From 66864909de6de46755e1a61cab534fc284ae0d92 Mon Sep 17 00:00:00 2001 From: bmiast Date: Wed, 28 May 2025 07:06:44 +0000 Subject: [PATCH] changed dnsmasq-container -> deb1 --- doc/main.md | 61 ++++++++++++++++++++++++--------------------------- doc/main.pdf | Bin 206078 -> 205731 bytes doc/main.tex | 51 +++++++++++++++++++++--------------------- 3 files changed, 55 insertions(+), 57 deletions(-) diff --git a/doc/main.md b/doc/main.md index fe81e59..30c79f3 100644 --- a/doc/main.md +++ b/doc/main.md @@ -26,15 +26,15 @@ Before proceeding, ensure the following: ## Creating and Setting Up the Incus Container -Create a Debian container named `dnsmasq-container` using the following -commands on the host: +Create a Debian container named `deb1` using the following commands on +the host: ``` {.bash language="bash"} -incus create images:debian/12 dnsmasq-container -incus config set dnsmasq-container security.syscalls.intercept.mount true -incus config set dnsmasq-container security.nesting true -incus config set dnsmasq-container security.privileged true -incus start dnsmasq-container +incus create images:debian/12 deb1 +incus config set deb1 security.syscalls.intercept.mount true +incus config set deb1 security.nesting true +incus config set deb1 security.privileged true +incus start deb1 ``` The `security.syscalls.intercept.mount`, `security.nesting`, and @@ -54,8 +54,8 @@ wireless interface, the following iptables rules are applied: Install the necessary packages inside the container: ``` {.bash language="bash"} -incus exec dnsmasq-container -- apt update -incus exec dnsmasq-container -- apt install -y \ +incus exec deb1 -- apt update +incus exec deb1 -- apt install -y \ netplan.io \ sudo vim nano git tmux mc zip unzip curl wget htop lynx \ iproute2 termshark bridge-utils \ @@ -72,7 +72,7 @@ Configure user access and permissions within the container. Set the root password to \"passroot\": ``` {.bash language="bash"} -incus exec dnsmasq-container -- bash -c 'echo "root:passroot" | chpasswd' +incus exec deb1 -- bash -c 'echo "root:passroot" | chpasswd' ``` ### Adding a New User @@ -89,7 +89,7 @@ sudo useradd -m -s /bin/bash -G sudo user && echo 'user:pass' | sudo chpasswd Access the container's shell: ``` {.bash language="bash"} -incus exec dnsmasq-container -- su - user +incus exec deb1 -- su - user ``` # Setting Up a Veth Pair Between Container and Network Namespace @@ -97,16 +97,15 @@ incus exec dnsmasq-container -- su - user To enable direct communication between a container and a network namespace, a virtual Ethernet (`veth`) pair is created. The following Python script (`link.py`) is used to create a `veth` pair between the -`dnsmasq-container` (an Incus container) and the `ns1` network -namespace, with interfaces named `vA` and `vB`. +`deb1` (an Incus container) and the `ns1` network namespace, with +interfaces named `vA` and `vB`. - sudo python3 link.py -n1 vA -t2 incus -ns2 dnsmasq-container -n2 vB + sudo python3 link.py -n1 vA -t2 incus -ns2 deb1 -n2 vB This command: - Creates a `veth` pair with one end (`vA`) in the default namespace - and the other end (`vB`) in the `dnsmasq-container`'s network - namespace. + and the other end (`vB`) in the `deb1`'s network namespace. - Ensures the interfaces are set up and operational, allowing network traffic to flow between the container and the `ns1` namespace (or @@ -114,8 +113,8 @@ This command: The script uses the `pyroute2` library to manage network interfaces and namespaces, and supports container types such as Incus, LXC, LXD, and -Docker. Ensure the `dnsmasq-container` is running in Incus before -executing the command. +Docker. Ensure the `deb1` is running in Incus before executing the +command. ## Configuring the Network with Netplan @@ -124,7 +123,7 @@ address. Create or edit the Netplan configuration file at `/etc/netplan/01-netcfg.yaml`: ``` {.bash language="bash"} -incus exec dnsmasq-container -- nano /etc/netplan/01-netcfg.yaml +incus exec deb1 -- nano /etc/netplan/01-netcfg.yaml ``` Add the following configuration: @@ -147,7 +146,7 @@ network: Apply the configuration: ``` {.bash language="bash"} -incus exec dnsmasq-container -- netplan apply +incus exec deb1 -- netplan apply ``` ## Installing dnsmasq @@ -155,8 +154,8 @@ incus exec dnsmasq-container -- netplan apply Update the package list and install `dnsmasq`: ``` {.bash language="bash"} -incus exec dnsmasq-container -- apt update -incus exec dnsmasq-container -- apt install dnsmasq -y +incus exec deb1 -- apt update +incus exec deb1 -- apt install dnsmasq -y ``` ## Configuring dnsmasq @@ -164,7 +163,7 @@ incus exec dnsmasq-container -- apt install dnsmasq -y Edit the `dnsmasq` configuration file at `/etc/dnsmasq.conf`: ``` {.bash language="bash"} -incus exec dnsmasq-container -- nano /etc/dnsmasq.conf +incus exec deb1 -- nano /etc/dnsmasq.conf ``` Add or modify the following settings to enable DNS and DHCP: @@ -207,14 +206,14 @@ Add or modify the following settings to enable DNS and DHCP: Restart and enable the `dnsmasq` service: ``` {.bash language="bash"} -incus exec dnsmasq-container -- systemctl restart dnsmasq -incus exec dnsmasq-container -- systemctl enable dnsmasq +incus exec deb1 -- systemctl restart dnsmasq +incus exec deb1 -- systemctl enable dnsmasq ``` Verify that `dnsmasq` is running: ``` {.bash language="bash"} -incus exec dnsmasq-container -- systemctl status dnsmasq +incus exec deb1 -- systemctl status dnsmasq ``` ## Testing the Configuration @@ -222,7 +221,7 @@ incus exec dnsmasq-container -- systemctl status dnsmasq Test DNS resolution from within the container: ``` {.bash language="bash"} -incus exec dnsmasq-container -- nslookup example.local 192.168.1.10 +incus exec deb1 -- nslookup example.local 192.168.1.10 ``` To test DHCP, connect a client device to the same network and verify @@ -233,14 +232,12 @@ that it receives an IP address in the range If `dnsmasq` fails to start: -- Check the logs: - `incus exec dnsmasq-container – journalctl -u dnsmasq`. +- Check the logs: `incus exec deb1 – journalctl -u dnsmasq`. - Ensure no other service is using port 53 (DNS) or 67 (DHCP). -- Verify the network configuration with - `incus exec dnsmasq-container – ip a` and - `incus exec dnsmasq-container – ping 8.8.8.8`. +- Verify the network configuration with `incus exec deb1 – ip a` and + `incus exec deb1 – ping 8.8.8.8`. # Conclusion diff --git a/doc/main.pdf b/doc/main.pdf index 3b1afa0055dee9eb2b3009e298bdf20278fe74fb..b291df19c58eb2dfb610de72338088d713e650f8 100644 GIT binary patch delta 13048 zcmai)V{@j@^Y&xgw(VT;#@23ZY;0?jGuqg;oosB|#wHuvw)6kqzc+9{o2u#R>gky} zy8Bb}Ifhg?f)qyu0pd<%C!zxm@Ftwsc&;yNw&OG4(L2Ep{|+jyDwQSttK1YmTOQ4RhHQyegiy%P$xjW*5xk;ReS5>9BbqnN`o)mTrSbhSkR zocPm*2I^!Gnq2x1OZ@;i-JL6}WvgtBF$GI=_L|upe#?p7;SQVblHD@Ycc(39L4&9i;D6adPI3#i#`&Omd9T9nb$}ZaRA} zCls;GbU??pJnU{Ee~_{Mu{bo&+%LW5jbQ-hJu1Kt{~F`L>tM$!v+)>>=wc+`kWH4I z>)9KXTNS8fj}0RKK?0j3spO0<^jli_ZKZYC_o}k_v{xYKv9`s&ZNn7Bi!oc*-@k^W zeoJ4{s7=3S4$%QH+9Oo9KyoosyTF9{c*dIn1=Y?#F0p3K`Glgh1&g;45L?5U)nxEE z9%OfD)pSX|-!}^z%@%2{H6#AGU=ALnne@w#Q1arRpsq71T7E>F4L0FmcF%@g{Kh(| zF*+0MoUS4<%5LIML>bEf3+WH@)XOoUtE zG$GgdTmC@<2FU$ou()So*e2?y?8@I>c?EYV2lOAOeUwy0j1Yc7II^$Pe(vSU(88H7 z;`Iga7=-MZ2`1-*j8~z?Wmr#3;l}YDj;$J&hhPMK7$&1>5;pZM?Wardwo~YMY!TW% z+1durE!f|X^P9mPbQ@!f3gc*iF2Ogy!@7lF>QxM2!n1#ec<_(X_|(6n8ZPZ#0zGDl zeV(?yY{KWhAMl&FXZyS7SK>$+@V#IO_%C=Njyb};M$fTXDRE;)YlB`x(A8PJfq{gw z)?Ni9Dv1ccG}1=c*+i2jV_j}+iJt4#y$WRPzhQ2RjYFjR%ORT3lad7WQ7iV-b@IF5 zV1{u3g$?QrlLTLJO*jTrB$wzgE%jKX&Zne~Z2UxsL>mLgCJChu z@3}I#K8!9zm0d2qunRoCLK6y?x%F($BD;Ky@p<=0Mn6Zg2}wdHR~Hm+ZHYz{3+Q&@ zPIoI$zSzgyXK|w@goLVh4|dF~G*ru!Nv9KlnLMdMaDF$CJM0sZecE5nIPOm>CZ7S> zpQ4`CMz)S6Vyy!=e|2?Asot9gh|UolLHgU11UqcaK1WC%^L<64BBo@la8|i-X+>G+m001?1Ve`*t(KPU~yIG$An_x5@{A zU7sOd&R!U#Vup)gpHs5PaAWbSnQ*VOn6hiYQ32=@+)-#(d@57(Q;)=mo$xq~njyGG zTFba(j@_Z^aeIhTxbJx4S0F>}Un}7oJ**Mm{-=&I1Q<=)*WiAUNF8?Jc*ym^`v|Lh z?NsjHsl4kkw4D;*LH-{1h=v8qxt{?*>hXkjYr_NQ1KYoIK_znsgHpDSx~rbzVFz0N8Qj?)Uo*e8MEZ@fO% zwsGLRj4-@*tO}TRqs?~d@%^;4uP6 ziod(a_pt;fiK^_oz$u4NeSb@p-F4P;qNmk zYmv%54gU~^{nG1HhUd;vEbMobLpbUirq1_cIWE>lgoVl^WpNrCwrh0r=^MW*gaS12Z; zN;);~X00h<=wF|2ySQoQ7Foa9Bik}Z)XR#&{6NJShLQ{`l=|e%{v3oq?<%#R1@bt` z;%Qa@m*@-Rc`P6Q-@ii{wQ!+Xcls)}Y4Onew&MK0y($;65xH#L;kGC}yQS+|T>s%1 zjc18}BU!_qw>hV;n`(D}PXEK+M{IAjU@sm3Q_b`~TLrXv#33!YsL& zYiFqIArQO$Q~=&o(ECn6wki1SH!du}B%Qb>(VKY37~-34P1_!c_TC)c6_^G%`#{of z;0(j!MuD+1xH8%BcGn1NJro~p*``4~CYc)f0g6v)V|TImw!Ark^4pJ0F*8HO3ze|I z_WTP45s_&U&I)BGEo(drl#E&M9mYyl9Ss))1!};7ktd7mwTr>hn0ev>?;WERx0cea zQPcQo)o3E}LszamI+Z-HbLM&x_7EZd3<%Zq&keGzJGI1UbTO`HbFD#Io7BMl>aA4%be*BnzJ9&7k!m+u$&Ydcfb9VK{vNDIkT9 zhFu9lhw=iJ0Ftb4P{JnaaLxg_7a!-pZgAwQiJR!vA}wz}El*9xrU-ssQ9N^S2nMaL zYO&9PMZKpy4JjFWL4i9%`oHCGtl1G$uSqoo2%bp7AMrf%F+A>ncv_bgF6W_%gRd!} z%w3QgxS4Y`qhog2{JOOS$}@l)L2va!Q?Qj$)BICaWX#il_y5eY4Cl(TNa(JLeqj$| z7I}GGDq7ep>T}092&{kQ33^6m=(qo5K>0jpl3*vZ5BDJcnXyPGxN7a+)^`si*TrY)$WJx3l3X|&GhlD<1`@fZ|?en9{TemoIF=L@JJ zRyCZd;X%&}Jucd*Q;|c7$wfa#HL)hi**atvz^~fa(yp-7`JSBzvm@H-G(SdXdw_TK zeJ&OsBiUdL{aUXQ7~VAMC~!XVa=|OZ7;LnOxDkAvGFHHo+$1`5{aFBV-3nK*DUzg( zke@$BiOlq2a<#UtiN^s}5>0i#p9FcUTiQ6iVjr>bcGq@G%cY2bFtFDv_GA=d{h*hs zk(+7k(8vb)PjDGR8eIwu|GS|pTmp%qIs4OYLbtX37S7LY6X=_V@6>7K{^Ni0~oXO4PeceD(Kp)75z2>X~hT%K7>N^Msn!`V?5Jwy6q)hz)Y}i-5Ws z)u-N+h{d06S&%Iix3SL{0q9^P0uFsU9aRPvFG2jvD%m!^*@WI-sj-9cg8Ldx0w`V$ zM{WsQjce37v(EsSA3_Jy>2ykBMY~InWE(;4QLNQR83`-m`VUoJ_0GK`ez~5b_Pp>^ z`?74`e}?Uhp8pjH%$RVDRlDs;Qx2nt6H^Y+;KMY91xV`zQLe*GW}i?Eez_7HIWYpo7O~n-C%@;Ra??#9&BYj; z_=58v9z^HzAJ}9KkkbB^e3Q*Y;eC4Aa4ow&nI#KJ9cUKOQ~i3$<$!`eF&%1Wriiio zLh;dn#LE~_a^ni*0Mp{5_U8cea=M&)@n3?3IQ~yx#Fjza_a*qSpx_NzM6c30*ja26 z*UX7q7|#)$KJQn(&s(1;-li2DR={PLvG7>fLSwvEh?ygIK#ftR-~|9!t~ft zLHbN>R00`z_kqI$JMB`vh4P=UIM9a8K3{MNxK&%ddr=#EVN9he^VA z008B#r4T@9;p|1Qt;U1LFDG0=EH zli}{2>eYa{y!|z^SjEn;6Yu>q_NfkwfKiSNX;x1JFy->+mLJ@V5|)vq^y|f(j}MSD zsut!rJ@5*S<}f)}*>6{bkQ%6thj)^e8@19 zhWi}Alyr8Mou8g#`Fu0{@mfkq+65-%yuFkEUgEQ2EO3=hhpM7?WMqgA`X>_w0u;eA zm+W`?q0*|G?V}Ze9x4Y$?`za(UnwVb+ulpgocUqDwhbmv1i~FRQ)rhnlU6IM6jHgH zQit5n`Y(iMQo`SGX-~UL#9*cD4L8^{ijQLTiIE5yiR0ih9Ni4`tr zODPORZ0IK=_Ly^`j+7{yv7O9;`#&0aw2GHIpWHedJW@QHMUEzXB^95V^3URnD0p|f z>NVl2$@*(k00Uy&z);n*A6^!*n|0j$?oIMK9>YFx-$jDOhabcrEU0XC`~s+jXYvW7 zO(P=Eu?RXk1!>4b8)jCOnI46w1#dte`F?EIm4#6fbf`*b!h^kGp)d-E-5pwB=>uOv zZZ&(Kh#iEjKw>!>EjV}L92x_#q$3}@2Eyoms+qOh_%?a?#@<48_YEd!=-eKa?OQ^S zNo7a0yL=24?FrB`L_s}4JeE?`wr^CSM-e#`t1gK{pRrEM^>Pt0e00PJqnuGIp=*M# z9K|sRpIntwy$KYJ5o~_ss8D1ncAHGmKEqQ~$u^IDRe!oLiE_r{O~CB1VK*)NDl=_f+@X)?lw><^?sc?SU-_GiOp!w)pc%1m@hKhK-CaHJ0Vs90TCMsP(l-=ghxMne> zn+99M1XI<+bBMQ#r>WYdz1*5No(fh>2XXi&@M$?SdT0BZbls7Kmt35GGV1)uSz0E0 zsbr0~W#=Gd8ea+LH=Yz}#CQgK9-0Xxd*n%Ads?Oc)=}4hHR*|T zaIE)N1%q5QGt+U15Zvg7Xy%D@?O?8MgN~fI5+52UvmQWF<$=AFwL=T3P$Ih?M zbs?bDg?$kDje?42o}SA%wyWi@g>B4sLL&_cp`ilOI89e6q2K9jy6Zg6RY5^awP$og z!lUwGWHJFfV8v5wzZWmt&XtejW_B15SCMNde+Q?;x=+P*yGGrCGL|C}Pw`!|Qe z@{PGc+M8U}6@Z^=rPQl5ZD^MS(Hp8&Iyc;z=G)fQ%!2#{ps0%R@-w&Z^l;wz_k6`w zv$Qt(=iKkg6()}8I^i}%R}`-b2`ojM&v<)nr*Hr=dnVi!<96Rd^B4w)bgtlZG+C@F zDX=G1s`AGUqghGqAUb$~Fx=sNZA+h-xm(jF>z>>7&}-J{b&nV8E1wh{=FjIfP0u%m z&X>KbT*}|=-n$lfTu&W{bR={2@+;kVc7+qe)36i?Tba>tvN2lZ0*66bGW20ZuPfH$ zzBvHw)5V}Tk&2O|bSER5oae1BOhfJJa-BNnI4UDucm|>#bFox%Zx1w-+}DT)BmA8Y zeKn3lB#~G^=T@p{o~kMt+82x|8d4N^gb`A2)S0el*IJ1eDa0)CGui@8b(uH$z z3;GCVY#(9T79ly?le!ApXvrQ~1>8(y1rP8PpBf^qF5asL{koBRv*eBJ)JEZ#qrHw4 z%!{VsO<~-;xd^@))^Oq)o5w3YuuYVf(-7T|@VATP94u!b0Z3e`%oH5$%D08zKfTNm zELC3HgjTodx3mcrLAEz5zMHe3*3eL0L8SBD(QubIyVL!L&%mYo&+9*7!O045(*{nq zT=9cWavOKN_`d}3RvgW-AGr*sZiP?ZwzjGhp5ktA(o}uVeri@0Dx#@zPNNhVUYmpi zd0cWMS?m}4vA<(Gy`AqzR*NbWT(%$*1Xhc( z6+#q#{J;`Zg_9&-^nf@ZPI>BP83ELAcE4PtmuQ(<287MQT}K;PpV+O)H8Ib{ND1d& zJ7cF*c8oSKo$yjw(^GtFry6$w*}|3t;VNW>)(tULdO zl9OI6Uht^C2pj8Yd~-iFC-=ugP>MRd>)-o{Kd_@}x$>Byhl;{y<}bK7vX zI^Hiu^BLALvEd}kh;&a<#!}RBNvxsUa0PYxhkMN`rm!Os6C@+++{Mqn48(~G-xfpa zgH`l9ySUbaz}t(_8BXUT$<%9`lJC&6m`w3RPs4WD`!F%lTnq5)N0bWw(F?{74PhT+ zoDiM#mdF3dmiWOL_h&}8;2OyM&T|#!(;g*CBx=!LKtA5h9P@L~J!WdRjwMGj7q6&J z!b->?F3}7Lb>6vP@3cf}HRAi={G-2fG+`U;`r@CsO>$=C)nK$i?M*j!>Rom(_NZ)) z;QI8H|6-2Hb`RFU3CW}Nw^&n2E_kb&Oa3d9N_RfO zG}^t2P_bD!vI1+I{nPaP(TU^dbFtnpYW1;%Fbj3kyDYPY`zx|Bl1uWngi;j6lm^LZ za(ckFKFWBK>={HzysT6!luv*suONuP^pxF5RYX_HtoVI>E31VIg}yW=wOJ{ZJ&J(I z<@;dcQgmHoye_Y36kw~_+KxFK0(Sq(@Glym84NJrb6y@}e#*9OAQ{ehkxhqvP(v4z zkvAcW$E?k4YHlMdp>%4jwbN+tDB$n03E~h6r-7v&nzJ?ujJ1hECFmk#jR-*b6JPI`W0`bYI+A2s)5)x$fQ~@>SQE5R0F`)qKZm$d_!Uo_J_cqYQkU_4;Cw}a8Ap`=D2^9V3E8zBsOs+|$T zY_@DJwK9L+P5z4O&!0o&a{ZSN&E%Kkk~g%w7mk0<f>!;|VXP_i8*7_V);t#k|b1 zwmlpaCE&IT$YEL+==N-0WaxH1Vr&n!eZem$MBwq*6cj-V?58R%zWk-6Id#Tf4bS)u zNkRXfJl}cm+8)){g@l{oc(a$)YcuCkvg8wUX{xq5M&%*n5bsCAQr7UK9 z?XQ}xx`v^Mv-Y-Y#hz22c-;v8ylaZstfB+iBAx5Oes3amXrBD@S;|N@RM7c4Ia@hw zj(kUlX*dgP&ORsjAOD?F(Ix~T+G=V5JU*C?>7bLz`@f*^#^0x)-vR>53WPbtoErr6 zG}?i*uB%!-({z%9yC8RFygGXWcVYeEYg;%YtABj2UpwXl-*Ia2Z>NXEH?+5!6|J;o zkYXx@-6~+FkFLXSZYOU?$j&RZTfz(ijZ+OEV=aX!r1Y!BY+`>ndA7Z0ucW!qstTQ4 z;XU6#%UeQm-T_KA6*UNE_CH-*oz0Bx5X=%Wi3lM%dD#Ak5I1zDT-KT~dfsZbCp%O) z(W99$n6E%G{sV@RjEOmc`yGroOe!a2aMQUP_YWiR7nPTF9&1~@Bf=W}ovwm~K*$ORqJZdQaqg~R0 ze&%xb^wL^KrLrcHCzok@^B_lWEF(qvn0aMoY|nx%fU@N`Mu$FaZdiMW@Ck+f_vgg< z<7rO^1{Wq-AI8BVJAA&-hg6_p&%*yYRo}d>U5K72yujTI8D{BSe;J5(jqJEyDAoC5 zX?88CT7*>kT_iGa`5LCE`A7(yBjXS4MMlU7Q6e`aHz>8iS|v%G#By#vy5go6qzP6n zdlkT~pKUqTsk5iMV_aB?`GC)|I{8JjC|@uVIdDmgd(T$*O1)KjoaWg$Ld2h-xXvRT zS4O-o1Xbr~+30WJ%j56?^Srjv3+s2UmzWoxn1L{%|1ha{mU4H+WVnN+V+fKi5o50-suZ{gQv2uL)VdvVSetvv-#7jEQ z@|_S|iqGVsi9Hy>XXi9`?)CmO7Ei3@wb1Ar5w}{YZBh^s3*`w}Q;4JJ*&a%Q_AV_zgspzc@(?t5gG9pANYHkQ)3Q$Z5J?*&JE*{q}mi4i>YFMyeCj6{J0 zIngQjyAVprf8N-%MJ?~S4qfSb2Cus=f8Ro@a zH>G%G@#UHrxQpjEF#+L|rBY%uqv;y&E+-LQ#0I5m1|pvqnJZp332()8iolUZ`aRQS zHHn_*sK$$zA@4n6=8@!swwbxWzD}{&(YS*+=OQSpZJQ$Z*cqM!tiSX4aFQd$+@TXP zg^Kv>CE~j8%$7d@iA-;}k66v;0SfBU@lwLkY-ex$?Xan#u*LAyycl^<0zY5j!^z@U z7`d&w6&VVb+f!X4Ut$PGMWLzR+k=<3nrGd$H!UP0^3wDYSQK>gFHk(@pFOJ!UXsUd zKgzb{(Q-RFwVDV??my$s2GgkeBHxbBn#Tf`6U&2agaU)%T1is{ zQ+sgL=Xto@ekZraT0NioGM{^Py)fS$T4#L-sALBTBT#zS4~uDzMY3CjV`V1JhmW~{ z?EEnaIA2Qi0G8!YDGDy9sH>^>N4~O0+npv$3b%F(qN4ouEmK4@!bQI8crEW#M!f<98vrL4~LHopdU5>Y+pQis_upXbfA zxm5R7hZx!k!kFUk)OxBiIk_$bT6HB_{Du)9#jgnprn+O+Q|vqp7dM!uCPH`3@N>Zh z1Fzn9!I=bKTx@LXNZ*;?-yd01Vlqyfn}D$gnCuT}6vtLFrDNNO=Kl6n6pn7!R=Y^I z4zGPQ?~s07V8^X*E!1#g7%?gZdIrOR00o!|F&x6iBIS%>tvFt|hjSr-M&h!@aJsS*q|6f8m3b2cHR?E;mWofR}^1 zQ6`m~WX(fQIP`_?h$g+TJLug{8Q?Q%6ZSA&S33{9e~?%2lgim7OXmn~Q?mwnR1}dZ1WC_Q#qGR`;9cF`ed+(8eDF7a|#s{kU-j zJ(mEY;B`FY=6xBCpP#ah2F-XsNk<_gE(aP< zy>N{wS%loK2gvS=Kt_2cvkZDeW&+JLhD2;xu%jhAMmWM?O$i1a%y~}clHCZNK8TWj z*w=RcgnFjqh>eprErP6&da$kVj@V?LX=r?2>!>tkN532F96J#_@voPB9gq??-78%P z$zavuE^lNs!85>6PeMV+CL)s~6>#`s?OU_45K~4EHg7jCYplm3%bB%T!N67&WEby= zm?;*IX_OXyTaD)x$q$Jj0&72E?)9V2Z{(=eq=Lh@dp$ATuR$I+dDfZ3>OWFYZ#ts% zmMYw*lFkG-bXw2aozY3%Iao3CS(o8$*0)(VJZIfCil5XbdoYn_ByL%+!_PP}S? zE`F*EGJm&C%Ms(U;j1Hss`v)eh-;r47Ba8ZO155uw>{Ne zVJp4Ov8%luI)o&IW?))(_a^_OML$9`@%tPFgFe+mwLEfIEI;;p^Ak0uj23+UL5L?s zq>ON30txUELW%=#hl`&iY}6}pO*G?~ejcrqp~?4BLn_z-PUbq!ANR4&W@YamHs>mZ zShwzepwgm9wP~bQ`|jKb%d`p75TQdqk%vmnDNFFiq(88101EMf>jc{TvZ5_VWb)Nw z7((rFH<9VECBv_aok3H>Osm0*-UK+bpJW431fk&$QGVVS?5;wPK$av$eFax!%xZ~F ze$wh8^n!)oNu)AdCTq(>ztEdiU0af@I{s2#+(L^X9SM8~ zQ`XC8*c!DT@TQNZy>}%$87lozZ?k95ct>>vd0({~hCMoPwIp%lCZxtiBIX+A2}^&yl)t^1seO>tUHuYL-mQ~lkl@oJPRXr z;cZCe4d0ZH)iTOHDnEA?$IW3_$%^X=@!C`BH#UWS_7B|Ss@2KW2CXoLt}uePtS~~5 zT$1y$@o;eK&?B%aI{cI{b~PiTli=rI}wSb~cXxW=VQLd(D}U z7sK~RbK9w0cDaM7?|pvxUAlUOZ(u{80Q@zUk4~6BigtXpu~W`(H07 z*&r(}`%-0Id!iwz#7PSUf)Xl&46747DoA81#OQ=ct0cq}t9_)2XcIY3ho92<(Y1l) zM0To0f;ulmU3r+aX&U!ZB*;xbAECPQMS8OeUnggYQ1ofK>acs%&tXvqE>4o^23I>yk?=K>U-@(%Rfr`mb622lNYRcPEvmWXt-Fc6MeOy zD&YoH2!t~`O*0gtG5bqafn&44LoTGH&y!NNZ>ZVzw90r__+pV5VHyKbbb% zmf-y1IWKK8EN~qBM>VwSUy9ldsJ&lRBhOwhZRV+WPNZB4tK1X!TgIzFcpe!qO;Yn#J^SC>^GcO5g$| z^4HL_*0We=BDFeZ1)tY?Y}d-@EY53)*NcUwFig^EoiwPCyhSqq*pfrjEjh`w-ia4$ zr7`u*QD_z$Y-xgD34}Wxw3G)UkoDTKON9*znwEpLOrkv%k1Ww($`lCbmGV->>679s zYCJZ2$sakZ5>N)1EeAz6%Opbo+6FSQ8NsL+l zTVi(*9OtZ+3?Miy;MS|Wqrtje4_+lNatvu`3yx`ZPQTc#pwuhFVb~vbHEmp>+A9!O zg_y6;+GX~jSu6}F9(1FQV0ZKSo7arUBStkyAZtq0UZMoh>-6hd=PgQkGz@}SVIr#j zH_0Z_cvCmpoDMsiT47=8q)Gl!!NHGkmO)2{S)b#Mo=3vv^p2Xc+68B2ac58nP%yp= zf2FfX04cjw1<;g~D|M*JtPmV%y)s*!)0S9yht$m{1CsVUbeYv9xB? zLCAvBFvTyaXVHfZiRwRPLy(N4Gl&{sS*Dg61(|w|uqMbXqR$Tt^e=fj( zX!BhthdjA)htobT?4nR#p%~t8c74o@O*EWV2D_$*M$rM~TGtwe6I5pR3Wo-Ud7Tx7|_GO_EdZtMh)xiJn>)R@GdB`jB) z#;>m^KrR8kxbHd+Cja|aq{u<&dzi?P&?lnELCp(3Ffj9?`x%4#9`WSWL!fRdyiMIh zvI~4+ZnjQb6Z%a!^sH~Cm_l~_vfQw<$ow5#`OcrD1QBH*NJwaT?QyVU09FqKUR+HJi?nh3L5BkO_M^OX@Je} zQ)A5OC;AYZh*cg;sq=xso3+iIJ53jwb$5!YMza1ONQ-)Iigyn5Pu08J=T)>8`tuAg z;z9&vMxKmOt!UW7N8_E{A%~tElAzzIORfCn#VgHlIs+(;qYLEU-*8|}tX4y82LclQ zeG*~afssMj4`5|>0GIE|jF-G`cy^lt!a~AbG9d%!7k9mKT1v}sum8czmfH1K>Z{Q6 ze&=GIKRSLh>SyW=_WJ&ryC`R)jd-Y*4-Bt>g7nZm&U~<;VjS~X?Ku@+HFKs$%k5qj z-khMW?xLTe!QbJA4n`#YPA?Ki37>pYEUd)XgGM{= z2Rj$NP2X4O|D8>al?4b3g}gmVym}BB*^pIU*?@!Pfu@_TeH) zIR1BqOWyq-M!MODp}O^t&>h*1C263h-8U-WlUBeqmdN=SQEZb?x- zE;bOC6fYN-s3;E?I~y;EotKSITuh3G3&bueOeXmMHPJ_4RWP%+aJ3|3=i^8lB3@8<{Hqlnk-luzjL( z9z0$cE*Xss^u(ztpp&D(GDAn-WA&*NK@$Nq)H(FDy5i2V)fGrsHMrZymMWB540X7V zFSqi1I)efPd^mKK{SN7K1m}h^l`lL;^KN!V_Hn;LKX6-8m#82~5ja2~1ZrwYWhsRJ E17qAbSO5S3 delta 13394 zcmaiZQ*}hw!N|KWMkXO-S6D{f4*mR{GAqbbo=kdw zsP@MX6E>mHc08_H-e-JZ&ROabc9$W5T`mn;ZYOu1(%--!ug90xYLI%|r8a3&tOy)g zl`=~^sfn*6hmvq{RZJ(fNmenhcYP`Ucfw>Zb*HrotvCmJcCq%i_3D&>!FL)H12m@;gkYNZNN|vghZ?-FebqIOBB0&A3xxg_0<7D& zN_3EIUsmcyawo&j@uiLM_UN8%=g% zfCc;5Kwo1IL<7L4_q@CXOl{W*&a7L`*&o5UIb+vUh0S@UcYM}gbKYtbRQbAX42rZ}sqZ=kG zDQ1YBL8d%vW~t|L_~l|r1#eC_$`0_;i?;n^y|{I{cZU-C`U zZQG3uBO9;`qvQ!o*n96i$_6R2tV%pQcH%jTUD5-uE$AeEBe&6lLZQVDVl8P#n8l%a zG@w_l?k~pYqjH1wd+|bU6I|T~lDYw5OF?zsPtrmig;dxQpm?$tr zu2JR(x-o%}&vnticE(enIeg_*GOOZX9=!*m&XQHYE#X@mI?yck(6h_-{74N1x*;{d z?zw=jOOQ5*!sXytw-lHTnui8?p|@4O3DP0`=TTD15JEC=-oSROXVjltjU`mPMeC`( z0$k1^C)OQ}LN22Yge;|e#_hDjIOFwp5ucSWejrV^1_;v|85j8P$j_ayw7`g=6((z_ zWfSS}g?Q^ZZiQiE%X%yX^%`K`2M)eas9=Cj7^+nGmpphRZ#1Fw*=)Ln!7SGA5@;D` z5x7HWjaynR<=R;R|FUtsoq=bO5cY9;|Bf(0F8Kj$(^TD@uMS#b3zB_q%9PD9vXHmO zK(N~%UUQk>?z$&F$FvN$)6f)DYb~Y>3NfJKDAEiCr%uqaNaR;Wv~g*HnUINaP?LZfh^>KfG`0|uVm4eP&1sh6FQZi~t`^Tu37mR!sz$n}a6T;j zIPkdber89E%3C9Tubv!PASv1V$J8I>GvE7Tm@#V>#7n~tDT5gnyDuk9@oS0m6YMy5 z=jK>1KL{7kzx`*qO?=bc6tQKr2B?6V$A^IH1croK3g2*77cMO@Qk>`g)_7nlHm=xQ;Sqeg~TXF@>9T_q8k9>9{k?B z#Xm+V%pw`+<%O4)*uZAIrwut+$&PF6g**^YHOL&eA#y+pu{qaFJaAji0~V+lk_T*r ziPYlHVS&;~GG5wPacNFm>xM%sO9*2HgyZhQjiIjlT=9i)ArVJh!DDTcV@#=nuqsn5 z!Zke5Dr1ve5!B}UX=Nm3e-Qz)xk1#yN9^%tZNl&7!gbeB`5I(G4m&dvNoDu zs7mh5F+)_Wj!!YUB5ovq(7v(YqDM_tUA8uGYlY{s8ZWtc$ zoAP@na|{PLFY&O$d+49GKPo*C?a@Xz3PUfSpWV6V-#n}A^wv4mJR|@cU9EKLRcWej zCs_-2yp7L(QN7pCdU4$7A%o7M%#6=g6VN92fkhiFdbUM7nAY%#L4L`ZPDTy0^|SDj z0$+;ntrhl_sX7RD0eaxrbhu!WJ2$*0prp@ZQ4|~~4cRb=bg^q6fmU1;Od=D*FC; z;nZNvy9&^~#W#Jgn5XceHxcPOJD)czJ7E1SUOqV2)#7wIi{c^WJ6h0W5|5CVz^aC*Pc6iE)KxQr)xUjeA1q7-Z3 zgtgyK3Bl$dT#|#PpLmd~`2zcfH4g1O*2 zco{@66dRn;XM9_EaiC(xHZv>rq#5LN5iBIJoFoo;6JYL{Z04=RP;$^a8I+pxWJ90} z?86abO5>fV~k1O66zHoSWv;VIYtsGq5({19%dBL8qF!LAI-SFei3pWxOB6{fdQ5($H!z-{z?c ze`q=|td92)e!(Dd=kXdF9~$K>Gb?YZSYwd~1ahWl^61APi(o~K88At3ZR-#v!{IKc znCd!Fp~p4U%0+-W+j7+c2^s~ez%@xg@!Ta-{${xc4!k2Oze(f?HE6ho3=0^& zr!C>se1MoNz?gA;#fK6aZHIP!1wMmUt`bJ|k3Y&!{9bEi-bd7Q?@=7+?3x}v+LX1a zx8Wycv$BIS%!CzL1Vro%6ubTa z>sw&llM_IHcOvo0sy|Prn}QaYV8M8|BBXlCnhf&k0h35i_-OP&<|$ry@`NO7tn>IS z*{E^drkHwZKa1dk52TE1J&P1}B&2W5I^G~ZyS$;{d}LBW0#eApX!lqq2jouXac@;k z_c;jzIF3^w3NUBqDQoI|`&l-wQnSrF?jHPpu4!JOlmbm06ZQ=x^}LRF+wH)oWviJ& zod3=+yEEas7UZ~Ee>)D{Za}bEt#X z(8n?pDZ}k90pw{$#f5B2zV>B)offiWm2Z#py|=*5!}84o<-Aok+b~OqG0{k1sS(#C zQb>Bh+wG-750v8+4l2n0@n5D@G~iQtO7?oJ(pM>Jz9l}(IVTT6+bCO-$FY*Y`B2B1 zlA&nRRw51r+xa(p4ej_jRt)=DaJxrsz@6gmCFGP}MdH1?(StEPQaV>U z-~#>T19%C|P4y;&qDvxbs-x2`cv5Ebve{@LpFA-(yyhPJ#Z)H>=uQ z)5e&CU)fw_70<;i*@0Ze7rUv~?FhN_QezS$89Aml`InVjea7%qe#xm(-Cy51zcE_7 zL=1dHh8)osEU|0ms3pxE68id4G5q;R1{AkxKzMk2NXK)<55IExTQV^;;i!C==<;7; zUH9$bvl2HT25tBa@FUSVuM>tvug6XBWl>89%(7W>i5fjFS#=^k;;)0m%+k`-cu$=2 z4L$We1|6d}*abAJ^>q&vY+l~I_6l4br!=LvfOSfvh(p73XYmQLL#(;YQtHKjl~270 zh@oavXVF49RJN~Jr*;A+yivJc9Ffj;`{|ONoItNiYq{`gDN( z>D7AR80Wll##f-~hU5)Z!*H`0mr~mYh^Z>oO5m~iN?u5eftv-|(3~G94BR)Nmm0X} zwTG=ft8Bh^{+I%ni37n+uTcyJ1d3e_+OZV9+;U_xhni@`MQo$>9wX7b?oFX#@?Pamu93TXaWH;);)s^s?xxgEj>gdzwk zNl7$=**f!w72b`D&lf(mXLjSwPnpn^2OKvRd4nv$A}&cV;k7YnetZ7<@*o*%B2Wr4 zh_<*s{MRZczTeJd5RAl^BZ8NHTYa=>Kdmk|sjjMjm)t}<35dz)2{V7Zq^KR4&E+qF z5CZraWATT2B!=TA%N-YelH9Z3RR60@er^7>uzXM4VgNauW9kJ1}mZz1=D z!+VUP;SA+cLZ*<(CO3LXME@(dAc9)7k_zW*8RXb8u$_d zTV7AFKCrX5)fL>onkCwUx)?!U$zXOnG{E^!@)PSSdDg02xBCWCKC=D)n)6uNq1ZRz zOB@urG~t4q=*NN5e^3qrs>EGY<4+tgM@ZuFW_VzYB62*8xH83NgQ1`xbcGcy^SGV` z08X>gtyf0Y51*yyhHa!P)%jX&Aw6uAtj&0y!;Ef8{}AOG|A(mZjwp8wuaHp#MWUgc ztH$NV;3#i6-8T&zBcBV#WKcI@@*TMi@2N1a`M{_4+i72jKQ)$492G z25&=^!ng`CII~B_L>V+bZS!^#{mepDQr?hvp)>EvH+Hh4AmFlhY#g? zvTcn0)$Ho~KENySv6n$( z@Xz12M`GHq-f-9PB)4M?gFa0A0mD+|Ekes>#l?_K&&ur5qjCR^0}QO$MaC|={%pI% znkt~W7equE`y`WIJwW*~#+uk8re_9Nd*EF-Avc-E2=HvM zBp0IM1;H75w^Nb+lb??2m}|IlQ8aq8s5E}uV{PXwjDj0Em4bkhSTNh3Ht&LB5L3Ak zeeGM`Kq&m57@4Aq8Vg{0jNb&e()`WzLoRxzR;hM>oXPizH~}wOLc7-wNZk%J4b)n@V z&C3|4Tq8)up;H;7W>DyH=fwh{c?&r7Ek1GE+X}ak!B-17c9NkqyQaSmXlU*C?XVsFpUo2_Od|K-<97`ZrJ+B8>|}}Fb1XK- zBImn_AI%exD2vpf4$5_Vx;oz7M}QjrVNe6cHeO%o8J~IK`i$oqgI|j^LQzD{)0+mieh9+MM|WK z2DkeX06b2vAi+jeN+fxF1p=pPN3bi8sXhp`zuP1DTLuU-_eT5WI{0WB-`Ax!jkQr*5Z%)AH(zLhT|?_iH?q4()_2qSWFcZ;Tj4hyS%J?oL#W_L z0K}h_mS2yeWyIA!Nmlg~?ks<3ALt5LVy=K<$aN4bv7d#vEA3)5OkZDD5`LtOQTOBNZO{>U|RZi-hYA>->lis9F${yGG=u5G5Kd z#t*cBJe6I%R1LZ0ailScpI*49qp539t1sjcZ1}8-)Gd_e&`fm?HM+YB>hU$v7AYY9nxn!=6~)OF-Kfl^gWh*YgWPLEKmb>BB9uJuXQmxJGaM}3 zQqel*UjPAK`Fl5P`(@I50l6UMFqy)hO^jh#0_)~F{K#%y{Ksrh^Tv>qr2OWX7Cww> z@L6nRHPv#^wN2K3xsVI1DK$X4yE}Hq=Fa0bUI=O}wH%&5L+g*_V+BXE& zAdk0i!#L17CGN>)nVk25w$QuQQ5P}=K&nRf#%c=^5+-DceCa5A(F(M< zRTp5Kv_dYBTv!QMMT=A<6HbI05t;vsF~%#HZn7zawaa9w>DTYXY2T!cY_*P;4Gy!R zzcI^W@`TOd!wp;0BAYVgbwpj_o{)NPh*9U4vTo}wpuc+Mrc%BkFet8YqY}4wslcW8 zYhcPkk0`{3X1f&g_5Pfd;no==3pR)RpWCP~SxE%Zhb@^ET$8P0qT__|M-Ruu{mV{$ zVaw=!dObuj!PE}gub!MKBkavWc;IZO~bn0A3lVR!GH(dJKY+xW3GNs z%a?+fIO=c(az|gOTZo_9{M^bKsl@2)-ivUj5O0_@bV+@MH1kwph$EW1ZA_$x8KFO% z)}1+U&plwa`%$jRCdiaMHrm)i}*b1kn zk`GOB4xLj{6mePUSxv1r0)rizN6MeHU+FeGh6gOa${7Qo2Z8I5TNQ3Gj4+L&Zr#Fz z@X|AXN@}n8GUdvc8CZ$V1g(mMF2S}@D=|z0pT-ErOv-tnQzxwCf^nNZ@#KorxH#%? z^5g*~y4Ep=f(k^d*LZTgtRBIi5*);}=j{#5z~26;m+yk8pF+7ETkg_RCgrEq;%3u1 zAUh}H-aN6uS~AA{v@9nPXe<;1kFrwQa@7ml8RxzS5GLNrd3YIUJ)XuvsWy*DI9IrR zGoX04I1(Rl21CWptw=8?%Q(qWF*57#o+tpp*?JcncyQ+WROdKIc_&{XCsU|&F7pU# zr0*R=HsdK+`$4L~jUP}P4^+6kt$Ht(Tv-#{-(kTVBRdSdZ7|H=*$_A4&pc%gJnIiX z6pbQ4&Epb(niK=+X|AlWX8sBSUXL?0yaKHmc}d!XL5};6SR6=c^3}5uR3uo@L~Jq6eWDQ53b#wJ^auI#oXx zqP_odAf_8P?6lZ)5~y^Nm9hEC+rKh9W`PqX0PFbKo#{om(W;Z-Sj&I8Sdh2!7V-?g zJ#0Vf=MSiuZomU1e=ax}TT}}SIg>D06fUnvI(wcU$hY(CRF!Kj>gV8bp-2?N zh)s};#RK|cA*hrZsUi>58Fq#qg@`(VeJx!%aSFys3dc8baejUt9bG<}P@t1VC8v|a z%ZG1=sYG%V$A|dd5~K$yRYu#T0rVFXv{7aq8M2{DXWi8rT7WO7`;#GuHbK~QCh;6) zst^j58R$idKd&#|EJqZ%7IFyHy5-ZX7_yx+=BTeP8m$oqQD)mA%IY&B*=DDlkHw~K zgy!H%+9H6p*+^umU%%7rh6sI=vpEqt2_3MO=0nIgP$mtpb&<#HSai01Uy~_ZUY~V@ zBON*3V(2w)DFG4n6x2x{*?=pVIoSX(39Q9(GBE%5Sg`mnFZ&9teR0Bl4c)zTWD!MO zRA`~tA>c&Q9H>Ki8N+)2g{OGq`j~=whQN7TArN(aEv!;ZaFSA}i`gQU%n+r6-zL9h zlc%7YJ?nB(OHn>_-Cpnv>8KpULD ziqit>S`WqfHAfSbWQ+~(N>v?;tRBuEe`8=7lkY}@w8Vo9u>XLlmew_V?u-Q;15jY4 z?ITPN8yEj&W@^z!5C&F}k*Bm>L4Lgmglf zckB|uQj=W=rVUJe3@t0daw5mbBpMVpKF;oo&{Al3|i5a5}MGVoDSc~_AnVu>6j`C-H`YgD3 zi^nWbr=%RniBr*L!aX7ZpFz450TXu%Y)GYAD_yx+-t5C$Ll@j3Q$u6VM257Z#|`IO zIW#1x!Mm^C;RC=$x^&W6y=Fx$PJwpMBLRQHtaYLxQ$C+!kG)du^)6z)pU?EOKo4Im z%pl_~_=oYLbN%o71R_)BD6!mEqV8z(=ysQnGfI_Jjt9`B9{7q$i)Tgo#q|9ma|v7U z?W9{G3e8sq)Z5H$D;Wg~C%4e;`0C$mo*jV^(K2~bktYDAERU}@OovLY@hp&pZ@2M+ z!EQKWcD3%`Cu|_!iP;P#pp<3T+KNS0jLuB8MJ|{xe&rgv%A`Ynnc}y!3`Ix+<4FBMZX-2=^Qqv}HQlxFDim#~5Jw zae|E#IjBuGXz-$hMVCPH+bzxn7P;V98~hNUL+3;*L{g#FCn$AOxik%{tS7YO- zfnb1qS-nOG>QxgocD~#e=X%+CZw3^<$bM|!b>{)`$c@((I02v0rGDNMU%g?y`P9Y$ zBOM>hq}C4LZImeDz*iP&ygfMiwx!OAVNZZiG!9D`S2XTFmc~l~=tlXr$L#nbo8ZVx z?B4l6)-Y?8bc+SvxJih|9igXL>A1Xgwf9b+;2Dt;{`uE0 zbxce79=*GqNg8J|Kf0Mws}yFG>0fIdwv&h_@Hous`DnIp%(Iq40bTFt(_Y69X`k=F zww%L4a11`eCdLO}f~bmpzNiKhuMx+usA5MENAJoWJ$7pZ_#BL8(EB6)mB4F2sQ84~ zL0wI)KFHm6pxSo^%?fi|{}dW(vM)Ir7#lnL|7=Z-@qe}^QqKjgXGx_noI4V?e5({f z#gr&JCNE@I5xG2-@^RA9&7x%h2f50QYmPIvHOD_kld%pM$BqQ2M`!NVr^oPCh7{v0 zr6fi|9NRcF>VEs+05*1o>4msRbdBvjFp2jSQ?!JlvS>EC50TxHf}|MRNO!Azpsw75 z4S@BXv8>EI7@Mb6*WRDWD*I0jRUBpd3n@rLFCtnR22oil=-ip&18Ok<-D(`l!#KCY z=QPUHza1-;Nz|IPB`}$F{I&dmm{FOf=~|}7nWa*kAPOWqWR+1@naZ5v9s^uY(ipl^ zuP8D;X1l~(6H8LYz@f%pDdX~HhCuQi07T~1QL9WNO1zMs=tNm2lJOw@_tR<7seL|h!_)DG3hM+OxHszSdfPG)ic_pGA5uW^8T8nUDr6{_n z&Dh5PQk=={NV>c~EV}(lgn57N`#Z!ny0xZ{V1|K%yv3KLB)x3%blec@{6&}f0lOia zzJMaaQ{=q2M@)vy(50=T7G47MVaY32+yy-4C@1u~G=^6_gOzME61WgQ9nS+b6$52r zPLb>G8p%#e=oT zj~Tb>W0FF?RcTX-k^trr>EyYcu@w_8{^v<9oL12IV&I#G9}Sl&ZqHo+w7eHDQEiN) zNyifRPTz3G(8T@v^A{f3kbw1Z2WEju!e3u(+7TlN^uM5pynCVB8hnZf%|BL*f}O@p z3U(r-!UMO^6#IK_*iuI7e!QQ?<+^WC=Y-Bl3>w>Cb~Do_sv2)|M*wxvH)i^torG@o zpv9B!ftAra^zZv&WnagDOs$^hVUIC}jr(&A#pdatcb3Z?3@@c1O_*Hfwcws5b_F07 z?j4C;!2K1YPFI;P2t7h&^ z-LV3go4-qe+xAuCwYPls(y%o?a2<*GDY}Db1$tEP^?<4$Kw0~XexFB-oTt^ zOcKUDl5_BHo3K{EOl5c7rz{H|UCu+gAyRKJ*X|((1a-07t;{=JUw1`UA$;#|5lNg| z`3o(*`7q&-cowqnxi?tq`hrlSvrwB-lsrEv^iW!gPo`N*ZN`FWQJ{nYDL%&u!yE2_ zAIzIx0w}UavzT7jS>kZQGcZ9sR>4jk(#7qtlZ6l!xn^|0$&pmYOO7oAX_6CcyySl3 zo{;?vo;+MPOS zT>m~YA8y2=pl`Lmu2W?K>2vZBvuX*ap-?*>r9?I{2#HtYaTupLdf9Sv}s9SsPcRhDVoceKPv`k*v3EiRB{ zFQ9RcYCK20%P>=Xx_*nQjO{_(9qk>8He+HQQ*NR-eU=#p!YRl~%wb7=UJ19GILT(V z8GLd-m-)&{eKv-r)r5={!M8Z`4v7VWMo2K3*(L@wS&PxR49^87*?J%+xDtc09IKsM zGt5l*Pn<>OQ~}Tq4yX*4VTIwGWPOeqH(R%k*(|LYc1$$G+Zo*Bjz<6>sg$)M4@AT+yl`}{e8O&PokabRSA-rKa2RkM; zhky%#5Ir24(u$LU&hw~BTx?i6tL%fv_$+He`^z%Z+%{>DG}KXUTadt`Wr^|T7IcYi38tOWx@33~20oqOqi3$$NhvrW zhU*V*Dv{o?1kWrHafQ9`b~7115WnEpnPKqyo0olD|viMg41OOzor> zX-cP;$F98zjzf%6Bzk}qUTCEll?J#?!_l@b?$QztXon8{Bj$M$iQ0qm&feItt(i3v zLSRmezCj|Kh(Jy<2*lf2rj)sFEFRy$O-}GQG9n*}_6Ln4|4+Ot1@r@%2|QPWEX$QT zv5`%Q$;E1lQ;ufYBb-Yq`LE>AM3Kor^O>X?Z_2NYq^rhjVNgp)h5^*%T&TKTioG1?gWAiImG zHnH^sd1i>zU(yX+-=K2k-RF#7=GW|vYztQ_hO=fDuL_ip7Dvs3*gLDsWO-`}(Y(#w zyuR~3FVBLMjI)(p#&pXAM(h9_Aw$(I+04kK@O=SC!+_Jki9}b9p?&>xILx5(MFBl1 zU4-@GgYR~{ovkt&IY~Rnh2m!!y_m4C^22PUanbO;ipeeyNrT<}8x=|u%a~1L;qV{8 zUHNAM;oV917+}BrlU?x8;guUOxqBC6a3^r1QEWX0+5LA_jA*_A98rRO8?k& zo(lg&6gcqkoubu`mGPgwnH;ajxsCT7EcfO4oU+m1m7hpj1*rRu{`}2V4!j!A?HBjFnT)>S*SrayBV3uLDssqz0($)!sA^N-YPeG!LM`QjI|1<=PGWKH`a) z1xXNmFbVK#1UdNtIt47-ve8^XtoploXn?s6{r=1{fXqN$D5f`z5AW~%mBSEIeBT+j zLUiKM6yo&!w-5K$tCSOS|c=Yjlw))e{Blz8Mr_ws4AnE=( zKA?~R;oo>wzdC7Dmp-^-5A)G|#W3%#;ff*V8*`7e8^ZgG-xe_VCNSbCr?e?P7~z+| z<-f`6`)wT;vWXCqiXr4_xF_2R5n=!_C`j`IT?g-!Jy<(_fu-iD-7qgYYR!k$f(V1j z=>PHbh(*<1J-RGKKhi2ThvQx#mWPnI(Z+-%V})A@44GBza-AvrV6;D!=qw8 zq86F(gvqA}iG=Ceb47BBqKo>BwEggtSc$b#(ZU(h}OJnowfBw)<(6G>f3hI`4{@O=Y;0`V(q!rGK8pFtBz7rUs1LK zIBiy~S&IIGYG!EJo4wrCcb5ImojRMI0#yff;gY@FwqVwWCgx_RvR!SJ?z~zwyIzx< z-kHu`iU2Ld%<1XMK4Tc@2GGz8C$?bdK}Dp{eV5wYwP9k8WAq0}kT4iC++QG(9JJ%wB#BXBNeD{y5F8-z zC@5-V?G{-IKQZP&d&dDGAYjVB--~Fyjfuhz4_dB zo}#x_MPy**+tLjuOAa@kMpSwtSNsu;&A_{&r}XdRtvNSsZLv-eEL2P8o2t=v&4;bx z*tWKKl70bzgI4qHPoe7ZjptK--T$>vu(28=g&5h0KSJ~P7{-W6_a+4;gyCT2h9M^x IQxJ#wKL^3pq5uE@ diff --git a/doc/main.tex b/doc/main.tex index d782291..1bd9dd5 100644 --- a/doc/main.tex +++ b/doc/main.tex @@ -54,13 +54,13 @@ Before proceeding, ensure the following: \section{Step-by-Step Configuration} \subsection{Creating and Setting Up the Incus Container} -Create a Debian container named \texttt{dnsmasq-container} using the following commands on the host: +Create a Debian container named \texttt{deb1} using the following commands on the host: \begin{lstlisting}[language=bash] -incus create images:debian/12 dnsmasq-container -incus config set dnsmasq-container security.syscalls.intercept.mount true -incus config set dnsmasq-container security.nesting true -incus config set dnsmasq-container security.privileged true -incus start dnsmasq-container +incus create images:debian/12 deb1 +incus config set deb1 security.syscalls.intercept.mount true +incus config set deb1 security.nesting true +incus config set deb1 security.privileged true +incus start deb1 \end{lstlisting} The \texttt{security.syscalls.intercept.mount}, \texttt{security.nesting}, and \texttt{security.privileged} settings are required for \texttt{dnsmasq} and Docker to function correctly in the container. @@ -77,8 +77,8 @@ sudo iptables -A FORWARD -i wlo1 -o incusbr0 -m state --state RELATED,ESTABLISHE \subsection{Installing Additional Packages} Install the necessary packages inside the container: \begin{lstlisting}[language=bash] -incus exec dnsmasq-container -- apt update -incus exec dnsmasq-container -- apt install -y \ +incus exec deb1 -- apt update +incus exec deb1 -- apt install -y \ netplan.io \ sudo vim nano git tmux mc zip unzip curl wget htop lynx \ iproute2 termshark bridge-utils \ @@ -92,7 +92,7 @@ Configure user access and permissions within the container. \subsubsection{Changing the Root Password} Set the root password to "passroot": \begin{lstlisting}[language=bash] -incus exec dnsmasq-container -- bash -c 'echo "root:passroot" | chpasswd' +incus exec deb1 -- bash -c 'echo "root:passroot" | chpasswd' \end{lstlisting} \subsubsection{Adding a New User} @@ -104,29 +104,29 @@ sudo useradd -m -s /bin/bash -G sudo user && echo 'user:pass' | sudo chpasswd \subsection{Accessing the Container} Access the container's shell: \begin{lstlisting}[language=bash] -incus exec dnsmasq-container -- su - user +incus exec deb1 -- su - user \end{lstlisting} % New section for veth pair setup \section{Setting Up a Veth Pair Between Container and Network Namespace} -To enable direct communication between a container and a network namespace, a virtual Ethernet (\texttt{veth}) pair is created. The following Python script (\texttt{link.py}) is used to create a \texttt{veth} pair between the \texttt{dnsmasq-container} (an Incus container) and the \texttt{ns1} network namespace, with interfaces named \texttt{vA} and \texttt{vB}. +To enable direct communication between a container and a network namespace, a virtual Ethernet (\texttt{veth}) pair is created. The following Python script (\texttt{link.py}) is used to create a \texttt{veth} pair between the \texttt{deb1} (an Incus container) and the \texttt{ns1} network namespace, with interfaces named \texttt{vA} and \texttt{vB}. \begin{lstlisting} -sudo python3 link.py -n1 vA -t2 incus -ns2 dnsmasq-container -n2 vB +sudo python3 link.py -n1 vA -t2 incus -ns2 deb1 -n2 vB \end{lstlisting} This command: \begin{itemize} - \item Creates a \texttt{veth} pair with one end (\texttt{vA}) in the default namespace and the other end (\texttt{vB}) in the \texttt{dnsmasq-container}'s network namespace. + \item Creates a \texttt{veth} pair with one end (\texttt{vA}) in the default namespace and the other end (\texttt{vB}) in the \texttt{deb1}'s network namespace. \item Ensures the interfaces are set up and operational, allowing network traffic to flow between the container and the \texttt{ns1} namespace (or default namespace if \texttt{ns1} is not explicitly created). \end{itemize} -The script uses the \texttt{pyroute2} library to manage network interfaces and namespaces, and supports container types such as Incus, LXC, LXD, and Docker. Ensure the \texttt{dnsmasq-container} is running in Incus before executing the command. +The script uses the \texttt{pyroute2} library to manage network interfaces and namespaces, and supports container types such as Incus, LXC, LXD, and Docker. Ensure the \texttt{deb1} is running in Incus before executing the command. \subsection{Configuring the Network with Netplan} Configure the container's network using Netplan to assign a static IP address. Create or edit the Netplan configuration file at \texttt{/etc/netplan/01-netcfg.yaml}: \begin{lstlisting}[language=bash] -incus exec dnsmasq-container -- nano /etc/netplan/01-netcfg.yaml +incus exec deb1 -- nano /etc/netplan/01-netcfg.yaml \end{lstlisting} Add the following configuration: \begin{lstlisting}[language=yaml] @@ -145,22 +145,22 @@ network: \end{lstlisting} Apply the configuration: \begin{lstlisting}[language=bash] -incus exec dnsmasq-container -- netplan apply +incus exec deb1 -- netplan apply \end{lstlisting} \subsection{Installing dnsmasq} Update the package list and install \texttt{dnsmasq}: \begin{lstlisting}[language=bash] -incus exec dnsmasq-container -- apt update -incus exec dnsmasq-container -- apt install dnsmasq -y +incus exec deb1 -- apt update +incus exec deb1 -- apt install dnsmasq -y \end{lstlisting} \subsection{Configuring dnsmasq} Edit the \texttt{dnsmasq} configuration file at \texttt{/etc/dnsmasq.conf}: \begin{lstlisting}[language=bash] -incus exec dnsmasq-container -- nano /etc/dnsmasq.conf +incus exec deb1 -- nano /etc/dnsmasq.conf \end{lstlisting} Add or modify the following settings to enable DNS and DHCP: \begin{lstlisting} @@ -193,30 +193,31 @@ dhcp-option=6,8.8.8.8,8.8.4.4 \subsection{Starting and Enabling dnsmasq} Restart and enable the \texttt{dnsmasq} service: \begin{lstlisting}[language=bash] -incus exec dnsmasq-container -- systemctl restart dnsmasq -incus exec dnsmasq-container -- systemctl enable dnsmasq +incus exec deb1 -- systemctl restart dnsmasq +incus exec deb1 -- systemctl enable dnsmasq \end{lstlisting} Verify that \texttt{dnsmasq} is running: \begin{lstlisting}[language=bash] -incus exec dnsmasq-container -- systemctl status dnsmasq +incus exec deb1 -- systemctl status dnsmasq \end{lstlisting} \subsection{Testing the Configuration} Test DNS resolution from within the container: \begin{lstlisting}[language=bash] -incus exec dnsmasq-container -- nslookup example.local 192.168.1.10 +incus exec deb1 -- nslookup example.local 192.168.1.10 \end{lstlisting} To test DHCP, connect a client device to the same network and verify that it receives an IP address in the range \texttt{192.168.1.100--192.168.1.200}. \section{Troubleshooting} If \texttt{dnsmasq} fails to start: \begin{itemize} - \item Check the logs: \texttt{incus exec dnsmasq-container -- journalctl -u dnsmasq}. + \item Check the logs: \texttt{incus exec deb1 -- journalctl -u dnsmasq}. \item Ensure no other service is using port 53 (DNS) or 67 (DHCP). - \item Verify the network configuration with \texttt{incus exec dnsmasq-container -- ip a} and \texttt{incus exec dnsmasq-container -- ping 8.8.8.8}. + \item Verify the network configuration with \texttt{incus exec deb1 -- ip a} and \texttt{incus exec deb1 -- ping 8.8.8.8}. \end{itemize} \section{Conclusion} This guide configures \texttt{dnsmasq} as a DNS and DHCP server in an Incus container on Debian. The Netplan configuration ensures proper network setup. For advanced configurations, refer to the \texttt{dnsmasq} documentation (\texttt{man dnsmasq}). \end{document} +