Private/AzStackHci.ParallelLayer7.Helpers.ps1
|
# ============================================================================= # Strict Mode v1 (PS 5.1 safe) - surfaces reads of uninitialised variables at runtime. Set-StrictMode -Version 1.0 # AzStackHci.ParallelLayer7.Helpers.ps1 # ============================================================================= # Private helpers for the Layer-7 endpoint sweep in Test-AzureLocalConnectivity. # # Two helpers live here: # 1. Invoke-Layer7EndpointTest - tests ONE endpoint (mutates the $UrlObject in place, # may append CRL/OCSP dependency rows to $script:Results # via Add-CrlDependencyRowToResults). This is the # extracted body of the main per-URL ForEach loop and # is byte-identical to the v0.6.6 inline behaviour. # 2. Invoke-Layer7BucketWorker - runs inside a Start-Job worker process; loops over # a bucket of $UrlObject rows calling # Invoke-Layer7EndpointTest, snapshots the module-scope # classification state ($script:SSLInspectedURLs, # $script:CRLOfflineURLs, $script:PrivateLink* arrays, # any newly-appended $script:Results rows) and returns # a hashtable for the parent process to merge. # # The parallel fan-out is opt-in via the new -Parallelism parameter on # Test-AzureLocalConnectivity (default 1, sequential, byte-identical to v0.6.6). # ============================================================================= function Invoke-Layer7EndpointTest { <# .SYNOPSIS Runs DNS + TCP + Layer-7 connectivity tests for a single endpoint row, mutating the row in place. Body extracted verbatim from the main ForEach loop in Test-AzureLocalConnectivity to enable parallel fan-out via Start-Job. .DESCRIPTION Sequential default behaviour: identical to the pre-extraction inline ForEach body. Mutates $UrlObject fields (TCPStatus, Layer7Status, Layer7Response, certificate columns, IPAddress, Note). May call Add-CrlDependencyRowToResults which appends new rows to $script:Results. May also append to module-scope classification state ($script:SSLInspectedURLs, $script:CRLOfflineURLs, $script:PrivateLink* arrays, $script:SSLInspectionDetected) via the call into Test-Layer7Connectivity -> Get-Layer7CertificateDetails / Get-DnsRecord. .PARAMETER UrlObject The PSCustomObject row from $script:Results to test. Mutated in place. .PARAMETER SkipUrls The list of URLs that the parent loop has decided to skip (the manually-curated "skip" list — pre-2026 hardcoded entries like wustat.windows.com). .PARAMETER ArcGatewayDeployment Whether -ArcGatewayDeployment was specified on the public Test-AzureLocalConnectivity. .PARAMETER NTPTimeServer Optional user-supplied NTP server URL (replaces time.windows.com for that one row). .PARAMETER IncludeTCPConnectivityTests Whether -IncludeTCPConnectivityTests was specified on the public function. .PARAMETER RequestMethod 'Get' / 'Head' / 'Auto' — plumbed through to Test-Layer7Connectivity. #> [CmdletBinding()] param( [Parameter(Mandatory)] [object]$UrlObject, [Parameter(Mandatory)] [array]$SkipUrls, [Parameter(Mandatory=$false)] [bool]$ArcGatewayDeployment = $false, [Parameter(Mandatory=$false)] [string]$NTPTimeServer, [Parameter(Mandatory=$false)] [bool]$IncludeTCPConnectivityTests = $false, [Parameter(Mandatory=$false)] [ValidateSet('Get','Head','Auto')] [string]$RequestMethod = 'Auto' ) # Local alias preserves the old loop variable name so the extracted body remains # diff-readable against the v0.6.6 ForEach body it came from. $urlObj = $UrlObject # Per-iteration DNSCheck reset (matches original "Remove-Variable DNSCheck" inside the loop). $DNSCheck = $null Write-Debug "Arc Gateway boolean for url '$($urlObj.url)' from source $($urlObj.Source) = $($urlObj.ArcGateway)" # If the ArcGatewayDeployment switch is used, only test URLs that do not support Arc Gateway if ($ArcGatewayDeployment) { # Skip URLs with ArcGateway -eq $True if ($urlObj.ArcGateway) { # Skip URLs that support Arc Gateway Write-HostAzS "Skipped URL: '$($urlObj.URL)' as supported by Arc Gateway" -ForegroundColor Yellow Set-UrlObjectSkipFields -UrlObject $urlObj -TCPStatus "Skipped" -Layer7Status "Skipped" $urlObj.Note = "Skipped, URL is supported by Arc Gateway - $($urlObj.Note)" Write-HostAzS "" return } } # Process URLs that require special handling if (($urlObj.URL -like ("*.gw.arc.azure.com") -or $urlObj.URL -like ("*.gw.arc.azure.net"))) { if ($ArcGatewayDeployment) { # Replace the URL with the user-defined Arc Gateway URL, if specified $urlObj.URL = (Get-DomainFromURL -url $script:UpdatedArcGatewayURL).Domain # Run DNS + TCP + Layer 7 connectivity tests using shared helper # Forward -RequestMethod down through Invoke-EndpointConnectivityTest into Test-Layer7Connectivity (parity with the non-wildcard branch). $testResult = Invoke-EndpointConnectivityTest -Url $urlObj.URL -Port $urlObj.Port -IncludeTCPConnectivityTests:$IncludeTCPConnectivityTests -RequestMethod $RequestMethod Copy-ConnectivityResultsToUrlObject -UrlObject $urlObj -TestResult $testResult } else { # Not using Arc Gateway, skip the URL Write-HostAzS "Skipping URL, (not using Arc Gateway): $($urlObj.URL)" -ForegroundColor Green Set-UrlObjectSkipFields -UrlObject $urlObj -TCPStatus "Skipped" -Layer7Status "Skipped" $urlObj.Note = "Skipped, not using Arc Gateway, as '-ArcGatewayDeployment' switch not present - $($urlObj.Note)" } } elseif ($urlObj.URL -eq "time.windows.com") { # Replace the URL with the user-defined NTP Time Server, if specified if ([string]::IsNullOrWhiteSpace($NTPTimeServer)) { # Use default NTP Time Server Write-HostAzS "Using default NTP Time Server: 'time.windows.com' for NTP connectivity test on UDP port 123, as the '`$NTPTimeServer' parameter was not specified" -ForegroundColor Yellow $DNSCheck = Get-DnsRecord -url (Get-DomainFromURL -url $urlObj.URL).Domain } else { Write-HostAzS "Replacing default NTP Time Server 'time.windows.com' with user-defined NTP server: '$NTPTimeServer'" -ForegroundColor Green [string]$urlObj.URL = (Get-DomainFromURL -url $NTPTimeServer).Domain $urlObj.Source = "User-defined NTP server" # //// Ignore RFC1918 check during DNS check for user-defined NTP server //// $DNSCheck = Get-DnsRecord -url (Get-DomainFromURL -url $NTPTimeServer).Domain -SkipRfc1918Check } # If using a Proxy, DNS resolution from the local host may not be required if (($DNSCheck.DNSExists) -or ($script:Proxy.Enabled)) { $StopWatch = [Diagnostics.Stopwatch]::StartNew() $urlObj.TCPStatus, $urlObj.IPAddress = Test-NTPConnectivity -ntpServer $urlObj.URL if ($urlObj.TCPStatus -eq "Success") { $urlObj.Layer7Status = "Success" } else { $urlObj.Layer7Status = "Failed" } if ([string]::IsNullOrWhiteSpace($urlObj.IPAddress)) { $urlObj.IPAddress = $DNSCheck.IpAddress } $urlObj.Layer7Response = "UDP port 123" $urlObj.Layer7ResponseTime = [math]::round($StopWatch.Elapsed.TotalMilliseconds/1000, 3) $StopWatch.Stop() # NTP does not use SSL certificates $urlObj.CertificateIssuer = "N/A" $urlObj.CertificateSubject = "N/A" $urlObj.CertificateThumbprint = "N/A" $urlObj.IntermediateCertificateIssuer = "N/A" $urlObj.IntermediateCertificateSubject = "N/A" $urlObj.IntermediateCertificateThumbprint = "N/A" $urlObj.RootCertificateIssuer = "N/A" $urlObj.RootCertificateSubject = "N/A" $urlObj.RootCertificateThumbprint = "N/A" } else { Set-UrlObjectSkipFields -UrlObject $urlObj -TCPStatus "Failed" -Layer7Status "Failed" -IPAddress $DNSCheck.IpAddress } # //// Skipped URLs //// } elseif ($SkipUrls.URL.Contains($urlObj.URL)) { Write-HostAzS "Skipped URL: $($urlObj.URL)" -ForegroundColor Green Set-UrlObjectSkipFields -UrlObject $urlObj -TCPStatus "Skipped" -Layer7Status "Skipped" $urlObj.Note = "Skipped URL - $($urlObj.Note)" # //// Wildcard URLs //// } elseif ($urlObj.IsWildcard) { Write-HostAzS "Wildcard URLs are processed later..." -ForegroundColor Yellow Set-UrlObjectSkipFields -UrlObject $urlObj -TCPStatus "Skipped" -Layer7Status "Skipped" $urlObj.Note = "$($urlObj.Note)" # //// Non-wildcard URLs //// } else { # Placeholder KeyVault URL: show Warning status instead of running tests against a URL that will always fail DNS if ($urlObj.URL -like "yourhcikeyvaultname.vault.*") { Write-HostAzS "WARNING: Default KeyVault endpoint '$($urlObj.URL)' is being used." -ForegroundColor Yellow Write-HostAzS "INFO: Specify your KeyVault endpoint using the '-KeyVaultURL' parameter to validate your actual KeyVault connectivity." -ForegroundColor Yellow Set-UrlObjectSkipFields -UrlObject $urlObj -TCPStatus "Failed" -Layer7Status "Failed" $urlObj.Note = "PARAMETER `"-KeyVaultURL https://<yourKeyVault>.vault.azure.net`" WAS NOT USED - THIS IS REQUIRED TO SPECIFY YOUR UNIQUE KEY VAULT NAME - Key vault for deployment secrets." # Sleep for 3 seconds to allow the user to read the warning, if present. Start-Sleep -Seconds 3 # NOTE: original 'Continue' here SKIPS the trailing Write-HostAzS "" — replicate by returning early. return } # Run DNS + TCP + Layer 7 connectivity tests using shared helper # Forward -RequestMethod down through Invoke-EndpointConnectivityTest into Test-Layer7Connectivity. $testResult = Invoke-EndpointConnectivityTest -Url $urlObj.URL -Port $urlObj.Port -IncludeTCPConnectivityTests:$IncludeTCPConnectivityTests -RequestMethod $RequestMethod Copy-ConnectivityResultsToUrlObject -UrlObject $urlObj -TestResult $testResult } # Add line return after each URL (matches the original loop trailing Write-HostAzS ""). Write-HostAzS "" } function Invoke-Layer7BucketWorker { <# .SYNOPSIS Worker scriptblock body — runs inside a Start-Job child process, loops over a bucket of endpoint rows calling Invoke-Layer7EndpointTest, and returns a snapshot of all module-scope classification state for the parent process to merge. .DESCRIPTION Each Start-Job worker is its own process, so $script:* variables are isolated. The worker imports the module (so Invoke-Layer7EndpointTest, Test-Layer7Connectivity, Get-DnsRecord, Add-CrlDependencyRowToResults etc. are all available), seeds the module-scope state from the parent's snapshot, runs the bucket sequentially, then returns a hashtable that the parent merges. Returned hashtable keys: - Rows : the mutated $UrlObject rows from this bucket (RowID-tagged) - NewCrlRows : any rows appended to $script:Results by Add-CrlDependencyRowToResults inside the bucket - RedirectedResults : URLs the worker discovered via HTTP 301/302 redirect responses ($script:RedirectedResults snapshot — Phase 4 of Test-AzureLocalConnectivity iterates the parent's copy of this list, so workers MUST plumb it back or redirected URLs are silently dropped from the output) - SSLInspectedURLs : list of URLs flagged for SSL Inspection - CRLOfflineURLs : list of URLs whose CRL/OCSP check was offline - SSLInspectionDetected : bool — true if any row in the bucket triggered SSL inspection - PrivateLinkDetected : bool — true if any URL in the bucket resolved to RFC1918 (the parent uses this scalar flag to decide whether to print the customer-facing 'PRIVATE LINK DETECTED' warning) - PrivateLinkDetectedArray : list of URLs flagged for Private Link - PrivateLinkCriticalArray : list of URLs flagged for Private Link (RFC1918, critical) - PrivateLinkProxyBypassArray: list of URLs flagged for Private Link (RFC1918, proxy bypass) - BucketIndex : the worker's bucket index (for deterministic merge order) - BucketWallClockSec : wall-clock duration of this worker's bucket Diagnostic console output produced during testing is interleaved across workers — that is the documented behaviour of the parallel mode. The transcript still captures every line; the JSON output is RowID-sorted so customer-facing output ordering is identical to sequential mode. .PARAMETER Bucket Array of $UrlObject rows for this worker to test (round-robin partition from parent). .PARAMETER ParameterBag Hashtable carrying SkipUrls / ArcGatewayDeployment / NTPTimeServer / IncludeTCPConnectivityTests / RequestMethod / Proxy / UpdatedArcGatewayURL. .PARAMETER BucketIndex Index of this bucket (0..N-1). #> [CmdletBinding()] param( [Parameter(Mandatory)] [array]$Bucket, [Parameter(Mandatory)] [hashtable]$ParameterBag, [Parameter(Mandatory=$false)] [int]$BucketIndex = 0 ) $bucketSw = [System.Diagnostics.Stopwatch]::StartNew() # Tag every Write-HostAzS line emitted from inside this worker with [bucket-N] # so the interleaved transcript is greppable per bucket. Cleared in the finally # so the parent process never inherits a stale prefix. $script:WorkerLogPrefix = "[bucket-$BucketIndex] " # Wrap the bucket body in try/finally so the [bucket-N] prefix is ALWAYS cleared # (and the stopwatch always stopped) even if a terminating error escapes the # per-row try/catch below. Body indentation is intentionally unchanged to keep # this diff minimal and reviewable. try { # Seed module-scope state from the parent's snapshot — Invoke-Layer7EndpointTest reads # $script:Proxy and $script:UpdatedArcGatewayURL. Constants.ps1's Initialize-ModuleState # has already created the empty ArrayLists / arrays for the classification state, so # we can rely on those being initialised but empty in this worker process. if ($ParameterBag.ContainsKey('Proxy')) { $script:Proxy = $ParameterBag.Proxy } if ($ParameterBag.ContainsKey('UpdatedArcGatewayURL')) { $script:UpdatedArcGatewayURL = $ParameterBag.UpdatedArcGatewayURL } # Snapshot the row count BEFORE running the bucket so we can isolate any new # CRL/OCSP rows that Add-CrlDependencyRowToResults appends during testing. # The worker's $script:Results starts as a (cloned) copy of the bucket so that # Add-CrlDependencyRowToResults's host-level dedupe still works correctly within # the bucket's scope. [System.Collections.ArrayList]$script:Results = @($Bucket) $initialRowCount = $script:Results.Count foreach ($row in $Bucket) { try { Invoke-Layer7EndpointTest ` -UrlObject $row ` -SkipUrls $ParameterBag.SkipUrls ` -ArcGatewayDeployment ([bool]$ParameterBag.ArcGatewayDeployment) ` -NTPTimeServer $ParameterBag.NTPTimeServer ` -IncludeTCPConnectivityTests ([bool]$ParameterBag.IncludeTCPConnectivityTests) ` -RequestMethod $ParameterBag.RequestMethod } catch { # Mark the row as Failed but never abort the bucket — bucket-level isolation matters. try { $row.Layer7Status = 'Failed' $row.Layer7Response = "Worker exception: $($_.Exception.Message)" } catch {} } } # Identify any new CRL/OCSP dependency rows the bucket appended during testing. $newCrlRows = @() if ($script:Results.Count -gt $initialRowCount) { $newCrlRows = @($script:Results | Select-Object -Skip $initialRowCount) } } finally { $bucketSw.Stop() # Clear the bucket prefix so a direct (non-Start-Job) caller doesn't leak it. # In the Start-Job process this is moot — the process is torn down — but # Pester tests that invoke Invoke-Layer7BucketWorker in-proc would otherwise # see subsequent Write-HostAzS calls still tagged. $script:WorkerLogPrefix = '' } return @{ Rows = @($Bucket) NewCrlRows = $newCrlRows RedirectedResults = @($script:RedirectedResults) SSLInspectedURLs = @($script:SSLInspectedURLs) CRLOfflineURLs = @($script:CRLOfflineURLs) SSLInspectionDetected = [bool]$script:SSLInspectionDetected PrivateLinkDetected = [bool]$script:PrivateLinkDetected PrivateLinkDetectedArray = @($script:PrivateLinkDetectedArray) PrivateLinkCriticalArray = @($script:PrivateLinkCriticalArray) PrivateLinkProxyBypassArray = @($script:PrivateLinkProxyBypassArray) BucketIndex = $BucketIndex BucketWallClockSec = [math]::Round($bucketSw.Elapsed.TotalSeconds, 3) } } function Merge-Layer7WorkerResult { <# .SYNOPSIS Merges one worker's returned hashtable into the parent module-scope state. .DESCRIPTION - Replaces parent rows by RowID with the worker's mutated copies. - Appends new CRL/OCSP dependency rows to $script:Results (idempotent: skips URLs already present at the parent level). - Unions the SSL-inspection / CRL-offline / Private-Link arrays. - ORs the SSLInspectionDetected flag. .PARAMETER WorkerResult The hashtable returned by Invoke-Layer7BucketWorker. #> [CmdletBinding()] param( [Parameter(Mandatory)] [hashtable]$WorkerResult ) # The worker mutated the original PSCustomObject references in $Bucket. Because # Start-Job serialises objects across the process boundary, the deserialised rows # returned in WorkerResult.Rows are NOT the same instances as the parent's # $script:Results entries. Merge by RowID match. foreach ($workerRow in $WorkerResult.Rows) { $match = $script:Results | Where-Object { $_.RowID -eq $workerRow.RowID } | Select-Object -First 1 if ($null -ne $match) { # Copy back every mutated field. This is intentionally explicit (not # ForEach-Object Get-Member) to avoid accidentally overwriting RowID/URL/Port etc. foreach ($field in @( 'TCPStatus','IPAddress','Layer7Status','Layer7Response','Layer7ResponseTime', 'CertificateIssuer','CertificateSubject','CertificateThumbprint', 'IntermediateCertificateIssuer','IntermediateCertificateSubject','IntermediateCertificateThumbprint', 'RootCertificateIssuer','RootCertificateSubject','RootCertificateThumbprint', 'Note','URL','Source' )) { if (($workerRow.PSObject.Properties.Name -contains $field) -and ($match.PSObject.Properties.Name -contains $field)) { $match.$field = $workerRow.$field } } } } # Append any new CRL/OCSP dependency rows the worker generated. When the same # dependency URL is discovered in another bucket the row is NOT re-added — instead # we extend the existing row's Source field so customer-facing output preserves # all parent-domain attributions. This mirrors the Tier-1 dedupe semantics inside # Add-CrlDependencyRowToResults (Private/AzStackHci.Connectivity.Helpers.ps1) for # the cross-bucket case, where each worker's local dedupe cannot see other buckets. foreach ($newRow in $WorkerResult.NewCrlRows) { # Defence-in-depth: skip any $null row (mirrors the RedirectedResults loop guard # below) so a malformed worker payload can never throw on $newRow.URL. if ($null -eq $newRow) { continue } $existing = $script:Results | Where-Object { ($_.URL -eq $newRow.URL) -and ($_.Port -eq $newRow.Port) } | Select-Object -First 1 if ($null -eq $existing) { $script:Results.Add($newRow) | Out-Null } elseif ($newRow.PSObject.Properties.Name -contains 'Source' -and -not [string]::IsNullOrWhiteSpace($newRow.Source)) { # Extract the parent-domain hint(s) from the worker's Source string and append # any not already present on the parent row's Source. The Source field uses # '; '-separated parent-domain tokens so a simple substring check is reliable. $existingSrc = if ([string]::IsNullOrWhiteSpace($existing.Source)) { '' } else { $existing.Source } foreach ($token in ($newRow.Source -split ';\s*')) { $t = $token.Trim() if ($t -and ($existingSrc -notmatch [regex]::Escape($t))) { $existing.Source = if ([string]::IsNullOrWhiteSpace($existing.Source)) { $t } else { "$($existing.Source); $t" } $existingSrc = $existing.Source } } } } # Plumb back any URLs the worker discovered as HTTP 301/302 redirect targets so # Phase 4 of Test-AzureLocalConnectivity (the redirected-URLs loop) can test them. # Without this merge step those rows would be silently dropped from the JSON / HTML # / CSV output in -Parallelism > 1 runs. Dedupe by url + Port matches the existing # New-RedirectedResultEntry semantics in Private/AzStackHci.Connectivity.Helpers.ps1. if ($WorkerResult.RedirectedResults) { foreach ($redirRow in $WorkerResult.RedirectedResults) { if ($null -eq $redirRow) { continue } $existsInRedirected = $script:RedirectedResults | Where-Object { ($_.url -eq $redirRow.url) -and ($_.Port -eq $redirRow.Port) } | Select-Object -First 1 $existsInResults = $script:Results | Where-Object { ($_.URL -eq $redirRow.url) -and ($_.Port -eq $redirRow.Port) } | Select-Object -First 1 if ((-not $existsInRedirected) -and (-not $existsInResults)) { $script:RedirectedResults.Add($redirRow) | Out-Null } } } foreach ($u in $WorkerResult.SSLInspectedURLs) { if (-not ($script:SSLInspectedURLs -contains $u)) { $script:SSLInspectedURLs.Add($u) | Out-Null } } foreach ($u in $WorkerResult.CRLOfflineURLs) { if (-not ($script:CRLOfflineURLs -contains $u)) { $script:CRLOfflineURLs.Add($u) | Out-Null } } if ($WorkerResult.SSLInspectionDetected) { $script:SSLInspectionDetected = $true } # OR-merge the scalar PrivateLinkDetected flag — the parent uses this boolean (NOT # the array) at the end of Test-AzureLocalConnectivity to decide whether to print # the customer-facing 'PRIVATE LINK DETECTED' warning block. if ($WorkerResult.PrivateLinkDetected) { $script:PrivateLinkDetected = $true } foreach ($u in $WorkerResult.PrivateLinkDetectedArray) { if (-not ($script:PrivateLinkDetectedArray -contains $u)) { $script:PrivateLinkDetectedArray += $u } } foreach ($u in $WorkerResult.PrivateLinkCriticalArray) { if (-not ($script:PrivateLinkCriticalArray -contains $u)) { $script:PrivateLinkCriticalArray += $u } } foreach ($u in $WorkerResult.PrivateLinkProxyBypassArray) { if (-not ($script:PrivateLinkProxyBypassArray -contains $u)) { $script:PrivateLinkProxyBypassArray += $u } } } function Split-Layer7BucketsRoundRobin { <# .SYNOPSIS Cost-aware bin-packs a row array into N buckets, with plain round-robin fallback. .DESCRIPTION Endpoint timing is heterogeneous: rows that trigger CRL/OCSP chain validation or that are flagged as Critical/Wildcard typically take 2-3x longer than a plain HEAD probe. A pure `i % Buckets` round-robin can leave one worker with most of the slow rows. Algorithm (cost-aware mode, default): 1. Estimate a per-row cost (Get-Layer7RowCost — CRL/OCSP/Critical = 3, Wildcard = 2, Redirected = 2, all others = 1). 2. Sort rows DESC by cost. (Output ordering is preserved at MERGE time via RowID-sort — see Merge-Layer7WorkerResult — so the bucket-internal order does not affect customer-visible results.) 3. Greedy bin-pack: for each row, place it in the bucket with the lowest current cumulative cost. Ties broken by lowest bucket index. Algorithm (legacy round-robin, opt-in via -RoundRobin): Plain `i % Buckets` — preserved for benchmarking / regression comparison. .PARAMETER Rows The full ordered array of rows to partition. .PARAMETER Buckets Number of buckets (= -Parallelism). Range 1-64. .PARAMETER RoundRobin Switch to force the legacy `i % Buckets` distribution. Default behaviour (switch absent) is cost-aware bin-packing. #> [CmdletBinding()] param( [Parameter(Mandatory)] [array]$Rows, [Parameter(Mandatory)] [ValidateRange(1, 64)] [int]$Buckets, [switch]$RoundRobin ) # Initialise N empty bucket arrays. The leading comma on `,@()` is required — # `for` would otherwise unwrap a 0-element array, leaving fewer than N buckets. $result = @(for ($i = 0; $i -lt $Buckets; $i++) { ,@() }) if ($RoundRobin -or $Buckets -eq 1 -or $Rows.Count -le $Buckets) { # Legacy / trivial cases: bin-packing has no benefit. for ($i = 0; $i -lt $Rows.Count; $i++) { $b = $i % $Buckets $result[$b] += $Rows[$i] } return ,$result } # Cost-aware greedy bin-pack. $costs = @{} foreach ($row in $Rows) { $costs[$row] = Get-Layer7RowCost -Row $row } # Sort DESC by cost. Stable for ties (PowerShell's Sort-Object is NOT stable; # use a secondary key by original index to make ordering deterministic for tests). $indexed = for ($i = 0; $i -lt $Rows.Count; $i++) { [pscustomobject]@{ Row = $Rows[$i]; Cost = $costs[$Rows[$i]]; Index = $i } } $sorted = @($indexed | Sort-Object -Property @{Expression='Cost';Descending=$true}, @{Expression='Index';Descending=$false}) $bucketCost = New-Object 'int[]' $Buckets foreach ($entry in $sorted) { # Find bucket with minimum cumulative cost (ties → lowest index). $minIdx = 0 for ($b = 1; $b -lt $Buckets; $b++) { if ($bucketCost[$b] -lt $bucketCost[$minIdx]) { $minIdx = $b } } $result[$minIdx] += $entry.Row $bucketCost[$minIdx] += $entry.Cost } return ,$result } function Get-Layer7RowCost { <# .SYNOPSIS Estimate the relative cost of testing a Layer-7 row, used by Split-Layer7BucketsRoundRobin. .DESCRIPTION Returns 3 for CRL/OCSP / Critical rows (slowest — chain validation, often blocked endpoints with full timeout), 2 for Wildcard / Redirected rows (medium — extra DNS + sometimes a second HEAD), and 1 for everything else. The exact numbers are not load-bearing; they only need to reflect the relative wall-clock weight so the greedy bin-pack balances correctly. #> [CmdletBinding()] [OutputType([int])] param( [Parameter(Mandatory)] [object]$Row ) $isCrl = ($Row.PSObject.Properties['Source'] -and ($Row.Source -match 'CRL|OCSP|crl\.|ocsp\.')) $isCrit = ($Row.PSObject.Properties['Source'] -and ($Row.Source -match 'Critical')) $isWild = ($Row.PSObject.Properties['IsWildcard'] -and $Row.IsWildcard) $isRedir = ($Row.PSObject.Properties['Source'] -and ($Row.Source -match 'Redirect')) if ($isCrl -or $isCrit) { return 3 } if ($isWild -or $isRedir) { return 2 } return 1 } # SIG # Begin signature block # MIInSQYJKoZIhvcNAQcCoIInOjCCJzYCAQExDzANBglghkgBZQMEAgEFADB5Bgor # BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG # KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCEQBFUsc70Flfx # GXDVWqSt8TObmV68HLUEGKGmmHLceaCCDLowggX1MIID3aADAgECAhMzAAACHU0Z # yE7XD1dIAAAAAAIdMA0GCSqGSIb3DQEBCwUAMFcxCzAJBgNVBAYTAlVTMR4wHAYD # VQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBD # b2RlIFNpZ25pbmcgUENBIDIwMjQwHhcNMjYwNDE2MTg1OTQzWhcNMjcwNDE1MTg1 # OTQzWjB0MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UE # BxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMR4wHAYD # VQQDExVNaWNyb3NvZnQgQ29ycG9yYXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IB # DwAwggEKAoIBAQDQvewXxx9gZZFC6Ys1WBay8BJ8kGA4JQnH5CMafqOASlTpK9H8 # o5ZXTXt0caVQTNMUPt445wXYD+dFtaKWTwDn1I52oUSrC9vJin1Gsqt+zyKJL5Dg # 3eQXbQNR61DmMy20GLTIO3SFed9Rfi/ophgCLGFLDR3r0KvHjwMb/jYWS0celV/4 # Lz27LfAekm8v9E5IXaeiXbAUYZKK090n4CVl3JBtbN+9DtI9SNu/yjvozW52/u7R # X/Ttpa/KDlpuokZ+Zcbvmtd9ur9gFLvZzh41o9MsE/clQtdaFWGvuo6Jua/ntpgk # ey3E5/vBFe+MJPG6phdnuo6r57ZudCudiI1bAgMBAAGjggGbMIIBlzAOBgNVHQ8B # Af8EBAMCB4AwHwYDVR0lBBgwFgYKKwYBBAGCN0wIAQYIKwYBBQUHAwMwHQYDVR0O # BBYEFH6QuMwqcPG0hQlQ6c5jCtTTLrVeMEUGA1UdEQQ+MDykOjA4MR4wHAYDVQQL # ExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xFjAUBgNVBAUTDTIzMDAxMis1MDc1NTkw # HwYDVR0jBBgwFoAUf1k/VCHarU/vBeXmo9ctBpQSCDEwYAYDVR0fBFkwVzBVoFOg # UYZPaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9jcmwvTWljcm9zb2Z0 # JTIwQ29kZSUyMFNpZ25pbmclMjBQQ0ElMjAyMDI0LmNybDBtBggrBgEFBQcBAQRh # MF8wXQYIKwYBBQUHMAKGUWh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMv # Y2VydHMvTWljcm9zb2Z0JTIwQ29kZSUyMFNpZ25pbmclMjBQQ0ElMjAyMDI0LmNy # dDAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEBCwUAA4ICAQBKTbYOjzwTG/DXGaz9 # s6+fQeaTtDcFmMY+5UyVFCyj7Pv+5i37qfX8lSL/tBIfYQfWsMuBQlfZurJD6r4H # VJ2CeH+1fgiq8dcHdVKoZ3Sa2qXoX3cq9iS8cVb06B7+5/XJ7I0OxHH9fDsvJ3T3 # w5V/ZtAIFmLrl+P0CtG+92uzRsn0nTbdFjOkLMLWPLAU3THohKRlSEMgFJpPkm5n # 5UAZ35xX6FWCrDLsSKb555bTifwa8mJBwdlof0bmfYidH+dxZ1FdDxvLnNl9zeKs # A4kejaaIqqIPguhwAti5Ql7BlTNoJNwxCvBmqW2MQLnCkYN/VVUsR3V2x/rcTNzo # Bf/Z/SpROvdaA2ZOOd1uioXJt3tdLQ7vHpqpib0KfWr/FWXW10q38VxfCnRQBqzb # SuztR7nEMuzX7Ck+B/XaPDXd1qh72+QYyB0Z2VzWmO9zsnb9Uq/dwu8LGeQqnyu6 # 7SDGACvnXii2fb9+US492VTnXSnFKyqwgzUyFMtZK1/sHYTv6bG4TtQUygQxTN+Z # V+aJIlKO2MqZ7bKrAnOzS9m6NgoTdWOq11bTOZwKlIEV/EhV9SWkDmdpR/hPPT2v # 6TEj4F8PT/zHjRezIU5c/DGlt/VhY/pK0XkJtEyMmmS1BMtjU/rqBZVMIm3dnxQs # /TBByr+Cf8Z1r7aifQVQ+WSqzjCCBr0wggSloAMCAQICEzMAAAA5O7Y3Gb8GHWcA # AAAAADkwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpX # YXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQg # Q29ycG9yYXRpb24xMjAwBgNVBAMTKU1pY3Jvc29mdCBSb290IENlcnRpZmljYXRl # IEF1dGhvcml0eSAyMDExMB4XDTI0MDgwODIwNTQxOFoXDTM2MDMyMjIyMTMwNFow # VzELMAkGA1UEBhMCVVMxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEo # MCYGA1UEAxMfTWljcm9zb2Z0IENvZGUgU2lnbmluZyBQQ0EgMjAyNDCCAiIwDQYJ # KoZIhvcNAQEBBQADggIPADCCAgoCggIBANgBnB7jOMeqlRYHNa265v4IY9fH8TKh # emHfPINe1gpLaV3dhg324WwH06LcHbpnsBukCDNitryo0dtS/EW6I/yEL/bLSY8h # KpbfQuWusBPr9qazYcDxCW/qnjb5JsI1s8bNOg3bVATvQVL4tcf03aTycsz8QeCd # M0l/yHRObJ9QqazM1r6VPEOJ7LL+uEEb73w6QCuhs89a1uv1zerOYMnsneRRwCbp # yW11IcggU0cRKDDq1pjVJzIbIF6+oiXXbReOsgeI8zu1FyQfK0fVkaya8SmVHQ/t # Of23mZ4W9k0Ri22QW9p3UgSC5OUDktKxxcCmGL6tXLfOGSWHIIV4YrTJTT6PNty5 # REojHJuZHArkF9VnHTERWoTjAzfI3kP+5b4alUdhgAZ7ttOu1bVnXfHaqPYl2rPs # 20ji03LOVWsh/radgE17es5hL+t6lV0eVHrVhsssROWJuz2MXMCt7iw7lFPG9LXK # Gjsmonn2gotGdHIuEg5JnJMJVmixd5LRlkmgYRZKzhxSCwyoGIq0PhaA7Y+VPct5 # pCHkijcIIDm0nlkK+0KyepolcqGm0T/GYQRMhHJlGOOmVQop36wUVUYklUy++vDW # eEgEo4s7hxN6mIbf2MSIQ/iIfMZgJxC69oukMUXCrOC3SkE/xIkgpfl22MM1itkZ # 35nNXkMolU1lAgMBAAGjggFOMIIBSjAOBgNVHQ8BAf8EBAMCAYYwEAYJKwYBBAGC # NxUBBAMCAQAwHQYDVR0OBBYEFH9ZP1Qh2q1P7wXl5qPXLQaUEggxMBkGCSsGAQQB # gjcUAgQMHgoAUwB1AGIAQwBBMA8GA1UdEwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAU # ci06AjGQQ7kUBU7h6qfHMdEjiTQwWgYDVR0fBFMwUTBPoE2gS4ZJaHR0cDovL2Ny # bC5taWNyb3NvZnQuY29tL3BraS9jcmwvcHJvZHVjdHMvTWljUm9vQ2VyQXV0MjAx # MV8yMDExXzAzXzIyLmNybDBeBggrBgEFBQcBAQRSMFAwTgYIKwYBBQUHMAKGQmh0 # dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2kvY2VydHMvTWljUm9vQ2VyQXV0MjAx # MV8yMDExXzAzXzIyLmNydDANBgkqhkiG9w0BAQwFAAOCAgEAFJQfOChP7onn6fLI # MKrSlN1WYKwDFgAddymOUO3FrM8d7B/W/iQ6DxXsDn7D5W4wMwYeLystcEqfkjz4 # NURRgazyMu5yRzQh4LqjA4tStTcJh1opExo7nn5PuPBYnbu0+THSuVHTe0VTTPVh # ily/piFrDo3axQ9P4C+Ol5yet+2gTfekICS5xS+cYfSIvgn0JksVBVMYVI5QFu/q # hnLhsEFEUzG8fvv0hjgkO+lkpV9ty6GkN4vdnd7ya6Q6aR9y34aiM1qmxaxBi6OU # nyNl6fkuun/diTFnYDLTppOkr/mg5WSfCiDVMNCxtj4wPKC5OmHm1DQIt/MNokbb # H3UGsFP1QbzsLocuSqLCvH09Io3fDPTmscR9Y75G4qX7RTX8AdBPo0I6OEojf39z # uFZt0qOHm65YWQE69cZM2ueE1MB05dNNgHK9gTE7zKvK/fg8B2qjW88MT/WF5V5u # vZGtqa9FSL2RazArA+rDPuf6JGYz4HpgMZHB4S6szWSKYBv0VisCzfxgeU+dquXW # 9bd0auYlOB58DPcOYKdc3Se94g+xL4pcEhbB54JOgAkwYTu/9dLeH2pDqeJZAABV # DWRQCaXfO5LgyKwKCLYXpigrZYCjUSBcr+Ve8PFWMhVTQl0v4q8J/AUmQN5W4n10 # 1cY2L4A7GTQG1h32HHAvfQESWP0xghnlMIIZ4QIBATBuMFcxCzAJBgNVBAYTAlVT # MR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jv # c29mdCBDb2RlIFNpZ25pbmcgUENBIDIwMjQCEzMAAAIdTRnITtcPV0gAAAAAAh0w # DQYJYIZIAWUDBAIBBQCgga4wGQYJKoZIhvcNAQkDMQwGCisGAQQBgjcCAQQwHAYK # KwYBBAGCNwIBCzEOMAwGCisGAQQBgjcCARUwLwYJKoZIhvcNAQkEMSIEIGoUi4zM # sts/VFO7JdQMxgiIjtmrA3jmdG1JT7wTB27AMEIGCisGAQQBgjcCAQwxNDAyoBSA # EgBNAGkAYwByAG8AcwBvAGYAdKEagBhodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20w # DQYJKoZIhvcNAQEBBQAEggEAa05tWEHzpGNU9PR09Gu2fCXbka/IR4mirGUJjV7v # Q/1kKlTxpmjZvX3L8IFcFWRzuI5xqcSswOEoPKsmp30awRGzXQ5rUx7QGueSBMIT # D7pjvgvtIyj5YsqRg5UBHLaYG6j7aPfJVzkNlml1b3Z1pj0p3Dci7ObtulL6M5gl # O7W5Yo3eNY/ZbkpcYjks8RcF09nKI/50uDgWBCXgA/vtty6GaEMKwekwqtyZhvXJ # uWO0NpDWS7Y3lA81/LKTrDMof8Qb7P5wrCyRpw8rE6135dJD6lCR4VwuG6Y1E09A # SbU7oSkGLbb8j53wsCgm3MT/pm55eXaNMmP/ZNFeLZKTJqGCF5cwgheTBgorBgEE # AYI3AwMBMYIXgzCCF38GCSqGSIb3DQEHAqCCF3AwghdsAgEDMQ8wDQYJYIZIAWUD # BAIBBQAwggFSBgsqhkiG9w0BCRABBKCCAUEEggE9MIIBOQIBAQYKKwYBBAGEWQoD # ATAxMA0GCWCGSAFlAwQCAQUABCBBukGi3XAf3r7ZUrqLOAjAQqeryYaydFrzYy5k # cJaNDAIGajH/ArYAGBMyMDI2MDcwNzE2NTYzMi41NTdaMASAAgH0oIHRpIHOMIHL # MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVk # bW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSUwIwYDVQQLExxN # aWNyb3NvZnQgQW1lcmljYSBPcGVyYXRpb25zMScwJQYDVQQLEx5uU2hpZWxkIFRT # UyBFU046MzMwMy0wNUUwLUQ5NDcxJTAjBgNVBAMTHE1pY3Jvc29mdCBUaW1lLVN0 # YW1wIFNlcnZpY2WgghHtMIIHIDCCBQigAwIBAgITMwAAAiEzwDX70g8hpAABAAAC # ITANBgkqhkiG9w0BAQsFADB8MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGlu # Z3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBv # cmF0aW9uMSYwJAYDVQQDEx1NaWNyb3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAxMDAe # Fw0yNjAyMTkxOTM5NTRaFw0yNzA1MTcxOTM5NTRaMIHLMQswCQYDVQQGEwJVUzET # MBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMV # TWljcm9zb2Z0IENvcnBvcmF0aW9uMSUwIwYDVQQLExxNaWNyb3NvZnQgQW1lcmlj # YSBPcGVyYXRpb25zMScwJQYDVQQLEx5uU2hpZWxkIFRTUyBFU046MzMwMy0wNUUw # LUQ5NDcxJTAjBgNVBAMTHE1pY3Jvc29mdCBUaW1lLVN0YW1wIFNlcnZpY2UwggIi # MA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDbcTACqU1YvRocyWL2PL9fyf/+ # ULs2qK7U1aZsRnDZSnlCr7K7jgA3eFCEJL5BZ7dUTC0DeZepf+ZC+7HEbB4IdzmJ # fQAUDFFerqY5VTHmQvP2XA3lWSFj740idcGUHglP5H/PbCJU7GAHWP2HdcCjdx1l # YAo0A+zLI7xwnTQeMyOXX212Eg4UmDPPJgxdTMw6WFVWsBPWRBi5gDixy2s+7R8A # Dk5lbBBFDB5h0CjrNWIN7uCAzF5g7trrL8nXIKp10mj9RxhcGQ+tlht6VIvdygRV # TUGdzFB2/nBvJqQ9kxxFltQST70fEdx4TyaKow/f5+BSh4z4/9f7NXIVVTLn/8kc # JAfRqFmRrrFt3IKby7VrzmYuoQWD0lmNFtGQ57BrJkPrPFAPek1ALtcbb7FH3nQp # vi8ngz/MFX/+cnmNFWFU29VVLmzB9XvLZxbYvkeett0mh5lfteeN2rEwUyrdrKuf # z9h2S6pbate+C2h02CrXwSka0x6ezpTmGkIJLFt25ub/UYXNLdHdsxGD6EfckOIo # JYsm4MS9F/vSqLNHK89I0vTLBngQEp6LIFkINanRT3PtNx3pNKRKJRALc6L6mhW4 # hL4aHL749qPfQ72t5qAMm5xiKYMgJ2WanidRLNuI251JIN7raaeA/2vb0XFkZcIb # TR1pfQGsco4U0g5tjwIDAQABo4IBSTCCAUUwHQYDVR0OBBYEFOYjIs5qa6pfuquP # yyK1FTr5QDCnMB8GA1UdIwQYMBaAFJ+nFV0AXmJdg/Tl0mWnG1M1GelyMF8GA1Ud # HwRYMFYwVKBSoFCGTmh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMvY3Js # L01pY3Jvc29mdCUyMFRpbWUtU3RhbXAlMjBQQ0ElMjAyMDEwKDEpLmNybDBsBggr # BgEFBQcBAQRgMF4wXAYIKwYBBQUHMAKGUGh0dHA6Ly93d3cubWljcm9zb2Z0LmNv # bS9wa2lvcHMvY2VydHMvTWljcm9zb2Z0JTIwVGltZS1TdGFtcCUyMFBDQSUyMDIw # MTAoMSkuY3J0MAwGA1UdEwEB/wQCMAAwFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwgw # DgYDVR0PAQH/BAQDAgeAMA0GCSqGSIb3DQEBCwUAA4ICAQA4I/3bkdnTxD2rFum3 # MF8xVKdEkohAObbePrQ+0fr5bRimjz9sVkKT/7gcj4OMcClSYG+IdX6Mp3EYsLHW # fjvwfzFoeZE+yTbdBj/1VHZQRuCmw6QqeVCTbw2nnS7nBxnWd9oZXbPUpqEawH5D # qXQaWFgR9A4KWVK/IvXVDMj1PlPCES1P3JonNbdhkkkz49rJuKOm5b7e/BH8loqA # mXOXRc22yxWVTMWrEp4pslmv8eT7VoY8X/jdKYTPVEXsfmLbVFcqzMuB8vFGfUyW # sWROS8wgq7lQYfWcYqh7NymoATX+wWYK3zWG7aRciPGUAzznXdf+aHtIWnQLNa5H # FmSXkiak3fSuprWYZiHhuYjE16hroApcBHpm+8S/kNqhm9WjQX+2BxnYv+Jejy6l # qTi8fLBLS069WXVw/ptf5IV+FtYl34GvVoeg31UoUmVVZe1SDUJkm9dDXc8l/qBD # YiAIT2CCsPTyt9XA9JVuHxdP63n7ChvWAO/47QRuCDsUlFJoWwyBwl7jeYpaRVMt # Qt0iuJMGGjgEaJX1Q/2j8sXURvTceLHDD9ipWt092ZDWMQciDRmhHNFOX1dnjBvk # /k1UMcg997j5oYznAnSpJvlg/4BP3aVE0h/YH2KgsKbU4NXZHAjJXj2Slqo1C115 # CG6qBZaFkM8W6vPZCm5qnSezOjCCB3EwggVZoAMCAQICEzMAAAAVxedrngKbSZkA # AAAAABUwDQYJKoZIhvcNAQELBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpX # YXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQg # Q29ycG9yYXRpb24xMjAwBgNVBAMTKU1pY3Jvc29mdCBSb290IENlcnRpZmljYXRl # IEF1dGhvcml0eSAyMDEwMB4XDTIxMDkzMDE4MjIyNVoXDTMwMDkzMDE4MzIyNVow # fDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1Jl # ZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEmMCQGA1UEAxMd # TWljcm9zb2Z0IFRpbWUtU3RhbXAgUENBIDIwMTAwggIiMA0GCSqGSIb3DQEBAQUA # A4ICDwAwggIKAoICAQDk4aZM57RyIQt5osvXJHm9DtWC0/3unAcH0qlsTnXIyjVX # 9gF/bErg4r25PhdgM/9cT8dm95VTcVrifkpa/rg2Z4VGIwy1jRPPdzLAEBjoYH1q # UoNEt6aORmsHFPPFdvWGUNzBRMhxXFExN6AKOG6N7dcP2CZTfDlhAnrEqv1yaa8d # q6z2Nr41JmTamDu6GnszrYBbfowQHJ1S/rboYiXcag/PXfT+jlPP1uyFVk3v3byN # pOORj7I5LFGc6XBpDco2LXCOMcg1KL3jtIckw+DJj361VI/c+gVVmG1oO5pGve2k # rnopN6zL64NF50ZuyjLVwIYwXE8s4mKyzbnijYjklqwBSru+cakXW2dg3viSkR4d # Pf0gz3N9QZpGdc3EXzTdEonW/aUgfX782Z5F37ZyL9t9X4C626p+Nuw2TPYrbqgS # Uei/BQOj0XOmTTd0lBw0gg/wEPK3Rxjtp+iZfD9M269ewvPV2HM9Q07BMzlMjgK8 # QmguEOqEUUbi0b1qGFphAXPKZ6Je1yh2AuIzGHLXpyDwwvoSCtdjbwzJNmSLW6Cm # gyFdXzB0kZSU2LlQ+QuJYfM2BjUYhEfb3BvR/bLUHMVr9lxSUV0S2yW6r1AFemzF # ER1y7435UsSFF5PAPBXbGjfHCBUYP3irRbb1Hode2o+eFnJpxq57t7c+auIurQID # AQABo4IB3TCCAdkwEgYJKwYBBAGCNxUBBAUCAwEAATAjBgkrBgEEAYI3FQIEFgQU # KqdS/mTEmr6CkTxGNSnPEP8vBO4wHQYDVR0OBBYEFJ+nFV0AXmJdg/Tl0mWnG1M1 # GelyMFwGA1UdIARVMFMwUQYMKwYBBAGCN0yDfQEBMEEwPwYIKwYBBQUHAgEWM2h0 # dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMvRG9jcy9SZXBvc2l0b3J5Lmh0 # bTATBgNVHSUEDDAKBggrBgEFBQcDCDAZBgkrBgEEAYI3FAIEDB4KAFMAdQBiAEMA # QTALBgNVHQ8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAfBgNVHSMEGDAWgBTV9lbL # j+iiXGJo0T2UkFvXzpoYxDBWBgNVHR8ETzBNMEugSaBHhkVodHRwOi8vY3JsLm1p # Y3Jvc29mdC5jb20vcGtpL2NybC9wcm9kdWN0cy9NaWNSb29DZXJBdXRfMjAxMC0w # Ni0yMy5jcmwwWgYIKwYBBQUHAQEETjBMMEoGCCsGAQUFBzAChj5odHRwOi8vd3d3 # Lm1pY3Jvc29mdC5jb20vcGtpL2NlcnRzL01pY1Jvb0NlckF1dF8yMDEwLTA2LTIz # LmNydDANBgkqhkiG9w0BAQsFAAOCAgEAnVV9/Cqt4SwfZwExJFvhnnJL/Klv6lwU # tj5OR2R4sQaTlz0xM7U518JxNj/aZGx80HU5bbsPMeTCj/ts0aGUGCLu6WZnOlNN # 3Zi6th542DYunKmCVgADsAW+iehp4LoJ7nvfam++Kctu2D9IdQHZGN5tggz1bSNU # 5HhTdSRXud2f8449xvNo32X2pFaq95W2KFUn0CS9QKC/GbYSEhFdPSfgQJY4rPf5 # KYnDvBewVIVCs/wMnosZiefwC2qBwoEZQhlSdYo2wh3DYXMuLGt7bj8sCXgU6ZGy # qVvfSaN0DLzskYDSPeZKPmY7T7uG+jIa2Zb0j/aRAfbOxnT99kxybxCrdTDFNLB6 # 2FD+CljdQDzHVG2dY3RILLFORy3BFARxv2T5JL5zbcqOCb2zAVdJVGTZc9d/HltE # AY5aGZFrDZ+kKNxnGSgkujhLmm77IVRrakURR6nxt67I6IleT53S0Ex2tVdUCbFp # AUR+fKFhbHP+CrvsQWY9af3LwUFJfn6Tvsv4O+S3Fb+0zj6lMVGEvL8CwYKiexcd # FYmNcP7ntdAoGokLjzbaukz5m/8K6TT4JDVnK+ANuOaMmdbhIurwJ0I9JZTmdHRb # atGePu1+oDEzfbzL6Xu/OHBE0ZDxyKs6ijoIYn/ZcGNTTY3ugm2lBRDBcQZqELQd # VTNYs6FwZvKhggNQMIICOAIBATCB+aGB0aSBzjCByzELMAkGA1UEBhMCVVMxEzAR # BgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1p # Y3Jvc29mdCBDb3Jwb3JhdGlvbjElMCMGA1UECxMcTWljcm9zb2Z0IEFtZXJpY2Eg # T3BlcmF0aW9uczEnMCUGA1UECxMeblNoaWVsZCBUU1MgRVNOOjMzMDMtMDVFMC1E # OTQ3MSUwIwYDVQQDExxNaWNyb3NvZnQgVGltZS1TdGFtcCBTZXJ2aWNloiMKAQEw # BwYFKw4DAhoDFQALbEgZZnyYHXJ1DGb5fGjplXptuaCBgzCBgKR+MHwxCzAJBgNV # BAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4w # HAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMTHU1pY3Jvc29m # dCBUaW1lLVN0YW1wIFBDQSAyMDEwMA0GCSqGSIb3DQEBCwUAAgUA7feBgTAiGA8y # MDI2MDcwNzEzNDUzN1oYDzIwMjYwNzA4MTM0NTM3WjB3MD0GCisGAQQBhFkKBAEx # LzAtMAoCBQDt94GBAgEAMAoCAQACAkIuAgH/MAcCAQACAhK6MAoCBQDt+NMBAgEA # MDYGCisGAQQBhFkKBAIxKDAmMAwGCisGAQQBhFkKAwKgCjAIAgEAAgMHoSChCjAI # AgEAAgMBhqAwDQYJKoZIhvcNAQELBQADggEBAAJLMf1Gitylnq+rQvzTg6hNgec8 # EZ5qCPzxlK/fdK+FQQ6cOTculLroDlCmkExB3u5b4MPQFBymJlvi5iUnuj6zUmbX # Wb340CJFuejGnKGBFAd/3+jEnK590sJuju7bYkWMjRQ4XV9S3MVKatDM0mrFLGMn # ZQEYAWvi08Xp0/EL/qjyQV+cN0US+eIRZaV4I/0Qg2sVc0tt885C6excF/AhZnqp # m8bheMKReJmN7m6AhcBnpF9P6eJ61PnseWTN8drxc6K0evYacIIa6ryVOCPYRzgk # 36gNQWZRXgGBN2/5tcelk1tVpys2cNpYYJVbB+aKCNPdW2ZHA7kKMQcuTX0xggQN # MIIECQIBATCBkzB8MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQ # MA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9u # MSYwJAYDVQQDEx1NaWNyb3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAxMAITMwAAAiEz # wDX70g8hpAABAAACITANBglghkgBZQMEAgEFAKCCAUowGgYJKoZIhvcNAQkDMQ0G # CyqGSIb3DQEJEAEEMC8GCSqGSIb3DQEJBDEiBCBWKagNFjRhYeIUZ9sfov1wPIk4 # 1BNwR7had8K97pegWDCB+gYLKoZIhvcNAQkQAi8xgeowgecwgeQwgb0EIADvIQef # FVUa4BJy8IZywMAvmGSKdUVqEmy9A++PCj1EMIGYMIGApH4wfDELMAkGA1UEBhMC # VVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNV # BAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRp # bWUtU3RhbXAgUENBIDIwMTACEzMAAAIhM8A1+9IPIaQAAQAAAiEwIgQgEmOeFgFi # 09JxkvKaz7592StVlrmW85SDR5R/mxsTzsMwDQYJKoZIhvcNAQELBQAEggIAHmb7 # +SNYkqYBgNehjARFPgrgPYuq0NxATqPmpwJdmSLqLTbbuGnFx87rh1Klum9p98tQ # ODHLs8zX053ycbUQI9Z/a2kgaaThS4nkll42/MpuU/UeBX8eW8kZWNAdfkEVSsqG # GavJfsinSJvMhHNAMOe7Pw0YRqnxd1MXGHwoshElfx6F8vdUlHA7t27Ucsz+Ka73 # rPesfdjwBMTk3LTv6Eh1cbYTn++DNP1KxRCTqUlhEkJeCIdxYn8DiD6HFC23S3YG # 6ZKCpQm8gXC1HSTwtInddAIfw3Zh58j63u8oo3WPsHD4RH7Ll2XehzS/R01PrLJb # co3nhlYrj1ub1mR+yCyH8f+eIbIsdKw4txA8Bpux53DJkviAFq+46inrK3NHfhmu # 8Ju/P1LMnPaKoQ4ZvfF/VA5DbrN7/vkH0UTQvZp+OO/Iz36hIYKvnpdAslJGBZJ1 # 1MHJZ/B9z/U635KONkyX3IFghcduGVJhKkOKlGgb3z6w6pqJJn0brX5PX+nZO9gU # aodpyfCoFdMJMJ9jf0+zz5uMDynQiW5cokDHBfiYepQzARdvb3JNgQXRaXDKRaYa # H7MKrHqx++gWXX6PXUDawEzu5nQRNl3AEer52msMLpHtbBlREBBaRZOwpAoT7tku # QbaeZdb2wK/0Wxw+TSNbKDcieWInpYr/DG554b0= # SIG # End signature block |