Private/AzStackHci.ParallelLayer7.Helpers.ps1
|
# ============================================================================= # Strict Mode v1 (PS 5.1 safe) - surfaces reads of uninitialised variables at runtime. Set-StrictMode -Version 1.0 # AzStackHci.ParallelLayer7.Helpers.ps1 # ============================================================================= # Private helpers for the Layer-7 endpoint sweep in Test-AzureLocalConnectivity. # # Two helpers live here: # 1. Invoke-Layer7EndpointTest - tests ONE endpoint (mutates the $UrlObject in place, # may append CRL/OCSP dependency rows to $script:Results # via Add-CrlDependencyRowToResults). This is the # extracted body of the main per-URL ForEach loop and # is byte-identical to the v0.6.6 inline behaviour. # 2. Invoke-Layer7BucketWorker - runs inside a Start-Job worker process; loops over # a bucket of $UrlObject rows calling # Invoke-Layer7EndpointTest, snapshots the module-scope # classification state ($script:SSLInspectedURLs, # $script:CRLOfflineURLs, $script:PrivateLink* arrays, # any newly-appended $script:Results rows) and returns # a hashtable for the parent process to merge. # # The parallel fan-out is opt-in via the new -Parallelism parameter on # Test-AzureLocalConnectivity (default 1, sequential, byte-identical to v0.6.6). # ============================================================================= function Invoke-Layer7EndpointTest { <# .SYNOPSIS Runs DNS + TCP + Layer-7 connectivity tests for a single endpoint row, mutating the row in place. Body extracted verbatim from the main ForEach loop in Test-AzureLocalConnectivity to enable parallel fan-out via Start-Job. .DESCRIPTION Sequential default behaviour: identical to the pre-extraction inline ForEach body. Mutates $UrlObject fields (TCPStatus, Layer7Status, Layer7Response, certificate columns, IPAddress, Note). May call Add-CrlDependencyRowToResults which appends new rows to $script:Results. May also append to module-scope classification state ($script:SSLInspectedURLs, $script:CRLOfflineURLs, $script:PrivateLink* arrays, $script:SSLInspectionDetected) via the call into Test-Layer7Connectivity -> Get-Layer7CertificateDetails / Get-DnsRecord. .PARAMETER UrlObject The PSCustomObject row from $script:Results to test. Mutated in place. .PARAMETER SkipUrls The list of URLs that the parent loop has decided to skip (the manually-curated "skip" list — pre-2026 hardcoded entries like wustat.windows.com). .PARAMETER ArcGatewayDeployment Whether -ArcGatewayDeployment was specified on the public Test-AzureLocalConnectivity. .PARAMETER NTPTimeServer Optional user-supplied NTP server URL (replaces time.windows.com for that one row). .PARAMETER IncludeTCPConnectivityTests Whether -IncludeTCPConnectivityTests was specified on the public function. .PARAMETER RequestMethod 'Get' / 'Head' / 'Auto' — plumbed through to Test-Layer7Connectivity. #> [CmdletBinding()] param( [Parameter(Mandatory)] [object]$UrlObject, [Parameter(Mandatory)] [array]$SkipUrls, [Parameter(Mandatory=$false)] [bool]$ArcGatewayDeployment = $false, [Parameter(Mandatory=$false)] [string]$NTPTimeServer, [Parameter(Mandatory=$false)] [bool]$IncludeTCPConnectivityTests = $false, [Parameter(Mandatory=$false)] [ValidateSet('Get','Head','Auto')] [string]$RequestMethod = 'Auto' ) # Local alias preserves the old loop variable name so the extracted body remains # diff-readable against the v0.6.6 ForEach body it came from. $urlObj = $UrlObject # Per-iteration DNSCheck reset (matches original "Remove-Variable DNSCheck" inside the loop). $DNSCheck = $null Write-Debug "Arc Gateway boolean for url '$($urlObj.url)' from source $($urlObj.Source) = $($urlObj.ArcGateway)" # If the ArcGatewayDeployment switch is used, only test URLs that do not support Arc Gateway if ($ArcGatewayDeployment) { # Skip URLs with ArcGateway -eq $True if ($urlObj.ArcGateway) { # Skip URLs that support Arc Gateway Write-HostAzS "Skipped URL: '$($urlObj.URL)' as supported by Arc Gateway" -ForegroundColor Yellow Set-UrlObjectSkipFields -UrlObject $urlObj -TCPStatus "Skipped" -Layer7Status "Skipped" $urlObj.Note = "Skipped, URL is supported by Arc Gateway - $($urlObj.Note)" Write-HostAzS "" return } } # Process URLs that require special handling if (($urlObj.URL -like ("*.gw.arc.azure.com") -or $urlObj.URL -like ("*.gw.arc.azure.net"))) { if ($ArcGatewayDeployment) { # Replace the URL with the user-defined Arc Gateway URL, if specified $urlObj.URL = (Get-DomainFromURL -url $script:UpdatedArcGatewayURL).Domain # Run DNS + TCP + Layer 7 connectivity tests using shared helper # Forward -RequestMethod down through Invoke-EndpointConnectivityTest into Test-Layer7Connectivity (parity with the non-wildcard branch). $testResult = Invoke-EndpointConnectivityTest -Url $urlObj.URL -Port $urlObj.Port -IncludeTCPConnectivityTests:$IncludeTCPConnectivityTests -RequestMethod $RequestMethod Copy-ConnectivityResultsToUrlObject -UrlObject $urlObj -TestResult $testResult } else { # Not using Arc Gateway, skip the URL Write-HostAzS "Skipping URL, (not using Arc Gateway): $($urlObj.URL)" -ForegroundColor Green Set-UrlObjectSkipFields -UrlObject $urlObj -TCPStatus "Skipped" -Layer7Status "Skipped" $urlObj.Note = "Skipped, not using Arc Gateway, as '-ArcGatewayDeployment' switch not present - $($urlObj.Note)" } } elseif ($urlObj.URL -eq "time.windows.com") { # Replace the URL with the user-defined NTP Time Server, if specified if ([string]::IsNullOrWhiteSpace($NTPTimeServer)) { # Use default NTP Time Server Write-HostAzS "Using default NTP Time Server: 'time.windows.com' for NTP connectivity test on UDP port 123, as the '`$NTPTimeServer' parameter was not specified" -ForegroundColor Yellow $DNSCheck = Get-DnsRecord -url (Get-DomainFromURL -url $urlObj.URL).Domain } else { Write-HostAzS "Replacing default NTP Time Server 'time.windows.com' with user-defined NTP server: '$NTPTimeServer'" -ForegroundColor Green [string]$urlObj.URL = (Get-DomainFromURL -url $NTPTimeServer).Domain $urlObj.Source = "User-defined NTP server" # //// Ignore RFC1918 check during DNS check for user-defined NTP server //// $DNSCheck = Get-DnsRecord -url (Get-DomainFromURL -url $NTPTimeServer).Domain -SkipRfc1918Check } # If using a Proxy, DNS resolution from the local host may not be required if (($DNSCheck.DNSExists) -or ($script:Proxy.Enabled)) { $StopWatch = [Diagnostics.Stopwatch]::StartNew() $urlObj.TCPStatus, $urlObj.IPAddress = Test-NTPConnectivity -ntpServer $urlObj.URL if ($urlObj.TCPStatus -eq "Success") { $urlObj.Layer7Status = "Success" } else { $urlObj.Layer7Status = "Failed" } if ([string]::IsNullOrWhiteSpace($urlObj.IPAddress)) { $urlObj.IPAddress = $DNSCheck.IpAddress } $urlObj.Layer7Response = "UDP port 123" $urlObj.Layer7ResponseTime = [math]::round($StopWatch.Elapsed.TotalMilliseconds/1000, 3) $StopWatch.Stop() # NTP does not use SSL certificates $urlObj.CertificateIssuer = "N/A" $urlObj.CertificateSubject = "N/A" $urlObj.CertificateThumbprint = "N/A" $urlObj.IntermediateCertificateIssuer = "N/A" $urlObj.IntermediateCertificateSubject = "N/A" $urlObj.IntermediateCertificateThumbprint = "N/A" $urlObj.RootCertificateIssuer = "N/A" $urlObj.RootCertificateSubject = "N/A" $urlObj.RootCertificateThumbprint = "N/A" } else { Set-UrlObjectSkipFields -UrlObject $urlObj -TCPStatus "Failed" -Layer7Status "Failed" -IPAddress $DNSCheck.IpAddress } # //// Skipped URLs //// } elseif ($SkipUrls.URL.Contains($urlObj.URL)) { Write-HostAzS "Skipped URL: $($urlObj.URL)" -ForegroundColor Green Set-UrlObjectSkipFields -UrlObject $urlObj -TCPStatus "Skipped" -Layer7Status "Skipped" $urlObj.Note = "Skipped URL - $($urlObj.Note)" # //// Wildcard URLs //// } elseif ($urlObj.IsWildcard) { Write-HostAzS "Wildcard URLs are processed later..." -ForegroundColor Yellow Set-UrlObjectSkipFields -UrlObject $urlObj -TCPStatus "Skipped" -Layer7Status "Skipped" $urlObj.Note = "$($urlObj.Note)" # //// Non-wildcard URLs //// } else { # Placeholder KeyVault URL: show Warning status instead of running tests against a URL that will always fail DNS if ($urlObj.URL -like "yourhcikeyvaultname.vault.*") { Write-HostAzS "WARNING: Default KeyVault endpoint '$($urlObj.URL)' is being used." -ForegroundColor Yellow Write-HostAzS "INFO: Specify your KeyVault endpoint using the '-KeyVaultURL' parameter to validate your actual KeyVault connectivity." -ForegroundColor Yellow Set-UrlObjectSkipFields -UrlObject $urlObj -TCPStatus "Failed" -Layer7Status "Failed" $urlObj.Note = "PARAMETER `"-KeyVaultURL https://<yourKeyVault>.vault.azure.net`" WAS NOT USED - THIS IS REQUIRED TO SPECIFY YOUR UNIQUE KEY VAULT NAME - Key vault for deployment secrets." # Sleep for 3 seconds to allow the user to read the warning, if present. Start-Sleep -Seconds 3 # NOTE: original 'Continue' here SKIPS the trailing Write-HostAzS "" — replicate by returning early. return } # Run DNS + TCP + Layer 7 connectivity tests using shared helper # Forward -RequestMethod down through Invoke-EndpointConnectivityTest into Test-Layer7Connectivity. $testResult = Invoke-EndpointConnectivityTest -Url $urlObj.URL -Port $urlObj.Port -IncludeTCPConnectivityTests:$IncludeTCPConnectivityTests -RequestMethod $RequestMethod Copy-ConnectivityResultsToUrlObject -UrlObject $urlObj -TestResult $testResult } # Add line return after each URL (matches the original loop trailing Write-HostAzS ""). Write-HostAzS "" } function Invoke-Layer7BucketWorker { <# .SYNOPSIS Worker scriptblock body — runs inside a Start-Job child process, loops over a bucket of endpoint rows calling Invoke-Layer7EndpointTest, and returns a snapshot of all module-scope classification state for the parent process to merge. .DESCRIPTION Each Start-Job worker is its own process, so $script:* variables are isolated. The worker imports the module (so Invoke-Layer7EndpointTest, Test-Layer7Connectivity, Get-DnsRecord, Add-CrlDependencyRowToResults etc. are all available), seeds the module-scope state from the parent's snapshot, runs the bucket sequentially, then returns a hashtable that the parent merges. Returned hashtable keys: - Rows : the mutated $UrlObject rows from this bucket (RowID-tagged) - NewCrlRows : any rows appended to $script:Results by Add-CrlDependencyRowToResults inside the bucket - RedirectedResults : URLs the worker discovered via HTTP 301/302 redirect responses ($script:RedirectedResults snapshot — Phase 4 of Test-AzureLocalConnectivity iterates the parent's copy of this list, so workers MUST plumb it back or redirected URLs are silently dropped from the output) - SSLInspectedURLs : list of URLs flagged for SSL Inspection - CRLOfflineURLs : list of URLs whose CRL/OCSP check was offline - SSLInspectionDetected : bool — true if any row in the bucket triggered SSL inspection - PrivateLinkDetected : bool — true if any URL in the bucket resolved to RFC1918 (the parent uses this scalar flag to decide whether to print the customer-facing 'PRIVATE LINK DETECTED' warning) - PrivateLinkDetectedArray : list of URLs flagged for Private Link - PrivateLinkCriticalArray : list of URLs flagged for Private Link (RFC1918, critical) - PrivateLinkProxyBypassArray: list of URLs flagged for Private Link (RFC1918, proxy bypass) - BucketIndex : the worker's bucket index (for deterministic merge order) - BucketWallClockSec : wall-clock duration of this worker's bucket Diagnostic console output produced during testing is interleaved across workers — that is the documented behaviour of the parallel mode. The transcript still captures every line; the JSON output is RowID-sorted so customer-facing output ordering is identical to sequential mode. .PARAMETER Bucket Array of $UrlObject rows for this worker to test (round-robin partition from parent). .PARAMETER ParameterBag Hashtable carrying SkipUrls / ArcGatewayDeployment / NTPTimeServer / IncludeTCPConnectivityTests / RequestMethod / Proxy / UpdatedArcGatewayURL. .PARAMETER BucketIndex Index of this bucket (0..N-1). #> [CmdletBinding()] param( [Parameter(Mandatory)] [array]$Bucket, [Parameter(Mandatory)] [hashtable]$ParameterBag, [Parameter(Mandatory=$false)] [int]$BucketIndex = 0 ) $bucketSw = [System.Diagnostics.Stopwatch]::StartNew() # Tag every Write-HostAzS line emitted from inside this worker with [bucket-N] # so the interleaved transcript is greppable per bucket. Cleared in the finally # so the parent process never inherits a stale prefix. $script:WorkerLogPrefix = "[bucket-$BucketIndex] " # Wrap the bucket body in try/finally so the [bucket-N] prefix is ALWAYS cleared # (and the stopwatch always stopped) even if a terminating error escapes the # per-row try/catch below. Body indentation is intentionally unchanged to keep # this diff minimal and reviewable. try { # Seed module-scope state from the parent's snapshot — Invoke-Layer7EndpointTest reads # $script:Proxy and $script:UpdatedArcGatewayURL. Constants.ps1's Initialize-ModuleState # has already created the empty ArrayLists / arrays for the classification state, so # we can rely on those being initialised but empty in this worker process. if ($ParameterBag.ContainsKey('Proxy')) { $script:Proxy = $ParameterBag.Proxy } if ($ParameterBag.ContainsKey('UpdatedArcGatewayURL')) { $script:UpdatedArcGatewayURL = $ParameterBag.UpdatedArcGatewayURL } # Snapshot the row count BEFORE running the bucket so we can isolate any new # CRL/OCSP rows that Add-CrlDependencyRowToResults appends during testing. # The worker's $script:Results starts as a (cloned) copy of the bucket so that # Add-CrlDependencyRowToResults's host-level dedupe still works correctly within # the bucket's scope. [System.Collections.ArrayList]$script:Results = @($Bucket) $initialRowCount = $script:Results.Count foreach ($row in $Bucket) { try { Invoke-Layer7EndpointTest ` -UrlObject $row ` -SkipUrls $ParameterBag.SkipUrls ` -ArcGatewayDeployment ([bool]$ParameterBag.ArcGatewayDeployment) ` -NTPTimeServer $ParameterBag.NTPTimeServer ` -IncludeTCPConnectivityTests ([bool]$ParameterBag.IncludeTCPConnectivityTests) ` -RequestMethod $ParameterBag.RequestMethod } catch { # Mark the row as Failed but never abort the bucket — bucket-level isolation matters. try { $row.Layer7Status = 'Failed' $row.Layer7Response = "Worker exception: $($_.Exception.Message)" } catch {} } } # Identify any new CRL/OCSP dependency rows the bucket appended during testing. $newCrlRows = @() if ($script:Results.Count -gt $initialRowCount) { $newCrlRows = @($script:Results | Select-Object -Skip $initialRowCount) } } finally { $bucketSw.Stop() # Clear the bucket prefix so a direct (non-Start-Job) caller doesn't leak it. # In the Start-Job process this is moot — the process is torn down — but # Pester tests that invoke Invoke-Layer7BucketWorker in-proc would otherwise # see subsequent Write-HostAzS calls still tagged. $script:WorkerLogPrefix = '' } return @{ Rows = @($Bucket) NewCrlRows = $newCrlRows RedirectedResults = @($script:RedirectedResults) SSLInspectedURLs = @($script:SSLInspectedURLs) CRLOfflineURLs = @($script:CRLOfflineURLs) SSLInspectionDetected = [bool]$script:SSLInspectionDetected PrivateLinkDetected = [bool]$script:PrivateLinkDetected PrivateLinkDetectedArray = @($script:PrivateLinkDetectedArray) PrivateLinkCriticalArray = @($script:PrivateLinkCriticalArray) PrivateLinkProxyBypassArray = @($script:PrivateLinkProxyBypassArray) BucketIndex = $BucketIndex BucketWallClockSec = [math]::Round($bucketSw.Elapsed.TotalSeconds, 3) } } function Merge-Layer7WorkerResult { <# .SYNOPSIS Merges one worker's returned hashtable into the parent module-scope state. .DESCRIPTION - Replaces parent rows by RowID with the worker's mutated copies. - Appends new CRL/OCSP dependency rows to $script:Results (idempotent: skips URLs already present at the parent level). - Unions the SSL-inspection / CRL-offline / Private-Link arrays. - ORs the SSLInspectionDetected flag. .PARAMETER WorkerResult The hashtable returned by Invoke-Layer7BucketWorker. #> [CmdletBinding()] param( [Parameter(Mandatory)] [hashtable]$WorkerResult ) # The worker mutated the original PSCustomObject references in $Bucket. Because # Start-Job serialises objects across the process boundary, the deserialised rows # returned in WorkerResult.Rows are NOT the same instances as the parent's # $script:Results entries. Merge by RowID match. foreach ($workerRow in $WorkerResult.Rows) { $match = $script:Results | Where-Object { $_.RowID -eq $workerRow.RowID } | Select-Object -First 1 if ($null -ne $match) { # Copy back every mutated field. This is intentionally explicit (not # ForEach-Object Get-Member) to avoid accidentally overwriting RowID/URL/Port etc. foreach ($field in @( 'TCPStatus','IPAddress','Layer7Status','Layer7Response','Layer7ResponseTime', 'CertificateIssuer','CertificateSubject','CertificateThumbprint', 'IntermediateCertificateIssuer','IntermediateCertificateSubject','IntermediateCertificateThumbprint', 'RootCertificateIssuer','RootCertificateSubject','RootCertificateThumbprint', 'Note','URL','Source' )) { if (($workerRow.PSObject.Properties.Name -contains $field) -and ($match.PSObject.Properties.Name -contains $field)) { $match.$field = $workerRow.$field } } } } # Append any new CRL/OCSP dependency rows the worker generated. When the same # dependency URL is discovered in another bucket the row is NOT re-added — instead # we extend the existing row's Source field so customer-facing output preserves # all parent-domain attributions. This mirrors the Tier-1 dedupe semantics inside # Add-CrlDependencyRowToResults (Private/AzStackHci.Connectivity.Helpers.ps1) for # the cross-bucket case, where each worker's local dedupe cannot see other buckets. foreach ($newRow in $WorkerResult.NewCrlRows) { # Defence-in-depth: skip any $null row (mirrors the RedirectedResults loop guard # below) so a malformed worker payload can never throw on $newRow.URL. if ($null -eq $newRow) { continue } $existing = $script:Results | Where-Object { ($_.URL -eq $newRow.URL) -and ($_.Port -eq $newRow.Port) } | Select-Object -First 1 if ($null -eq $existing) { $script:Results.Add($newRow) | Out-Null } elseif ($newRow.PSObject.Properties.Name -contains 'Source' -and -not [string]::IsNullOrWhiteSpace($newRow.Source)) { # Extract the parent-domain hint(s) from the worker's Source string and append # any not already present on the parent row's Source. The Source field uses # '; '-separated parent-domain tokens so a simple substring check is reliable. $existingSrc = if ([string]::IsNullOrWhiteSpace($existing.Source)) { '' } else { $existing.Source } foreach ($token in ($newRow.Source -split ';\s*')) { $t = $token.Trim() if ($t -and ($existingSrc -notmatch [regex]::Escape($t))) { $existing.Source = if ([string]::IsNullOrWhiteSpace($existing.Source)) { $t } else { "$($existing.Source); $t" } $existingSrc = $existing.Source } } } } # Plumb back any URLs the worker discovered as HTTP 301/302 redirect targets so # Phase 4 of Test-AzureLocalConnectivity (the redirected-URLs loop) can test them. # Without this merge step those rows would be silently dropped from the JSON / HTML # / CSV output in -Parallelism > 1 runs. Dedupe by url + Port matches the existing # New-RedirectedResultEntry semantics in Private/AzStackHci.Connectivity.Helpers.ps1. if ($WorkerResult.RedirectedResults) { foreach ($redirRow in $WorkerResult.RedirectedResults) { if ($null -eq $redirRow) { continue } $existsInRedirected = $script:RedirectedResults | Where-Object { ($_.url -eq $redirRow.url) -and ($_.Port -eq $redirRow.Port) } | Select-Object -First 1 $existsInResults = $script:Results | Where-Object { ($_.URL -eq $redirRow.url) -and ($_.Port -eq $redirRow.Port) } | Select-Object -First 1 if ((-not $existsInRedirected) -and (-not $existsInResults)) { $script:RedirectedResults.Add($redirRow) | Out-Null } } } foreach ($u in $WorkerResult.SSLInspectedURLs) { if (-not ($script:SSLInspectedURLs -contains $u)) { $script:SSLInspectedURLs.Add($u) | Out-Null } } foreach ($u in $WorkerResult.CRLOfflineURLs) { if (-not ($script:CRLOfflineURLs -contains $u)) { $script:CRLOfflineURLs.Add($u) | Out-Null } } if ($WorkerResult.SSLInspectionDetected) { $script:SSLInspectionDetected = $true } # OR-merge the scalar PrivateLinkDetected flag — the parent uses this boolean (NOT # the array) at the end of Test-AzureLocalConnectivity to decide whether to print # the customer-facing 'PRIVATE LINK DETECTED' warning block. if ($WorkerResult.PrivateLinkDetected) { $script:PrivateLinkDetected = $true } foreach ($u in $WorkerResult.PrivateLinkDetectedArray) { if (-not ($script:PrivateLinkDetectedArray -contains $u)) { $script:PrivateLinkDetectedArray += $u } } foreach ($u in $WorkerResult.PrivateLinkCriticalArray) { if (-not ($script:PrivateLinkCriticalArray -contains $u)) { $script:PrivateLinkCriticalArray += $u } } foreach ($u in $WorkerResult.PrivateLinkProxyBypassArray) { if (-not ($script:PrivateLinkProxyBypassArray -contains $u)) { $script:PrivateLinkProxyBypassArray += $u } } } function Split-Layer7BucketsRoundRobin { <# .SYNOPSIS Cost-aware bin-packs a row array into N buckets, with plain round-robin fallback. .DESCRIPTION Endpoint timing is heterogeneous: rows that trigger CRL/OCSP chain validation or that are flagged as Critical/Wildcard typically take 2-3x longer than a plain HEAD probe. A pure `i % Buckets` round-robin can leave one worker with most of the slow rows. Algorithm (cost-aware mode, default): 1. Estimate a per-row cost (Get-Layer7RowCost — CRL/OCSP/Critical = 3, Wildcard = 2, Redirected = 2, all others = 1). 2. Sort rows DESC by cost. (Output ordering is preserved at MERGE time via RowID-sort — see Merge-Layer7WorkerResult — so the bucket-internal order does not affect customer-visible results.) 3. Greedy bin-pack: for each row, place it in the bucket with the lowest current cumulative cost. Ties broken by lowest bucket index. Algorithm (legacy round-robin, opt-in via -RoundRobin): Plain `i % Buckets` — preserved for benchmarking / regression comparison. .PARAMETER Rows The full ordered array of rows to partition. .PARAMETER Buckets Number of buckets (= -Parallelism). Range 1-64. .PARAMETER RoundRobin Switch to force the legacy `i % Buckets` distribution. Default behaviour (switch absent) is cost-aware bin-packing. #> [CmdletBinding()] param( [Parameter(Mandatory)] [array]$Rows, [Parameter(Mandatory)] [ValidateRange(1, 64)] [int]$Buckets, [switch]$RoundRobin ) # Initialise N empty bucket arrays. The leading comma on `,@()` is required — # `for` would otherwise unwrap a 0-element array, leaving fewer than N buckets. $result = @(for ($i = 0; $i -lt $Buckets; $i++) { ,@() }) if ($RoundRobin -or $Buckets -eq 1 -or $Rows.Count -le $Buckets) { # Legacy / trivial cases: bin-packing has no benefit. for ($i = 0; $i -lt $Rows.Count; $i++) { $b = $i % $Buckets $result[$b] += $Rows[$i] } return ,$result } # Cost-aware greedy bin-pack. $costs = @{} foreach ($row in $Rows) { $costs[$row] = Get-Layer7RowCost -Row $row } # Sort DESC by cost. Stable for ties (PowerShell's Sort-Object is NOT stable; # use a secondary key by original index to make ordering deterministic for tests). $indexed = for ($i = 0; $i -lt $Rows.Count; $i++) { [pscustomobject]@{ Row = $Rows[$i]; Cost = $costs[$Rows[$i]]; Index = $i } } $sorted = @($indexed | Sort-Object -Property @{Expression='Cost';Descending=$true}, @{Expression='Index';Descending=$false}) $bucketCost = New-Object 'int[]' $Buckets foreach ($entry in $sorted) { # Find bucket with minimum cumulative cost (ties → lowest index). $minIdx = 0 for ($b = 1; $b -lt $Buckets; $b++) { if ($bucketCost[$b] -lt $bucketCost[$minIdx]) { $minIdx = $b } } $result[$minIdx] += $entry.Row $bucketCost[$minIdx] += $entry.Cost } return ,$result } function Get-Layer7RowCost { <# .SYNOPSIS Estimate the relative cost of testing a Layer-7 row, used by Split-Layer7BucketsRoundRobin. .DESCRIPTION Returns 3 for CRL/OCSP / Critical rows (slowest — chain validation, often blocked endpoints with full timeout), 2 for Wildcard / Redirected rows (medium — extra DNS + sometimes a second HEAD), and 1 for everything else. The exact numbers are not load-bearing; they only need to reflect the relative wall-clock weight so the greedy bin-pack balances correctly. #> [CmdletBinding()] [OutputType([int])] param( [Parameter(Mandatory)] [object]$Row ) $isCrl = ($Row.PSObject.Properties['Source'] -and ($Row.Source -match 'CRL|OCSP|crl\.|ocsp\.')) $isCrit = ($Row.PSObject.Properties['Source'] -and ($Row.Source -match 'Critical')) $isWild = ($Row.PSObject.Properties['IsWildcard'] -and $Row.IsWildcard) $isRedir = ($Row.PSObject.Properties['Source'] -and ($Row.Source -match 'Redirect')) if ($isCrl -or $isCrit) { return 3 } if ($isWild -or $isRedir) { return 2 } return 1 } # SIG # Begin signature block # MIInRQYJKoZIhvcNAQcCoIInNjCCJzICAQExDzANBglghkgBZQMEAgEFADB5Bgor # BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG # KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCEQBFUsc70Flfx # GXDVWqSt8TObmV68HLUEGKGmmHLceaCCDLowggX1MIID3aADAgECAhMzAAACHU0Z # yE7XD1dIAAAAAAIdMA0GCSqGSIb3DQEBCwUAMFcxCzAJBgNVBAYTAlVTMR4wHAYD # VQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBD # b2RlIFNpZ25pbmcgUENBIDIwMjQwHhcNMjYwNDE2MTg1OTQzWhcNMjcwNDE1MTg1 # OTQzWjB0MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UE # BxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMR4wHAYD # VQQDExVNaWNyb3NvZnQgQ29ycG9yYXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IB # DwAwggEKAoIBAQDQvewXxx9gZZFC6Ys1WBay8BJ8kGA4JQnH5CMafqOASlTpK9H8 # o5ZXTXt0caVQTNMUPt445wXYD+dFtaKWTwDn1I52oUSrC9vJin1Gsqt+zyKJL5Dg # 3eQXbQNR61DmMy20GLTIO3SFed9Rfi/ophgCLGFLDR3r0KvHjwMb/jYWS0celV/4 # Lz27LfAekm8v9E5IXaeiXbAUYZKK090n4CVl3JBtbN+9DtI9SNu/yjvozW52/u7R # X/Ttpa/KDlpuokZ+Zcbvmtd9ur9gFLvZzh41o9MsE/clQtdaFWGvuo6Jua/ntpgk # ey3E5/vBFe+MJPG6phdnuo6r57ZudCudiI1bAgMBAAGjggGbMIIBlzAOBgNVHQ8B # Af8EBAMCB4AwHwYDVR0lBBgwFgYKKwYBBAGCN0wIAQYIKwYBBQUHAwMwHQYDVR0O # BBYEFH6QuMwqcPG0hQlQ6c5jCtTTLrVeMEUGA1UdEQQ+MDykOjA4MR4wHAYDVQQL # ExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xFjAUBgNVBAUTDTIzMDAxMis1MDc1NTkw # HwYDVR0jBBgwFoAUf1k/VCHarU/vBeXmo9ctBpQSCDEwYAYDVR0fBFkwVzBVoFOg # UYZPaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9jcmwvTWljcm9zb2Z0 # JTIwQ29kZSUyMFNpZ25pbmclMjBQQ0ElMjAyMDI0LmNybDBtBggrBgEFBQcBAQRh # MF8wXQYIKwYBBQUHMAKGUWh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMv # Y2VydHMvTWljcm9zb2Z0JTIwQ29kZSUyMFNpZ25pbmclMjBQQ0ElMjAyMDI0LmNy # dDAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEBCwUAA4ICAQBKTbYOjzwTG/DXGaz9 # s6+fQeaTtDcFmMY+5UyVFCyj7Pv+5i37qfX8lSL/tBIfYQfWsMuBQlfZurJD6r4H # VJ2CeH+1fgiq8dcHdVKoZ3Sa2qXoX3cq9iS8cVb06B7+5/XJ7I0OxHH9fDsvJ3T3 # w5V/ZtAIFmLrl+P0CtG+92uzRsn0nTbdFjOkLMLWPLAU3THohKRlSEMgFJpPkm5n # 5UAZ35xX6FWCrDLsSKb555bTifwa8mJBwdlof0bmfYidH+dxZ1FdDxvLnNl9zeKs # A4kejaaIqqIPguhwAti5Ql7BlTNoJNwxCvBmqW2MQLnCkYN/VVUsR3V2x/rcTNzo # Bf/Z/SpROvdaA2ZOOd1uioXJt3tdLQ7vHpqpib0KfWr/FWXW10q38VxfCnRQBqzb # SuztR7nEMuzX7Ck+B/XaPDXd1qh72+QYyB0Z2VzWmO9zsnb9Uq/dwu8LGeQqnyu6 # 7SDGACvnXii2fb9+US492VTnXSnFKyqwgzUyFMtZK1/sHYTv6bG4TtQUygQxTN+Z # V+aJIlKO2MqZ7bKrAnOzS9m6NgoTdWOq11bTOZwKlIEV/EhV9SWkDmdpR/hPPT2v # 6TEj4F8PT/zHjRezIU5c/DGlt/VhY/pK0XkJtEyMmmS1BMtjU/rqBZVMIm3dnxQs # /TBByr+Cf8Z1r7aifQVQ+WSqzjCCBr0wggSloAMCAQICEzMAAAA5O7Y3Gb8GHWcA # AAAAADkwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpX # YXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQg # Q29ycG9yYXRpb24xMjAwBgNVBAMTKU1pY3Jvc29mdCBSb290IENlcnRpZmljYXRl # IEF1dGhvcml0eSAyMDExMB4XDTI0MDgwODIwNTQxOFoXDTM2MDMyMjIyMTMwNFow # VzELMAkGA1UEBhMCVVMxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEo # MCYGA1UEAxMfTWljcm9zb2Z0IENvZGUgU2lnbmluZyBQQ0EgMjAyNDCCAiIwDQYJ # KoZIhvcNAQEBBQADggIPADCCAgoCggIBANgBnB7jOMeqlRYHNa265v4IY9fH8TKh # emHfPINe1gpLaV3dhg324WwH06LcHbpnsBukCDNitryo0dtS/EW6I/yEL/bLSY8h # KpbfQuWusBPr9qazYcDxCW/qnjb5JsI1s8bNOg3bVATvQVL4tcf03aTycsz8QeCd # M0l/yHRObJ9QqazM1r6VPEOJ7LL+uEEb73w6QCuhs89a1uv1zerOYMnsneRRwCbp # yW11IcggU0cRKDDq1pjVJzIbIF6+oiXXbReOsgeI8zu1FyQfK0fVkaya8SmVHQ/t # Of23mZ4W9k0Ri22QW9p3UgSC5OUDktKxxcCmGL6tXLfOGSWHIIV4YrTJTT6PNty5 # REojHJuZHArkF9VnHTERWoTjAzfI3kP+5b4alUdhgAZ7ttOu1bVnXfHaqPYl2rPs # 20ji03LOVWsh/radgE17es5hL+t6lV0eVHrVhsssROWJuz2MXMCt7iw7lFPG9LXK # Gjsmonn2gotGdHIuEg5JnJMJVmixd5LRlkmgYRZKzhxSCwyoGIq0PhaA7Y+VPct5 # pCHkijcIIDm0nlkK+0KyepolcqGm0T/GYQRMhHJlGOOmVQop36wUVUYklUy++vDW # eEgEo4s7hxN6mIbf2MSIQ/iIfMZgJxC69oukMUXCrOC3SkE/xIkgpfl22MM1itkZ # 35nNXkMolU1lAgMBAAGjggFOMIIBSjAOBgNVHQ8BAf8EBAMCAYYwEAYJKwYBBAGC # NxUBBAMCAQAwHQYDVR0OBBYEFH9ZP1Qh2q1P7wXl5qPXLQaUEggxMBkGCSsGAQQB # gjcUAgQMHgoAUwB1AGIAQwBBMA8GA1UdEwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAU # ci06AjGQQ7kUBU7h6qfHMdEjiTQwWgYDVR0fBFMwUTBPoE2gS4ZJaHR0cDovL2Ny # bC5taWNyb3NvZnQuY29tL3BraS9jcmwvcHJvZHVjdHMvTWljUm9vQ2VyQXV0MjAx # MV8yMDExXzAzXzIyLmNybDBeBggrBgEFBQcBAQRSMFAwTgYIKwYBBQUHMAKGQmh0 # dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2kvY2VydHMvTWljUm9vQ2VyQXV0MjAx # MV8yMDExXzAzXzIyLmNydDANBgkqhkiG9w0BAQwFAAOCAgEAFJQfOChP7onn6fLI # MKrSlN1WYKwDFgAddymOUO3FrM8d7B/W/iQ6DxXsDn7D5W4wMwYeLystcEqfkjz4 # NURRgazyMu5yRzQh4LqjA4tStTcJh1opExo7nn5PuPBYnbu0+THSuVHTe0VTTPVh # ily/piFrDo3axQ9P4C+Ol5yet+2gTfekICS5xS+cYfSIvgn0JksVBVMYVI5QFu/q # hnLhsEFEUzG8fvv0hjgkO+lkpV9ty6GkN4vdnd7ya6Q6aR9y34aiM1qmxaxBi6OU # nyNl6fkuun/diTFnYDLTppOkr/mg5WSfCiDVMNCxtj4wPKC5OmHm1DQIt/MNokbb # H3UGsFP1QbzsLocuSqLCvH09Io3fDPTmscR9Y75G4qX7RTX8AdBPo0I6OEojf39z # uFZt0qOHm65YWQE69cZM2ueE1MB05dNNgHK9gTE7zKvK/fg8B2qjW88MT/WF5V5u # vZGtqa9FSL2RazArA+rDPuf6JGYz4HpgMZHB4S6szWSKYBv0VisCzfxgeU+dquXW # 9bd0auYlOB58DPcOYKdc3Se94g+xL4pcEhbB54JOgAkwYTu/9dLeH2pDqeJZAABV # DWRQCaXfO5LgyKwKCLYXpigrZYCjUSBcr+Ve8PFWMhVTQl0v4q8J/AUmQN5W4n10 # 1cY2L4A7GTQG1h32HHAvfQESWP0xghnhMIIZ3QIBATBuMFcxCzAJBgNVBAYTAlVT # MR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jv # c29mdCBDb2RlIFNpZ25pbmcgUENBIDIwMjQCEzMAAAIdTRnITtcPV0gAAAAAAh0w # DQYJYIZIAWUDBAIBBQCgga4wGQYJKoZIhvcNAQkDMQwGCisGAQQBgjcCAQQwHAYK # KwYBBAGCNwIBCzEOMAwGCisGAQQBgjcCARUwLwYJKoZIhvcNAQkEMSIEIGoUi4zM # sts/VFO7JdQMxgiIjtmrA3jmdG1JT7wTB27AMEIGCisGAQQBgjcCAQwxNDAyoBSA # EgBNAGkAYwByAG8AcwBvAGYAdKEagBhodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20w # DQYJKoZIhvcNAQEBBQAEggEAa05tWEHzpGNU9PR09Gu2fCXbka/IR4mirGUJjV7v # Q/1kKlTxpmjZvX3L8IFcFWRzuI5xqcSswOEoPKsmp30awRGzXQ5rUx7QGueSBMIT # D7pjvgvtIyj5YsqRg5UBHLaYG6j7aPfJVzkNlml1b3Z1pj0p3Dci7ObtulL6M5gl # O7W5Yo3eNY/ZbkpcYjks8RcF09nKI/50uDgWBCXgA/vtty6GaEMKwekwqtyZhvXJ # uWO0NpDWS7Y3lA81/LKTrDMof8Qb7P5wrCyRpw8rE6135dJD6lCR4VwuG6Y1E09A # SbU7oSkGLbb8j53wsCgm3MT/pm55eXaNMmP/ZNFeLZKTJqGCF5MwghePBgorBgEE # AYI3AwMBMYIXfzCCF3sGCSqGSIb3DQEHAqCCF2wwghdoAgEDMQ8wDQYJYIZIAWUD # BAIBBQAwggFRBgsqhkiG9w0BCRABBKCCAUAEggE8MIIBOAIBAQYKKwYBBAGEWQoD # ATAxMA0GCWCGSAFlAwQCAQUABCBBukGi3XAf3r7ZUrqLOAjAQqeryYaydFrzYy5k # cJaNDAIGajFojfCvGBIyMDI2MDcxNTE4MjU1OS41NVowBIACAfSggdGkgc4wgcsx # CzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRt # b25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xJTAjBgNVBAsTHE1p # Y3Jvc29mdCBBbWVyaWNhIE9wZXJhdGlvbnMxJzAlBgNVBAsTHm5TaGllbGQgVFNT # IEVTTjpEQzAwLTA1RTAtRDk0NzElMCMGA1UEAxMcTWljcm9zb2Z0IFRpbWUtU3Rh # bXAgU2VydmljZaCCEeowggcgMIIFCKADAgECAhMzAAACJDuEIbAsrGQiAAEAAAIk # MA0GCSqGSIb3DQEBCwUAMHwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5n # dG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9y # YXRpb24xJjAkBgNVBAMTHU1pY3Jvc29mdCBUaW1lLVN0YW1wIFBDQSAyMDEwMB4X # DTI2MDIxOTE5Mzk1OVoXDTI3MDUxNzE5Mzk1OVowgcsxCzAJBgNVBAYTAlVTMRMw # EQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVN # aWNyb3NvZnQgQ29ycG9yYXRpb24xJTAjBgNVBAsTHE1pY3Jvc29mdCBBbWVyaWNh # IE9wZXJhdGlvbnMxJzAlBgNVBAsTHm5TaGllbGQgVFNTIEVTTjpEQzAwLTA1RTAt # RDk0NzElMCMGA1UEAxMcTWljcm9zb2Z0IFRpbWUtU3RhbXAgU2VydmljZTCCAiIw # DQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKPpbdRpDZmviE29LLuPtQw8VXKz # toTEYH4kXDKTPNeDeNrJib2A4tcnu02FTZ6aGstAI5lyAu/PoWSqaCHNDHOaSAq0 # tiIpoTOGiA79x7SVOF0s11W0zBA5iCj5e1cBlxWIFfgtweTfxG6xmIXvDFJrm38v # GJzTj5n+GXLWAlCkh4UOqnhr0+4u3yux8fTm9b2lT26uIZ0PF8lef+Vzj0LFteoD # cRfXsvbhtzq36YW48MAkoqlqLddeoXacmWlM992sDb2xZNI0qKD0K0ELm3NCPR+V # uxr/jCo7275GS7CllvdvuqdbkV0WsNHW9CZd+OXJQ/1k7fzzf03BK6Ie2+wUI2RM # 0hfw4vldWrWewrK7/8Z4hn1i7Gx8sF52obTbg8MRHKsCzSm99RY4tqlVBqMc+gKe # 41Iq9sSHuzkhDRiC6kaOL4fusgPHb+YgQj7pDxbAG2TdjHKGOPQZfD3T2LQSRORX # LL7XIAOPBILxvDaozj4xziHLK2VnNJzQg9QGrVgadjAKMjBrn+UxbSkWf8ekl0Hp # d4y5O1hM6lo+ijrgWNCvItdaN3ii+nDmU7Dtf6/cT2TA31UEL7AkRIEQILWBkwJL # lNpXB8TXDimdddvWpP1uOBGw+Dh2SWu5RN2if/dI23RrRDk1zZSX6syVDFeg/2Kx # fAw2co7kkmSpENFVAgMBAAGjggFJMIIBRTAdBgNVHQ4EFgQUcx+RfW7/MksIx7SC # piK3HW0Ad6gwHwYDVR0jBBgwFoAUn6cVXQBeYl2D9OXSZacbUzUZ6XIwXwYDVR0f # BFgwVjBUoFKgUIZOaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9jcmwv # TWljcm9zb2Z0JTIwVGltZS1TdGFtcCUyMFBDQSUyMDIwMTAoMSkuY3JsMGwGCCsG # AQUFBwEBBGAwXjBcBggrBgEFBQcwAoZQaHR0cDovL3d3dy5taWNyb3NvZnQuY29t # L3BraW9wcy9jZXJ0cy9NaWNyb3NvZnQlMjBUaW1lLVN0YW1wJTIwUENBJTIwMjAx # MCgxKS5jcnQwDAYDVR0TAQH/BAIwADAWBgNVHSUBAf8EDDAKBggrBgEFBQcDCDAO # BgNVHQ8BAf8EBAMCB4AwDQYJKoZIhvcNAQELBQADggIBAD7AdJuaEikzwJFVni2T # rbiFD4t1lcTiqh5C6LvsJ41reOrUU7OLsxEqSSjp2IQMdc81a8BqDFqy0J7A/Obl # MI2HWzioIeHhHYb+vjzBT8ylzrz9YOYnLkIhCf8XCmzWxs1QS7sHODTTipQshUn3 # reOj9qbjHAqDCH69JUvv92Gx9Pt2+GlF11tgtBMdmDC40HpCFwQSyCiAtXA1GPft # URZkOLCgx3HILthitC7owJW2LMec62RJfsWoiiLqOVx+p+jrX24Mf2vyTaoA4cJ4 # QCopcrKYhcMxwYaUR0MVtiINmA8IEzQgeAB6KVRKifTvCMe7R7SywGa0Fp89vgZ3 # 7kW5GdYbdcZ73U0KksqqYVr/gaRXP04zNlSDyhzPEL/glPcd/jkkS2zNOhfA2yRX # ck0Jy7Ygi2vpIkeaLcQNUAMNFI2F3MVGliamUYSU+XkZGg+0mIMS9Ehu/kwUojDb # H2Cd6F/ki8GMLhmQGD7gZOmoYTeaafMXech6Q6Rfi6DT/SY3YJJquG5KL02Ycg6l # Q3Z5AdS2BNv/4aaruCS0IzAir8k4JgiJNiqm/WhuMAYp1Yw8KuVLI0CzSNljOSFr # nfnXnw0zH7AEa+x8WhWwIwbk5ynq9boJfK5ZFtRWoxTU6tBsd93LMmluEkLU9sBk # jIkJs35UGANMDNMpjzDghJLBMIIHcTCCBVmgAwIBAgITMwAAABXF52ueAptJmQAA # AAAAFTANBgkqhkiG9w0BAQsFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldh # c2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBD # b3Jwb3JhdGlvbjEyMDAGA1UEAxMpTWljcm9zb2Z0IFJvb3QgQ2VydGlmaWNhdGUg # QXV0aG9yaXR5IDIwMTAwHhcNMjEwOTMwMTgyMjI1WhcNMzAwOTMwMTgzMjI1WjB8 # MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVk # bW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSYwJAYDVQQDEx1N # aWNyb3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAxMDCCAiIwDQYJKoZIhvcNAQEBBQAD # ggIPADCCAgoCggIBAOThpkzntHIhC3miy9ckeb0O1YLT/e6cBwfSqWxOdcjKNVf2 # AX9sSuDivbk+F2Az/1xPx2b3lVNxWuJ+Slr+uDZnhUYjDLWNE893MsAQGOhgfWpS # g0S3po5GawcU88V29YZQ3MFEyHFcUTE3oAo4bo3t1w/YJlN8OWECesSq/XJprx2r # rPY2vjUmZNqYO7oaezOtgFt+jBAcnVL+tuhiJdxqD89d9P6OU8/W7IVWTe/dvI2k # 45GPsjksUZzpcGkNyjYtcI4xyDUoveO0hyTD4MmPfrVUj9z6BVWYbWg7mka97aSu # eik3rMvrg0XnRm7KMtXAhjBcTyziYrLNueKNiOSWrAFKu75xqRdbZ2De+JKRHh09 # /SDPc31BmkZ1zcRfNN0Sidb9pSB9fvzZnkXftnIv231fgLrbqn427DZM9ituqBJR # 6L8FA6PRc6ZNN3SUHDSCD/AQ8rdHGO2n6Jl8P0zbr17C89XYcz1DTsEzOUyOArxC # aC4Q6oRRRuLRvWoYWmEBc8pnol7XKHYC4jMYctenIPDC+hIK12NvDMk2ZItboKaD # IV1fMHSRlJTYuVD5C4lh8zYGNRiER9vcG9H9stQcxWv2XFJRXRLbJbqvUAV6bMUR # HXLvjflSxIUXk8A8FdsaN8cIFRg/eKtFtvUeh17aj54WcmnGrnu3tz5q4i6tAgMB # AAGjggHdMIIB2TASBgkrBgEEAYI3FQEEBQIDAQABMCMGCSsGAQQBgjcVAgQWBBQq # p1L+ZMSavoKRPEY1Kc8Q/y8E7jAdBgNVHQ4EFgQUn6cVXQBeYl2D9OXSZacbUzUZ # 6XIwXAYDVR0gBFUwUzBRBgwrBgEEAYI3TIN9AQEwQTA/BggrBgEFBQcCARYzaHR0 # cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9Eb2NzL1JlcG9zaXRvcnkuaHRt # MBMGA1UdJQQMMAoGCCsGAQUFBwMIMBkGCSsGAQQBgjcUAgQMHgoAUwB1AGIAQwBB # MAsGA1UdDwQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB8GA1UdIwQYMBaAFNX2VsuP # 6KJcYmjRPZSQW9fOmhjEMFYGA1UdHwRPME0wS6BJoEeGRWh0dHA6Ly9jcmwubWlj # cm9zb2Z0LmNvbS9wa2kvY3JsL3Byb2R1Y3RzL01pY1Jvb0NlckF1dF8yMDEwLTA2 # LTIzLmNybDBaBggrBgEFBQcBAQROMEwwSgYIKwYBBQUHMAKGPmh0dHA6Ly93d3cu # bWljcm9zb2Z0LmNvbS9wa2kvY2VydHMvTWljUm9vQ2VyQXV0XzIwMTAtMDYtMjMu # Y3J0MA0GCSqGSIb3DQEBCwUAA4ICAQCdVX38Kq3hLB9nATEkW+Geckv8qW/qXBS2 # Pk5HZHixBpOXPTEztTnXwnE2P9pkbHzQdTltuw8x5MKP+2zRoZQYIu7pZmc6U03d # mLq2HnjYNi6cqYJWAAOwBb6J6Gngugnue99qb74py27YP0h1AdkY3m2CDPVtI1Tk # eFN1JFe53Z/zjj3G82jfZfakVqr3lbYoVSfQJL1AoL8ZthISEV09J+BAljis9/kp # icO8F7BUhUKz/AyeixmJ5/ALaoHCgRlCGVJ1ijbCHcNhcy4sa3tuPywJeBTpkbKp # W99Jo3QMvOyRgNI95ko+ZjtPu4b6MhrZlvSP9pEB9s7GdP32THJvEKt1MMU0sHrY # UP4KWN1APMdUbZ1jdEgssU5HLcEUBHG/ZPkkvnNtyo4JvbMBV0lUZNlz138eW0QB # jloZkWsNn6Qo3GcZKCS6OEuabvshVGtqRRFHqfG3rsjoiV5PndLQTHa1V1QJsWkB # RH58oWFsc/4Ku+xBZj1p/cvBQUl+fpO+y/g75LcVv7TOPqUxUYS8vwLBgqJ7Fx0V # iY1w/ue10CgaiQuPNtq6TPmb/wrpNPgkNWcr4A245oyZ1uEi6vAnQj0llOZ0dFtq # 0Z4+7X6gMTN9vMvpe784cETRkPHIqzqKOghif9lwY1NNje6CbaUFEMFxBmoQtB1V # M1izoXBm8qGCA00wggI1AgEBMIH5oYHRpIHOMIHLMQswCQYDVQQGEwJVUzETMBEG # A1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWlj # cm9zb2Z0IENvcnBvcmF0aW9uMSUwIwYDVQQLExxNaWNyb3NvZnQgQW1lcmljYSBP # cGVyYXRpb25zMScwJQYDVQQLEx5uU2hpZWxkIFRTUyBFU046REMwMC0wNUUwLUQ5 # NDcxJTAjBgNVBAMTHE1pY3Jvc29mdCBUaW1lLVN0YW1wIFNlcnZpY2WiIwoBATAH # BgUrDgMCGgMVAKYI8duax4BJ97/9sa1f15Ab7T7joIGDMIGApH4wfDELMAkGA1UE # BhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAc # BgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0 # IFRpbWUtU3RhbXAgUENBIDIwMTAwDQYJKoZIhvcNAQELBQACBQDuAh58MCIYDzIw # MjYwNzE1MTQ1ODA0WhgPMjAyNjA3MTYxNDU4MDRaMHQwOgYKKwYBBAGEWQoEATEs # MCowCgIFAO4CHnwCAQAwBwIBAAICBDswBwIBAAICEg0wCgIFAO4Db/wCAQAwNgYK # KwYBBAGEWQoEAjEoMCYwDAYKKwYBBAGEWQoDAqAKMAgCAQACAwehIKEKMAgCAQAC # AwGGoDANBgkqhkiG9w0BAQsFAAOCAQEApRGYsXmofqA1HhhD18PMk160GnE4ULRy # y1y1lzg22P65Prp5G5KWp7pWT+5zjGJainGtrFiqh/fxRodQbLI0y1CcKMcwmdcx # SViX1iLRcoh5NhyMi1sHaV97WrvW4BaxlNG1LKYXwykvNUtEMR9pnblQeisGCU3O # YCbvEDWlGxEag14BVJjoNkaDUQX3YPNwEh9HEvkr7e+oa11hpOJNdl5k72PKkvG3 # Rwi4jpm1azgbejtENLxEISVq8e2cwHUbkXuSVOSxTn+zrGieJfLDaYScIOoWf0KU # 8e0TexExWmWubiSXp9Jk/9YtSLChTN3cd2ggdSpWVldVeL/T8dXG2zGCBA0wggQJ # AgEBMIGTMHwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYD # VQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xJjAk # BgNVBAMTHU1pY3Jvc29mdCBUaW1lLVN0YW1wIFBDQSAyMDEwAhMzAAACJDuEIbAs # rGQiAAEAAAIkMA0GCWCGSAFlAwQCAQUAoIIBSjAaBgkqhkiG9w0BCQMxDQYLKoZI # hvcNAQkQAQQwLwYJKoZIhvcNAQkEMSIEIKvy5/txujPTMs0wSCewpQfLoluDo7Ch # fWL3XzIhOxkNMIH6BgsqhkiG9w0BCRACLzGB6jCB5zCB5DCBvQQgSCE9N2qb91HJ # nQFzNdx2WhUSogJ1yalU1sf0IRXNZI4wgZgwgYCkfjB8MQswCQYDVQQGEwJVUzET # MBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMV # TWljcm9zb2Z0IENvcnBvcmF0aW9uMSYwJAYDVQQDEx1NaWNyb3NvZnQgVGltZS1T # dGFtcCBQQ0EgMjAxMAITMwAAAiQ7hCGwLKxkIgABAAACJDAiBCAe1A/1umw0dpYq # G/BPKCvYSgV9IAZ9vYsXK2euiZWJJjANBgkqhkiG9w0BAQsFAASCAgCVA51cWRjd # EAqc4Gaq8x2mobzhncCqzO5UkRQJCLKDyxzDkENoyFmDDfxNR5fMDB3rqj4J78uR # yLFWsW56VSAiX+UKitcq/yv/sQvOzWdEDTwfxevoyXglbHXLNIeZSofNTU1EImfA # 0ustq8kB39IaXId4lf3Rb3B8/BWVcESq2GbOmhscaBAIccHSuHESRZVzLb80NhRn # Jb3vNXt2uIeekc1qV3uOzfqz0vfmlB200Kle/sGwmWZZSZefWmA6ln9pjPkU8+V3 # 48FBISOL3J+nYLizI/z2ouc50TxK+dwRayo6cGsBwztvANKCqdTM05LSWZfizXzJ # SE/03kYevHXWPTOF1FvuUBozUqOL3MUZipw92B9zFVtcS0vL5OfrOCmcDiImGwbR # u12u3g0cp5RhfYB+BXZH9hPe/6W1iF6lotfJ+N2cGUB1rkL6lN1gqO+vQK1F7YK8 # NO06hKbVSq4ZcoNKIVCeYvnMp5yyY6WILBtkI6MdH7PtqFRvkztbbie+oVcddizN # uoXrjTcEOV7sWsAfv5Z21uS8/GvtSj2Udzl+2BrWOX9gBNyTO4v3hshE2qijhSB/ # Lbw1OP2pY+2IAvXAEdx8vE6BjzVVtvcD85hviRkuJjZL28Ixba+1zx4p1Ipg5rro # M9isXmCkPjZSOx4U5nBNx/S/T77BCUuoRg== # SIG # End signature block |