Private/AzStackHci.Connectivity.Helpers.ps1
|
# //////////////////////////////////////////////////////////////////////////// # Strict Mode v1 (PS 5.1 safe) - surfaces reads of uninitialised variables at runtime. Set-StrictMode -Version 1.0 # Function to test version of PowerShell # Returns $true on Windows PowerShell 5.1 and $false on PowerShell 6/7+. # Uses PSEdition ('Desktop' = Windows PowerShell, 'Core' = PowerShell 6/7+) rather than a # version-string comparison: it is the intent-revealing signal for "must be Windows PowerShell" # and avoids the magic 5.1.99999.999 upper-bound constant. Callers own the user-facing message # (this helper only returns a boolean; it never throws or writes an error). Function Test-PowerShellVersion5 { param ( [Parameter(Mandatory = $false)] [bool]$NoVerboseOutput = $false ) if (-not $NoVerboseOutput) { Write-Verbose "PowerShell version $($PSVersionTable.PSVersion.ToString()) ($($PSVersionTable.PSEdition) edition) detected." } # 'Desktop' is Windows PowerShell (5.1); 'Core' is PowerShell 6/7+. return ($PSVersionTable.PSEdition -eq 'Desktop') } # //////////////////////////////////////////////////////////////////////////// # Classify a single connectivity result row into a stable, machine-readable # category (v0.6.7). Lets integrators branch on $row.ResultCategory instead of # brittle free-text matching on $row.Note (e.g. the old config-gap heuristic # -match 'WAS NOT USED|REQUIRED TO SPECIFY'). # # Categories (mutually exclusive, evaluated in priority order): # ConfigGap - a required parameter placeholder (e.g. -KeyVaultURL) was left # unsubstituted, so the row carries the 'WAS NOT USED' / # 'REQUIRED TO SPECIFY' Note marker. This is a setup/input gap, # NOT a real network fault. # PrivateLink - the endpoint resolved to an RFC1918 private IP (Private Link). # SSLInspected - an untrusted certificate chain was seen (possible SSL inspection). # Skipped - the endpoint was never tested. Covers (a) Arc-Gateway skip rows and # skip-list rows (Layer7Status/TCPStatus literally 'Skipped'), and # (b) untested wildcard-parent placeholder rows whose Layer7Status is # still the initial EMPTY string because they never entered the # DNS/TCP/Layer7 test loop. (A genuinely tested row ALWAYS ends with a # non-empty Layer7Status - Success / Failed / N/A / 'Invalid port:' - # so an empty/whitespace value unambiguously means "not tested".) # Success - Layer7Status reported Success. # ConnectivityFailure - any other terminal state where a test ran and did not pass # (Failed, or N/A from a DNS-resolution failure, or 'Invalid port:'). # # Precedence rationale: the three "diagnostic" categories (ConfigGap, PrivateLink, # SSLInspected) describe WHY a row is special and are evaluated ahead of the generic # Success / ConnectivityFailure split, because such rows usually ALSO carry # Layer7Status='Failed' which would otherwise mask the real cause. # # NOTE on CRL/OCSP revocation-offline rows: these keep Layer7Status='Failed' + a # '- CRL/OCSP unreachable' Layer7Response marker and are DELIBERATELY left as # ConnectivityFailure here (NOT given their own category) to keep the ResultCategory # enum stable for consumers. The run-level signal for them is the CRLOfflineDetected / # CRLOfflineURLs container NoteProperties on the returned ArrayList (and JSON summary), # mirroring how SSL inspection is ALSO surfaced as a container array - integrators that # want to treat revocation-offline as a softer WARNING branch on those fields. Function Get-ConnectivityResultCategory { [CmdletBinding()] [OutputType([string])] param( [Parameter(Mandatory = $true)] [psobject]$Row, # Run-level detection lists. Publish-Results passes a snapshot of the module-scope # state ($script:SSLInspectedURLs / $script:PrivateLinkDetectedArray); unit tests # pass synthetic lists. Default to empty so the helper is fully self-contained. [AllowNull()] [string[]]$SSLInspectedURLs = @(), [AllowNull()] [string[]]$PrivateLinkURLs = @() ) # Bare property reads are safe under StrictMode v1.0 (it throws only on uninitialised # VARIABLES, not absent object properties); cast to [string] to coalesce $null to ''. $note = [string]$Row.Note $url = [string]$Row.URL $l7 = [string]$Row.Layer7Status $tcp = [string]$Row.TCPStatus # URL normalisation for the detection-list lookups (steps 2 & 3). The two run-level arrays # store the URL in DIFFERENT shapes: # * $script:PrivateLinkDetectedArray stores the bare result-row .URL (host[/path]) - it is # populated by matching $_.URL in Test-AzureLocalConnectivity, so it already aligns. # * $script:SSLInspectedURLs stores the SCHEME-PREFIXED request URL ('https://host/path') # because Test-Layer7Connectivity adds the value it actually requested. # The result-row .URL is the bare host+path with no scheme, so a raw -contains against the # SSL list silently MISSES (an SSL-inspected row then falls through to ConnectivityFailure). # Strip a leading http(s):// and any trailing '/' from BOTH the row URL and every list entry # so the comparison is scheme- and trailing-slash-insensitive. (-contains is already # case-insensitive for strings.) $normalizeUrl = { param($u) (([string]$u) -replace '^\s*https?://', '').TrimEnd('/') } $urlNorm = & $normalizeUrl $url $sslNorm = @(@($SSLInspectedURLs) | ForEach-Object { & $normalizeUrl $_ }) $plNorm = @(@($PrivateLinkURLs) | ForEach-Object { & $normalizeUrl $_ }) # 1. Config gap — required parameter placeholder was never substituted. if ($note -match 'WAS NOT USED|REQUIRED TO SPECIFY') { return 'ConfigGap' } # 2. Private Link — endpoint resolved to an RFC1918 address. if ($plNorm -and ($plNorm -contains $urlNorm)) { return 'PrivateLink' } # 3. SSL inspection — untrusted certificate chain observed (possible TLS interception). # Two signals, set in lockstep by AzStackHci.Layer7.Helpers.ps1; either is authoritative: # (a) the bare row URL appears in the run-level $script:SSLInspectedURLs snapshot, OR # (b) the row's own Layer7Response carries the '- SSL Inspection detected' marker. # (b) is read straight off the row, so it survives any URL-shape drift between the snapshot # (which stores the scheme-prefixed REQUEST url, possibly a redirect target) and the row's # .URL field. A CRL/OCSP-offline row is reclassified away from this marker before this helper runs, so it # correctly does NOT match here and stays a ConnectivityFailure. $l7Response = [string]$Row.Layer7Response if (($sslNorm -and ($sslNorm -contains $urlNorm)) -or ($l7Response -match 'SSL Inspection detected')) { return 'SSLInspected' } # 4. Skipped / not-tested. Three cases: # (a) Arc-Gateway / skip-list rows -> TCPStatus or Layer7Status literally 'Skipped'. # (b) Untested wildcard-parent / placeholder rows that never entered the test loop # -> Layer7Status is still the initial EMPTY string. A tested row always has a # non-empty Layer7Status, so empty/whitespace here means "never tested", NOT a # failure. Guard with -not IsNullOrWhiteSpace($note) is unnecessary because the # ConfigGap Note marker is already handled at step 1 above. if (($tcp -like 'Skipped*') -or ($l7 -eq 'Skipped') -or [string]::IsNullOrWhiteSpace($l7)) { return 'Skipped' } # 5. Success. if ($l7 -eq 'Success') { return 'Success' } # 6. Everything else is a terminal connectivity failure (Failed / N/A / 'Invalid port:'). return 'ConnectivityFailure' } # //////////////////////////////////////////////////////////////////////////// # This function converts a hashtable to a string representation Function Convert-HashTableToString { param ( [Parameter(Mandatory = $true)] [System.Collections.Hashtable] $HashTable ) begin { # Write-Verbose "Starting Convert-HashTableToString function" } process { $HashString = "@{" $Keys = $HashTable.keys foreach ($Key in $Keys) { $v = $HashTable[$key] if ($key -match "\s") { $HashString += "`"$key`"" + "=" + "`"$v`"" + ";" } else { $HashString += $key + "=" + "`"$v`"" + ";" } } $HashString += "}" } # End of process block end { # Write-Debug "Completed Convert-HashTableToString function" return $HashString } } # //////////////////////////////////////////////////////////////////////////// # Function to extract domains from URLs Function Get-DomainFromURL { param ( [string]$url ) begin { # Write-Verbose "Starting Get-DomainFromURL function" } process { # Remove the protocol (http:// or https://) and extract the domain and port $url = $url -replace "^https?://", "" # Check if the URL contains a port number # If the URL contains a port number, extract it if ($url -match ":(\d+)$") { $port = [int]($url -replace ".*:(\d+)$", '$1') $url = $url -replace ":(\d+)$", "" } else { $port = $null } $domain = $url -split '/' | Select-Object -First 1 return @{ Domain = $domain; Port = $port } } end { # Write-Debug "Completed Get-DomainFromURL function" } } # //////////////////////////////////////////////////////////////////////////// # Helper function to normalize URL with protocol based on port # This is a private helper function for Test-Layer7Connectivity Function Initialize-WebRequestUrl { param ( [Parameter(Mandatory=$true)] [string]$url, [Parameter(Mandatory=$true)] [int]$port ) # Check if the port is 80 for HTTP or port 443, 8084 or 8443 for HTTPS and update the URL accordingly if ($port -eq $script:PORT_HTTPS -or $port -eq $script:PORT_HTTPS_ALT1 -or $port -eq $script:PORT_HTTPS_ALT2) { if($url -notmatch "^https://") { # If the URL does not start with https://, add it $url = "https://$url" } } elseif($port -eq $script:PORT_HTTP) { if($url -notmatch "^http://") { # If the URL does not start with http://, add it $url = "http://$url" } } else { # For custom ports, use http as the default if($url -notmatch "^http") { Write-Verbose "Custom port $port detected, using http as the default" $url = "http://$url" } } return $url } # //////////////////////////////////////////////////////////////////////////// # Helper function to register a redirected URL into the RedirectedResults array # Prevents duplicates by checking both RedirectedResults and Results arrays. # Called from the redirect-handling section of Test-Layer7Connectivity. function Get-ConnectivityResourceUrl { param ( [Parameter(Mandatory=$true)][string]$Url, [Parameter(Mandatory=$true)][int]$Port ) if ($Url -notmatch '^https?://') { $scheme = if ($Port -eq 80) { 'http' } else { 'https' } $Url = '{0}://{1}' -f $scheme, $Url } $builder = [System.UriBuilder]::new($Url) if ($builder.Scheme -notin @('http', 'https')) { throw 'Only HTTP and HTTPS resources are supported.' } $builder.Port = $Port $builder.Fragment = '' return $builder.Uri.AbsoluteUri } function Get-ConnectivityRowResourceUrl { param ([Parameter(Mandatory=$true)]$Row) $resource = [string]$Row.URL if ($Row.PSObject.Properties['redirect'] -and $Row.redirect) { $resource = [string]$Row.redirect } if ($resource.Contains('*')) { return '' } return Get-ConnectivityResourceUrl -Url $resource -Port $Row.Port } function Resolve-ConnectivityRedirectUrl { param ([Parameter(Mandatory=$true)][uri]$BaseUri, [Parameter(Mandatory=$true)][string]$Location) $target = [uri]::new($BaseUri, $Location) if ($target.Scheme -notin @('http', 'https')) { throw 'Only HTTP and HTTPS redirect targets are supported.' } return Get-ConnectivityResourceUrl -Url $target.AbsoluteUri -Port $target.Port } function Test-ConnectivityRedirectAdvisory { param ([Parameter(Mandatory=$true)]$Row) return ($Row.PSObject.Properties['RedirectDisposition'] -and $Row.RedirectDisposition -eq 'Advisory' -and $Row.PSObject.Properties['ResultCategory'] -and $Row.ResultCategory -eq 'ConnectivityFailure') } function Initialize-ConnectivityRedirectMetadata { param ([Parameter(Mandatory=$true)]$Row) $defaults = [ordered]@{ RedirectDisposition = 'NotRedirect' RedirectReason = '' RedirectOriginUrls = [string[]]@() RedirectTargetUrl = '' } foreach ($property in $defaults.Keys) { if (-not $Row.PSObject.Properties[$property]) { Add-Member -InputObject $Row -NotePropertyName $property -NotePropertyValue $defaults[$property] } } } function Merge-ConnectivityRedirectRow { param ([Parameter(Mandatory=$true)]$Row) $target = Get-ConnectivityRowResourceUrl -Row $Row $existing = $script:RedirectedResults | Where-Object { (Get-ConnectivityRowResourceUrl -Row $_) -ceq $target } | Select-Object -First 1 if ($existing) { foreach ($property in @('RedirectOriginUrls', 'RedirectParentUrls')) { if ($Row.PSObject.Properties[$property]) { $values = [string[]]@($Row.$property) if ($existing.PSObject.Properties[$property]) { $values += [string[]]@($existing.$property) } $unique = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::Ordinal) foreach ($value in $values) { [void]$unique.Add($value) } Add-Member -InputObject $existing -NotePropertyName $property -NotePropertyValue ([string[]]@($unique | Sort-Object -CaseSensitive)) -Force } } } else { [void]$script:RedirectedResults.Add($Row) } } function Update-ConnectivityRedirectDisposition { $inventory = @($script:Results | Where-Object { $_.Source -match '^(GitHub|Environment Checker)( Wildcard)?$' -or $_.Source -match '^(?!(?:Redirect for|Test for) ).+ SBE(?: Wildcard)?$' }) foreach ($result in $script:Results) { Initialize-ConnectivityRedirectMetadata -Row $result } foreach ($redirectRow in $script:RedirectedResults) { Initialize-ConnectivityRedirectMetadata -Row $redirectRow $target = [uri](Get-ConnectivityRowResourceUrl -Row $redirectRow) $redirectRow.RedirectTargetUrl = $target.AbsoluteUri $redirectRow.RedirectDisposition = 'Advisory' $redirectRow.RedirectReason = 'Destination requirement unverified; discovered while following redirects during connectivity testing. Review the ''RedirectOriginUrls'' column for source details.' $requiredTarget = @($inventory | Where-Object { $_.Port -eq $target.Port -and $target.Host -like (Get-DomainFromURL -url $_.URL).Domain }).Count -gt 0 if ($requiredTarget) { $redirectRow.RedirectDisposition = 'RequiredDependency' $redirectRow.RedirectReason = 'Destination matches an applicable inventory endpoint and port.' } } for ($pass = 0; $pass -le $script:RedirectedResults.Count; $pass++) { $changed = $false foreach ($redirectRow in $script:RedirectedResults) { if (-not $redirectRow.PSObject.Properties['RedirectParentUrls']) { continue } foreach ($parentUrl in $redirectRow.RedirectParentUrls) { $parent = [uri]$parentUrl foreach ($parentRow in @($script:RedirectedResults | Where-Object { $_.RedirectTargetUrl -ceq $parentUrl })) { foreach ($origin in $parentRow.RedirectOriginUrls) { if ($redirectRow.RedirectOriginUrls -cnotcontains $origin) { $redirectRow.RedirectOriginUrls = [string[]]@($redirectRow.RedirectOriginUrls + $origin) $changed = $true } } } $requiredParent = @($script:RedirectedResults | Where-Object { $_.RedirectTargetUrl -ceq $parentUrl -and $_.RedirectDisposition -eq 'RequiredDependency' }).Count -gt 0 $intentionalLink = ($parent.Host -eq 'aka.ms' -and $parent.AbsolutePath -ne '/') -or ($parent.Host -eq 'go.microsoft.com' -and $parent.AbsolutePath.TrimEnd('/') -eq '/fwlink' -and $parent.Query -match '(?i)[?&]linkid=\d+(?:&|$)') if ($intentionalLink) { $requiredParent = $requiredParent -or @($inventory | Where-Object { -not $_.IsWildcard -and (Get-ConnectivityRowResourceUrl -Row $_) -ceq $parentUrl }).Count -gt 0 } if ($requiredParent -and $redirectRow.RedirectDisposition -ne 'RequiredDependency') { $redirectRow.RedirectDisposition = 'RequiredDependency' $redirectRow.RedirectReason = 'Dependency of an applicable required redirect chain.' $changed = $true } } } if (-not $changed) { break } } } Function Add-RedirectedUrlToResults { param ( [Parameter(Mandatory=$true)] [string]$RedirectedURL, [Parameter(Mandatory=$true)] [string]$FullRedirectUrl, [Parameter(Mandatory=$true)] [int]$DestinationPort, [Parameter(Mandatory=$true)] [string]$OriginalURL, [Parameter(Mandatory=$true)] [int]$OriginalPort, [string]$ParentUrl ) Write-HostAzS "Redirected to '$FullRedirectUrl'" -ForegroundColor Yellow # Update the Note on the original result to show the redirect target (only if not already set) $ResultsToUpdate = $script:Results | Where-Object { $_.url -eq $OriginalURL -and ($_.Port -eq $OriginalPort) } ForEach ($ResultToUpdate in $ResultsToUpdate) { if (-not($ResultToUpdate.Note -like "Redirects to *")) { if ($ResultToUpdate.Note) { $ResultToUpdate.Note = "Redirects to '$($RedirectedURL)' - $($ResultToUpdate.Note)" } else { $ResultToUpdate.Note = "Redirects to '$($RedirectedURL)'" } } } if ([string]::IsNullOrWhiteSpace($RedirectedURL)) { Write-Warning "Redirected URL is null for $FullRedirectUrl, skipping" return } $originUrl = Get-ConnectivityResourceUrl -Url $OriginalURL -Port $OriginalPort if (-not $ParentUrl) { $ParentUrl = $originUrl } $targetUrl = Get-ConnectivityResourceUrl -Url $FullRedirectUrl -Port $DestinationPort $OriginalResult = @($script:Results) + @($script:RedirectedResults) | Where-Object { -not $_.IsWildcard -and (Get-ConnectivityRowResourceUrl -Row $_) -ceq $originUrl } | Select-Object -First 1 $originUrls = [string[]]@($originUrl) $originalSource = 'Connectivity probe' if ($OriginalResult) { $originalSource = $OriginalResult.Source if ($OriginalResult.PSObject.Properties['RedirectOriginUrls'] -and $OriginalResult.RedirectOriginUrls.Count) { $originUrls = [string[]]@($OriginalResult.RedirectOriginUrls) } } Merge-ConnectivityRedirectRow -Row ([PSCustomObject]@{ RowID = 0 MachineName = $env:COMPUTERNAME url = $RedirectedURL redirect = $targetUrl Port = $DestinationPort ArcGateway = $false IsWildcard = $false Source = "Redirect for $originalSource" Note = "Redirected URL from '$originUrl'; destination requirement evaluated separately." RedirectDisposition = 'Advisory' RedirectReason = 'Destination requirement unverified; discovered while following redirects during connectivity testing. Review the ''RedirectOriginUrls'' column for source details.' RedirectOriginUrls = $originUrls RedirectTargetUrl = $targetUrl RedirectParentUrls = [string[]]@($ParentUrl) TCPStatus = "" IPAddress = "" Layer7Status = "" Layer7Response = "" Layer7ResponseTime = "" CertificateSubject = "" CertificateIssuer = "" CertificateThumbprint = "" IntermediateCertificateIssuer = "" IntermediateCertificateSubject = "" IntermediateCertificateThumbprint = "" RootCertificateIssuer = "" RootCertificateSubject = "" RootCertificateThumbprint = "" }) Update-ConnectivityRedirectDisposition } # //////////////////////////////////////////////////////////////////////////// # Helper function to register a CRL / OCSP dependency URL as its own row in # $script:Results. Called when Get-Layer7CertificateDetails classifies an HTTPS # endpoint as "CRL/OCSP unreachable" (trusted chain, revocation offline). # # Dedupe strategy (two tiers): # - OCSP: skip if ANY existing row already covers the same host+port=80 # (the OCSP protocol uses a single host, so host match = full coverage) # - CRL: fall through to exact-URL match — different .crl files on the same # host can be blocked independently by path-based proxy filtering # When an identical URL was already added by a previous parent, the existing # row's Source is extended to list both parents. # # Rows are appended directly to $script:Results with Layer7Status = "" so the # existing remainingUrls loop in Test-AzureLocalConnectivity picks them up and # tests them as first-class endpoints. Function Add-CrlDependencyRowToResults { [CmdletBinding()] param ( [Parameter(Mandatory=$true)][ValidateSet('CRL','OCSP')][string]$Kind, [Parameter(Mandatory=$true)][string]$DependencyURL, [Parameter(Mandatory=$true)][string]$ParentURL ) if ([string]::IsNullOrWhiteSpace($DependencyURL)) { return } $parentDomain = (Get-DomainFromURL -url $ParentURL).Domain $depDomain = (Get-DomainFromURL -url $DependencyURL).Domain if ([string]::IsNullOrWhiteSpace($depDomain)) { Write-Debug "Add-CrlDependencyRowToResults: cannot parse domain from '$DependencyURL', skipping" return } # Tier 1 — dedupe against existing rows if ($Kind -eq 'OCSP') { # Host-level dedupe is sufficient for OCSP (single-host protocol) $existing = $script:Results | Where-Object { ((Get-DomainFromURL -url $_.URL).Domain -eq $depDomain) -and ($_.Port -eq $script:PORT_HTTP) } | Select-Object -First 1 if ($existing) { Write-Debug "Add-CrlDependencyRowToResults: OCSP host '$depDomain' already in Results (row URL '$($existing.URL)'), skipping duplicate" return } } else { # CRL — exact URL dedupe (different .crl paths on same host can be independently blocked) $existingSame = $script:Results | Where-Object { ($_.URL -eq $DependencyURL) -and ($_.Port -eq $script:PORT_HTTP) } | Select-Object -First 1 if ($existingSame) { # Same CRL URL already added — extend Source to reflect shared parent if ($existingSame.Source -notmatch [regex]::Escape($parentDomain)) { $existingSame.Source = "$($existingSame.Source); $parentDomain" } Write-Debug "Add-CrlDependencyRowToResults: CRL URL '$DependencyURL' already present — appended parent '$parentDomain' to Source" return } } # Tier 2 — append new row (Layer7Status="" so the remaining-URLs loop tests it) $sourcePrefix = if ($Kind -eq 'CRL') { 'CRL dependency for' } else { 'OCSP dependency for' } $script:Results.Add([PSCustomObject]@{ RowID = 0 MachineName = $env:COMPUTERNAME URL = $DependencyURL Port = $script:PORT_HTTP ArcGateway = $false IsWildcard = $false Source = "$sourcePrefix $parentDomain" Note = "Required for certificate revocation check of https://$parentDomain (HTTP port 80 must be reachable)" TCPStatus = "" IPAddress = "" Layer7Status = "" Layer7Response = "" Layer7ResponseTime = "" CertificateIssuer = "" CertificateSubject = "" CertificateThumbprint = "" IntermediateCertificateIssuer = "" IntermediateCertificateSubject = "" IntermediateCertificateThumbprint = "" RootCertificateIssuer = "" RootCertificateSubject = "" RootCertificateThumbprint = "" }) | Out-Null Write-Debug "Add-CrlDependencyRowToResults: appended $Kind dependency row '$DependencyURL' for parent '$parentDomain'" } # //////////////////////////////////////////////////////////////////////////// # Helper function to initialize ServerCertificateValidationCallback for SSL bypass # This is a private helper function for Test-Layer7Connectivity Function Initialize-CertificateCallback { # IMPORTANT: This sets a PROCESS-WIDE callback on ServicePointManager.ServerCertificateValidationCallback # that accepts all certificates. This is intentional — the module needs to connect to endpoints even when # SSL inspection replaces certificates, so it can detect and report SSL inspection to the user. # The callback is reset to $null in the end block of Test-Layer7Connectivity and Test-AzureLocalConnectivity. # Check if ServerCertificateValidationCallback class is already defined if (-not ([System.Management.Automation.PSTypeName]'ServerCertificateValidationCallback').Type) { # Define the ServerCertificateValidationCallback class # This class is used to bypass SSL certificate validation, to allow for SSL inspection detection $CertCallback = @" using System; using System.Net; using System.Net.Security; using System.Security.Cryptography.X509Certificates; public class ServerCertificateValidationCallback { public static void Ignore() { if(ServicePointManager.ServerCertificateValidationCallback == null) { ServicePointManager.ServerCertificateValidationCallback += delegate ( Object obj, X509Certificate certificate, X509Chain chain, SslPolicyErrors errors ) { return true; }; } } } "@ Add-Type $CertCallback } # Call the Ignore method to bypass SSL certificate validation. # PRECONDITION: the C# Ignore() only installs the accept-all delegate when # ServicePointManager.ServerCertificateValidationCallback is currently $null. If the # caller (or another loaded module) already set a callback, the bypass is NOT installed, # so SSL-inspection detection can be inconsistent in shared sessions. The caller # (Test-Layer7Connectivity / Test-AzureLocalConnectivity) captures and restores the # original callback in its finally block, so this never leaks across function calls. [ServerCertificateValidationCallback]::Ignore() } # //////////////////////////////////////////////////////////////////////////// # Helper to set all connectivity result fields on a URL object to skip/N/A values. # Used when a URL is skipped, wildcarded, or DNS resolution fails. Function Set-UrlObjectSkipFields { param( [Parameter(Mandatory)][PSCustomObject]$UrlObject, [Parameter(Mandatory)][string]$TCPStatus, [Parameter(Mandatory)][string]$Layer7Status, [string]$IPAddress = "N/A", [string]$Layer7Response = "N/A", [string]$Layer7ResponseTime = "N/A" ) $UrlObject.TCPStatus = $TCPStatus $UrlObject.IPAddress = $IPAddress $UrlObject.Layer7Status = $Layer7Status $UrlObject.Layer7Response = $Layer7Response $UrlObject.Layer7ResponseTime = $Layer7ResponseTime $UrlObject.CertificateIssuer = "N/A" $UrlObject.CertificateSubject = "N/A" $UrlObject.CertificateThumbprint = "N/A" $UrlObject.IntermediateCertificateIssuer = "N/A" $UrlObject.IntermediateCertificateSubject = "N/A" $UrlObject.IntermediateCertificateThumbprint = "N/A" $UrlObject.RootCertificateIssuer = "N/A" $UrlObject.RootCertificateSubject = "N/A" $UrlObject.RootCertificateThumbprint = "N/A" } # //////////////////////////////////////////////////////////////////////////// # Helper to copy connectivity test results from an Invoke-EndpointConnectivityTest # result hashtable to a URL result object. Function Copy-ConnectivityResultsToUrlObject { param( [Parameter(Mandatory)][PSCustomObject]$UrlObject, [Parameter(Mandatory)][hashtable]$TestResult ) $UrlObject.TCPStatus = $TestResult.TCPStatus foreach ($field in @('TCPDiagnostics', 'DNSDiagnostics', 'DNSFailureCode', 'DNSResolutionStatus')) { Add-Member -InputObject $UrlObject -NotePropertyName $field -NotePropertyValue $TestResult[$field] -Force } $UrlObject.IPAddress = $TestResult.IPAddress $UrlObject.Layer7Status = $TestResult.Layer7Status $UrlObject.Layer7Response = $TestResult.Layer7Response $UrlObject.Layer7ResponseTime = $TestResult.Layer7ResponseTime $UrlObject.CertificateIssuer = $TestResult.CertificateIssuer $UrlObject.CertificateSubject = $TestResult.CertificateSubject $UrlObject.CertificateThumbprint = $TestResult.CertificateThumbprint $UrlObject.IntermediateCertificateIssuer = $TestResult.CertificateIntermediateIssuer $UrlObject.IntermediateCertificateSubject = $TestResult.CertificateIntermediateSubject $UrlObject.IntermediateCertificateThumbprint = $TestResult.CertificateIntermediateThumbprint $UrlObject.RootCertificateIssuer = $TestResult.CertificateRootIssuer $UrlObject.RootCertificateSubject = $TestResult.CertificateRootSubject $UrlObject.RootCertificateThumbprint = $TestResult.CertificateRootThumbprint } # SIG # Begin signature block # MIInQQYJKoZIhvcNAQcCoIInMjCCJy4CAQExDzANBglghkgBZQMEAgEFADB5Bgor # BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG # KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCNHlxwjKyG8RWW # wrcwbKfhVyyB+sGrqYZ7ddE7PdkCUqCCDLowggX1MIID3aADAgECAhMzAAACHU0Z # yE7XD1dIAAAAAAIdMA0GCSqGSIb3DQEBCwUAMFcxCzAJBgNVBAYTAlVTMR4wHAYD # VQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBD # b2RlIFNpZ25pbmcgUENBIDIwMjQwHhcNMjYwNDE2MTg1OTQzWhcNMjcwNDE1MTg1 # OTQzWjB0MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UE # BxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMR4wHAYD # VQQDExVNaWNyb3NvZnQgQ29ycG9yYXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IB # DwAwggEKAoIBAQDQvewXxx9gZZFC6Ys1WBay8BJ8kGA4JQnH5CMafqOASlTpK9H8 # o5ZXTXt0caVQTNMUPt445wXYD+dFtaKWTwDn1I52oUSrC9vJin1Gsqt+zyKJL5Dg # 3eQXbQNR61DmMy20GLTIO3SFed9Rfi/ophgCLGFLDR3r0KvHjwMb/jYWS0celV/4 # Lz27LfAekm8v9E5IXaeiXbAUYZKK090n4CVl3JBtbN+9DtI9SNu/yjvozW52/u7R # X/Ttpa/KDlpuokZ+Zcbvmtd9ur9gFLvZzh41o9MsE/clQtdaFWGvuo6Jua/ntpgk # ey3E5/vBFe+MJPG6phdnuo6r57ZudCudiI1bAgMBAAGjggGbMIIBlzAOBgNVHQ8B # Af8EBAMCB4AwHwYDVR0lBBgwFgYKKwYBBAGCN0wIAQYIKwYBBQUHAwMwHQYDVR0O # BBYEFH6QuMwqcPG0hQlQ6c5jCtTTLrVeMEUGA1UdEQQ+MDykOjA4MR4wHAYDVQQL # ExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xFjAUBgNVBAUTDTIzMDAxMis1MDc1NTkw # HwYDVR0jBBgwFoAUf1k/VCHarU/vBeXmo9ctBpQSCDEwYAYDVR0fBFkwVzBVoFOg # UYZPaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9jcmwvTWljcm9zb2Z0 # JTIwQ29kZSUyMFNpZ25pbmclMjBQQ0ElMjAyMDI0LmNybDBtBggrBgEFBQcBAQRh # MF8wXQYIKwYBBQUHMAKGUWh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMv # Y2VydHMvTWljcm9zb2Z0JTIwQ29kZSUyMFNpZ25pbmclMjBQQ0ElMjAyMDI0LmNy # dDAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEBCwUAA4ICAQBKTbYOjzwTG/DXGaz9 # s6+fQeaTtDcFmMY+5UyVFCyj7Pv+5i37qfX8lSL/tBIfYQfWsMuBQlfZurJD6r4H # VJ2CeH+1fgiq8dcHdVKoZ3Sa2qXoX3cq9iS8cVb06B7+5/XJ7I0OxHH9fDsvJ3T3 # w5V/ZtAIFmLrl+P0CtG+92uzRsn0nTbdFjOkLMLWPLAU3THohKRlSEMgFJpPkm5n # 5UAZ35xX6FWCrDLsSKb555bTifwa8mJBwdlof0bmfYidH+dxZ1FdDxvLnNl9zeKs # A4kejaaIqqIPguhwAti5Ql7BlTNoJNwxCvBmqW2MQLnCkYN/VVUsR3V2x/rcTNzo # Bf/Z/SpROvdaA2ZOOd1uioXJt3tdLQ7vHpqpib0KfWr/FWXW10q38VxfCnRQBqzb # SuztR7nEMuzX7Ck+B/XaPDXd1qh72+QYyB0Z2VzWmO9zsnb9Uq/dwu8LGeQqnyu6 # 7SDGACvnXii2fb9+US492VTnXSnFKyqwgzUyFMtZK1/sHYTv6bG4TtQUygQxTN+Z # V+aJIlKO2MqZ7bKrAnOzS9m6NgoTdWOq11bTOZwKlIEV/EhV9SWkDmdpR/hPPT2v # 6TEj4F8PT/zHjRezIU5c/DGlt/VhY/pK0XkJtEyMmmS1BMtjU/rqBZVMIm3dnxQs # /TBByr+Cf8Z1r7aifQVQ+WSqzjCCBr0wggSloAMCAQICEzMAAAA5O7Y3Gb8GHWcA # AAAAADkwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpX # YXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQg # Q29ycG9yYXRpb24xMjAwBgNVBAMTKU1pY3Jvc29mdCBSb290IENlcnRpZmljYXRl # IEF1dGhvcml0eSAyMDExMB4XDTI0MDgwODIwNTQxOFoXDTM2MDMyMjIyMTMwNFow # VzELMAkGA1UEBhMCVVMxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEo # MCYGA1UEAxMfTWljcm9zb2Z0IENvZGUgU2lnbmluZyBQQ0EgMjAyNDCCAiIwDQYJ # KoZIhvcNAQEBBQADggIPADCCAgoCggIBANgBnB7jOMeqlRYHNa265v4IY9fH8TKh # emHfPINe1gpLaV3dhg324WwH06LcHbpnsBukCDNitryo0dtS/EW6I/yEL/bLSY8h # KpbfQuWusBPr9qazYcDxCW/qnjb5JsI1s8bNOg3bVATvQVL4tcf03aTycsz8QeCd # M0l/yHRObJ9QqazM1r6VPEOJ7LL+uEEb73w6QCuhs89a1uv1zerOYMnsneRRwCbp # yW11IcggU0cRKDDq1pjVJzIbIF6+oiXXbReOsgeI8zu1FyQfK0fVkaya8SmVHQ/t # Of23mZ4W9k0Ri22QW9p3UgSC5OUDktKxxcCmGL6tXLfOGSWHIIV4YrTJTT6PNty5 # REojHJuZHArkF9VnHTERWoTjAzfI3kP+5b4alUdhgAZ7ttOu1bVnXfHaqPYl2rPs # 20ji03LOVWsh/radgE17es5hL+t6lV0eVHrVhsssROWJuz2MXMCt7iw7lFPG9LXK # Gjsmonn2gotGdHIuEg5JnJMJVmixd5LRlkmgYRZKzhxSCwyoGIq0PhaA7Y+VPct5 # pCHkijcIIDm0nlkK+0KyepolcqGm0T/GYQRMhHJlGOOmVQop36wUVUYklUy++vDW # eEgEo4s7hxN6mIbf2MSIQ/iIfMZgJxC69oukMUXCrOC3SkE/xIkgpfl22MM1itkZ # 35nNXkMolU1lAgMBAAGjggFOMIIBSjAOBgNVHQ8BAf8EBAMCAYYwEAYJKwYBBAGC # NxUBBAMCAQAwHQYDVR0OBBYEFH9ZP1Qh2q1P7wXl5qPXLQaUEggxMBkGCSsGAQQB # gjcUAgQMHgoAUwB1AGIAQwBBMA8GA1UdEwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAU # ci06AjGQQ7kUBU7h6qfHMdEjiTQwWgYDVR0fBFMwUTBPoE2gS4ZJaHR0cDovL2Ny # bC5taWNyb3NvZnQuY29tL3BraS9jcmwvcHJvZHVjdHMvTWljUm9vQ2VyQXV0MjAx # MV8yMDExXzAzXzIyLmNybDBeBggrBgEFBQcBAQRSMFAwTgYIKwYBBQUHMAKGQmh0 # dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2kvY2VydHMvTWljUm9vQ2VyQXV0MjAx # MV8yMDExXzAzXzIyLmNydDANBgkqhkiG9w0BAQwFAAOCAgEAFJQfOChP7onn6fLI # MKrSlN1WYKwDFgAddymOUO3FrM8d7B/W/iQ6DxXsDn7D5W4wMwYeLystcEqfkjz4 # NURRgazyMu5yRzQh4LqjA4tStTcJh1opExo7nn5PuPBYnbu0+THSuVHTe0VTTPVh # ily/piFrDo3axQ9P4C+Ol5yet+2gTfekICS5xS+cYfSIvgn0JksVBVMYVI5QFu/q # hnLhsEFEUzG8fvv0hjgkO+lkpV9ty6GkN4vdnd7ya6Q6aR9y34aiM1qmxaxBi6OU # nyNl6fkuun/diTFnYDLTppOkr/mg5WSfCiDVMNCxtj4wPKC5OmHm1DQIt/MNokbb # H3UGsFP1QbzsLocuSqLCvH09Io3fDPTmscR9Y75G4qX7RTX8AdBPo0I6OEojf39z # uFZt0qOHm65YWQE69cZM2ueE1MB05dNNgHK9gTE7zKvK/fg8B2qjW88MT/WF5V5u # vZGtqa9FSL2RazArA+rDPuf6JGYz4HpgMZHB4S6szWSKYBv0VisCzfxgeU+dquXW # 9bd0auYlOB58DPcOYKdc3Se94g+xL4pcEhbB54JOgAkwYTu/9dLeH2pDqeJZAABV # DWRQCaXfO5LgyKwKCLYXpigrZYCjUSBcr+Ve8PFWMhVTQl0v4q8J/AUmQN5W4n10 # 1cY2L4A7GTQG1h32HHAvfQESWP0xghndMIIZ2QIBATBuMFcxCzAJBgNVBAYTAlVT # MR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jv # c29mdCBDb2RlIFNpZ25pbmcgUENBIDIwMjQCEzMAAAIdTRnITtcPV0gAAAAAAh0w # DQYJYIZIAWUDBAIBBQCggZAwGQYJKoZIhvcNAQkDMQwGCisGAQQBgjcCAQQwLwYJ # KoZIhvcNAQkEMSIEIFDaBQOOAcXO5EslFmbiMfHAZId64GU2PAB8WevF/Bl2MEIG # CisGAQQBgjcCAQwxNDAyoBSAEgBNAGkAYwByAG8AcwBvAGYAdKEagBhodHRwOi8v # d3d3Lm1pY3Jvc29mdC5jb20wDQYJKoZIhvcNAQEBBQAEggEAWyaSMZer/TWCs3zZ # V2UvztgvGsoLAGmlzMJQX5zojz7HoOnEDY9VfRzoaNXmffP08w3o7mjLH3Ty4m4B # O5BPWxrE6lOVFs1+DqVZGGNIGGUMmWSKd+BEppubbWQd7scPY2EQSGJVHQ0DqBXH # NiUGazCMlf6NUqmRvRzwa1pGNpg0LG1TMe6kaJimc9J9S7fxO1h9KgrKZxgkVRRW # U8142RS18jEs0/ZBcfMBcBLLhj7RWoW2OIvyEjIlc/d+3a1bLDPjXv91N0kJLdJd # gy6XVcbT38FbLB+tCbRSiVMQ2jGTguIrfI582zgjpxAnE2Xq2a+fBBEK5GrV53mA # MGi3KaGCF60wghepBgorBgEEAYI3AwMBMYIXmTCCF5UGCSqGSIb3DQEHAqCCF4Yw # gheCAgEDMQ8wDQYJYIZIAWUDBAIBBQAwggFaBgsqhkiG9w0BCRABBKCCAUkEggFF # MIIBQQIBAQYKKwYBBAGEWQoDATAxMA0GCWCGSAFlAwQCAQUABCCWBhcB07CfCjMh # sEAWHnIlb0hoMlCY1iw1XMMLYwETywIGaq3H68L1GBMyMDI2MDkyOTIwNDQ0OS42 # ODNaMASAAgH0oIHZpIHWMIHTMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGlu # Z3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBv # cmF0aW9uMS0wKwYDVQQLEyRNaWNyb3NvZnQgSXJlbGFuZCBPcGVyYXRpb25zIExp # bWl0ZWQxJzAlBgNVBAsTHm5TaGllbGQgVFNTIEVTTjoyRDFBLTA1RTAtRDk0NzEl # MCMGA1UEAxMcTWljcm9zb2Z0IFRpbWUtU3RhbXAgU2VydmljZaCCEfswggcoMIIF # EKADAgECAhMzAAACEtEIBjzKGE+qAAEAAAISMA0GCSqGSIb3DQEBCwUAMHwxCzAJ # BgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25k # MR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMTHU1pY3Jv # c29mdCBUaW1lLVN0YW1wIFBDQSAyMDEwMB4XDTI1MDgxNDE4NDgxNVoXDTI2MTEx # MzE4NDgxNVowgdMxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAw # DgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24x # LTArBgNVBAsTJE1pY3Jvc29mdCBJcmVsYW5kIE9wZXJhdGlvbnMgTGltaXRlZDEn # MCUGA1UECxMeblNoaWVsZCBUU1MgRVNOOjJEMUEtMDVFMC1EOTQ3MSUwIwYDVQQD # ExxNaWNyb3NvZnQgVGltZS1TdGFtcCBTZXJ2aWNlMIICIjANBgkqhkiG9w0BAQEF # AAOCAg8AMIICCgKCAgEAr0zToDkpWQtsZekS0cV0quDdKSTGkovvBaZH0OAIEi0O # 3CcO77JiX8c4Epq9uibHVZZ1W/LoufE172vkRXO+QYNtWWorECJ2AcZQ10bpAltk # hZNiXlVJ8L3QzhKgrXrmMkm2J+/g81U23JPcO4wXHEftonT3wpd//936rjmwxMm7 # NkbsygbJf+4AVBMNr4aMPQhBd76od0KMB6WrvyEGOOU0893OFufS5EDey4n44Wga # xJE0Vnv3/OOvuOw5Kp1KPqjjYJ+L9ywLuBMtcDfLpNQO/h1eFEoMrbiEM67TOfNl # XfxbDz4MlsYvLioxgd2Xzey1QxrV1+i+JyVDJMiSe9gKOuzpiQQFE19DUPgsidyj # LTzXEhSVLBlRor0eCVf7gC6Rfk8NY3rO2sggOL79vU5FuDKTh/sIOtcUHeHC42jB # GB+tfdKC1KOBR+UlN9aOzg8mpUNI2FgqQvirVP9ppbeMUfvp2wA9voyTiRWvDgzC # xo8xlJ1nscYTHIQrmkF9j/Ca0IDmt8fvOn64nnlJOGUYZYHMC1l0xtgkYTE1ESUq # qkawKk7iqbxdnLyycS+dR+zaxPudMDLrQFz8lgfy9obk0D8HC2dzhWpYNn5hdkoP # EzgCqQUOp8v3Qj/sd4anyupe5KoCkjABOP3yhSQ4W9Z+DrJnhM/rbsXC7oTv26cC # AwEAAaOCAUkwggFFMB0GA1UdDgQWBBRSBblSxb5cYKYOwvd/VfoXOfu33jAfBgNV # HSMEGDAWgBSfpxVdAF5iXYP05dJlpxtTNRnpcjBfBgNVHR8EWDBWMFSgUqBQhk5o # dHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2NybC9NaWNyb3NvZnQlMjBU # aW1lLVN0YW1wJTIwUENBJTIwMjAxMCgxKS5jcmwwbAYIKwYBBQUHAQEEYDBeMFwG # CCsGAQUFBzAChlBodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2NlcnRz # L01pY3Jvc29mdCUyMFRpbWUtU3RhbXAlMjBQQ0ElMjAyMDEwKDEpLmNydDAMBgNV # HRMBAf8EAjAAMBYGA1UdJQEB/wQMMAoGCCsGAQUFBwMIMA4GA1UdDwEB/wQEAwIH # gDANBgkqhkiG9w0BAQsFAAOCAgEAXnSAkmX79Rc7lxS1wOozXJ7V0ou5DntVcOJp # lIkDjvEN8BIQph4U+gSOLZuVReP/z9YdUiUkcPwL1PM245/kEX1EegpxNc8HDA6h # KCHg0ALNEcuxnGOlgKLokXfUer1D5hiW8PABM9R+neiteTgPaaRlJFvGTYvotc0u # qGiES5hMQhL8RNFhpS9RcIWHtnQGEnrdOUvCAhs4FeViawcmLTKv+1870c/MeTHi # 0QDdeR+7/Wg4qhkJ2k1iEHJdmYf8rIV0NRBZcdRTTdHee35SXP5neNCfAkjDIuZy # cRud6jzPLCNLiNYzGXBswzJygj4EeSORT7wMvaFuKeRAXoXC3wwYvgIsI1zn3DGY # 625Y+yZSi8UNSNHuri36Zv9a+Q4vJwDpYK36S0TB2pf7xLiiH32nk7YK73Rg98W6 # fZ2INuzYzZ7Ghgvfffkj4EUXg1E0EffY1pEqkbpDTP7h/DBqtzoPXsyw2MUh+7yv # Wcq2BGZSuca6CY6X4ioMuc5PWpsmvOOli7ARNA7Ab8kKdCc2gNDLacglsweZEc9/ # VQB6hls/b6Kk32nkwuHExKlaeoSVrKB5U9xlp1+c8J/7GJj4Rw7AiQ8tcp+WmfyD # 8KxX2QlKbDi4SUjnglv4617R8+a/cDWJyaMt8279Wn7f2yMedN7kfGIQ5SZj66Rd # hdlZOq8wggdxMIIFWaADAgECAhMzAAAAFcXna54Cm0mZAAAAAAAVMA0GCSqGSIb3 # DQEBCwUAMIGIMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4G # A1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMTIw # MAYDVQQDEylNaWNyb3NvZnQgUm9vdCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkgMjAx # MDAeFw0yMTA5MzAxODIyMjVaFw0zMDA5MzAxODMyMjVaMHwxCzAJBgNVBAYTAlVT # MRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQK # ExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMTHU1pY3Jvc29mdCBUaW1l # LVN0YW1wIFBDQSAyMDEwMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA # 5OGmTOe0ciELeaLL1yR5vQ7VgtP97pwHB9KpbE51yMo1V/YBf2xK4OK9uT4XYDP/ # XE/HZveVU3Fa4n5KWv64NmeFRiMMtY0Tz3cywBAY6GB9alKDRLemjkZrBxTzxXb1 # hlDcwUTIcVxRMTegCjhuje3XD9gmU3w5YQJ6xKr9cmmvHaus9ja+NSZk2pg7uhp7 # M62AW36MEBydUv626GIl3GoPz130/o5Tz9bshVZN7928jaTjkY+yOSxRnOlwaQ3K # Ni1wjjHINSi947SHJMPgyY9+tVSP3PoFVZhtaDuaRr3tpK56KTesy+uDRedGbsoy # 1cCGMFxPLOJiss254o2I5JasAUq7vnGpF1tnYN74kpEeHT39IM9zfUGaRnXNxF80 # 3RKJ1v2lIH1+/NmeRd+2ci/bfV+AutuqfjbsNkz2K26oElHovwUDo9Fzpk03dJQc # NIIP8BDyt0cY7afomXw/TNuvXsLz1dhzPUNOwTM5TI4CvEJoLhDqhFFG4tG9ahha # YQFzymeiXtcodgLiMxhy16cg8ML6EgrXY28MyTZki1ugpoMhXV8wdJGUlNi5UPkL # iWHzNgY1GIRH29wb0f2y1BzFa/ZcUlFdEtsluq9QBXpsxREdcu+N+VLEhReTwDwV # 2xo3xwgVGD94q0W29R6HXtqPnhZyacaue7e3PmriLq0CAwEAAaOCAd0wggHZMBIG # CSsGAQQBgjcVAQQFAgMBAAEwIwYJKwYBBAGCNxUCBBYEFCqnUv5kxJq+gpE8RjUp # zxD/LwTuMB0GA1UdDgQWBBSfpxVdAF5iXYP05dJlpxtTNRnpcjBcBgNVHSAEVTBT # MFEGDCsGAQQBgjdMg30BATBBMD8GCCsGAQUFBwIBFjNodHRwOi8vd3d3Lm1pY3Jv # c29mdC5jb20vcGtpb3BzL0RvY3MvUmVwb3NpdG9yeS5odG0wEwYDVR0lBAwwCgYI # KwYBBQUHAwgwGQYJKwYBBAGCNxQCBAweCgBTAHUAYgBDAEEwCwYDVR0PBAQDAgGG # MA8GA1UdEwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAU1fZWy4/oolxiaNE9lJBb186a # GMQwVgYDVR0fBE8wTTBLoEmgR4ZFaHR0cDovL2NybC5taWNyb3NvZnQuY29tL3Br # aS9jcmwvcHJvZHVjdHMvTWljUm9vQ2VyQXV0XzIwMTAtMDYtMjMuY3JsMFoGCCsG # AQUFBwEBBE4wTDBKBggrBgEFBQcwAoY+aHR0cDovL3d3dy5taWNyb3NvZnQuY29t # L3BraS9jZXJ0cy9NaWNSb29DZXJBdXRfMjAxMC0wNi0yMy5jcnQwDQYJKoZIhvcN # AQELBQADggIBAJ1VffwqreEsH2cBMSRb4Z5yS/ypb+pcFLY+TkdkeLEGk5c9MTO1 # OdfCcTY/2mRsfNB1OW27DzHkwo/7bNGhlBgi7ulmZzpTTd2YurYeeNg2LpypglYA # A7AFvonoaeC6Ce5732pvvinLbtg/SHUB2RjebYIM9W0jVOR4U3UkV7ndn/OOPcbz # aN9l9qRWqveVtihVJ9AkvUCgvxm2EhIRXT0n4ECWOKz3+SmJw7wXsFSFQrP8DJ6L # GYnn8AtqgcKBGUIZUnWKNsIdw2FzLixre24/LAl4FOmRsqlb30mjdAy87JGA0j3m # Sj5mO0+7hvoyGtmW9I/2kQH2zsZ0/fZMcm8Qq3UwxTSwethQ/gpY3UA8x1RtnWN0 # SCyxTkctwRQEcb9k+SS+c23Kjgm9swFXSVRk2XPXfx5bRAGOWhmRaw2fpCjcZxko # JLo4S5pu+yFUa2pFEUep8beuyOiJXk+d0tBMdrVXVAmxaQFEfnyhYWxz/gq77EFm # PWn9y8FBSX5+k77L+DvktxW/tM4+pTFRhLy/AsGConsXHRWJjXD+57XQKBqJC482 # 2rpM+Zv/Cuk0+CQ1ZyvgDbjmjJnW4SLq8CdCPSWU5nR0W2rRnj7tfqAxM328y+l7 # vzhwRNGQ8cirOoo6CGJ/2XBjU02N7oJtpQUQwXEGahC0HVUzWLOhcGbyoYIDVjCC # Aj4CAQEwggEBoYHZpIHWMIHTMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGlu # Z3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBv # cmF0aW9uMS0wKwYDVQQLEyRNaWNyb3NvZnQgSXJlbGFuZCBPcGVyYXRpb25zIExp # bWl0ZWQxJzAlBgNVBAsTHm5TaGllbGQgVFNTIEVTTjoyRDFBLTA1RTAtRDk0NzEl # MCMGA1UEAxMcTWljcm9zb2Z0IFRpbWUtU3RhbXAgU2VydmljZaIjCgEBMAcGBSsO # AwIaAxUA5VHBr4h00EN7jUdQ33SE+qbk/8CggYMwgYCkfjB8MQswCQYDVQQGEwJV # UzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UE # ChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSYwJAYDVQQDEx1NaWNyb3NvZnQgVGlt # ZS1TdGFtcCBQQ0EgMjAxMDANBgkqhkiG9w0BAQsFAAIFAO5mHQ0wIhgPMjAyNjA5 # MjkxMTE4MzdaGA8yMDI2MDkzMDExMTgzN1owdDA6BgorBgEEAYRZCgQBMSwwKjAK # AgUA7mYdDQIBADAHAgEAAgIS2TAHAgEAAgISdDAKAgUA7mdujQIBADA2BgorBgEE # AYRZCgQCMSgwJjAMBgorBgEEAYRZCgMCoAowCAIBAAIDB6EgoQowCAIBAAIDAYag # MA0GCSqGSIb3DQEBCwUAA4IBAQBmtnygjGauZt5fCLjSH2PyJabmUlgTl7BWH1A/ # lbgryijoEbMu9vrehyJlhpg2rHvcS14oBTP8UXMBE13SuyMIHJjjlTCpgZ6Ua/to # spd0mRtIaiyu4iNme/6l4/PbjZlxrH63L8ifX/AQu0xeR8LIXg+/c+HCznJPXG35 # wqW64g3QGQrPK/TvvsjBBkzQxlBkdCX/LS2Y5iEKybqlOF5pSkHhRTLH4eIjM4MM # +zi/oGJpiNjrJVIEUztoE3n4dNGwtgbvTzZlD0MypwMAdDIeL9ZDCcyamz1sGxwG # cEN2VO1/Yczyv0zcF+Ne+gAfhKa2zmrhxBYPStjr5BQXGpyxMYIEDTCCBAkCAQEw # gZMwfDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcT # B1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEmMCQGA1UE # AxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAgUENBIDIwMTACEzMAAAIS0QgGPMoYT6oA # AQAAAhIwDQYJYIZIAWUDBAIBBQCgggFKMBoGCSqGSIb3DQEJAzENBgsqhkiG9w0B # CRABBDAvBgkqhkiG9w0BCQQxIgQgAYSI1SEewhIB9QTxK79qywVc+gjqPqPGFbvc # 6fS4UNkwgfoGCyqGSIb3DQEJEAIvMYHqMIHnMIHkMIG9BCBz+X5GvO7WngknH4BZ # eYU+BzBL1Jy5oJ8wVlTNIxfYgzCBmDCBgKR+MHwxCzAJBgNVBAYTAlVTMRMwEQYD # VQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNy # b3NvZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMTHU1pY3Jvc29mdCBUaW1lLVN0YW1w # IFBDQSAyMDEwAhMzAAACEtEIBjzKGE+qAAEAAAISMCIEIJ5gCGD68K86zFVdUCgl # Jw/Y3cFPDq54jK4CpKBCOeAzMA0GCSqGSIb3DQEBCwUABIICAIhvyqdanHruMa+0 # vDMYe5/5zbYkXF/NtCfrzYNHqXHflMsXRtgbbO1K2IrHZtz4x1AMUSZ/N9SWqRdG # sxAglQt2R4fiYpBEygBFGh96soRrWDw8i48R4UrN1wGnjimnCujcEWjH4VMnOoXZ # aKVZbFe5w9SX6cxpYvZSEqdZxB6D8m1m5gO4JYyzEU/uFxH/MXHVxvYriX3z3sgG # 58Mtyv8tr4jTkJRE0qZwGCiTuF7XbNHlCRXtwITqWHT9x5xmCVn1ZxVkrO0WhdQT # nGmWmccB5FH6rCWKDmb8m99d75zioCRIzavRkvT0Qb7qS8hvUy4bUo23Xz5jvLwm # WC7nGYQRhHeWVz1xKNBc1dTAOgka+Zhtb7dqKLSoFoqXjlJVc8skm/UlBiZWv/Ge # LQGgd8YRPkxkTb58KQq5BkRcWqUUrFnI/xHgYlo7q/1fIozs7rrL1NbbVUKBbiSP # cS0tmLqC8lh8AMz2Z8iRJihZGFxVk9RYLWK0/ILqB6sx+C0q3+VcAJYgVs4VJCWT # dD4dOGrxk8PyrkJPzJuV5j5d8pxP33Y06xt9Pg4kNlrFp9vQt5GCqRAdDraxH59g # k6POzjB853nlEo0AWFu7F2nTdNkwFJSghBo+UyXaBYKwBaUJgBZCnBkZObD2eEwV # 2Nn9cccbwJ1QLgZ7iWr6sWIbyCgI # SIG # End signature block |