Microsoft.AzLocal.CSSTools

1.2607.16.2249

modules/AzStack.Insights/rules/AzStackHci.DiagnosticSettings.PrivateLinkConfiguration.ps1

                                <#

.SYNOPSIS

    Rule to evaluate Azure Local Private Link configuration health from the connectivity test results.

.DESCRIPTION

    AzStackHci.DiagnosticSettings v0.6.8 classifies Private Link findings and surfaces them as run-level state

    on the Test-AzureLocalConnectivity -PassThru result. The analyzer captures that state and passes it to this

    rule, which distinguishes two severities:

      * Critical (FAILURE) - Arc endpoints that resolved to an RFC1918 (private) address. This is an

        unsupported configuration for those endpoints and will block Arc enablement / agent connectivity.

      * Missing from proxy bypass (WARNING) - non-critical endpoints that resolve to an RFC1918 address

        (a Private Endpoint is in use) but are NOT on the machine's proxy bypass list, so their traffic is

        wrongly forced through the forward proxy instead of routing via ExpressRoute / VPN.

    v0.6.8 VERIFIES bypass state (PrivateLinkBypassMissingArray / PrivateLinkBypassConfirmedArray) rather than

    blanket-advising every Private Link endpoint. When that verification ran, the missing-from-bypass list is

    authoritative; otherwise (older module, or no proxy configured) the rule falls back to the legacy

    PrivateLinkProxyBypassArray advisory. A run with neither critical nor missing-bypass findings returns SUCCESS.

#>

[CmdletBinding()]

param(

    # Run-level flag from Test-AzureLocalConnectivity (-PassThru). $true when the module detected any endpoint

    # resolving to a Private Link / RFC1918 address during the sweep.

    [Parameter(Mandatory=$false)]

    [bool]$PrivateLinkDetected = $false,

    # Critical endpoints (Arc) that resolved to RFC1918 - an unsupported configuration. AllowEmptyCollection

    # so a clean run passes an empty array without tripping parameter binding.

    [Parameter(Mandatory=$false)]

    [AllowEmptyCollection()]

    [string[]]$PrivateLinkCriticalArray = @(),

    # PaaS Private Link endpoints that must be added to the proxy bypass list (legacy blanket advisory / WARNING).

    [Parameter(Mandatory=$false)]

    [AllowEmptyCollection()]

    [string[]]$PrivateLinkProxyBypassArray = @(),

    # v0.6.8 VERIFIED signal: non-critical endpoints that resolve to an RFC1918 address (Private Endpoint in use)

    # but are NOT on the machine's proxy bypass list (WinHTTP bypass / NO_PROXY) - so their traffic is wrongly

    # forced through the forward proxy. This is the precise 'detected AND missing from bypass' set.

    [Parameter(Mandatory=$false)]

    [AllowEmptyCollection()]

    [string[]]$PrivateLinkBypassMissingArray = @(),

    # v0.6.8 VERIFIED signal: RFC1918 endpoints that ARE correctly excluded from the proxy (bypass confirmed).

    # Surfaced for context so the report can show the verified-good set alongside the missing set.

    [Parameter(Mandatory=$false)]

    [AllowEmptyCollection()]

    [string[]]$PrivateLinkBypassConfirmedArray = @()

)

# Import localization strings from the locale directory

# this will natively import the psd1 file that has the same name as the script

# and the locale folder that matches the current culture of the user running the script

Import-LocalizedData -BindingVariable 'localizedData' -BaseDirectory "$PSScriptRoot\locale" -UICulture $PSUICulture

$insightRule = Initialize-InsightRule -Id $localizedData.Id -Properties $localizedData.Insight

<# START INSIGHT RULE LOGIC #>

try {

    # Normalise the lists once so counts and logged detail agree even if a $null slipped through.

    $criticalUrls    = @($PrivateLinkCriticalArray        | Where-Object { $_ })

    $proxyBypassUrls = @($PrivateLinkProxyBypassArray     | Where-Object { $_ })

    $bypassMissing   = @($PrivateLinkBypassMissingArray   | Where-Object { $_ })

    $bypassConfirmed = @($PrivateLinkBypassConfirmedArray | Where-Object { $_ })

    # v0.6.8 verifies bypass state when a proxy is configured (populating the Missing / Confirmed lists).

    # When that verification ran, the missing-from-bypass list is authoritative and supersedes the legacy

    # blanket advisory (which is a superset that also includes correctly-bypassed endpoints). Otherwise

    # (older module, or no proxy configured) fall back to the legacy PrivateLinkProxyBypassArray advisory.

    $verificationRan   = ($bypassMissing.Count -gt 0) -or ($bypassConfirmed.Count -gt 0)

    $missingFromBypass = if ($verificationRan) { $bypassMissing } else { $proxyBypassUrls }

    # Whether the rule received ANY per-endpoint detail (critical / missing-bypass / confirmed-bypass / legacy

    # proxy-bypass). Used below to catch the edge case where the run-level PrivateLinkDetected flag is set but no

    # endpoint list was surfaced - so a genuine detection is not silently dropped to SUCCESS. Note: the

    # 'verified as correctly bypassed' case populates $bypassConfirmed, so it counts as detail and stays SUCCESS.

    $anyDetailProvided = (($criticalUrls.Count + $bypassMissing.Count + $bypassConfirmed.Count + $proxyBypassUrls.Count) -gt 0)

    Write-InsightLog -Message (

        "Private Link summary: Detected={0}, Critical={1}, BypassMissing={2}, BypassConfirmed={3}, LegacyProxyBypass={4}" -f `

            $PrivateLinkDetected, $criticalUrls.Count, $bypassMissing.Count, $bypassConfirmed.Count, $proxyBypassUrls.Count

    )

    # Critical findings take precedence and are a hard FAILURE - the unsupported RFC1918 resolution will

    # block Arc enablement regardless of any proxy-bypass state.

    if ($criticalUrls.Count -gt 0) {

        foreach ($url in $criticalUrls) {

            Write-InsightLog -Level 'Error' -Message ("PRIVATE LINK CRITICAL: '{0}' resolved to an RFC1918 address (unsupported)." -f $url)

        }

        $insightRule.Status       = [InsightStatus]::FAILURE

        $insightRule.ErrorMessage = ($localizedData.Insight.ErrorMessage -f $criticalUrls.Count)

    }

    elseif ($missingFromBypass.Count -gt 0) {

        # Non-critical endpoints that resolve to an RFC1918 address (Private Endpoint in use) but are NOT on

        # the proxy bypass list -> WARNING (traffic wrongly forced through the proxy).

        foreach ($url in $missingFromBypass) {

            Write-InsightLog -Level 'Warning' -Message ("PRIVATE LINK MISSING BYPASS: '{0}' resolves to an RFC1918 address but is not on the proxy bypass list." -f $url)

        }

        $insightRule.Status       = [InsightStatus]::WARNING

        $insightRule.ErrorMessage = ($localizedData.BypassMissingMessage -f $missingFromBypass.Count)

    }

    elseif ($PrivateLinkDetected -and -not $anyDetailProvided) {

        # Edge case: the sweep set the run-level PrivateLinkDetected flag, but no per-endpoint detail reached this

        # rule (no critical, no missing-bypass, no confirmed-bypass, no legacy proxy-bypass list). Surface a

        # non-success status so the top-level signal is not silently dropped to SUCCESS - mirroring how the

        # SslInspection / CrlRevocationOffline rules handle their detected-but-no-detail edge cases.

        Write-InsightLog -Level 'Warning' -Message "Private Link / RFC1918 resolution was detected during connectivity testing, but no endpoint detail was provided to this rule."

        $insightRule.Status       = [InsightStatus]::WARNING

        $insightRule.ErrorMessage = $localizedData.PrivateLinkDetectedNoDetailsMessage

    }

    else {

        # No Private Link misconfiguration surfaced (nothing critical, and any detected endpoints are

        # either not RFC1918 or verified as correctly bypassed).

        Write-InsightLog -Message "No Private Link configuration issues detected across the tested Azure Local endpoints."

        $insightRule.Status = [InsightStatus]::SUCCESS

    }

    # Surface the lists in Properties so they render in the analyzer / HTML output.

    $insightRule.Properties = [PSCustomObject]@{

        PrivateLinkDetected             = [bool]$PrivateLinkDetected

        CriticalCount                   = $criticalUrls.Count

        BypassMissingCount              = $bypassMissing.Count

        BypassConfirmedCount            = $bypassConfirmed.Count

        ProxyBypassCount                = $proxyBypassUrls.Count

        PrivateLinkCriticalArray        = $criticalUrls

        PrivateLinkBypassMissingArray   = $bypassMissing

        PrivateLinkBypassConfirmedArray = $bypassConfirmed

        PrivateLinkProxyBypassArray     = $proxyBypassUrls

    }

} catch {

    $_ | Write-InsightLog -Level 'Exception'

    $insightRule.ScriptStackTrace = Get-FormattedException -Exception $_.Exception

    $insightRule.Status = [InsightStatus]::UNKNOWN

}

<# END INSIGHT RULE LOGIC #>

# if the status is FAILURE or WARNING, set the failure code and remediation message

if ($insightRule.Status -eq [InsightStatus]::FAILURE -or $insightRule.Status -eq [InsightStatus]::WARNING) {

    $insightRule.ErrorCode   = $localizedData.Insight.ErrorCode

    $insightRule.Remediation = $localizedData.Insight.Remediation

}

$insightRule.Duration = New-TimeSpan -Start $insightRule.OccurrenceTimeUTC -End $([System.DateTime]::UtcNow)

Write-InsightEvent -Insight $insightRule

return $insightRule

# SIG # Begin signature block

# MIInSQYJKoZIhvcNAQcCoIInOjCCJzYCAQExDzANBglghkgBZQMEAgEFADB5Bgor

# BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG

# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCDTOt3CvTTMbJIF

# IWimI6gOTACpiUeKcggE0ZL3vRCJPaCCDLowggX1MIID3aADAgECAhMzAAACHU0Z

# yE7XD1dIAAAAAAIdMA0GCSqGSIb3DQEBCwUAMFcxCzAJBgNVBAYTAlVTMR4wHAYD

# VQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBD

# b2RlIFNpZ25pbmcgUENBIDIwMjQwHhcNMjYwNDE2MTg1OTQzWhcNMjcwNDE1MTg1

# OTQzWjB0MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UE

# BxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMR4wHAYD

# VQQDExVNaWNyb3NvZnQgQ29ycG9yYXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IB

# DwAwggEKAoIBAQDQvewXxx9gZZFC6Ys1WBay8BJ8kGA4JQnH5CMafqOASlTpK9H8

# o5ZXTXt0caVQTNMUPt445wXYD+dFtaKWTwDn1I52oUSrC9vJin1Gsqt+zyKJL5Dg

# 3eQXbQNR61DmMy20GLTIO3SFed9Rfi/ophgCLGFLDR3r0KvHjwMb/jYWS0celV/4

# Lz27LfAekm8v9E5IXaeiXbAUYZKK090n4CVl3JBtbN+9DtI9SNu/yjvozW52/u7R

# X/Ttpa/KDlpuokZ+Zcbvmtd9ur9gFLvZzh41o9MsE/clQtdaFWGvuo6Jua/ntpgk

# ey3E5/vBFe+MJPG6phdnuo6r57ZudCudiI1bAgMBAAGjggGbMIIBlzAOBgNVHQ8B

# Af8EBAMCB4AwHwYDVR0lBBgwFgYKKwYBBAGCN0wIAQYIKwYBBQUHAwMwHQYDVR0O

# BBYEFH6QuMwqcPG0hQlQ6c5jCtTTLrVeMEUGA1UdEQQ+MDykOjA4MR4wHAYDVQQL

# ExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xFjAUBgNVBAUTDTIzMDAxMis1MDc1NTkw

# HwYDVR0jBBgwFoAUf1k/VCHarU/vBeXmo9ctBpQSCDEwYAYDVR0fBFkwVzBVoFOg

# UYZPaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9jcmwvTWljcm9zb2Z0

# JTIwQ29kZSUyMFNpZ25pbmclMjBQQ0ElMjAyMDI0LmNybDBtBggrBgEFBQcBAQRh

# MF8wXQYIKwYBBQUHMAKGUWh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMv

# Y2VydHMvTWljcm9zb2Z0JTIwQ29kZSUyMFNpZ25pbmclMjBQQ0ElMjAyMDI0LmNy

# dDAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEBCwUAA4ICAQBKTbYOjzwTG/DXGaz9

# s6+fQeaTtDcFmMY+5UyVFCyj7Pv+5i37qfX8lSL/tBIfYQfWsMuBQlfZurJD6r4H

# VJ2CeH+1fgiq8dcHdVKoZ3Sa2qXoX3cq9iS8cVb06B7+5/XJ7I0OxHH9fDsvJ3T3

# w5V/ZtAIFmLrl+P0CtG+92uzRsn0nTbdFjOkLMLWPLAU3THohKRlSEMgFJpPkm5n

# 5UAZ35xX6FWCrDLsSKb555bTifwa8mJBwdlof0bmfYidH+dxZ1FdDxvLnNl9zeKs

# A4kejaaIqqIPguhwAti5Ql7BlTNoJNwxCvBmqW2MQLnCkYN/VVUsR3V2x/rcTNzo

# Bf/Z/SpROvdaA2ZOOd1uioXJt3tdLQ7vHpqpib0KfWr/FWXW10q38VxfCnRQBqzb

# SuztR7nEMuzX7Ck+B/XaPDXd1qh72+QYyB0Z2VzWmO9zsnb9Uq/dwu8LGeQqnyu6

# 7SDGACvnXii2fb9+US492VTnXSnFKyqwgzUyFMtZK1/sHYTv6bG4TtQUygQxTN+Z

# V+aJIlKO2MqZ7bKrAnOzS9m6NgoTdWOq11bTOZwKlIEV/EhV9SWkDmdpR/hPPT2v

# 6TEj4F8PT/zHjRezIU5c/DGlt/VhY/pK0XkJtEyMmmS1BMtjU/rqBZVMIm3dnxQs

# /TBByr+Cf8Z1r7aifQVQ+WSqzjCCBr0wggSloAMCAQICEzMAAAA5O7Y3Gb8GHWcA

# AAAAADkwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpX

# YXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQg

# Q29ycG9yYXRpb24xMjAwBgNVBAMTKU1pY3Jvc29mdCBSb290IENlcnRpZmljYXRl

# IEF1dGhvcml0eSAyMDExMB4XDTI0MDgwODIwNTQxOFoXDTM2MDMyMjIyMTMwNFow

# VzELMAkGA1UEBhMCVVMxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEo

# MCYGA1UEAxMfTWljcm9zb2Z0IENvZGUgU2lnbmluZyBQQ0EgMjAyNDCCAiIwDQYJ

# KoZIhvcNAQEBBQADggIPADCCAgoCggIBANgBnB7jOMeqlRYHNa265v4IY9fH8TKh

# emHfPINe1gpLaV3dhg324WwH06LcHbpnsBukCDNitryo0dtS/EW6I/yEL/bLSY8h

# KpbfQuWusBPr9qazYcDxCW/qnjb5JsI1s8bNOg3bVATvQVL4tcf03aTycsz8QeCd

# M0l/yHRObJ9QqazM1r6VPEOJ7LL+uEEb73w6QCuhs89a1uv1zerOYMnsneRRwCbp

# yW11IcggU0cRKDDq1pjVJzIbIF6+oiXXbReOsgeI8zu1FyQfK0fVkaya8SmVHQ/t

# Of23mZ4W9k0Ri22QW9p3UgSC5OUDktKxxcCmGL6tXLfOGSWHIIV4YrTJTT6PNty5

# REojHJuZHArkF9VnHTERWoTjAzfI3kP+5b4alUdhgAZ7ttOu1bVnXfHaqPYl2rPs

# 20ji03LOVWsh/radgE17es5hL+t6lV0eVHrVhsssROWJuz2MXMCt7iw7lFPG9LXK

# Gjsmonn2gotGdHIuEg5JnJMJVmixd5LRlkmgYRZKzhxSCwyoGIq0PhaA7Y+VPct5

# pCHkijcIIDm0nlkK+0KyepolcqGm0T/GYQRMhHJlGOOmVQop36wUVUYklUy++vDW

# eEgEo4s7hxN6mIbf2MSIQ/iIfMZgJxC69oukMUXCrOC3SkE/xIkgpfl22MM1itkZ

# 35nNXkMolU1lAgMBAAGjggFOMIIBSjAOBgNVHQ8BAf8EBAMCAYYwEAYJKwYBBAGC

# NxUBBAMCAQAwHQYDVR0OBBYEFH9ZP1Qh2q1P7wXl5qPXLQaUEggxMBkGCSsGAQQB

# gjcUAgQMHgoAUwB1AGIAQwBBMA8GA1UdEwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAU

# ci06AjGQQ7kUBU7h6qfHMdEjiTQwWgYDVR0fBFMwUTBPoE2gS4ZJaHR0cDovL2Ny

# bC5taWNyb3NvZnQuY29tL3BraS9jcmwvcHJvZHVjdHMvTWljUm9vQ2VyQXV0MjAx

# MV8yMDExXzAzXzIyLmNybDBeBggrBgEFBQcBAQRSMFAwTgYIKwYBBQUHMAKGQmh0

# dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2kvY2VydHMvTWljUm9vQ2VyQXV0MjAx

# MV8yMDExXzAzXzIyLmNydDANBgkqhkiG9w0BAQwFAAOCAgEAFJQfOChP7onn6fLI

# MKrSlN1WYKwDFgAddymOUO3FrM8d7B/W/iQ6DxXsDn7D5W4wMwYeLystcEqfkjz4

# NURRgazyMu5yRzQh4LqjA4tStTcJh1opExo7nn5PuPBYnbu0+THSuVHTe0VTTPVh

# ily/piFrDo3axQ9P4C+Ol5yet+2gTfekICS5xS+cYfSIvgn0JksVBVMYVI5QFu/q

# hnLhsEFEUzG8fvv0hjgkO+lkpV9ty6GkN4vdnd7ya6Q6aR9y34aiM1qmxaxBi6OU

# nyNl6fkuun/diTFnYDLTppOkr/mg5WSfCiDVMNCxtj4wPKC5OmHm1DQIt/MNokbb

# H3UGsFP1QbzsLocuSqLCvH09Io3fDPTmscR9Y75G4qX7RTX8AdBPo0I6OEojf39z

# uFZt0qOHm65YWQE69cZM2ueE1MB05dNNgHK9gTE7zKvK/fg8B2qjW88MT/WF5V5u

# vZGtqa9FSL2RazArA+rDPuf6JGYz4HpgMZHB4S6szWSKYBv0VisCzfxgeU+dquXW

# 9bd0auYlOB58DPcOYKdc3Se94g+xL4pcEhbB54JOgAkwYTu/9dLeH2pDqeJZAABV

# DWRQCaXfO5LgyKwKCLYXpigrZYCjUSBcr+Ve8PFWMhVTQl0v4q8J/AUmQN5W4n10

# 1cY2L4A7GTQG1h32HHAvfQESWP0xghnlMIIZ4QIBATBuMFcxCzAJBgNVBAYTAlVT

# MR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jv

# c29mdCBDb2RlIFNpZ25pbmcgUENBIDIwMjQCEzMAAAIdTRnITtcPV0gAAAAAAh0w

# DQYJYIZIAWUDBAIBBQCgga4wGQYJKoZIhvcNAQkDMQwGCisGAQQBgjcCAQQwHAYK

# KwYBBAGCNwIBCzEOMAwGCisGAQQBgjcCARUwLwYJKoZIhvcNAQkEMSIEIDtUIVkc

# SC0k6r6ulOAcuZMCmaKZWSzQZT8RKfW+saRCMEIGCisGAQQBgjcCAQwxNDAyoBSA

# EgBNAGkAYwByAG8AcwBvAGYAdKEagBhodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20w

# DQYJKoZIhvcNAQEBBQAEggEAlXyC1jt4GhhNzWpbWjnPpvU2Ci0J0pn44DsH1gPc

# WAtgGg+1wpwiUBj0buv8hOvfiCY9F6tXGu5f7UFbLxFt/mQyJP6eZd8KxNG2SPtK

# PW611oNI0nqcZbQqAsqjvn5ms6i3AqOn6MA7pzmcce57rbD+iyL2hxcHVFekTv/7

# XT/xWQSgX79Xeq32ROyW+11jKo9y7zl8CElaqtHDbD+AIFMi8pagS3SUoGNmZ6/Z

# MJLJO6c0iHaH91ITZxOOOSQyyDOjfjIl+R4XM4F+q1LJ1x63i3qZ0pOsEF05lOvY

# haVM4Jr7mug4lPzSVy9cBqpbXZq6lsuw0WXg1hpKsjDQyaGCF5cwgheTBgorBgEE

# AYI3AwMBMYIXgzCCF38GCSqGSIb3DQEHAqCCF3AwghdsAgEDMQ8wDQYJYIZIAWUD

# BAIBBQAwggFSBgsqhkiG9w0BCRABBKCCAUEEggE9MIIBOQIBAQYKKwYBBAGEWQoD

# ATAxMA0GCWCGSAFlAwQCAQUABCAbMDjyNePBMkQCaYjkJ3fvwCOmKFkXBxurE98t

# V6CDhQIGajG4/RKJGBMyMDI2MDcxNjIyNTMwMS4zMTNaMASAAgH0oIHRpIHOMIHL

# MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVk

# bW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSUwIwYDVQQLExxN

# aWNyb3NvZnQgQW1lcmljYSBPcGVyYXRpb25zMScwJQYDVQQLEx5uU2hpZWxkIFRT

# UyBFU046OTYwMC0wNUUwLUQ5NDcxJTAjBgNVBAMTHE1pY3Jvc29mdCBUaW1lLVN0

# YW1wIFNlcnZpY2WgghHtMIIHIDCCBQigAwIBAgITMwAAAiY1tD5nQ5P2HwABAAAC

# JjANBgkqhkiG9w0BAQsFADB8MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGlu

# Z3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBv

# cmF0aW9uMSYwJAYDVQQDEx1NaWNyb3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAxMDAe

# Fw0yNjAyMTkxOTQwMDJaFw0yNzA1MTcxOTQwMDJaMIHLMQswCQYDVQQGEwJVUzET

# MBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMV

# TWljcm9zb2Z0IENvcnBvcmF0aW9uMSUwIwYDVQQLExxNaWNyb3NvZnQgQW1lcmlj

# YSBPcGVyYXRpb25zMScwJQYDVQQLEx5uU2hpZWxkIFRTUyBFU046OTYwMC0wNUUw

# LUQ5NDcxJTAjBgNVBAMTHE1pY3Jvc29mdCBUaW1lLVN0YW1wIFNlcnZpY2UwggIi

# MA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC//w+ZZIL5RFFpVI8D3ZyuNu8I

# zcAEOD30OLYjh337rXjcrIlOSzpJc4ZeUxEyli6x6F6zm4NR8dbPb9diDp/hOUzH

# WGxiA1Z3RXKBb/4F/ojyvN43SEGWqSfVc3I3BlsYT35ecVAJ9kVf90YOv29tFjJB

# BZkYvrT/DwwyRLscOyP4p+9/lyJjD+ULs3YXBhVrfZ+MbQB+BYKLqRvBKbj/wR9a

# kNrMxQINoGaD5jZO/N/nSsmG2P1zv/cv4gSoMBnWeQIBkjd2I5w1DeXupp2vSiNm

# R5sA2ZkBK3yiQWaJvRxODlkfiyHk9Mkk/TrYTjmjPCbhe+uqhHNRy8UlbOvWsCq0

# tRtUykHv39DgqAfJNrE8OSt835rBzDprrcAhwmgfhoVi4AKeqwikY0nUa48K0Qy8

# 0XT4fiEA3ExEZNaRFo9Nq/GwbfgqKqGmc9xhKuRFcjtua4KHZvnAvpWgEFSOCkov

# Xs/BcLnkEHM9xZ8iUag5CyhNqXYYE/z0pcXdYaNIkQ68EWmuvLm7g9oofV2vOm5G

# VNoghnkWG6nGPo/JwEgmA9oSS0EfvFRMWPA/gpSvF3shArKHnaEpVSSi3DNbyiuY

# iEs9Ko0IkZc8xKFeQRaqGRxrB+2r/7B3X81Tps99KhFwg+wD87od22F2MUg1x7tw

# t3gaVnFk0IZIwUPCGwIDAQABo4IBSTCCAUUwHQYDVR0OBBYEFF3hn9fYJN2Y/Z9L

# VbBPIxAzXHsQMB8GA1UdIwQYMBaAFJ+nFV0AXmJdg/Tl0mWnG1M1GelyMF8GA1Ud

# HwRYMFYwVKBSoFCGTmh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMvY3Js

# L01pY3Jvc29mdCUyMFRpbWUtU3RhbXAlMjBQQ0ElMjAyMDEwKDEpLmNybDBsBggr

# BgEFBQcBAQRgMF4wXAYIKwYBBQUHMAKGUGh0dHA6Ly93d3cubWljcm9zb2Z0LmNv

# bS9wa2lvcHMvY2VydHMvTWljcm9zb2Z0JTIwVGltZS1TdGFtcCUyMFBDQSUyMDIw

# MTAoMSkuY3J0MAwGA1UdEwEB/wQCMAAwFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwgw

# DgYDVR0PAQH/BAQDAgeAMA0GCSqGSIb3DQEBCwUAA4ICAQA2Ux0tr9sYCjsq0FRy

# iVpx15OurNXv6Qk7iX+ArVPlz3w4tqjcTNm1dt3tTua2wJMpJhPH8n7UXhmT98d5

# Du44Ll4adnse4SQfVg3QL6aRkXHnJUn8y9iftB/Py22n9xnwPFfj3QlDOSgLuHle

# u97U0iH2ZaluYabWXJihdiYpK8cPHFlqZOAiot0+GD8dP+RMuvpxt/F2LmYelpoZ

# wriiFOUmlxEUV7xJHyZZlDquskeyuq01DTv91N4qM8cfPPhl/2pc4HeMf/nd2Hou

# ifJbDQFNd4WPhLzn0Sy3u1Zh3+S3tjQdqN+dyw60RaV+RXCoOLgFZ3MAg/GoDl+f

# vb5hy/1a71ctX8wEad1Pf6def2pqfl3wFc++hkF8DXXTZofJN4YVaN3InwbAGQDD

# kNK4lqecCixxmSKwidPynGeE5OtvNoK1pkLsm/i8F1RjGczZ/kSF2VDkqG866iQ+

# jVbGOQ6Du3eyyFcFKZoDJ4B5mEAS9aT2SKqllLeybOboH6r67siR5B/2Hnu7+KYu

# YZy0BEadtA6ngG4cnSR9JsrkhhsKmb11ujqwgJyNx92MsoGGwNgN1aI0QID8CsjC

# FwpfmMzlA44xHKYv3hmjxeqBS4uU5rQeiAnVgpJeaVGKm/lzPDtnppGV+7XhRp5b

# 1ZxT/Z7Xxc+I7H7/jCtQDZoaZTCCB3EwggVZoAMCAQICEzMAAAAVxedrngKbSZkA

# AAAAABUwDQYJKoZIhvcNAQELBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpX

# YXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQg

# Q29ycG9yYXRpb24xMjAwBgNVBAMTKU1pY3Jvc29mdCBSb290IENlcnRpZmljYXRl

# IEF1dGhvcml0eSAyMDEwMB4XDTIxMDkzMDE4MjIyNVoXDTMwMDkzMDE4MzIyNVow

# fDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1Jl

# ZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEmMCQGA1UEAxMd

# TWljcm9zb2Z0IFRpbWUtU3RhbXAgUENBIDIwMTAwggIiMA0GCSqGSIb3DQEBAQUA

# A4ICDwAwggIKAoICAQDk4aZM57RyIQt5osvXJHm9DtWC0/3unAcH0qlsTnXIyjVX

# 9gF/bErg4r25PhdgM/9cT8dm95VTcVrifkpa/rg2Z4VGIwy1jRPPdzLAEBjoYH1q

# UoNEt6aORmsHFPPFdvWGUNzBRMhxXFExN6AKOG6N7dcP2CZTfDlhAnrEqv1yaa8d

# q6z2Nr41JmTamDu6GnszrYBbfowQHJ1S/rboYiXcag/PXfT+jlPP1uyFVk3v3byN

# pOORj7I5LFGc6XBpDco2LXCOMcg1KL3jtIckw+DJj361VI/c+gVVmG1oO5pGve2k

# rnopN6zL64NF50ZuyjLVwIYwXE8s4mKyzbnijYjklqwBSru+cakXW2dg3viSkR4d

# Pf0gz3N9QZpGdc3EXzTdEonW/aUgfX782Z5F37ZyL9t9X4C626p+Nuw2TPYrbqgS

# Uei/BQOj0XOmTTd0lBw0gg/wEPK3Rxjtp+iZfD9M269ewvPV2HM9Q07BMzlMjgK8

# QmguEOqEUUbi0b1qGFphAXPKZ6Je1yh2AuIzGHLXpyDwwvoSCtdjbwzJNmSLW6Cm

# gyFdXzB0kZSU2LlQ+QuJYfM2BjUYhEfb3BvR/bLUHMVr9lxSUV0S2yW6r1AFemzF

# ER1y7435UsSFF5PAPBXbGjfHCBUYP3irRbb1Hode2o+eFnJpxq57t7c+auIurQID

# AQABo4IB3TCCAdkwEgYJKwYBBAGCNxUBBAUCAwEAATAjBgkrBgEEAYI3FQIEFgQU

# KqdS/mTEmr6CkTxGNSnPEP8vBO4wHQYDVR0OBBYEFJ+nFV0AXmJdg/Tl0mWnG1M1

# GelyMFwGA1UdIARVMFMwUQYMKwYBBAGCN0yDfQEBMEEwPwYIKwYBBQUHAgEWM2h0

# dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMvRG9jcy9SZXBvc2l0b3J5Lmh0

# bTATBgNVHSUEDDAKBggrBgEFBQcDCDAZBgkrBgEEAYI3FAIEDB4KAFMAdQBiAEMA

# QTALBgNVHQ8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAfBgNVHSMEGDAWgBTV9lbL

# j+iiXGJo0T2UkFvXzpoYxDBWBgNVHR8ETzBNMEugSaBHhkVodHRwOi8vY3JsLm1p

# Y3Jvc29mdC5jb20vcGtpL2NybC9wcm9kdWN0cy9NaWNSb29DZXJBdXRfMjAxMC0w

# Ni0yMy5jcmwwWgYIKwYBBQUHAQEETjBMMEoGCCsGAQUFBzAChj5odHRwOi8vd3d3

# Lm1pY3Jvc29mdC5jb20vcGtpL2NlcnRzL01pY1Jvb0NlckF1dF8yMDEwLTA2LTIz

# LmNydDANBgkqhkiG9w0BAQsFAAOCAgEAnVV9/Cqt4SwfZwExJFvhnnJL/Klv6lwU

# tj5OR2R4sQaTlz0xM7U518JxNj/aZGx80HU5bbsPMeTCj/ts0aGUGCLu6WZnOlNN

# 3Zi6th542DYunKmCVgADsAW+iehp4LoJ7nvfam++Kctu2D9IdQHZGN5tggz1bSNU

# 5HhTdSRXud2f8449xvNo32X2pFaq95W2KFUn0CS9QKC/GbYSEhFdPSfgQJY4rPf5

# KYnDvBewVIVCs/wMnosZiefwC2qBwoEZQhlSdYo2wh3DYXMuLGt7bj8sCXgU6ZGy

# qVvfSaN0DLzskYDSPeZKPmY7T7uG+jIa2Zb0j/aRAfbOxnT99kxybxCrdTDFNLB6

# 2FD+CljdQDzHVG2dY3RILLFORy3BFARxv2T5JL5zbcqOCb2zAVdJVGTZc9d/HltE

# AY5aGZFrDZ+kKNxnGSgkujhLmm77IVRrakURR6nxt67I6IleT53S0Ex2tVdUCbFp

# AUR+fKFhbHP+CrvsQWY9af3LwUFJfn6Tvsv4O+S3Fb+0zj6lMVGEvL8CwYKiexcd

# FYmNcP7ntdAoGokLjzbaukz5m/8K6TT4JDVnK+ANuOaMmdbhIurwJ0I9JZTmdHRb

# atGePu1+oDEzfbzL6Xu/OHBE0ZDxyKs6ijoIYn/ZcGNTTY3ugm2lBRDBcQZqELQd

# VTNYs6FwZvKhggNQMIICOAIBATCB+aGB0aSBzjCByzELMAkGA1UEBhMCVVMxEzAR

# BgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1p

# Y3Jvc29mdCBDb3Jwb3JhdGlvbjElMCMGA1UECxMcTWljcm9zb2Z0IEFtZXJpY2Eg

# T3BlcmF0aW9uczEnMCUGA1UECxMeblNoaWVsZCBUU1MgRVNOOjk2MDAtMDVFMC1E

# OTQ3MSUwIwYDVQQDExxNaWNyb3NvZnQgVGltZS1TdGFtcCBTZXJ2aWNloiMKAQEw

# BwYFKw4DAhoDFQCi/fMxFtkqr7XMXdsRyWU0lSKHZ6CBgzCBgKR+MHwxCzAJBgNV

# BAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4w

# HAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMTHU1pY3Jvc29m

# dCBUaW1lLVN0YW1wIFBDQSAyMDEwMA0GCSqGSIb3DQEBCwUAAgUA7gPASDAiGA8y

# MDI2MDcxNjIwNDA0MFoYDzIwMjYwNzE3MjA0MDQwWjB3MD0GCisGAQQBhFkKBAEx

# LzAtMAoCBQDuA8BIAgEAMAoCAQACAiDWAgH/MAcCAQACAhIWMAoCBQDuBRHIAgEA

# MDYGCisGAQQBhFkKBAIxKDAmMAwGCisGAQQBhFkKAwKgCjAIAgEAAgMHoSChCjAI

# AgEAAgMBhqAwDQYJKoZIhvcNAQELBQADggEBAKDNE2ayvZWpQPD1VwloQk+F+v+b

# KNqSgSvA0aKAmIQRz8iZf1kccW/4dDxc+bxtbfEitTf/A/dmkdq8veSdO8o2nEu3

# DAV0b0K2PZULGdUg+nwEuN+fcl0+t0T3Kz+1J5oLAs0wbADEqoyFM9fzATP9Hf6+

# ohbYavw6/MrHTid8ydbrDI7bOEerasw46nWc6Zkztu7yiMKWH8fNiivht7bmtX5I

# vjXMvCNZ8cZzl7AN2skmZ6HubT5EBDTRiANqO3a+xVnd3vQ+qAejCs8jDwQ13tGz

# h2HCUPhdejCiLDt7561xqzxOcb1+Lzt2IVK97JbnfLzhJ1GY/n1IMU39U0gxggQN

# MIIECQIBATCBkzB8MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQ

# MA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9u

# MSYwJAYDVQQDEx1NaWNyb3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAxMAITMwAAAiY1

# tD5nQ5P2HwABAAACJjANBglghkgBZQMEAgEFAKCCAUowGgYJKoZIhvcNAQkDMQ0G

# CyqGSIb3DQEJEAEEMC8GCSqGSIb3DQEJBDEiBCDFuZ2ic8R3YXH+eZFnGND3C31f

# GXIQ19XDR2unrJ9bHzCB+gYLKoZIhvcNAQkQAi8xgeowgecwgeQwgb0EIMwyXGFn

# TNsZRBrs6GN/BbV0okaNP3VBYqLFjUsFnbgqMIGYMIGApH4wfDELMAkGA1UEBhMC

# VVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNV

# BAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRp

# bWUtU3RhbXAgUENBIDIwMTACEzMAAAImNbQ+Z0OT9h8AAQAAAiYwIgQgz/91ZfkL

# g6H8Qp6htuDp65xrJjSTXKmTLfJyIodk9dwwDQYJKoZIhvcNAQELBQAEggIAbMu2

# jHaVzndGffft9VE0b+8NKwdIP2CseAZz/NsHjskw+KxBNl+DkvKo20cS28seXb0Z

# +53UbRqD50h3t7/zC81BC6sQlKka06mJlaNN4gnKrSTGrx9E+CZrmPrgqSIc+teR

# 7wO5k0uc1fLuZlnNIJeTr6M11LBtyl7e+TmNII5MwRrg/uctE4/r+VMf0L3LByt+

# I/iVBFIoBFp/XoYpmZkZ+n9nsaMH2WvOzSqw2NcgkFtKz83U9ljG2kJaK7yDZk5I

# Ial9Mtcv4vYadYWjnuZmS8CXrlq5lp/va0167dyXtY1QTgB8uEJulb5aVvlIMCXi

# SGKn4e1YBOZ++OPvH0Kaixvl4xYpz09IAyXVHUlpxaZshejXzyAcPOTWhvwWm5J3

# VG9Ha37SaMzCZILl7ToGszrqkNgQRhWsH6NDkn+pZED5m/sJKsR2mP5QVQridMYw

# K5+X7Ynyea9nHlhVRB3CLYlsNE8MUoxyHLlqIhXy1305UtmiLH+0+QEfsuZM8Qev

# k5vA+UJN6zclwOK8cPoYU5CEc4PEO+/xR/Xv8P9rdRsgsw8RVI20EF1SIKyiH6YM

# X3j0Pkim20yjI4VyvFbc31RXnEqVW81VXCOlp3uYe2IGfRUh/JkzVtZShhY+w+Lz

# Mxg8lFzme3RszKJBfNEpX9izS29+zxfQZXv2Z9k=

# SIG # End signature block