packages/AzStackHci.DiagnosticSettings.0.6.9/Private/AzStackHci.ParallelLayer7.Helpers.ps1
|
# ============================================================================= # Strict Mode v1 (PS 5.1 safe) - surfaces reads of uninitialised variables at runtime. Set-StrictMode -Version 1.0 # AzStackHci.ParallelLayer7.Helpers.ps1 # ============================================================================= # Private helpers for the Layer-7 endpoint sweep in Test-AzureLocalConnectivity. # # Two helpers live here: # 1. Invoke-Layer7EndpointTest - tests ONE endpoint (mutates the $UrlObject in place, # may append CRL/OCSP dependency rows to $script:Results # via Add-CrlDependencyRowToResults). This is the # extracted body of the main per-URL ForEach loop and # is byte-identical to the v0.6.6 inline behaviour. # 2. Invoke-Layer7BucketWorker - runs inside a Start-Job worker process; loops over # a bucket of $UrlObject rows calling # Invoke-Layer7EndpointTest, snapshots the module-scope # classification state ($script:SSLInspectedURLs, # $script:CRLOfflineURLs, $script:PrivateLink* arrays, # any newly-appended $script:Results rows) and returns # a hashtable for the parent process to merge. # # The parallel fan-out is opt-in via the new -Parallelism parameter on # Test-AzureLocalConnectivity (default 1, sequential, byte-identical to v0.6.6). # ============================================================================= function Invoke-Layer7EndpointTest { <# .SYNOPSIS Runs DNS + TCP + Layer-7 connectivity tests for a single endpoint row, mutating the row in place. Body extracted verbatim from the main ForEach loop in Test-AzureLocalConnectivity to enable parallel fan-out via Start-Job. .DESCRIPTION Sequential default behaviour: identical to the pre-extraction inline ForEach body. Mutates $UrlObject fields (TCPStatus, Layer7Status, Layer7Response, certificate columns, IPAddress, Note). May call Add-CrlDependencyRowToResults which appends new rows to $script:Results. May also append to module-scope classification state ($script:SSLInspectedURLs, $script:CRLOfflineURLs, $script:PrivateLink* arrays, $script:SSLInspectionDetected) via the call into Test-Layer7Connectivity -> Get-Layer7CertificateDetails / Get-DnsRecord. .PARAMETER UrlObject The PSCustomObject row from $script:Results to test. Mutated in place. .PARAMETER SkipUrls The list of URLs that the parent loop has decided to skip (the manually-curated "skip" list — pre-2026 hardcoded entries like wustat.windows.com). .PARAMETER ArcGatewayDeployment Whether -ArcGatewayDeployment was specified on the public Test-AzureLocalConnectivity. .PARAMETER NTPTimeServer Optional user-supplied NTP server URL (replaces time.windows.com for that one row). .PARAMETER IncludeTCPConnectivityTests Whether -IncludeTCPConnectivityTests was specified on the public function. .PARAMETER RequestMethod 'Get' / 'Head' / 'Auto' — plumbed through to Test-Layer7Connectivity. #> [CmdletBinding()] param( [Parameter(Mandatory)] [object]$UrlObject, [Parameter(Mandatory)] [array]$SkipUrls, [Parameter(Mandatory=$false)] [bool]$ArcGatewayDeployment = $false, [Parameter(Mandatory=$false)] [string]$NTPTimeServer, [Parameter(Mandatory=$false)] [bool]$IncludeTCPConnectivityTests = $false, [Parameter(Mandatory=$false)] [ValidateSet('Get','Head','Auto')] [string]$RequestMethod = 'Auto' ) # Local alias preserves the old loop variable name so the extracted body remains # diff-readable against the v0.6.6 ForEach body it came from. $urlObj = $UrlObject # Per-iteration DNSCheck reset (matches original "Remove-Variable DNSCheck" inside the loop). $DNSCheck = $null Write-Debug "Arc Gateway boolean for url '$($urlObj.url)' from source $($urlObj.Source) = $($urlObj.ArcGateway)" # If the ArcGatewayDeployment switch is used, only test URLs that do not support Arc Gateway if ($ArcGatewayDeployment) { # Skip URLs with ArcGateway -eq $True if ($urlObj.ArcGateway) { # Skip URLs that support Arc Gateway Write-HostAzS "Skipped URL: '$($urlObj.URL)' as supported by Arc Gateway" -ForegroundColor Yellow Set-UrlObjectSkipFields -UrlObject $urlObj -TCPStatus "Skipped" -Layer7Status "Skipped" $urlObj.Note = "Skipped, URL is supported by Arc Gateway - $($urlObj.Note)" Write-HostAzS "" return } } # Process URLs that require special handling if (($urlObj.URL -like ("*.gw.arc.azure.com") -or $urlObj.URL -like ("*.gw.arc.azure.net"))) { if ($ArcGatewayDeployment) { # Replace the URL with the user-defined Arc Gateway URL, if specified $urlObj.URL = (Get-DomainFromURL -url $script:UpdatedArcGatewayURL).Domain # Run DNS + TCP + Layer 7 connectivity tests using shared helper # Forward -RequestMethod down through Invoke-EndpointConnectivityTest into Test-Layer7Connectivity (parity with the non-wildcard branch). $testResult = Invoke-EndpointConnectivityTest -Url $urlObj.URL -Port $urlObj.Port -IncludeTCPConnectivityTests:$IncludeTCPConnectivityTests -RequestMethod $RequestMethod Copy-ConnectivityResultsToUrlObject -UrlObject $urlObj -TestResult $testResult } else { # Not using Arc Gateway, skip the URL Write-HostAzS "Skipping URL, (not using Arc Gateway): $($urlObj.URL)" -ForegroundColor Green Set-UrlObjectSkipFields -UrlObject $urlObj -TCPStatus "Skipped" -Layer7Status "Skipped" $urlObj.Note = "Skipped, not using Arc Gateway, as '-ArcGatewayDeployment' switch not present - $($urlObj.Note)" } } elseif ($urlObj.URL -eq "time.windows.com") { # Replace the URL with the user-defined NTP Time Server, if specified if ([string]::IsNullOrWhiteSpace($NTPTimeServer)) { # Use default NTP Time Server Write-HostAzS "Using default NTP Time Server: 'time.windows.com' for NTP connectivity test on UDP port 123, as the '`$NTPTimeServer' parameter was not specified" -ForegroundColor Yellow $DNSCheck = Get-DnsRecord -url (Get-DomainFromURL -url $urlObj.URL).Domain } else { Write-HostAzS "Replacing default NTP Time Server 'time.windows.com' with user-defined NTP server: '$NTPTimeServer'" -ForegroundColor Green [string]$urlObj.URL = (Get-DomainFromURL -url $NTPTimeServer).Domain $urlObj.Source = "User-defined NTP server" # //// Ignore RFC1918 check during DNS check for user-defined NTP server //// $DNSCheck = Get-DnsRecord -url (Get-DomainFromURL -url $NTPTimeServer).Domain -SkipRfc1918Check } # If using a Proxy, DNS resolution from the local host may not be required if (($DNSCheck.DNSExists) -or ($script:Proxy.Enabled)) { $StopWatch = [Diagnostics.Stopwatch]::StartNew() $urlObj.TCPStatus, $urlObj.IPAddress = Test-NTPConnectivity -ntpServer $urlObj.URL if ($urlObj.TCPStatus -eq "Success") { $urlObj.Layer7Status = "Success" } else { $urlObj.Layer7Status = "Failed" } if ([string]::IsNullOrWhiteSpace($urlObj.IPAddress)) { $urlObj.IPAddress = $DNSCheck.IpAddress } $urlObj.Layer7Response = "UDP port 123" $urlObj.Layer7ResponseTime = [math]::round($StopWatch.Elapsed.TotalMilliseconds/1000, 3) $StopWatch.Stop() # NTP does not use SSL certificates $urlObj.CertificateIssuer = "N/A" $urlObj.CertificateSubject = "N/A" $urlObj.CertificateThumbprint = "N/A" $urlObj.IntermediateCertificateIssuer = "N/A" $urlObj.IntermediateCertificateSubject = "N/A" $urlObj.IntermediateCertificateThumbprint = "N/A" $urlObj.RootCertificateIssuer = "N/A" $urlObj.RootCertificateSubject = "N/A" $urlObj.RootCertificateThumbprint = "N/A" } else { Set-UrlObjectSkipFields -UrlObject $urlObj -TCPStatus "Failed" -Layer7Status "Failed" -IPAddress $DNSCheck.IpAddress } # //// Skipped URLs //// } elseif ($SkipUrls.URL.Contains($urlObj.URL)) { Write-HostAzS "Skipped URL: $($urlObj.URL)" -ForegroundColor Green Set-UrlObjectSkipFields -UrlObject $urlObj -TCPStatus "Skipped" -Layer7Status "Skipped" $urlObj.Note = "Skipped URL - $($urlObj.Note)" # //// Wildcard URLs //// } elseif ($urlObj.IsWildcard) { Write-HostAzS "Wildcard URLs are processed later..." -ForegroundColor Yellow Set-UrlObjectSkipFields -UrlObject $urlObj -TCPStatus "Skipped" -Layer7Status "Skipped" $urlObj.Note = "$($urlObj.Note)" # //// Non-wildcard URLs //// } else { # Placeholder KeyVault URL: show Warning status instead of running tests against a URL that will always fail DNS if ($urlObj.URL -like "yourhcikeyvaultname.vault.*") { Write-HostAzS "WARNING: Default KeyVault endpoint '$($urlObj.URL)' is being used." -ForegroundColor Yellow Write-HostAzS "INFO: Specify your KeyVault endpoint using the '-KeyVaultURL' parameter to validate your actual KeyVault connectivity." -ForegroundColor Yellow Set-UrlObjectSkipFields -UrlObject $urlObj -TCPStatus "Failed" -Layer7Status "Failed" $urlObj.Note = "PARAMETER `"-KeyVaultURL https://<yourKeyVault>.vault.azure.net`" WAS NOT USED - THIS IS REQUIRED TO SPECIFY YOUR UNIQUE KEY VAULT NAME - Key vault for deployment secrets." # Sleep for 3 seconds to allow the user to read the warning, if present. Start-Sleep -Seconds 3 # NOTE: original 'Continue' here SKIPS the trailing Write-HostAzS "" — replicate by returning early. return } # Run DNS + TCP + Layer 7 connectivity tests using shared helper # Forward -RequestMethod down through Invoke-EndpointConnectivityTest into Test-Layer7Connectivity. $testResult = Invoke-EndpointConnectivityTest -Url $urlObj.URL -Port $urlObj.Port -IncludeTCPConnectivityTests:$IncludeTCPConnectivityTests -RequestMethod $RequestMethod Copy-ConnectivityResultsToUrlObject -UrlObject $urlObj -TestResult $testResult } # Add line return after each URL (matches the original loop trailing Write-HostAzS ""). Write-HostAzS "" } function Invoke-Layer7BucketWorker { <# .SYNOPSIS Worker scriptblock body — runs inside a Start-Job child process, loops over a bucket of endpoint rows calling Invoke-Layer7EndpointTest, and returns a snapshot of all module-scope classification state for the parent process to merge. .DESCRIPTION Each Start-Job worker is its own process, so $script:* variables are isolated. The worker imports the module (so Invoke-Layer7EndpointTest, Test-Layer7Connectivity, Get-DnsRecord, Add-CrlDependencyRowToResults etc. are all available), seeds the module-scope state from the parent's snapshot, runs the bucket sequentially, then returns a hashtable that the parent merges. Returned hashtable keys: - Rows : the mutated $UrlObject rows from this bucket (RowID-tagged) - NewCrlRows : any rows appended to $script:Results by Add-CrlDependencyRowToResults inside the bucket - RedirectedResults : URLs the worker discovered via HTTP 301/302 redirect responses ($script:RedirectedResults snapshot — Phase 4 of Test-AzureLocalConnectivity iterates the parent's copy of this list, so workers MUST plumb it back or redirected URLs are silently dropped from the output) - SSLInspectedURLs : list of URLs flagged for SSL Inspection - CRLOfflineURLs : list of URLs whose CRL/OCSP check was offline - SSLInspectionDetected : bool — true if any row in the bucket triggered SSL inspection - PrivateLinkDetected : bool — true if any URL in the bucket resolved to RFC1918 (the parent uses this scalar flag to decide whether to print the customer-facing 'PRIVATE LINK DETECTED' warning) - PrivateLinkDetectedArray : list of URLs flagged for Private Link - PrivateLinkCriticalArray : list of URLs flagged for Private Link (RFC1918, critical) - PrivateLinkProxyBypassArray: list of URLs flagged for Private Link (RFC1918, proxy bypass) - BucketIndex : the worker's bucket index (for deterministic merge order) - BucketWallClockSec : wall-clock duration of this worker's bucket Diagnostic console output produced during testing is interleaved across workers — that is the documented behaviour of the parallel mode. The transcript still captures every line; the JSON output is RowID-sorted so customer-facing output ordering is identical to sequential mode. .PARAMETER Bucket Array of $UrlObject rows for this worker to test (round-robin partition from parent). .PARAMETER ParameterBag Hashtable carrying SkipUrls / ArcGatewayDeployment / NTPTimeServer / IncludeTCPConnectivityTests / RequestMethod / Proxy / UpdatedArcGatewayURL. .PARAMETER BucketIndex Index of this bucket (0..N-1). #> [CmdletBinding()] param( [Parameter(Mandatory)] [array]$Bucket, [Parameter(Mandatory)] [hashtable]$ParameterBag, [Parameter(Mandatory=$false)] [int]$BucketIndex = 0 ) $bucketSw = [System.Diagnostics.Stopwatch]::StartNew() # A Start-Job worker imports a fresh module, so none of the parent's $script: # output state crosses the process boundary. Apply the explicitly forwarded # state before endpoint helpers can emit host, verbose, debug, or progress output. $script:SilentMode = $ParameterBag.ContainsKey('SilentMode') -and [bool]$ParameterBag.SilentMode $verboseRequested = $ParameterBag.ContainsKey('VerboseRequested') -and [bool]$ParameterBag.VerboseRequested $script:VerboseMode = (-not $script:SilentMode) -and $verboseRequested $script:VerbosePreference = if ($script:VerboseMode) { 'Continue' } else { 'SilentlyContinue' } $script:DebugPreference = 'SilentlyContinue' $VerbosePreference = $script:VerbosePreference $DebugPreference = $script:DebugPreference # Tag every Write-HostAzS line emitted from inside this worker with [bucket-N] # so the interleaved transcript is greppable per bucket. Cleared in the finally # so the parent process never inherits a stale prefix. $script:WorkerLogPrefix = "[bucket-$BucketIndex] " # Wrap the bucket body in try/finally so the [bucket-N] prefix is ALWAYS cleared # (and the stopwatch always stopped) even if a terminating error escapes the # per-row try/catch below. Body indentation is intentionally unchanged to keep # this diff minimal and reviewable. try { # Seed module-scope state from the parent's snapshot — Invoke-Layer7EndpointTest reads # $script:Proxy and $script:UpdatedArcGatewayURL. Constants.ps1's Initialize-ModuleState # has already created the empty ArrayLists / arrays for the classification state, so # we can rely on those being initialised but empty in this worker process. if ($ParameterBag.ContainsKey('Proxy')) { $script:Proxy = $ParameterBag.Proxy } if ($ParameterBag.ContainsKey('UpdatedArcGatewayURL')) { $script:UpdatedArcGatewayURL = $ParameterBag.UpdatedArcGatewayURL } # Snapshot the row count BEFORE running the bucket so we can isolate any new # CRL/OCSP rows that Add-CrlDependencyRowToResults appends during testing. # The worker's $script:Results starts as a (cloned) copy of the bucket so that # Add-CrlDependencyRowToResults's host-level dedupe still works correctly within # the bucket's scope. [System.Collections.ArrayList]$script:Results = @($Bucket) $initialRowCount = $script:Results.Count foreach ($row in $Bucket) { try { Invoke-Layer7EndpointTest ` -UrlObject $row ` -SkipUrls $ParameterBag.SkipUrls ` -ArcGatewayDeployment ([bool]$ParameterBag.ArcGatewayDeployment) ` -NTPTimeServer $ParameterBag.NTPTimeServer ` -IncludeTCPConnectivityTests ([bool]$ParameterBag.IncludeTCPConnectivityTests) ` -RequestMethod $ParameterBag.RequestMethod } catch { # Mark the row as Failed but never abort the bucket — bucket-level isolation matters. try { $row.Layer7Status = 'Failed' $row.Layer7Response = "Worker exception: $($_.Exception.Message)" } catch {} } } # Identify any new CRL/OCSP dependency rows the bucket appended during testing. $newCrlRows = @() if ($script:Results.Count -gt $initialRowCount) { $newCrlRows = @($script:Results | Select-Object -Skip $initialRowCount) } } finally { $bucketSw.Stop() # Clear the bucket prefix so a direct (non-Start-Job) caller doesn't leak it. # In the Start-Job process this is moot — the process is torn down — but # Pester tests that invoke Invoke-Layer7BucketWorker in-proc would otherwise # see subsequent Write-HostAzS calls still tagged. $script:WorkerLogPrefix = '' } return @{ Rows = @($Bucket) NewCrlRows = $newCrlRows RedirectedResults = @($script:RedirectedResults) SSLInspectedURLs = @($script:SSLInspectedURLs) CRLOfflineURLs = @($script:CRLOfflineURLs) SSLInspectionDetected = [bool]$script:SSLInspectionDetected PrivateLinkDetected = [bool]$script:PrivateLinkDetected PrivateLinkDetectedArray = @($script:PrivateLinkDetectedArray) PrivateLinkCriticalArray = @($script:PrivateLinkCriticalArray) PrivateLinkProxyBypassArray = @($script:PrivateLinkProxyBypassArray) BucketIndex = $BucketIndex BucketWallClockSec = [math]::Round($bucketSw.Elapsed.TotalSeconds, 3) } } function Merge-Layer7WorkerResult { <# .SYNOPSIS Merges one worker's returned hashtable into the parent module-scope state. .DESCRIPTION - Replaces parent rows by RowID with the worker's mutated copies. - Appends new CRL/OCSP dependency rows to $script:Results (idempotent: skips URLs already present at the parent level). - Unions the SSL-inspection / CRL-offline / Private-Link arrays. - ORs the SSLInspectionDetected flag. .PARAMETER WorkerResult The hashtable returned by Invoke-Layer7BucketWorker. #> [CmdletBinding()] param( [Parameter(Mandatory)] [hashtable]$WorkerResult ) # The worker mutated the original PSCustomObject references in $Bucket. Because # Start-Job serialises objects across the process boundary, the deserialised rows # returned in WorkerResult.Rows are NOT the same instances as the parent's # $script:Results entries. Merge by RowID match. foreach ($workerRow in $WorkerResult.Rows) { $match = $script:Results | Where-Object { $_.RowID -eq $workerRow.RowID } | Select-Object -First 1 if ($null -ne $match) { # Copy back every mutated field. This is intentionally explicit (not # ForEach-Object Get-Member) to avoid accidentally overwriting RowID/URL/Port etc. foreach ($field in @( 'TCPStatus','IPAddress','Layer7Status','Layer7Response','Layer7ResponseTime', 'CertificateIssuer','CertificateSubject','CertificateThumbprint', 'IntermediateCertificateIssuer','IntermediateCertificateSubject','IntermediateCertificateThumbprint', 'RootCertificateIssuer','RootCertificateSubject','RootCertificateThumbprint', 'Note','URL','Source' )) { if (($workerRow.PSObject.Properties.Name -contains $field) -and ($match.PSObject.Properties.Name -contains $field)) { $match.$field = $workerRow.$field } } } } # Append any new CRL/OCSP dependency rows the worker generated. When the same # dependency URL is discovered in another bucket the row is NOT re-added — instead # we extend the existing row's Source field so customer-facing output preserves # all parent-domain attributions. This mirrors the Tier-1 dedupe semantics inside # Add-CrlDependencyRowToResults (Private/AzStackHci.Connectivity.Helpers.ps1) for # the cross-bucket case, where each worker's local dedupe cannot see other buckets. foreach ($newRow in $WorkerResult.NewCrlRows) { # Defence-in-depth: skip any $null row (mirrors the RedirectedResults loop guard # below) so a malformed worker payload can never throw on $newRow.URL. if ($null -eq $newRow) { continue } $existing = $script:Results | Where-Object { ($_.URL -eq $newRow.URL) -and ($_.Port -eq $newRow.Port) } | Select-Object -First 1 if ($null -eq $existing) { $script:Results.Add($newRow) | Out-Null } elseif ($newRow.PSObject.Properties.Name -contains 'Source' -and -not [string]::IsNullOrWhiteSpace($newRow.Source)) { # Extract the parent-domain hint(s) from the worker's Source string and append # any not already present on the parent row's Source. The Source field uses # '; '-separated parent-domain tokens so a simple substring check is reliable. $existingSrc = if ([string]::IsNullOrWhiteSpace($existing.Source)) { '' } else { $existing.Source } foreach ($token in ($newRow.Source -split ';\s*')) { $t = $token.Trim() if ($t -and ($existingSrc -notmatch [regex]::Escape($t))) { $existing.Source = if ([string]::IsNullOrWhiteSpace($existing.Source)) { $t } else { "$($existing.Source); $t" } $existingSrc = $existing.Source } } } } # Plumb back any URLs the worker discovered as HTTP 301/302 redirect targets so # Phase 4 of Test-AzureLocalConnectivity (the redirected-URLs loop) can test them. # Without this merge step those rows would be silently dropped from the JSON / HTML # / CSV output in -Parallelism > 1 runs. Dedupe by url + Port matches the existing # New-RedirectedResultEntry semantics in Private/AzStackHci.Connectivity.Helpers.ps1. if ($WorkerResult.RedirectedResults) { foreach ($redirRow in $WorkerResult.RedirectedResults) { if ($null -eq $redirRow) { continue } $existsInRedirected = $script:RedirectedResults | Where-Object { ($_.url -eq $redirRow.url) -and ($_.Port -eq $redirRow.Port) } | Select-Object -First 1 $existsInResults = $script:Results | Where-Object { ($_.URL -eq $redirRow.url) -and ($_.Port -eq $redirRow.Port) } | Select-Object -First 1 if ((-not $existsInRedirected) -and (-not $existsInResults)) { $script:RedirectedResults.Add($redirRow) | Out-Null } } } foreach ($u in $WorkerResult.SSLInspectedURLs) { if (-not ($script:SSLInspectedURLs -contains $u)) { $script:SSLInspectedURLs.Add($u) | Out-Null } } foreach ($u in $WorkerResult.CRLOfflineURLs) { if (-not ($script:CRLOfflineURLs -contains $u)) { $script:CRLOfflineURLs.Add($u) | Out-Null } } if ($WorkerResult.SSLInspectionDetected) { $script:SSLInspectionDetected = $true } # OR-merge the scalar PrivateLinkDetected flag — the parent uses this boolean (NOT # the array) at the end of Test-AzureLocalConnectivity to decide whether to print # the customer-facing 'PRIVATE LINK DETECTED' warning block. if ($WorkerResult.PrivateLinkDetected) { $script:PrivateLinkDetected = $true } foreach ($u in $WorkerResult.PrivateLinkDetectedArray) { if (-not ($script:PrivateLinkDetectedArray -contains $u)) { $script:PrivateLinkDetectedArray += $u } } foreach ($u in $WorkerResult.PrivateLinkCriticalArray) { if (-not ($script:PrivateLinkCriticalArray -contains $u)) { $script:PrivateLinkCriticalArray += $u } } foreach ($u in $WorkerResult.PrivateLinkProxyBypassArray) { if (-not ($script:PrivateLinkProxyBypassArray -contains $u)) { $script:PrivateLinkProxyBypassArray += $u } } } function Split-Layer7BucketsRoundRobin { <# .SYNOPSIS Cost-aware bin-packs a row array into N buckets, with plain round-robin fallback. .DESCRIPTION Endpoint timing is heterogeneous: rows that trigger CRL/OCSP chain validation or that are flagged as Critical/Wildcard typically take 2-3x longer than a plain HEAD probe. A pure `i % Buckets` round-robin can leave one worker with most of the slow rows. Algorithm (cost-aware mode, default): 1. Estimate a per-row cost (Get-Layer7RowCost — CRL/OCSP/Critical = 3, Wildcard = 2, Redirected = 2, all others = 1). 2. Sort rows DESC by cost. (Output ordering is preserved at MERGE time via RowID-sort — see Merge-Layer7WorkerResult — so the bucket-internal order does not affect customer-visible results.) 3. Greedy bin-pack: for each row, place it in the bucket with the lowest current cumulative cost. Ties broken by lowest bucket index. Algorithm (legacy round-robin, opt-in via -RoundRobin): Plain `i % Buckets` — preserved for benchmarking / regression comparison. .PARAMETER Rows The full ordered array of rows to partition. .PARAMETER Buckets Number of buckets (= -Parallelism). Range 1-64. .PARAMETER RoundRobin Switch to force the legacy `i % Buckets` distribution. Default behaviour (switch absent) is cost-aware bin-packing. #> [CmdletBinding()] param( [Parameter(Mandatory)] [array]$Rows, [Parameter(Mandatory)] [ValidateRange(1, 64)] [int]$Buckets, [switch]$RoundRobin ) # Initialise N empty bucket arrays. The leading comma on `,@()` is required — # `for` would otherwise unwrap a 0-element array, leaving fewer than N buckets. $result = @(for ($i = 0; $i -lt $Buckets; $i++) { ,@() }) if ($RoundRobin -or $Buckets -eq 1 -or $Rows.Count -le $Buckets) { # Legacy / trivial cases: bin-packing has no benefit. for ($i = 0; $i -lt $Rows.Count; $i++) { $b = $i % $Buckets $result[$b] += $Rows[$i] } return ,$result } # Cost-aware greedy bin-pack. $costs = @{} foreach ($row in $Rows) { $costs[$row] = Get-Layer7RowCost -Row $row } # Sort DESC by cost. Stable for ties (PowerShell's Sort-Object is NOT stable; # use a secondary key by original index to make ordering deterministic for tests). $indexed = for ($i = 0; $i -lt $Rows.Count; $i++) { [pscustomobject]@{ Row = $Rows[$i]; Cost = $costs[$Rows[$i]]; Index = $i } } $sorted = @($indexed | Sort-Object -Property @{Expression='Cost';Descending=$true}, @{Expression='Index';Descending=$false}) $bucketCost = New-Object 'int[]' $Buckets foreach ($entry in $sorted) { # Find bucket with minimum cumulative cost (ties → lowest index). $minIdx = 0 for ($b = 1; $b -lt $Buckets; $b++) { if ($bucketCost[$b] -lt $bucketCost[$minIdx]) { $minIdx = $b } } $result[$minIdx] += $entry.Row $bucketCost[$minIdx] += $entry.Cost } return ,$result } function Get-Layer7RowCost { <# .SYNOPSIS Estimate the relative cost of testing a Layer-7 row, used by Split-Layer7BucketsRoundRobin. .DESCRIPTION Returns 3 for CRL/OCSP / Critical rows (slowest — chain validation, often blocked endpoints with full timeout), 2 for Wildcard / Redirected rows (medium — extra DNS + sometimes a second HEAD), and 1 for everything else. The exact numbers are not load-bearing; they only need to reflect the relative wall-clock weight so the greedy bin-pack balances correctly. #> [CmdletBinding()] [OutputType([int])] param( [Parameter(Mandatory)] [object]$Row ) $isCrl = ($Row.PSObject.Properties['Source'] -and ($Row.Source -match 'CRL|OCSP|crl\.|ocsp\.')) $isCrit = ($Row.PSObject.Properties['Source'] -and ($Row.Source -match 'Critical')) $isWild = ($Row.PSObject.Properties['IsWildcard'] -and $Row.IsWildcard) $isRedir = ($Row.PSObject.Properties['Source'] -and ($Row.Source -match 'Redirect')) if ($isCrl -or $isCrit) { return 3 } if ($isWild -or $isRedir) { return 2 } return 1 } # SIG # Begin signature block # MIInOgYJKoZIhvcNAQcCoIInKzCCJycCAQExDzANBglghkgBZQMEAgEFADB5Bgor # BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG # KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCRExToOSggK+BF # UkiKUrF+q1BQdBWVkCdusEuJBzHkZ6CCDMkwggYEMIID7KADAgECAhMzAAACHPrN # xZvoL37EAAAAAAIcMA0GCSqGSIb3DQEBCwUAMFcxCzAJBgNVBAYTAlVTMR4wHAYD # VQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBD # b2RlIFNpZ25pbmcgUENBIDIwMjQwHhcNMjYwNDE2MTg1OTQxWhcNMjcwNDE1MTg1 # OTQxWjB0MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UE # BxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMR4wHAYD # VQQDExVNaWNyb3NvZnQgQ29ycG9yYXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IB # DwAwggEKAoIBAQDVsZfgOKmM31HPfoWOoNEiw0SlCiIxUMC0I9NMWbucKOw/e9lP # oAoehQVu6SG65V4EPzrYsnBnFPNoi4/HoOdjhz1qkrEt4I6tEcxXU6oOeY9zGveC # /3iBeuhLYxM3M/PkcUoebF+Nednm8OkdSPoDu8imViHPQq/8CQUu0WRR4rE+dMRf # rpVqfmNi2qWCX94T4MsepijGVkwE//tJg0ryAiYdHT34LSnlG/RSBZmQRGWZ5g8j # qnKjRParSqMft1gvjuUTVgtWNZfgcLFSK5Wa0myrq8OPcgTGGsRgun+tnSS+IxDT # xVsAPH1OzvPjwomguByhUe/OcvUN0D5Wmp7xAgMBAAGjggGqMIIBpjAOBgNVHQ8B # Af8EBAMCB4AwHwYDVR0lBBgwFgYKKwYBBAGCN0wIAQYIKwYBBQUHAwMwHQYDVR0O # BBYEFNoH7a2YDjOSwpkp6DHcmUS7J+0yMFQGA1UdEQRNMEukSTBHMS0wKwYDVQQL # EyRNaWNyb3NvZnQgSXJlbGFuZCBPcGVyYXRpb25zIExpbWl0ZWQxFjAUBgNVBAUT # DTIzMDAxMis1MDc1NjkwHwYDVR0jBBgwFoAUf1k/VCHarU/vBeXmo9ctBpQSCDEw # YAYDVR0fBFkwVzBVoFOgUYZPaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9w # cy9jcmwvTWljcm9zb2Z0JTIwQ29kZSUyMFNpZ25pbmclMjBQQ0ElMjAyMDI0LmNy # bDBtBggrBgEFBQcBAQRhMF8wXQYIKwYBBQUHMAKGUWh0dHA6Ly93d3cubWljcm9z # b2Z0LmNvbS9wa2lvcHMvY2VydHMvTWljcm9zb2Z0JTIwQ29kZSUyMFNpZ25pbmcl # MjBQQ0ElMjAyMDI0LmNydDAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEBCwUAA4IC # AQAUnEqhaRXe0T3hIJjvdQErEkrA/7bByjn6t5IArODkkRjzkYwtKMc2yYj2quaN # rLutWw2YZcngKPy1b71YyDJQTy4NDRwaSh9Tw5thrk3NmcPrAHia5vtcBJ1CgtKK # 7mQbIcQ22d/N3813ayCDDFewu1+jsZmX+r/aTEqaOM4TVxVtRSkuCy8nAXKuChOK # Li/zA4XuH8iEYqIsj2YoNaeSxVmeGiERXpKdo3dDmYi0kO5w2D8VS4c3+9h6gElY # BaAAg/dYErBg27qT3vv0zRDJhJufvCNylA8S7/+8H5E/PV5cng6na9VV/w9OV3qu # uND6zdGa2EX38Glp50F9AIQk3p2xXmcvorDeM4XJ7UlWYBi6g80J1SSOQnInCYFE # msfUNn3+1AaTJKSJL83quKArTac2pKhu0Yzzzrzo6HrsRiQKzpnRBb1/dMa6P3hz # 75XbMRBctNsFhZC07WCmjExdLg2eHW5uV0TY8D5+6wozJf7vF3+WHkYPO85Z+BC6 # U4FkNbYNycZ9cE4j1tXRdyDCfml6c0HWPHjNVDObrv9lKt3qUqFpX38VCqVCyNOO # 1UcXfQiVjJw32U2WUKZjt/neJKHEBsm9kFsLuWzkQ53+qcaSaytmsCnk2gOglrlD # 5d3kKyvvAw+rzm0lT8K38P6PLxfZQHhu4W8dV7Av8N2ZmDCCBr0wggSloAMCAQIC # EzMAAAA5O7Y3Gb8GHWcAAAAAADkwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYT # AlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYD # VQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xMjAwBgNVBAMTKU1pY3Jvc29mdCBS # b290IENlcnRpZmljYXRlIEF1dGhvcml0eSAyMDExMB4XDTI0MDgwODIwNTQxOFoX # DTM2MDMyMjIyMTMwNFowVzELMAkGA1UEBhMCVVMxHjAcBgNVBAoTFU1pY3Jvc29m # dCBDb3Jwb3JhdGlvbjEoMCYGA1UEAxMfTWljcm9zb2Z0IENvZGUgU2lnbmluZyBQ # Q0EgMjAyNDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANgBnB7jOMeq # lRYHNa265v4IY9fH8TKhemHfPINe1gpLaV3dhg324WwH06LcHbpnsBukCDNitryo # 0dtS/EW6I/yEL/bLSY8hKpbfQuWusBPr9qazYcDxCW/qnjb5JsI1s8bNOg3bVATv # QVL4tcf03aTycsz8QeCdM0l/yHRObJ9QqazM1r6VPEOJ7LL+uEEb73w6QCuhs89a # 1uv1zerOYMnsneRRwCbpyW11IcggU0cRKDDq1pjVJzIbIF6+oiXXbReOsgeI8zu1 # FyQfK0fVkaya8SmVHQ/tOf23mZ4W9k0Ri22QW9p3UgSC5OUDktKxxcCmGL6tXLfO # GSWHIIV4YrTJTT6PNty5REojHJuZHArkF9VnHTERWoTjAzfI3kP+5b4alUdhgAZ7 # ttOu1bVnXfHaqPYl2rPs20ji03LOVWsh/radgE17es5hL+t6lV0eVHrVhsssROWJ # uz2MXMCt7iw7lFPG9LXKGjsmonn2gotGdHIuEg5JnJMJVmixd5LRlkmgYRZKzhxS # CwyoGIq0PhaA7Y+VPct5pCHkijcIIDm0nlkK+0KyepolcqGm0T/GYQRMhHJlGOOm # VQop36wUVUYklUy++vDWeEgEo4s7hxN6mIbf2MSIQ/iIfMZgJxC69oukMUXCrOC3 # SkE/xIkgpfl22MM1itkZ35nNXkMolU1lAgMBAAGjggFOMIIBSjAOBgNVHQ8BAf8E # BAMCAYYwEAYJKwYBBAGCNxUBBAMCAQAwHQYDVR0OBBYEFH9ZP1Qh2q1P7wXl5qPX # LQaUEggxMBkGCSsGAQQBgjcUAgQMHgoAUwB1AGIAQwBBMA8GA1UdEwEB/wQFMAMB # Af8wHwYDVR0jBBgwFoAUci06AjGQQ7kUBU7h6qfHMdEjiTQwWgYDVR0fBFMwUTBP # oE2gS4ZJaHR0cDovL2NybC5taWNyb3NvZnQuY29tL3BraS9jcmwvcHJvZHVjdHMv # TWljUm9vQ2VyQXV0MjAxMV8yMDExXzAzXzIyLmNybDBeBggrBgEFBQcBAQRSMFAw # TgYIKwYBBQUHMAKGQmh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2kvY2VydHMv # TWljUm9vQ2VyQXV0MjAxMV8yMDExXzAzXzIyLmNydDANBgkqhkiG9w0BAQwFAAOC # AgEAFJQfOChP7onn6fLIMKrSlN1WYKwDFgAddymOUO3FrM8d7B/W/iQ6DxXsDn7D # 5W4wMwYeLystcEqfkjz4NURRgazyMu5yRzQh4LqjA4tStTcJh1opExo7nn5PuPBY # nbu0+THSuVHTe0VTTPVhily/piFrDo3axQ9P4C+Ol5yet+2gTfekICS5xS+cYfSI # vgn0JksVBVMYVI5QFu/qhnLhsEFEUzG8fvv0hjgkO+lkpV9ty6GkN4vdnd7ya6Q6 # aR9y34aiM1qmxaxBi6OUnyNl6fkuun/diTFnYDLTppOkr/mg5WSfCiDVMNCxtj4w # PKC5OmHm1DQIt/MNokbbH3UGsFP1QbzsLocuSqLCvH09Io3fDPTmscR9Y75G4qX7 # RTX8AdBPo0I6OEojf39zuFZt0qOHm65YWQE69cZM2ueE1MB05dNNgHK9gTE7zKvK # /fg8B2qjW88MT/WF5V5uvZGtqa9FSL2RazArA+rDPuf6JGYz4HpgMZHB4S6szWSK # YBv0VisCzfxgeU+dquXW9bd0auYlOB58DPcOYKdc3Se94g+xL4pcEhbB54JOgAkw # YTu/9dLeH2pDqeJZAABVDWRQCaXfO5LgyKwKCLYXpigrZYCjUSBcr+Ve8PFWMhVT # Ql0v4q8J/AUmQN5W4n101cY2L4A7GTQG1h32HHAvfQESWP0xghnHMIIZwwIBATBu # MFcxCzAJBgNVBAYTAlVTMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24x # KDAmBgNVBAMTH01pY3Jvc29mdCBDb2RlIFNpZ25pbmcgUENBIDIwMjQCEzMAAAIc # +s3Fm+gvfsQAAAAAAhwwDQYJYIZIAWUDBAIBBQCggZAwGQYJKoZIhvcNAQkDMQwG # CisGAQQBgjcCAQQwLwYJKoZIhvcNAQkEMSIEIPClF6T6tZHXIeXR/8o10V3911UM # I5vp2MdT3OFkNkESMEIGCisGAQQBgjcCAQwxNDAyoBSAEgBNAGkAYwByAG8AcwBv # AGYAdKEagBhodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20wDQYJKoZIhvcNAQEBBQAE # ggEAp3KjnJ3PGywG0LLTUolEHvfoEitbFytKqzEzgD1IIiJ+oOzkdFpEQ3n8lgys # 3bjeHUxoShuSpgQFe2inkFUUqQDBcP9MjlC4o3Qqxh3iHPE62yJr+AVPuLhxfLli # JGQDWBejXRETqr20T2TAd5ZKEng79LdJvi6zTSSv36ICPrJjPUqr6ZtmDViMGduv # g4+6SiVUKkOo0jTpU3A0WqzV/qUYftOr8v5X/G+Fc/G0aVji1PlhcK0xrS/u+1pz # ASp9fcZlcU8ekoPSMajm8mgRnO8tmosFL0g2F7/Rh/eD7yLj+tQ5bsghSwC8oNqI # YCZLRrT/xYc6sax7e8fPrT5bf6GCF5cwgheTBgorBgEEAYI3AwMBMYIXgzCCF38G # CSqGSIb3DQEHAqCCF3AwghdsAgEDMQ8wDQYJYIZIAWUDBAIBBQAwggFSBgsqhkiG # 9w0BCRABBKCCAUEEggE9MIIBOQIBAQYKKwYBBAGEWQoDATAxMA0GCWCGSAFlAwQC # AQUABCDsluLuk5y6+CrcPBcwsGG2br2Ny7HjaLb06CnV9YpH0wIGaoSCQM4CGBMy # MDI2MDkwMjE1MjcyMS40NzNaMASAAgH0oIHRpIHOMIHLMQswCQYDVQQGEwJVUzET # MBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMV # TWljcm9zb2Z0IENvcnBvcmF0aW9uMSUwIwYDVQQLExxNaWNyb3NvZnQgQW1lcmlj # YSBPcGVyYXRpb25zMScwJQYDVQQLEx5uU2hpZWxkIFRTUyBFU046OTIwMC0wNUUw # LUQ5NDcxJTAjBgNVBAMTHE1pY3Jvc29mdCBUaW1lLVN0YW1wIFNlcnZpY2WgghHt # MIIHIDCCBQigAwIBAgITMwAAAiNP2WAkU8/+KwABAAACIzANBgkqhkiG9w0BAQsF # ADB8MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMH # UmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSYwJAYDVQQD # Ex1NaWNyb3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAxMDAeFw0yNjAyMTkxOTM5NTda # Fw0yNzA1MTcxOTM5NTdaMIHLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGlu # Z3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBv # cmF0aW9uMSUwIwYDVQQLExxNaWNyb3NvZnQgQW1lcmljYSBPcGVyYXRpb25zMScw # JQYDVQQLEx5uU2hpZWxkIFRTUyBFU046OTIwMC0wNUUwLUQ5NDcxJTAjBgNVBAMT # HE1pY3Jvc29mdCBUaW1lLVN0YW1wIFNlcnZpY2UwggIiMA0GCSqGSIb3DQEBAQUA # A4ICDwAwggIKAoICAQCK6Q2nk5WUdKzSCSafp+UjUARsWxHKS63rJhFC/zSabFum # TBuaJ0QNrmqevub5Db7fSj5qtwwKnjIO92+HXF67192fujL7DFot5WEj/AtEZ/Xr # zFHimKlN1h6gEQwP5I67wizaPW5ZzSBNpaLBg5oHvASPOZtwdNUoZ+DQKF3hJl1K # ZuoIlVK+qi7cLjgak6s5oOZcRCMrKnuC3aoVa6wRDbYvKUuj7rkFx9KO0PsHJ/k+ # LnZMggRheh4AVdawyh+oOzKPjlQGUNfSeWUgym2U9CLa8tt0mQX4DxDz6+ram50g # j1oAfyQ6TQ7r96PADFOKBgaU7+cpHnaZG89dTegQ6ydBRGIycOw1dRX2eKDRRzzi # K3cn0WaIm/7OeGsyQKjIzEQuUTDv0Jj/9zQ7truLOOpJD98BJVOK7je84Sz2hb3H # vUST7j1j2N8peD6olkpFHR/1Z8Jz4F+mkrUF7MmPAirYHRzunbIg3HrDMNwFYN7y # BkDA4/VMo9CY0y9oGUoq2yjbCwTibz9VYl93nB3QQiTCT9nW3M+TOWB+PMrZpExq # 1BSHmKPzIqehKqrUDoM33PK+dEKwpYLET6uXq4HuQRMXWT//sPubUnQAaaUMfQhA # ZSy23HtxwtN3eK9+T4wCav2wQFt57eUOwUW5/DCzMF9tua5He1hNvgcAXaiG1wID # AQABo4IBSTCCAUUwHQYDVR0OBBYEFNbAh89v29nPY9bwQb1QYCzxVgeXMB8GA1Ud # IwQYMBaAFJ+nFV0AXmJdg/Tl0mWnG1M1GelyMF8GA1UdHwRYMFYwVKBSoFCGTmh0 # dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMvY3JsL01pY3Jvc29mdCUyMFRp # bWUtU3RhbXAlMjBQQ0ElMjAyMDEwKDEpLmNybDBsBggrBgEFBQcBAQRgMF4wXAYI # KwYBBQUHMAKGUGh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMvY2VydHMv # TWljcm9zb2Z0JTIwVGltZS1TdGFtcCUyMFBDQSUyMDIwMTAoMSkuY3J0MAwGA1Ud # EwEB/wQCMAAwFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwgwDgYDVR0PAQH/BAQDAgeA # MA0GCSqGSIb3DQEBCwUAA4ICAQCHQwe7z5tp4NZwAf1cB+4c9J4svw3P6WqGBMxt # qznS6DdzUzStXHCaPZhM41g1iKHNnmcnLjwLujOEaNjhSnUDiAZqQjW5ZapOBxgc # 7Egghh9k+r78qWAe3rJ4QohBbhSGdZtKivTRaeRqmnhy8+ThrKhzCeEwaarXJimZ # wSpdQQUDbheWHeyAxASqultd5KO0m/UFvO03tfepqGXA4tCg/WGECwKqOjJzpRAf # PIB6y1HyVrk+vmL5rpEbTwwLOtX7WxFGG8+cYLk9HjaDkxraA/HYlKQRx1sdza+w # /gulLwgOnByRJKF2rr8M7FNIlwoi6ywFpaNc8A7HewaGjgw/tfcE260I1XekGluA # NI9HnONOYWlI7BKBQbWE2teo6vsQ1Vg8B8rTZSePVdmXL1PPqqs3KVdFKM5kYocP # CDM+6VL32IV96sESf2T7DjxanpCg2D2UYj4Z1i7cy8U1LLDGg55KWs4af2RRBjH2 # MulHgAmW5obKxiZCDQjRaroJ2XElXUhigE9BzvhCFbT/HDY2vpVpl5HnSpcCSxmL # 5i5lIT/xbAQMI7Luh75Xrm+IslfFWOGOGMlCp+24qEJEglXEP7xwsolNdBNndXih # hyIefVGlI1DR7xGELiJrk8ifVWYo9XEbEXv/lbvp6F2R2UsnweWckvq0y1HWnLHD # qH6dPjCCB3EwggVZoAMCAQICEzMAAAAVxedrngKbSZkAAAAAABUwDQYJKoZIhvcN # AQELBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYD # VQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xMjAw # BgNVBAMTKU1pY3Jvc29mdCBSb290IENlcnRpZmljYXRlIEF1dGhvcml0eSAyMDEw # MB4XDTIxMDkzMDE4MjIyNVoXDTMwMDkzMDE4MzIyNVowfDELMAkGA1UEBhMCVVMx # EzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoT # FU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRpbWUt # U3RhbXAgUENBIDIwMTAwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDk # 4aZM57RyIQt5osvXJHm9DtWC0/3unAcH0qlsTnXIyjVX9gF/bErg4r25PhdgM/9c # T8dm95VTcVrifkpa/rg2Z4VGIwy1jRPPdzLAEBjoYH1qUoNEt6aORmsHFPPFdvWG # UNzBRMhxXFExN6AKOG6N7dcP2CZTfDlhAnrEqv1yaa8dq6z2Nr41JmTamDu6Gnsz # rYBbfowQHJ1S/rboYiXcag/PXfT+jlPP1uyFVk3v3byNpOORj7I5LFGc6XBpDco2 # LXCOMcg1KL3jtIckw+DJj361VI/c+gVVmG1oO5pGve2krnopN6zL64NF50ZuyjLV # wIYwXE8s4mKyzbnijYjklqwBSru+cakXW2dg3viSkR4dPf0gz3N9QZpGdc3EXzTd # EonW/aUgfX782Z5F37ZyL9t9X4C626p+Nuw2TPYrbqgSUei/BQOj0XOmTTd0lBw0 # gg/wEPK3Rxjtp+iZfD9M269ewvPV2HM9Q07BMzlMjgK8QmguEOqEUUbi0b1qGFph # AXPKZ6Je1yh2AuIzGHLXpyDwwvoSCtdjbwzJNmSLW6CmgyFdXzB0kZSU2LlQ+QuJ # YfM2BjUYhEfb3BvR/bLUHMVr9lxSUV0S2yW6r1AFemzFER1y7435UsSFF5PAPBXb # GjfHCBUYP3irRbb1Hode2o+eFnJpxq57t7c+auIurQIDAQABo4IB3TCCAdkwEgYJ # KwYBBAGCNxUBBAUCAwEAATAjBgkrBgEEAYI3FQIEFgQUKqdS/mTEmr6CkTxGNSnP # EP8vBO4wHQYDVR0OBBYEFJ+nFV0AXmJdg/Tl0mWnG1M1GelyMFwGA1UdIARVMFMw # UQYMKwYBBAGCN0yDfQEBMEEwPwYIKwYBBQUHAgEWM2h0dHA6Ly93d3cubWljcm9z # b2Z0LmNvbS9wa2lvcHMvRG9jcy9SZXBvc2l0b3J5Lmh0bTATBgNVHSUEDDAKBggr # BgEFBQcDCDAZBgkrBgEEAYI3FAIEDB4KAFMAdQBiAEMAQTALBgNVHQ8EBAMCAYYw # DwYDVR0TAQH/BAUwAwEB/zAfBgNVHSMEGDAWgBTV9lbLj+iiXGJo0T2UkFvXzpoY # xDBWBgNVHR8ETzBNMEugSaBHhkVodHRwOi8vY3JsLm1pY3Jvc29mdC5jb20vcGtp # L2NybC9wcm9kdWN0cy9NaWNSb29DZXJBdXRfMjAxMC0wNi0yMy5jcmwwWgYIKwYB # BQUHAQEETjBMMEoGCCsGAQUFBzAChj5odHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20v # cGtpL2NlcnRzL01pY1Jvb0NlckF1dF8yMDEwLTA2LTIzLmNydDANBgkqhkiG9w0B # AQsFAAOCAgEAnVV9/Cqt4SwfZwExJFvhnnJL/Klv6lwUtj5OR2R4sQaTlz0xM7U5 # 18JxNj/aZGx80HU5bbsPMeTCj/ts0aGUGCLu6WZnOlNN3Zi6th542DYunKmCVgAD # sAW+iehp4LoJ7nvfam++Kctu2D9IdQHZGN5tggz1bSNU5HhTdSRXud2f8449xvNo # 32X2pFaq95W2KFUn0CS9QKC/GbYSEhFdPSfgQJY4rPf5KYnDvBewVIVCs/wMnosZ # iefwC2qBwoEZQhlSdYo2wh3DYXMuLGt7bj8sCXgU6ZGyqVvfSaN0DLzskYDSPeZK # PmY7T7uG+jIa2Zb0j/aRAfbOxnT99kxybxCrdTDFNLB62FD+CljdQDzHVG2dY3RI # LLFORy3BFARxv2T5JL5zbcqOCb2zAVdJVGTZc9d/HltEAY5aGZFrDZ+kKNxnGSgk # ujhLmm77IVRrakURR6nxt67I6IleT53S0Ex2tVdUCbFpAUR+fKFhbHP+CrvsQWY9 # af3LwUFJfn6Tvsv4O+S3Fb+0zj6lMVGEvL8CwYKiexcdFYmNcP7ntdAoGokLjzba # ukz5m/8K6TT4JDVnK+ANuOaMmdbhIurwJ0I9JZTmdHRbatGePu1+oDEzfbzL6Xu/ # OHBE0ZDxyKs6ijoIYn/ZcGNTTY3ugm2lBRDBcQZqELQdVTNYs6FwZvKhggNQMIIC # OAIBATCB+aGB0aSBzjCByzELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0 # b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3Jh # dGlvbjElMCMGA1UECxMcTWljcm9zb2Z0IEFtZXJpY2EgT3BlcmF0aW9uczEnMCUG # A1UECxMeblNoaWVsZCBUU1MgRVNOOjkyMDAtMDVFMC1EOTQ3MSUwIwYDVQQDExxN # aWNyb3NvZnQgVGltZS1TdGFtcCBTZXJ2aWNloiMKAQEwBwYFKw4DAhoDFQA4RWFs # +kTiZnoZiAj1BtYj8zCNaqCBgzCBgKR+MHwxCzAJBgNVBAYTAlVTMRMwEQYDVQQI # EwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3Nv # ZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMTHU1pY3Jvc29mdCBUaW1lLVN0YW1wIFBD # QSAyMDEwMA0GCSqGSIb3DQEBCwUAAgUA7kIcHjAiGA8yMDI2MDkwMjAzNTMwMloY # DzIwMjYwOTAzMDM1MzAyWjB3MD0GCisGAQQBhFkKBAExLzAtMAoCBQDuQhweAgEA # MAoCAQACAg3dAgH/MAcCAQACAhUcMAoCBQDuQ22eAgEAMDYGCisGAQQBhFkKBAIx # KDAmMAwGCisGAQQBhFkKAwKgCjAIAgEAAgMHoSChCjAIAgEAAgMBhqAwDQYJKoZI # hvcNAQELBQADggEBAANkFxQNAIvMQ1veFASRQ78pYJ6QOez9Lz2bVoqKx3TDBY+5 # WZ8rkCrkD+hY5Up9i23vmGQ3nERtPFs5O5j66tlU6fKz/YxYvXlx2f4WbVOaeyI7 # PMVLOVZnGa/ILQx2ZOO7tPfrBMnPcjRbg0OlSDXK7qvgpud/pTUkhfj3P8y5QOCB # XtyIn2S1bEMkQL6nHsZBvCVwpd6o7lMla6hoiXnY9OuZbz8PgNNBuUUJJxqV1Mft # a0onZ5WHFcL03/91QhGw2oKXmcv0rXcX9uM7r4kAx6lAzUzW+qoZud2b3nmUd2bb # zkZm2ztotTWta5xRiGk/lE4RlPk+wHuGrzE9p20xggQNMIIECQIBATCBkzB8MQsw # CQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9u # ZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSYwJAYDVQQDEx1NaWNy # b3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAxMAITMwAAAiNP2WAkU8/+KwABAAACIzAN # BglghkgBZQMEAgEFAKCCAUowGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEEMC8G # CSqGSIb3DQEJBDEiBCCgXHO2cJX5dzFgAC/ArpsWiHULsP99PI4Ahqe6AIwP3TCB # +gYLKoZIhvcNAQkQAi8xgeowgecwgeQwgb0EIJbwMywRbvcGiynjnwjAqcaD47yY # vebKZRAvtEAR5u6zMIGYMIGApH4wfDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldh # c2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBD # b3Jwb3JhdGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAgUENBIDIw # MTACEzMAAAIjT9lgJFPP/isAAQAAAiMwIgQgvDz8c1vVS4hFAl2t7vTZUtYD9Ca4 # xtXQL29zIkxAwW0wDQYJKoZIhvcNAQELBQAEggIAebpFmk2E+dUGeQEq3jG56xxP # qqDjjvp1Tp+dkQN+84mdKR+lwCcLxu0lEoFkPwgp2fXUllA9vDcB5Clf9SddIOJO # MOUPMDldfVI4PvmPc0L/id0Oky/tk9+Ui9J8or1dH7s/D0qTBaDb8UdKbbMtD7cl # 9ntWptMJhOhxl5VrTpKo8EDmAX5s+bKhjyYwQQfMWtE7SoADmUNUjzWCUOIFtSai # mr8l9ulw9pfIu4BgZHHRzAVB+FM9fozOQzLtBsP8j4h7ZTEUPrZuBdU6roF+zOZ2 # pcKtflkILUXw7hj/OGacpFPeYvh6aHCqqi1jpnCGp16MpoLqbaXWUfTIRysflgA+ # MlLuibomJ6R3NYVqIdUNjEHp+kaM5ih+hxJh9XB+mWihg2P5rGCIS3ZUZ2bX4Wvf # fsI6WrrXLgDiU7A6gVE9++4ApiufWEv01f5ll1C4Qtl0gHXGD40UrOELm6bMhgvw # irDkJrLwOqbwv+ucOZa4fFB1gBZ4zHIbOSEYP+XEDk0gfWXaiIuzpgRLrzn4LhLR # ijI0jjFqS3Vce+hdawUexH/HVn10h4EL6RwR6+XSY7fyVOBGI9tSwwMOXyAepyAg # ZTUCJyOqHZh4oUbL/7rCng0GCgQj7BN3OejcVMtxSwOGf56ahvkdC7/nn2yBC9DK # PMHB7U7wnL5lZVXQct8= # SIG # End signature block |