Private/AzStackHci.WildcardAndSubdomain.Helpers.ps1

# ////////////////////////////////////////////////////////////////////////////
# Helper to perform DNS + optional TCP + Layer7 testing for a URL/port and return a result hashtable.
# Used by Expand-WildcardUrlsDynamically and Test-ManuallyDefinedSubdomains to avoid duplicated test logic.
Function Invoke-EndpointConnectivityTest {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory)][string]$Url,
        [Parameter(Mandatory)][int]$Port,
        [switch]$IncludeTCPConnectivityTests
    )

    try {
        $DNSCheck = Get-DnsRecord -url (Get-DomainFromURL -url $Url).Domain
    } catch {
        Write-HostAzS "Error: DNS resolution failed for '$Url': $($_.Exception.Message)" -ForegroundColor Red
        return @{
            TCPStatus                        = "Failed"
            IPAddress                        = "DNS Error"
            Layer7Status                     = "Failed"
            Layer7Response                   = "DNS resolution error: $($_.Exception.Message)"
            Layer7ResponseTime               = "N/A"
            CertificateIssuer                = "N/A"
            CertificateSubject               = "N/A"
            CertificateThumbprint            = "N/A"
            CertificateIntermediateIssuer    = "N/A"
            CertificateIntermediateSubject   = "N/A"
            CertificateIntermediateThumbprint= "N/A"
            CertificateRootIssuer            = "N/A"
            CertificateRootSubject           = "N/A"
            CertificateRootThumbprint        = "N/A"
        }
    }

    if (($DNSCheck.DNSExists) -or ($script:Proxy.Enabled)) {
        if ($IncludeTCPConnectivityTests.IsPresent) {
            try {
                $tcpStatus, $ipAddress = Test-TCPConnectivity -url $Url -port $Port
            } catch {
                Write-HostAzS "Error: TCP connectivity test failed for '$Url': $($_.Exception.Message)" -ForegroundColor Red
                $tcpStatus = "Failed"
                $ipAddress = "TCP Error"
            }
        } else {
            $tcpStatus = "N/A"
            $ipAddress = $DNSCheck.IpAddress
        }
        try {
            $Layer7Results = Test-Layer7Connectivity -url $Url -port $Port
        } catch {
            Write-HostAzS "Error: Layer 7 connectivity test failed for '$Url': $($_.Exception.Message)" -ForegroundColor Red
            $Layer7Results = @{
                Layer7Status = "Failed"
                Layer7Response = "Layer 7 test error: $($_.Exception.Message)"
                Layer7ResponseTime = "N/A"
                CertificateIssuer = "N/A"
                CertificateSubject = "N/A"
                CertificateThumbprint = "N/A"
                CertificateIntermediateIssuer = "N/A"
                CertificateIntermediateSubject = "N/A"
                CertificateIntermediateThumbprint = "N/A"
                CertificateRootIssuer = "N/A"
                CertificateRootSubject = "N/A"
                CertificateRootThumbprint = "N/A"
            }
        }
        return @{
            TCPStatus                        = $tcpStatus
            IPAddress                        = $ipAddress
            Layer7Status                     = $Layer7Results.Layer7Status
            Layer7Response                   = $Layer7Results.Layer7Response
            Layer7ResponseTime               = $Layer7Results.Layer7ResponseTime
            CertificateIssuer                = $Layer7Results.CertificateIssuer
            CertificateSubject               = $Layer7Results.CertificateSubject
            CertificateThumbprint            = $Layer7Results.CertificateThumbprint
            CertificateIntermediateIssuer    = $Layer7Results.CertificateIntermediateIssuer
            CertificateIntermediateSubject   = $Layer7Results.CertificateIntermediateSubject
            CertificateIntermediateThumbprint= $Layer7Results.CertificateIntermediateThumbprint
            CertificateRootIssuer            = $Layer7Results.CertificateRootIssuer
            CertificateRootSubject           = $Layer7Results.CertificateRootSubject
            CertificateRootThumbprint        = $Layer7Results.CertificateRootThumbprint
        }
    } else {
        # DNS name does not exist
        return @{
            TCPStatus                        = if ($IncludeTCPConnectivityTests.IsPresent) { "Failed" } else { "N/A" }
            IPAddress                        = $DNSCheck.IpAddress
            Layer7Status                     = "Failed"
            Layer7Response                   = "N/A"
            Layer7ResponseTime               = "N/A"
            CertificateIssuer                = "N/A"
            CertificateSubject               = "N/A"
            CertificateThumbprint            = "N/A"
            CertificateIntermediateIssuer    = "N/A"
            CertificateIntermediateSubject   = "N/A"
            CertificateIntermediateThumbprint= "N/A"
            CertificateRootIssuer            = "N/A"
            CertificateRootSubject           = "N/A"
            CertificateRootThumbprint        = "N/A"
        }
    }
}


# ////////////////////////////////////////////////////////////////////////////
# Enhanced Function to expand wildcard URLs dynamically using pattern matching *.domain.com
#
# How this works:
# 1. Splits $script:Results into wildcard entries (*.foo.com) and non-wildcard entries (bar.foo.com)
# 2. For each wildcard, converts it to a regex (e.g. *.foo.com -> .*\.foo\.com)
# 3. Finds non-wildcard URLs that match the regex pattern
# 4. For each match: if already tested, adds a cross-reference Note; if new, runs connectivity tests
# 5. Updates the wildcard entry's Note field to show which specific URLs were tested for it
#
# This enables testing of wildcard firewall rules by verifying connectivity to known specific endpoints
# that fall under the wildcard pattern.
Function Expand-WildcardUrlsDynamically {

    begin {
        # Write-Verbose "Starting Expand-WildcardUrlsDynamically function"
    }

    process {
        # Split into wildcard and non-wildcard results
        [array]$wildcardResults = $script:Results | Where-Object { $_.IsWildcard -eq $true }
        [array]$nonWildcardResults = $script:Results | Where-Object { $_.IsWildcard -eq $false }

        [int]$wildcardCount = 0

        ForEach ($wildcard in $wildcardResults) {

            $wildcardCount++
            Write-Progress -Id 1 -ParentId 0 -Activity "Expanding Wildcard URLs" -Status "Wildcard $wildcardCount of $($wildcardResults.Count): $($wildcard.URL)" -PercentComplete (($wildcardCount / [math]::Max($wildcardResults.Count,1)) * 100)

            # Create a regex pattern from the wildcard URL
            # Escape dots first, then replace * with .* for proper regex matching
            $wildcardPattern = [regex]::Escape($wildcard.URL) -replace "\\\*", ".*"

            # Find matching non-wildcard URLs, for each wildcard URL that exists
            [array]$matchingUrls = @()
            $matchingUrls = $nonWildcardResults | Where-Object { $_.URL -match "^$wildcardPattern$" }

            Write-HostAzS "`n$wildcardCount of $($wildcardResults.Count): Processing $($wildcard.Source): $($wildcard.URL)"

            if($matchingUrls.Count -eq 0) {
                Write-HostAzS "`tInfo: No match found for $($wildcard.source), $($wildcard.URL)" -ForegroundColor Yellow
                if($wildcard.Note -notlike "Wildcard URL,*"){
                    # Update the note to include the matching URL
                    Write-Verbose "Updating Note of wildcard URL: $($wildcard.URL)"
                    ($script:Results | Where-Object { $PSItem.URL -eq $wildcard.URL } | Select-Object -First 1).Note = "Wildcard URL, not tested (as no non-wildcard) - $($wildcard.Note)"
                }
                # Continue to the next matching URL
                Continue

            } elseif ($matchingUrls.Count -gt 0) {
                # Matches found, expand the wildcard entry
                # Incremental counter for matching URLs
                [int]$counter = 0
                # Loop for each matching URL
                foreach ($match in $matchingUrls) {
                    $counter++
                    Write-HostAzS "`n`tProcessing match $counter of $($matchingUrls.count): $($match.URL)"
                    # Add URL based on test for either HTTP or HTTPS
                    if($match.Port -is [int]){

                        # If the URL already exists in the results, update the note
                        if($script:Results.URL -contains $match.URL){
                            # URL already exists in the results, skip
                            Write-HostAzS "`tEndpoint matches wildcard '$($wildcard.URL)', adding cross-reference in Notes column" -ForegroundColor Green
                            if(($match.Note -notlike "URL matches *") -and ($match.Note -notlike "Manually defined URL *")){
                                # Update the note to include the matching URL
                                Write-Verbose "Updating Note of matched URL: $($match.URL)"
                            ($script:Results | Where-Object { $PSItem.URL -eq $match.URL } | Select-Object -First 1).Note = "URL matches $($wildcard.Source), to test URL $($wildcard.URL) - $($match.Note)"
                            }
                            # Continue to the next matching URL
                            Continue

                        } elseif ($script:Results.URL -notcontains $match.URL){
                            # Specific URL matched to Wildcard URL does not exist in the results, unexpected, but will add it
                            Write-HostAzS "`tEndpoint matches wildcard '$($wildcard.URL)', adding to results" -ForegroundColor Green
                            $newEntry = $wildcard.PSObject.Copy()
                            $newEntry.URL = $match.URL
                            $newEntry.Port = $match.Port
                            $newEntry.ArcGateway = $match.ArcGateway
                            $newEntry.Source = "$($match.Source)"
                            $newEntry.Note = "URL matches $($match.Source), to test URL $($wildcard.URL) - $($match.Note)"
                            # Set IsWildcard to false, as this is no longer a wildcard URL, it is a specific URL to test a wildcard URL
                            $newEntry.IsWildcard = $false
                            if($ArcGatewayDeployment.IsPresent){
                                # Skip URLs with ArcGateway -eq $True
                                if($match.ArcGateway){
                                    # Skip URLs that support Arc Gateway
                                    Write-HostAzS "Skipped URL: '$($newEntry.URL)' as supported by Arc Gateway" -ForegroundColor Yellow
                                    $newEntry.TCPStatus = "Skipped"
                                    $newEntry.Note = "Skipped, URL is supported by Arc Gateway - $($match.Note)"
                                    $newEntry.IPAddress = "N/A"
                                    $newEntry.Layer7Status = "Skipped"
                                    $newEntry.Layer7Response = "N/A"
                                    $newEntry.Layer7ResponseTime = "N/A"
                                    $newEntry.CertificateIssuer = "N/A"
                                    $newEntry.CertificateSubject = "N/A"
                                    $newEntry.CertificateThumbprint = "N/A"
                                    $newEntry.IntermediateCertificateIssuer = "N/A"
                                    $newEntry.IntermediateCertificateSubject = "N/A"
                                    $newEntry.IntermediateCertificateThumbprint = "N/A"
                                    $newEntry.RootCertificateIssuer = "N/A"
                                    $newEntry.RootCertificateSubject = "N/A"
                                    $newEntry.RootCertificateThumbprint = "N/A"
                                } else {
                                    # Does not support Arc Gateway - run connectivity tests
                                    $testResult = Invoke-EndpointConnectivityTest -Url $match.URL -Port $match.Port -IncludeTCPConnectivityTests:$IncludeTCPConnectivityTests.IsPresent
                                    $newEntry.TCPStatus = $testResult.TCPStatus
                                    $newEntry.IPAddress = $testResult.IPAddress
                                    $newEntry.Layer7Status = $testResult.Layer7Status
                                    $newEntry.Layer7Response = $testResult.Layer7Response
                                    $newEntry.Layer7ResponseTime = $testResult.Layer7ResponseTime
                                    $newEntry.CertificateIssuer = $testResult.CertificateIssuer
                                    $newEntry.CertificateSubject = $testResult.CertificateSubject
                                    $newEntry.CertificateThumbprint = $testResult.CertificateThumbprint
                                    $newEntry.IntermediateCertificateIssuer = $testResult.CertificateIntermediateIssuer
                                    $newEntry.IntermediateCertificateSubject = $testResult.CertificateIntermediateSubject
                                    $newEntry.IntermediateCertificateThumbprint = $testResult.CertificateIntermediateThumbprint
                                    $newEntry.RootCertificateIssuer = $testResult.CertificateRootIssuer
                                    $newEntry.RootCertificateSubject = $testResult.CertificateRootSubject
                                    $newEntry.RootCertificateThumbprint = $testResult.CertificateRootThumbprint
                                } # End of ArcGateway -eq $True check
                            } else {
                                # Else process URLs with ArcGateway -eq $False
                                $testResult = Invoke-EndpointConnectivityTest -Url $match.URL -Port $match.Port -IncludeTCPConnectivityTests:$IncludeTCPConnectivityTests.IsPresent
                                $newEntry.TCPStatus = $testResult.TCPStatus
                                $newEntry.IPAddress = $testResult.IPAddress
                                $newEntry.Layer7Status = $testResult.Layer7Status
                                $newEntry.Layer7Response = $testResult.Layer7Response
                                $newEntry.Layer7ResponseTime = $testResult.Layer7ResponseTime
                                $newEntry.CertificateIssuer = $testResult.CertificateIssuer
                                $newEntry.CertificateSubject = $testResult.CertificateSubject
                                $newEntry.CertificateThumbprint = $testResult.CertificateThumbprint
                                $newEntry.IntermediateCertificateIssuer = $testResult.CertificateIntermediateIssuer
                                $newEntry.IntermediateCertificateSubject = $testResult.CertificateIntermediateSubject
                                $newEntry.IntermediateCertificateThumbprint = $testResult.CertificateIntermediateThumbprint
                                $newEntry.RootCertificateIssuer = $testResult.CertificateRootIssuer
                                $newEntry.RootCertificateSubject = $testResult.CertificateRootSubject
                                $newEntry.RootCertificateThumbprint = $testResult.CertificateRootThumbprint
                            } # End of DNS check
                            # Add the new match to the expanded results
                            $script:Results.Add($newEntry) | Out-Null
                            Write-Verbose "Added: '$($newEntry.URL)' that matches Wildcard '$($wildcard.URL)'"
                        
                        } else {
                            # Unexpected condition, should not occur, as we use the Results array for the list of Wildcards, so the URL should always exist
                            Write-Warning "Unexpected: URL '$($match.URL)' matches Wildcard '$($wildcard.URL)', but conditions not met, skipping"
                            Continue
                        } # End of URL exists check

                    } else {
                        Write-Warning "Port not valid for url: '$($match.URL)', port: '$($match.Port)', note: '$($match.Source)' - skipping"
                    }

                } # End of matching URLs loop
            } else {
                # Unexpected condition, should not occur, as we use the Results array for the list of Wildcards, so the URL should always exist
                Write-Warning "Unexpected: Wildcard URL $($wildcard.URL) should match either zero or more results, but matches status unknown, skipping"
                Continue

            } # End of matching URLs check
        } # End of wildcard loop
        Write-Progress -Id 1 -Activity "Expanding Wildcard URLs" -Completed

    } # End of process block

    end {
        # Write-Debug "Completed Expand-WildcardUrlsDynamically function"
    }

} # End of Expand-WildcardUrlsDynamically function


# ////////////////////////////////////////////////////////////////////////////
# Function to manually test known subdomains for wildcard URLs
Function Test-ManuallyDefinedSubdomains {

    Param (
    )

    begin {
        # Incremental counter for subdomains (separate from the main progress bar)
        [int]$urlCount = 0
        # Total number of manually defined subdomains for sub-progress tracking
        [int]$totalSubdomains = $script:MANUAL_SUBDOMAIN_COUNT
        # Use the constant subdomain list
        $manualSubdomains = $script:MANUAL_SUBDOMAINS
    }

    process {
        # Test each manual subdomain for each wildcard to validate connectivity.
        ForEach ($entry in $manualSubdomains) {
            $wildcard = $entry.Wildcard
            $subdomains = $entry.Subdomains

            # Check if the wildcard URL is supported by Arc Gateway, if so, skip the wildcard URL
            if($ArcGatewayDeployment.IsPresent -and ($PreArcGatewayRemoval | Where-Object { ($_.URL -eq $wildcard) -and ($_.ArcGateway -eq $true) })) {
                # Skip wildcard URLs that have already been tested
                Write-Verbose "Info: Wildcard '$wildcard', supports the Arc Gateway, skipping subdomain tests."
                Continue
            }

            # Check if the wildcard URL exists in the results, if not, skip testing subdomains
            if($script:Results.URL -notcontains $wildcard) {
                # Skip wildcard URLs that have already been tested
                Write-Verbose "Info: Wildcard '$wildcard', is not present in Results array, skipping subdomain tests."
                Continue
            }

            Write-HostAzS "`nTesting manually defined subdomains for wildcard $wildcard"

            # ForEach loop to process each subdomain
            ForEach ($subdomain in $subdomains) {
                # Test each subdomain for TCP and Layer 7 connectivity
                $urlCount++
                if ($totalSubdomains -gt 0) {
                    Write-Progress -Id 1 -ParentId 0 -Activity "Validating Wildcard Endpoints" -Status "Subdomain $urlCount of $($totalSubdomains): $subdomain" -PercentComplete (($urlCount / $totalSubdomains) * 100)
                }
                Write-HostAzS "`nWildcard validation $urlCount of $($totalSubdomains): Subdomain: $subdomain"
                # Test port 80 and 443 for each subdomain
                ForEach ($port in @(80, 443)) {
                    
                    # Exceptions to some URLs, that do not support port 80 or 443
                    # Skip port 443 for ctldl.windowsupdate.com, download.windowsupdate.com, fe2.update.microsoft.com and 1a.au.download.windowsupdate.com
                    if(($subdomain -in ("ctldl.windowsupdate.com","download.windowsupdate.com","fe2.update.microsoft.com","1a.au.download.windowsupdate.com")) -and ($port -eq 443)){
                        # Skip port 443 for ctldl.windowsupdate.com, download.windowsupdate.com, fe2.update.microsoft.com and 1a.au.download.windowsupdate.com
                        Write-HostAzS "Skipping port 443 for $subdomain" -ForegroundColor Yellow
                        Continue
                    }
                    # Skip port 80 for prod5.prod.hot.ingest.monitor.core.windows.net and edr-neu3.eu.endpoint.security.microsoft.com
                    if(($subdomain -in ("prod5.prod.hot.ingest.monitor.core.windows.net","edr-neu3.eu.endpoint.security.microsoft.com")) -and ($port -eq 80)){
                        # Skip port 80 for prod5.prod.hot.ingest.monitor.core.windows.net and edr-neu3.eu.endpoint.security.microsoft.com
                        Write-HostAzS "Skipping port 80 for $subdomain" -ForegroundColor Yellow
                        Continue
                    }
                    
                    # Run connectivity tests using shared helper
                    Write-HostAzS "Testing $subdomain on port $port"
                    $testResult = Invoke-EndpointConnectivityTest -Url $subdomain -Port $port -IncludeTCPConnectivityTests:$IncludeTCPConnectivityTests.IsPresent
                    $TCPstatus = $testResult.TCPStatus
                    $ipAddress = $testResult.IPAddress
                    $Layer7Status = $testResult.Layer7Status
                    $Layer7Response = $testResult.Layer7Response
                    $Layer7ResponseTime = $testResult.Layer7ResponseTime
                    $CertificateIssuer = $testResult.CertificateIssuer
                    $CertificateSubject = $testResult.CertificateSubject
                    $CertificateThumbprint = $testResult.CertificateThumbprint
                    $CertificateIntermediateIssuer = $testResult.CertificateIntermediateIssuer
                    $CertificateIntermediateSubject = $testResult.CertificateIntermediateSubject
                    $CertificateIntermediateThumbprint = $testResult.CertificateIntermediateThumbprint
                    $CertificateRootIssuer = $testResult.CertificateRootIssuer
                    $CertificateRootSubject = $testResult.CertificateRootSubject
                    $CertificateRootThumbprint = $testResult.CertificateRootThumbprint
                    
                    # Check if the URL already exists in the "allTestedUrls" results, only add new ones
                    if($script:Results.URL -notcontains $subdomain) {
                        # ArcGateway = $true, as all wildcards are "microsoft.com" or "windows.net", so should support ArcGateway
                        $subdomainEntry = [PSCustomObject]@{
                            RowID = 0
                            URL = $subdomain
                            Port = $port
                            ArcGateway = $true
                            IsWildcard = $false
                            Source = "Test for $(($script:Results | Where-Object { ($_.URL -eq $wildcard) } | Select-Object -First 1).Source)"
                            Note = "Manually defined URL to test $Source Wildcard URL $wildcard"
                            TCPStatus = $TCPstatus
                            IPAddress = $ipAddress
                            Layer7Status = $Layer7Status
                            Layer7Response = $Layer7Response
                            Layer7ResponseTime = $Layer7ResponseTime
                            CertificateIssuer = $CertificateIssuer
                            CertificateSubject = $CertificateSubject
                            CertificateThumbprint = $CertificateThumbprint
                            IntermediateCertificateIssuer = $CertificateIntermediateIssuer
                            IntermediateCertificateSubject = $CertificateIntermediateSubject
                            IntermediateCertificateThumbprint = $CertificateIntermediateThumbprint
                            RootCertificateIssuer = $CertificateRootIssuer
                            RootCertificateSubject = $CertificateRootSubject
                            RootCertificateThumbprint = $CertificateRootThumbprint
                        }
                        # Add the subdomain entry to the results
                        Write-Debug "Info: Added $($subdomain) to the results array"
                        $script:Results.Add($subdomainEntry) | Out-Null
                        $MatchedWildcardURLs = ($script:Results | Where-Object { $PSItem.URL -eq $wildcard } )
                        ForEach($MatchedWildcardURL in $MatchedWildcardURLs) {
                            if($MatchedWildcardURL.Note -notlike "Wildcard URL,*"){
                                # Update the note to include the matching URL
                                Write-Verbose "Updating Note of wildcard URL: $($wildcard), with cross-reference to $($subdomain)"
                                $MatchedWildcardURL.Note = "Wildcard URL, tested by manually defined URL $($subdomain) - $($MatchedWildcardURL.Note)"
                            }
                        }

                    } else {
                        # URL already exists in the results, skip
                        Write-Verbose "Info: Url $($subdomain) already exists in the results, skipping"
                        $MatchedWildcardURLs = ($script:Results | Where-Object { $PSItem.URL -eq $wildcard } )
                        ForEach($MatchedWildcardURL in $MatchedWildcardURLs) {
                            if($MatchedWildcardURL.Note -notlike "Wildcard URL,*"){
                                # Update the note to include the matching URL
                                $MatchedWildcardURL.Note = "Wildcard URL, tested by manually defined URL $($subdomain) - $($MatchedWildcardURL.Note)"
                                Write-Verbose "Updated Note of wildcard URL: $($wildcard), with cross-reference to $($subdomain)"
                            }
                        }
                    }
                }
            } # End of ForEach per $port

        } # End of ForEach $subdomain

    } # End of Process block

    end {
        # Progress bar is managed by the caller (unified with main endpoint testing)
    }
} # End of Test-ManuallyDefinedSubdomains function


# ////////////////////////////////////////////////////////////////////////////
# Function to parse endpoints from markdown lines
Function Get-EndpointsFromMarkdown {
    <#
    .SYNOPSIS
        Parse endpoints from markdown lines.
    .DESCRIPTION
        This function parses the provided markdown lines to extract endpoint URLs.
    #>

    [CmdletBinding()]
    param (
        [Parameter(Mandatory=$true)]
        [AllowEmptyCollection()]
        [string[]]$InputMarkdown,

        [Parameter(Mandatory=$true)]
        [ValidateNotNullOrEmpty()]
        [string]$Source
    )

    begin {
        # Write-Debug "Get-EndpointsFromMarkdown: Beginning endpoint parsing from markdown lines"
        # Initialize counter to store the number of parsed endpoints
        [int]$parsedEndpoints = 0
        
        # Validate input is not empty
        if (-not $InputMarkdown -or $InputMarkdown.Count -eq 0) {
            Write-Warning "No markdown content provided to parse in function: 'Get-EndpointsFromMarkdown'. Returning 0 endpoints."
            return $parsedEndpoints
        }
    }

    process {
        # Parse markdown table rows to extract endpoint URLs.
        # Expected format: | RowNum | ... | URL | Ports | Note | ArcGateway | ...
        # The regex matches lines starting with | followed by a number (the row ID column).
        # Columns are split on '|' and indexed: [3]=URL, [4]=Ports, [5]=Note, [6]=ArcGateway.
        ForEach ($line in $InputMarkdown) {
            if ($line -match "^\|\s*(\d+)\s*\|") {
                # $rowId = [int]($line -replace "^\|\s*(\d+)\s*\|.*", '$1')
                $columns = $line -split "\|"
                # Validate column count before accessing indices (need at least 7 columns: empty, rowId, desc, URL, Ports, Note, ArcGateway)
                if ($columns.Count -lt 7) {
                    Write-Warning "Skipping malformed markdown row (expected at least 7 columns, found $($columns.Count)): $line"
                    Continue
                }
                $url = $columns[3].Trim()
                # Sanitize URL: only allow FQDN characters (alphanumeric, hyphens, dots, wildcards, forward slashes, colons for port, underscores)
                # This prevents injection of unexpected values from crafted markdown files.
                if ($url -notmatch '^[a-zA-Z0-9\*\.\-\:/_]+$') {
                    Write-Warning "Skipping invalid URL from markdown: '$url' - contains unexpected characters"
                    Continue
                }
                $ports = $columns[4].Trim() -split ','
                $note = $columns[5].Trim()
                $ArcGatewayText = $columns[6].Trim()
                if(($ArcGatewayText.Length -ge 2) -and ($ArcGatewayText.Substring(0,2) -eq "No")){
                    # "No"
                    [bool]$ArcGateway = $false
                } elseif(($ArcGatewayText.Length -ge 3) -and ($ArcGatewayText.Substring(0,3) -eq "Yes")){
                    # "Yes"
                    [bool]$ArcGateway = $true
                } else {
                    # Unknown
                    Write-Warning "Unknown ArcGateway status for url: '$url' : $ArcGatewayText"
                    [bool]$ArcGateway = $false
                }
                # Use only the domain name from the URL, remove any absolute path from the endpoint when checking if it exists
                $urlcheck = (Get-DomainFromURL -url $url).Domain
                foreach ($port in $ports) {
                    $isWildcard = $url.Contains("*")
                    if($script:Results | Where-Object { ((Get-DomainFromURL -url $_.URL).Domain -eq $urlcheck) -and ($_.Port -eq $port) }) {
                        Write-Debug "$($Source): Skipping '$url' with port '$port', as it already exists in the results array."
                        # If the ArcGateway value is different, update it
                        $script:Results | Where-Object { ((Get-DomainFromURL -url $_.URL).Domain -like $urlcheck) -and ($_.Port -eq $port) } | ForEach-Object {
                            $_.ArcGateway = $ArcGateway
                        }
                        Continue
                    } else {
                        Write-Debug "$($Source): Adding '$urlcheck' with port '$port' to results array for processing."
                        $script:Results.Add([PSCustomObject]@{
                            RowID = 0
                            URL = $url
                            Port = [int]$port
                            ArcGateway = $ArcGateway
                            IsWildcard = $isWildcard
                            Source = if ($isWildcard) { "$Source Wildcard" } else { "$Source" }
                            Note = $note
                            TCPStatus = ""
                            IPAddress = ""
                            Layer7Status = ""
                            Layer7Response = ""
                            Layer7ResponseTime = ""
                            CertificateIssuer = ""
                            CertificateSubject = ""
                            CertificateThumbprint = ""
                            IntermediateCertificateIssuer = ""
                            IntermediateCertificateSubject = ""
                            IntermediateCertificateThumbprint = ""
                            RootCertificateIssuer = ""
                            RootCertificateSubject = ""
                            RootCertificateThumbprint = ""
                        }) | Out-Null
                        # Increment the parsed endpoints counter
                        $parsedEndpoints++
                    }
                }
            }
            
        }
    } # End of process block

    end {
        # Write-Debug "Get-EndpointsFromMarkdown: Endpoint parsing completed"
        Return $parsedEndpoints

    }
} # End Function Get-EndpointsFromMarkdown

# SIG # Begin signature block
# MIIoKgYJKoZIhvcNAQcCoIIoGzCCKBcCAQExDzANBglghkgBZQMEAgEFADB5Bgor
# BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG
# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCDUMkELYXP9aHuK
# s8xAbHAIjkK1q5rNTaAzyexAYjYMiKCCDXYwggX0MIID3KADAgECAhMzAAAEhV6Z
# 7A5ZL83XAAAAAASFMA0GCSqGSIb3DQEBCwUAMH4xCzAJBgNVBAYTAlVTMRMwEQYD
# VQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNy
# b3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBDb2RlIFNpZ25p
# bmcgUENBIDIwMTEwHhcNMjUwNjE5MTgyMTM3WhcNMjYwNjE3MTgyMTM3WjB0MQsw
# CQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9u
# ZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMR4wHAYDVQQDExVNaWNy
# b3NvZnQgQ29ycG9yYXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
# AQDASkh1cpvuUqfbqxele7LCSHEamVNBfFE4uY1FkGsAdUF/vnjpE1dnAD9vMOqy
# 5ZO49ILhP4jiP/P2Pn9ao+5TDtKmcQ+pZdzbG7t43yRXJC3nXvTGQroodPi9USQi
# 9rI+0gwuXRKBII7L+k3kMkKLmFrsWUjzgXVCLYa6ZH7BCALAcJWZTwWPoiT4HpqQ
# hJcYLB7pfetAVCeBEVZD8itKQ6QA5/LQR+9X6dlSj4Vxta4JnpxvgSrkjXCz+tlJ
# 67ABZ551lw23RWU1uyfgCfEFhBfiyPR2WSjskPl9ap6qrf8fNQ1sGYun2p4JdXxe
# UAKf1hVa/3TQXjvPTiRXCnJPAgMBAAGjggFzMIIBbzAfBgNVHSUEGDAWBgorBgEE
# AYI3TAgBBggrBgEFBQcDAzAdBgNVHQ4EFgQUuCZyGiCuLYE0aU7j5TFqY05kko0w
# RQYDVR0RBD4wPKQ6MDgxHjAcBgNVBAsTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEW
# MBQGA1UEBRMNMjMwMDEyKzUwNTM1OTAfBgNVHSMEGDAWgBRIbmTlUAXTgqoXNzci
# tW2oynUClTBUBgNVHR8ETTBLMEmgR6BFhkNodHRwOi8vd3d3Lm1pY3Jvc29mdC5j
# b20vcGtpb3BzL2NybC9NaWNDb2RTaWdQQ0EyMDExXzIwMTEtMDctMDguY3JsMGEG
# CCsGAQUFBwEBBFUwUzBRBggrBgEFBQcwAoZFaHR0cDovL3d3dy5taWNyb3NvZnQu
# Y29tL3BraW9wcy9jZXJ0cy9NaWNDb2RTaWdQQ0EyMDExXzIwMTEtMDctMDguY3J0
# MAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADggIBACjmqAp2Ci4sTHZci+qk
# tEAKsFk5HNVGKyWR2rFGXsd7cggZ04H5U4SV0fAL6fOE9dLvt4I7HBHLhpGdE5Uj
# Ly4NxLTG2bDAkeAVmxmd2uKWVGKym1aarDxXfv3GCN4mRX+Pn4c+py3S/6Kkt5eS
# DAIIsrzKw3Kh2SW1hCwXX/k1v4b+NH1Fjl+i/xPJspXCFuZB4aC5FLT5fgbRKqns
# WeAdn8DsrYQhT3QXLt6Nv3/dMzv7G/Cdpbdcoul8FYl+t3dmXM+SIClC3l2ae0wO
# lNrQ42yQEycuPU5OoqLT85jsZ7+4CaScfFINlO7l7Y7r/xauqHbSPQ1r3oIC+e71
# 5s2G3ClZa3y99aYx2lnXYe1srcrIx8NAXTViiypXVn9ZGmEkfNcfDiqGQwkml5z9
# nm3pWiBZ69adaBBbAFEjyJG4y0a76bel/4sDCVvaZzLM3TFbxVO9BQrjZRtbJZbk
# C3XArpLqZSfx53SuYdddxPX8pvcqFuEu8wcUeD05t9xNbJ4TtdAECJlEi0vvBxlm
# M5tzFXy2qZeqPMXHSQYqPgZ9jvScZ6NwznFD0+33kbzyhOSz/WuGbAu4cHZG8gKn
# lQVT4uA2Diex9DMs2WHiokNknYlLoUeWXW1QrJLpqO82TLyKTbBM/oZHAdIc0kzo
# STro9b3+vjn2809D0+SOOCVZMIIHejCCBWKgAwIBAgIKYQ6Q0gAAAAAAAzANBgkq
# hkiG9w0BAQsFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24x
# EDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlv
# bjEyMDAGA1UEAxMpTWljcm9zb2Z0IFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5
# IDIwMTEwHhcNMTEwNzA4MjA1OTA5WhcNMjYwNzA4MjEwOTA5WjB+MQswCQYDVQQG
# EwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwG
# A1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSgwJgYDVQQDEx9NaWNyb3NvZnQg
# Q29kZSBTaWduaW5nIFBDQSAyMDExMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC
# CgKCAgEAq/D6chAcLq3YbqqCEE00uvK2WCGfQhsqa+laUKq4BjgaBEm6f8MMHt03
# a8YS2AvwOMKZBrDIOdUBFDFC04kNeWSHfpRgJGyvnkmc6Whe0t+bU7IKLMOv2akr
# rnoJr9eWWcpgGgXpZnboMlImEi/nqwhQz7NEt13YxC4Ddato88tt8zpcoRb0Rrrg
# OGSsbmQ1eKagYw8t00CT+OPeBw3VXHmlSSnnDb6gE3e+lD3v++MrWhAfTVYoonpy
# 4BI6t0le2O3tQ5GD2Xuye4Yb2T6xjF3oiU+EGvKhL1nkkDstrjNYxbc+/jLTswM9
# sbKvkjh+0p2ALPVOVpEhNSXDOW5kf1O6nA+tGSOEy/S6A4aN91/w0FK/jJSHvMAh
# dCVfGCi2zCcoOCWYOUo2z3yxkq4cI6epZuxhH2rhKEmdX4jiJV3TIUs+UsS1Vz8k
# A/DRelsv1SPjcF0PUUZ3s/gA4bysAoJf28AVs70b1FVL5zmhD+kjSbwYuER8ReTB
# w3J64HLnJN+/RpnF78IcV9uDjexNSTCnq47f7Fufr/zdsGbiwZeBe+3W7UvnSSmn
# Eyimp31ngOaKYnhfsi+E11ecXL93KCjx7W3DKI8sj0A3T8HhhUSJxAlMxdSlQy90
# lfdu+HggWCwTXWCVmj5PM4TasIgX3p5O9JawvEagbJjS4NaIjAsCAwEAAaOCAe0w
# ggHpMBAGCSsGAQQBgjcVAQQDAgEAMB0GA1UdDgQWBBRIbmTlUAXTgqoXNzcitW2o
# ynUClTAZBgkrBgEEAYI3FAIEDB4KAFMAdQBiAEMAQTALBgNVHQ8EBAMCAYYwDwYD
# VR0TAQH/BAUwAwEB/zAfBgNVHSMEGDAWgBRyLToCMZBDuRQFTuHqp8cx0SOJNDBa
# BgNVHR8EUzBRME+gTaBLhklodHRwOi8vY3JsLm1pY3Jvc29mdC5jb20vcGtpL2Ny
# bC9wcm9kdWN0cy9NaWNSb29DZXJBdXQyMDExXzIwMTFfMDNfMjIuY3JsMF4GCCsG
# AQUFBwEBBFIwUDBOBggrBgEFBQcwAoZCaHR0cDovL3d3dy5taWNyb3NvZnQuY29t
# L3BraS9jZXJ0cy9NaWNSb29DZXJBdXQyMDExXzIwMTFfMDNfMjIuY3J0MIGfBgNV
# HSAEgZcwgZQwgZEGCSsGAQQBgjcuAzCBgzA/BggrBgEFBQcCARYzaHR0cDovL3d3
# dy5taWNyb3NvZnQuY29tL3BraW9wcy9kb2NzL3ByaW1hcnljcHMuaHRtMEAGCCsG
# AQUFBwICMDQeMiAdAEwAZQBnAGEAbABfAHAAbwBsAGkAYwB5AF8AcwB0AGEAdABl
# AG0AZQBuAHQALiAdMA0GCSqGSIb3DQEBCwUAA4ICAQBn8oalmOBUeRou09h0ZyKb
# C5YR4WOSmUKWfdJ5DJDBZV8uLD74w3LRbYP+vj/oCso7v0epo/Np22O/IjWll11l
# hJB9i0ZQVdgMknzSGksc8zxCi1LQsP1r4z4HLimb5j0bpdS1HXeUOeLpZMlEPXh6
# I/MTfaaQdION9MsmAkYqwooQu6SpBQyb7Wj6aC6VoCo/KmtYSWMfCWluWpiW5IP0
# wI/zRive/DvQvTXvbiWu5a8n7dDd8w6vmSiXmE0OPQvyCInWH8MyGOLwxS3OW560
# STkKxgrCxq2u5bLZ2xWIUUVYODJxJxp/sfQn+N4sOiBpmLJZiWhub6e3dMNABQam
# ASooPoI/E01mC8CzTfXhj38cbxV9Rad25UAqZaPDXVJihsMdYzaXht/a8/jyFqGa
# J+HNpZfQ7l1jQeNbB5yHPgZ3BtEGsXUfFL5hYbXw3MYbBL7fQccOKO7eZS/sl/ah
# XJbYANahRr1Z85elCUtIEJmAH9AAKcWxm6U/RXceNcbSoqKfenoi+kiVH6v7RyOA
# 9Z74v2u3S5fi63V4GuzqN5l5GEv/1rMjaHXmr/r8i+sLgOppO6/8MO0ETI7f33Vt
# Y5E90Z1WTk+/gFcioXgRMiF670EKsT/7qMykXcGhiJtXcVZOSEXAQsmbdlsKgEhr
# /Xmfwb1tbWrJUnMTDXpQzTGCGgowghoGAgEBMIGVMH4xCzAJBgNVBAYTAlVTMRMw
# EQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVN
# aWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBDb2RlIFNp
# Z25pbmcgUENBIDIwMTECEzMAAASFXpnsDlkvzdcAAAAABIUwDQYJYIZIAWUDBAIB
# BQCgga4wGQYJKoZIhvcNAQkDMQwGCisGAQQBgjcCAQQwHAYKKwYBBAGCNwIBCzEO
# MAwGCisGAQQBgjcCARUwLwYJKoZIhvcNAQkEMSIEIFCrvCIb5/SetIGSjdBLmrsw
# MB8UlBTb9EFdOGZ8tB5WMEIGCisGAQQBgjcCAQwxNDAyoBSAEgBNAGkAYwByAG8A
# cwBvAGYAdKEagBhodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20wDQYJKoZIhvcNAQEB
# BQAEggEAJ0rIKazFOdLIShMLNCqCUifmZVmkbiDMm6K0VZRrsdlaJo+2WRob+6wS
# TwITVXoxA6pyXUcMJIL+B7v8RVpOiRXY3x8fYpXxGuVN6MNjdPWB9cIpdxcZJaVN
# bYm1DUmBuhd67a8h0Pd3O2Bk9t824sETvEZA+Hvg9tO/BS/RdEpokWvxLMB7VUql
# b4HEfpXNIT1kxqkzUyT36B737IjTimf8m9dCVHnPeFfSefQfHX/jN+rJrWeTWn1e
# 0hvZNfr+8ii/GgEvuG/8J7bvIdCAxhcLULSLaoKIDXX34hZzG/8bYj7s0ee4UIg9
# eTmkc2SBQV4ykvKk7kCGs6kC6I5nwKGCF5QwgheQBgorBgEEAYI3AwMBMYIXgDCC
# F3wGCSqGSIb3DQEHAqCCF20wghdpAgEDMQ8wDQYJYIZIAWUDBAIBBQAwggFSBgsq
# hkiG9w0BCRABBKCCAUEEggE9MIIBOQIBAQYKKwYBBAGEWQoDATAxMA0GCWCGSAFl
# AwQCAQUABCAziK2jR3uoadBQbdFvQ8mFBbJmpzkel3Zz7/Et4eqJngIGadehhoCZ
# GBMyMDI2MDQxNzE1MDY0NC45MTVaMASAAgH0oIHRpIHOMIHLMQswCQYDVQQGEwJV
# UzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UE
# ChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSUwIwYDVQQLExxNaWNyb3NvZnQgQW1l
# cmljYSBPcGVyYXRpb25zMScwJQYDVQQLEx5uU2hpZWxkIFRTUyBFU046QTQwMC0w
# NUUwLUQ5NDcxJTAjBgNVBAMTHE1pY3Jvc29mdCBUaW1lLVN0YW1wIFNlcnZpY2Wg
# ghHqMIIHIDCCBQigAwIBAgITMwAAAijwpYfX88geQAABAAACKDANBgkqhkiG9w0B
# AQsFADB8MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UE
# BxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSYwJAYD
# VQQDEx1NaWNyb3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAxMDAeFw0yNjAyMTkxOTQw
# MDZaFw0yNzA1MTcxOTQwMDZaMIHLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2Fz
# aGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENv
# cnBvcmF0aW9uMSUwIwYDVQQLExxNaWNyb3NvZnQgQW1lcmljYSBPcGVyYXRpb25z
# MScwJQYDVQQLEx5uU2hpZWxkIFRTUyBFU046QTQwMC0wNUUwLUQ5NDcxJTAjBgNV
# BAMTHE1pY3Jvc29mdCBUaW1lLVN0YW1wIFNlcnZpY2UwggIiMA0GCSqGSIb3DQEB
# AQUAA4ICDwAwggIKAoICAQCujvbk/sqcCSReZaJfCuf1NwRcc7XknhE6wkLofkNj
# 1mxEAg35qy2xcFjgjartVvA09W8QHcpyMqVSXOTxNHJsmk0qP2CDLvUAulWg7aS5
# oBORpEX1oz3n0R2nPqeH0IHK1zJxjxaHW21AbuZ0Z+wM3WYNzkBlcHmVe03ZG7rl
# k28h72r5P5ME8FGpFmYW5Hl7psKbgLEfrYAitpttsb+sZsBUI+hMKl4uLJYotKyZ
# v1ewOIinBfRU8QosivjofaBezUf9NdV+iGrWh321WnSsK3A/Jl6GLtbSWXcJWULg
# bxuqnobPK+YlB3174TMWTgX4YWjG7o0Otz/pjHNCKBbB788dynhLdGY6B08E9+4S
# GrRpsty4iJHOydHCA5M4i5yYRwsdut+gmvxIpT8yNXJcjJCg0vO8mv/nFY9Wytv2
# qmCtCFFivGUWqU20/sUeRooQZGiQOJQn095Cj3isIsvRP8KU7hN/EDI8HVsb/NPz
# MFLvRznrRnj0TOnDiOTUcnYwmk+XfoS1owskcCCCwHnbC00D58z83y7K5ZJB745h
# cn4CE2nR3e6RGsr42y5qtt6Mdz/s7MTnDS2UmVHWX1X/HZe3UlX8gj/t63L50xIP
# qkRCBEdM1ADNUaSfo9OQiKb/bj1diZCGTfEDUBBLop1mhkwIF82faplV2busZ+U4
# kQIDAQABo4IBSTCCAUUwHQYDVR0OBBYEFKrJpYz48tzouvVkBVthASFpQ93DMB8G
# A1UdIwQYMBaAFJ+nFV0AXmJdg/Tl0mWnG1M1GelyMF8GA1UdHwRYMFYwVKBSoFCG
# Tmh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMvY3JsL01pY3Jvc29mdCUy
# MFRpbWUtU3RhbXAlMjBQQ0ElMjAyMDEwKDEpLmNybDBsBggrBgEFBQcBAQRgMF4w
# XAYIKwYBBQUHMAKGUGh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMvY2Vy
# dHMvTWljcm9zb2Z0JTIwVGltZS1TdGFtcCUyMFBDQSUyMDIwMTAoMSkuY3J0MAwG
# A1UdEwEB/wQCMAAwFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwgwDgYDVR0PAQH/BAQD
# AgeAMA0GCSqGSIb3DQEBCwUAA4ICAQCQ6NfLmrRahgVtgWg383GaS07fHyod6bhc
# UONt2tet+6BaNuH0r7ABkVHheOpxBdrUrOEYVEaIii9dK3cuZLNmp1iUAx/VbmOZ
# Yl7xz+tNrjCWqrg1jQmq0oRB8iE4QJpwNhGP67oY5huYIU0D4lhDoahqfgKJn/0B
# k+9UKDPw5XlUYmreFmJlj9YQzcPPep8MxBXxh/Y5I7vQeRaW5SjtiLQOLRk3ggvr
# aDs5Sf49MJV6/BwxXC2rvUfEFX6SUDooqKIE9NgVIRq0RZu7Ot0i0Is+HvPP0hB6
# KwOxMg1SWKOfTtFpWpdo8MJvgKCHkPpXEzgprP+pyIHuO7gVRlSTsbYBFLh2yId/
# itM4uYL0R+2SSBBTpSSRthrGuEmElI5BCHMxzMg/oqHSPwZAIAkM2C4xxi0St7qM
# uA+m+ZzFYkfoF41QoSJn+HjqhqWYQ0m/SO9/KnJRJJUwMd5TiMnjZ+E/DJiUry5u
# diWyQpvfj2hQFI0djhahoAXDazeEciLF2uEnTur9UfjcwOun/oMY+ULftnOi2jKL
# MrreV097akzz/JxpnDgYJU/tgU7fQflg7IqiL9+0276+joQHo21mVeY5YD8Kh/kU
# aY6Jm/OTM88G7evTz/qnRumxovTjMStvpbAHNRhmSTdIPTV32CyuxDKS/V5a5iwA
# +f9ViBo+wjCCB3EwggVZoAMCAQICEzMAAAAVxedrngKbSZkAAAAAABUwDQYJKoZI
# hvcNAQELBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAw
# DgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24x
# MjAwBgNVBAMTKU1pY3Jvc29mdCBSb290IENlcnRpZmljYXRlIEF1dGhvcml0eSAy
# MDEwMB4XDTIxMDkzMDE4MjIyNVoXDTMwMDkzMDE4MzIyNVowfDELMAkGA1UEBhMC
# VVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNV
# BAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRp
# bWUtU3RhbXAgUENBIDIwMTAwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoIC
# AQDk4aZM57RyIQt5osvXJHm9DtWC0/3unAcH0qlsTnXIyjVX9gF/bErg4r25Phdg
# M/9cT8dm95VTcVrifkpa/rg2Z4VGIwy1jRPPdzLAEBjoYH1qUoNEt6aORmsHFPPF
# dvWGUNzBRMhxXFExN6AKOG6N7dcP2CZTfDlhAnrEqv1yaa8dq6z2Nr41JmTamDu6
# GnszrYBbfowQHJ1S/rboYiXcag/PXfT+jlPP1uyFVk3v3byNpOORj7I5LFGc6XBp
# Dco2LXCOMcg1KL3jtIckw+DJj361VI/c+gVVmG1oO5pGve2krnopN6zL64NF50Zu
# yjLVwIYwXE8s4mKyzbnijYjklqwBSru+cakXW2dg3viSkR4dPf0gz3N9QZpGdc3E
# XzTdEonW/aUgfX782Z5F37ZyL9t9X4C626p+Nuw2TPYrbqgSUei/BQOj0XOmTTd0
# lBw0gg/wEPK3Rxjtp+iZfD9M269ewvPV2HM9Q07BMzlMjgK8QmguEOqEUUbi0b1q
# GFphAXPKZ6Je1yh2AuIzGHLXpyDwwvoSCtdjbwzJNmSLW6CmgyFdXzB0kZSU2LlQ
# +QuJYfM2BjUYhEfb3BvR/bLUHMVr9lxSUV0S2yW6r1AFemzFER1y7435UsSFF5PA
# PBXbGjfHCBUYP3irRbb1Hode2o+eFnJpxq57t7c+auIurQIDAQABo4IB3TCCAdkw
# EgYJKwYBBAGCNxUBBAUCAwEAATAjBgkrBgEEAYI3FQIEFgQUKqdS/mTEmr6CkTxG
# NSnPEP8vBO4wHQYDVR0OBBYEFJ+nFV0AXmJdg/Tl0mWnG1M1GelyMFwGA1UdIARV
# MFMwUQYMKwYBBAGCN0yDfQEBMEEwPwYIKwYBBQUHAgEWM2h0dHA6Ly93d3cubWlj
# cm9zb2Z0LmNvbS9wa2lvcHMvRG9jcy9SZXBvc2l0b3J5Lmh0bTATBgNVHSUEDDAK
# BggrBgEFBQcDCDAZBgkrBgEEAYI3FAIEDB4KAFMAdQBiAEMAQTALBgNVHQ8EBAMC
# AYYwDwYDVR0TAQH/BAUwAwEB/zAfBgNVHSMEGDAWgBTV9lbLj+iiXGJo0T2UkFvX
# zpoYxDBWBgNVHR8ETzBNMEugSaBHhkVodHRwOi8vY3JsLm1pY3Jvc29mdC5jb20v
# cGtpL2NybC9wcm9kdWN0cy9NaWNSb29DZXJBdXRfMjAxMC0wNi0yMy5jcmwwWgYI
# KwYBBQUHAQEETjBMMEoGCCsGAQUFBzAChj5odHRwOi8vd3d3Lm1pY3Jvc29mdC5j
# b20vcGtpL2NlcnRzL01pY1Jvb0NlckF1dF8yMDEwLTA2LTIzLmNydDANBgkqhkiG
# 9w0BAQsFAAOCAgEAnVV9/Cqt4SwfZwExJFvhnnJL/Klv6lwUtj5OR2R4sQaTlz0x
# M7U518JxNj/aZGx80HU5bbsPMeTCj/ts0aGUGCLu6WZnOlNN3Zi6th542DYunKmC
# VgADsAW+iehp4LoJ7nvfam++Kctu2D9IdQHZGN5tggz1bSNU5HhTdSRXud2f8449
# xvNo32X2pFaq95W2KFUn0CS9QKC/GbYSEhFdPSfgQJY4rPf5KYnDvBewVIVCs/wM
# nosZiefwC2qBwoEZQhlSdYo2wh3DYXMuLGt7bj8sCXgU6ZGyqVvfSaN0DLzskYDS
# PeZKPmY7T7uG+jIa2Zb0j/aRAfbOxnT99kxybxCrdTDFNLB62FD+CljdQDzHVG2d
# Y3RILLFORy3BFARxv2T5JL5zbcqOCb2zAVdJVGTZc9d/HltEAY5aGZFrDZ+kKNxn
# GSgkujhLmm77IVRrakURR6nxt67I6IleT53S0Ex2tVdUCbFpAUR+fKFhbHP+Crvs
# QWY9af3LwUFJfn6Tvsv4O+S3Fb+0zj6lMVGEvL8CwYKiexcdFYmNcP7ntdAoGokL
# jzbaukz5m/8K6TT4JDVnK+ANuOaMmdbhIurwJ0I9JZTmdHRbatGePu1+oDEzfbzL
# 6Xu/OHBE0ZDxyKs6ijoIYn/ZcGNTTY3ugm2lBRDBcQZqELQdVTNYs6FwZvKhggNN
# MIICNQIBATCB+aGB0aSBzjCByzELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hp
# bmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jw
# b3JhdGlvbjElMCMGA1UECxMcTWljcm9zb2Z0IEFtZXJpY2EgT3BlcmF0aW9uczEn
# MCUGA1UECxMeblNoaWVsZCBUU1MgRVNOOkE0MDAtMDVFMC1EOTQ3MSUwIwYDVQQD
# ExxNaWNyb3NvZnQgVGltZS1TdGFtcCBTZXJ2aWNloiMKAQEwBwYFKw4DAhoDFQB1
# rbmFkzS7qAK1Oav08AUnhbNIUqCBgzCBgKR+MHwxCzAJBgNVBAYTAlVTMRMwEQYD
# VQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNy
# b3NvZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMTHU1pY3Jvc29mdCBUaW1lLVN0YW1w
# IFBDQSAyMDEwMA0GCSqGSIb3DQEBCwUAAgUA7YyqvzAiGA8yMDI2MDQxNzEyNDkw
# M1oYDzIwMjYwNDE4MTI0OTAzWjB0MDoGCisGAQQBhFkKBAExLDAqMAoCBQDtjKq/
# AgEAMAcCAQACAgiwMAcCAQACAhT8MAoCBQDtjfw/AgEAMDYGCisGAQQBhFkKBAIx
# KDAmMAwGCisGAQQBhFkKAwKgCjAIAgEAAgMHoSChCjAIAgEAAgMBhqAwDQYJKoZI
# hvcNAQELBQADggEBABMrPVrJTYomANGjYEuXLvJRYbavCYgclnL9ZNxwAMglK1mV
# HNlAAthhoM9YLOmpg9cXzKb5Km5U5HoFUH5dUC/aMRy4xUT48ewZNrPNEVk8hcYG
# sAv4awIkRjUZ0ju0t/2LcUMiCKZHgmDbN7w+7upjnwRuAaeqRUJBZQzdItGB3caO
# UcZX4Q44sPGedi15ARJvjRfMm8Ss7VrTZmB59GwTgIUDiGtahRBVzB6XAHf/bINF
# NROAABRlJq3qJKg56zT11xuqV9KFmEuDSngTPlbTWsZq9nvE111ryJT/lXomGaoO
# KjWO/IjKLTw9imdR2ERR1I70FSK78CExmFxNqjoxggQNMIIECQIBATCBkzB8MQsw
# CQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9u
# ZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSYwJAYDVQQDEx1NaWNy
# b3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAxMAITMwAAAijwpYfX88geQAABAAACKDAN
# BglghkgBZQMEAgEFAKCCAUowGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEEMC8G
# CSqGSIb3DQEJBDEiBCA72JD6vPCYnCsFWWy4+7yFLe0EGoiIOrYMaIYaMpkSlzCB
# +gYLKoZIhvcNAQkQAi8xgeowgecwgeQwgb0EIFWxikZRYGNf4oEVZK1eT45H+3GQ
# 3/qxV75VwuBt+iLXMIGYMIGApH4wfDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldh
# c2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBD
# b3Jwb3JhdGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAgUENBIDIw
# MTACEzMAAAIo8KWH1/PIHkAAAQAAAigwIgQgAZO3UgTDvq/geuXCsy0DDQjFOMQh
# fPhH/8A3ISXXJ2MwDQYJKoZIhvcNAQELBQAEggIAP4+yXdP6YYMfZYrP6fMSC0Uf
# fB1eLPePL5gNSwlDhJAtCKFKy834HIxULkVmN3ncMMPopoP28RzjdbMubazdyNbC
# AeDfCtSwnf5XAEKkEw12ingGg/d+sGBNfWhK5KlKY45wE3DpKEnmjtPLLTtqQicl
# no5eGCDKjysZwy4yAhWJB/goDl7vx0JbjUt+nYKXjd8bd7a7g5Ck3i3/CNAD21GL
# uDGXsKPrLBqBHodqlALn4nTEdecplKm/M70pQF8+4xOEm1hH9n/OKi8su6pUfltH
# 0hhrQQEX2/tIYNm0HByhhPWTdVsUuAjfI0NGykooDrGNvEfk6VdX9cv+P/8O6gyZ
# lxV5rH+o8iRhxsF7V0dy1xw864i6Ks2GkPiFJUTinycZ8KfCORbQzxDUoCkK0QEJ
# bP6x7nNxGg6LvO2cEMsdSdMI+8i3i97RDfTQpU+uDUA9WAijt/crScA8l9yzFjyU
# FWKeRn+9hl9TiCtIzsJkxTcZ0SEcXS9elBFk/I9Gsv48wKeySeevM9lU/lq0ZCDn
# jnwnkxHTrwa/dtTjYUggs6jd6xIAVTvl41fMGZItv96nWSOITsx6RR4pkhAQtvnS
# 8onxOeqMOluIxN6zvRjuNUw+TpfL41A8MDjZLwe/gO1xjQJAoDE2RYGZ98UVwg6w
# tCJvyo5fZ+1ot2jgCS8=
# SIG # End signature block