Private/AzStackHci.Layer7.Helpers.ps1
|
# //////////////////////////////////////////////////////////////////////////// # Strict Mode v1 (PS 5.1 safe) - surfaces reads of uninitialised variables at runtime. Set-StrictMode -Version 1.0 # Helper function to extract CRL Distribution Point and OCSP responder URLs from # a leaf X509Certificate2. Used when the CRL/OCSP revocation check is offline, so # callers can surface the specific dependency URLs to the user and optionally # append dedicated test rows for them. # # Returns @{ CRL = @(<http urls>); OCSP = @(<http urls>) } (empty arrays if the # certificate has no such extensions). Non-http scheme entries (e.g. ldap://) # are filtered out as they are not applicable for Azure Local. # # This is a private helper for Test-Layer7Connectivity / Get-Layer7CertificateDetails. Function Get-CertRevocationEndpoints { [CmdletBinding()] param ( [Parameter(Mandatory=$true)] [System.Security.Cryptography.X509Certificates.X509Certificate2]$Certificate ) $result = @{ CRL = @(); OCSP = @() } try { foreach ($ext in $Certificate.Extensions) { if (-not $ext -or -not $ext.Oid) { continue } $oid = $ext.Oid.Value if ($oid -ne $script:CRL_DP_OID -and $oid -ne $script:AIA_OID) { continue } # Format(true) expands the ASN.1 into a human-readable multi-line string # containing 'URL=http://...' or 'URL=ldap://...' lines. $formatted = $ext.Format($true) $urlMatches = [regex]::Matches($formatted, 'URL\s*=\s*(\S+)', 'IgnoreCase') foreach ($m in $urlMatches) { $candidate = ($m.Groups[1].Value).Trim().TrimEnd(',', ';', ')', ']') if ([string]::IsNullOrWhiteSpace($candidate)) { continue } if ($candidate -notmatch '^https?://') { continue } # skip ldap://, etc. if ($oid -eq $script:CRL_DP_OID) { if ($result.CRL -notcontains $candidate) { $result.CRL += $candidate } } else { if ($result.OCSP -notcontains $candidate) { $result.OCSP += $candidate } } } } } catch { Write-Debug "Get-CertRevocationEndpoints: error parsing extensions - $($_.Exception.Message)" } return $result } # //////////////////////////////////////////////////////////////////////////// # Helper function to get certificate details for an endpoint # # Certificate chain validation flow: # 1. If HTTPS: calls Get-AzSHciSslCertificateChain to retrieve the full X509 chain (leaf, intermediate, root) # 2. Validates the leaf certificate using Test-Certificate -Policy SSL # 3. Then validates the leaf certificate against the specific DNS name # 4. If either validation fails: marks as SSL Inspection detected (sets $script:SSLInspectionDetected) # 5. Extracts Subject, Issuer, and Thumbprint for all three chain levels # 6. If HTTP (port 80): skips all cert checks and fills fields with "Port 80 - SSL not required" # 7. If cert retrieval fails: fills fields with "Error retrieving certificates" # # This is a private helper function for Test-Layer7Connectivity Function Get-Layer7CertificateDetails { param ( [Parameter(Mandatory=$true)] [string]$url, [Parameter(Mandatory=$true)] [string]$Layer7Status, [Parameter(Mandatory=$false)] [string]$ReturnLayer7Response = "" ) # Initialize return hashtable $CertDetails = @{ Layer7Status = $Layer7Status ReturnLayer7Response = $ReturnLayer7Response ReturnCertIssuer = "" ReturnCertSubject = "" ReturnCertThumbprint = "" ReturnCertIntIssuer = "" ReturnCertIntSubject = "" ReturnCertIntThumbprint = "" ReturnCertRootIssuer = "" ReturnCertRootSubject = "" ReturnCertRootThumbprint = "" } # Initialised here so the HTTP (port 80) path - which skips the HTTPS cert-retrieval # branch - never leaves these variables undefined when they are read below # ('if ($Certificates)' / 'elseif ($NoCertificatesRequired)') under Set-StrictMode -Version 1.0. $Certificates = $null $NoCertificatesRequired = $false try { # Check if the URL is HTTPS if($url -match "https://"){ # Get the certificate chain for the URL # The function will check for SSL inspection, and return the certificate issuer # The function will return the certificate issuer, thumbprint, and subject. # NOTE: function renamed in v0.6.6 from Get-SslCertificateChain to avoid a name # collision with AzStackHci.EnvironmentChecker (10.2509+) which exports a function # of the same name with a different parameter set. $Certificates = Get-AzSHciSslCertificateChain -url $url -AllowAutoRedirect $false -ErrorAction SilentlyContinue # Retry once if cert retrieval failed (intermittent backend pool server issues can cause TLS handshake timeouts) if(-not $Certificates){ Write-Debug "Certificate retrieval failed for '$url', retrying once..." $Certificates = Get-AzSHciSslCertificateChain -url $url -AllowAutoRedirect $false -ErrorAction SilentlyContinue } } else { # No certificate required for HTTP (port 80) $NoCertificatesRequired = $true Write-Verbose "Port 80: SSL certificate checks not required." } # Get Certificate details if($Certificates){ # Get the certificate chain elements array with bounds safety $chainCerts = $Certificates.ChainElements.Certificate [int]$chainCount = if ($chainCerts) { @($chainCerts).Count } else { 0 } # Check if the certificate chain is not null if($chainCount -gt 0){ Write-Verbose "Certificates Chain found with $chainCount parts" } else { # No certificate found Write-HostAzS "Error: No SSL Certificates found" -ForegroundColor Red } # Leaf certificate (index 0) - only access if chain has at least 1 element if($chainCount -ge 1){ # Check if the certificate subject is not null if(-not([string]::IsNullOrWhiteSpace($chainCerts[0].Subject))){ # Set the certificate subject to the variable $CertDetails.ReturnCertSubject = $chainCerts[0].Subject # Check the certificate using Test-Certificate, to check if the certificate is trusted for SSL # Check if the certificate is trusted for SSL if(Test-Certificate -Cert $chainCerts[0] -Policy SSL -ErrorAction SilentlyContinue -ErrorVariable certError -WarningAction SilentlyContinue){ # Certificate is valid for SSL Write-Verbose "Certificate is trusted for SSL: $($CertDetails.ReturnCertSubject)" # Check if the certificate is valid for the URL if(Test-Certificate -Cert $chainCerts[0] -Policy SSL -DNSName (Get-DomainFromURL -url $url).Domain -ErrorAction SilentlyContinue -ErrorVariable certError -WarningAction SilentlyContinue){ # Certificate is a valid for URL Write-Verbose "Certificate is a valid for endpoint: $url" } else { # Certificate is not valid for URL Write-HostAzS "Certificate is not valid for endpoint: $url" -ForegroundColor Red Write-HostAzS "Possible SSL Inspection detected, certificate is not trusted." -ForegroundColor Yellow Write-HostAzS "Returned certificate subject: '$($CertDetails.ReturnCertSubject)'" -ForegroundColor Yellow $CertDetails.Layer7Status = "Failed" $CertDetails.ReturnLayer7Response = $CertDetails.ReturnLayer7Response + " - SSL Inspection detected" $script:SSLInspectionDetected = $true $script:SSLInspectedURLs.Add($url) | Out-Null } } else { # Test-Certificate failed. Distinguish two cases: # (a) Chain is trusted locally but CRL/OCSP endpoint is unreachable -> CRL/OCSP offline (NOT SSL inspection) # (b) Chain is not trusted by local root store -> SSL inspection (or legitimately untrusted cert) # Perform a revocation-independent chain build against the captured leaf to tell them apart. $isRevocationOffline = $false $revNoneChain = $null try { $revNoneChain = [System.Security.Cryptography.X509Certificates.X509Chain]::new() $revNoneChain.ChainPolicy.RevocationMode = [System.Security.Cryptography.X509Certificates.X509RevocationMode]::NoCheck $revNoneChain.ChainPolicy.RevocationFlag = [System.Security.Cryptography.X509Certificates.X509RevocationFlag]::EntireChain $null = $revNoneChain.Build($chainCerts[0]) # If revocation-independent build succeeds, failure must be revocation-only if ($revNoneChain.ChainStatus.Count -eq 0) { # Confirm the original certError mentioned a revocation-offline token $certErrorText = ($certError | Out-String) foreach ($token in $script:CERT_CHAIN_STATUS_REVOCATION_OFFLINE) { if ($certErrorText -match [regex]::Escape($token)) { $isRevocationOffline = $true; break } } # Also inspect the revocation-enabled chain's status tokens as a second source of truth if (-not $isRevocationOffline) { $revFullChain = $null try { $revFullChain = [System.Security.Cryptography.X509Certificates.X509Chain]::new() $revFullChain.ChainPolicy.RevocationMode = [System.Security.Cryptography.X509Certificates.X509RevocationMode]::Online $revFullChain.ChainPolicy.RevocationFlag = [System.Security.Cryptography.X509Certificates.X509RevocationFlag]::EntireChain $null = $revFullChain.Build($chainCerts[0]) foreach ($cs in $revFullChain.ChainStatus) { if ($script:CERT_CHAIN_STATUS_REVOCATION_OFFLINE -contains $cs.Status.ToString()) { $isRevocationOffline = $true; break } } } catch { Write-Debug "Revocation-enabled chain build failed for '$url': $($_.Exception.Message)" } finally { if ($revFullChain) { $revFullChain.Dispose() } } } } } catch { Write-Debug "Revocation-independent chain build failed for '$url': $($_.Exception.Message)" } finally { if ($revNoneChain) { $revNoneChain.Dispose() } } if ($isRevocationOffline) { # Chain is trusted locally but CRL/OCSP is unreachable — mark as Failed with a distinct response Write-HostAzS "Certificate chain is trusted, but CRL/OCSP revocation check is offline for: $($CertDetails.ReturnCertSubject)" -ForegroundColor Yellow Write-HostAzS "This is NOT SSL Inspection — a CRL/OCSP endpoint used by the CA is unreachable from this host." -ForegroundColor Yellow $CertDetails.Layer7Status = "Failed" $CertDetails.ReturnLayer7Response = $CertDetails.ReturnLayer7Response + " - CRL/OCSP unreachable" if (-not ($script:CRLOfflineURLs -contains $url)) { $script:CRLOfflineURLs.Add($url) | Out-Null } # Extract CRL Distribution Points + OCSP responders from the leaf and # append (deduped) dependency rows to $script:Results so the existing # remaining-URLs loop tests them as first-class endpoints. try { $revEndpoints = Get-CertRevocationEndpoints -Certificate $chainCerts[0] $crlAdded = 0; $ocspAdded = 0 foreach ($crlUrl in $revEndpoints.CRL) { if ($crlAdded -ge $script:CRL_MAX_DP_PER_CERT) { break } Add-CrlDependencyRowToResults -Kind 'CRL' -DependencyURL $crlUrl -ParentURL $url $crlAdded++ } foreach ($ocspUrl in $revEndpoints.OCSP) { if ($ocspAdded -ge $script:CRL_MAX_OCSP_PER_CERT) { break } Add-CrlDependencyRowToResults -Kind 'OCSP' -DependencyURL $ocspUrl -ParentURL $url $ocspAdded++ } # Write the discovered revocation endpoints to the parent's Note so the # HTML/CSV/JSON output clearly links parent -> child row(s). $revSummaryParts = @() if ($revEndpoints.CRL.Count -gt 0) { $revSummaryParts += "CRL: $(($revEndpoints.CRL | Select-Object -First $script:CRL_MAX_DP_PER_CERT) -join ', ')" } if ($revEndpoints.OCSP.Count -gt 0) { $revSummaryParts += "OCSP: $(($revEndpoints.OCSP | Select-Object -First $script:CRL_MAX_OCSP_PER_CERT) -join ', ')" } if ($revSummaryParts.Count -gt 0) { $revSummary = $revSummaryParts -join ' | ' $CertDetails.ReturnLayer7Response = $CertDetails.ReturnLayer7Response + " [$revSummary]" } else { Write-Debug "CRL/OCSP offline for '$url' but no revocation endpoints found in leaf certificate extensions" } } catch { Write-Debug "Error extracting/adding CRL/OCSP dependency rows for '$url': $($_.Exception.Message)" } } else { # Certificate is not valid for SSL Write-HostAzS "Certificate is not trusted for SSL: $($CertDetails.ReturnCertSubject)" -ForegroundColor Red # SSL inspection detected Write-HostAzS "Possible SSL Inspection detected, certificate is not trusted." -ForegroundColor Yellow $CertDetails.Layer7Status = "Failed" $CertDetails.ReturnLayer7Response = $CertDetails.ReturnLayer7Response + " - SSL Inspection detected" $script:SSLInspectionDetected = $true $script:SSLInspectedURLs.Add($url) | Out-Null } } } else { # No certificate subject found $CertDetails.ReturnCertSubject = "No certificate common name found" } # Check if the certificate issuer is not null if(-not([string]::IsNullOrWhiteSpace($chainCerts[0].Issuer))){ # Set the certificate issuer to the variable $CertDetails.ReturnCertIssuer = $chainCerts[0].Issuer } else { # No certificate issuer found $CertDetails.ReturnCertIssuer = "No certificate issuer found" } # Check if the certificate thumbprint is not null if(-not([string]::IsNullOrWhiteSpace($chainCerts[0].Thumbprint))){ # Set the certificate thumbprint to the variable $CertDetails.ReturnCertThumbprint = $chainCerts[0].Thumbprint } else { # No certificate thumbprint found $CertDetails.ReturnCertThumbprint = "No certificate thumbprint found" } } else { $CertDetails.ReturnCertSubject = "No leaf certificate found in chain" $CertDetails.ReturnCertIssuer = "No leaf certificate found in chain" $CertDetails.ReturnCertThumbprint = "No leaf certificate found in chain" } # Intermediate certificate (index 1) - only access if chain has at least 2 elements if($chainCount -ge 2){ # Check if the intermediate certificate subject is not null if(-not([string]::IsNullOrWhiteSpace($chainCerts[1].Subject))){ # Set the certificate issuer to the variable $CertDetails.ReturnCertIntSubject = $chainCerts[1].Subject } else { # No intermediate certificate Subject found $CertDetails.ReturnCertIntSubject = "No intermediate certificate common name found" } # Check if the intermediate certificate issuer is not null if(-not([string]::IsNullOrWhiteSpace($chainCerts[1].Issuer))){ # Set the certificate issuer to the variable $CertDetails.ReturnCertIntIssuer = $chainCerts[1].Issuer } else { # No intermediate certificate issuer found $CertDetails.ReturnCertIntIssuer = "No intermediate certificate issuer found" } # Check if the intermediate certificate thumbprint is not null if(-not([string]::IsNullOrWhiteSpace($chainCerts[1].Thumbprint))){ # Set the certificate thumbprint to the variable $CertDetails.ReturnCertIntThumbprint = $chainCerts[1].Thumbprint } else { # No intermediate certificate thumbprint found $CertDetails.ReturnCertIntThumbprint = "No intermediate certificate thumbprint found" } } else { $CertDetails.ReturnCertIntSubject = "No intermediate certificate in chain" $CertDetails.ReturnCertIntIssuer = "No intermediate certificate in chain" $CertDetails.ReturnCertIntThumbprint = "No intermediate certificate in chain" } # Root certificate (index 2) - only access if chain has at least 3 elements if($chainCount -ge 3){ # Check if the root certificate subject is not null if(-not([string]::IsNullOrWhiteSpace($chainCerts[2].Subject))){ # Set the certificate issuer to the variable $CertDetails.ReturnCertRootSubject = $chainCerts[2].Subject } else { # No root certificate Subject found $CertDetails.ReturnCertRootSubject = "No root certificate common name found" } # Check if the root certificate issuer is not null if(-not([string]::IsNullOrWhiteSpace($chainCerts[2].Issuer))){ # Set the certificate issuer to the variable $CertDetails.ReturnCertRootIssuer = $chainCerts[2].Issuer } else { # No root certificate issuer found $CertDetails.ReturnCertRootIssuer = "No root certificate issuer found" } # Check if the root certificate thumbprint is not null if(-not([string]::IsNullOrWhiteSpace($chainCerts[2].Thumbprint))){ # Set the certificate thumbprint to the variable $CertDetails.ReturnCertRootThumbprint = $chainCerts[2].Thumbprint } else { # No root certificate thumbprint found $CertDetails.ReturnCertRootThumbprint = "No root certificate thumbprint found" } } else { $CertDetails.ReturnCertRootSubject = "No root certificate in chain" $CertDetails.ReturnCertRootIssuer = "No root certificate in chain" $CertDetails.ReturnCertRootThumbprint = "No root certificate in chain" } } elseif($NoCertificatesRequired){ # No certificate found, as the port is 80 $CertDetails.ReturnCertIssuer = "Port 80 - SSL not required" $CertDetails.ReturnCertSubject = "Port 80 - SSL not required" $CertDetails.ReturnCertThumbprint = "Port 80 - SSL not required" $CertDetails.ReturnCertIntIssuer = "Port 80 - SSL not required" $CertDetails.ReturnCertIntSubject = "Port 80 - SSL not required" $CertDetails.ReturnCertIntThumbprint = "Port 80 - SSL not required" $CertDetails.ReturnCertRootIssuer = "Port 80 - SSL not required" $CertDetails.ReturnCertRootSubject = "Port 80 - SSL not required" $CertDetails.ReturnCertRootThumbprint = "Port 80 - SSL not required" Write-Verbose "Port 80: SSL certificate checks not required." } else { # No certificate found, but expected $CertDetails.ReturnCertIssuer = "Error retrieving certificates" $CertDetails.ReturnCertSubject = "Error retrieving certificates" $CertDetails.ReturnCertThumbprint = "Error retrieving certificates" $CertDetails.ReturnCertIntIssuer = "Error retrieving certificates" $CertDetails.ReturnCertIntSubject = "Error retrieving certificates" $CertDetails.ReturnCertIntThumbprint = "Error retrieving certificates" $CertDetails.ReturnCertRootIssuer = "Error retrieving certificates" $CertDetails.ReturnCertRootSubject = "Error retrieving certificates" $CertDetails.ReturnCertRootThumbprint = "Error retrieving certificates" Write-HostAzS "Error retrieving certificates..." -ForegroundColor Red } } catch { # Catch any unexpected errors during certificate chain processing Write-HostAzS "Error processing certificate details for '$url': $($_.Exception.Message)" -ForegroundColor Red $CertDetails.ReturnCertIssuer = "Error: $($_.Exception.Message)" $CertDetails.ReturnCertSubject = "Error: $($_.Exception.Message)" $CertDetails.ReturnCertThumbprint = "Error: $($_.Exception.Message)" $CertDetails.ReturnCertIntIssuer = "Error: $($_.Exception.Message)" $CertDetails.ReturnCertIntSubject = "Error: $($_.Exception.Message)" $CertDetails.ReturnCertIntThumbprint = "Error: $($_.Exception.Message)" $CertDetails.ReturnCertRootIssuer = "Error: $($_.Exception.Message)" $CertDetails.ReturnCertRootSubject = "Error: $($_.Exception.Message)" $CertDetails.ReturnCertRootThumbprint = "Error: $($_.Exception.Message)" } return $CertDetails } # //////////////////////////////////////////////////////////////////////////// # Helper function to get certificate details for failed endpoints # This is a private helper function for Test-Layer7Connectivity Function Get-FailedEndpointCertificateDetails { param ( [Parameter(Mandatory=$true)] [string]$url ) # Initialize return hashtable $CertDetails = @{ ReturnCertIssuer = "" ReturnCertSubject = "" ReturnCertThumbprint = "" ReturnCertIntIssuer = "" ReturnCertIntSubject = "" ReturnCertIntThumbprint = "" ReturnCertRootIssuer = "" ReturnCertRootSubject = "" ReturnCertRootThumbprint = "" } # Check if the URL is HTTPS if($url -match "https://"){ # Do not attempt to check the certificate, as the Layer7Status is not "Success" Write-Debug "Unable to check certificates, as Layer7Status is 'Failed'" $CertDetails.ReturnCertIssuer = "Failed - Certificate not checked" $CertDetails.ReturnCertSubject = "Failed - Certificate not checked" $CertDetails.ReturnCertThumbprint = "Failed - Certificate not checked" $CertDetails.ReturnCertIntIssuer = "Failed - Certificate not checked" $CertDetails.ReturnCertIntSubject = "Failed - Certificate not checked" $CertDetails.ReturnCertIntThumbprint = "Failed - Certificate not checked" $CertDetails.ReturnCertRootIssuer = "Failed - Certificate not checked" $CertDetails.ReturnCertRootSubject = "Failed - Certificate not checked" $CertDetails.ReturnCertRootThumbprint = "Failed - Certificate not checked" } else { # No certificate required for HTTP (port 80) $CertDetails.ReturnCertIssuer = "Failed - (But Certificate not required for port 80)" $CertDetails.ReturnCertSubject = "Failed - (But Certificate not required for port 80)" $CertDetails.ReturnCertThumbprint = "Failed - (But Certificate not required for port 80)" $CertDetails.ReturnCertIntIssuer = "Failed - (But Certificate not required for port 80)" $CertDetails.ReturnCertIntSubject = "Failed - (But Certificate not required for port 80)" $CertDetails.ReturnCertIntThumbprint = "Failed - (But Certificate not required for port 80)" $CertDetails.ReturnCertRootIssuer = "Failed - (But Certificate not required for port 80)" $CertDetails.ReturnCertRootSubject = "Failed - (But Certificate not required for port 80)" $CertDetails.ReturnCertRootThumbprint = "Failed - (But Certificate not required for port 80)" } return $CertDetails } # //////////////////////////////////////////////////////////////////////////// # Pure decision predicate for the Auto-mode HEAD->GET fallback in Test-Layer7Connectivity. # Extracted so the fallback decision can be unit-tested deterministically without having to # fabricate a live System.Net.WebException response graph (HttpWebResponse has no usable public # constructor in PS 5.1, so the detection of $IsProtocolError stays inline in the caller and the # resulting boolean is passed in here). Function Test-HeadToGetFallbackRequired { <# .SYNOPSIS Decides whether an Auto-mode HEAD attempt should be retried as GET. .DESCRIPTION Returns $true when ALL of the following hold: - RequestMethod is 'Auto' (HEAD-first with a GET safety net), - a HEAD->GET fallback has not already been attempted for this URL, - this is the first request (RedirectCount -eq 1), not a redirected hop, AND at least one of: - the HEAD attempt returned (405) Method Not Allowed, - the HEAD attempt returned (400) Bad Request, - the HEAD attempt was classified Failed AND came back with an actual HTTP response (IsProtocolError). A HEAD carries no body and frequently omits the Server header, so Get-HttpStatusInterpretation cannot disambiguate a 4xx such as 403 Forbidden; GET returns those, so a GET retry yields an authoritative result. Transport-level failures (connect / DNS / timeout / TLS) are NOT protocol errors and so never trigger a GET retry — GET would fail identically, and those retries are handled elsewhere. .OUTPUTS [bool] #> [OutputType([bool])] param ( [Parameter(Mandatory = $true)] [string]$RequestMethod, [Parameter(Mandatory = $true)] [bool]$HeadFallbackAlreadyTried, [Parameter(Mandatory = $true)] [int]$RedirectCount, [Parameter(Mandatory = $false)] [string]$Layer7Response, [Parameter(Mandatory = $false)] [string]$Layer7Status, [Parameter(Mandatory = $false)] [bool]$IsProtocolError ) if ($RequestMethod -ne 'Auto') { return $false } if ($HeadFallbackAlreadyTried) { return $false } if ($RedirectCount -ne 1) { return $false } if ($Layer7Response -eq '(405) Method Not Allowed') { return $true } if ($Layer7Response -eq '(400) Bad Request') { return $true } if (($Layer7Status -eq 'Failed') -and $IsProtocolError) { return $true } return $false } # //////////////////////////////////////////////////////////////////////////// # Helper function to interpret HTTP status codes and exception responses # This is a private helper function for Test-Layer7Connectivity # It determines whether a failed web request should be treated as "Success" (endpoint reachable) # or "Failed" (endpoint unreachable) based on the response string, server headers, and endpoint URL. # Documentation: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status Function Get-HttpStatusInterpretation { param ( [Parameter(Mandatory=$true)] [string]$Layer7Response, [Parameter(Mandatory=$false)] [object]$IwrError, [Parameter(Mandatory=$false)] [string]$OriginalURL ) # Check if the response is a known value if($Layer7Response -eq "Unable to connect to the remote server"){ # Overwrite the Layer7Status to "Failed". return "Failed" } elseif($Layer7Response -eq "The operation has timed out"){ # Overwrite the Layer7Status to "Failed". return "Failed" } elseif($Layer7Response -like "The remote name could not be resolved*"){ # Overwrite the Layer7Status to "Failed". return "Failed" } elseif($Layer7Response -eq "(400) Bad Request"){ # Request was successful, but it was a bad request return "Success" } elseif($Layer7Response -eq "(401) Unauthorized"){ # Request was successful, but the request was not authorized return "Success" } elseif($Layer7Response -eq "(404) Not Found"){ # Request was successful, but the remote server returned no content from the root of the web server (404 page not found). return "Success" # Exception handling for 403 Forbidden responses } elseif($Layer7Response -eq "(403) Forbidden"){ # Additional connectivity test for 403 Forbidden, to check if the URL is accessible if($($IwrError.ErrorRecord.Exception.Response.Server) -like "Microsoft-IIS*") { # Microsoft IIS Server detected, valid connection return "Success" } elseif($($IwrError.ErrorRecord.Exception.Response.Server) -like "Microsoft-HTTPAPI*") { # Microsoft HTTPAPI Server detected, valid connection return "Success" } elseif($($IwrError.ErrorRecord.Exception.Response.Server) -like "AkamaiGHost*") { # AkamaiGHost detected, valid connection return "Success" } elseif($($IwrError.ErrorRecord.Exception.Response.Server) -like "AkamaiNetStorage*") { # AkamaiNetStorage detected, valid connection return "Success" } elseif($($IwrError.ErrorRecord.Exception.Response.Server) -like "Qwilt*") { # Qwilt detected, valid connection return "Success" } elseif($($IwrError.ErrorRecord.Exception.Response.Server) -like "AzureContainerRegistry") { # AzureContainerRegistry detected, valid connection return "Success" } elseif(($($IwrError.ErrorRecord.Exception.Response.Server) -eq "nginx") -and ($OriginalURL -eq "tlu.dl.delivery.mp.microsoft.com")) { # Windows Update endpoint 'tlu.dl.delivery.mp.microsoft.com', with Server "nginx" can intermittently return a 403 response # Set status to successful connection return "Success" } elseif(($($IwrError.ErrorRecord.Exception.Response.Server) -like "Amazon*") -and ($OriginalURL -eq "download.hitachivantara.com")) { # SBE endpoint: download.hitachivantara.com detected has Server "AmazonS3" # Set status to successful connection return "Success" } elseif($($IwrError.ErrorRecord.Exception.Response.StatusDescription) -eq "Forbidden - unexpected URL format") { # "Forbidden - unexpected URL format" detected, valid connection # Example URL: tlu.dl.delivery.mp.microsoft.com on port 80, which intermittently changes between "AkamaiGHost" and a null value for "$_.Exception.Response.Server" return "Success" } elseif($($IwrError.ErrorRecord.Exception.Response.Headers) -contains "x-azure-ref") { # Azure Front Door response detected, valid connection return "Success" } elseif($($IwrError.ErrorRecord.Exception.Response.Headers) -contains "X-MSEdge-Ref") { # Microsoft Edge response detected, valid connection return "Success" } elseif($($IwrError.ErrorRecord.Exception.Response.Headers) -contains "x-ms-request-id") { # Microsoft Edge response detected, valid connection return "Success" } elseif($($IwrError.ErrorRecord.Exception.Response.Headers) -contains "Location") { # Additional check for "Location" header in the response # This is used by some Microsoft services to indicate a redirect if($($IwrError.ErrorRecord.Exception.Response.Headers["Location"]) -like "*mscom.errorpage.failover.com*") { # Microsoft web server response detected, valid connection return "Success" } # Location header present but not a known Microsoft redirect - fall through to default Failed return "Failed" } elseif($($IwrError.ErrorRecord.Exception.Response.Server) -like "Zscaler*") { # Zscaler response detected, invalid connection # Known firewall / proxy device intercepting requests # Set status to Failed return "Failed" } elseif($IwrError.Message.ToString().Contains("You do not have permission to view this directory or page using the credentials that you supplied.")){ # Expected response from a couple of endpoints # Response: "403 - Forbidden: Access is denied." # Server Error # Server example: 'https://azurewatsonanalysis-prod.core.windows.net' and key vaults # Response: "403 - Forbidden: Access is denied. You do not have permission to view this directory or page using the credentials that you supplied." # You do not have permission to view this directory or page using the credentials that you supplied. return "Success" } else { # ////// All other 403 Forbidden responses /////// # Unknown, set Layer7Status to "Failed" return "Failed" } } elseif($Layer7Response -eq "(405) Method Not Allowed"){ # Overwrite the Layer7Status to "Failed". # https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/405 if(($($IwrError.ErrorRecord.Exception.Response.Server) -like "Microsoft*")) { # https://dataonsbe.azurewebsites.net/download returns a 405, valid connection return "Success" } else { return "Failed" } } elseif($Layer7Response -eq "(408) Request Timeout"){ # Overwrite the Layer7Status to "Failed". # https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/408 return "Failed" } elseif($Layer7Response -eq "(429) Too Many Requests"){ # Overwrite the Layer7Status to "Success", as this the server is responding with a "429" Too Many Requests # https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/429 return "Success" } elseif($Layer7Response -eq "(500) Internal Server Error"){ # The server returned a 500 error, but connectivity to the endpoint was established successfully. # This indicates the endpoint is reachable (firewall/proxy rules are correct), even though the service has an internal error. # https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/500 return "Success" } elseif($Layer7Response -eq "(502) Bad Gateway"){ # Overwrite the Layer7Status to "Failed", another device can respond. # https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/502 # Additional check for 502 Bad Gateway, to check for "Microsoft-Azure-Application-Gateway/v2" in the response if($($IwrError.ErrorRecord.Exception.Response.Server) -like 'Microsoft-Azure-Application-Gateway*') { Write-Verbose "Azure Application Gateway response detected, valid connection" return "Success" # Additional check for Arc Gateway response } elseif($IwrError.Message.ToString().Contains("Our services aren't available right now") -and (($OriginalURL -like "*.gw.arc.azure.com") -or ($OriginalURL -eq "dp.stackhci.azure.com"))) { Write-Verbose "Azure Front Door response detected, valid connection" return "Success" } elseif($($IwrError.ErrorRecord.Exception.Response.Headers) -contains "x-azure-ref") { # Azure Front Door response detected, valid connection even though the response is 502 Bad Gateway Write-Verbose "Azure Front Door response detected, valid connection" return "Success" } else { return "Failed" } } elseif($Layer7Response -eq "(503) Server Unavailable"){ # Overwrite the Layer7Status to "Success". # 503 status code indicates that the server is not ready to handle the request. # This can be due to the server being overloaded or down for maintenance. # https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status/503 return "Success" # Could not 'Could not establish trust relationship for the SSL/TLS secure channel' } elseif($Layer7Response -like "*Could not establish trust relationship for the SSL/TLS secure channel"){ # Overwrite the Layer7Status to "Failed" return "Failed" # ////// All other / unhandled exceptions treat as Failed ////// } else { # Overwrite the Layer7Status to "Failed" return "Failed" } } # //////////////////////////////////////////////////////////////////////////// # NOTE: A previous helper `Resolve-Layer7Redirect` was removed in v0.6.7 because: # 1. It was never called anywhere in the module (dead code), and # 2. It pushed raw STRINGS into $script:RedirectedResults, but the live redirect # path uses Add-RedirectedUrlToResults (Connectivity.Helpers.ps1) which pushes # properly-shaped [PSCustomObject] entries with .url / .Port / .RowID / etc. # Mixing the two shapes would have broken Phase-4 redirect-URL processing, the # RowID-keyed JSON output, and the parallel-fan-out merge dedupe added in v0.6.7 # (Merge-Layer7WorkerResult). Deleting the dead function eliminates that latent # polymorphism bug. If a future change needs to centralise redirect handling, # extend Add-RedirectedUrlToResults instead. # //////////////////////////////////////////////////////////////////////////// # SIG # Begin signature block # MIInSQYJKoZIhvcNAQcCoIInOjCCJzYCAQExDzANBglghkgBZQMEAgEFADB5Bgor # BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG # KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCC7957t1WGpcHR+ # BHnKzbXfubLMo73+5c7hHrKvYUpda6CCDLowggX1MIID3aADAgECAhMzAAACHU0Z # yE7XD1dIAAAAAAIdMA0GCSqGSIb3DQEBCwUAMFcxCzAJBgNVBAYTAlVTMR4wHAYD # VQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBD # b2RlIFNpZ25pbmcgUENBIDIwMjQwHhcNMjYwNDE2MTg1OTQzWhcNMjcwNDE1MTg1 # OTQzWjB0MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UE # BxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMR4wHAYD # VQQDExVNaWNyb3NvZnQgQ29ycG9yYXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IB # DwAwggEKAoIBAQDQvewXxx9gZZFC6Ys1WBay8BJ8kGA4JQnH5CMafqOASlTpK9H8 # o5ZXTXt0caVQTNMUPt445wXYD+dFtaKWTwDn1I52oUSrC9vJin1Gsqt+zyKJL5Dg # 3eQXbQNR61DmMy20GLTIO3SFed9Rfi/ophgCLGFLDR3r0KvHjwMb/jYWS0celV/4 # Lz27LfAekm8v9E5IXaeiXbAUYZKK090n4CVl3JBtbN+9DtI9SNu/yjvozW52/u7R # X/Ttpa/KDlpuokZ+Zcbvmtd9ur9gFLvZzh41o9MsE/clQtdaFWGvuo6Jua/ntpgk # ey3E5/vBFe+MJPG6phdnuo6r57ZudCudiI1bAgMBAAGjggGbMIIBlzAOBgNVHQ8B # Af8EBAMCB4AwHwYDVR0lBBgwFgYKKwYBBAGCN0wIAQYIKwYBBQUHAwMwHQYDVR0O # BBYEFH6QuMwqcPG0hQlQ6c5jCtTTLrVeMEUGA1UdEQQ+MDykOjA4MR4wHAYDVQQL # ExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xFjAUBgNVBAUTDTIzMDAxMis1MDc1NTkw # HwYDVR0jBBgwFoAUf1k/VCHarU/vBeXmo9ctBpQSCDEwYAYDVR0fBFkwVzBVoFOg # UYZPaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9jcmwvTWljcm9zb2Z0 # JTIwQ29kZSUyMFNpZ25pbmclMjBQQ0ElMjAyMDI0LmNybDBtBggrBgEFBQcBAQRh # MF8wXQYIKwYBBQUHMAKGUWh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMv # Y2VydHMvTWljcm9zb2Z0JTIwQ29kZSUyMFNpZ25pbmclMjBQQ0ElMjAyMDI0LmNy # dDAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEBCwUAA4ICAQBKTbYOjzwTG/DXGaz9 # s6+fQeaTtDcFmMY+5UyVFCyj7Pv+5i37qfX8lSL/tBIfYQfWsMuBQlfZurJD6r4H # VJ2CeH+1fgiq8dcHdVKoZ3Sa2qXoX3cq9iS8cVb06B7+5/XJ7I0OxHH9fDsvJ3T3 # w5V/ZtAIFmLrl+P0CtG+92uzRsn0nTbdFjOkLMLWPLAU3THohKRlSEMgFJpPkm5n # 5UAZ35xX6FWCrDLsSKb555bTifwa8mJBwdlof0bmfYidH+dxZ1FdDxvLnNl9zeKs # A4kejaaIqqIPguhwAti5Ql7BlTNoJNwxCvBmqW2MQLnCkYN/VVUsR3V2x/rcTNzo # Bf/Z/SpROvdaA2ZOOd1uioXJt3tdLQ7vHpqpib0KfWr/FWXW10q38VxfCnRQBqzb # SuztR7nEMuzX7Ck+B/XaPDXd1qh72+QYyB0Z2VzWmO9zsnb9Uq/dwu8LGeQqnyu6 # 7SDGACvnXii2fb9+US492VTnXSnFKyqwgzUyFMtZK1/sHYTv6bG4TtQUygQxTN+Z # V+aJIlKO2MqZ7bKrAnOzS9m6NgoTdWOq11bTOZwKlIEV/EhV9SWkDmdpR/hPPT2v # 6TEj4F8PT/zHjRezIU5c/DGlt/VhY/pK0XkJtEyMmmS1BMtjU/rqBZVMIm3dnxQs # /TBByr+Cf8Z1r7aifQVQ+WSqzjCCBr0wggSloAMCAQICEzMAAAA5O7Y3Gb8GHWcA # AAAAADkwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpX # YXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQg # Q29ycG9yYXRpb24xMjAwBgNVBAMTKU1pY3Jvc29mdCBSb290IENlcnRpZmljYXRl # IEF1dGhvcml0eSAyMDExMB4XDTI0MDgwODIwNTQxOFoXDTM2MDMyMjIyMTMwNFow # VzELMAkGA1UEBhMCVVMxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEo # MCYGA1UEAxMfTWljcm9zb2Z0IENvZGUgU2lnbmluZyBQQ0EgMjAyNDCCAiIwDQYJ # KoZIhvcNAQEBBQADggIPADCCAgoCggIBANgBnB7jOMeqlRYHNa265v4IY9fH8TKh # emHfPINe1gpLaV3dhg324WwH06LcHbpnsBukCDNitryo0dtS/EW6I/yEL/bLSY8h # KpbfQuWusBPr9qazYcDxCW/qnjb5JsI1s8bNOg3bVATvQVL4tcf03aTycsz8QeCd # M0l/yHRObJ9QqazM1r6VPEOJ7LL+uEEb73w6QCuhs89a1uv1zerOYMnsneRRwCbp # yW11IcggU0cRKDDq1pjVJzIbIF6+oiXXbReOsgeI8zu1FyQfK0fVkaya8SmVHQ/t # Of23mZ4W9k0Ri22QW9p3UgSC5OUDktKxxcCmGL6tXLfOGSWHIIV4YrTJTT6PNty5 # REojHJuZHArkF9VnHTERWoTjAzfI3kP+5b4alUdhgAZ7ttOu1bVnXfHaqPYl2rPs # 20ji03LOVWsh/radgE17es5hL+t6lV0eVHrVhsssROWJuz2MXMCt7iw7lFPG9LXK # Gjsmonn2gotGdHIuEg5JnJMJVmixd5LRlkmgYRZKzhxSCwyoGIq0PhaA7Y+VPct5 # pCHkijcIIDm0nlkK+0KyepolcqGm0T/GYQRMhHJlGOOmVQop36wUVUYklUy++vDW # eEgEo4s7hxN6mIbf2MSIQ/iIfMZgJxC69oukMUXCrOC3SkE/xIkgpfl22MM1itkZ # 35nNXkMolU1lAgMBAAGjggFOMIIBSjAOBgNVHQ8BAf8EBAMCAYYwEAYJKwYBBAGC # NxUBBAMCAQAwHQYDVR0OBBYEFH9ZP1Qh2q1P7wXl5qPXLQaUEggxMBkGCSsGAQQB # gjcUAgQMHgoAUwB1AGIAQwBBMA8GA1UdEwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAU # ci06AjGQQ7kUBU7h6qfHMdEjiTQwWgYDVR0fBFMwUTBPoE2gS4ZJaHR0cDovL2Ny # bC5taWNyb3NvZnQuY29tL3BraS9jcmwvcHJvZHVjdHMvTWljUm9vQ2VyQXV0MjAx # MV8yMDExXzAzXzIyLmNybDBeBggrBgEFBQcBAQRSMFAwTgYIKwYBBQUHMAKGQmh0 # dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2kvY2VydHMvTWljUm9vQ2VyQXV0MjAx # MV8yMDExXzAzXzIyLmNydDANBgkqhkiG9w0BAQwFAAOCAgEAFJQfOChP7onn6fLI # MKrSlN1WYKwDFgAddymOUO3FrM8d7B/W/iQ6DxXsDn7D5W4wMwYeLystcEqfkjz4 # NURRgazyMu5yRzQh4LqjA4tStTcJh1opExo7nn5PuPBYnbu0+THSuVHTe0VTTPVh # ily/piFrDo3axQ9P4C+Ol5yet+2gTfekICS5xS+cYfSIvgn0JksVBVMYVI5QFu/q # hnLhsEFEUzG8fvv0hjgkO+lkpV9ty6GkN4vdnd7ya6Q6aR9y34aiM1qmxaxBi6OU # nyNl6fkuun/diTFnYDLTppOkr/mg5WSfCiDVMNCxtj4wPKC5OmHm1DQIt/MNokbb # H3UGsFP1QbzsLocuSqLCvH09Io3fDPTmscR9Y75G4qX7RTX8AdBPo0I6OEojf39z # uFZt0qOHm65YWQE69cZM2ueE1MB05dNNgHK9gTE7zKvK/fg8B2qjW88MT/WF5V5u # vZGtqa9FSL2RazArA+rDPuf6JGYz4HpgMZHB4S6szWSKYBv0VisCzfxgeU+dquXW # 9bd0auYlOB58DPcOYKdc3Se94g+xL4pcEhbB54JOgAkwYTu/9dLeH2pDqeJZAABV # DWRQCaXfO5LgyKwKCLYXpigrZYCjUSBcr+Ve8PFWMhVTQl0v4q8J/AUmQN5W4n10 # 1cY2L4A7GTQG1h32HHAvfQESWP0xghnlMIIZ4QIBATBuMFcxCzAJBgNVBAYTAlVT # MR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jv # c29mdCBDb2RlIFNpZ25pbmcgUENBIDIwMjQCEzMAAAIdTRnITtcPV0gAAAAAAh0w # DQYJYIZIAWUDBAIBBQCgga4wGQYJKoZIhvcNAQkDMQwGCisGAQQBgjcCAQQwHAYK # KwYBBAGCNwIBCzEOMAwGCisGAQQBgjcCARUwLwYJKoZIhvcNAQkEMSIEIJIfcSc+ # UE6T6HT8DyLyIqfZMuiMk4BWMq6MdZSzl/PxMEIGCisGAQQBgjcCAQwxNDAyoBSA # EgBNAGkAYwByAG8AcwBvAGYAdKEagBhodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20w # DQYJKoZIhvcNAQEBBQAEggEAXczBpIjWasxYHal9eNbFhNWsAAC01fwTSKF4YnKz # UJWC7aW1ftrQeTxucECZ3EZtlJFP/oLN06JLcD0L4MezezMzrLCVogVUGGKTEhps # 1OhIEnl2J656gPPtjEOyfea2rPmEC210Wrk6HFJEtqYRnQ73vNGsTRmt6jOvCcEO # I3gCvJquf8ODuEqFFRlVcXeBlR5iwW+fP5Fq/PpnDSYWJbFRRG+s/6dZ/MOQRyfH # 8DpI7iDedxUAquNamsNS+cBQJNddSt1XpKmI0IZFZrArV0pHh/xZnn8zfWnOfiLt # wptdHQD65IIRwqPjJz7t01RVW8f7isNwbOEQiomLxjUmN6GCF5cwgheTBgorBgEE # AYI3AwMBMYIXgzCCF38GCSqGSIb3DQEHAqCCF3AwghdsAgEDMQ8wDQYJYIZIAWUD # BAIBBQAwggFSBgsqhkiG9w0BCRABBKCCAUEEggE9MIIBOQIBAQYKKwYBBAGEWQoD # ATAxMA0GCWCGSAFlAwQCAQUABCD6lCDNQCRSr1zvuFeLpSnjsqffV91fKN7yjobz # ghS1tAIGajGd5RLtGBMyMDI2MDcxNTE4MjYwMC44NTFaMASAAgH0oIHRpIHOMIHL # MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVk # bW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSUwIwYDVQQLExxN # aWNyb3NvZnQgQW1lcmljYSBPcGVyYXRpb25zMScwJQYDVQQLEx5uU2hpZWxkIFRT # UyBFU046MzcwMy0wNUUwLUQ5NDcxJTAjBgNVBAMTHE1pY3Jvc29mdCBUaW1lLVN0 # YW1wIFNlcnZpY2WgghHtMIIHIDCCBQigAwIBAgITMwAAAh86cGnkojAulQABAAAC # HzANBgkqhkiG9w0BAQsFADB8MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGlu # Z3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBv # cmF0aW9uMSYwJAYDVQQDEx1NaWNyb3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAxMDAe # Fw0yNjAyMTkxOTM5NTFaFw0yNzA1MTcxOTM5NTFaMIHLMQswCQYDVQQGEwJVUzET # MBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMV # TWljcm9zb2Z0IENvcnBvcmF0aW9uMSUwIwYDVQQLExxNaWNyb3NvZnQgQW1lcmlj # YSBPcGVyYXRpb25zMScwJQYDVQQLEx5uU2hpZWxkIFRTUyBFU046MzcwMy0wNUUw # LUQ5NDcxJTAjBgNVBAMTHE1pY3Jvc29mdCBUaW1lLVN0YW1wIFNlcnZpY2UwggIi # MA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDLO8XFOcfGqAqgiz0+AmQmFl3d # Z0aTG4UFJkqqNdMHy28DaheCBs6ONufukye5x42CWkzgRIy9kE2VWwEntZ8Zkgyr # ykC0bIqsID7+6FxguseTXf1Vwvm1D8104VmetoBJlJ4uGbuyJZUvXDx55nVh50yg # LTzZ24WkQsnPpvRZv2kPc39f3bhLyHVtnHsa/W/86Vrftd+AfFveA+qN/EY+XGj5 # c/DPMXCYECb0arYb92dDJWtwzpyBrp4gfHlgY1UEpc4l4AGELrf2J4wrxTzTW+SM # 8XhV1dOOPrYjD080IbZqL8B+IF0RCdn269YXrGK6QIHipznKZcCS8jN30YAHnTJV # N5Zzs6t/2YsqBGDquvDad7934FFTwzvUcO3VoIyd93XWwvP8/SCFVJh21W8oGQTp # tGHyly+Fl4henVMVZF1v6osOtirX8GFTiEhnf8nRdOg7yZYAJ0xy9CtDfbXaTn/c # f3Lq3N/GCYKFjC+5mUCE+AJhmxMuMdvSUGmKiAFdiPAjUTqsWWBBZJm0eCwgeGJF # mmQA+V7/98BKcE+gUL7O9eWRDQwKeAcvo6rxNv2Y4jKrHA6Z/wi3a/fKUhLCNZES # 8qGdrpDAm7qh+6FjYxytAbkiKM6uTNy/ULPlwtlYZoAJDDQP7eYCywwVbNTbHXRB # SS+NccC0sSB4W7U67wIDAQABo4IBSTCCAUUwHQYDVR0OBBYEFNk72sGDlH0r5Dwv # fGR5XwJI8B7bMB8GA1UdIwQYMBaAFJ+nFV0AXmJdg/Tl0mWnG1M1GelyMF8GA1Ud # HwRYMFYwVKBSoFCGTmh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMvY3Js # L01pY3Jvc29mdCUyMFRpbWUtU3RhbXAlMjBQQ0ElMjAyMDEwKDEpLmNybDBsBggr # BgEFBQcBAQRgMF4wXAYIKwYBBQUHMAKGUGh0dHA6Ly93d3cubWljcm9zb2Z0LmNv # bS9wa2lvcHMvY2VydHMvTWljcm9zb2Z0JTIwVGltZS1TdGFtcCUyMFBDQSUyMDIw # MTAoMSkuY3J0MAwGA1UdEwEB/wQCMAAwFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwgw # DgYDVR0PAQH/BAQDAgeAMA0GCSqGSIb3DQEBCwUAA4ICAQBlbu3IoynnPz0K1iPb # eNnsej2b15l5sdl2FAFBBGT9lRdc2gNV8LAIusPYHHhUvRDcsx4lbMNhVKPGu4TD # LaqNt/CI+SFtGuqdRLpVP1XE9cCLyKrKPpcJFJCqPpV+efoAtYBmIUQcxxwT7WIQ # 7gag8+rkKvrMkCoRqKS0mKv8J1sKfi85+G2uhZ/1RteSVdYZOZOj+Sb4wzonTCTj # 7EtgMN/BX35W5dTzd7wJdGepYkVi871dSrC2Tr1ZFzAR7S44drCWZpJ6phJabVNO # sNxFJKgSykugOGWzQ318Rr3MTPg2s3Bns+pUPVgMijd4bUOH2BlEsLMMwOcolTTZ # qg1HYrdY1jxpUAI9ipjBQRINL/O705Z+/f2LjNmJQooCVJVX24adpZ519SsfazGo # qXGt91bmqKo0fI09Il4sUHh4ih6rpiQDBlyL7vmvCejwVxYevY4qVwTZ/o3gvl+R # 0lFxYS9feIM4NeG0+WsDZ7jLci5MFeuNwosQY3z26Xg1oj0U9u+ncR9uTU+xBmJ8 # BtlCdhQ13RNMX5P+krRYPB3XCp9Jm6XaO1995q32AIZm1mzBGI6yHlviXaEC5TzG # iO1LXuPtXZU2X93oQJbMoe3v8+5CPKrQalGWyYuh2a3V1pwbj+W0FEmEFPpu8TI+ # qYO1IIQWUSRvFjXth5Ob02hMMjCCB3EwggVZoAMCAQICEzMAAAAVxedrngKbSZkA # AAAAABUwDQYJKoZIhvcNAQELBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpX # YXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQg # Q29ycG9yYXRpb24xMjAwBgNVBAMTKU1pY3Jvc29mdCBSb290IENlcnRpZmljYXRl # IEF1dGhvcml0eSAyMDEwMB4XDTIxMDkzMDE4MjIyNVoXDTMwMDkzMDE4MzIyNVow # fDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1Jl # ZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEmMCQGA1UEAxMd # TWljcm9zb2Z0IFRpbWUtU3RhbXAgUENBIDIwMTAwggIiMA0GCSqGSIb3DQEBAQUA # A4ICDwAwggIKAoICAQDk4aZM57RyIQt5osvXJHm9DtWC0/3unAcH0qlsTnXIyjVX # 9gF/bErg4r25PhdgM/9cT8dm95VTcVrifkpa/rg2Z4VGIwy1jRPPdzLAEBjoYH1q # UoNEt6aORmsHFPPFdvWGUNzBRMhxXFExN6AKOG6N7dcP2CZTfDlhAnrEqv1yaa8d # q6z2Nr41JmTamDu6GnszrYBbfowQHJ1S/rboYiXcag/PXfT+jlPP1uyFVk3v3byN # pOORj7I5LFGc6XBpDco2LXCOMcg1KL3jtIckw+DJj361VI/c+gVVmG1oO5pGve2k # rnopN6zL64NF50ZuyjLVwIYwXE8s4mKyzbnijYjklqwBSru+cakXW2dg3viSkR4d # Pf0gz3N9QZpGdc3EXzTdEonW/aUgfX782Z5F37ZyL9t9X4C626p+Nuw2TPYrbqgS # Uei/BQOj0XOmTTd0lBw0gg/wEPK3Rxjtp+iZfD9M269ewvPV2HM9Q07BMzlMjgK8 # QmguEOqEUUbi0b1qGFphAXPKZ6Je1yh2AuIzGHLXpyDwwvoSCtdjbwzJNmSLW6Cm # gyFdXzB0kZSU2LlQ+QuJYfM2BjUYhEfb3BvR/bLUHMVr9lxSUV0S2yW6r1AFemzF # ER1y7435UsSFF5PAPBXbGjfHCBUYP3irRbb1Hode2o+eFnJpxq57t7c+auIurQID # AQABo4IB3TCCAdkwEgYJKwYBBAGCNxUBBAUCAwEAATAjBgkrBgEEAYI3FQIEFgQU # KqdS/mTEmr6CkTxGNSnPEP8vBO4wHQYDVR0OBBYEFJ+nFV0AXmJdg/Tl0mWnG1M1 # GelyMFwGA1UdIARVMFMwUQYMKwYBBAGCN0yDfQEBMEEwPwYIKwYBBQUHAgEWM2h0 # dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMvRG9jcy9SZXBvc2l0b3J5Lmh0 # bTATBgNVHSUEDDAKBggrBgEFBQcDCDAZBgkrBgEEAYI3FAIEDB4KAFMAdQBiAEMA # QTALBgNVHQ8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAfBgNVHSMEGDAWgBTV9lbL # j+iiXGJo0T2UkFvXzpoYxDBWBgNVHR8ETzBNMEugSaBHhkVodHRwOi8vY3JsLm1p # Y3Jvc29mdC5jb20vcGtpL2NybC9wcm9kdWN0cy9NaWNSb29DZXJBdXRfMjAxMC0w # Ni0yMy5jcmwwWgYIKwYBBQUHAQEETjBMMEoGCCsGAQUFBzAChj5odHRwOi8vd3d3 # Lm1pY3Jvc29mdC5jb20vcGtpL2NlcnRzL01pY1Jvb0NlckF1dF8yMDEwLTA2LTIz # LmNydDANBgkqhkiG9w0BAQsFAAOCAgEAnVV9/Cqt4SwfZwExJFvhnnJL/Klv6lwU # tj5OR2R4sQaTlz0xM7U518JxNj/aZGx80HU5bbsPMeTCj/ts0aGUGCLu6WZnOlNN # 3Zi6th542DYunKmCVgADsAW+iehp4LoJ7nvfam++Kctu2D9IdQHZGN5tggz1bSNU # 5HhTdSRXud2f8449xvNo32X2pFaq95W2KFUn0CS9QKC/GbYSEhFdPSfgQJY4rPf5 # KYnDvBewVIVCs/wMnosZiefwC2qBwoEZQhlSdYo2wh3DYXMuLGt7bj8sCXgU6ZGy # qVvfSaN0DLzskYDSPeZKPmY7T7uG+jIa2Zb0j/aRAfbOxnT99kxybxCrdTDFNLB6 # 2FD+CljdQDzHVG2dY3RILLFORy3BFARxv2T5JL5zbcqOCb2zAVdJVGTZc9d/HltE # AY5aGZFrDZ+kKNxnGSgkujhLmm77IVRrakURR6nxt67I6IleT53S0Ex2tVdUCbFp # AUR+fKFhbHP+CrvsQWY9af3LwUFJfn6Tvsv4O+S3Fb+0zj6lMVGEvL8CwYKiexcd # FYmNcP7ntdAoGokLjzbaukz5m/8K6TT4JDVnK+ANuOaMmdbhIurwJ0I9JZTmdHRb # atGePu1+oDEzfbzL6Xu/OHBE0ZDxyKs6ijoIYn/ZcGNTTY3ugm2lBRDBcQZqELQd # VTNYs6FwZvKhggNQMIICOAIBATCB+aGB0aSBzjCByzELMAkGA1UEBhMCVVMxEzAR # BgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1p # Y3Jvc29mdCBDb3Jwb3JhdGlvbjElMCMGA1UECxMcTWljcm9zb2Z0IEFtZXJpY2Eg # T3BlcmF0aW9uczEnMCUGA1UECxMeblNoaWVsZCBUU1MgRVNOOjM3MDMtMDVFMC1E # OTQ3MSUwIwYDVQQDExxNaWNyb3NvZnQgVGltZS1TdGFtcCBTZXJ2aWNloiMKAQEw # BwYFKw4DAhoDFQBLIMg1P7sNuCXpmbH2IXT2tXeEEKCBgzCBgKR+MHwxCzAJBgNV # BAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4w # HAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMTHU1pY3Jvc29m # dCBUaW1lLVN0YW1wIFBDQSAyMDEwMA0GCSqGSIb3DQEBCwUAAgUA7gGrHDAiGA8y # MDI2MDcxNTA2NDU0OFoYDzIwMjYwNzE2MDY0NTQ4WjB3MD0GCisGAQQBhFkKBAEx # LzAtMAoCBQDuAascAgEAMAoCAQACAggoAgH/MAcCAQACAhVeMAoCBQDuAvycAgEA # MDYGCisGAQQBhFkKBAIxKDAmMAwGCisGAQQBhFkKAwKgCjAIAgEAAgMHoSChCjAI # AgEAAgMBhqAwDQYJKoZIhvcNAQELBQADggEBALyzDsINyB4nQnYBJ2mvp7qzyB4p # zJAseGKu0MaILg7n+STL4Ehwbjge+MNB7p8SRDRWwKljMBpM0jdzW/s1Gl22897q # mVuZn9NijoU1g/QhrqqK1CqaHp+oEAsthPgwxisc6sDVebDQlJGMdDLJX4KLzAfG # yrGQ8tEnc/n5Y1wFzKdY9VvqCC0pax2zEbxHsdYf2+Y749PqKWvXHgZsmg3SmChC # 70QwVvkDzyCpI0G5tYtWro1jEPLQb1odwsH1HeBlNxJBTYAJuPEPhWaFiwUUtFPp # UwEW3eJf8S6u/TwvxZSnMeWjMS3vzGX+baD9Hd++8Pggw85NmwxPPQMPJQAxggQN # MIIECQIBATCBkzB8MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQ # MA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9u # MSYwJAYDVQQDEx1NaWNyb3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAxMAITMwAAAh86 # cGnkojAulQABAAACHzANBglghkgBZQMEAgEFAKCCAUowGgYJKoZIhvcNAQkDMQ0G # CyqGSIb3DQEJEAEEMC8GCSqGSIb3DQEJBDEiBCAYr8bgl+uzap4Zm8yjY9usLnK/ # WDPWls5X+NCJBSEAXDCB+gYLKoZIhvcNAQkQAi8xgeowgecwgeQwgb0EILAkCt9W # kCsMtURkFu6TY0P3UXdRnCiYuPZhe3ykLfwUMIGYMIGApH4wfDELMAkGA1UEBhMC # VVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNV # BAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRp # bWUtU3RhbXAgUENBIDIwMTACEzMAAAIfOnBp5KIwLpUAAQAAAh8wIgQgrgbS3uO8 # aBikYEGQx4Zj9sg7NFFirrSReoLFkl2BtUAwDQYJKoZIhvcNAQELBQAEggIAOt6d # j34rlyej1C1i6sVbsleH2c/SXvf8EF+8UKGNaWD6F6sgfWXunEBnDKDoX36oEzRj # h+vlP3XNBuJm9lewFuz0tert2VVR3CQUZNNSGL2KH8nFpeTNjnLuqvs+yay3UvnY # SBdnt7d98eCoepFUA9DCON1sMYNUtW4kaPA82vasR2n88cX+sLZjbd87hKuFj2u3 # 2Hz/KhRmjJtnIgB3zzCMXES1PPHFuvG/9EiOLdXd/knW3Sojr/1hswTuOSVNrRWt # dZ1Kb4h43U0jr7LJl2fMT726+EesyYjJiNoRH810w7IX6z2zyzv4GSnircn8xFbE # 2GeK0SiGrXGXFjb3pFZiu1seZiJSA6/ADFeTSoTQ8kwBGgw+pZOzIqSCheehXqUs # csIxyYCihDIixn8AIvdny4vRBodS23DgM5gr0s8tAdQWeFJUH1Y62ntSJUrKUC74 # DYCMEfxIybIf1O3sHABp0cx9joXeKyAAIv2Bb4ZA0ArzIdzocnfnhpMYwpcrVroA # 81lfmkyE8ItKmia3dmqDx7tCSDcz631W3n0EayD/hAMcjuQnfhHYl7pputtGDl+b # yAGBlt+uM4XynsDW9edSPYgpx+gFPbOCEgY9eholw4T9ulteic7Y2VDWVvOn1+Gq # 30jzceinSnMh598Qr9053bu55me3gwd/uhhL9bQ= # SIG # End signature block |