Private/AzStackHci.Connectivity.Helpers.ps1
|
# //////////////////////////////////////////////////////////////////////////// # Strict Mode v1 (PS 5.1 safe) - surfaces reads of uninitialised variables at runtime. Set-StrictMode -Version 1.0 # Function to test version of PowerShell # Returns $true on Windows PowerShell 5.1 and $false on PowerShell 6/7+. # Uses PSEdition ('Desktop' = Windows PowerShell, 'Core' = PowerShell 6/7+) rather than a # version-string comparison: it is the intent-revealing signal for "must be Windows PowerShell" # and avoids the magic 5.1.99999.999 upper-bound constant. Callers own the user-facing message # (this helper only returns a boolean; it never throws or writes an error). Function Test-PowerShellVersion5 { param ( [Parameter(Mandatory = $false)] [bool]$NoVerboseOutput = $false ) if (-not $NoVerboseOutput) { Write-Verbose "PowerShell version $($PSVersionTable.PSVersion.ToString()) ($($PSVersionTable.PSEdition) edition) detected." } # 'Desktop' is Windows PowerShell (5.1); 'Core' is PowerShell 6/7+. return ($PSVersionTable.PSEdition -eq 'Desktop') } # //////////////////////////////////////////////////////////////////////////// # Classify a single connectivity result row into a stable, machine-readable # category (v0.6.7). Lets integrators branch on $row.ResultCategory instead of # brittle free-text matching on $row.Note (e.g. the old config-gap heuristic # -match 'WAS NOT USED|REQUIRED TO SPECIFY'). # # Categories (mutually exclusive, evaluated in priority order): # ConfigGap - a required parameter placeholder (e.g. -KeyVaultURL) was left # unsubstituted, so the row carries the 'WAS NOT USED' / # 'REQUIRED TO SPECIFY' Note marker. This is a setup/input gap, # NOT a real network fault. # PrivateLink - the endpoint resolved to an RFC1918 private IP (Private Link). # SSLInspected - an untrusted certificate chain was seen (possible SSL inspection). # Skipped - the endpoint was never tested. Covers (a) Arc-Gateway skip rows and # skip-list rows (Layer7Status/TCPStatus literally 'Skipped'), and # (b) untested wildcard-parent placeholder rows whose Layer7Status is # still the initial EMPTY string because they never entered the # DNS/TCP/Layer7 test loop. (A genuinely tested row ALWAYS ends with a # non-empty Layer7Status - Success / Failed / N/A / 'Invalid port:' - # so an empty/whitespace value unambiguously means "not tested".) # Success - Layer7Status reported Success. # ConnectivityFailure - any other terminal state where a test ran and did not pass # (Failed, or N/A from a DNS-resolution failure, or 'Invalid port:'). # # Precedence rationale: the three "diagnostic" categories (ConfigGap, PrivateLink, # SSLInspected) describe WHY a row is special and are evaluated ahead of the generic # Success / ConnectivityFailure split, because such rows usually ALSO carry # Layer7Status='Failed' which would otherwise mask the real cause. # # NOTE on CRL/OCSP revocation-offline rows: these keep Layer7Status='Failed' + a # '- CRL/OCSP unreachable' Layer7Response marker and are DELIBERATELY left as # ConnectivityFailure here (NOT given their own category) to keep the ResultCategory # enum stable for consumers. The run-level signal for them is the CRLOfflineDetected / # CRLOfflineURLs container NoteProperties on the returned ArrayList (and JSON summary), # mirroring how SSL inspection is ALSO surfaced as a container array - integrators that # want to treat revocation-offline as a softer WARNING branch on those fields. Function Get-ConnectivityResultCategory { [CmdletBinding()] [OutputType([string])] param( [Parameter(Mandatory = $true)] [psobject]$Row, # Run-level detection lists. Publish-Results passes a snapshot of the module-scope # state ($script:SSLInspectedURLs / $script:PrivateLinkDetectedArray); unit tests # pass synthetic lists. Default to empty so the helper is fully self-contained. [AllowNull()] [string[]]$SSLInspectedURLs = @(), [AllowNull()] [string[]]$PrivateLinkURLs = @() ) # Bare property reads are safe under StrictMode v1.0 (it throws only on uninitialised # VARIABLES, not absent object properties); cast to [string] to coalesce $null to ''. $note = [string]$Row.Note $url = [string]$Row.URL $l7 = [string]$Row.Layer7Status $tcp = [string]$Row.TCPStatus # URL normalisation for the detection-list lookups (steps 2 & 3). The two run-level arrays # store the URL in DIFFERENT shapes: # * $script:PrivateLinkDetectedArray stores the bare result-row .URL (host[/path]) - it is # populated by matching $_.URL in Test-AzureLocalConnectivity, so it already aligns. # * $script:SSLInspectedURLs stores the SCHEME-PREFIXED request URL ('https://host/path') # because Test-Layer7Connectivity adds the value it actually requested. # The result-row .URL is the bare host+path with no scheme, so a raw -contains against the # SSL list silently MISSES (an SSL-inspected row then falls through to ConnectivityFailure). # Strip a leading http(s):// and any trailing '/' from BOTH the row URL and every list entry # so the comparison is scheme- and trailing-slash-insensitive. (-contains is already # case-insensitive for strings.) $normalizeUrl = { param($u) (([string]$u) -replace '^\s*https?://', '').TrimEnd('/') } $urlNorm = & $normalizeUrl $url $sslNorm = @(@($SSLInspectedURLs) | ForEach-Object { & $normalizeUrl $_ }) $plNorm = @(@($PrivateLinkURLs) | ForEach-Object { & $normalizeUrl $_ }) # 1. Config gap — required parameter placeholder was never substituted. if ($note -match 'WAS NOT USED|REQUIRED TO SPECIFY') { return 'ConfigGap' } # 2. Private Link — endpoint resolved to an RFC1918 address. if ($plNorm -and ($plNorm -contains $urlNorm)) { return 'PrivateLink' } # 3. SSL inspection — untrusted certificate chain observed (possible TLS interception). # Two signals, set in lockstep by AzStackHci.Layer7.Helpers.ps1; either is authoritative: # (a) the bare row URL appears in the run-level $script:SSLInspectedURLs snapshot, OR # (b) the row's own Layer7Response carries the '- SSL Inspection detected' marker. # (b) is read straight off the row, so it survives any URL-shape drift between the snapshot # (which stores the scheme-prefixed REQUEST url, possibly a redirect target) and the row's # .URL field. A CRL/OCSP-offline row is reclassified away from this marker before this helper runs, so it # correctly does NOT match here and stays a ConnectivityFailure. $l7Response = [string]$Row.Layer7Response if (($sslNorm -and ($sslNorm -contains $urlNorm)) -or ($l7Response -match 'SSL Inspection detected')) { return 'SSLInspected' } # 4. Skipped / not-tested. Three cases: # (a) Arc-Gateway / skip-list rows -> TCPStatus or Layer7Status literally 'Skipped'. # (b) Untested wildcard-parent / placeholder rows that never entered the test loop # -> Layer7Status is still the initial EMPTY string. A tested row always has a # non-empty Layer7Status, so empty/whitespace here means "never tested", NOT a # failure. Guard with -not IsNullOrWhiteSpace($note) is unnecessary because the # ConfigGap Note marker is already handled at step 1 above. if (($tcp -like 'Skipped*') -or ($l7 -eq 'Skipped') -or [string]::IsNullOrWhiteSpace($l7)) { return 'Skipped' } # 5. Success. if ($l7 -eq 'Success') { return 'Success' } # 6. Everything else is a terminal connectivity failure (Failed / N/A / 'Invalid port:'). return 'ConnectivityFailure' } # //////////////////////////////////////////////////////////////////////////// # This function converts a hashtable to a string representation Function Convert-HashTableToString { param ( [Parameter(Mandatory = $true)] [System.Collections.Hashtable] $HashTable ) begin { # Write-Verbose "Starting Convert-HashTableToString function" } process { $HashString = "@{" $Keys = $HashTable.keys foreach ($Key in $Keys) { $v = $HashTable[$key] if ($key -match "\s") { $HashString += "`"$key`"" + "=" + "`"$v`"" + ";" } else { $HashString += $key + "=" + "`"$v`"" + ";" } } $HashString += "}" } # End of process block end { # Write-Debug "Completed Convert-HashTableToString function" return $HashString } } # //////////////////////////////////////////////////////////////////////////// # Function to extract domains from URLs Function Get-DomainFromURL { param ( [string]$url ) begin { # Write-Verbose "Starting Get-DomainFromURL function" } process { # Remove the protocol (http:// or https://) and extract the domain and port $url = $url -replace "^https?://", "" # Check if the URL contains a port number # If the URL contains a port number, extract it if ($url -match ":(\d+)$") { $port = [int]($url -replace ".*:(\d+)$", '$1') $url = $url -replace ":(\d+)$", "" } else { $port = $null } $domain = $url -split '/' | Select-Object -First 1 return @{ Domain = $domain; Port = $port } } end { # Write-Debug "Completed Get-DomainFromURL function" } } # //////////////////////////////////////////////////////////////////////////// # Helper function to normalize URL with protocol based on port # This is a private helper function for Test-Layer7Connectivity Function Initialize-WebRequestUrl { param ( [Parameter(Mandatory=$true)] [string]$url, [Parameter(Mandatory=$true)] [int]$port ) # Check if the port is 80 for HTTP or port 443, 8084 or 8443 for HTTPS and update the URL accordingly if ($port -eq $script:PORT_HTTPS -or $port -eq $script:PORT_HTTPS_ALT1 -or $port -eq $script:PORT_HTTPS_ALT2) { if($url -notmatch "^https://") { # If the URL does not start with https://, add it $url = "https://$url" } } elseif($port -eq $script:PORT_HTTP) { if($url -notmatch "^http://") { # If the URL does not start with http://, add it $url = "http://$url" } } else { # For custom ports, use http as the default if($url -notmatch "^http") { Write-Verbose "Custom port $port detected, using http as the default" $url = "http://$url" } } return $url } # //////////////////////////////////////////////////////////////////////////// # Helper function to register a redirected URL into the RedirectedResults array # Prevents duplicates by checking both RedirectedResults and Results arrays. # Called from the redirect-handling section of Test-Layer7Connectivity. function Get-ConnectivityResourceUrl { param ( [Parameter(Mandatory=$true)][string]$Url, [Parameter(Mandatory=$true)][int]$Port ) if ($Url -notmatch '^https?://') { $scheme = if ($Port -eq 80) { 'http' } else { 'https' } $Url = '{0}://{1}' -f $scheme, $Url } $builder = [System.UriBuilder]::new($Url) if ($builder.Scheme -notin @('http', 'https')) { throw 'Only HTTP and HTTPS resources are supported.' } $builder.Port = $Port $builder.Fragment = '' return $builder.Uri.AbsoluteUri } function Get-ConnectivityRowResourceUrl { param ([Parameter(Mandatory=$true)]$Row) $resource = [string]$Row.URL if ($Row.PSObject.Properties['redirect'] -and $Row.redirect) { $resource = [string]$Row.redirect } if ($resource.Contains('*')) { return '' } return Get-ConnectivityResourceUrl -Url $resource -Port $Row.Port } function Resolve-ConnectivityRedirectUrl { param ([Parameter(Mandatory=$true)][uri]$BaseUri, [Parameter(Mandatory=$true)][string]$Location) $target = [uri]::new($BaseUri, $Location) if ($target.Scheme -notin @('http', 'https')) { throw 'Only HTTP and HTTPS redirect targets are supported.' } return Get-ConnectivityResourceUrl -Url $target.AbsoluteUri -Port $target.Port } function Test-ConnectivityRedirectAdvisory { param ([Parameter(Mandatory=$true)]$Row) return ($Row.PSObject.Properties['RedirectDisposition'] -and $Row.RedirectDisposition -eq 'Advisory' -and $Row.PSObject.Properties['ResultCategory'] -and $Row.ResultCategory -eq 'ConnectivityFailure') } function Initialize-ConnectivityRedirectMetadata { param ([Parameter(Mandatory=$true)]$Row) $defaults = [ordered]@{ RedirectDisposition = 'NotRedirect' RedirectReason = '' RedirectOriginUrls = [string[]]@() RedirectTargetUrl = '' } foreach ($property in $defaults.Keys) { if (-not $Row.PSObject.Properties[$property]) { Add-Member -InputObject $Row -NotePropertyName $property -NotePropertyValue $defaults[$property] } } } function Merge-ConnectivityRedirectRow { param ([Parameter(Mandatory=$true)]$Row) $target = Get-ConnectivityRowResourceUrl -Row $Row $existing = $script:RedirectedResults | Where-Object { (Get-ConnectivityRowResourceUrl -Row $_) -ceq $target } | Select-Object -First 1 if ($existing) { foreach ($property in @('RedirectOriginUrls', 'RedirectParentUrls')) { if ($Row.PSObject.Properties[$property]) { $values = [string[]]@($Row.$property) if ($existing.PSObject.Properties[$property]) { $values += [string[]]@($existing.$property) } $unique = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::Ordinal) foreach ($value in $values) { [void]$unique.Add($value) } Add-Member -InputObject $existing -NotePropertyName $property -NotePropertyValue ([string[]]@($unique | Sort-Object -CaseSensitive)) -Force } } } else { [void]$script:RedirectedResults.Add($Row) } } function Update-ConnectivityRedirectDisposition { $inventory = @($script:Results | Where-Object { $_.Source -match '^(GitHub|Environment Checker)( Wildcard)?$' -or $_.Source -match '^(?!(?:Redirect for|Test for) ).+ SBE(?: Wildcard)?$' }) foreach ($result in $script:Results) { Initialize-ConnectivityRedirectMetadata -Row $result } foreach ($redirectRow in $script:RedirectedResults) { Initialize-ConnectivityRedirectMetadata -Row $redirectRow $target = [uri](Get-ConnectivityRowResourceUrl -Row $redirectRow) $redirectRow.RedirectTargetUrl = $target.AbsoluteUri $redirectRow.RedirectDisposition = 'Advisory' $redirectRow.RedirectReason = 'Destination requirement unverified; discovered while following redirects during connectivity testing. Review the ''RedirectOriginUrls'' column for source details.' $requiredTarget = @($inventory | Where-Object { $_.Port -eq $target.Port -and $target.Host -like (Get-DomainFromURL -url $_.URL).Domain }).Count -gt 0 if ($requiredTarget) { $redirectRow.RedirectDisposition = 'RequiredDependency' $redirectRow.RedirectReason = 'Destination matches an applicable inventory endpoint and port.' } } for ($pass = 0; $pass -le $script:RedirectedResults.Count; $pass++) { $changed = $false foreach ($redirectRow in $script:RedirectedResults) { if (-not $redirectRow.PSObject.Properties['RedirectParentUrls']) { continue } foreach ($parentUrl in $redirectRow.RedirectParentUrls) { $parent = [uri]$parentUrl foreach ($parentRow in @($script:RedirectedResults | Where-Object { $_.RedirectTargetUrl -ceq $parentUrl })) { foreach ($origin in $parentRow.RedirectOriginUrls) { if ($redirectRow.RedirectOriginUrls -cnotcontains $origin) { $redirectRow.RedirectOriginUrls = [string[]]@($redirectRow.RedirectOriginUrls + $origin) $changed = $true } } } $requiredParent = @($script:RedirectedResults | Where-Object { $_.RedirectTargetUrl -ceq $parentUrl -and $_.RedirectDisposition -eq 'RequiredDependency' }).Count -gt 0 $intentionalLink = ($parent.Host -eq 'aka.ms' -and $parent.AbsolutePath -ne '/') -or ($parent.Host -eq 'go.microsoft.com' -and $parent.AbsolutePath.TrimEnd('/') -eq '/fwlink' -and $parent.Query -match '(?i)[?&]linkid=\d+(?:&|$)') if ($intentionalLink) { $requiredParent = $requiredParent -or @($inventory | Where-Object { -not $_.IsWildcard -and (Get-ConnectivityRowResourceUrl -Row $_) -ceq $parentUrl }).Count -gt 0 } if ($requiredParent -and $redirectRow.RedirectDisposition -ne 'RequiredDependency') { $redirectRow.RedirectDisposition = 'RequiredDependency' $redirectRow.RedirectReason = 'Dependency of an applicable required redirect chain.' $changed = $true } } } if (-not $changed) { break } } } Function Add-RedirectedUrlToResults { param ( [Parameter(Mandatory=$true)] [string]$RedirectedURL, [Parameter(Mandatory=$true)] [string]$FullRedirectUrl, [Parameter(Mandatory=$true)] [int]$DestinationPort, [Parameter(Mandatory=$true)] [string]$OriginalURL, [Parameter(Mandatory=$true)] [int]$OriginalPort, [string]$ParentUrl ) Write-HostAzS "Redirected to '$FullRedirectUrl'" -ForegroundColor Yellow # Update the Note on the original result to show the redirect target (only if not already set) $ResultsToUpdate = $script:Results | Where-Object { $_.url -eq $OriginalURL -and ($_.Port -eq $OriginalPort) } ForEach ($ResultToUpdate in $ResultsToUpdate) { if (-not($ResultToUpdate.Note -like "Redirects to *")) { if ($ResultToUpdate.Note) { $ResultToUpdate.Note = "Redirects to '$($RedirectedURL)' - $($ResultToUpdate.Note)" } else { $ResultToUpdate.Note = "Redirects to '$($RedirectedURL)'" } } } if ([string]::IsNullOrWhiteSpace($RedirectedURL)) { Write-Warning "Redirected URL is null for $FullRedirectUrl, skipping" return } $originUrl = Get-ConnectivityResourceUrl -Url $OriginalURL -Port $OriginalPort if (-not $ParentUrl) { $ParentUrl = $originUrl } $targetUrl = Get-ConnectivityResourceUrl -Url $FullRedirectUrl -Port $DestinationPort $OriginalResult = @($script:Results) + @($script:RedirectedResults) | Where-Object { -not $_.IsWildcard -and (Get-ConnectivityRowResourceUrl -Row $_) -ceq $originUrl } | Select-Object -First 1 $originUrls = [string[]]@($originUrl) $originalSource = 'Connectivity probe' if ($OriginalResult) { $originalSource = $OriginalResult.Source if ($OriginalResult.PSObject.Properties['RedirectOriginUrls'] -and $OriginalResult.RedirectOriginUrls.Count) { $originUrls = [string[]]@($OriginalResult.RedirectOriginUrls) } } Merge-ConnectivityRedirectRow -Row ([PSCustomObject]@{ RowID = 0 MachineName = $env:COMPUTERNAME url = $RedirectedURL redirect = $targetUrl Port = $DestinationPort ArcGateway = $false IsWildcard = $false Source = "Redirect for $originalSource" Note = "Redirected URL from '$originUrl'; destination requirement evaluated separately." RedirectDisposition = 'Advisory' RedirectReason = 'Destination requirement unverified; discovered while following redirects during connectivity testing. Review the ''RedirectOriginUrls'' column for source details.' RedirectOriginUrls = $originUrls RedirectTargetUrl = $targetUrl RedirectParentUrls = [string[]]@($ParentUrl) TCPStatus = "" IPAddress = "" Layer7Status = "" Layer7Response = "" Layer7ResponseTime = "" CertificateSubject = "" CertificateIssuer = "" CertificateThumbprint = "" IntermediateCertificateIssuer = "" IntermediateCertificateSubject = "" IntermediateCertificateThumbprint = "" RootCertificateIssuer = "" RootCertificateSubject = "" RootCertificateThumbprint = "" }) Update-ConnectivityRedirectDisposition } # //////////////////////////////////////////////////////////////////////////// # Helper function to register a CRL / OCSP dependency URL as its own row in # $script:Results. Called when Get-Layer7CertificateDetails classifies an HTTPS # endpoint as "CRL/OCSP unreachable" (trusted chain, revocation offline). # # Dedupe strategy (two tiers): # - OCSP: skip if ANY existing row already covers the same host+port=80 # (the OCSP protocol uses a single host, so host match = full coverage) # - CRL: fall through to exact-URL match — different .crl files on the same # host can be blocked independently by path-based proxy filtering # When an identical URL was already added by a previous parent, the existing # row's Source is extended to list both parents. # # Rows are appended directly to $script:Results with Layer7Status = "" so the # existing remainingUrls loop in Test-AzureLocalConnectivity picks them up and # tests them as first-class endpoints. Function Add-CrlDependencyRowToResults { [CmdletBinding()] param ( [Parameter(Mandatory=$true)][ValidateSet('CRL','OCSP')][string]$Kind, [Parameter(Mandatory=$true)][string]$DependencyURL, [Parameter(Mandatory=$true)][string]$ParentURL ) if ([string]::IsNullOrWhiteSpace($DependencyURL)) { return } $parentDomain = (Get-DomainFromURL -url $ParentURL).Domain $depDomain = (Get-DomainFromURL -url $DependencyURL).Domain if ([string]::IsNullOrWhiteSpace($depDomain)) { Write-Debug "Add-CrlDependencyRowToResults: cannot parse domain from '$DependencyURL', skipping" return } # Tier 1 — dedupe against existing rows if ($Kind -eq 'OCSP') { # Host-level dedupe is sufficient for OCSP (single-host protocol) $existing = $script:Results | Where-Object { ((Get-DomainFromURL -url $_.URL).Domain -eq $depDomain) -and ($_.Port -eq $script:PORT_HTTP) } | Select-Object -First 1 if ($existing) { Write-Debug "Add-CrlDependencyRowToResults: OCSP host '$depDomain' already in Results (row URL '$($existing.URL)'), skipping duplicate" return } } else { # CRL — exact URL dedupe (different .crl paths on same host can be independently blocked) $existingSame = $script:Results | Where-Object { ($_.URL -eq $DependencyURL) -and ($_.Port -eq $script:PORT_HTTP) } | Select-Object -First 1 if ($existingSame) { # Same CRL URL already added — extend Source to reflect shared parent if ($existingSame.Source -notmatch [regex]::Escape($parentDomain)) { $existingSame.Source = "$($existingSame.Source); $parentDomain" } Write-Debug "Add-CrlDependencyRowToResults: CRL URL '$DependencyURL' already present — appended parent '$parentDomain' to Source" return } } # Tier 2 — append new row (Layer7Status="" so the remaining-URLs loop tests it) $sourcePrefix = if ($Kind -eq 'CRL') { 'CRL dependency for' } else { 'OCSP dependency for' } $script:Results.Add([PSCustomObject]@{ RowID = 0 MachineName = $env:COMPUTERNAME URL = $DependencyURL Port = $script:PORT_HTTP ArcGateway = $false IsWildcard = $false Source = "$sourcePrefix $parentDomain" Note = "Required for certificate revocation check of https://$parentDomain (HTTP port 80 must be reachable)" TCPStatus = "" IPAddress = "" Layer7Status = "" Layer7Response = "" Layer7ResponseTime = "" CertificateIssuer = "" CertificateSubject = "" CertificateThumbprint = "" IntermediateCertificateIssuer = "" IntermediateCertificateSubject = "" IntermediateCertificateThumbprint = "" RootCertificateIssuer = "" RootCertificateSubject = "" RootCertificateThumbprint = "" }) | Out-Null Write-Debug "Add-CrlDependencyRowToResults: appended $Kind dependency row '$DependencyURL' for parent '$parentDomain'" } # //////////////////////////////////////////////////////////////////////////// # Helper function to initialize ServerCertificateValidationCallback for SSL bypass # This is a private helper function for Test-Layer7Connectivity Function Initialize-CertificateCallback { # IMPORTANT: This sets a PROCESS-WIDE callback on ServicePointManager.ServerCertificateValidationCallback # that accepts all certificates. This is intentional — the module needs to connect to endpoints even when # SSL inspection replaces certificates, so it can detect and report SSL inspection to the user. # The callback is reset to $null in the end block of Test-Layer7Connectivity and Test-AzureLocalConnectivity. # Check if ServerCertificateValidationCallback class is already defined if (-not ([System.Management.Automation.PSTypeName]'ServerCertificateValidationCallback').Type) { # Define the ServerCertificateValidationCallback class # This class is used to bypass SSL certificate validation, to allow for SSL inspection detection $CertCallback = @" using System; using System.Net; using System.Net.Security; using System.Security.Cryptography.X509Certificates; public class ServerCertificateValidationCallback { public static void Ignore() { if(ServicePointManager.ServerCertificateValidationCallback == null) { ServicePointManager.ServerCertificateValidationCallback += delegate ( Object obj, X509Certificate certificate, X509Chain chain, SslPolicyErrors errors ) { return true; }; } } } "@ Add-Type $CertCallback } # Call the Ignore method to bypass SSL certificate validation. # PRECONDITION: the C# Ignore() only installs the accept-all delegate when # ServicePointManager.ServerCertificateValidationCallback is currently $null. If the # caller (or another loaded module) already set a callback, the bypass is NOT installed, # so SSL-inspection detection can be inconsistent in shared sessions. The caller # (Test-Layer7Connectivity / Test-AzureLocalConnectivity) captures and restores the # original callback in its finally block, so this never leaks across function calls. [ServerCertificateValidationCallback]::Ignore() } # //////////////////////////////////////////////////////////////////////////// # Helper to set all connectivity result fields on a URL object to skip/N/A values. # Used when a URL is skipped, wildcarded, or DNS resolution fails. Function Set-UrlObjectSkipFields { param( [Parameter(Mandatory)][PSCustomObject]$UrlObject, [Parameter(Mandatory)][string]$TCPStatus, [Parameter(Mandatory)][string]$Layer7Status, [string]$IPAddress = "N/A", [string]$Layer7Response = "N/A", [string]$Layer7ResponseTime = "N/A" ) $UrlObject.TCPStatus = $TCPStatus $UrlObject.IPAddress = $IPAddress $UrlObject.Layer7Status = $Layer7Status $UrlObject.Layer7Response = $Layer7Response $UrlObject.Layer7ResponseTime = $Layer7ResponseTime $UrlObject.CertificateIssuer = "N/A" $UrlObject.CertificateSubject = "N/A" $UrlObject.CertificateThumbprint = "N/A" $UrlObject.IntermediateCertificateIssuer = "N/A" $UrlObject.IntermediateCertificateSubject = "N/A" $UrlObject.IntermediateCertificateThumbprint = "N/A" $UrlObject.RootCertificateIssuer = "N/A" $UrlObject.RootCertificateSubject = "N/A" $UrlObject.RootCertificateThumbprint = "N/A" } # //////////////////////////////////////////////////////////////////////////// # Helper to copy connectivity test results from an Invoke-EndpointConnectivityTest # result hashtable to a URL result object. Function Copy-ConnectivityResultsToUrlObject { param( [Parameter(Mandatory)][PSCustomObject]$UrlObject, [Parameter(Mandatory)][hashtable]$TestResult ) $UrlObject.TCPStatus = $TestResult.TCPStatus foreach ($field in @('TCPDiagnostics', 'DNSDiagnostics', 'DNSFailureCode', 'DNSResolutionStatus')) { Add-Member -InputObject $UrlObject -NotePropertyName $field -NotePropertyValue $TestResult[$field] -Force } $UrlObject.IPAddress = $TestResult.IPAddress $UrlObject.Layer7Status = $TestResult.Layer7Status $UrlObject.Layer7Response = $TestResult.Layer7Response $UrlObject.Layer7ResponseTime = $TestResult.Layer7ResponseTime $UrlObject.CertificateIssuer = $TestResult.CertificateIssuer $UrlObject.CertificateSubject = $TestResult.CertificateSubject $UrlObject.CertificateThumbprint = $TestResult.CertificateThumbprint $UrlObject.IntermediateCertificateIssuer = $TestResult.CertificateIntermediateIssuer $UrlObject.IntermediateCertificateSubject = $TestResult.CertificateIntermediateSubject $UrlObject.IntermediateCertificateThumbprint = $TestResult.CertificateIntermediateThumbprint $UrlObject.RootCertificateIssuer = $TestResult.CertificateRootIssuer $UrlObject.RootCertificateSubject = $TestResult.CertificateRootSubject $UrlObject.RootCertificateThumbprint = $TestResult.CertificateRootThumbprint } # SIG # Begin signature block # MIInOgYJKoZIhvcNAQcCoIInKzCCJycCAQExDzANBglghkgBZQMEAgEFADB5Bgor # BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG # KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCNHlxwjKyG8RWW # wrcwbKfhVyyB+sGrqYZ7ddE7PdkCUqCCDMkwggYEMIID7KADAgECAhMzAAACHPrN # xZvoL37EAAAAAAIcMA0GCSqGSIb3DQEBCwUAMFcxCzAJBgNVBAYTAlVTMR4wHAYD # VQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBD # b2RlIFNpZ25pbmcgUENBIDIwMjQwHhcNMjYwNDE2MTg1OTQxWhcNMjcwNDE1MTg1 # OTQxWjB0MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UE # BxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMR4wHAYD # VQQDExVNaWNyb3NvZnQgQ29ycG9yYXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IB # DwAwggEKAoIBAQDVsZfgOKmM31HPfoWOoNEiw0SlCiIxUMC0I9NMWbucKOw/e9lP # oAoehQVu6SG65V4EPzrYsnBnFPNoi4/HoOdjhz1qkrEt4I6tEcxXU6oOeY9zGveC # /3iBeuhLYxM3M/PkcUoebF+Nednm8OkdSPoDu8imViHPQq/8CQUu0WRR4rE+dMRf # rpVqfmNi2qWCX94T4MsepijGVkwE//tJg0ryAiYdHT34LSnlG/RSBZmQRGWZ5g8j # qnKjRParSqMft1gvjuUTVgtWNZfgcLFSK5Wa0myrq8OPcgTGGsRgun+tnSS+IxDT # xVsAPH1OzvPjwomguByhUe/OcvUN0D5Wmp7xAgMBAAGjggGqMIIBpjAOBgNVHQ8B # Af8EBAMCB4AwHwYDVR0lBBgwFgYKKwYBBAGCN0wIAQYIKwYBBQUHAwMwHQYDVR0O # BBYEFNoH7a2YDjOSwpkp6DHcmUS7J+0yMFQGA1UdEQRNMEukSTBHMS0wKwYDVQQL # EyRNaWNyb3NvZnQgSXJlbGFuZCBPcGVyYXRpb25zIExpbWl0ZWQxFjAUBgNVBAUT # DTIzMDAxMis1MDc1NjkwHwYDVR0jBBgwFoAUf1k/VCHarU/vBeXmo9ctBpQSCDEw # YAYDVR0fBFkwVzBVoFOgUYZPaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9w # cy9jcmwvTWljcm9zb2Z0JTIwQ29kZSUyMFNpZ25pbmclMjBQQ0ElMjAyMDI0LmNy # bDBtBggrBgEFBQcBAQRhMF8wXQYIKwYBBQUHMAKGUWh0dHA6Ly93d3cubWljcm9z # b2Z0LmNvbS9wa2lvcHMvY2VydHMvTWljcm9zb2Z0JTIwQ29kZSUyMFNpZ25pbmcl # MjBQQ0ElMjAyMDI0LmNydDAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEBCwUAA4IC # AQAUnEqhaRXe0T3hIJjvdQErEkrA/7bByjn6t5IArODkkRjzkYwtKMc2yYj2quaN # rLutWw2YZcngKPy1b71YyDJQTy4NDRwaSh9Tw5thrk3NmcPrAHia5vtcBJ1CgtKK # 7mQbIcQ22d/N3813ayCDDFewu1+jsZmX+r/aTEqaOM4TVxVtRSkuCy8nAXKuChOK # Li/zA4XuH8iEYqIsj2YoNaeSxVmeGiERXpKdo3dDmYi0kO5w2D8VS4c3+9h6gElY # BaAAg/dYErBg27qT3vv0zRDJhJufvCNylA8S7/+8H5E/PV5cng6na9VV/w9OV3qu # uND6zdGa2EX38Glp50F9AIQk3p2xXmcvorDeM4XJ7UlWYBi6g80J1SSOQnInCYFE # msfUNn3+1AaTJKSJL83quKArTac2pKhu0Yzzzrzo6HrsRiQKzpnRBb1/dMa6P3hz # 75XbMRBctNsFhZC07WCmjExdLg2eHW5uV0TY8D5+6wozJf7vF3+WHkYPO85Z+BC6 # U4FkNbYNycZ9cE4j1tXRdyDCfml6c0HWPHjNVDObrv9lKt3qUqFpX38VCqVCyNOO # 1UcXfQiVjJw32U2WUKZjt/neJKHEBsm9kFsLuWzkQ53+qcaSaytmsCnk2gOglrlD # 5d3kKyvvAw+rzm0lT8K38P6PLxfZQHhu4W8dV7Av8N2ZmDCCBr0wggSloAMCAQIC # EzMAAAA5O7Y3Gb8GHWcAAAAAADkwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYT # AlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYD # VQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xMjAwBgNVBAMTKU1pY3Jvc29mdCBS # b290IENlcnRpZmljYXRlIEF1dGhvcml0eSAyMDExMB4XDTI0MDgwODIwNTQxOFoX # DTM2MDMyMjIyMTMwNFowVzELMAkGA1UEBhMCVVMxHjAcBgNVBAoTFU1pY3Jvc29m # dCBDb3Jwb3JhdGlvbjEoMCYGA1UEAxMfTWljcm9zb2Z0IENvZGUgU2lnbmluZyBQ # Q0EgMjAyNDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANgBnB7jOMeq # lRYHNa265v4IY9fH8TKhemHfPINe1gpLaV3dhg324WwH06LcHbpnsBukCDNitryo # 0dtS/EW6I/yEL/bLSY8hKpbfQuWusBPr9qazYcDxCW/qnjb5JsI1s8bNOg3bVATv # QVL4tcf03aTycsz8QeCdM0l/yHRObJ9QqazM1r6VPEOJ7LL+uEEb73w6QCuhs89a # 1uv1zerOYMnsneRRwCbpyW11IcggU0cRKDDq1pjVJzIbIF6+oiXXbReOsgeI8zu1 # FyQfK0fVkaya8SmVHQ/tOf23mZ4W9k0Ri22QW9p3UgSC5OUDktKxxcCmGL6tXLfO # GSWHIIV4YrTJTT6PNty5REojHJuZHArkF9VnHTERWoTjAzfI3kP+5b4alUdhgAZ7 # ttOu1bVnXfHaqPYl2rPs20ji03LOVWsh/radgE17es5hL+t6lV0eVHrVhsssROWJ # uz2MXMCt7iw7lFPG9LXKGjsmonn2gotGdHIuEg5JnJMJVmixd5LRlkmgYRZKzhxS # CwyoGIq0PhaA7Y+VPct5pCHkijcIIDm0nlkK+0KyepolcqGm0T/GYQRMhHJlGOOm # VQop36wUVUYklUy++vDWeEgEo4s7hxN6mIbf2MSIQ/iIfMZgJxC69oukMUXCrOC3 # SkE/xIkgpfl22MM1itkZ35nNXkMolU1lAgMBAAGjggFOMIIBSjAOBgNVHQ8BAf8E # BAMCAYYwEAYJKwYBBAGCNxUBBAMCAQAwHQYDVR0OBBYEFH9ZP1Qh2q1P7wXl5qPX # LQaUEggxMBkGCSsGAQQBgjcUAgQMHgoAUwB1AGIAQwBBMA8GA1UdEwEB/wQFMAMB # Af8wHwYDVR0jBBgwFoAUci06AjGQQ7kUBU7h6qfHMdEjiTQwWgYDVR0fBFMwUTBP # oE2gS4ZJaHR0cDovL2NybC5taWNyb3NvZnQuY29tL3BraS9jcmwvcHJvZHVjdHMv # TWljUm9vQ2VyQXV0MjAxMV8yMDExXzAzXzIyLmNybDBeBggrBgEFBQcBAQRSMFAw # TgYIKwYBBQUHMAKGQmh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2kvY2VydHMv # TWljUm9vQ2VyQXV0MjAxMV8yMDExXzAzXzIyLmNydDANBgkqhkiG9w0BAQwFAAOC # AgEAFJQfOChP7onn6fLIMKrSlN1WYKwDFgAddymOUO3FrM8d7B/W/iQ6DxXsDn7D # 5W4wMwYeLystcEqfkjz4NURRgazyMu5yRzQh4LqjA4tStTcJh1opExo7nn5PuPBY # nbu0+THSuVHTe0VTTPVhily/piFrDo3axQ9P4C+Ol5yet+2gTfekICS5xS+cYfSI # vgn0JksVBVMYVI5QFu/qhnLhsEFEUzG8fvv0hjgkO+lkpV9ty6GkN4vdnd7ya6Q6 # aR9y34aiM1qmxaxBi6OUnyNl6fkuun/diTFnYDLTppOkr/mg5WSfCiDVMNCxtj4w # PKC5OmHm1DQIt/MNokbbH3UGsFP1QbzsLocuSqLCvH09Io3fDPTmscR9Y75G4qX7 # RTX8AdBPo0I6OEojf39zuFZt0qOHm65YWQE69cZM2ueE1MB05dNNgHK9gTE7zKvK # /fg8B2qjW88MT/WF5V5uvZGtqa9FSL2RazArA+rDPuf6JGYz4HpgMZHB4S6szWSK # YBv0VisCzfxgeU+dquXW9bd0auYlOB58DPcOYKdc3Se94g+xL4pcEhbB54JOgAkw # YTu/9dLeH2pDqeJZAABVDWRQCaXfO5LgyKwKCLYXpigrZYCjUSBcr+Ve8PFWMhVT # Ql0v4q8J/AUmQN5W4n101cY2L4A7GTQG1h32HHAvfQESWP0xghnHMIIZwwIBATBu # MFcxCzAJBgNVBAYTAlVTMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24x # KDAmBgNVBAMTH01pY3Jvc29mdCBDb2RlIFNpZ25pbmcgUENBIDIwMjQCEzMAAAIc # +s3Fm+gvfsQAAAAAAhwwDQYJYIZIAWUDBAIBBQCggZAwGQYJKoZIhvcNAQkDMQwG # CisGAQQBgjcCAQQwLwYJKoZIhvcNAQkEMSIEIFDaBQOOAcXO5EslFmbiMfHAZId6 # 4GU2PAB8WevF/Bl2MEIGCisGAQQBgjcCAQwxNDAyoBSAEgBNAGkAYwByAG8AcwBv # AGYAdKEagBhodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20wDQYJKoZIhvcNAQEBBQAE # ggEA0EYy9A26IvYtQq80eqhcQXmqL+dd3PoixCAAf626BzKcX3yT4AT7TxnO8vrC # Mj04UHB2U61viFCMV+TYUZTrlmRiJFWrVMNf84yUxKyfiERKCxQecuF7dUAcTaXe # uF76o+Z0LHGnVb4RJAEBcc3srT+LRSQGZz/ZwHcWkhZmZKQTpvjATAFlvYFiVBnD # RuiGXkCAyuwuNDXHqmPoYygTitsiqwg+zdQqmcZZUNdFrOzjSHiGNDRhLllzGKEs # d3x2NPCY/pwob4ULdMfSSIVy9vsYyduWmwkBw26LOAcMNeEamer9PFrMt8rFpki5 # OYAZfeUkMgmuI5uzjqxomeEguaGCF5cwgheTBgorBgEEAYI3AwMBMYIXgzCCF38G # CSqGSIb3DQEHAqCCF3AwghdsAgEDMQ8wDQYJYIZIAWUDBAIBBQAwggFSBgsqhkiG # 9w0BCRABBKCCAUEEggE9MIIBOQIBAQYKKwYBBAGEWQoDATAxMA0GCWCGSAFlAwQC # AQUABCA4uxdzBelQbY5rdGIttCigbqhbPIbQvj4pJJ2f7rmg4AIGaql/E2pgGBMy # MDI2MDkyNTE3MTEwNC45MTlaMASAAgH0oIHRpIHOMIHLMQswCQYDVQQGEwJVUzET # MBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMV # TWljcm9zb2Z0IENvcnBvcmF0aW9uMSUwIwYDVQQLExxNaWNyb3NvZnQgQW1lcmlj # YSBPcGVyYXRpb25zMScwJQYDVQQLEx5uU2hpZWxkIFRTUyBFU046QTAwMC0wNUUw # LUQ5NDcxJTAjBgNVBAMTHE1pY3Jvc29mdCBUaW1lLVN0YW1wIFNlcnZpY2WgghHt # MIIHIDCCBQigAwIBAgITMwAAAiu7AFD/TTuaoQABAAACKzANBgkqhkiG9w0BAQsF # ADB8MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMH # UmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSYwJAYDVQQD # Ex1NaWNyb3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAxMDAeFw0yNjAyMTkxOTQwMTFa # Fw0yNzA1MTcxOTQwMTFaMIHLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGlu # Z3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBv # cmF0aW9uMSUwIwYDVQQLExxNaWNyb3NvZnQgQW1lcmljYSBPcGVyYXRpb25zMScw # JQYDVQQLEx5uU2hpZWxkIFRTUyBFU046QTAwMC0wNUUwLUQ5NDcxJTAjBgNVBAMT # HE1pY3Jvc29mdCBUaW1lLVN0YW1wIFNlcnZpY2UwggIiMA0GCSqGSIb3DQEBAQUA # A4ICDwAwggIKAoICAQCX3mi6OD3syUqQm4QqgkrKPbcsK/Qx3fYctL8+VM1uOY3b # ooi5GxwauTgQf6JFHITToxS7gjqKlK8OFLzL6UTl0jxEK5t6DuOcgJXdvutimoTl # OS0C3kyITXBAXoj/gp6hRR9z6WRip1Ktkilb3dJXCjQqT9P2Cuujr+Vz8r+Z+jDl # 09ji/ic/4G34r3mVwjs//Gnx9Pu31V8rXFicNiAzxpubawpbd8pqfzlWT2vnG3kF # 9l6MiREbvJ3XHLUwHQsh0t/TrSFx/s/yCqpJWYJ6oClG70tvsFH0aRP8wB4cP/CF # a2ILvk26i3OcJBl+pqKjHTSBy9mvwTPEDlnzco0Nt8R6pSPTXZgBsscHhoKfC0WQ # mOzY2keXbAmRTcZMyXz5v/AJbmoI0y07Bazvt5NkXddG9TErQWwtsFyIKrElDgWf # HeCoTu1wu2ciD3dK72z3ca2gzoEDxT2j9BXIUKaiTzTdQPRsAMaO3dU0zaGwMMlw # tSJyDh14YEgZoUu5vS8MugMqdrNjphyL65yKhjpAWbhYkIHO/0uZju95tP8zZNqX # IRh4tdfWHJPATn9r+cxkyuh2x0VLdfx1lmK9X3NjH0NtgAs5JB/wOlkyuudxmFTf # WVyRrL37ispOZ8aPAFgvyR6cNTkGpkFo35JRjciNmZiU4qT9Uty+V5gudFk1jwID # AQABo4IBSTCCAUUwHQYDVR0OBBYEFD4WjuQTUJbtbd3jmvZku0FZ2eU2MB8GA1Ud # IwQYMBaAFJ+nFV0AXmJdg/Tl0mWnG1M1GelyMF8GA1UdHwRYMFYwVKBSoFCGTmh0 # dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMvY3JsL01pY3Jvc29mdCUyMFRp # bWUtU3RhbXAlMjBQQ0ElMjAyMDEwKDEpLmNybDBsBggrBgEFBQcBAQRgMF4wXAYI # KwYBBQUHMAKGUGh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMvY2VydHMv # TWljcm9zb2Z0JTIwVGltZS1TdGFtcCUyMFBDQSUyMDIwMTAoMSkuY3J0MAwGA1Ud # EwEB/wQCMAAwFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwgwDgYDVR0PAQH/BAQDAgeA # MA0GCSqGSIb3DQEBCwUAA4ICAQDO/CKsciEM8kr1fqH4TlfT66ENoTjxXw810pyE # q0PdrgLwfgT3x+1gz7CQHtUdevqMQ5qHyDLhm6pT911CYkGN+6g+MU7fMYTr6d3S # xieJwBIoWkfR4g7SitGzMKU465KEYejfddoUgovC/xcRpaALO5p3/A248ByhJiMt # tBQNDtsT/HaCFwRFCURby/f8c1kky8F8xkCXFz+/MtZ5d1lWFjwOI2geZHWq9Xih # DOgee5nS2koo5V6n8XG220UTevVf+pgmpIH71XKDVIYTGGZJs6yPlfJ2aXqw1ME4 # NR6okNsY3P1M31H6DMYRfJGNBNep595kXGh3YzA3cCiyg+jmJ58h/fTvjngIpuUF # fODpDjFx0ic1YoLANxhCF3RhS9qYM7K40NEhKshYuaAkIG2XBKYig3r/0/b0sjvj # Bws55AYonMm3A8qcX/6k9Vfc0mv9dtonHuWGfA2b+qE2qpCnhzGbdDHq7iOSZEw0 # 1nNupAMf1c41k9IoTQ2z3iw6w4ZZoLOyg4TKMbp1krpT4trip/y30Cv5khyqCDNq # aXQpBkOYON8LgtoQ3amVOX7ix5jdrnx/vUxTUSigXvrWdL7Uk8kpmS0zto2Toy7a # T5oBzCTvfj9iJ/BN/E1vhFBkhJCvZ7PVvsMSnTTmkx2Fal2lVkztuAI44fD/uyLJ # daMQSzCCB3EwggVZoAMCAQICEzMAAAAVxedrngKbSZkAAAAAABUwDQYJKoZIhvcN # AQELBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYD # VQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xMjAw # BgNVBAMTKU1pY3Jvc29mdCBSb290IENlcnRpZmljYXRlIEF1dGhvcml0eSAyMDEw # MB4XDTIxMDkzMDE4MjIyNVoXDTMwMDkzMDE4MzIyNVowfDELMAkGA1UEBhMCVVMx # EzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoT # FU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRpbWUt # U3RhbXAgUENBIDIwMTAwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDk # 4aZM57RyIQt5osvXJHm9DtWC0/3unAcH0qlsTnXIyjVX9gF/bErg4r25PhdgM/9c # T8dm95VTcVrifkpa/rg2Z4VGIwy1jRPPdzLAEBjoYH1qUoNEt6aORmsHFPPFdvWG # UNzBRMhxXFExN6AKOG6N7dcP2CZTfDlhAnrEqv1yaa8dq6z2Nr41JmTamDu6Gnsz # rYBbfowQHJ1S/rboYiXcag/PXfT+jlPP1uyFVk3v3byNpOORj7I5LFGc6XBpDco2 # LXCOMcg1KL3jtIckw+DJj361VI/c+gVVmG1oO5pGve2krnopN6zL64NF50ZuyjLV # wIYwXE8s4mKyzbnijYjklqwBSru+cakXW2dg3viSkR4dPf0gz3N9QZpGdc3EXzTd # EonW/aUgfX782Z5F37ZyL9t9X4C626p+Nuw2TPYrbqgSUei/BQOj0XOmTTd0lBw0 # gg/wEPK3Rxjtp+iZfD9M269ewvPV2HM9Q07BMzlMjgK8QmguEOqEUUbi0b1qGFph # AXPKZ6Je1yh2AuIzGHLXpyDwwvoSCtdjbwzJNmSLW6CmgyFdXzB0kZSU2LlQ+QuJ # YfM2BjUYhEfb3BvR/bLUHMVr9lxSUV0S2yW6r1AFemzFER1y7435UsSFF5PAPBXb # GjfHCBUYP3irRbb1Hode2o+eFnJpxq57t7c+auIurQIDAQABo4IB3TCCAdkwEgYJ # KwYBBAGCNxUBBAUCAwEAATAjBgkrBgEEAYI3FQIEFgQUKqdS/mTEmr6CkTxGNSnP # EP8vBO4wHQYDVR0OBBYEFJ+nFV0AXmJdg/Tl0mWnG1M1GelyMFwGA1UdIARVMFMw # UQYMKwYBBAGCN0yDfQEBMEEwPwYIKwYBBQUHAgEWM2h0dHA6Ly93d3cubWljcm9z # b2Z0LmNvbS9wa2lvcHMvRG9jcy9SZXBvc2l0b3J5Lmh0bTATBgNVHSUEDDAKBggr # BgEFBQcDCDAZBgkrBgEEAYI3FAIEDB4KAFMAdQBiAEMAQTALBgNVHQ8EBAMCAYYw # DwYDVR0TAQH/BAUwAwEB/zAfBgNVHSMEGDAWgBTV9lbLj+iiXGJo0T2UkFvXzpoY # xDBWBgNVHR8ETzBNMEugSaBHhkVodHRwOi8vY3JsLm1pY3Jvc29mdC5jb20vcGtp # L2NybC9wcm9kdWN0cy9NaWNSb29DZXJBdXRfMjAxMC0wNi0yMy5jcmwwWgYIKwYB # BQUHAQEETjBMMEoGCCsGAQUFBzAChj5odHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20v # cGtpL2NlcnRzL01pY1Jvb0NlckF1dF8yMDEwLTA2LTIzLmNydDANBgkqhkiG9w0B # AQsFAAOCAgEAnVV9/Cqt4SwfZwExJFvhnnJL/Klv6lwUtj5OR2R4sQaTlz0xM7U5 # 18JxNj/aZGx80HU5bbsPMeTCj/ts0aGUGCLu6WZnOlNN3Zi6th542DYunKmCVgAD # sAW+iehp4LoJ7nvfam++Kctu2D9IdQHZGN5tggz1bSNU5HhTdSRXud2f8449xvNo # 32X2pFaq95W2KFUn0CS9QKC/GbYSEhFdPSfgQJY4rPf5KYnDvBewVIVCs/wMnosZ # iefwC2qBwoEZQhlSdYo2wh3DYXMuLGt7bj8sCXgU6ZGyqVvfSaN0DLzskYDSPeZK # PmY7T7uG+jIa2Zb0j/aRAfbOxnT99kxybxCrdTDFNLB62FD+CljdQDzHVG2dY3RI # LLFORy3BFARxv2T5JL5zbcqOCb2zAVdJVGTZc9d/HltEAY5aGZFrDZ+kKNxnGSgk # ujhLmm77IVRrakURR6nxt67I6IleT53S0Ex2tVdUCbFpAUR+fKFhbHP+CrvsQWY9 # af3LwUFJfn6Tvsv4O+S3Fb+0zj6lMVGEvL8CwYKiexcdFYmNcP7ntdAoGokLjzba # ukz5m/8K6TT4JDVnK+ANuOaMmdbhIurwJ0I9JZTmdHRbatGePu1+oDEzfbzL6Xu/ # OHBE0ZDxyKs6ijoIYn/ZcGNTTY3ugm2lBRDBcQZqELQdVTNYs6FwZvKhggNQMIIC # OAIBATCB+aGB0aSBzjCByzELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0 # b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3Jh # dGlvbjElMCMGA1UECxMcTWljcm9zb2Z0IEFtZXJpY2EgT3BlcmF0aW9uczEnMCUG # A1UECxMeblNoaWVsZCBUU1MgRVNOOkEwMDAtMDVFMC1EOTQ3MSUwIwYDVQQDExxN # aWNyb3NvZnQgVGltZS1TdGFtcCBTZXJ2aWNloiMKAQEwBwYFKw4DAhoDFQAJrD90 # ykHpo/0AGb7lmwvsCtqROaCBgzCBgKR+MHwxCzAJBgNVBAYTAlVTMRMwEQYDVQQI # EwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3Nv # ZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMTHU1pY3Jvc29mdCBUaW1lLVN0YW1wIFBD # QSAyMDEwMA0GCSqGSIb3DQEBCwUAAgUA7mCCMjAiGA8yMDI2MDkyNTA1MTYzNFoY # DzIwMjYwOTI2MDUxNjM0WjB3MD0GCisGAQQBhFkKBAExLzAtMAoCBQDuYIIyAgEA # MAoCAQACAg5JAgH/MAcCAQACAhaaMAoCBQDuYdOyAgEAMDYGCisGAQQBhFkKBAIx # KDAmMAwGCisGAQQBhFkKAwKgCjAIAgEAAgMHoSChCjAIAgEAAgMBhqAwDQYJKoZI # hvcNAQELBQADggEBAAsN2t8yMprRvs8abKfY+xmV/g7JTOJDQBjqkdXu36CZCVKP # L6HtavYXXigDmOGZWQqLQhLtowk2QqEONkg6kg59a1YGnbrWdMUTdj7f50Bjr+te # Zrrae46JGit7et8v6BMKXofKOr5Vzw+VTo7G/1mo/+I81PoKW9im46jA1m52YKef # gZ7QWW9hoyiJO0E86encXzMXaxo1SNLHDl8/IhELraW+dZX/7UNTP+sYY15waHiQ # aIMvFVUoqpWLJ+asWK5qgwGkhKlohlGNlx8ehniO3VRUH3YPIGsGTDPIe3zsvckK # vrLKQr5LWLZwhd9t8XciJDIyc7FqRsZJVaMwWqkxggQNMIIECQIBATCBkzB8MQsw # CQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9u # ZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSYwJAYDVQQDEx1NaWNy # b3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAxMAITMwAAAiu7AFD/TTuaoQABAAACKzAN # BglghkgBZQMEAgEFAKCCAUowGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEEMC8G # CSqGSIb3DQEJBDEiBCBAEsrKkFpNqtJlcks0NC/0IZMsf7oY0pCl40LZDraZ3TCB # +gYLKoZIhvcNAQkQAi8xgeowgecwgeQwgb0EIHIOI/Q/kFftYA+M2OY+1Bx3ajBD # 6/WDAtPT2vFkv25SMIGYMIGApH4wfDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldh # c2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBD # b3Jwb3JhdGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAgUENBIDIw # MTACEzMAAAIruwBQ/007mqEAAQAAAiswIgQg/m8zrAPwMvB5F5JAyswXPaGXtEhc # +fmz4ynVO2vHZz8wDQYJKoZIhvcNAQELBQAEggIAJk9fdTM//6l+5Br8QM00KiPK # /kHQJlAvcgtH8Gk+WSUW11Okh47k8hODJ4fcEzqhbuSF5EEzLEA0rvsWZtBmLjau # 9LcfyK06SlfXtoYx7P6lzLz4qBBhkSHDT71+hOniZ88Xc+sZjw8LyhDjPzx/bjLC # JEpsfvpLhs+rEhhZDnSlBxMzDAPsk3sZR3D6zXwByE8SIg6nSFaBfRltVVp/QXHo # vv37dxlYuA7UJfjR5ywDd1litYh2Wt8cWCCkHivVQMj7OZ+kW/XAC5qtY9O0l6sI # Xv3octTq24QsIthBT7F22G6Gmm76OYpopDiJhMK0Wiv/i9cncQGiKsU2BO6Lmdfa # wZ2ep9VZZY9EGN8xhjqY5taZ1v47T3Ew6zaVs0Z1ZpClHgbSJsBqFPUxqzreY7jb # 4wf+twNgt7NpT9NElb7LPJxKhXYdwb1vtxKc5FbtH9p286V6hORRlJ7vvpcObdZj # cyjpABMcTniTmmp78SUW6TSkd11Vk7BwYDgckM5hrGC1dUfuttnx/HtmAcXTvJga # tuWW7o4ZWwXAGOofrE0GdqZ+1wpR/eYCH9ZwJQchz48qbdlNAIF2jHgV7lC8wIF8 # qAlio2ZXSyrkwI8ykpoVI3vBOLOCuiMWYj5z59gqOPGfJ34iilYqPWiuvugbNCxI # k1HEUbc/EEFftBqqufc= # SIG # End signature block |