Private/AzStackHci.ParallelLayer7.Helpers.ps1
|
# ============================================================================= # Strict Mode v1 (PS 5.1 safe) - surfaces reads of uninitialised variables at runtime. Set-StrictMode -Version 1.0 # AzStackHci.ParallelLayer7.Helpers.ps1 # ============================================================================= # Private helpers for the Layer-7 endpoint sweep in Test-AzureLocalConnectivity. # # Two helpers live here: # 1. Invoke-Layer7EndpointTest - tests ONE endpoint (mutates the $UrlObject in place, # may append CRL/OCSP dependency rows to $script:Results # via Add-CrlDependencyRowToResults). This is the # extracted body of the main per-URL ForEach loop and # is byte-identical to the v0.6.6 inline behaviour. # 2. Invoke-Layer7BucketWorker - runs inside a Start-Job worker process; loops over # a bucket of $UrlObject rows calling # Invoke-Layer7EndpointTest, snapshots the module-scope # classification state ($script:SSLInspectedURLs, # $script:CRLOfflineURLs, $script:PrivateLink* arrays, # any newly-appended $script:Results rows) and returns # a hashtable for the parent process to merge. # # The parallel fan-out is opt-in via the new -Parallelism parameter on # Test-AzureLocalConnectivity (default 1, sequential, byte-identical to v0.6.6). # ============================================================================= function Invoke-Layer7EndpointTest { <# .SYNOPSIS Runs DNS + TCP + Layer-7 connectivity tests for a single endpoint row, mutating the row in place. Body extracted verbatim from the main ForEach loop in Test-AzureLocalConnectivity to enable parallel fan-out via Start-Job. .DESCRIPTION Sequential default behaviour: identical to the pre-extraction inline ForEach body. Mutates $UrlObject fields (TCPStatus, Layer7Status, Layer7Response, certificate columns, IPAddress, Note). May call Add-CrlDependencyRowToResults which appends new rows to $script:Results. May also append to module-scope classification state ($script:SSLInspectedURLs, $script:CRLOfflineURLs, $script:PrivateLink* arrays, $script:SSLInspectionDetected) via the call into Test-Layer7Connectivity -> Get-Layer7CertificateDetails / Get-DnsRecord. .PARAMETER UrlObject The PSCustomObject row from $script:Results to test. Mutated in place. .PARAMETER SkipUrls The list of URLs that the parent loop has decided to skip (the manually-curated "skip" list — pre-2026 hardcoded entries like wustat.windows.com). .PARAMETER ArcGatewayDeployment Whether -ArcGatewayDeployment was specified on the public Test-AzureLocalConnectivity. .PARAMETER NTPTimeServer Optional user-supplied NTP server URL (replaces time.windows.com for that one row). .PARAMETER IncludeTCPConnectivityTests Whether -IncludeTCPConnectivityTests was specified on the public function. .PARAMETER RequestMethod 'Get' / 'Head' / 'Auto' — plumbed through to Test-Layer7Connectivity. #> [CmdletBinding()] param( [Parameter(Mandatory)] [object]$UrlObject, [Parameter(Mandatory)] [array]$SkipUrls, [Parameter(Mandatory=$false)] [bool]$ArcGatewayDeployment = $false, [Parameter(Mandatory=$false)] [string]$NTPTimeServer, [Parameter(Mandatory=$false)] [bool]$IncludeTCPConnectivityTests = $false, [Parameter(Mandatory=$false)] [ValidateSet('Get','Head','Auto')] [string]$RequestMethod = 'Auto' ) # Local alias preserves the old loop variable name so the extracted body remains # diff-readable against the v0.6.6 ForEach body it came from. $urlObj = $UrlObject # Per-iteration DNSCheck reset (matches original "Remove-Variable DNSCheck" inside the loop). $DNSCheck = $null Write-Debug "Arc Gateway boolean for url '$($urlObj.url)' from source $($urlObj.Source) = $($urlObj.ArcGateway)" # If the ArcGatewayDeployment switch is used, only test URLs that do not support Arc Gateway if ($ArcGatewayDeployment) { # Skip URLs with ArcGateway -eq $True if ($urlObj.ArcGateway) { # Skip URLs that support Arc Gateway Write-HostAzS "Skipped URL: '$($urlObj.URL)' as supported by Arc Gateway" -ForegroundColor Yellow Set-UrlObjectSkipFields -UrlObject $urlObj -TCPStatus "Skipped" -Layer7Status "Skipped" $urlObj.Note = "Skipped, URL is supported by Arc Gateway - $($urlObj.Note)" Write-HostAzS "" return } } # Process URLs that require special handling if (($urlObj.URL -like ("*.gw.arc.azure.com") -or $urlObj.URL -like ("*.gw.arc.azure.net"))) { if ($ArcGatewayDeployment) { # Replace the URL with the user-defined Arc Gateway URL, if specified $urlObj.URL = (Get-DomainFromURL -url $script:UpdatedArcGatewayURL).Domain # Run DNS + TCP + Layer 7 connectivity tests using shared helper # Forward -RequestMethod down through Invoke-EndpointConnectivityTest into Test-Layer7Connectivity (parity with the non-wildcard branch). $testResult = Invoke-EndpointConnectivityTest -Url $urlObj.URL -Port $urlObj.Port -IncludeTCPConnectivityTests:$IncludeTCPConnectivityTests -RequestMethod $RequestMethod Copy-ConnectivityResultsToUrlObject -UrlObject $urlObj -TestResult $testResult } else { # Not using Arc Gateway, skip the URL Write-HostAzS "Skipping URL, (not using Arc Gateway): $($urlObj.URL)" -ForegroundColor Green Set-UrlObjectSkipFields -UrlObject $urlObj -TCPStatus "Skipped" -Layer7Status "Skipped" $urlObj.Note = "Skipped, not using Arc Gateway, as '-ArcGatewayDeployment' switch not present - $($urlObj.Note)" } } elseif ($urlObj.URL -eq "time.windows.com") { # Replace the URL with the user-defined NTP Time Server, if specified if ([string]::IsNullOrWhiteSpace($NTPTimeServer)) { # Use default NTP Time Server Write-HostAzS "Using default NTP Time Server: 'time.windows.com' for NTP connectivity test on UDP port 123, as the '`$NTPTimeServer' parameter was not specified" -ForegroundColor Yellow $DNSCheck = Get-DnsRecord -url (Get-DomainFromURL -url $urlObj.URL).Domain } else { Write-HostAzS "Replacing default NTP Time Server 'time.windows.com' with user-defined NTP server: '$NTPTimeServer'" -ForegroundColor Green [string]$urlObj.URL = (Get-DomainFromURL -url $NTPTimeServer).Domain $urlObj.Source = "User-defined NTP server" # //// Ignore RFC1918 check during DNS check for user-defined NTP server //// $DNSCheck = Get-DnsRecord -url (Get-DomainFromURL -url $NTPTimeServer).Domain -SkipRfc1918Check } Add-Member -InputObject $urlObj -NotePropertyName DNSFailureCode -NotePropertyValue $DNSCheck.DNSFailureCode -Force Add-Member -InputObject $urlObj -NotePropertyName DNSResolutionStatus -NotePropertyValue $(if ($DNSCheck.DNSExists) { 'Success' } else { 'Failed' }) -Force # If using a Proxy, DNS resolution from the local host may not be required if (($DNSCheck.DNSExists) -or ($script:Proxy.Enabled)) { $StopWatch = [Diagnostics.Stopwatch]::StartNew() $urlObj.TCPStatus, $urlObj.IPAddress = Test-NTPConnectivity -ntpServer $urlObj.URL if ($urlObj.TCPStatus -eq "Success") { $urlObj.Layer7Status = "Success" } else { $urlObj.Layer7Status = "Failed" } if ([string]::IsNullOrWhiteSpace($urlObj.IPAddress)) { $urlObj.IPAddress = $DNSCheck.IpAddress } $urlObj.Layer7Response = "UDP port 123" $urlObj.Layer7ResponseTime = [math]::round($StopWatch.Elapsed.TotalMilliseconds/1000, 3) $StopWatch.Stop() # NTP does not use SSL certificates $urlObj.CertificateIssuer = "N/A" $urlObj.CertificateSubject = "N/A" $urlObj.CertificateThumbprint = "N/A" $urlObj.IntermediateCertificateIssuer = "N/A" $urlObj.IntermediateCertificateSubject = "N/A" $urlObj.IntermediateCertificateThumbprint = "N/A" $urlObj.RootCertificateIssuer = "N/A" $urlObj.RootCertificateSubject = "N/A" $urlObj.RootCertificateThumbprint = "N/A" } else { Set-UrlObjectSkipFields -UrlObject $urlObj -TCPStatus "Failed" -Layer7Status "Failed" -IPAddress $DNSCheck.IpAddress } # //// Skipped URLs //// } elseif ($SkipUrls.URL.Contains($urlObj.URL)) { Write-HostAzS "Skipped URL: $($urlObj.URL)" -ForegroundColor Green Set-UrlObjectSkipFields -UrlObject $urlObj -TCPStatus "Skipped" -Layer7Status "Skipped" $urlObj.Note = "Skipped URL - $($urlObj.Note)" # //// Wildcard URLs //// } elseif ($urlObj.IsWildcard) { Write-HostAzS "Wildcard URLs are processed later..." -ForegroundColor Yellow Set-UrlObjectSkipFields -UrlObject $urlObj -TCPStatus "Skipped" -Layer7Status "Skipped" $urlObj.Note = "$($urlObj.Note)" # //// Non-wildcard URLs //// } else { # Placeholder KeyVault URL: show Warning status instead of running tests against a URL that will always fail DNS if ($urlObj.URL -like "yourhcikeyvaultname.vault.*") { Write-HostAzS "WARNING: Default KeyVault endpoint '$($urlObj.URL)' is being used." -ForegroundColor Yellow Write-HostAzS "INFO: Specify your KeyVault endpoint using the '-KeyVaultURL' parameter to validate your actual KeyVault connectivity." -ForegroundColor Yellow Set-UrlObjectSkipFields -UrlObject $urlObj -TCPStatus "Failed" -Layer7Status "Failed" $urlObj.Note = "PARAMETER `"-KeyVaultURL https://<yourKeyVault>.vault.azure.net`" WAS NOT USED - THIS IS REQUIRED TO SPECIFY YOUR UNIQUE KEY VAULT NAME - Key vault for deployment secrets." # Sleep for 3 seconds to allow the user to read the warning, if present. Start-Sleep -Seconds 3 # NOTE: original 'Continue' here SKIPS the trailing Write-HostAzS "" — replicate by returning early. return } # Run DNS + TCP + Layer 7 connectivity tests using shared helper # Forward -RequestMethod down through Invoke-EndpointConnectivityTest into Test-Layer7Connectivity. $testResult = Invoke-EndpointConnectivityTest -Url $urlObj.URL -Port $urlObj.Port -IncludeTCPConnectivityTests:$IncludeTCPConnectivityTests -RequestMethod $RequestMethod Copy-ConnectivityResultsToUrlObject -UrlObject $urlObj -TestResult $testResult } # Add line return after each URL (matches the original loop trailing Write-HostAzS ""). Write-HostAzS "" } function Invoke-Layer7BucketWorker { <# .SYNOPSIS Worker scriptblock body — runs inside a Start-Job child process, loops over a bucket of endpoint rows calling Invoke-Layer7EndpointTest, and returns a snapshot of all module-scope classification state for the parent process to merge. .DESCRIPTION Each Start-Job worker is its own process, so $script:* variables are isolated. The worker imports the module (so Invoke-Layer7EndpointTest, Test-Layer7Connectivity, Get-DnsRecord, Add-CrlDependencyRowToResults etc. are all available), seeds the module-scope state from the parent's snapshot, runs the bucket sequentially, then returns a hashtable that the parent merges. Returned hashtable keys: - Rows : the mutated $UrlObject rows from this bucket (RowID-tagged) - NewCrlRows : any rows appended to $script:Results by Add-CrlDependencyRowToResults inside the bucket - RedirectedResults : URLs the worker discovered via HTTP 301/302 redirect responses ($script:RedirectedResults snapshot — Phase 4 of Test-AzureLocalConnectivity iterates the parent's copy of this list, so workers MUST plumb it back or redirected URLs are silently dropped from the output) - SSLInspectedURLs : list of URLs flagged for SSL Inspection - CRLOfflineURLs : list of URLs whose CRL/OCSP check was offline - SSLInspectionDetected : bool — true if any row in the bucket triggered SSL inspection - PrivateLinkDetected : bool — true if any URL in the bucket resolved to RFC1918 (the parent uses this scalar flag to decide whether to print the customer-facing 'PRIVATE LINK DETECTED' warning) - PrivateLinkDetectedArray : list of URLs flagged for Private Link - PrivateLinkCriticalArray : list of URLs flagged for Private Link (RFC1918, critical) - PrivateLinkProxyBypassArray: list of URLs flagged for Private Link (RFC1918, proxy bypass) - BucketIndex : the worker's bucket index (for deterministic merge order) - BucketWallClockSec : wall-clock duration of this worker's bucket Diagnostic console output produced during testing is interleaved across workers — that is the documented behaviour of the parallel mode. The transcript still captures every line; the JSON output is RowID-sorted so customer-facing output ordering is identical to sequential mode. .PARAMETER Bucket Array of $UrlObject rows for this worker to test (round-robin partition from parent). .PARAMETER ParameterBag Hashtable carrying SkipUrls / ArcGatewayDeployment / NTPTimeServer / IncludeTCPConnectivityTests / RequestMethod / Proxy / UpdatedArcGatewayURL. .PARAMETER BucketIndex Index of this bucket (0..N-1). #> [CmdletBinding()] param( [Parameter(Mandatory)] [array]$Bucket, [Parameter(Mandatory)] [hashtable]$ParameterBag, [Parameter(Mandatory=$false)] [int]$BucketIndex = 0 ) $bucketSw = [System.Diagnostics.Stopwatch]::StartNew() # A Start-Job worker imports a fresh module, so none of the parent's $script: # output state crosses the process boundary. Apply the explicitly forwarded # state before endpoint helpers can emit host, verbose, debug, or progress output. $script:SilentMode = $ParameterBag.ContainsKey('SilentMode') -and [bool]$ParameterBag.SilentMode $verboseRequested = $ParameterBag.ContainsKey('VerboseRequested') -and [bool]$ParameterBag.VerboseRequested $script:VerboseMode = (-not $script:SilentMode) -and $verboseRequested $script:VerbosePreference = if ($script:VerboseMode) { 'Continue' } else { 'SilentlyContinue' } $debugRequested = $ParameterBag.ContainsKey('DebugRequested') -and [bool]$ParameterBag.DebugRequested $script:DebugPreference = if ((-not $script:SilentMode) -and $debugRequested) { 'Continue' } else { 'SilentlyContinue' } $VerbosePreference = $script:VerbosePreference $DebugPreference = $script:DebugPreference # Tag every Write-HostAzS line emitted from inside this worker with [bucket-N] # so the interleaved transcript is greppable per bucket. Cleared in the finally # so the parent process never inherits a stale prefix. $script:WorkerLogPrefix = "[bucket-$BucketIndex] " # Wrap the bucket body in try/finally so the [bucket-N] prefix is ALWAYS cleared # (and the stopwatch always stopped) even if a terminating error escapes the # per-row try/catch below. Body indentation is intentionally unchanged to keep # this diff minimal and reviewable. try { # Seed module-scope state from the parent's snapshot — Invoke-Layer7EndpointTest reads # $script:Proxy and $script:UpdatedArcGatewayURL. Constants.ps1's Initialize-ModuleState # has already created the empty ArrayLists / arrays for the classification state, so # we can rely on those being initialised but empty in this worker process. if ($ParameterBag.ContainsKey('Proxy')) { $script:Proxy = $ParameterBag.Proxy } if ($ParameterBag.ContainsKey('UpdatedArcGatewayURL')) { $script:UpdatedArcGatewayURL = $ParameterBag.UpdatedArcGatewayURL } # Snapshot the row count BEFORE running the bucket so we can isolate any new # CRL/OCSP rows that Add-CrlDependencyRowToResults appends during testing. # The worker's $script:Results starts as a (cloned) copy of the bucket so that # Add-CrlDependencyRowToResults's host-level dedupe still works correctly within # the bucket's scope. [System.Collections.ArrayList]$script:Results = @($Bucket) $initialRowCount = $script:Results.Count foreach ($row in $Bucket) { try { Invoke-Layer7EndpointTest ` -UrlObject $row ` -SkipUrls $ParameterBag.SkipUrls ` -ArcGatewayDeployment ([bool]$ParameterBag.ArcGatewayDeployment) ` -NTPTimeServer $ParameterBag.NTPTimeServer ` -IncludeTCPConnectivityTests ([bool]$ParameterBag.IncludeTCPConnectivityTests) ` -RequestMethod $ParameterBag.RequestMethod } catch { # Mark the row as Failed but never abort the bucket — bucket-level isolation matters. try { $row.Layer7Status = 'Failed' $row.Layer7Response = "Worker exception: $($_.Exception.Message)" } catch {} } } # Identify any new CRL/OCSP dependency rows the bucket appended during testing. $newCrlRows = @() if ($script:Results.Count -gt $initialRowCount) { $newCrlRows = @($script:Results | Select-Object -Skip $initialRowCount) } } finally { $bucketSw.Stop() # Clear the bucket prefix so a direct (non-Start-Job) caller doesn't leak it. # In the Start-Job process this is moot — the process is torn down — but # Pester tests that invoke Invoke-Layer7BucketWorker in-proc would otherwise # see subsequent Write-HostAzS calls still tagged. $script:WorkerLogPrefix = '' } return @{ Rows = @($Bucket) NewCrlRows = $newCrlRows RedirectedResults = @($script:RedirectedResults) SSLInspectedURLs = @($script:SSLInspectedURLs) CRLOfflineURLs = @($script:CRLOfflineURLs) SSLInspectionDetected = [bool]$script:SSLInspectionDetected PrivateLinkDetected = [bool]$script:PrivateLinkDetected PrivateLinkDetectedArray = @($script:PrivateLinkDetectedArray) PrivateLinkCriticalArray = @($script:PrivateLinkCriticalArray) PrivateLinkProxyBypassArray = @($script:PrivateLinkProxyBypassArray) BucketIndex = $BucketIndex BucketWallClockSec = [math]::Round($bucketSw.Elapsed.TotalSeconds, 3) } } function Merge-Layer7WorkerResult { <# .SYNOPSIS Merges one worker's returned hashtable into the parent module-scope state. .DESCRIPTION - Replaces parent rows by RowID with the worker's mutated copies. - Appends new CRL/OCSP dependency rows to $script:Results (idempotent: skips URLs already present at the parent level). - Unions the SSL-inspection / CRL-offline / Private-Link arrays. - ORs the SSLInspectionDetected flag. .PARAMETER WorkerResult The hashtable returned by Invoke-Layer7BucketWorker. #> [CmdletBinding()] param( [Parameter(Mandatory)] [hashtable]$WorkerResult ) # The worker mutated the original PSCustomObject references in $Bucket. Because # Start-Job serialises objects across the process boundary, the deserialised rows # returned in WorkerResult.Rows are NOT the same instances as the parent's # $script:Results entries. Merge by RowID match. foreach ($workerRow in $WorkerResult.Rows) { $match = $script:Results | Where-Object { $_.RowID -eq $workerRow.RowID } | Select-Object -First 1 if ($null -ne $match) { # Copy back every mutated field. This is intentionally explicit (not # ForEach-Object Get-Member) to avoid accidentally overwriting RowID/URL/Port etc. foreach ($field in @( 'TCPStatus','IPAddress','Layer7Status','Layer7Response','Layer7ResponseTime', 'TCPDiagnostics','DNSDiagnostics','DNSFailureCode','DNSResolutionStatus', 'CertificateIssuer','CertificateSubject','CertificateThumbprint', 'IntermediateCertificateIssuer','IntermediateCertificateSubject','IntermediateCertificateThumbprint', 'RootCertificateIssuer','RootCertificateSubject','RootCertificateThumbprint', 'Note','URL','Source' )) { if ($workerRow.PSObject.Properties.Name -contains $field) { Add-Member -InputObject $match -NotePropertyName $field -NotePropertyValue $workerRow.$field -Force } } } } # Append any new CRL/OCSP dependency rows the worker generated. When the same # dependency URL is discovered in another bucket the row is NOT re-added — instead # we extend the existing row's Source field so customer-facing output preserves # all parent-domain attributions. This mirrors the Tier-1 dedupe semantics inside # Add-CrlDependencyRowToResults (Private/AzStackHci.Connectivity.Helpers.ps1) for # the cross-bucket case, where each worker's local dedupe cannot see other buckets. foreach ($newRow in $WorkerResult.NewCrlRows) { # Defence-in-depth: skip any $null row (mirrors the RedirectedResults loop guard # below) so a malformed worker payload can never throw on $newRow.URL. if ($null -eq $newRow) { continue } $existing = $script:Results | Where-Object { ($_.URL -eq $newRow.URL) -and ($_.Port -eq $newRow.Port) } | Select-Object -First 1 if ($null -eq $existing) { $script:Results.Add($newRow) | Out-Null } elseif ($newRow.PSObject.Properties.Name -contains 'Source' -and -not [string]::IsNullOrWhiteSpace($newRow.Source)) { # Extract the parent-domain hint(s) from the worker's Source string and append # any not already present on the parent row's Source. The Source field uses # '; '-separated parent-domain tokens so a simple substring check is reliable. $existingSrc = if ([string]::IsNullOrWhiteSpace($existing.Source)) { '' } else { $existing.Source } foreach ($token in ($newRow.Source -split ';\s*')) { $t = $token.Trim() if ($t -and ($existingSrc -notmatch [regex]::Escape($t))) { $existing.Source = if ([string]::IsNullOrWhiteSpace($existing.Source)) { $t } else { "$($existing.Source); $t" } $existingSrc = $existing.Source } } } } # Plumb back any URLs the worker discovered as HTTP 301/302 redirect targets so # Phase 4 of Test-AzureLocalConnectivity (the redirected-URLs loop) can test them. # Without this merge step those rows would be silently dropped from the JSON / HTML # / CSV output in -Parallelism > 1 runs. Dedupe by url + Port matches the existing # New-RedirectedResultEntry semantics in Private/AzStackHci.Connectivity.Helpers.ps1. if ($WorkerResult.RedirectedResults) { foreach ($redirRow in $WorkerResult.RedirectedResults) { if ($null -eq $redirRow) { continue } Merge-ConnectivityRedirectRow -Row $redirRow } Update-ConnectivityRedirectDisposition } foreach ($u in $WorkerResult.SSLInspectedURLs) { if (-not ($script:SSLInspectedURLs -contains $u)) { $script:SSLInspectedURLs.Add($u) | Out-Null } } foreach ($u in $WorkerResult.CRLOfflineURLs) { if (-not ($script:CRLOfflineURLs -contains $u)) { $script:CRLOfflineURLs.Add($u) | Out-Null } } if ($WorkerResult.SSLInspectionDetected) { $script:SSLInspectionDetected = $true } # OR-merge the scalar PrivateLinkDetected flag — the parent uses this boolean (NOT # the array) at the end of Test-AzureLocalConnectivity to decide whether to print # the customer-facing 'PRIVATE LINK DETECTED' warning block. if ($WorkerResult.PrivateLinkDetected) { $script:PrivateLinkDetected = $true } foreach ($u in $WorkerResult.PrivateLinkDetectedArray) { if (-not ($script:PrivateLinkDetectedArray -contains $u)) { $script:PrivateLinkDetectedArray += $u } } foreach ($u in $WorkerResult.PrivateLinkCriticalArray) { if (-not ($script:PrivateLinkCriticalArray -contains $u)) { $script:PrivateLinkCriticalArray += $u } } foreach ($u in $WorkerResult.PrivateLinkProxyBypassArray) { if (-not ($script:PrivateLinkProxyBypassArray -contains $u)) { $script:PrivateLinkProxyBypassArray += $u } } } function Split-Layer7BucketsRoundRobin { <# .SYNOPSIS Cost-aware bin-packs a row array into N buckets, with plain round-robin fallback. .DESCRIPTION Endpoint timing is heterogeneous: rows that trigger CRL/OCSP chain validation or that are flagged as Critical/Wildcard typically take 2-3x longer than a plain HEAD probe. A pure `i % Buckets` round-robin can leave one worker with most of the slow rows. Algorithm (cost-aware mode, default): 1. Estimate a per-row cost (Get-Layer7RowCost — CRL/OCSP/Critical = 3, Wildcard = 2, Redirected = 2, all others = 1). 2. Sort rows DESC by cost. (Output ordering is preserved at MERGE time via RowID-sort — see Merge-Layer7WorkerResult — so the bucket-internal order does not affect customer-visible results.) 3. Greedy bin-pack: for each row, place it in the bucket with the lowest current cumulative cost. Ties broken by lowest bucket index. Algorithm (legacy round-robin, opt-in via -RoundRobin): Plain `i % Buckets` — preserved for benchmarking / regression comparison. .PARAMETER Rows The full ordered array of rows to partition. .PARAMETER Buckets Number of buckets (= -Parallelism). Range 1-64. .PARAMETER RoundRobin Switch to force the legacy `i % Buckets` distribution. Default behaviour (switch absent) is cost-aware bin-packing. #> [CmdletBinding()] param( [Parameter(Mandatory)] [array]$Rows, [Parameter(Mandatory)] [ValidateRange(1, 64)] [int]$Buckets, [switch]$RoundRobin ) # Initialise N empty bucket arrays. The leading comma on `,@()` is required — # `for` would otherwise unwrap a 0-element array, leaving fewer than N buckets. $result = @(for ($i = 0; $i -lt $Buckets; $i++) { ,@() }) if ($RoundRobin -or $Buckets -eq 1 -or $Rows.Count -le $Buckets) { # Legacy / trivial cases: bin-packing has no benefit. for ($i = 0; $i -lt $Rows.Count; $i++) { $b = $i % $Buckets $result[$b] += $Rows[$i] } return ,$result } # Cost-aware greedy bin-pack. $costs = @{} foreach ($row in $Rows) { $costs[$row] = Get-Layer7RowCost -Row $row } # Sort DESC by cost. Stable for ties (PowerShell's Sort-Object is NOT stable; # use a secondary key by original index to make ordering deterministic for tests). $indexed = for ($i = 0; $i -lt $Rows.Count; $i++) { [pscustomobject]@{ Row = $Rows[$i]; Cost = $costs[$Rows[$i]]; Index = $i } } $sorted = @($indexed | Sort-Object -Property @{Expression='Cost';Descending=$true}, @{Expression='Index';Descending=$false}) $bucketCost = New-Object 'int[]' $Buckets foreach ($entry in $sorted) { # Find bucket with minimum cumulative cost (ties → lowest index). $minIdx = 0 for ($b = 1; $b -lt $Buckets; $b++) { if ($bucketCost[$b] -lt $bucketCost[$minIdx]) { $minIdx = $b } } $result[$minIdx] += $entry.Row $bucketCost[$minIdx] += $entry.Cost } return ,$result } function Get-Layer7RowCost { <# .SYNOPSIS Estimate the relative cost of testing a Layer-7 row, used by Split-Layer7BucketsRoundRobin. .DESCRIPTION Returns 3 for CRL/OCSP / Critical rows (slowest — chain validation, often blocked endpoints with full timeout), 2 for Wildcard / Redirected rows (medium — extra DNS + sometimes a second HEAD), and 1 for everything else. The exact numbers are not load-bearing; they only need to reflect the relative wall-clock weight so the greedy bin-pack balances correctly. #> [CmdletBinding()] [OutputType([int])] param( [Parameter(Mandatory)] [object]$Row ) $isCrl = ($Row.PSObject.Properties['Source'] -and ($Row.Source -match 'CRL|OCSP|crl\.|ocsp\.')) $isCrit = ($Row.PSObject.Properties['Source'] -and ($Row.Source -match 'Critical')) $isWild = ($Row.PSObject.Properties['IsWildcard'] -and $Row.IsWildcard) $isRedir = ($Row.PSObject.Properties['Source'] -and ($Row.Source -match 'Redirect')) if ($isCrl -or $isCrit) { return 3 } if ($isWild -or $isRedir) { return 2 } return 1 } # SIG # Begin signature block # MIInKwYJKoZIhvcNAQcCoIInHDCCJxgCAQExDzANBglghkgBZQMEAgEFADB5Bgor # BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG # KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCACELOKVEcFXkxd # 5728R37fXcCPD3fwyUUwumGnFhSuS6CCDLowggX1MIID3aADAgECAhMzAAACHU0Z # yE7XD1dIAAAAAAIdMA0GCSqGSIb3DQEBCwUAMFcxCzAJBgNVBAYTAlVTMR4wHAYD # VQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBD # b2RlIFNpZ25pbmcgUENBIDIwMjQwHhcNMjYwNDE2MTg1OTQzWhcNMjcwNDE1MTg1 # OTQzWjB0MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UE # BxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMR4wHAYD # VQQDExVNaWNyb3NvZnQgQ29ycG9yYXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IB # DwAwggEKAoIBAQDQvewXxx9gZZFC6Ys1WBay8BJ8kGA4JQnH5CMafqOASlTpK9H8 # o5ZXTXt0caVQTNMUPt445wXYD+dFtaKWTwDn1I52oUSrC9vJin1Gsqt+zyKJL5Dg # 3eQXbQNR61DmMy20GLTIO3SFed9Rfi/ophgCLGFLDR3r0KvHjwMb/jYWS0celV/4 # Lz27LfAekm8v9E5IXaeiXbAUYZKK090n4CVl3JBtbN+9DtI9SNu/yjvozW52/u7R # X/Ttpa/KDlpuokZ+Zcbvmtd9ur9gFLvZzh41o9MsE/clQtdaFWGvuo6Jua/ntpgk # ey3E5/vBFe+MJPG6phdnuo6r57ZudCudiI1bAgMBAAGjggGbMIIBlzAOBgNVHQ8B # Af8EBAMCB4AwHwYDVR0lBBgwFgYKKwYBBAGCN0wIAQYIKwYBBQUHAwMwHQYDVR0O # BBYEFH6QuMwqcPG0hQlQ6c5jCtTTLrVeMEUGA1UdEQQ+MDykOjA4MR4wHAYDVQQL # ExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xFjAUBgNVBAUTDTIzMDAxMis1MDc1NTkw # HwYDVR0jBBgwFoAUf1k/VCHarU/vBeXmo9ctBpQSCDEwYAYDVR0fBFkwVzBVoFOg # UYZPaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9jcmwvTWljcm9zb2Z0 # JTIwQ29kZSUyMFNpZ25pbmclMjBQQ0ElMjAyMDI0LmNybDBtBggrBgEFBQcBAQRh # MF8wXQYIKwYBBQUHMAKGUWh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMv # Y2VydHMvTWljcm9zb2Z0JTIwQ29kZSUyMFNpZ25pbmclMjBQQ0ElMjAyMDI0LmNy # dDAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEBCwUAA4ICAQBKTbYOjzwTG/DXGaz9 # s6+fQeaTtDcFmMY+5UyVFCyj7Pv+5i37qfX8lSL/tBIfYQfWsMuBQlfZurJD6r4H # VJ2CeH+1fgiq8dcHdVKoZ3Sa2qXoX3cq9iS8cVb06B7+5/XJ7I0OxHH9fDsvJ3T3 # w5V/ZtAIFmLrl+P0CtG+92uzRsn0nTbdFjOkLMLWPLAU3THohKRlSEMgFJpPkm5n # 5UAZ35xX6FWCrDLsSKb555bTifwa8mJBwdlof0bmfYidH+dxZ1FdDxvLnNl9zeKs # A4kejaaIqqIPguhwAti5Ql7BlTNoJNwxCvBmqW2MQLnCkYN/VVUsR3V2x/rcTNzo # Bf/Z/SpROvdaA2ZOOd1uioXJt3tdLQ7vHpqpib0KfWr/FWXW10q38VxfCnRQBqzb # SuztR7nEMuzX7Ck+B/XaPDXd1qh72+QYyB0Z2VzWmO9zsnb9Uq/dwu8LGeQqnyu6 # 7SDGACvnXii2fb9+US492VTnXSnFKyqwgzUyFMtZK1/sHYTv6bG4TtQUygQxTN+Z # V+aJIlKO2MqZ7bKrAnOzS9m6NgoTdWOq11bTOZwKlIEV/EhV9SWkDmdpR/hPPT2v # 6TEj4F8PT/zHjRezIU5c/DGlt/VhY/pK0XkJtEyMmmS1BMtjU/rqBZVMIm3dnxQs # /TBByr+Cf8Z1r7aifQVQ+WSqzjCCBr0wggSloAMCAQICEzMAAAA5O7Y3Gb8GHWcA # AAAAADkwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpX # YXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQg # Q29ycG9yYXRpb24xMjAwBgNVBAMTKU1pY3Jvc29mdCBSb290IENlcnRpZmljYXRl # IEF1dGhvcml0eSAyMDExMB4XDTI0MDgwODIwNTQxOFoXDTM2MDMyMjIyMTMwNFow # VzELMAkGA1UEBhMCVVMxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEo # MCYGA1UEAxMfTWljcm9zb2Z0IENvZGUgU2lnbmluZyBQQ0EgMjAyNDCCAiIwDQYJ # KoZIhvcNAQEBBQADggIPADCCAgoCggIBANgBnB7jOMeqlRYHNa265v4IY9fH8TKh # emHfPINe1gpLaV3dhg324WwH06LcHbpnsBukCDNitryo0dtS/EW6I/yEL/bLSY8h # KpbfQuWusBPr9qazYcDxCW/qnjb5JsI1s8bNOg3bVATvQVL4tcf03aTycsz8QeCd # M0l/yHRObJ9QqazM1r6VPEOJ7LL+uEEb73w6QCuhs89a1uv1zerOYMnsneRRwCbp # yW11IcggU0cRKDDq1pjVJzIbIF6+oiXXbReOsgeI8zu1FyQfK0fVkaya8SmVHQ/t # Of23mZ4W9k0Ri22QW9p3UgSC5OUDktKxxcCmGL6tXLfOGSWHIIV4YrTJTT6PNty5 # REojHJuZHArkF9VnHTERWoTjAzfI3kP+5b4alUdhgAZ7ttOu1bVnXfHaqPYl2rPs # 20ji03LOVWsh/radgE17es5hL+t6lV0eVHrVhsssROWJuz2MXMCt7iw7lFPG9LXK # Gjsmonn2gotGdHIuEg5JnJMJVmixd5LRlkmgYRZKzhxSCwyoGIq0PhaA7Y+VPct5 # pCHkijcIIDm0nlkK+0KyepolcqGm0T/GYQRMhHJlGOOmVQop36wUVUYklUy++vDW # eEgEo4s7hxN6mIbf2MSIQ/iIfMZgJxC69oukMUXCrOC3SkE/xIkgpfl22MM1itkZ # 35nNXkMolU1lAgMBAAGjggFOMIIBSjAOBgNVHQ8BAf8EBAMCAYYwEAYJKwYBBAGC # NxUBBAMCAQAwHQYDVR0OBBYEFH9ZP1Qh2q1P7wXl5qPXLQaUEggxMBkGCSsGAQQB # gjcUAgQMHgoAUwB1AGIAQwBBMA8GA1UdEwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAU # ci06AjGQQ7kUBU7h6qfHMdEjiTQwWgYDVR0fBFMwUTBPoE2gS4ZJaHR0cDovL2Ny # bC5taWNyb3NvZnQuY29tL3BraS9jcmwvcHJvZHVjdHMvTWljUm9vQ2VyQXV0MjAx # MV8yMDExXzAzXzIyLmNybDBeBggrBgEFBQcBAQRSMFAwTgYIKwYBBQUHMAKGQmh0 # dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2kvY2VydHMvTWljUm9vQ2VyQXV0MjAx # MV8yMDExXzAzXzIyLmNydDANBgkqhkiG9w0BAQwFAAOCAgEAFJQfOChP7onn6fLI # MKrSlN1WYKwDFgAddymOUO3FrM8d7B/W/iQ6DxXsDn7D5W4wMwYeLystcEqfkjz4 # NURRgazyMu5yRzQh4LqjA4tStTcJh1opExo7nn5PuPBYnbu0+THSuVHTe0VTTPVh # ily/piFrDo3axQ9P4C+Ol5yet+2gTfekICS5xS+cYfSIvgn0JksVBVMYVI5QFu/q # hnLhsEFEUzG8fvv0hjgkO+lkpV9ty6GkN4vdnd7ya6Q6aR9y34aiM1qmxaxBi6OU # nyNl6fkuun/diTFnYDLTppOkr/mg5WSfCiDVMNCxtj4wPKC5OmHm1DQIt/MNokbb # H3UGsFP1QbzsLocuSqLCvH09Io3fDPTmscR9Y75G4qX7RTX8AdBPo0I6OEojf39z # uFZt0qOHm65YWQE69cZM2ueE1MB05dNNgHK9gTE7zKvK/fg8B2qjW88MT/WF5V5u # vZGtqa9FSL2RazArA+rDPuf6JGYz4HpgMZHB4S6szWSKYBv0VisCzfxgeU+dquXW # 9bd0auYlOB58DPcOYKdc3Se94g+xL4pcEhbB54JOgAkwYTu/9dLeH2pDqeJZAABV # DWRQCaXfO5LgyKwKCLYXpigrZYCjUSBcr+Ve8PFWMhVTQl0v4q8J/AUmQN5W4n10 # 1cY2L4A7GTQG1h32HHAvfQESWP0xghnHMIIZwwIBATBuMFcxCzAJBgNVBAYTAlVT # MR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jv # c29mdCBDb2RlIFNpZ25pbmcgUENBIDIwMjQCEzMAAAIdTRnITtcPV0gAAAAAAh0w # DQYJYIZIAWUDBAIBBQCggZAwGQYJKoZIhvcNAQkDMQwGCisGAQQBgjcCAQQwLwYJ # KoZIhvcNAQkEMSIEIPl8RfmfKgQmvC7/5iF8kAcM9It6+VM9Hu5dl76IYGmfMEIG # CisGAQQBgjcCAQwxNDAyoBSAEgBNAGkAYwByAG8AcwBvAGYAdKEagBhodHRwOi8v # d3d3Lm1pY3Jvc29mdC5jb20wDQYJKoZIhvcNAQEBBQAEggEAKjxphzElZ1BpOlzf # lP4jEmue9tKMgpbj7YNlgBZD+Qd23JoD/mmM/KOcgDGSBA1FRmQaShIGdLpiYFhq # RGt+FG9+e7zKBqNzAwiASOJ9N+rsk3wCLGsZ+gIXazKsVZu8noH6Kpaze/yjTuNa # r+inXNQ6XoZUfK19HHJsVxrL3RIAOQK1Nq0LbV+sXl7skxOPIeR8zf8+CriGukf5 # JWGdlXjziIFF8CjbqHXAzHNzC9t2/5OlN3aPHO93bWOOcxzLazhWaE3Br/UfZkkL # CeZkkAm48GsGhxXYgSsft+5PqL6rhoMv5A/hbOb37LZfdAIG/axgRGEDlodKk936 # KHhSLaGCF5cwgheTBgorBgEEAYI3AwMBMYIXgzCCF38GCSqGSIb3DQEHAqCCF3Aw # ghdsAgEDMQ8wDQYJYIZIAWUDBAIBBQAwggFSBgsqhkiG9w0BCRABBKCCAUEEggE9 # MIIBOQIBAQYKKwYBBAGEWQoDATAxMA0GCWCGSAFlAwQCAQUABCCQJWrcpwz3Hw4c # A6l4ovfOYDdLN80u8wraWuLVd3aiBQIGaql/E2zgGBMyMDI2MDkyNTE3MTEyNS4w # NzdaMASAAgH0oIHRpIHOMIHLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGlu # Z3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBv # cmF0aW9uMSUwIwYDVQQLExxNaWNyb3NvZnQgQW1lcmljYSBPcGVyYXRpb25zMScw # JQYDVQQLEx5uU2hpZWxkIFRTUyBFU046QTAwMC0wNUUwLUQ5NDcxJTAjBgNVBAMT # HE1pY3Jvc29mdCBUaW1lLVN0YW1wIFNlcnZpY2WgghHtMIIHIDCCBQigAwIBAgIT # MwAAAiu7AFD/TTuaoQABAAACKzANBgkqhkiG9w0BAQsFADB8MQswCQYDVQQGEwJV # UzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UE # ChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSYwJAYDVQQDEx1NaWNyb3NvZnQgVGlt # ZS1TdGFtcCBQQ0EgMjAxMDAeFw0yNjAyMTkxOTQwMTFaFw0yNzA1MTcxOTQwMTFa # MIHLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMH # UmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSUwIwYDVQQL # ExxNaWNyb3NvZnQgQW1lcmljYSBPcGVyYXRpb25zMScwJQYDVQQLEx5uU2hpZWxk # IFRTUyBFU046QTAwMC0wNUUwLUQ5NDcxJTAjBgNVBAMTHE1pY3Jvc29mdCBUaW1l # LVN0YW1wIFNlcnZpY2UwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCX # 3mi6OD3syUqQm4QqgkrKPbcsK/Qx3fYctL8+VM1uOY3booi5GxwauTgQf6JFHITT # oxS7gjqKlK8OFLzL6UTl0jxEK5t6DuOcgJXdvutimoTlOS0C3kyITXBAXoj/gp6h # RR9z6WRip1Ktkilb3dJXCjQqT9P2Cuujr+Vz8r+Z+jDl09ji/ic/4G34r3mVwjs/ # /Gnx9Pu31V8rXFicNiAzxpubawpbd8pqfzlWT2vnG3kF9l6MiREbvJ3XHLUwHQsh # 0t/TrSFx/s/yCqpJWYJ6oClG70tvsFH0aRP8wB4cP/CFa2ILvk26i3OcJBl+pqKj # HTSBy9mvwTPEDlnzco0Nt8R6pSPTXZgBsscHhoKfC0WQmOzY2keXbAmRTcZMyXz5 # v/AJbmoI0y07Bazvt5NkXddG9TErQWwtsFyIKrElDgWfHeCoTu1wu2ciD3dK72z3 # ca2gzoEDxT2j9BXIUKaiTzTdQPRsAMaO3dU0zaGwMMlwtSJyDh14YEgZoUu5vS8M # ugMqdrNjphyL65yKhjpAWbhYkIHO/0uZju95tP8zZNqXIRh4tdfWHJPATn9r+cxk # yuh2x0VLdfx1lmK9X3NjH0NtgAs5JB/wOlkyuudxmFTfWVyRrL37ispOZ8aPAFgv # yR6cNTkGpkFo35JRjciNmZiU4qT9Uty+V5gudFk1jwIDAQABo4IBSTCCAUUwHQYD # VR0OBBYEFD4WjuQTUJbtbd3jmvZku0FZ2eU2MB8GA1UdIwQYMBaAFJ+nFV0AXmJd # g/Tl0mWnG1M1GelyMF8GA1UdHwRYMFYwVKBSoFCGTmh0dHA6Ly93d3cubWljcm9z # b2Z0LmNvbS9wa2lvcHMvY3JsL01pY3Jvc29mdCUyMFRpbWUtU3RhbXAlMjBQQ0El # MjAyMDEwKDEpLmNybDBsBggrBgEFBQcBAQRgMF4wXAYIKwYBBQUHMAKGUGh0dHA6 # Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMvY2VydHMvTWljcm9zb2Z0JTIwVGlt # ZS1TdGFtcCUyMFBDQSUyMDIwMTAoMSkuY3J0MAwGA1UdEwEB/wQCMAAwFgYDVR0l # AQH/BAwwCgYIKwYBBQUHAwgwDgYDVR0PAQH/BAQDAgeAMA0GCSqGSIb3DQEBCwUA # A4ICAQDO/CKsciEM8kr1fqH4TlfT66ENoTjxXw810pyEq0PdrgLwfgT3x+1gz7CQ # HtUdevqMQ5qHyDLhm6pT911CYkGN+6g+MU7fMYTr6d3SxieJwBIoWkfR4g7SitGz # MKU465KEYejfddoUgovC/xcRpaALO5p3/A248ByhJiMttBQNDtsT/HaCFwRFCURb # y/f8c1kky8F8xkCXFz+/MtZ5d1lWFjwOI2geZHWq9XihDOgee5nS2koo5V6n8XG2 # 20UTevVf+pgmpIH71XKDVIYTGGZJs6yPlfJ2aXqw1ME4NR6okNsY3P1M31H6DMYR # fJGNBNep595kXGh3YzA3cCiyg+jmJ58h/fTvjngIpuUFfODpDjFx0ic1YoLANxhC # F3RhS9qYM7K40NEhKshYuaAkIG2XBKYig3r/0/b0sjvjBws55AYonMm3A8qcX/6k # 9Vfc0mv9dtonHuWGfA2b+qE2qpCnhzGbdDHq7iOSZEw01nNupAMf1c41k9IoTQ2z # 3iw6w4ZZoLOyg4TKMbp1krpT4trip/y30Cv5khyqCDNqaXQpBkOYON8LgtoQ3amV # OX7ix5jdrnx/vUxTUSigXvrWdL7Uk8kpmS0zto2Toy7aT5oBzCTvfj9iJ/BN/E1v # hFBkhJCvZ7PVvsMSnTTmkx2Fal2lVkztuAI44fD/uyLJdaMQSzCCB3EwggVZoAMC # AQICEzMAAAAVxedrngKbSZkAAAAAABUwDQYJKoZIhvcNAQELBQAwgYgxCzAJBgNV # BAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4w # HAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xMjAwBgNVBAMTKU1pY3Jvc29m # dCBSb290IENlcnRpZmljYXRlIEF1dGhvcml0eSAyMDEwMB4XDTIxMDkzMDE4MjIy # NVoXDTMwMDkzMDE4MzIyNVowfDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hp # bmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jw # b3JhdGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAgUENBIDIwMTAw # ggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDk4aZM57RyIQt5osvXJHm9 # DtWC0/3unAcH0qlsTnXIyjVX9gF/bErg4r25PhdgM/9cT8dm95VTcVrifkpa/rg2 # Z4VGIwy1jRPPdzLAEBjoYH1qUoNEt6aORmsHFPPFdvWGUNzBRMhxXFExN6AKOG6N # 7dcP2CZTfDlhAnrEqv1yaa8dq6z2Nr41JmTamDu6GnszrYBbfowQHJ1S/rboYiXc # ag/PXfT+jlPP1uyFVk3v3byNpOORj7I5LFGc6XBpDco2LXCOMcg1KL3jtIckw+DJ # j361VI/c+gVVmG1oO5pGve2krnopN6zL64NF50ZuyjLVwIYwXE8s4mKyzbnijYjk # lqwBSru+cakXW2dg3viSkR4dPf0gz3N9QZpGdc3EXzTdEonW/aUgfX782Z5F37Zy # L9t9X4C626p+Nuw2TPYrbqgSUei/BQOj0XOmTTd0lBw0gg/wEPK3Rxjtp+iZfD9M # 269ewvPV2HM9Q07BMzlMjgK8QmguEOqEUUbi0b1qGFphAXPKZ6Je1yh2AuIzGHLX # pyDwwvoSCtdjbwzJNmSLW6CmgyFdXzB0kZSU2LlQ+QuJYfM2BjUYhEfb3BvR/bLU # HMVr9lxSUV0S2yW6r1AFemzFER1y7435UsSFF5PAPBXbGjfHCBUYP3irRbb1Hode # 2o+eFnJpxq57t7c+auIurQIDAQABo4IB3TCCAdkwEgYJKwYBBAGCNxUBBAUCAwEA # ATAjBgkrBgEEAYI3FQIEFgQUKqdS/mTEmr6CkTxGNSnPEP8vBO4wHQYDVR0OBBYE # FJ+nFV0AXmJdg/Tl0mWnG1M1GelyMFwGA1UdIARVMFMwUQYMKwYBBAGCN0yDfQEB # MEEwPwYIKwYBBQUHAgEWM2h0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMv # RG9jcy9SZXBvc2l0b3J5Lmh0bTATBgNVHSUEDDAKBggrBgEFBQcDCDAZBgkrBgEE # AYI3FAIEDB4KAFMAdQBiAEMAQTALBgNVHQ8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB # /zAfBgNVHSMEGDAWgBTV9lbLj+iiXGJo0T2UkFvXzpoYxDBWBgNVHR8ETzBNMEug # SaBHhkVodHRwOi8vY3JsLm1pY3Jvc29mdC5jb20vcGtpL2NybC9wcm9kdWN0cy9N # aWNSb29DZXJBdXRfMjAxMC0wNi0yMy5jcmwwWgYIKwYBBQUHAQEETjBMMEoGCCsG # AQUFBzAChj5odHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpL2NlcnRzL01pY1Jv # b0NlckF1dF8yMDEwLTA2LTIzLmNydDANBgkqhkiG9w0BAQsFAAOCAgEAnVV9/Cqt # 4SwfZwExJFvhnnJL/Klv6lwUtj5OR2R4sQaTlz0xM7U518JxNj/aZGx80HU5bbsP # MeTCj/ts0aGUGCLu6WZnOlNN3Zi6th542DYunKmCVgADsAW+iehp4LoJ7nvfam++ # Kctu2D9IdQHZGN5tggz1bSNU5HhTdSRXud2f8449xvNo32X2pFaq95W2KFUn0CS9 # QKC/GbYSEhFdPSfgQJY4rPf5KYnDvBewVIVCs/wMnosZiefwC2qBwoEZQhlSdYo2 # wh3DYXMuLGt7bj8sCXgU6ZGyqVvfSaN0DLzskYDSPeZKPmY7T7uG+jIa2Zb0j/aR # AfbOxnT99kxybxCrdTDFNLB62FD+CljdQDzHVG2dY3RILLFORy3BFARxv2T5JL5z # bcqOCb2zAVdJVGTZc9d/HltEAY5aGZFrDZ+kKNxnGSgkujhLmm77IVRrakURR6nx # t67I6IleT53S0Ex2tVdUCbFpAUR+fKFhbHP+CrvsQWY9af3LwUFJfn6Tvsv4O+S3 # Fb+0zj6lMVGEvL8CwYKiexcdFYmNcP7ntdAoGokLjzbaukz5m/8K6TT4JDVnK+AN # uOaMmdbhIurwJ0I9JZTmdHRbatGePu1+oDEzfbzL6Xu/OHBE0ZDxyKs6ijoIYn/Z # cGNTTY3ugm2lBRDBcQZqELQdVTNYs6FwZvKhggNQMIICOAIBATCB+aGB0aSBzjCB # yzELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1Jl # ZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjElMCMGA1UECxMc # TWljcm9zb2Z0IEFtZXJpY2EgT3BlcmF0aW9uczEnMCUGA1UECxMeblNoaWVsZCBU # U1MgRVNOOkEwMDAtMDVFMC1EOTQ3MSUwIwYDVQQDExxNaWNyb3NvZnQgVGltZS1T # dGFtcCBTZXJ2aWNloiMKAQEwBwYFKw4DAhoDFQAJrD90ykHpo/0AGb7lmwvsCtqR # OaCBgzCBgKR+MHwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAw # DgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24x # JjAkBgNVBAMTHU1pY3Jvc29mdCBUaW1lLVN0YW1wIFBDQSAyMDEwMA0GCSqGSIb3 # DQEBCwUAAgUA7mCCMjAiGA8yMDI2MDkyNTA1MTYzNFoYDzIwMjYwOTI2MDUxNjM0 # WjB3MD0GCisGAQQBhFkKBAExLzAtMAoCBQDuYIIyAgEAMAoCAQACAg5JAgH/MAcC # AQACAhaaMAoCBQDuYdOyAgEAMDYGCisGAQQBhFkKBAIxKDAmMAwGCisGAQQBhFkK # AwKgCjAIAgEAAgMHoSChCjAIAgEAAgMBhqAwDQYJKoZIhvcNAQELBQADggEBAAsN # 2t8yMprRvs8abKfY+xmV/g7JTOJDQBjqkdXu36CZCVKPL6HtavYXXigDmOGZWQqL # QhLtowk2QqEONkg6kg59a1YGnbrWdMUTdj7f50Bjr+teZrrae46JGit7et8v6BMK # XofKOr5Vzw+VTo7G/1mo/+I81PoKW9im46jA1m52YKefgZ7QWW9hoyiJO0E86enc # XzMXaxo1SNLHDl8/IhELraW+dZX/7UNTP+sYY15waHiQaIMvFVUoqpWLJ+asWK5q # gwGkhKlohlGNlx8ehniO3VRUH3YPIGsGTDPIe3zsvckKvrLKQr5LWLZwhd9t8Xci # JDIyc7FqRsZJVaMwWqkxggQNMIIECQIBATCBkzB8MQswCQYDVQQGEwJVUzETMBEG # A1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWlj # cm9zb2Z0IENvcnBvcmF0aW9uMSYwJAYDVQQDEx1NaWNyb3NvZnQgVGltZS1TdGFt # cCBQQ0EgMjAxMAITMwAAAiu7AFD/TTuaoQABAAACKzANBglghkgBZQMEAgEFAKCC # AUowGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEEMC8GCSqGSIb3DQEJBDEiBCDT # oILGezCCv16dUcmTNABv379GbLRuv4FYvGQ1jWb5YDCB+gYLKoZIhvcNAQkQAi8x # geowgecwgeQwgb0EIHIOI/Q/kFftYA+M2OY+1Bx3ajBD6/WDAtPT2vFkv25SMIGY # MIGApH4wfDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNV # BAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEmMCQG # A1UEAxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAgUENBIDIwMTACEzMAAAIruwBQ/007 # mqEAAQAAAiswIgQg/m8zrAPwMvB5F5JAyswXPaGXtEhc+fmz4ynVO2vHZz8wDQYJ # KoZIhvcNAQELBQAEggIAR1yjM0YUFxnDDvgzJmBF4zF7Z0UI2g/xGGMw1y0IlaMJ # 0jL6hS49vJt9e3eGr2V7IipSAE82XdYKdgijRkwRbqohYk7M/3IBs+X5eDAl00QP # mHgavmryCPLaWVd/e6n43+BqgKr+vZnaQuwqWqQp0uT4uaHaxtM88EVawNtnShC0 # gDGv+NyGNXTu7qzMRIlk9eYfyZ78eRr6w4TT/wD45jQ/7kRxxeaaH9CEOzGY6UJ0 # P3NvXGEO2Gitpd8LOhMgyqgABENjcJhxFtNkcrVWGwVyvKkpnQFs9kBRCjCbWaui # zphvwpf5HRHUlzi7VyZmWx+UiIrFuWa6JrYGxNkhE+2nvpwLngbeNbQMvhgQk1eH # GYcrgR8xD9i2IggpfPwR1wAWZ1JBWIDQUM4umRNnD/ipJVokpNl/DX6s6lq3pDmA # yMhl/1utMNaadeijeJ+mwnb1ZSIRJfixkz3PpueohoN6qw+dmxaSbVK1Mhw3COqg # PpXUnwmbKkxTMUgPmrwwr75OYTxutekb1Oz7L2SmNlxKMqGL9qwNTB1N38+d9CTR # 5zEO+T1MUPutxXCBOb4gm5OW8ksrsi8D4x9T4V7zyuDiqro60MkrS19tHtupwd4W # kAq5wliuHLWhzozvUNrzB9TUIpMhssszRy0bgT1J7mgWzhabCWZ1W+lMRW3pCG8= # SIG # End signature block |