modules/AzStack.Insights/AzStack.Insights.Helper.psm1
|
<################################################################
# # # Copyright (C) Microsoft Corporation. All rights reserved. # # # ################################################################> function Get-InsightModulePaths { <# .SYNOPSIS Returns the resolved paths for the module root and packages directory. .DESCRIPTION Derives paths from the module file's own $PSScriptRoot, which PowerShell binds at module load time and cannot be overwritten by script code. Prefer this over reading from a global variable, which can be overwritten at runtime. .OUTPUTS PSCustomObject with ModuleRoot and PackagesPath properties. #> [CmdletBinding()] [OutputType([PSCustomObject])] param() # $PSScriptRoot here is always the AzStack.Insights module directory # (modules\AzStack.Insights\), so two levels up reaches the version root. $moduleRoot = (Get-Item -Path (Join-Path -Path $PSScriptRoot -ChildPath '..\..') -ErrorAction Stop).FullName $packagesPath = Join-Path -Path $moduleRoot -ChildPath 'packages' return [PSCustomObject]@{ ModuleRoot = $moduleRoot PackagesPath = $packagesPath } } function Get-ParsedFileVersion { <# .SYNOPSIS Returns a parsed System.Version value from a file's version metadata. .DESCRIPTION Reads FileVersion first, then ProductVersion, and extracts a numeric version token (for example, 1.2.3.4). Returns $null when no version can be parsed. .PARAMETER FilePath Path to the file whose version should be parsed. .OUTPUTS System.Version or $null. #> [CmdletBinding()] [OutputType([System.Version])] param( [Parameter(Mandatory = $true)] [string]$FilePath ) $versionInfo = (Get-Item -Path $FilePath -ErrorAction Stop).VersionInfo $rawVersion = $versionInfo.FileVersion if ([string]::IsNullOrWhiteSpace($rawVersion)) { $rawVersion = $versionInfo.ProductVersion } if ([string]::IsNullOrWhiteSpace($rawVersion)) { return $null } $versionMatch = [System.Text.RegularExpressions.Regex]::Match($rawVersion, '\d+(\.\d+){1,3}') if (-not $versionMatch.Success) { return $null } try { return [System.Version]$versionMatch.Value } catch { return $null } } function Test-isFailoverCluster { [CmdletBinding()] param() # Detecting Failover Cluster based on the presence of the Get-Cluster cmdlet return ((Get-Command "Get-Cluster" -ErrorAction Ignore) -and (Get-Cluster -ErrorAction Ignore)) } function Get-NodeFqdn { <# .SYNOPSIS Resolves the local node FQDN with resilient fallback behavior. .DESCRIPTION Uses Win32_ComputerSystem identity first, then DNS host lookup, then USERDNSDOMAIN, and finally falls back to computer name. #> [CmdletBinding()] param() $computerSystem = Get-CimInstance -ClassName Win32_ComputerSystem -ErrorAction SilentlyContinue if ($null -ne $computerSystem -and $computerSystem.PartOfDomain -and -not [string]::IsNullOrWhiteSpace($computerSystem.DNSHostName) -and -not [string]::IsNullOrWhiteSpace($computerSystem.Domain) -and $computerSystem.Domain -ne 'WORKGROUP') { return "$($computerSystem.DNSHostName).$($computerSystem.Domain)" } try { $hostName = [System.Net.Dns]::GetHostEntry($Env:ComputerName).HostName if (-not [string]::IsNullOrWhiteSpace($hostName) -and $hostName.Contains('.')) { return $hostName } } catch { } if (-not [string]::IsNullOrWhiteSpace($Env:USERDNSDOMAIN)) { return "$($Env:ComputerName).$($Env:USERDNSDOMAIN)" } return $Env:ComputerName } function Get-FirewallEndpoints { <# .SYNOPSIS Retrieves the required firewall endpoints for a specified Azure region. .DESCRIPTION This function returns a collection of firewall endpoints that need to be opened for Azure Local operations in the specified region. This comes from https://learn.microsoft.com/en-us/azure/azure-local/concepts/system-requirements-23h2?view=azloc-2601&tabs=azure-public .OUTPUTS Collection of PSObjects representing firewall endpoints. .EXAMPLE $endpoints = Get-FirewallEndpoints -Region 'eastus' Retrieves all firewall endpoints for the 'eastus' region and stores them in the $endpoints variable. #> [CmdletBinding()] param ( [Parameter(Mandatory = $true)] [string]$Region ) $endpointRootDir = Get-Item -Path "$PSScriptRoot\config\firewall_endpoints" try { switch ($Region) { 'australiaeast' { $configData = Import-PowerShellDataFile -Path (Join-Path -Path $endpointRootDir.FullName -ChildPath "AustraliaEastEndpoints.psd1") } 'canadacentral' { $configData = Import-PowerShellDataFile -Path (Join-Path -Path $endpointRootDir.FullName -ChildPath "CanadaCentralEndpoints.psd1") } 'eastus' { $configData = Import-PowerShellDataFile -Path (Join-Path -Path $endpointRootDir.FullName -ChildPath "EastUSEndpoints.psd1") } 'centralindia' { $configData = Import-PowerShellDataFile -Path (Join-Path -Path $endpointRootDir.FullName -ChildPath "IndiaCentralEndpoints.psd1") } 'japaneast' { $configData = Import-PowerShellDataFile -Path (Join-Path -Path $endpointRootDir.FullName -ChildPath "JapanEastEndpoints.psd1") } 'southcentralus' { $configData = Import-PowerShellDataFile -Path (Join-Path -Path $endpointRootDir.FullName -ChildPath "SouthCentralUSEndpoints.psd1") } 'southeastasia' { $configData = Import-PowerShellDataFile -Path (Join-Path -Path $endpointRootDir.FullName -ChildPath "SoutheastAsiaEndpoints.psd1") } 'westeurope' { $configData = Import-PowerShellDataFile -Path (Join-Path -Path $endpointRootDir.FullName -ChildPath "WestEuropeEndpoints.psd1") } 'usgovvirginia' { $configData = Import-PowerShellDataFile -Path (Join-Path -Path $endpointRootDir.FullName -ChildPath "USGovVirginiaEndpoints.psd1") } default { return $null } } return $configData.Endpoints } catch { throw "Failed to load firewall endpoints for region '$Region'. $_" } } function Get-MocConfigCached { <# .SYNOPSIS Returns MOC configuration, using the global cache when available. .DESCRIPTION Reads from $Global:MocArbCachedMocConfig if populated (set by the MocArb component). On cache miss, calls Get-MocConfig directly with up to 5 retry attempts and exponential backoff to handle transient MOC file lock errors on the shared catalogs file. .PARAMETER CallerName Label used in diagnostic messages. .OUTPUTS The MOC configuration object, or $null if all attempts fail. #> [CmdletBinding()] param ( [Parameter(Mandatory = $false)] [string]$CallerName = 'MocArb' ) if ($Global:MocArbCachedMocConfig) { return $Global:MocArbCachedMocConfig } Write-Verbose "[$env:COMPUTERNAME][$CallerName] Cache miss, calling Get-MocConfig directly" $mocConfig = $null for ($attempt = 1; $attempt -le 5; $attempt++) { try { $mocConfig = Get-MocConfig -ErrorAction SilentlyContinue 2>$null } catch { } if ($mocConfig) { Write-Verbose "[$env:COMPUTERNAME][$CallerName] Get-MocConfig succeeded on attempt $attempt" return $mocConfig } if ($attempt -lt 5) { $backoff = 2 * $attempt Write-Warning "[$env:COMPUTERNAME][$CallerName] Get-MocConfig attempt $attempt failed, retrying in ${backoff}s" Start-Sleep -Seconds $backoff } } Write-Warning "[$env:COMPUTERNAME][$CallerName] Get-MocConfig failed after 5 attempts" return $null } function Get-ArbControlPlaneVMs { <# .SYNOPSIS Returns local Hyper-V VM objects for the ARB control-plane VM. .DESCRIPTION Calls Get-VM -Name '*control-plan*' on the local node, then disambiguates when multiple VMs match (e.g., AKS workloads also create control-plane VMs). Uses three methods to identify the real ARB VM: 1. Cluster group: ARB VM belongs to the '<clusterName>-arcbridge' cluster group. The cluster group name reliably contains 'arcbridge' even though the VM name does not. 2. MOC kubeconfig IP: Matches the API server IP from the ARB kubeconfig to VM network adapters. Kubeconfigs under paths containing 'arcbridge' are preferred over AKS kubeconfigs. 3. ARB hex-ID name pattern: matches '<hex>-control-plan[hex/random]-<hex>' VM names. Two real-world variants are seen in the field — '<hex>-control-plane-0-<hex>' (older clusters) and '<hex>-control-plan<5-char-suffix>-<hex>' (newer clusters, e.g. LH-21). Both are covered. AKS control-plane VMs use non-hex prefixes so this still excludes them. Falls back to returning all matches if disambiguation fails. .OUTPUTS Array of Hyper-V VM objects, or empty array if none found on this node. #> [CmdletBinding()] param () $vms = @(Get-VM -Name '*control-plan*' -ErrorAction Ignore) if ($vms.Count -le 1) { return $vms } # Multiple VMs matched — AKS workloads can create additional control-plane VMs. Write-Verbose "[$env:COMPUTERNAME][Get-ArbControlPlaneVMs] Found $($vms.Count) VMs matching '*control-plan*', disambiguating ARB VM..." # Method 1: Cross-reference with the ARB failover cluster group (<clusterName>-arcbridge) # The cluster group name reliably contains 'arcbridge'; the VM name itself does not. try { $clusterName = Get-AzsSupportEceManagementClusterName -ErrorAction Stop $arbGroupName = "$clusterName-arcbridge" $arbGroup = Get-ClusterGroup -Name $arbGroupName -ErrorAction Ignore if ($arbGroup) { $arbGroupResources = @(Get-ClusterResource -InputObject $arbGroup -ErrorAction Ignore | Where-Object { $_.ResourceType -eq 'Virtual Machine' }) if ($arbGroupResources.Count -gt 0) { $arbResourceNames = @($arbGroupResources | ForEach-Object { $_.Name }) # Cluster resource names for VMs are typically 'Virtual Machine <VMName>' $matched = @($vms | Where-Object { $vmName = $_.Name $arbResourceNames -contains $vmName -or $arbResourceNames -contains "Virtual Machine $vmName" }) if ($matched.Count -gt 0) { Write-Verbose "[$env:COMPUTERNAME][Get-ArbControlPlaneVMs] Narrowed to $($matched.Count) VM(s) by cluster group '$arbGroupName'" return $matched } } } } catch { Write-Warning "[$env:COMPUTERNAME][Get-ArbControlPlaneVMs] Cluster group cross-reference skipped: $_" } # Method 2: Match VM network adapter IPs against the ARB kubeconfig API server IP # Prefer kubeconfigs whose path contains 'arcbridge' to avoid picking up AKS kubeconfigs. $arbIp = $null $mocCfg = Get-MocConfigCached -CallerName 'Get-ArbControlPlaneVMs' if ($mocCfg -and $mocCfg.WorkingDir -and (Test-Path $mocCfg.WorkingDir)) { $kubeconfigs = @(Get-ChildItem -Path $mocCfg.WorkingDir -Filter 'kubeconfig' -Recurse -Depth 10 -ErrorAction Ignore) # Prefer kubeconfigs under arcbridge paths $arcbridgeKubeconfigs = @($kubeconfigs | Where-Object { $_.FullName -like '*arcbridge*' }) $orderedKubeconfigs = if ($arcbridgeKubeconfigs.Count -gt 0) { $arcbridgeKubeconfigs } else { $kubeconfigs } foreach ($kc in $orderedKubeconfigs) { $content = Get-Content -Path $kc.FullName -Raw -ErrorAction Ignore if ($content -match 'server:\s*https?://([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+):6443') { $arbIp = $matches[1] break } } } if ($arbIp) { $matched = @($vms | Where-Object { $vmIps = @( $_ | Get-VMNetworkAdapter -ErrorAction Ignore | ForEach-Object { $_.IPAddresses } | Where-Object { $_ -match '^\d+\.' } ) $vmIps -contains $arbIp }) if ($matched.Count -gt 0) { Write-Verbose "[$env:COMPUTERNAME][Get-ArbControlPlaneVMs] Narrowed to $($matched.Count) VM(s) by MOC kubeconfig IP ($arbIp)" return $matched } } # ------------------------------------------------------------------------------------------ # Method 3: ARB-vs-AKS disambiguation by VM name regex — READ BEFORE MODIFYING # ------------------------------------------------------------------------------------------ # The regex below matches ONLY the Arc Resource Bridge (ARB) control-plane VM. # It DELIBERATELY EXCLUDES AKS workload-cluster control-plane VMs (which can co-exist). # # Discriminator: the leading prefix before '-control-plan' must be ALL hex chars [0-9a-f]. # ARB VM prefix is a derived Azure resource identifier — all hex, typically ~45 chars: # caa5017c65b71e53681da3c40ae39f0807ad6c3f216b0-control-planzzq2l-92b1f66d (newer) # 013bc87fb2959d61230552d6d19dc6c9e7483f83cd66-control-plane-0-3e9345d2 (older) # AKS workload-cluster control-plane VM prefix contains non-hex letters (g–z), e.g. # 0002akscls001-control-plane-... ('k','s','c','l' are not hex → no match) # # If you are looking for AKS control-plane VMs you need a DIFFERENT regex/lookup — # this one will silently skip them. # ------------------------------------------------------------------------------------------ $matched = @($vms | Where-Object { $_.Name -imatch '^[0-9a-f]+-control-plan[a-z0-9-]+-[0-9a-f]+$' }) if ($matched.Count -gt 0) { Write-Verbose "[$env:COMPUTERNAME][Get-ArbControlPlaneVMs] Narrowed to $($matched.Count) VM(s) by ARB hex-ID name pattern" return $matched } Write-Warning "[$env:COMPUTERNAME][Get-ArbControlPlaneVMs] Could not disambiguate $($vms.Count) control-plane VMs. Returning all matches." return $vms } function Get-ArbControlPlaneTargets { <# .SYNOPSIS Discovers ARB control-plane VM IPv4 addresses. .DESCRIPTION Uses two methods to find ARB control-plane VM IPs: 1. Local Hyper-V (Get-VM) for VMs matching '*control-plan*' on this node. 2. Parses kubeconfig files in the MOC working directory and ClusterStorage for the Kubernetes API server IP (port 6443). Method 2 uses Get-MocConfigCached to locate the MOC working directory. .PARAMETER CallerName Label used in diagnostic messages. .OUTPUTS Array of unique IPv4 address strings, or empty array if none found. #> [CmdletBinding()] param ( [Parameter(Mandatory = $false)] [string]$CallerName = 'MocArb' ) $arbTargets = @() # Method 1: Local Get-VM for ARB control-plane VMs on this node $arbVMs = Get-ArbControlPlaneVMs if ($arbVMs) { $arbTargets = @( $arbVMs | Get-VMNetworkAdapter -ErrorAction Ignore | ForEach-Object { $_.IPAddresses } | Where-Object { $_ } | Where-Object { $_ -match '^\d+\.' } ) } # Method 2: Parse kubeconfig files for API server IP if ($arbTargets.Count -eq 0) { $searchPaths = @() $mocCfg = Get-MocConfigCached -CallerName $CallerName if ($mocCfg.WorkingDir) { $searchPaths += $mocCfg.WorkingDir } $searchPaths += 'C:\ClusterStorage' foreach ($searchPath in $searchPaths) { if (-not (Test-Path $searchPath)) { continue } $kubeconfigs = @(Get-ChildItem -Path $searchPath -Filter 'kubeconfig' -Recurse -Depth 10 -ErrorAction Ignore) # On clusters with AKS workloads, multiple kubeconfigs exist (ARB + AKS target clusters). # Prefer kubeconfigs whose path contains 'arcbridge' to avoid testing AKS endpoints. $arcbridgeKubeconfigs = @($kubeconfigs | Where-Object { $_.FullName -like '*arcbridge*' }) $orderedKubeconfigs = if ($arcbridgeKubeconfigs.Count -gt 0) { $arcbridgeKubeconfigs } else { $kubeconfigs } foreach ($kc in $orderedKubeconfigs) { $content = Get-Content -Path $kc.FullName -Raw -ErrorAction Ignore if ($content -match 'server:\s*https?://([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+):6443') { $arbTargets += $matches[1] } } $arbTargets = @($arbTargets | Select-Object -Unique) if ($arbTargets.Count -gt 0) { break } } } return $arbTargets } function Get-ArbKubeconfigs { <# .SYNOPSIS Finds ARB kubeconfig files on the local node. .DESCRIPTION Searches the MOC working directory and ClusterStorage for kubeconfig files that contain a Kubernetes API server endpoint (port 6443). .PARAMETER CallerName Label used in diagnostic messages. .OUTPUTS Array of FileInfo objects for matching kubeconfig files. #> [CmdletBinding()] param ( [Parameter(Mandatory = $false)] [string]$CallerName = 'MocArb' ) $searchPaths = @() $mocCfg = Get-MocConfigCached -CallerName $CallerName if ($mocCfg.WorkingDir) { $searchPaths += $mocCfg.WorkingDir } $searchPaths += 'C:\ClusterStorage' $found = @() foreach ($searchPath in $searchPaths) { if (-not (Test-Path $searchPath)) { continue } $kubeconfigs = @(Get-ChildItem -Path $searchPath -Filter 'kubeconfig' -Recurse -Depth 10 -ErrorAction Ignore) foreach ($kc in $kubeconfigs) { $content = Get-Content -Path $kc.FullName -Raw -ErrorAction Ignore if ($content -match 'server:\s*https?://[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:6443') { $found += $kc } } if ($found.Count -gt 0) { break } } return $found } function Get-EffectiveVlanId { <# .SYNOPSIS Resolves the effective VLAN ID applied to a Hyper-V virtual network adapter. .DESCRIPTION A Hyper-V vNIC can carry its VLAN in one of two places depending on how the port is programmed: - Access mode: the VLAN is in 'AccessVlanId' (Get-VMNetworkAdapterVlan) and the isolation 'DefaultIsolationID' reads 0. - VLAN isolation mode: the VLAN is in 'DefaultIsolationID' (Get-VMNetworkAdapterIsolation) and 'AccessVlanId' reads 0. SDN / ARC-SDN managed ports (including the ARB control-plane VM NIC) run in this mode. Reading only one source produces a false mismatch when the port uses the other. This helper applies the same precedence the virtual switch applies, so an access-mode port and an isolation-mode port carrying the same VLAN resolve to the same effective value. .PARAMETER VlanInfo The object returned by Get-VMNetworkAdapterVlan for the adapter. Optional. .PARAMETER IsolationInfo The object returned by Get-VMNetworkAdapterIsolation for the adapter. Optional. .OUTPUTS PSCustomObject with EffectiveVlanId, Source, and the raw diagnostic fields (OperationMode, AccessVlanId, IsolationMode, DefaultIsolationID). EffectiveVlanId is an int when the VLAN can be resolved, or $null with Source 'Unknown' when the adapter VLAN could not be determined (no usable isolation data and AccessVlanId 0). #> [CmdletBinding()] param ( [Parameter()] [object] $VlanInfo, [Parameter()] [object] $IsolationInfo ) $operationMode = $null $accessVlanId = $null $isolationMode = $null $defaultIsolationId = $null if ($null -ne $VlanInfo) { $operationMode = $VlanInfo.OperationMode $accessVlanId = $VlanInfo.AccessVlanId } if ($null -ne $IsolationInfo) { $isolationMode = $IsolationInfo.IsolationMode $defaultIsolationId = $IsolationInfo.DefaultIsolationID } # Precedence: a port in VLAN isolation mode carries its VLAN in DefaultIsolationID # (AccessVlanId reads 0 there). Otherwise an access-mode port carries it in # AccessVlanId. If neither is set and isolation data was readable the port is # genuinely untagged (0). If isolation data could NOT be read, an AccessVlanId of 0 # is ambiguous (it cannot distinguish an untagged port from a VLAN-isolation port # whose tag lives in DefaultIsolationID), so the effective VLAN is left unresolved # (null) and the caller keeps this adapter out of the drift comparison. if (($null -ne $isolationMode) -and ("$isolationMode" -eq 'Vlan') -and ($null -ne $defaultIsolationId) -and ([int]$defaultIsolationId -gt 0)) { $effectiveVlanId = [int]$defaultIsolationId $source = 'DefaultIsolationID' } elseif (($null -ne $accessVlanId) -and ([int]$accessVlanId -gt 0)) { $effectiveVlanId = [int]$accessVlanId $source = 'AccessVlanId' } elseif ($null -ne $IsolationInfo) { $effectiveVlanId = 0 $source = 'Untagged' } else { $effectiveVlanId = $null $source = 'Unknown' } return [PSCustomObject]@{ EffectiveVlanId = $effectiveVlanId Source = $source OperationMode = $operationMode AccessVlanId = $accessVlanId IsolationMode = $isolationMode DefaultIsolationID = $defaultIsolationId } } function Get-CimReferenceKeyValue { <# .SYNOPSIS Extracts a key property value from a CIM reference-typed property. .DESCRIPTION Reference-typed properties on a CimInstance (for example the 'Parent' and 'HostResource' properties of Msvm_EthernetPortAllocationSettingData) may be surfaced either as a Microsoft.Management.Infrastructure.CimInstance whose key properties are populated, or as a WMI object-path string of the form '...InstanceID="Microsoft:GUID\\GUID"...'. This helper returns the requested key value regardless of which representation is used, so callers do not have to branch on the shape of the reference. .PARAMETER Reference The reference-typed property value (CimInstance or object-path string). .PARAMETER KeyName The name of the key property to extract (for example 'InstanceID' or 'Name'). .OUTPUTS The string value of the requested key, or $null when it cannot be resolved. #> [CmdletBinding()] [OutputType([string])] param ( [Parameter()] [object] $Reference, [Parameter(Mandatory = $true)] [string] $KeyName ) if ($null -eq $Reference) { return $null } if ($Reference -is [Microsoft.Management.Infrastructure.CimInstance]) { $property = $Reference.CimInstanceProperties[$KeyName] if ($null -ne $property) { return [string]$property.Value } return $null } # Fall back to parsing an object-path string such as ...KeyName="value"... # Anchor the key name on a word boundary so it cannot match as a substring of a # different key. For example, Msvm_VirtualEthernetSwitch is a two-key class and its # real HostResource reference is: # Msvm_VirtualEthernetSwitch.CreationClassName="Msvm_VirtualEthernetSwitch",Name="<switch-guid>" # An unanchored 'Name="([^"]*)"' would match inside CreationClassName and return the # class name instead of the GUID; the '\b' anchor forces a match on the standalone key. $match = [regex]::Match([string]$Reference, '\b' + [regex]::Escape($KeyName) + '="([^"]*)"') if ($match.Success) { # Backslashes inside a WMI object-path key value are escaped (doubled). The real # Parent reference emitted by Hyper-V is, for example, # Msvm_SyntheticEthernetPortSettingData.InstanceID="Microsoft:<guid>\\<portGuid>" # Unescape the doubled backslash so the returned value matches the single-backslash # form the referenced instance reports through its own InstanceID key property # (otherwise the correlating hashtable lookup in Get-VMNetworkAdapterFromCim misses # and every adapter is silently skipped). return $match.Groups[1].Value -replace '\\\\', '\' } return $null } function Get-VMNetworkAdapterFromCim { <# .SYNOPSIS Collects Hyper-V VM network adapters using CIM cmdlets instead of Get-VMNetworkAdapter. .DESCRIPTION Get-VMNetworkAdapter is expensive on hosts with many VMs because it performs a large number of per-adapter WMI association traversals. This helper issues a small, fixed number of bulk Get-CimInstance queries against the root\virtualization\v2 namespace and correlates the results in memory, which scales far better on dense hosts. Only adapters that are connected to a virtual switch are returned (the connection is represented by Msvm_EthernetPortAllocationSettingData). Disconnected adapters have no switch association and are therefore not relevant to switch-scoped checks. The returned objects mirror the subset of Get-VMNetworkAdapter properties that the switch insight rules consume, so those rules do not need to change. .OUTPUTS PSCustomObject collection, each with: Name, VMName, IsManagementOs, SwitchName, SwitchId, MacAddress, and MacAddressSpoofing ('On' or 'Off'). #> [CmdletBinding()] [OutputType([System.Management.Automation.PSObject[]])] param () $namespace = 'root\virtualization\v2' $cimParams = @{ Namespace = $namespace; ErrorAction = 'Stop' } try { # Virtual switches: correlate by Name (the switch GUID, which matches Get-VMSwitch.Id). $switchByGuid = @{} foreach ($vSwitch in @(Get-CimInstance @cimParams -ClassName 'Msvm_VirtualEthernetSwitch')) { if (-not [string]::IsNullOrEmpty($vSwitch.Name)) { $switchByGuid[$vSwitch.Name] = $vSwitch } } # The host ("Hosting Computer System") owns the management OS (host) vNICs; any adapter # whose owning system GUID equals the host GUID is a management OS adapter. $hostSystemGuid = $null $vmNameByGuid = @{} foreach ($system in @(Get-CimInstance @cimParams -ClassName 'Msvm_ComputerSystem')) { if (-not [string]::IsNullOrEmpty($system.Name)) { $vmNameByGuid[$system.Name] = $system.ElementName } if ($system.Caption -ieq 'Hosting Computer System') { $hostSystemGuid = $system.Name } } # Port setting data describes each adapter (name, MAC). Both synthetic and emulated NICs. $portByInstanceId = @{} foreach ($portClass in @('Msvm_SyntheticEthernetPortSettingData', 'Msvm_EmulatedEthernetPortSettingData')) { foreach ($port in @(Get-CimInstance @cimParams -ClassName $portClass)) { if (-not [string]::IsNullOrEmpty($port.InstanceID)) { $portByInstanceId[$port.InstanceID] = $port } } } # Security setting data carries AllowMacSpoofing. Its InstanceID is the owning connection's # InstanceID plus a feature suffix, so index by the connection prefix for correlation. $securityByConnectionId = @{} foreach ($security in @(Get-CimInstance @cimParams -ClassName 'Msvm_EthernetSwitchPortSecuritySettingData')) { if ([string]::IsNullOrEmpty($security.InstanceID)) { continue } # InstanceID form: '<connection InstanceID>\<featureGuid>'. Strip the last segment. $connectionId = $security.InstanceID -replace '\\[^\\]*$', '' if (-not [string]::IsNullOrEmpty($connectionId)) { $securityByConnectionId[$connectionId] = $security } } $adapters = [System.Collections.Generic.List[object]]::new() # Each connection (allocation) ties an adapter port to a virtual switch. foreach ($connection in @(Get-CimInstance @cimParams -ClassName 'Msvm_EthernetPortAllocationSettingData')) { # Resolve the switch this connection targets from its HostResource references. $vSwitch = $null foreach ($hostResource in @($connection.HostResource)) { $switchGuid = Get-CimReferenceKeyValue -Reference $hostResource -KeyName 'Name' if (-not [string]::IsNullOrEmpty($switchGuid) -and $switchByGuid.ContainsKey($switchGuid)) { $vSwitch = $switchByGuid[$switchGuid] break } } # Skip connections that are not attached to a known virtual switch. if ($null -eq $vSwitch) { continue } # Resolve the adapter port backing this connection. $portInstanceId = Get-CimReferenceKeyValue -Reference $connection.Parent -KeyName 'InstanceID' if ([string]::IsNullOrEmpty($portInstanceId) -or -not $portByInstanceId.ContainsKey($portInstanceId)) { continue } $port = $portByInstanceId[$portInstanceId] # MAC spoofing state comes from the security feature setting on this connection. $macAddressSpoofing = 'Off' if ($securityByConnectionId.ContainsKey($connection.InstanceID)) { $security = $securityByConnectionId[$connection.InstanceID] if ($security.AllowMacSpoofing) { $macAddressSpoofing = 'On' } } # The owning system GUID is the first path segment of the port InstanceID # ('Microsoft:<systemGuid>\<portGuid>'). $systemGuid = $null $instanceCore = $portInstanceId -replace '^Microsoft:', '' if ($instanceCore.Contains('\')) { $systemGuid = $instanceCore.Substring(0, $instanceCore.IndexOf('\')) } $isManagementOs = (-not [string]::IsNullOrEmpty($hostSystemGuid)) -and ($systemGuid -eq $hostSystemGuid) $vmName = if ($isManagementOs) { $null } elseif ($null -ne $systemGuid -and $vmNameByGuid.ContainsKey($systemGuid)) { $vmNameByGuid[$systemGuid] } else { $null } $adapters.Add([PSCustomObject]@{ Name = $port.ElementName VMName = $vmName IsManagementOs = $isManagementOs SwitchName = $vSwitch.ElementName SwitchId = $vSwitch.Name MacAddress = $port.Address MacAddressSpoofing = $macAddressSpoofing }) } return $adapters.ToArray() } catch { # Surface CIM failures as a non-terminating error so callers using # -ErrorAction SilentlyContinue gracefully skip (returning no adapters) # instead of the whole analyzer going UNKNOWN on the terminating error. Write-Error -ErrorRecord $_ return @() } } # SIG # Begin signature block # MIInUAYJKoZIhvcNAQcCoIInQTCCJz0CAQExDzANBglghkgBZQMEAgEFADB5Bgor # BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG # KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCD+uE0uUehsCc5g # WNOAfkUHpGfSJgX2smjTkuXNOEMna6CCDMkwggYEMIID7KADAgECAhMzAAACHPrN # xZvoL37EAAAAAAIcMA0GCSqGSIb3DQEBCwUAMFcxCzAJBgNVBAYTAlVTMR4wHAYD # VQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBD # b2RlIFNpZ25pbmcgUENBIDIwMjQwHhcNMjYwNDE2MTg1OTQxWhcNMjcwNDE1MTg1 # OTQxWjB0MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UE # BxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMR4wHAYD # VQQDExVNaWNyb3NvZnQgQ29ycG9yYXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IB # DwAwggEKAoIBAQDVsZfgOKmM31HPfoWOoNEiw0SlCiIxUMC0I9NMWbucKOw/e9lP # oAoehQVu6SG65V4EPzrYsnBnFPNoi4/HoOdjhz1qkrEt4I6tEcxXU6oOeY9zGveC # /3iBeuhLYxM3M/PkcUoebF+Nednm8OkdSPoDu8imViHPQq/8CQUu0WRR4rE+dMRf # rpVqfmNi2qWCX94T4MsepijGVkwE//tJg0ryAiYdHT34LSnlG/RSBZmQRGWZ5g8j # qnKjRParSqMft1gvjuUTVgtWNZfgcLFSK5Wa0myrq8OPcgTGGsRgun+tnSS+IxDT # xVsAPH1OzvPjwomguByhUe/OcvUN0D5Wmp7xAgMBAAGjggGqMIIBpjAOBgNVHQ8B # Af8EBAMCB4AwHwYDVR0lBBgwFgYKKwYBBAGCN0wIAQYIKwYBBQUHAwMwHQYDVR0O # BBYEFNoH7a2YDjOSwpkp6DHcmUS7J+0yMFQGA1UdEQRNMEukSTBHMS0wKwYDVQQL # EyRNaWNyb3NvZnQgSXJlbGFuZCBPcGVyYXRpb25zIExpbWl0ZWQxFjAUBgNVBAUT # DTIzMDAxMis1MDc1NjkwHwYDVR0jBBgwFoAUf1k/VCHarU/vBeXmo9ctBpQSCDEw # YAYDVR0fBFkwVzBVoFOgUYZPaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9w # cy9jcmwvTWljcm9zb2Z0JTIwQ29kZSUyMFNpZ25pbmclMjBQQ0ElMjAyMDI0LmNy # bDBtBggrBgEFBQcBAQRhMF8wXQYIKwYBBQUHMAKGUWh0dHA6Ly93d3cubWljcm9z # b2Z0LmNvbS9wa2lvcHMvY2VydHMvTWljcm9zb2Z0JTIwQ29kZSUyMFNpZ25pbmcl # MjBQQ0ElMjAyMDI0LmNydDAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEBCwUAA4IC # AQAUnEqhaRXe0T3hIJjvdQErEkrA/7bByjn6t5IArODkkRjzkYwtKMc2yYj2quaN # rLutWw2YZcngKPy1b71YyDJQTy4NDRwaSh9Tw5thrk3NmcPrAHia5vtcBJ1CgtKK # 7mQbIcQ22d/N3813ayCDDFewu1+jsZmX+r/aTEqaOM4TVxVtRSkuCy8nAXKuChOK # Li/zA4XuH8iEYqIsj2YoNaeSxVmeGiERXpKdo3dDmYi0kO5w2D8VS4c3+9h6gElY # BaAAg/dYErBg27qT3vv0zRDJhJufvCNylA8S7/+8H5E/PV5cng6na9VV/w9OV3qu # uND6zdGa2EX38Glp50F9AIQk3p2xXmcvorDeM4XJ7UlWYBi6g80J1SSOQnInCYFE # msfUNn3+1AaTJKSJL83quKArTac2pKhu0Yzzzrzo6HrsRiQKzpnRBb1/dMa6P3hz # 75XbMRBctNsFhZC07WCmjExdLg2eHW5uV0TY8D5+6wozJf7vF3+WHkYPO85Z+BC6 # U4FkNbYNycZ9cE4j1tXRdyDCfml6c0HWPHjNVDObrv9lKt3qUqFpX38VCqVCyNOO # 1UcXfQiVjJw32U2WUKZjt/neJKHEBsm9kFsLuWzkQ53+qcaSaytmsCnk2gOglrlD # 5d3kKyvvAw+rzm0lT8K38P6PLxfZQHhu4W8dV7Av8N2ZmDCCBr0wggSloAMCAQIC # EzMAAAA5O7Y3Gb8GHWcAAAAAADkwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYT # AlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYD # VQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xMjAwBgNVBAMTKU1pY3Jvc29mdCBS # b290IENlcnRpZmljYXRlIEF1dGhvcml0eSAyMDExMB4XDTI0MDgwODIwNTQxOFoX # DTM2MDMyMjIyMTMwNFowVzELMAkGA1UEBhMCVVMxHjAcBgNVBAoTFU1pY3Jvc29m # dCBDb3Jwb3JhdGlvbjEoMCYGA1UEAxMfTWljcm9zb2Z0IENvZGUgU2lnbmluZyBQ # Q0EgMjAyNDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANgBnB7jOMeq # lRYHNa265v4IY9fH8TKhemHfPINe1gpLaV3dhg324WwH06LcHbpnsBukCDNitryo # 0dtS/EW6I/yEL/bLSY8hKpbfQuWusBPr9qazYcDxCW/qnjb5JsI1s8bNOg3bVATv # QVL4tcf03aTycsz8QeCdM0l/yHRObJ9QqazM1r6VPEOJ7LL+uEEb73w6QCuhs89a # 1uv1zerOYMnsneRRwCbpyW11IcggU0cRKDDq1pjVJzIbIF6+oiXXbReOsgeI8zu1 # FyQfK0fVkaya8SmVHQ/tOf23mZ4W9k0Ri22QW9p3UgSC5OUDktKxxcCmGL6tXLfO # GSWHIIV4YrTJTT6PNty5REojHJuZHArkF9VnHTERWoTjAzfI3kP+5b4alUdhgAZ7 # ttOu1bVnXfHaqPYl2rPs20ji03LOVWsh/radgE17es5hL+t6lV0eVHrVhsssROWJ # uz2MXMCt7iw7lFPG9LXKGjsmonn2gotGdHIuEg5JnJMJVmixd5LRlkmgYRZKzhxS # CwyoGIq0PhaA7Y+VPct5pCHkijcIIDm0nlkK+0KyepolcqGm0T/GYQRMhHJlGOOm # VQop36wUVUYklUy++vDWeEgEo4s7hxN6mIbf2MSIQ/iIfMZgJxC69oukMUXCrOC3 # SkE/xIkgpfl22MM1itkZ35nNXkMolU1lAgMBAAGjggFOMIIBSjAOBgNVHQ8BAf8E # BAMCAYYwEAYJKwYBBAGCNxUBBAMCAQAwHQYDVR0OBBYEFH9ZP1Qh2q1P7wXl5qPX # LQaUEggxMBkGCSsGAQQBgjcUAgQMHgoAUwB1AGIAQwBBMA8GA1UdEwEB/wQFMAMB # Af8wHwYDVR0jBBgwFoAUci06AjGQQ7kUBU7h6qfHMdEjiTQwWgYDVR0fBFMwUTBP # oE2gS4ZJaHR0cDovL2NybC5taWNyb3NvZnQuY29tL3BraS9jcmwvcHJvZHVjdHMv # TWljUm9vQ2VyQXV0MjAxMV8yMDExXzAzXzIyLmNybDBeBggrBgEFBQcBAQRSMFAw # TgYIKwYBBQUHMAKGQmh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2kvY2VydHMv # TWljUm9vQ2VyQXV0MjAxMV8yMDExXzAzXzIyLmNydDANBgkqhkiG9w0BAQwFAAOC # AgEAFJQfOChP7onn6fLIMKrSlN1WYKwDFgAddymOUO3FrM8d7B/W/iQ6DxXsDn7D # 5W4wMwYeLystcEqfkjz4NURRgazyMu5yRzQh4LqjA4tStTcJh1opExo7nn5PuPBY # nbu0+THSuVHTe0VTTPVhily/piFrDo3axQ9P4C+Ol5yet+2gTfekICS5xS+cYfSI # vgn0JksVBVMYVI5QFu/qhnLhsEFEUzG8fvv0hjgkO+lkpV9ty6GkN4vdnd7ya6Q6 # aR9y34aiM1qmxaxBi6OUnyNl6fkuun/diTFnYDLTppOkr/mg5WSfCiDVMNCxtj4w # PKC5OmHm1DQIt/MNokbbH3UGsFP1QbzsLocuSqLCvH09Io3fDPTmscR9Y75G4qX7 # RTX8AdBPo0I6OEojf39zuFZt0qOHm65YWQE69cZM2ueE1MB05dNNgHK9gTE7zKvK # /fg8B2qjW88MT/WF5V5uvZGtqa9FSL2RazArA+rDPuf6JGYz4HpgMZHB4S6szWSK # YBv0VisCzfxgeU+dquXW9bd0auYlOB58DPcOYKdc3Se94g+xL4pcEhbB54JOgAkw # YTu/9dLeH2pDqeJZAABVDWRQCaXfO5LgyKwKCLYXpigrZYCjUSBcr+Ve8PFWMhVT # Ql0v4q8J/AUmQN5W4n101cY2L4A7GTQG1h32HHAvfQESWP0xghndMIIZ2QIBATBu # MFcxCzAJBgNVBAYTAlVTMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24x # KDAmBgNVBAMTH01pY3Jvc29mdCBDb2RlIFNpZ25pbmcgUENBIDIwMjQCEzMAAAIc # +s3Fm+gvfsQAAAAAAhwwDQYJYIZIAWUDBAIBBQCggZAwGQYJKoZIhvcNAQkDMQwG # CisGAQQBgjcCAQQwLwYJKoZIhvcNAQkEMSIEIMD9ufZ1MhEPpynHaoX7rS5QqPkF # LArGqY0OXoz+wLMMMEIGCisGAQQBgjcCAQwxNDAyoBSAEgBNAGkAYwByAG8AcwBv # AGYAdKEagBhodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20wDQYJKoZIhvcNAQEBBQAE # ggEAtK0Hjjj/WoRcosB8aogV63ZvldxRmNDNG5CVP2BtKFiTvqTqNIgtkxobJb4I # b/rxoW95ybh+lDsNXOjJa3vAd1ullXodGXFYcT551S3vQ7yT1l9Cx2/ImZ2bcjkh # 8Z6xO5HnHtX+YbA2ag4HzXCaV4XKSWSYNnneJJZjPRSPRZAVt36yJFAVqnm5vrRq # gMcJ0Kl+CSLgYv6hhP2VciMO3qZiT9+HLCkM+B3T6w7SwIeU4VTXbViOlpfmCRHS # zwdT7SghHe6KR1JRLUNlG6Gq8hqpWg74lJlzbYm0hJRWBgqYmTo0skNGD1Wih4TJ # SMo1JHx1TSi9ggtqFAtp/AUgLqGCF60wghepBgorBgEEAYI3AwMBMYIXmTCCF5UG # CSqGSIb3DQEHAqCCF4YwgheCAgEDMQ8wDQYJYIZIAWUDBAIBBQAwggFaBgsqhkiG # 9w0BCRABBKCCAUkEggFFMIIBQQIBAQYKKwYBBAGEWQoDATAxMA0GCWCGSAFlAwQC # AQUABCD9tzSAx+41mxhiSjc0Z74PlTA7aTQCQiLIn0JgnPOi4QIGamQLqGigGBMy # MDI2MDcyOTEzMTUxOC42NDhaMASAAgH0oIHZpIHWMIHTMQswCQYDVQQGEwJVUzET # MBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMV # TWljcm9zb2Z0IENvcnBvcmF0aW9uMS0wKwYDVQQLEyRNaWNyb3NvZnQgSXJlbGFu # ZCBPcGVyYXRpb25zIExpbWl0ZWQxJzAlBgNVBAsTHm5TaGllbGQgVFNTIEVTTjo1 # NTFBLTA1RTAtRDk0NzElMCMGA1UEAxMcTWljcm9zb2Z0IFRpbWUtU3RhbXAgU2Vy # dmljZaCCEfswggcoMIIFEKADAgECAhMzAAACG9CyuAJn93LPAAEAAAIbMA0GCSqG # SIb3DQEBCwUAMHwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAw # DgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24x # JjAkBgNVBAMTHU1pY3Jvc29mdCBUaW1lLVN0YW1wIFBDQSAyMDEwMB4XDTI1MDgx # NDE4NDgzMFoXDTI2MTExMzE4NDgzMFowgdMxCzAJBgNVBAYTAlVTMRMwEQYDVQQI # EwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3Nv # ZnQgQ29ycG9yYXRpb24xLTArBgNVBAsTJE1pY3Jvc29mdCBJcmVsYW5kIE9wZXJh # dGlvbnMgTGltaXRlZDEnMCUGA1UECxMeblNoaWVsZCBUU1MgRVNOOjU1MUEtMDVF # MC1EOTQ3MSUwIwYDVQQDExxNaWNyb3NvZnQgVGltZS1TdGFtcCBTZXJ2aWNlMIIC # IjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAjsWd52ZZkzB5Xe5g/l2GsOjA # z30sg6jVxfFJV+w4xIDVyaI3LO8bIpmzYul3AZHg50UIQ8PrSRZGpQqFkRNu+o3Y # KJ4g2uGYBRksHnHYR0uVSCQg58ThkYyeplGX3oAvGRVuPIpQtAiTsR76A/gdoU7H # DwEbb73bJwTyrbKHhR+WaMy9DQHI4k5Qo4+bZDs0kj76bvhJvdGU+S8zxQBp7UAh # jJnFqKxIusSITE7zCCR422ELhkhVVOFqK2w6h1MAvILe76hxRIcPj0SBL2r8O9tx # 5njU4+tg2rAdU153pmyhqazdpUccYBE9wDRFUd/e9CoWx7TdnUicB+Mai7RT6qse # 7e5aGqX1B7bnj/ZHvrrfF+BJEIlS9iDXAUgekvXZ+FZmjvLwP+dN+0/crh++r4e8 # FknF7EX6IJfnmNeDN/68Z59kbaJ1f+P5mnKYfydCeZmxrGpS0taWkDk36D3jPVZf # lvxrc+1rhCIlM5v9agLEFI12QiBTfpOBOBr3AGCPk+eH0+latjQajug+2/BD12qb # 82500LQytUWT2ota/HYnRgSv1jvZ0/dml1FsxWYzOnCrjfdB/7N6pNySt4vn+PGN # 6dFLim7kxos+B9WfQPezJi3fuKyyDAB9zSHPj1Zu8nZfecZJ9um4zj7DFgvJXTDT # nG5qlG4ZdbFRa/rrfzkCAwEAAaOCAUkwggFFMB0GA1UdDgQWBBS2vp93/lxLppNK # 8OkauJ2AvNmIUDAfBgNVHSMEGDAWgBSfpxVdAF5iXYP05dJlpxtTNRnpcjBfBgNV # HR8EWDBWMFSgUqBQhk5odHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2Ny # bC9NaWNyb3NvZnQlMjBUaW1lLVN0YW1wJTIwUENBJTIwMjAxMCgxKS5jcmwwbAYI # KwYBBQUHAQEEYDBeMFwGCCsGAQUFBzAChlBodHRwOi8vd3d3Lm1pY3Jvc29mdC5j # b20vcGtpb3BzL2NlcnRzL01pY3Jvc29mdCUyMFRpbWUtU3RhbXAlMjBQQ0ElMjAy # MDEwKDEpLmNydDAMBgNVHRMBAf8EAjAAMBYGA1UdJQEB/wQMMAoGCCsGAQUFBwMI # MA4GA1UdDwEB/wQEAwIHgDANBgkqhkiG9w0BAQsFAAOCAgEAZkU1XxQD4OTM3GTh # t32TXShIfPBoMfSsFsBQqFOZqLJOxyJOllIBFpmpvOtGNPkC5Z8ldG8aCpvgFNo/ # jDWeT5FiW53dAj9KnZxpsQ3Pf5fRzSGHRcxEMOdXIVzDJwcZUX0cjfxna7ydNv8e # XB/Xk6G6SyrR2OH6S1LHMW11m3UvKF+eLjIPl45rximuDCoEd+ad0lOAXA5/vZOK # N5n/ePYeP0LRchZX0Q6H8n/ZmSPMlbli3MO851Q09RmT/ZGHa+/Fdy+WLDrwcYyk # V9mUy/4TbwKw6FtdR6ZPHxMdIi1pk8Y2mC/GzCq0LCsH0uTFeQ6Q7Nc3MRmER/3m # LWUhbaWHgX1FbYchvR22b+Bup+YPR5Q/0BhaaAN6AIBfcGs+u/nJoIByyZKA8cTy # CmnUI/4vW6D4vywg3XBFf4f2DwFHy/evsC+58KMl+k2wa05X2kK0T/bCPLhaov9Z # XyobawfNOLYGiauKT2FWvbwZzHIFCTxjBww6Pt5uRvCE/jnUcf/xhlOGMn6iKO9X # t49vZTE2SfIBk/34iLTRBJ6H7aGPTTQnza3OfWu1/dRycC6Wl5ons3PjnGXTSKSx # XllJPmg6R/ulGonP/UCYoJ6mN+EXjfyDLPXLqsr91+VTG1rYzRCjPwBFAHv4EIwa # E0ajCrf75eUGI3+oXU0UP6rloZ8wggdxMIIFWaADAgECAhMzAAAAFcXna54Cm0mZ # AAAAAAAVMA0GCSqGSIb3DQEBCwUAMIGIMQswCQYDVQQGEwJVUzETMBEGA1UECBMK # V2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0 # IENvcnBvcmF0aW9uMTIwMAYDVQQDEylNaWNyb3NvZnQgUm9vdCBDZXJ0aWZpY2F0 # ZSBBdXRob3JpdHkgMjAxMDAeFw0yMTA5MzAxODIyMjVaFw0zMDA5MzAxODMyMjVa # MHwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdS # ZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMT # HU1pY3Jvc29mdCBUaW1lLVN0YW1wIFBDQSAyMDEwMIICIjANBgkqhkiG9w0BAQEF # AAOCAg8AMIICCgKCAgEA5OGmTOe0ciELeaLL1yR5vQ7VgtP97pwHB9KpbE51yMo1 # V/YBf2xK4OK9uT4XYDP/XE/HZveVU3Fa4n5KWv64NmeFRiMMtY0Tz3cywBAY6GB9 # alKDRLemjkZrBxTzxXb1hlDcwUTIcVxRMTegCjhuje3XD9gmU3w5YQJ6xKr9cmmv # Haus9ja+NSZk2pg7uhp7M62AW36MEBydUv626GIl3GoPz130/o5Tz9bshVZN7928 # jaTjkY+yOSxRnOlwaQ3KNi1wjjHINSi947SHJMPgyY9+tVSP3PoFVZhtaDuaRr3t # pK56KTesy+uDRedGbsoy1cCGMFxPLOJiss254o2I5JasAUq7vnGpF1tnYN74kpEe # HT39IM9zfUGaRnXNxF803RKJ1v2lIH1+/NmeRd+2ci/bfV+AutuqfjbsNkz2K26o # ElHovwUDo9Fzpk03dJQcNIIP8BDyt0cY7afomXw/TNuvXsLz1dhzPUNOwTM5TI4C # vEJoLhDqhFFG4tG9ahhaYQFzymeiXtcodgLiMxhy16cg8ML6EgrXY28MyTZki1ug # poMhXV8wdJGUlNi5UPkLiWHzNgY1GIRH29wb0f2y1BzFa/ZcUlFdEtsluq9QBXps # xREdcu+N+VLEhReTwDwV2xo3xwgVGD94q0W29R6HXtqPnhZyacaue7e3PmriLq0C # AwEAAaOCAd0wggHZMBIGCSsGAQQBgjcVAQQFAgMBAAEwIwYJKwYBBAGCNxUCBBYE # FCqnUv5kxJq+gpE8RjUpzxD/LwTuMB0GA1UdDgQWBBSfpxVdAF5iXYP05dJlpxtT # NRnpcjBcBgNVHSAEVTBTMFEGDCsGAQQBgjdMg30BATBBMD8GCCsGAQUFBwIBFjNo # dHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL0RvY3MvUmVwb3NpdG9yeS5o # dG0wEwYDVR0lBAwwCgYIKwYBBQUHAwgwGQYJKwYBBAGCNxQCBAweCgBTAHUAYgBD # AEEwCwYDVR0PBAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAU1fZW # y4/oolxiaNE9lJBb186aGMQwVgYDVR0fBE8wTTBLoEmgR4ZFaHR0cDovL2NybC5t # aWNyb3NvZnQuY29tL3BraS9jcmwvcHJvZHVjdHMvTWljUm9vQ2VyQXV0XzIwMTAt # MDYtMjMuY3JsMFoGCCsGAQUFBwEBBE4wTDBKBggrBgEFBQcwAoY+aHR0cDovL3d3 # dy5taWNyb3NvZnQuY29tL3BraS9jZXJ0cy9NaWNSb29DZXJBdXRfMjAxMC0wNi0y # My5jcnQwDQYJKoZIhvcNAQELBQADggIBAJ1VffwqreEsH2cBMSRb4Z5yS/ypb+pc # FLY+TkdkeLEGk5c9MTO1OdfCcTY/2mRsfNB1OW27DzHkwo/7bNGhlBgi7ulmZzpT # Td2YurYeeNg2LpypglYAA7AFvonoaeC6Ce5732pvvinLbtg/SHUB2RjebYIM9W0j # VOR4U3UkV7ndn/OOPcbzaN9l9qRWqveVtihVJ9AkvUCgvxm2EhIRXT0n4ECWOKz3 # +SmJw7wXsFSFQrP8DJ6LGYnn8AtqgcKBGUIZUnWKNsIdw2FzLixre24/LAl4FOmR # sqlb30mjdAy87JGA0j3mSj5mO0+7hvoyGtmW9I/2kQH2zsZ0/fZMcm8Qq3UwxTSw # ethQ/gpY3UA8x1RtnWN0SCyxTkctwRQEcb9k+SS+c23Kjgm9swFXSVRk2XPXfx5b # RAGOWhmRaw2fpCjcZxkoJLo4S5pu+yFUa2pFEUep8beuyOiJXk+d0tBMdrVXVAmx # aQFEfnyhYWxz/gq77EFmPWn9y8FBSX5+k77L+DvktxW/tM4+pTFRhLy/AsGConsX # HRWJjXD+57XQKBqJC4822rpM+Zv/Cuk0+CQ1ZyvgDbjmjJnW4SLq8CdCPSWU5nR0 # W2rRnj7tfqAxM328y+l7vzhwRNGQ8cirOoo6CGJ/2XBjU02N7oJtpQUQwXEGahC0 # HVUzWLOhcGbyoYIDVjCCAj4CAQEwggEBoYHZpIHWMIHTMQswCQYDVQQGEwJVUzET # MBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMV # TWljcm9zb2Z0IENvcnBvcmF0aW9uMS0wKwYDVQQLEyRNaWNyb3NvZnQgSXJlbGFu # ZCBPcGVyYXRpb25zIExpbWl0ZWQxJzAlBgNVBAsTHm5TaGllbGQgVFNTIEVTTjo1 # NTFBLTA1RTAtRDk0NzElMCMGA1UEAxMcTWljcm9zb2Z0IFRpbWUtU3RhbXAgU2Vy # dmljZaIjCgEBMAcGBSsOAwIaAxUAhoV6r49M4GBd41K1RYB1Z0f4zuCggYMwgYCk # fjB8MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMH # UmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSYwJAYDVQQD # Ex1NaWNyb3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAxMDANBgkqhkiG9w0BAQsFAAIF # AO4UeI4wIhgPMjAyNjA3MjkxMzAzMTBaGA8yMDI2MDczMDEzMDMxMFowdDA6Bgor # BgEEAYRZCgQBMSwwKjAKAgUA7hR4jgIBADAHAgEAAgIkZTAHAgEAAgIUDDAKAgUA # 7hXKDgIBADA2BgorBgEEAYRZCgQCMSgwJjAMBgorBgEEAYRZCgMCoAowCAIBAAID # B6EgoQowCAIBAAIDAYagMA0GCSqGSIb3DQEBCwUAA4IBAQBBKNCybRpSQnQMbl+e # 8KC4KKasXpTcv8dur8qL2tUcU+Td/QIlxDWIsUBv+b+NRDN5gAARp8aOM9tWYMCe # e9gQqg9qntg6Qm8f9X3iDRvdZVd+Re6TYPwlMANuukAWtOnvKh880kHuHfPbjKa7 # bN+95rd2o6afCuEhaflRyXoCwXKqy8r3q1y8XW8xBJ1lfhENM3Q13rhP86ezq/yn # 7FC8DZ+j8tvHHBRojWEb4LAXwOu1+hHSnyDhKozgxykF9l1staWtdfMhpP7Qvvoy # 7DLlDQn2atDklh3wLVnlNq1TZlknWRUry4dD7uw72G1pvSoJK8/NO3QmNkE2YJS0 # XVcuMYIEDTCCBAkCAQEwgZMwfDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hp # bmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jw # b3JhdGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAgUENBIDIwMTAC # EzMAAAIb0LK4Amf3cs8AAQAAAhswDQYJYIZIAWUDBAIBBQCgggFKMBoGCSqGSIb3 # DQEJAzENBgsqhkiG9w0BCRABBDAvBgkqhkiG9w0BCQQxIgQgH05XLK8oIohDG2+7 # xJYViaTLL4rCj/Dhgf2ieSWjq3kwgfoGCyqGSIb3DQEJEAIvMYHqMIHnMIHkMIG9 # BCAwJRSVuD2jmMcQCFXdLuJAwDpUVNZ6bc6dfJU83Q2LgDCBmDCBgKR+MHwxCzAJ # BgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25k # MR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMTHU1pY3Jv # c29mdCBUaW1lLVN0YW1wIFBDQSAyMDEwAhMzAAACG9CyuAJn93LPAAEAAAIbMCIE # IKWGU5PiqhNQ+wl21ourF14OaXmCxym6bUDrQXe4w3dlMA0GCSqGSIb3DQEBCwUA # BIICAF8HABE0GU3ibgEi46XEzHnD7h+zk0cYmwJwn/2V3iF3TxI1nT+PqX3bJxvM # RL6cltGbn1eHsbJ09F3GtaY370blfdCzjREKdHd2ApsxTBnt2LSwhLhYGNH54E5g # A49DrE3iOtAUY2AZWvxtzBR4b51IS+oKcSZED/eR4+xD08h2xApt7VAmG4IZgnt8 # mrM0Sok7GXhHF4WhTgzr02eiw54ODkTxTeL7pWqbpRFAh1WZTHHl7FHI88YcfkLQ # Y3f354fCpbaMdAct17gK7CVpp1Zn1tE2MWvtmB/rg+zMLc+RdZpr0u3llbaViUAM # MHZttSiXPEtTgn7kkqzpdGxvSANag0XE1o+mAvCq5NsUdddgFhJ8Pg49uGwmUfsp # zxpNZW0regHpcJJqp24mFvoyiZSfGR/LzJDCl94rRwoV/iTjFckAiYyirwOoznZv # SiV6Yc7TRmyDcyYkjwkLFLlEaCy2SPOrvzx7N3loFA/eoXReZlpEmyT/FsNLwB3B # 2NAFF7FHcEfUCy/U4daFVKWVHo+OqnrqTHWa4SEmzJk+cgp1QnEcG9e4I6omktCI # hj9RV+Uqyijo3aU79/QZAUYddvhTqRu4FTF3b4fCy4mJEra0uSO88LidtypPrFsV # 4NJBOT5GbtwlSkojAaGAfv1BOQbuwfPh9gJdlnQIXGkU4Zxg # SIG # End signature block |