packages/AzStackHci.DiagnosticSettings.0.6.8/Private/AzStackHci.Connectivity.Helpers.ps1
|
# //////////////////////////////////////////////////////////////////////////// # Strict Mode v1 (PS 5.1 safe) - surfaces reads of uninitialised variables at runtime. Set-StrictMode -Version 1.0 # Function to test version of PowerShell # Returns $true on Windows PowerShell 5.1 and $false on PowerShell 6/7+. # Uses PSEdition ('Desktop' = Windows PowerShell, 'Core' = PowerShell 6/7+) rather than a # version-string comparison: it is the intent-revealing signal for "must be Windows PowerShell" # and avoids the magic 5.1.99999.999 upper-bound constant. Callers own the user-facing message # (this helper only returns a boolean; it never throws or writes an error). Function Test-PowerShellVersion5 { param ( [Parameter(Mandatory = $false)] [bool]$NoVerboseOutput = $false ) if (-not $NoVerboseOutput) { Write-Verbose "PowerShell version $($PSVersionTable.PSVersion.ToString()) ($($PSVersionTable.PSEdition) edition) detected." } # 'Desktop' is Windows PowerShell (5.1); 'Core' is PowerShell 6/7+. return ($PSVersionTable.PSEdition -eq 'Desktop') } # //////////////////////////////////////////////////////////////////////////// # Classify a single connectivity result row into a stable, machine-readable # category (v0.6.7). Lets integrators branch on $row.ResultCategory instead of # brittle free-text matching on $row.Note (e.g. the old config-gap heuristic # -match 'WAS NOT USED|REQUIRED TO SPECIFY'). # # Categories (mutually exclusive, evaluated in priority order): # ConfigGap - a required parameter placeholder (e.g. -KeyVaultURL) was left # unsubstituted, so the row carries the 'WAS NOT USED' / # 'REQUIRED TO SPECIFY' Note marker. This is a setup/input gap, # NOT a real network fault. # PrivateLink - the endpoint resolved to an RFC1918 private IP (Private Link). # SSLInspected - an untrusted certificate chain was seen (possible SSL inspection). # Skipped - the endpoint was never tested. Covers (a) Arc-Gateway skip rows and # skip-list rows (Layer7Status/TCPStatus literally 'Skipped'), and # (b) untested wildcard-parent placeholder rows whose Layer7Status is # still the initial EMPTY string because they never entered the # DNS/TCP/Layer7 test loop. (A genuinely tested row ALWAYS ends with a # non-empty Layer7Status - Success / Failed / N/A / 'Invalid port:' - # so an empty/whitespace value unambiguously means "not tested".) # Success - Layer7Status reported Success. # ConnectivityFailure - any other terminal state where a test ran and did not pass # (Failed, or N/A from a DNS-resolution failure, or 'Invalid port:'). # # Precedence rationale: the three "diagnostic" categories (ConfigGap, PrivateLink, # SSLInspected) describe WHY a row is special and are evaluated ahead of the generic # Success / ConnectivityFailure split, because such rows usually ALSO carry # Layer7Status='Failed' which would otherwise mask the real cause. # # NOTE on CRL/OCSP revocation-offline rows: these keep Layer7Status='Failed' + a # '- CRL/OCSP unreachable' Layer7Response marker and are DELIBERATELY left as # ConnectivityFailure here (NOT given their own category) to keep the ResultCategory # enum stable for consumers. The run-level signal for them is the CRLOfflineDetected / # CRLOfflineURLs container NoteProperties on the returned ArrayList (and JSON summary), # mirroring how SSL inspection is ALSO surfaced as a container array - integrators that # want to treat revocation-offline as a softer WARNING branch on those fields. Function Get-ConnectivityResultCategory { [CmdletBinding()] [OutputType([string])] param( [Parameter(Mandatory = $true)] [psobject]$Row, # Run-level detection lists. Publish-Results passes a snapshot of the module-scope # state ($script:SSLInspectedURLs / $script:PrivateLinkDetectedArray); unit tests # pass synthetic lists. Default to empty so the helper is fully self-contained. [AllowNull()] [string[]]$SSLInspectedURLs = @(), [AllowNull()] [string[]]$PrivateLinkURLs = @() ) # Bare property reads are safe under StrictMode v1.0 (it throws only on uninitialised # VARIABLES, not absent object properties); cast to [string] to coalesce $null to ''. $note = [string]$Row.Note $url = [string]$Row.URL $l7 = [string]$Row.Layer7Status $tcp = [string]$Row.TCPStatus # URL normalisation for the detection-list lookups (steps 2 & 3). The two run-level arrays # store the URL in DIFFERENT shapes: # * $script:PrivateLinkDetectedArray stores the bare result-row .URL (host[/path]) - it is # populated by matching $_.URL in Test-AzureLocalConnectivity, so it already aligns. # * $script:SSLInspectedURLs stores the SCHEME-PREFIXED request URL ('https://host/path') # because Test-Layer7Connectivity adds the value it actually requested. # The result-row .URL is the bare host+path with no scheme, so a raw -contains against the # SSL list silently MISSES (an SSL-inspected row then falls through to ConnectivityFailure). # Strip a leading http(s):// and any trailing '/' from BOTH the row URL and every list entry # so the comparison is scheme- and trailing-slash-insensitive. (-contains is already # case-insensitive for strings.) $normalizeUrl = { param($u) (([string]$u) -replace '^\s*https?://', '').TrimEnd('/') } $urlNorm = & $normalizeUrl $url $sslNorm = @(@($SSLInspectedURLs) | ForEach-Object { & $normalizeUrl $_ }) $plNorm = @(@($PrivateLinkURLs) | ForEach-Object { & $normalizeUrl $_ }) # 1. Config gap — required parameter placeholder was never substituted. if ($note -match 'WAS NOT USED|REQUIRED TO SPECIFY') { return 'ConfigGap' } # 2. Private Link — endpoint resolved to an RFC1918 address. if ($plNorm -and ($plNorm -contains $urlNorm)) { return 'PrivateLink' } # 3. SSL inspection — untrusted certificate chain observed (possible TLS interception). # Two signals, set in lockstep upstream (AzStackHci.Layer7.Helpers.ps1); either is authoritative: # (a) the bare row URL appears in the run-level $script:SSLInspectedURLs snapshot, OR # (b) the row's own Layer7Response carries the '- SSL Inspection detected' marker. # (b) is read straight off the row, so it survives any URL-shape drift between the snapshot # (which stores the scheme-prefixed REQUEST url, possibly a redirect target) and the row's # .URL field. A CRL/OCSP-offline row is reclassified away from this marker upstream, so it # correctly does NOT match here and stays a ConnectivityFailure. $l7Response = [string]$Row.Layer7Response if (($sslNorm -and ($sslNorm -contains $urlNorm)) -or ($l7Response -match 'SSL Inspection detected')) { return 'SSLInspected' } # 4. Skipped / not-tested. Three cases: # (a) Arc-Gateway / skip-list rows -> TCPStatus or Layer7Status literally 'Skipped'. # (b) Untested wildcard-parent / placeholder rows that never entered the test loop # -> Layer7Status is still the initial EMPTY string. A tested row always has a # non-empty Layer7Status, so empty/whitespace here means "never tested", NOT a # failure. Guard with -not IsNullOrWhiteSpace($note) is unnecessary because the # ConfigGap Note marker is already handled at step 1 above. if (($tcp -like 'Skipped*') -or ($l7 -eq 'Skipped') -or [string]::IsNullOrWhiteSpace($l7)) { return 'Skipped' } # 5. Success. if ($l7 -eq 'Success') { return 'Success' } # 6. Everything else is a terminal connectivity failure (Failed / N/A / 'Invalid port:'). return 'ConnectivityFailure' } # //////////////////////////////////////////////////////////////////////////// # This function converts a hashtable to a string representation Function Convert-HashTableToString { param ( [Parameter(Mandatory = $true)] [System.Collections.Hashtable] $HashTable ) begin { # Write-Verbose "Starting Convert-HashTableToString function" } process { $HashString = "@{" $Keys = $HashTable.keys foreach ($Key in $Keys) { $v = $HashTable[$key] if ($key -match "\s") { $HashString += "`"$key`"" + "=" + "`"$v`"" + ";" } else { $HashString += $key + "=" + "`"$v`"" + ";" } } $HashString += "}" } # End of process block end { # Write-Debug "Completed Convert-HashTableToString function" return $HashString } } # //////////////////////////////////////////////////////////////////////////// # Function to extract domains from URLs Function Get-DomainFromURL { param ( [string]$url ) begin { # Write-Verbose "Starting Get-DomainFromURL function" } process { # Remove the protocol (http:// or https://) and extract the domain and port $url = $url -replace "^https?://", "" # Check if the URL contains a port number # If the URL contains a port number, extract it if ($url -match ":(\d+)$") { $port = [int]($url -replace ".*:(\d+)$", '$1') $url = $url -replace ":(\d+)$", "" } else { $port = $null } $domain = $url -split '/' | Select-Object -First 1 return @{ Domain = $domain; Port = $port } } end { # Write-Debug "Completed Get-DomainFromURL function" } } # //////////////////////////////////////////////////////////////////////////// # Helper function to normalize URL with protocol based on port # This is a private helper function for Test-Layer7Connectivity Function Initialize-WebRequestUrl { param ( [Parameter(Mandatory=$true)] [string]$url, [Parameter(Mandatory=$true)] [int]$port ) # Check if the port is 80 for HTTP or port 443, 8084 or 8443 for HTTPS and update the URL accordingly if ($port -eq $script:PORT_HTTPS -or $port -eq $script:PORT_HTTPS_ALT1 -or $port -eq $script:PORT_HTTPS_ALT2) { if($url -notmatch "^https://") { # If the URL does not start with https://, add it $url = "https://$url" } } elseif($port -eq $script:PORT_HTTP) { if($url -notmatch "^http://") { # If the URL does not start with http://, add it $url = "http://$url" } } else { # For custom ports, use http as the default if($url -notmatch "^http") { Write-Verbose "Custom port $port detected, using http as the default" $url = "http://$url" } } return $url } # //////////////////////////////////////////////////////////////////////////// # Helper function to register a redirected URL into the RedirectedResults array # Prevents duplicates by checking both RedirectedResults and Results arrays. # Called from the redirect-handling section of Test-Layer7Connectivity. Function Add-RedirectedUrlToResults { param ( [Parameter(Mandatory=$true)] [string]$RedirectedURL, [Parameter(Mandatory=$true)] [string]$FullRedirectUrl, [Parameter(Mandatory=$true)] [int]$DestinationPort, [Parameter(Mandatory=$true)] [string]$OriginalURL, [Parameter(Mandatory=$true)] [int]$OriginalPort ) Write-HostAzS "Redirected to '$FullRedirectUrl'" -ForegroundColor Yellow # Update the Note on the original result to show the redirect target (only if not already set) $ResultsToUpdate = $script:Results | Where-Object { $_.url -eq $OriginalURL -and ($_.Port -eq $OriginalPort) } ForEach ($ResultToUpdate in $ResultsToUpdate) { if (-not($ResultToUpdate.Note -like "Redirects to *")) { if ($ResultToUpdate.Note) { $ResultToUpdate.Note = "Redirects to '$($RedirectedURL)' - $($ResultToUpdate.Note)" } else { $ResultToUpdate.Note = "Redirects to '$($RedirectedURL)'" } } } if ([string]::IsNullOrWhiteSpace($RedirectedURL)) { Write-Warning "Redirected URL is null for $FullRedirectUrl, skipping" return } # Check if the URL already exists in the Results array [bool]$RedirectExistsInResults = $false ForEach ($result in $script:Results) { if ((Get-DomainFromURL -url $result.url).Domain -eq $RedirectedURL -and ($result.Port -eq $DestinationPort)) { Write-Debug "Redirected URL already exists in Results array, skipping" $RedirectExistsInResults = $true break } } # Add to RedirectedResults if it doesn't already exist in either array # Note: -notcontains works correctly on an empty @() array, no special first-entry handling needed if (($script:RedirectedResults.url -notcontains $RedirectedURL) -and (-not($RedirectExistsInResults))) { $OriginalResult = $script:Results | Where-Object { ((Get-DomainFromURL -url $_.URL).Domain -eq (Get-DomainFromURL -url $OriginalURL).Domain) -and ($_.Port -eq $OriginalPort) } | Select-Object -First 1 $script:RedirectedResults.Add([PSCustomObject]@{ RowID = 0 MachineName = $env:COMPUTERNAME url = $RedirectedURL redirect = $FullRedirectUrl Port = $DestinationPort ArcGateway = $false IsWildcard = $false Source = "Redirect for $($OriginalResult.Source)" Note = "Redirected URL from $($OriginalURL) - $($OriginalResult.Note)" TCPStatus = "" IPAddress = "" Layer7Status = "" Layer7Response = "" Layer7ResponseTime = "" CertificateSubject = "" CertificateIssuer = "" CertificateThumbprint = "" IntermediateCertificateIssuer = "" IntermediateCertificateSubject = "" IntermediateCertificateThumbprint = "" RootCertificateIssuer = "" RootCertificateSubject = "" RootCertificateThumbprint = "" }) | Out-Null Write-Debug "Added $($script:RedirectedResults[-1]) to RedirectedResults array" } else { Write-Debug "Redirected URL $RedirectedURL already exists in RedirectedResults or Results array, skipping" } } # //////////////////////////////////////////////////////////////////////////// # Helper function to register a CRL / OCSP dependency URL as its own row in # $script:Results. Called when Get-Layer7CertificateDetails classifies an HTTPS # endpoint as "CRL/OCSP unreachable" (trusted chain, revocation offline). # # Dedupe strategy (two tiers): # - OCSP: skip if ANY existing row already covers the same host+port=80 # (the OCSP protocol uses a single host, so host match = full coverage) # - CRL: fall through to exact-URL match — different .crl files on the same # host can be blocked independently by path-based proxy filtering # When an identical URL was already added by a previous parent, the existing # row's Source is extended to list both parents. # # Rows are appended directly to $script:Results with Layer7Status = "" so the # existing remainingUrls loop in Test-AzureLocalConnectivity picks them up and # tests them as first-class endpoints. Function Add-CrlDependencyRowToResults { [CmdletBinding()] param ( [Parameter(Mandatory=$true)][ValidateSet('CRL','OCSP')][string]$Kind, [Parameter(Mandatory=$true)][string]$DependencyURL, [Parameter(Mandatory=$true)][string]$ParentURL ) if ([string]::IsNullOrWhiteSpace($DependencyURL)) { return } $parentDomain = (Get-DomainFromURL -url $ParentURL).Domain $depDomain = (Get-DomainFromURL -url $DependencyURL).Domain if ([string]::IsNullOrWhiteSpace($depDomain)) { Write-Debug "Add-CrlDependencyRowToResults: cannot parse domain from '$DependencyURL', skipping" return } # Tier 1 — dedupe against existing rows if ($Kind -eq 'OCSP') { # Host-level dedupe is sufficient for OCSP (single-host protocol) $existing = $script:Results | Where-Object { ((Get-DomainFromURL -url $_.URL).Domain -eq $depDomain) -and ($_.Port -eq $script:PORT_HTTP) } | Select-Object -First 1 if ($existing) { Write-Debug "Add-CrlDependencyRowToResults: OCSP host '$depDomain' already in Results (row URL '$($existing.URL)'), skipping duplicate" return } } else { # CRL — exact URL dedupe (different .crl paths on same host can be independently blocked) $existingSame = $script:Results | Where-Object { ($_.URL -eq $DependencyURL) -and ($_.Port -eq $script:PORT_HTTP) } | Select-Object -First 1 if ($existingSame) { # Same CRL URL already added — extend Source to reflect shared parent if ($existingSame.Source -notmatch [regex]::Escape($parentDomain)) { $existingSame.Source = "$($existingSame.Source); $parentDomain" } Write-Debug "Add-CrlDependencyRowToResults: CRL URL '$DependencyURL' already present — appended parent '$parentDomain' to Source" return } } # Tier 2 — append new row (Layer7Status="" so the remaining-URLs loop tests it) $sourcePrefix = if ($Kind -eq 'CRL') { 'CRL dependency for' } else { 'OCSP dependency for' } $script:Results.Add([PSCustomObject]@{ RowID = 0 MachineName = $env:COMPUTERNAME URL = $DependencyURL Port = $script:PORT_HTTP ArcGateway = $false IsWildcard = $false Source = "$sourcePrefix $parentDomain" Note = "Required for certificate revocation check of https://$parentDomain (HTTP port 80 must be reachable)" TCPStatus = "" IPAddress = "" Layer7Status = "" Layer7Response = "" Layer7ResponseTime = "" CertificateIssuer = "" CertificateSubject = "" CertificateThumbprint = "" IntermediateCertificateIssuer = "" IntermediateCertificateSubject = "" IntermediateCertificateThumbprint = "" RootCertificateIssuer = "" RootCertificateSubject = "" RootCertificateThumbprint = "" }) | Out-Null Write-Debug "Add-CrlDependencyRowToResults: appended $Kind dependency row '$DependencyURL' for parent '$parentDomain'" } # //////////////////////////////////////////////////////////////////////////// # Helper function to initialize ServerCertificateValidationCallback for SSL bypass # This is a private helper function for Test-Layer7Connectivity Function Initialize-CertificateCallback { # IMPORTANT: This sets a PROCESS-WIDE callback on ServicePointManager.ServerCertificateValidationCallback # that accepts all certificates. This is intentional — the module needs to connect to endpoints even when # SSL inspection replaces certificates, so it can detect and report SSL inspection to the user. # The callback is reset to $null in the end block of Test-Layer7Connectivity and Test-AzureLocalConnectivity. # Check if ServerCertificateValidationCallback class is already defined if (-not ([System.Management.Automation.PSTypeName]'ServerCertificateValidationCallback').Type) { # Define the ServerCertificateValidationCallback class # This class is used to bypass SSL certificate validation, to allow for SSL inspection detection $CertCallback = @" using System; using System.Net; using System.Net.Security; using System.Security.Cryptography.X509Certificates; public class ServerCertificateValidationCallback { public static void Ignore() { if(ServicePointManager.ServerCertificateValidationCallback == null) { ServicePointManager.ServerCertificateValidationCallback += delegate ( Object obj, X509Certificate certificate, X509Chain chain, SslPolicyErrors errors ) { return true; }; } } } "@ Add-Type $CertCallback } # Call the Ignore method to bypass SSL certificate validation. # PRECONDITION: the C# Ignore() only installs the accept-all delegate when # ServicePointManager.ServerCertificateValidationCallback is currently $null. If the # caller (or another loaded module) already set a callback, the bypass is NOT installed, # so SSL-inspection detection can be inconsistent in shared sessions. The caller # (Test-Layer7Connectivity / Test-AzureLocalConnectivity) captures and restores the # original callback in its finally block, so this never leaks across function calls. [ServerCertificateValidationCallback]::Ignore() } # //////////////////////////////////////////////////////////////////////////// # Helper to set all connectivity result fields on a URL object to skip/N/A values. # Used when a URL is skipped, wildcarded, or DNS resolution fails. Function Set-UrlObjectSkipFields { param( [Parameter(Mandatory)][PSCustomObject]$UrlObject, [Parameter(Mandatory)][string]$TCPStatus, [Parameter(Mandatory)][string]$Layer7Status, [string]$IPAddress = "N/A", [string]$Layer7Response = "N/A", [string]$Layer7ResponseTime = "N/A" ) $UrlObject.TCPStatus = $TCPStatus $UrlObject.IPAddress = $IPAddress $UrlObject.Layer7Status = $Layer7Status $UrlObject.Layer7Response = $Layer7Response $UrlObject.Layer7ResponseTime = $Layer7ResponseTime $UrlObject.CertificateIssuer = "N/A" $UrlObject.CertificateSubject = "N/A" $UrlObject.CertificateThumbprint = "N/A" $UrlObject.IntermediateCertificateIssuer = "N/A" $UrlObject.IntermediateCertificateSubject = "N/A" $UrlObject.IntermediateCertificateThumbprint = "N/A" $UrlObject.RootCertificateIssuer = "N/A" $UrlObject.RootCertificateSubject = "N/A" $UrlObject.RootCertificateThumbprint = "N/A" } # //////////////////////////////////////////////////////////////////////////// # Helper to copy connectivity test results from an Invoke-EndpointConnectivityTest # result hashtable to a URL result object. Function Copy-ConnectivityResultsToUrlObject { param( [Parameter(Mandatory)][PSCustomObject]$UrlObject, [Parameter(Mandatory)][hashtable]$TestResult ) $UrlObject.TCPStatus = $TestResult.TCPStatus $UrlObject.IPAddress = $TestResult.IPAddress $UrlObject.Layer7Status = $TestResult.Layer7Status $UrlObject.Layer7Response = $TestResult.Layer7Response $UrlObject.Layer7ResponseTime = $TestResult.Layer7ResponseTime $UrlObject.CertificateIssuer = $TestResult.CertificateIssuer $UrlObject.CertificateSubject = $TestResult.CertificateSubject $UrlObject.CertificateThumbprint = $TestResult.CertificateThumbprint $UrlObject.IntermediateCertificateIssuer = $TestResult.CertificateIntermediateIssuer $UrlObject.IntermediateCertificateSubject = $TestResult.CertificateIntermediateSubject $UrlObject.IntermediateCertificateThumbprint = $TestResult.CertificateIntermediateThumbprint $UrlObject.RootCertificateIssuer = $TestResult.CertificateRootIssuer $UrlObject.RootCertificateSubject = $TestResult.CertificateRootSubject $UrlObject.RootCertificateThumbprint = $TestResult.CertificateRootThumbprint } # SIG # Begin signature block # MIInJwYJKoZIhvcNAQcCoIInGDCCJxQCAQExDzANBglghkgBZQMEAgEFADB5Bgor # BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG # KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCBnZRH1ealRbfOL # Gx91rHVWpjjedAwcRHgIB5NMmXCwEKCCDLowggX1MIID3aADAgECAhMzAAACHU0Z # yE7XD1dIAAAAAAIdMA0GCSqGSIb3DQEBCwUAMFcxCzAJBgNVBAYTAlVTMR4wHAYD # VQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBD # b2RlIFNpZ25pbmcgUENBIDIwMjQwHhcNMjYwNDE2MTg1OTQzWhcNMjcwNDE1MTg1 # OTQzWjB0MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UE # BxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMR4wHAYD # VQQDExVNaWNyb3NvZnQgQ29ycG9yYXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IB # DwAwggEKAoIBAQDQvewXxx9gZZFC6Ys1WBay8BJ8kGA4JQnH5CMafqOASlTpK9H8 # o5ZXTXt0caVQTNMUPt445wXYD+dFtaKWTwDn1I52oUSrC9vJin1Gsqt+zyKJL5Dg # 3eQXbQNR61DmMy20GLTIO3SFed9Rfi/ophgCLGFLDR3r0KvHjwMb/jYWS0celV/4 # Lz27LfAekm8v9E5IXaeiXbAUYZKK090n4CVl3JBtbN+9DtI9SNu/yjvozW52/u7R # X/Ttpa/KDlpuokZ+Zcbvmtd9ur9gFLvZzh41o9MsE/clQtdaFWGvuo6Jua/ntpgk # ey3E5/vBFe+MJPG6phdnuo6r57ZudCudiI1bAgMBAAGjggGbMIIBlzAOBgNVHQ8B # Af8EBAMCB4AwHwYDVR0lBBgwFgYKKwYBBAGCN0wIAQYIKwYBBQUHAwMwHQYDVR0O # BBYEFH6QuMwqcPG0hQlQ6c5jCtTTLrVeMEUGA1UdEQQ+MDykOjA4MR4wHAYDVQQL # ExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xFjAUBgNVBAUTDTIzMDAxMis1MDc1NTkw # HwYDVR0jBBgwFoAUf1k/VCHarU/vBeXmo9ctBpQSCDEwYAYDVR0fBFkwVzBVoFOg # UYZPaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9jcmwvTWljcm9zb2Z0 # JTIwQ29kZSUyMFNpZ25pbmclMjBQQ0ElMjAyMDI0LmNybDBtBggrBgEFBQcBAQRh # MF8wXQYIKwYBBQUHMAKGUWh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMv # Y2VydHMvTWljcm9zb2Z0JTIwQ29kZSUyMFNpZ25pbmclMjBQQ0ElMjAyMDI0LmNy # dDAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEBCwUAA4ICAQBKTbYOjzwTG/DXGaz9 # s6+fQeaTtDcFmMY+5UyVFCyj7Pv+5i37qfX8lSL/tBIfYQfWsMuBQlfZurJD6r4H # VJ2CeH+1fgiq8dcHdVKoZ3Sa2qXoX3cq9iS8cVb06B7+5/XJ7I0OxHH9fDsvJ3T3 # w5V/ZtAIFmLrl+P0CtG+92uzRsn0nTbdFjOkLMLWPLAU3THohKRlSEMgFJpPkm5n # 5UAZ35xX6FWCrDLsSKb555bTifwa8mJBwdlof0bmfYidH+dxZ1FdDxvLnNl9zeKs # A4kejaaIqqIPguhwAti5Ql7BlTNoJNwxCvBmqW2MQLnCkYN/VVUsR3V2x/rcTNzo # Bf/Z/SpROvdaA2ZOOd1uioXJt3tdLQ7vHpqpib0KfWr/FWXW10q38VxfCnRQBqzb # SuztR7nEMuzX7Ck+B/XaPDXd1qh72+QYyB0Z2VzWmO9zsnb9Uq/dwu8LGeQqnyu6 # 7SDGACvnXii2fb9+US492VTnXSnFKyqwgzUyFMtZK1/sHYTv6bG4TtQUygQxTN+Z # V+aJIlKO2MqZ7bKrAnOzS9m6NgoTdWOq11bTOZwKlIEV/EhV9SWkDmdpR/hPPT2v # 6TEj4F8PT/zHjRezIU5c/DGlt/VhY/pK0XkJtEyMmmS1BMtjU/rqBZVMIm3dnxQs # /TBByr+Cf8Z1r7aifQVQ+WSqzjCCBr0wggSloAMCAQICEzMAAAA5O7Y3Gb8GHWcA # AAAAADkwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpX # YXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQg # Q29ycG9yYXRpb24xMjAwBgNVBAMTKU1pY3Jvc29mdCBSb290IENlcnRpZmljYXRl # IEF1dGhvcml0eSAyMDExMB4XDTI0MDgwODIwNTQxOFoXDTM2MDMyMjIyMTMwNFow # VzELMAkGA1UEBhMCVVMxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEo # MCYGA1UEAxMfTWljcm9zb2Z0IENvZGUgU2lnbmluZyBQQ0EgMjAyNDCCAiIwDQYJ # KoZIhvcNAQEBBQADggIPADCCAgoCggIBANgBnB7jOMeqlRYHNa265v4IY9fH8TKh # emHfPINe1gpLaV3dhg324WwH06LcHbpnsBukCDNitryo0dtS/EW6I/yEL/bLSY8h # KpbfQuWusBPr9qazYcDxCW/qnjb5JsI1s8bNOg3bVATvQVL4tcf03aTycsz8QeCd # M0l/yHRObJ9QqazM1r6VPEOJ7LL+uEEb73w6QCuhs89a1uv1zerOYMnsneRRwCbp # yW11IcggU0cRKDDq1pjVJzIbIF6+oiXXbReOsgeI8zu1FyQfK0fVkaya8SmVHQ/t # Of23mZ4W9k0Ri22QW9p3UgSC5OUDktKxxcCmGL6tXLfOGSWHIIV4YrTJTT6PNty5 # REojHJuZHArkF9VnHTERWoTjAzfI3kP+5b4alUdhgAZ7ttOu1bVnXfHaqPYl2rPs # 20ji03LOVWsh/radgE17es5hL+t6lV0eVHrVhsssROWJuz2MXMCt7iw7lFPG9LXK # Gjsmonn2gotGdHIuEg5JnJMJVmixd5LRlkmgYRZKzhxSCwyoGIq0PhaA7Y+VPct5 # pCHkijcIIDm0nlkK+0KyepolcqGm0T/GYQRMhHJlGOOmVQop36wUVUYklUy++vDW # eEgEo4s7hxN6mIbf2MSIQ/iIfMZgJxC69oukMUXCrOC3SkE/xIkgpfl22MM1itkZ # 35nNXkMolU1lAgMBAAGjggFOMIIBSjAOBgNVHQ8BAf8EBAMCAYYwEAYJKwYBBAGC # NxUBBAMCAQAwHQYDVR0OBBYEFH9ZP1Qh2q1P7wXl5qPXLQaUEggxMBkGCSsGAQQB # gjcUAgQMHgoAUwB1AGIAQwBBMA8GA1UdEwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAU # ci06AjGQQ7kUBU7h6qfHMdEjiTQwWgYDVR0fBFMwUTBPoE2gS4ZJaHR0cDovL2Ny # bC5taWNyb3NvZnQuY29tL3BraS9jcmwvcHJvZHVjdHMvTWljUm9vQ2VyQXV0MjAx # MV8yMDExXzAzXzIyLmNybDBeBggrBgEFBQcBAQRSMFAwTgYIKwYBBQUHMAKGQmh0 # dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2kvY2VydHMvTWljUm9vQ2VyQXV0MjAx # MV8yMDExXzAzXzIyLmNydDANBgkqhkiG9w0BAQwFAAOCAgEAFJQfOChP7onn6fLI # MKrSlN1WYKwDFgAddymOUO3FrM8d7B/W/iQ6DxXsDn7D5W4wMwYeLystcEqfkjz4 # NURRgazyMu5yRzQh4LqjA4tStTcJh1opExo7nn5PuPBYnbu0+THSuVHTe0VTTPVh # ily/piFrDo3axQ9P4C+Ol5yet+2gTfekICS5xS+cYfSIvgn0JksVBVMYVI5QFu/q # hnLhsEFEUzG8fvv0hjgkO+lkpV9ty6GkN4vdnd7ya6Q6aR9y34aiM1qmxaxBi6OU # nyNl6fkuun/diTFnYDLTppOkr/mg5WSfCiDVMNCxtj4wPKC5OmHm1DQIt/MNokbb # H3UGsFP1QbzsLocuSqLCvH09Io3fDPTmscR9Y75G4qX7RTX8AdBPo0I6OEojf39z # uFZt0qOHm65YWQE69cZM2ueE1MB05dNNgHK9gTE7zKvK/fg8B2qjW88MT/WF5V5u # vZGtqa9FSL2RazArA+rDPuf6JGYz4HpgMZHB4S6szWSKYBv0VisCzfxgeU+dquXW # 9bd0auYlOB58DPcOYKdc3Se94g+xL4pcEhbB54JOgAkwYTu/9dLeH2pDqeJZAABV # DWRQCaXfO5LgyKwKCLYXpigrZYCjUSBcr+Ve8PFWMhVTQl0v4q8J/AUmQN5W4n10 # 1cY2L4A7GTQG1h32HHAvfQESWP0xghnDMIIZvwIBATBuMFcxCzAJBgNVBAYTAlVT # MR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jv # c29mdCBDb2RlIFNpZ25pbmcgUENBIDIwMjQCEzMAAAIdTRnITtcPV0gAAAAAAh0w # DQYJYIZIAWUDBAIBBQCggZAwGQYJKoZIhvcNAQkDMQwGCisGAQQBgjcCAQQwLwYJ # KoZIhvcNAQkEMSIEIJ0ToIg0h0S8LZAfzp015i19gJyyrpxxkWg5uW78LEjLMEIG # CisGAQQBgjcCAQwxNDAyoBSAEgBNAGkAYwByAG8AcwBvAGYAdKEagBhodHRwOi8v # d3d3Lm1pY3Jvc29mdC5jb20wDQYJKoZIhvcNAQEBBQAEggEAMOiqPzgDn2RZuthM # Dn5+KRl5iQDYUEau7/t0VEMGOJd24TVSnn4nOyCyUOHN7dQYXVr1zp6ePNc4keX/ # kuHUyyUlWE7MuMbX17qfRqtPHkjvB8nPO3WP7/h3gPWc4jIHc1Xj1kwEkL0ZUgaZ # Bg3I3m8z1r31tIBH0MJK+Lx+j2It0kNBAr8dhUKrC3r8z4CfTQh14uGH2DFbYJeb # EEacW+F/bNiNVqKQ4X+4QZnGhAa8VVLi4KGtutaSqc2fgrNNIvGM/IwygfFnu35g # wNIPOz/OzhBfg9sCGNlYq23V+tHhfFtEGR6Jq4Qz2cc0D48XIdMHLrBcVtakvW+j # BVRMYqGCF5MwghePBgorBgEEAYI3AwMBMYIXfzCCF3sGCSqGSIb3DQEHAqCCF2ww # ghdoAgEDMQ8wDQYJYIZIAWUDBAIBBQAwggFRBgsqhkiG9w0BCRABBKCCAUAEggE8 # MIIBOAIBAQYKKwYBBAGEWQoDATAxMA0GCWCGSAFlAwQCAQUABCD51Ncz9ZRBZSmq # HWUO/YSE+tbZYtlUKO3wNJZ5LJSVpwIGalorF/x7GBIyMDI2MDcyOTEzMTgyOC4w # MlowBIACAfSggdGkgc4wgcsxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5n # dG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9y # YXRpb24xJTAjBgNVBAsTHE1pY3Jvc29mdCBBbWVyaWNhIE9wZXJhdGlvbnMxJzAl # BgNVBAsTHm5TaGllbGQgVFNTIEVTTjo4OTAwLTA1RTAtRDk0NzElMCMGA1UEAxMc # TWljcm9zb2Z0IFRpbWUtU3RhbXAgU2VydmljZaCCEeowggcgMIIFCKADAgECAhMz # AAACIkHS9qr/yLX/AAEAAAIiMA0GCSqGSIb3DQEBCwUAMHwxCzAJBgNVBAYTAlVT # MRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQK # ExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMTHU1pY3Jvc29mdCBUaW1l # LVN0YW1wIFBDQSAyMDEwMB4XDTI2MDIxOTE5Mzk1NloXDTI3MDUxNzE5Mzk1Nlow # gcsxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdS # ZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xJTAjBgNVBAsT # HE1pY3Jvc29mdCBBbWVyaWNhIE9wZXJhdGlvbnMxJzAlBgNVBAsTHm5TaGllbGQg # VFNTIEVTTjo4OTAwLTA1RTAtRDk0NzElMCMGA1UEAxMcTWljcm9zb2Z0IFRpbWUt # U3RhbXAgU2VydmljZTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALW5 # 4om6Qi5SwAAmj8BjkNlGoftuGC/sJYY2UR1tEaghOt0Tpayfns1o27UFN2MFsVy/ # tF+LG17TH4dG9dKqwP5Z5Jf/r/L3ATQzP7FE9MYhjbQrtpANrrw7LNXJR5QLKnJk # L+Bb/fK079k6dT0fauLvuQk/wAGurLLVTFf86x4SC8eyPzKKRZPQBG2uNZtcwcXN # I6jmFBx9SYxcqpZbPr43T5TKeEbLWf52hbhZmCkfxjlbuGlKiRaPUz8u7jCLejoP # P29Va6RyBQUaMsCXhhmk6FqHse6IL9qVciYxB/wLcDyr/r/WEWh4hkHhQaTLDEH8 # 5JM5Kwvr7f2kOrMzsKA6l/hXv32Q33jIz25ckjlP9KIDkx0hkiERbT5uHzlGoOHl # hbf+hq/nhE/HDk4+UfrhBXoomSXQUgSUxWgs2jxRZFBwwPXv3HtYBKMLouxo1nvI # rSpwRIiwvXCJCZ19AHFyqsUKkhB+eZAWQ6n0jJdRarNry2anPwTppeD1vV6IBPc9 # VOCs6U+L+FhkJ8/Ff/qMa3I+PLUKLA6YlqaiGZJT/8I4B6d9FPYbYcxFSkJfXOz4 # CYOZ1AzVdFpvhhIAssCUPMYKyAjvuee4mOhcCWIma/s1+u9YBwDkqoJQ5ZDqRI+3 # mvbwx8pdYkmlJe0V5L8yQPMnL+IlFXIdwXL8H4y3AgMBAAGjggFJMIIBRTAdBgNV # HQ4EFgQUWQfAagMnllsQSK7wqy2K6ypqjNAwHwYDVR0jBBgwFoAUn6cVXQBeYl2D # 9OXSZacbUzUZ6XIwXwYDVR0fBFgwVjBUoFKgUIZOaHR0cDovL3d3dy5taWNyb3Nv # ZnQuY29tL3BraW9wcy9jcmwvTWljcm9zb2Z0JTIwVGltZS1TdGFtcCUyMFBDQSUy # MDIwMTAoMSkuY3JsMGwGCCsGAQUFBwEBBGAwXjBcBggrBgEFBQcwAoZQaHR0cDov # L3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9jZXJ0cy9NaWNyb3NvZnQlMjBUaW1l # LVN0YW1wJTIwUENBJTIwMjAxMCgxKS5jcnQwDAYDVR0TAQH/BAIwADAWBgNVHSUB # Af8EDDAKBggrBgEFBQcDCDAOBgNVHQ8BAf8EBAMCB4AwDQYJKoZIhvcNAQELBQAD # ggIBAGIAz6equnAbb23FJe/jaj4KxN7YLhuhpF8WO70lpaQtMfCrumSc040vef5Q # bfH8HTzcQpeIVisCa6XsFMcIZdTrf/FGxnbCPdmZHQDh32d/2xoIlWbiO49UUFqL # +iS045gfaP7X7MzvTCg3mieAH+m/LtfwB9jokHhc+9vzRDPt9jl511ufCPODWxmF # Q8VttzB5Z4AIg2vOoUrraYx5cqaG258ytqiiAl4ld9ZjfHj+lu5uAQ1Pf6ldPrnb # TcI8X2R90oTsYoAhFjLfGQFMO8V3x25+M6kKffycrqoyVW2cGMOFZAbQ8zcT+jEG # zlQGsjqkFiSYge1uOJ8Oq4dP5OFpVXvEdzoiehJzdo3Nfj0kdSBCa68N0yMuRthd # 4DT/WrkjFKDZT7JxkE68CLe51k8qEDlXM4ON/+5y7+8W1ethxGSYYo3eO6Norf/I # xmLYm7k0QvchJaivCntGN5mD4kwgrR+iy5WP5gKbmvrgsf8P1AkMCP5d9lo14V2/ # 3QrkDRBFEY/+mgH3JMhWMReP+4nOnwvgN3jiwCq6oM6Id2QuDF8ryc+qkJJY9n0b # 5EI+bzmj1wB/EQ22tK47BynIrPGxEJgIv48rj73yiuK30RUn8sugJ4b6MuWPQpoP # hDLqxl7itYyvVutAuixMFk3AWdfE2MicJYF3SLuKzXJNL/ipMIIHcTCCBVmgAwIB # AgITMwAAABXF52ueAptJmQAAAAAAFTANBgkqhkiG9w0BAQsFADCBiDELMAkGA1UE # BhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAc # BgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEyMDAGA1UEAxMpTWljcm9zb2Z0 # IFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5IDIwMTAwHhcNMjEwOTMwMTgyMjI1 # WhcNMzAwOTMwMTgzMjI1WjB8MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGlu # Z3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBv # cmF0aW9uMSYwJAYDVQQDEx1NaWNyb3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAxMDCC # AiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAOThpkzntHIhC3miy9ckeb0O # 1YLT/e6cBwfSqWxOdcjKNVf2AX9sSuDivbk+F2Az/1xPx2b3lVNxWuJ+Slr+uDZn # hUYjDLWNE893MsAQGOhgfWpSg0S3po5GawcU88V29YZQ3MFEyHFcUTE3oAo4bo3t # 1w/YJlN8OWECesSq/XJprx2rrPY2vjUmZNqYO7oaezOtgFt+jBAcnVL+tuhiJdxq # D89d9P6OU8/W7IVWTe/dvI2k45GPsjksUZzpcGkNyjYtcI4xyDUoveO0hyTD4MmP # frVUj9z6BVWYbWg7mka97aSueik3rMvrg0XnRm7KMtXAhjBcTyziYrLNueKNiOSW # rAFKu75xqRdbZ2De+JKRHh09/SDPc31BmkZ1zcRfNN0Sidb9pSB9fvzZnkXftnIv # 231fgLrbqn427DZM9ituqBJR6L8FA6PRc6ZNN3SUHDSCD/AQ8rdHGO2n6Jl8P0zb # r17C89XYcz1DTsEzOUyOArxCaC4Q6oRRRuLRvWoYWmEBc8pnol7XKHYC4jMYcten # IPDC+hIK12NvDMk2ZItboKaDIV1fMHSRlJTYuVD5C4lh8zYGNRiER9vcG9H9stQc # xWv2XFJRXRLbJbqvUAV6bMURHXLvjflSxIUXk8A8FdsaN8cIFRg/eKtFtvUeh17a # j54WcmnGrnu3tz5q4i6tAgMBAAGjggHdMIIB2TASBgkrBgEEAYI3FQEEBQIDAQAB # MCMGCSsGAQQBgjcVAgQWBBQqp1L+ZMSavoKRPEY1Kc8Q/y8E7jAdBgNVHQ4EFgQU # n6cVXQBeYl2D9OXSZacbUzUZ6XIwXAYDVR0gBFUwUzBRBgwrBgEEAYI3TIN9AQEw # QTA/BggrBgEFBQcCARYzaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9E # b2NzL1JlcG9zaXRvcnkuaHRtMBMGA1UdJQQMMAoGCCsGAQUFBwMIMBkGCSsGAQQB # gjcUAgQMHgoAUwB1AGIAQwBBMAsGA1UdDwQEAwIBhjAPBgNVHRMBAf8EBTADAQH/ # MB8GA1UdIwQYMBaAFNX2VsuP6KJcYmjRPZSQW9fOmhjEMFYGA1UdHwRPME0wS6BJ # oEeGRWh0dHA6Ly9jcmwubWljcm9zb2Z0LmNvbS9wa2kvY3JsL3Byb2R1Y3RzL01p # Y1Jvb0NlckF1dF8yMDEwLTA2LTIzLmNybDBaBggrBgEFBQcBAQROMEwwSgYIKwYB # BQUHMAKGPmh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2kvY2VydHMvTWljUm9v # Q2VyQXV0XzIwMTAtMDYtMjMuY3J0MA0GCSqGSIb3DQEBCwUAA4ICAQCdVX38Kq3h # LB9nATEkW+Geckv8qW/qXBS2Pk5HZHixBpOXPTEztTnXwnE2P9pkbHzQdTltuw8x # 5MKP+2zRoZQYIu7pZmc6U03dmLq2HnjYNi6cqYJWAAOwBb6J6Gngugnue99qb74p # y27YP0h1AdkY3m2CDPVtI1TkeFN1JFe53Z/zjj3G82jfZfakVqr3lbYoVSfQJL1A # oL8ZthISEV09J+BAljis9/kpicO8F7BUhUKz/AyeixmJ5/ALaoHCgRlCGVJ1ijbC # HcNhcy4sa3tuPywJeBTpkbKpW99Jo3QMvOyRgNI95ko+ZjtPu4b6MhrZlvSP9pEB # 9s7GdP32THJvEKt1MMU0sHrYUP4KWN1APMdUbZ1jdEgssU5HLcEUBHG/ZPkkvnNt # yo4JvbMBV0lUZNlz138eW0QBjloZkWsNn6Qo3GcZKCS6OEuabvshVGtqRRFHqfG3 # rsjoiV5PndLQTHa1V1QJsWkBRH58oWFsc/4Ku+xBZj1p/cvBQUl+fpO+y/g75LcV # v7TOPqUxUYS8vwLBgqJ7Fx0ViY1w/ue10CgaiQuPNtq6TPmb/wrpNPgkNWcr4A24 # 5oyZ1uEi6vAnQj0llOZ0dFtq0Z4+7X6gMTN9vMvpe784cETRkPHIqzqKOghif9lw # Y1NNje6CbaUFEMFxBmoQtB1VM1izoXBm8qGCA00wggI1AgEBMIH5oYHRpIHOMIHL # MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVk # bW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSUwIwYDVQQLExxN # aWNyb3NvZnQgQW1lcmljYSBPcGVyYXRpb25zMScwJQYDVQQLEx5uU2hpZWxkIFRT # UyBFU046ODkwMC0wNUUwLUQ5NDcxJTAjBgNVBAMTHE1pY3Jvc29mdCBUaW1lLVN0 # YW1wIFNlcnZpY2WiIwoBATAHBgUrDgMCGgMVALvJxdVnHduwOkmSvtW5yCmSyjO4 # oIGDMIGApH4wfDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAO # BgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEm # MCQGA1UEAxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAgUENBIDIwMTAwDQYJKoZIhvcN # AQELBQACBQDuFHnkMCIYDzIwMjYwNzI5MTMwODUyWhgPMjAyNjA3MzAxMzA4NTJa # MHQwOgYKKwYBBAGEWQoEATEsMCowCgIFAO4UeeQCAQAwBwIBAAICHOYwBwIBAAIC # EsAwCgIFAO4Vy2QCAQAwNgYKKwYBBAGEWQoEAjEoMCYwDAYKKwYBBAGEWQoDAqAK # MAgCAQACAwehIKEKMAgCAQACAwGGoDANBgkqhkiG9w0BAQsFAAOCAQEArfjXNGaR # bilX+D0sGonpW3PU6bS2WDJXORc7yFmN3li4dnK+dF88Bf7tVZDfFSwydTq8qsiL # bBYQNT7jZvtSVcb+EfrvIn+0p0EUYvIwhv/o+rf8Eq758j4Mtipqbhudf7ozMGE/ # M7xifjpGZrP/XwDgXqusYKhdqMm70Bl1jVZmZ/JjGsALaINItGwl/uaR3iuZF2mO # 15sspGpR3gNeq5NE3zSwv83gp31FJtWZzWXQ2HztED4Of4woewC6orCc9zQVKUA/ # EeNU/O2xqtF1us9AdnTmoUzyY8zA41jR29ZgsZ0TSF9aY8X5srm5QzvCgmIL+nwG # deDd4jwT8mBTHjGCBA0wggQJAgEBMIGTMHwxCzAJBgNVBAYTAlVTMRMwEQYDVQQI # EwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3Nv # ZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMTHU1pY3Jvc29mdCBUaW1lLVN0YW1wIFBD # QSAyMDEwAhMzAAACIkHS9qr/yLX/AAEAAAIiMA0GCWCGSAFlAwQCAQUAoIIBSjAa # BgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQAQQwLwYJKoZIhvcNAQkEMSIEIAbGBRHU # tUZ5LNgEVmYZoT0cBK/SkFdbo9NHqTzkgZKyMIH6BgsqhkiG9w0BCRACLzGB6jCB # 5zCB5DCBvQQgBWBdAQoE58aCM2ySYM6ZtwQg6ccY3AD5BxG58NHkCRMwgZgwgYCk # fjB8MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMH # UmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSYwJAYDVQQD # Ex1NaWNyb3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAxMAITMwAAAiJB0vaq/8i1/wAB # AAACIjAiBCC3w6/Pg2ggBF8rmuo8xOgtl06hBFWr7lrz0N9aFmeiCDANBgkqhkiG # 9w0BAQsFAASCAgBF5okvQt4mU3ZkFhJ1enk8q3tg4R2y2UVNuYcklmlBP6IFCbFu # ARILm6dEbG+1Vc9355yGpnND3xbWCWSKzex9Mhwc/Rb/GAjVB5k0+PCVi1iQDv1l # 8y+yklGocwD1003tWD8Pet12nduTyo0KtCntS3s+FrsLzz8ACn5qWOVYNMl7rwHG # x9Z3/JjRLw3z3mdaqy2Kd0O9J89kdlOundszfx6oD7hS4aSFsvvIyoyNVsqXZA1J # jdMmxN+bkoDBlpFccAta2WPapH1RC5pLzgwEfdK/yZTYZPvUSKyn2fNzZl6cieVl # zHGs+vyfIG4ifOmBMHsrr135/BVSz39BHa1IH81k61/zBHfM0zghWFjD2DEeQMEj # tLc46JpNZmmqtw57D31d3/EfJ87EvmbaDYXnzUb8z33n5cfOslpLK79yO4aeh9aM # 1tYcYqaJokV6DHjQa6k95jcQadO3S2rcW9B+yyM6Y+C3wD1cevnaU/Y6awq7YKJt # 01HTtThsCDKr+EH5hGDusr+mWGwco4u4LAq5QwvWmsavhqtHCeOMidG/iaR4YAX+ # Ewha7mX4PADT+SUyNRGmvbv7dkcT69i6XTYvKZVnz3crORHduowREjUW9GLZTDhr # FChdjZLAOq4HesZyddFnOETt1yvtbyAw2GvTKQzVazVV/xZEY3x7dogwRw== # SIG # End signature block |