packages/AzStackHci.DiagnosticSettings.0.6.8/Private/AzStackHci.ParallelLayer7.Helpers.ps1
|
# ============================================================================= # Strict Mode v1 (PS 5.1 safe) - surfaces reads of uninitialised variables at runtime. Set-StrictMode -Version 1.0 # AzStackHci.ParallelLayer7.Helpers.ps1 # ============================================================================= # Private helpers for the Layer-7 endpoint sweep in Test-AzureLocalConnectivity. # # Two helpers live here: # 1. Invoke-Layer7EndpointTest - tests ONE endpoint (mutates the $UrlObject in place, # may append CRL/OCSP dependency rows to $script:Results # via Add-CrlDependencyRowToResults). This is the # extracted body of the main per-URL ForEach loop and # is byte-identical to the v0.6.6 inline behaviour. # 2. Invoke-Layer7BucketWorker - runs inside a Start-Job worker process; loops over # a bucket of $UrlObject rows calling # Invoke-Layer7EndpointTest, snapshots the module-scope # classification state ($script:SSLInspectedURLs, # $script:CRLOfflineURLs, $script:PrivateLink* arrays, # any newly-appended $script:Results rows) and returns # a hashtable for the parent process to merge. # # The parallel fan-out is opt-in via the new -Parallelism parameter on # Test-AzureLocalConnectivity (default 1, sequential, byte-identical to v0.6.6). # ============================================================================= function Invoke-Layer7EndpointTest { <# .SYNOPSIS Runs DNS + TCP + Layer-7 connectivity tests for a single endpoint row, mutating the row in place. Body extracted verbatim from the main ForEach loop in Test-AzureLocalConnectivity to enable parallel fan-out via Start-Job. .DESCRIPTION Sequential default behaviour: identical to the pre-extraction inline ForEach body. Mutates $UrlObject fields (TCPStatus, Layer7Status, Layer7Response, certificate columns, IPAddress, Note). May call Add-CrlDependencyRowToResults which appends new rows to $script:Results. May also append to module-scope classification state ($script:SSLInspectedURLs, $script:CRLOfflineURLs, $script:PrivateLink* arrays, $script:SSLInspectionDetected) via the call into Test-Layer7Connectivity -> Get-Layer7CertificateDetails / Get-DnsRecord. .PARAMETER UrlObject The PSCustomObject row from $script:Results to test. Mutated in place. .PARAMETER SkipUrls The list of URLs that the parent loop has decided to skip (the manually-curated "skip" list — pre-2026 hardcoded entries like wustat.windows.com). .PARAMETER ArcGatewayDeployment Whether -ArcGatewayDeployment was specified on the public Test-AzureLocalConnectivity. .PARAMETER NTPTimeServer Optional user-supplied NTP server URL (replaces time.windows.com for that one row). .PARAMETER IncludeTCPConnectivityTests Whether -IncludeTCPConnectivityTests was specified on the public function. .PARAMETER RequestMethod 'Get' / 'Head' / 'Auto' — plumbed through to Test-Layer7Connectivity. #> [CmdletBinding()] param( [Parameter(Mandatory)] [object]$UrlObject, [Parameter(Mandatory)] [array]$SkipUrls, [Parameter(Mandatory=$false)] [bool]$ArcGatewayDeployment = $false, [Parameter(Mandatory=$false)] [string]$NTPTimeServer, [Parameter(Mandatory=$false)] [bool]$IncludeTCPConnectivityTests = $false, [Parameter(Mandatory=$false)] [ValidateSet('Get','Head','Auto')] [string]$RequestMethod = 'Auto' ) # Local alias preserves the old loop variable name so the extracted body remains # diff-readable against the v0.6.6 ForEach body it came from. $urlObj = $UrlObject # Per-iteration DNSCheck reset (matches original "Remove-Variable DNSCheck" inside the loop). $DNSCheck = $null Write-Debug "Arc Gateway boolean for url '$($urlObj.url)' from source $($urlObj.Source) = $($urlObj.ArcGateway)" # If the ArcGatewayDeployment switch is used, only test URLs that do not support Arc Gateway if ($ArcGatewayDeployment) { # Skip URLs with ArcGateway -eq $True if ($urlObj.ArcGateway) { # Skip URLs that support Arc Gateway Write-HostAzS "Skipped URL: '$($urlObj.URL)' as supported by Arc Gateway" -ForegroundColor Yellow Set-UrlObjectSkipFields -UrlObject $urlObj -TCPStatus "Skipped" -Layer7Status "Skipped" $urlObj.Note = "Skipped, URL is supported by Arc Gateway - $($urlObj.Note)" Write-HostAzS "" return } } # Process URLs that require special handling if (($urlObj.URL -like ("*.gw.arc.azure.com") -or $urlObj.URL -like ("*.gw.arc.azure.net"))) { if ($ArcGatewayDeployment) { # Replace the URL with the user-defined Arc Gateway URL, if specified $urlObj.URL = (Get-DomainFromURL -url $script:UpdatedArcGatewayURL).Domain # Run DNS + TCP + Layer 7 connectivity tests using shared helper # Forward -RequestMethod down through Invoke-EndpointConnectivityTest into Test-Layer7Connectivity (parity with the non-wildcard branch). $testResult = Invoke-EndpointConnectivityTest -Url $urlObj.URL -Port $urlObj.Port -IncludeTCPConnectivityTests:$IncludeTCPConnectivityTests -RequestMethod $RequestMethod Copy-ConnectivityResultsToUrlObject -UrlObject $urlObj -TestResult $testResult } else { # Not using Arc Gateway, skip the URL Write-HostAzS "Skipping URL, (not using Arc Gateway): $($urlObj.URL)" -ForegroundColor Green Set-UrlObjectSkipFields -UrlObject $urlObj -TCPStatus "Skipped" -Layer7Status "Skipped" $urlObj.Note = "Skipped, not using Arc Gateway, as '-ArcGatewayDeployment' switch not present - $($urlObj.Note)" } } elseif ($urlObj.URL -eq "time.windows.com") { # Replace the URL with the user-defined NTP Time Server, if specified if ([string]::IsNullOrWhiteSpace($NTPTimeServer)) { # Use default NTP Time Server Write-HostAzS "Using default NTP Time Server: 'time.windows.com' for NTP connectivity test on UDP port 123, as the '`$NTPTimeServer' parameter was not specified" -ForegroundColor Yellow $DNSCheck = Get-DnsRecord -url (Get-DomainFromURL -url $urlObj.URL).Domain } else { Write-HostAzS "Replacing default NTP Time Server 'time.windows.com' with user-defined NTP server: '$NTPTimeServer'" -ForegroundColor Green [string]$urlObj.URL = (Get-DomainFromURL -url $NTPTimeServer).Domain $urlObj.Source = "User-defined NTP server" # //// Ignore RFC1918 check during DNS check for user-defined NTP server //// $DNSCheck = Get-DnsRecord -url (Get-DomainFromURL -url $NTPTimeServer).Domain -SkipRfc1918Check } # If using a Proxy, DNS resolution from the local host may not be required if (($DNSCheck.DNSExists) -or ($script:Proxy.Enabled)) { $StopWatch = [Diagnostics.Stopwatch]::StartNew() $urlObj.TCPStatus, $urlObj.IPAddress = Test-NTPConnectivity -ntpServer $urlObj.URL if ($urlObj.TCPStatus -eq "Success") { $urlObj.Layer7Status = "Success" } else { $urlObj.Layer7Status = "Failed" } if ([string]::IsNullOrWhiteSpace($urlObj.IPAddress)) { $urlObj.IPAddress = $DNSCheck.IpAddress } $urlObj.Layer7Response = "UDP port 123" $urlObj.Layer7ResponseTime = [math]::round($StopWatch.Elapsed.TotalMilliseconds/1000, 3) $StopWatch.Stop() # NTP does not use SSL certificates $urlObj.CertificateIssuer = "N/A" $urlObj.CertificateSubject = "N/A" $urlObj.CertificateThumbprint = "N/A" $urlObj.IntermediateCertificateIssuer = "N/A" $urlObj.IntermediateCertificateSubject = "N/A" $urlObj.IntermediateCertificateThumbprint = "N/A" $urlObj.RootCertificateIssuer = "N/A" $urlObj.RootCertificateSubject = "N/A" $urlObj.RootCertificateThumbprint = "N/A" } else { Set-UrlObjectSkipFields -UrlObject $urlObj -TCPStatus "Failed" -Layer7Status "Failed" -IPAddress $DNSCheck.IpAddress } # //// Skipped URLs //// } elseif ($SkipUrls.URL.Contains($urlObj.URL)) { Write-HostAzS "Skipped URL: $($urlObj.URL)" -ForegroundColor Green Set-UrlObjectSkipFields -UrlObject $urlObj -TCPStatus "Skipped" -Layer7Status "Skipped" $urlObj.Note = "Skipped URL - $($urlObj.Note)" # //// Wildcard URLs //// } elseif ($urlObj.IsWildcard) { Write-HostAzS "Wildcard URLs are processed later..." -ForegroundColor Yellow Set-UrlObjectSkipFields -UrlObject $urlObj -TCPStatus "Skipped" -Layer7Status "Skipped" $urlObj.Note = "$($urlObj.Note)" # //// Non-wildcard URLs //// } else { # Placeholder KeyVault URL: show Warning status instead of running tests against a URL that will always fail DNS if ($urlObj.URL -like "yourhcikeyvaultname.vault.*") { Write-HostAzS "WARNING: Default KeyVault endpoint '$($urlObj.URL)' is being used." -ForegroundColor Yellow Write-HostAzS "INFO: Specify your KeyVault endpoint using the '-KeyVaultURL' parameter to validate your actual KeyVault connectivity." -ForegroundColor Yellow Set-UrlObjectSkipFields -UrlObject $urlObj -TCPStatus "Failed" -Layer7Status "Failed" $urlObj.Note = "PARAMETER `"-KeyVaultURL https://<yourKeyVault>.vault.azure.net`" WAS NOT USED - THIS IS REQUIRED TO SPECIFY YOUR UNIQUE KEY VAULT NAME - Key vault for deployment secrets." # Sleep for 3 seconds to allow the user to read the warning, if present. Start-Sleep -Seconds 3 # NOTE: original 'Continue' here SKIPS the trailing Write-HostAzS "" — replicate by returning early. return } # Run DNS + TCP + Layer 7 connectivity tests using shared helper # Forward -RequestMethod down through Invoke-EndpointConnectivityTest into Test-Layer7Connectivity. $testResult = Invoke-EndpointConnectivityTest -Url $urlObj.URL -Port $urlObj.Port -IncludeTCPConnectivityTests:$IncludeTCPConnectivityTests -RequestMethod $RequestMethod Copy-ConnectivityResultsToUrlObject -UrlObject $urlObj -TestResult $testResult } # Add line return after each URL (matches the original loop trailing Write-HostAzS ""). Write-HostAzS "" } function Invoke-Layer7BucketWorker { <# .SYNOPSIS Worker scriptblock body — runs inside a Start-Job child process, loops over a bucket of endpoint rows calling Invoke-Layer7EndpointTest, and returns a snapshot of all module-scope classification state for the parent process to merge. .DESCRIPTION Each Start-Job worker is its own process, so $script:* variables are isolated. The worker imports the module (so Invoke-Layer7EndpointTest, Test-Layer7Connectivity, Get-DnsRecord, Add-CrlDependencyRowToResults etc. are all available), seeds the module-scope state from the parent's snapshot, runs the bucket sequentially, then returns a hashtable that the parent merges. Returned hashtable keys: - Rows : the mutated $UrlObject rows from this bucket (RowID-tagged) - NewCrlRows : any rows appended to $script:Results by Add-CrlDependencyRowToResults inside the bucket - RedirectedResults : URLs the worker discovered via HTTP 301/302 redirect responses ($script:RedirectedResults snapshot — Phase 4 of Test-AzureLocalConnectivity iterates the parent's copy of this list, so workers MUST plumb it back or redirected URLs are silently dropped from the output) - SSLInspectedURLs : list of URLs flagged for SSL Inspection - CRLOfflineURLs : list of URLs whose CRL/OCSP check was offline - SSLInspectionDetected : bool — true if any row in the bucket triggered SSL inspection - PrivateLinkDetected : bool — true if any URL in the bucket resolved to RFC1918 (the parent uses this scalar flag to decide whether to print the customer-facing 'PRIVATE LINK DETECTED' warning) - PrivateLinkDetectedArray : list of URLs flagged for Private Link - PrivateLinkCriticalArray : list of URLs flagged for Private Link (RFC1918, critical) - PrivateLinkProxyBypassArray: list of URLs flagged for Private Link (RFC1918, proxy bypass) - BucketIndex : the worker's bucket index (for deterministic merge order) - BucketWallClockSec : wall-clock duration of this worker's bucket Diagnostic console output produced during testing is interleaved across workers — that is the documented behaviour of the parallel mode. The transcript still captures every line; the JSON output is RowID-sorted so customer-facing output ordering is identical to sequential mode. .PARAMETER Bucket Array of $UrlObject rows for this worker to test (round-robin partition from parent). .PARAMETER ParameterBag Hashtable carrying SkipUrls / ArcGatewayDeployment / NTPTimeServer / IncludeTCPConnectivityTests / RequestMethod / Proxy / UpdatedArcGatewayURL. .PARAMETER BucketIndex Index of this bucket (0..N-1). #> [CmdletBinding()] param( [Parameter(Mandatory)] [array]$Bucket, [Parameter(Mandatory)] [hashtable]$ParameterBag, [Parameter(Mandatory=$false)] [int]$BucketIndex = 0 ) $bucketSw = [System.Diagnostics.Stopwatch]::StartNew() # Tag every Write-HostAzS line emitted from inside this worker with [bucket-N] # so the interleaved transcript is greppable per bucket. Cleared in the finally # so the parent process never inherits a stale prefix. $script:WorkerLogPrefix = "[bucket-$BucketIndex] " # Wrap the bucket body in try/finally so the [bucket-N] prefix is ALWAYS cleared # (and the stopwatch always stopped) even if a terminating error escapes the # per-row try/catch below. Body indentation is intentionally unchanged to keep # this diff minimal and reviewable. try { # Seed module-scope state from the parent's snapshot — Invoke-Layer7EndpointTest reads # $script:Proxy and $script:UpdatedArcGatewayURL. Constants.ps1's Initialize-ModuleState # has already created the empty ArrayLists / arrays for the classification state, so # we can rely on those being initialised but empty in this worker process. if ($ParameterBag.ContainsKey('Proxy')) { $script:Proxy = $ParameterBag.Proxy } if ($ParameterBag.ContainsKey('UpdatedArcGatewayURL')) { $script:UpdatedArcGatewayURL = $ParameterBag.UpdatedArcGatewayURL } # Snapshot the row count BEFORE running the bucket so we can isolate any new # CRL/OCSP rows that Add-CrlDependencyRowToResults appends during testing. # The worker's $script:Results starts as a (cloned) copy of the bucket so that # Add-CrlDependencyRowToResults's host-level dedupe still works correctly within # the bucket's scope. [System.Collections.ArrayList]$script:Results = @($Bucket) $initialRowCount = $script:Results.Count foreach ($row in $Bucket) { try { Invoke-Layer7EndpointTest ` -UrlObject $row ` -SkipUrls $ParameterBag.SkipUrls ` -ArcGatewayDeployment ([bool]$ParameterBag.ArcGatewayDeployment) ` -NTPTimeServer $ParameterBag.NTPTimeServer ` -IncludeTCPConnectivityTests ([bool]$ParameterBag.IncludeTCPConnectivityTests) ` -RequestMethod $ParameterBag.RequestMethod } catch { # Mark the row as Failed but never abort the bucket — bucket-level isolation matters. try { $row.Layer7Status = 'Failed' $row.Layer7Response = "Worker exception: $($_.Exception.Message)" } catch {} } } # Identify any new CRL/OCSP dependency rows the bucket appended during testing. $newCrlRows = @() if ($script:Results.Count -gt $initialRowCount) { $newCrlRows = @($script:Results | Select-Object -Skip $initialRowCount) } } finally { $bucketSw.Stop() # Clear the bucket prefix so a direct (non-Start-Job) caller doesn't leak it. # In the Start-Job process this is moot — the process is torn down — but # Pester tests that invoke Invoke-Layer7BucketWorker in-proc would otherwise # see subsequent Write-HostAzS calls still tagged. $script:WorkerLogPrefix = '' } return @{ Rows = @($Bucket) NewCrlRows = $newCrlRows RedirectedResults = @($script:RedirectedResults) SSLInspectedURLs = @($script:SSLInspectedURLs) CRLOfflineURLs = @($script:CRLOfflineURLs) SSLInspectionDetected = [bool]$script:SSLInspectionDetected PrivateLinkDetected = [bool]$script:PrivateLinkDetected PrivateLinkDetectedArray = @($script:PrivateLinkDetectedArray) PrivateLinkCriticalArray = @($script:PrivateLinkCriticalArray) PrivateLinkProxyBypassArray = @($script:PrivateLinkProxyBypassArray) BucketIndex = $BucketIndex BucketWallClockSec = [math]::Round($bucketSw.Elapsed.TotalSeconds, 3) } } function Merge-Layer7WorkerResult { <# .SYNOPSIS Merges one worker's returned hashtable into the parent module-scope state. .DESCRIPTION - Replaces parent rows by RowID with the worker's mutated copies. - Appends new CRL/OCSP dependency rows to $script:Results (idempotent: skips URLs already present at the parent level). - Unions the SSL-inspection / CRL-offline / Private-Link arrays. - ORs the SSLInspectionDetected flag. .PARAMETER WorkerResult The hashtable returned by Invoke-Layer7BucketWorker. #> [CmdletBinding()] param( [Parameter(Mandatory)] [hashtable]$WorkerResult ) # The worker mutated the original PSCustomObject references in $Bucket. Because # Start-Job serialises objects across the process boundary, the deserialised rows # returned in WorkerResult.Rows are NOT the same instances as the parent's # $script:Results entries. Merge by RowID match. foreach ($workerRow in $WorkerResult.Rows) { $match = $script:Results | Where-Object { $_.RowID -eq $workerRow.RowID } | Select-Object -First 1 if ($null -ne $match) { # Copy back every mutated field. This is intentionally explicit (not # ForEach-Object Get-Member) to avoid accidentally overwriting RowID/URL/Port etc. foreach ($field in @( 'TCPStatus','IPAddress','Layer7Status','Layer7Response','Layer7ResponseTime', 'CertificateIssuer','CertificateSubject','CertificateThumbprint', 'IntermediateCertificateIssuer','IntermediateCertificateSubject','IntermediateCertificateThumbprint', 'RootCertificateIssuer','RootCertificateSubject','RootCertificateThumbprint', 'Note','URL','Source' )) { if (($workerRow.PSObject.Properties.Name -contains $field) -and ($match.PSObject.Properties.Name -contains $field)) { $match.$field = $workerRow.$field } } } } # Append any new CRL/OCSP dependency rows the worker generated. When the same # dependency URL is discovered in another bucket the row is NOT re-added — instead # we extend the existing row's Source field so customer-facing output preserves # all parent-domain attributions. This mirrors the Tier-1 dedupe semantics inside # Add-CrlDependencyRowToResults (Private/AzStackHci.Connectivity.Helpers.ps1) for # the cross-bucket case, where each worker's local dedupe cannot see other buckets. foreach ($newRow in $WorkerResult.NewCrlRows) { # Defence-in-depth: skip any $null row (mirrors the RedirectedResults loop guard # below) so a malformed worker payload can never throw on $newRow.URL. if ($null -eq $newRow) { continue } $existing = $script:Results | Where-Object { ($_.URL -eq $newRow.URL) -and ($_.Port -eq $newRow.Port) } | Select-Object -First 1 if ($null -eq $existing) { $script:Results.Add($newRow) | Out-Null } elseif ($newRow.PSObject.Properties.Name -contains 'Source' -and -not [string]::IsNullOrWhiteSpace($newRow.Source)) { # Extract the parent-domain hint(s) from the worker's Source string and append # any not already present on the parent row's Source. The Source field uses # '; '-separated parent-domain tokens so a simple substring check is reliable. $existingSrc = if ([string]::IsNullOrWhiteSpace($existing.Source)) { '' } else { $existing.Source } foreach ($token in ($newRow.Source -split ';\s*')) { $t = $token.Trim() if ($t -and ($existingSrc -notmatch [regex]::Escape($t))) { $existing.Source = if ([string]::IsNullOrWhiteSpace($existing.Source)) { $t } else { "$($existing.Source); $t" } $existingSrc = $existing.Source } } } } # Plumb back any URLs the worker discovered as HTTP 301/302 redirect targets so # Phase 4 of Test-AzureLocalConnectivity (the redirected-URLs loop) can test them. # Without this merge step those rows would be silently dropped from the JSON / HTML # / CSV output in -Parallelism > 1 runs. Dedupe by url + Port matches the existing # New-RedirectedResultEntry semantics in Private/AzStackHci.Connectivity.Helpers.ps1. if ($WorkerResult.RedirectedResults) { foreach ($redirRow in $WorkerResult.RedirectedResults) { if ($null -eq $redirRow) { continue } $existsInRedirected = $script:RedirectedResults | Where-Object { ($_.url -eq $redirRow.url) -and ($_.Port -eq $redirRow.Port) } | Select-Object -First 1 $existsInResults = $script:Results | Where-Object { ($_.URL -eq $redirRow.url) -and ($_.Port -eq $redirRow.Port) } | Select-Object -First 1 if ((-not $existsInRedirected) -and (-not $existsInResults)) { $script:RedirectedResults.Add($redirRow) | Out-Null } } } foreach ($u in $WorkerResult.SSLInspectedURLs) { if (-not ($script:SSLInspectedURLs -contains $u)) { $script:SSLInspectedURLs.Add($u) | Out-Null } } foreach ($u in $WorkerResult.CRLOfflineURLs) { if (-not ($script:CRLOfflineURLs -contains $u)) { $script:CRLOfflineURLs.Add($u) | Out-Null } } if ($WorkerResult.SSLInspectionDetected) { $script:SSLInspectionDetected = $true } # OR-merge the scalar PrivateLinkDetected flag — the parent uses this boolean (NOT # the array) at the end of Test-AzureLocalConnectivity to decide whether to print # the customer-facing 'PRIVATE LINK DETECTED' warning block. if ($WorkerResult.PrivateLinkDetected) { $script:PrivateLinkDetected = $true } foreach ($u in $WorkerResult.PrivateLinkDetectedArray) { if (-not ($script:PrivateLinkDetectedArray -contains $u)) { $script:PrivateLinkDetectedArray += $u } } foreach ($u in $WorkerResult.PrivateLinkCriticalArray) { if (-not ($script:PrivateLinkCriticalArray -contains $u)) { $script:PrivateLinkCriticalArray += $u } } foreach ($u in $WorkerResult.PrivateLinkProxyBypassArray) { if (-not ($script:PrivateLinkProxyBypassArray -contains $u)) { $script:PrivateLinkProxyBypassArray += $u } } } function Split-Layer7BucketsRoundRobin { <# .SYNOPSIS Cost-aware bin-packs a row array into N buckets, with plain round-robin fallback. .DESCRIPTION Endpoint timing is heterogeneous: rows that trigger CRL/OCSP chain validation or that are flagged as Critical/Wildcard typically take 2-3x longer than a plain HEAD probe. A pure `i % Buckets` round-robin can leave one worker with most of the slow rows. Algorithm (cost-aware mode, default): 1. Estimate a per-row cost (Get-Layer7RowCost — CRL/OCSP/Critical = 3, Wildcard = 2, Redirected = 2, all others = 1). 2. Sort rows DESC by cost. (Output ordering is preserved at MERGE time via RowID-sort — see Merge-Layer7WorkerResult — so the bucket-internal order does not affect customer-visible results.) 3. Greedy bin-pack: for each row, place it in the bucket with the lowest current cumulative cost. Ties broken by lowest bucket index. Algorithm (legacy round-robin, opt-in via -RoundRobin): Plain `i % Buckets` — preserved for benchmarking / regression comparison. .PARAMETER Rows The full ordered array of rows to partition. .PARAMETER Buckets Number of buckets (= -Parallelism). Range 1-64. .PARAMETER RoundRobin Switch to force the legacy `i % Buckets` distribution. Default behaviour (switch absent) is cost-aware bin-packing. #> [CmdletBinding()] param( [Parameter(Mandatory)] [array]$Rows, [Parameter(Mandatory)] [ValidateRange(1, 64)] [int]$Buckets, [switch]$RoundRobin ) # Initialise N empty bucket arrays. The leading comma on `,@()` is required — # `for` would otherwise unwrap a 0-element array, leaving fewer than N buckets. $result = @(for ($i = 0; $i -lt $Buckets; $i++) { ,@() }) if ($RoundRobin -or $Buckets -eq 1 -or $Rows.Count -le $Buckets) { # Legacy / trivial cases: bin-packing has no benefit. for ($i = 0; $i -lt $Rows.Count; $i++) { $b = $i % $Buckets $result[$b] += $Rows[$i] } return ,$result } # Cost-aware greedy bin-pack. $costs = @{} foreach ($row in $Rows) { $costs[$row] = Get-Layer7RowCost -Row $row } # Sort DESC by cost. Stable for ties (PowerShell's Sort-Object is NOT stable; # use a secondary key by original index to make ordering deterministic for tests). $indexed = for ($i = 0; $i -lt $Rows.Count; $i++) { [pscustomobject]@{ Row = $Rows[$i]; Cost = $costs[$Rows[$i]]; Index = $i } } $sorted = @($indexed | Sort-Object -Property @{Expression='Cost';Descending=$true}, @{Expression='Index';Descending=$false}) $bucketCost = New-Object 'int[]' $Buckets foreach ($entry in $sorted) { # Find bucket with minimum cumulative cost (ties → lowest index). $minIdx = 0 for ($b = 1; $b -lt $Buckets; $b++) { if ($bucketCost[$b] -lt $bucketCost[$minIdx]) { $minIdx = $b } } $result[$minIdx] += $entry.Row $bucketCost[$minIdx] += $entry.Cost } return ,$result } function Get-Layer7RowCost { <# .SYNOPSIS Estimate the relative cost of testing a Layer-7 row, used by Split-Layer7BucketsRoundRobin. .DESCRIPTION Returns 3 for CRL/OCSP / Critical rows (slowest — chain validation, often blocked endpoints with full timeout), 2 for Wildcard / Redirected rows (medium — extra DNS + sometimes a second HEAD), and 1 for everything else. The exact numbers are not load-bearing; they only need to reflect the relative wall-clock weight so the greedy bin-pack balances correctly. #> [CmdletBinding()] [OutputType([int])] param( [Parameter(Mandatory)] [object]$Row ) $isCrl = ($Row.PSObject.Properties['Source'] -and ($Row.Source -match 'CRL|OCSP|crl\.|ocsp\.')) $isCrit = ($Row.PSObject.Properties['Source'] -and ($Row.Source -match 'Critical')) $isWild = ($Row.PSObject.Properties['IsWildcard'] -and $Row.IsWildcard) $isRedir = ($Row.PSObject.Properties['Source'] -and ($Row.Source -match 'Redirect')) if ($isCrl -or $isCrit) { return 3 } if ($isWild -or $isRedir) { return 2 } return 1 } # SIG # Begin signature block # MIInRAYJKoZIhvcNAQcCoIInNTCCJzECAQExDzANBglghkgBZQMEAgEFADB5Bgor # BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG # KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCEQBFUsc70Flfx # GXDVWqSt8TObmV68HLUEGKGmmHLceaCCDLowggX1MIID3aADAgECAhMzAAACHU0Z # yE7XD1dIAAAAAAIdMA0GCSqGSIb3DQEBCwUAMFcxCzAJBgNVBAYTAlVTMR4wHAYD # VQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBD # b2RlIFNpZ25pbmcgUENBIDIwMjQwHhcNMjYwNDE2MTg1OTQzWhcNMjcwNDE1MTg1 # OTQzWjB0MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UE # BxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMR4wHAYD # VQQDExVNaWNyb3NvZnQgQ29ycG9yYXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IB # DwAwggEKAoIBAQDQvewXxx9gZZFC6Ys1WBay8BJ8kGA4JQnH5CMafqOASlTpK9H8 # o5ZXTXt0caVQTNMUPt445wXYD+dFtaKWTwDn1I52oUSrC9vJin1Gsqt+zyKJL5Dg # 3eQXbQNR61DmMy20GLTIO3SFed9Rfi/ophgCLGFLDR3r0KvHjwMb/jYWS0celV/4 # Lz27LfAekm8v9E5IXaeiXbAUYZKK090n4CVl3JBtbN+9DtI9SNu/yjvozW52/u7R # X/Ttpa/KDlpuokZ+Zcbvmtd9ur9gFLvZzh41o9MsE/clQtdaFWGvuo6Jua/ntpgk # ey3E5/vBFe+MJPG6phdnuo6r57ZudCudiI1bAgMBAAGjggGbMIIBlzAOBgNVHQ8B # Af8EBAMCB4AwHwYDVR0lBBgwFgYKKwYBBAGCN0wIAQYIKwYBBQUHAwMwHQYDVR0O # BBYEFH6QuMwqcPG0hQlQ6c5jCtTTLrVeMEUGA1UdEQQ+MDykOjA4MR4wHAYDVQQL # ExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xFjAUBgNVBAUTDTIzMDAxMis1MDc1NTkw # HwYDVR0jBBgwFoAUf1k/VCHarU/vBeXmo9ctBpQSCDEwYAYDVR0fBFkwVzBVoFOg # UYZPaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9jcmwvTWljcm9zb2Z0 # JTIwQ29kZSUyMFNpZ25pbmclMjBQQ0ElMjAyMDI0LmNybDBtBggrBgEFBQcBAQRh # MF8wXQYIKwYBBQUHMAKGUWh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMv # Y2VydHMvTWljcm9zb2Z0JTIwQ29kZSUyMFNpZ25pbmclMjBQQ0ElMjAyMDI0LmNy # dDAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEBCwUAA4ICAQBKTbYOjzwTG/DXGaz9 # s6+fQeaTtDcFmMY+5UyVFCyj7Pv+5i37qfX8lSL/tBIfYQfWsMuBQlfZurJD6r4H # VJ2CeH+1fgiq8dcHdVKoZ3Sa2qXoX3cq9iS8cVb06B7+5/XJ7I0OxHH9fDsvJ3T3 # w5V/ZtAIFmLrl+P0CtG+92uzRsn0nTbdFjOkLMLWPLAU3THohKRlSEMgFJpPkm5n # 5UAZ35xX6FWCrDLsSKb555bTifwa8mJBwdlof0bmfYidH+dxZ1FdDxvLnNl9zeKs # A4kejaaIqqIPguhwAti5Ql7BlTNoJNwxCvBmqW2MQLnCkYN/VVUsR3V2x/rcTNzo # Bf/Z/SpROvdaA2ZOOd1uioXJt3tdLQ7vHpqpib0KfWr/FWXW10q38VxfCnRQBqzb # SuztR7nEMuzX7Ck+B/XaPDXd1qh72+QYyB0Z2VzWmO9zsnb9Uq/dwu8LGeQqnyu6 # 7SDGACvnXii2fb9+US492VTnXSnFKyqwgzUyFMtZK1/sHYTv6bG4TtQUygQxTN+Z # V+aJIlKO2MqZ7bKrAnOzS9m6NgoTdWOq11bTOZwKlIEV/EhV9SWkDmdpR/hPPT2v # 6TEj4F8PT/zHjRezIU5c/DGlt/VhY/pK0XkJtEyMmmS1BMtjU/rqBZVMIm3dnxQs # /TBByr+Cf8Z1r7aifQVQ+WSqzjCCBr0wggSloAMCAQICEzMAAAA5O7Y3Gb8GHWcA # AAAAADkwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpX # YXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQg # Q29ycG9yYXRpb24xMjAwBgNVBAMTKU1pY3Jvc29mdCBSb290IENlcnRpZmljYXRl # IEF1dGhvcml0eSAyMDExMB4XDTI0MDgwODIwNTQxOFoXDTM2MDMyMjIyMTMwNFow # VzELMAkGA1UEBhMCVVMxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEo # MCYGA1UEAxMfTWljcm9zb2Z0IENvZGUgU2lnbmluZyBQQ0EgMjAyNDCCAiIwDQYJ # KoZIhvcNAQEBBQADggIPADCCAgoCggIBANgBnB7jOMeqlRYHNa265v4IY9fH8TKh # emHfPINe1gpLaV3dhg324WwH06LcHbpnsBukCDNitryo0dtS/EW6I/yEL/bLSY8h # KpbfQuWusBPr9qazYcDxCW/qnjb5JsI1s8bNOg3bVATvQVL4tcf03aTycsz8QeCd # M0l/yHRObJ9QqazM1r6VPEOJ7LL+uEEb73w6QCuhs89a1uv1zerOYMnsneRRwCbp # yW11IcggU0cRKDDq1pjVJzIbIF6+oiXXbReOsgeI8zu1FyQfK0fVkaya8SmVHQ/t # Of23mZ4W9k0Ri22QW9p3UgSC5OUDktKxxcCmGL6tXLfOGSWHIIV4YrTJTT6PNty5 # REojHJuZHArkF9VnHTERWoTjAzfI3kP+5b4alUdhgAZ7ttOu1bVnXfHaqPYl2rPs # 20ji03LOVWsh/radgE17es5hL+t6lV0eVHrVhsssROWJuz2MXMCt7iw7lFPG9LXK # Gjsmonn2gotGdHIuEg5JnJMJVmixd5LRlkmgYRZKzhxSCwyoGIq0PhaA7Y+VPct5 # pCHkijcIIDm0nlkK+0KyepolcqGm0T/GYQRMhHJlGOOmVQop36wUVUYklUy++vDW # eEgEo4s7hxN6mIbf2MSIQ/iIfMZgJxC69oukMUXCrOC3SkE/xIkgpfl22MM1itkZ # 35nNXkMolU1lAgMBAAGjggFOMIIBSjAOBgNVHQ8BAf8EBAMCAYYwEAYJKwYBBAGC # NxUBBAMCAQAwHQYDVR0OBBYEFH9ZP1Qh2q1P7wXl5qPXLQaUEggxMBkGCSsGAQQB # gjcUAgQMHgoAUwB1AGIAQwBBMA8GA1UdEwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAU # ci06AjGQQ7kUBU7h6qfHMdEjiTQwWgYDVR0fBFMwUTBPoE2gS4ZJaHR0cDovL2Ny # bC5taWNyb3NvZnQuY29tL3BraS9jcmwvcHJvZHVjdHMvTWljUm9vQ2VyQXV0MjAx # MV8yMDExXzAzXzIyLmNybDBeBggrBgEFBQcBAQRSMFAwTgYIKwYBBQUHMAKGQmh0 # dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2kvY2VydHMvTWljUm9vQ2VyQXV0MjAx # MV8yMDExXzAzXzIyLmNydDANBgkqhkiG9w0BAQwFAAOCAgEAFJQfOChP7onn6fLI # MKrSlN1WYKwDFgAddymOUO3FrM8d7B/W/iQ6DxXsDn7D5W4wMwYeLystcEqfkjz4 # NURRgazyMu5yRzQh4LqjA4tStTcJh1opExo7nn5PuPBYnbu0+THSuVHTe0VTTPVh # ily/piFrDo3axQ9P4C+Ol5yet+2gTfekICS5xS+cYfSIvgn0JksVBVMYVI5QFu/q # hnLhsEFEUzG8fvv0hjgkO+lkpV9ty6GkN4vdnd7ya6Q6aR9y34aiM1qmxaxBi6OU # nyNl6fkuun/diTFnYDLTppOkr/mg5WSfCiDVMNCxtj4wPKC5OmHm1DQIt/MNokbb # H3UGsFP1QbzsLocuSqLCvH09Io3fDPTmscR9Y75G4qX7RTX8AdBPo0I6OEojf39z # uFZt0qOHm65YWQE69cZM2ueE1MB05dNNgHK9gTE7zKvK/fg8B2qjW88MT/WF5V5u # vZGtqa9FSL2RazArA+rDPuf6JGYz4HpgMZHB4S6szWSKYBv0VisCzfxgeU+dquXW # 9bd0auYlOB58DPcOYKdc3Se94g+xL4pcEhbB54JOgAkwYTu/9dLeH2pDqeJZAABV # DWRQCaXfO5LgyKwKCLYXpigrZYCjUSBcr+Ve8PFWMhVTQl0v4q8J/AUmQN5W4n10 # 1cY2L4A7GTQG1h32HHAvfQESWP0xghngMIIZ3AIBATBuMFcxCzAJBgNVBAYTAlVT # MR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jv # c29mdCBDb2RlIFNpZ25pbmcgUENBIDIwMjQCEzMAAAIdTRnITtcPV0gAAAAAAh0w # DQYJYIZIAWUDBAIBBQCggZAwGQYJKoZIhvcNAQkDMQwGCisGAQQBgjcCAQQwLwYJ # KoZIhvcNAQkEMSIEIGoUi4zMsts/VFO7JdQMxgiIjtmrA3jmdG1JT7wTB27AMEIG # CisGAQQBgjcCAQwxNDAyoBSAEgBNAGkAYwByAG8AcwBvAGYAdKEagBhodHRwOi8v # d3d3Lm1pY3Jvc29mdC5jb20wDQYJKoZIhvcNAQEBBQAEggEAWsjb8q9yeQxhAuaL # ImfUdA7xRsETxXTZXtuylteh4ta29r1/AymQYGpBfm6WplZseRo/pdPx4bh6QkO/ # q1BHAGeuzPLAeElaV4aI7Hy6Ywy8S5OawppeOW2Tf4IadTmbRGSa4S8qwSpPT7S9 # k0OGEw3JlugyW/dSttjbU0HeUy9LOscAHUjUExUKkXhKQslsVW1y2Gk7m0p7JcL8 # oqqpA4OJyI+cvr5kHFDJ/cr8DHvrrtFxEB4xspQgwWzJIJAX1R5ziei4VwZ3YtTs # ZUhux9BgqUwxUL5/NOc0hkyNyYTRMByQAaw0mdiRvL9HfzyFBz9MipjD54COCv8B # d+9CIKGCF7AwghesBgorBgEEAYI3AwMBMYIXnDCCF5gGCSqGSIb3DQEHAqCCF4kw # gheFAgEDMQ8wDQYJYIZIAWUDBAIBBQAwggFaBgsqhkiG9w0BCRABBKCCAUkEggFF # MIIBQQIBAQYKKwYBBAGEWQoDATAxMA0GCWCGSAFlAwQCAQUABCC+J90BWYg7EukR # ORe/1i2vrKPfkxSDLvNVP1jaWmMpTwIGamNIEnrjGBMyMDI2MDcyOTEzMTc1Ny4z # MDhaMASAAgH0oIHZpIHWMIHTMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGlu # Z3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBv # cmF0aW9uMS0wKwYDVQQLEyRNaWNyb3NvZnQgSXJlbGFuZCBPcGVyYXRpb25zIExp # bWl0ZWQxJzAlBgNVBAsTHm5TaGllbGQgVFNTIEVTTjo2QjA1LTA1RTAtRDk0NzEl # MCMGA1UEAxMcTWljcm9zb2Z0IFRpbWUtU3RhbXAgU2VydmljZaCCEf4wggcoMIIF # EKADAgECAhMzAAACEUUYOZtDz/xsAAEAAAIRMA0GCSqGSIb3DQEBCwUAMHwxCzAJ # BgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25k # MR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMTHU1pY3Jv # c29mdCBUaW1lLVN0YW1wIFBDQSAyMDEwMB4XDTI1MDgxNDE4NDgxM1oXDTI2MTEx # MzE4NDgxM1owgdMxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAw # DgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24x # LTArBgNVBAsTJE1pY3Jvc29mdCBJcmVsYW5kIE9wZXJhdGlvbnMgTGltaXRlZDEn # MCUGA1UECxMeblNoaWVsZCBUU1MgRVNOOjZCMDUtMDVFMC1EOTQ3MSUwIwYDVQQD # ExxNaWNyb3NvZnQgVGltZS1TdGFtcCBTZXJ2aWNlMIICIjANBgkqhkiG9w0BAQEF # AAOCAg8AMIICCgKCAgEAz7m7MxAdL5Vayrk7jsMo3GnhN85ktHCZEvEcj4BIccHK # d/NKC7uPvpX5dhO63W6VM5iCxklG8qQeVVrPaKvj8dYYJC7DNt4NN3XlVdC/vove # JuPPhTJ/u7X+pYmV2qehTVPOOB1/hpmt51SzgxZczMdnFl+X2e1PgutSA5CAh9/X # z5NW0CxnYVz8g0Vpxg+Bq32amktRXr8m3BSEgUs8jgWRPVzPHEczpbhloGGEfHaR # OmHhVKIqN+JhMweEjU2NXM2W6hm32j/QH/I/KWqNNfYchHaG0xJljVTYoUKPpcQD # uhH9dQKEgvGxj2U5/3Fq1em4dO6Ih04m6R+ttxr6Y8oRJH9ZhZ3sciFBIvZh7E2Y # FXOjP4MGybSylQTPDEFAtHHgpkskeEUhsPDR9VvWWhekhQx3qXaAKh+AkLmz/hpE # 3e0y+RIKO2AREjULJAKgf+R9QnNvqMeMkz9PGrjsijqWGzB2k2JNyaUYKlbmQweO # absCioiY2fJbimjVyFAGk5AeYddUFxvJGgRVCH7BeBPKAq7MMOmSCTOMZ0Sw6zyN # x4Uhh5Y0uJ0ZOoTKnB3KfdN/ba/eKHFeEhi3WqAfzTxiy0rMvhsfsXZK7zoclqaR # vVl8Q48J174+eyriypY9HhU+ohgiYi4uQGDDVdTDeKDtoC/hD2Cn+ARzwE1rFfEC # AwEAAaOCAUkwggFFMB0GA1UdDgQWBBRifUUDwOnqIcvfb53+yV0EZn7OcDAfBgNV # HSMEGDAWgBSfpxVdAF5iXYP05dJlpxtTNRnpcjBfBgNVHR8EWDBWMFSgUqBQhk5o # dHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2NybC9NaWNyb3NvZnQlMjBU # aW1lLVN0YW1wJTIwUENBJTIwMjAxMCgxKS5jcmwwbAYIKwYBBQUHAQEEYDBeMFwG # CCsGAQUFBzAChlBodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2NlcnRz # L01pY3Jvc29mdCUyMFRpbWUtU3RhbXAlMjBQQ0ElMjAyMDEwKDEpLmNydDAMBgNV # HRMBAf8EAjAAMBYGA1UdJQEB/wQMMAoGCCsGAQUFBwMIMA4GA1UdDwEB/wQEAwIH # gDANBgkqhkiG9w0BAQsFAAOCAgEApEKdnMeIIUiU6PatZ/qbrwiDzYUMKRczC4Bp # /XY1S9NmHI+2c3dcpwH2SOmDfdvIIqt7mRrgvBPYOvJ9CtZS5eeIrsObC0b0ggKT # v2wrTgWG+qktqNFEhQeipdURNLN68uHAm5edwBytd1kwy5r6B93klxDsldOmVWtw # /ngj7knN09muCmwr17JnsMFcoIN/H59s+1RYN7Vid4+7nj8FcvYy9rbZOMndBzsT # iosF1M+aMIJX2k3EVFVsuDL7/R5ppI9Tg7eWQOWKMZHPdsA3ZqWzDuhJqTzoFSQS # hnZenC+xq/z9BhHPFFbUtfjAoG6EDPjSQJYXmogja8OEa19xwnh3wVufeP+ck+/0 # gxNi7g+kO6WaOm052F4siD8xi6Uv75L7798lHvPThcxHHsgXqMY592d1wUof3tL/ # eDaQ0UhnYCU8yGkU2XJnctONnBKAvURAvf2qiIWDj4Lpcm0zA7VuofuJR1Tpuyc5 # p1ja52bNZBBVqAOwyDhAmqWsJXAjYXnssC/fJkee314Fh+GIyMgvAPRScgqRZqV1 # 6dTBYvoe+w1n/wWs/ySTUsxDw4T/AITcu5PAsLnCVpArDrFLRTFyut+eHUoG6UYZ # fj8/RsuQ42INse1pb/cPm7G2lcLJtkIKT80xvB1LiaNvPTBVEcmNSvFUM0xrXZXc # YcxVXiYwggdxMIIFWaADAgECAhMzAAAAFcXna54Cm0mZAAAAAAAVMA0GCSqGSIb3 # DQEBCwUAMIGIMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4G # A1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMTIw # MAYDVQQDEylNaWNyb3NvZnQgUm9vdCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkgMjAx # MDAeFw0yMTA5MzAxODIyMjVaFw0zMDA5MzAxODMyMjVaMHwxCzAJBgNVBAYTAlVT # MRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQK # ExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMTHU1pY3Jvc29mdCBUaW1l # LVN0YW1wIFBDQSAyMDEwMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA # 5OGmTOe0ciELeaLL1yR5vQ7VgtP97pwHB9KpbE51yMo1V/YBf2xK4OK9uT4XYDP/ # XE/HZveVU3Fa4n5KWv64NmeFRiMMtY0Tz3cywBAY6GB9alKDRLemjkZrBxTzxXb1 # hlDcwUTIcVxRMTegCjhuje3XD9gmU3w5YQJ6xKr9cmmvHaus9ja+NSZk2pg7uhp7 # M62AW36MEBydUv626GIl3GoPz130/o5Tz9bshVZN7928jaTjkY+yOSxRnOlwaQ3K # Ni1wjjHINSi947SHJMPgyY9+tVSP3PoFVZhtaDuaRr3tpK56KTesy+uDRedGbsoy # 1cCGMFxPLOJiss254o2I5JasAUq7vnGpF1tnYN74kpEeHT39IM9zfUGaRnXNxF80 # 3RKJ1v2lIH1+/NmeRd+2ci/bfV+AutuqfjbsNkz2K26oElHovwUDo9Fzpk03dJQc # NIIP8BDyt0cY7afomXw/TNuvXsLz1dhzPUNOwTM5TI4CvEJoLhDqhFFG4tG9ahha # YQFzymeiXtcodgLiMxhy16cg8ML6EgrXY28MyTZki1ugpoMhXV8wdJGUlNi5UPkL # iWHzNgY1GIRH29wb0f2y1BzFa/ZcUlFdEtsluq9QBXpsxREdcu+N+VLEhReTwDwV # 2xo3xwgVGD94q0W29R6HXtqPnhZyacaue7e3PmriLq0CAwEAAaOCAd0wggHZMBIG # CSsGAQQBgjcVAQQFAgMBAAEwIwYJKwYBBAGCNxUCBBYEFCqnUv5kxJq+gpE8RjUp # zxD/LwTuMB0GA1UdDgQWBBSfpxVdAF5iXYP05dJlpxtTNRnpcjBcBgNVHSAEVTBT # MFEGDCsGAQQBgjdMg30BATBBMD8GCCsGAQUFBwIBFjNodHRwOi8vd3d3Lm1pY3Jv # c29mdC5jb20vcGtpb3BzL0RvY3MvUmVwb3NpdG9yeS5odG0wEwYDVR0lBAwwCgYI # KwYBBQUHAwgwGQYJKwYBBAGCNxQCBAweCgBTAHUAYgBDAEEwCwYDVR0PBAQDAgGG # MA8GA1UdEwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAU1fZWy4/oolxiaNE9lJBb186a # GMQwVgYDVR0fBE8wTTBLoEmgR4ZFaHR0cDovL2NybC5taWNyb3NvZnQuY29tL3Br # aS9jcmwvcHJvZHVjdHMvTWljUm9vQ2VyQXV0XzIwMTAtMDYtMjMuY3JsMFoGCCsG # AQUFBwEBBE4wTDBKBggrBgEFBQcwAoY+aHR0cDovL3d3dy5taWNyb3NvZnQuY29t # L3BraS9jZXJ0cy9NaWNSb29DZXJBdXRfMjAxMC0wNi0yMy5jcnQwDQYJKoZIhvcN # AQELBQADggIBAJ1VffwqreEsH2cBMSRb4Z5yS/ypb+pcFLY+TkdkeLEGk5c9MTO1 # OdfCcTY/2mRsfNB1OW27DzHkwo/7bNGhlBgi7ulmZzpTTd2YurYeeNg2LpypglYA # A7AFvonoaeC6Ce5732pvvinLbtg/SHUB2RjebYIM9W0jVOR4U3UkV7ndn/OOPcbz # aN9l9qRWqveVtihVJ9AkvUCgvxm2EhIRXT0n4ECWOKz3+SmJw7wXsFSFQrP8DJ6L # GYnn8AtqgcKBGUIZUnWKNsIdw2FzLixre24/LAl4FOmRsqlb30mjdAy87JGA0j3m # Sj5mO0+7hvoyGtmW9I/2kQH2zsZ0/fZMcm8Qq3UwxTSwethQ/gpY3UA8x1RtnWN0 # SCyxTkctwRQEcb9k+SS+c23Kjgm9swFXSVRk2XPXfx5bRAGOWhmRaw2fpCjcZxko # JLo4S5pu+yFUa2pFEUep8beuyOiJXk+d0tBMdrVXVAmxaQFEfnyhYWxz/gq77EFm # PWn9y8FBSX5+k77L+DvktxW/tM4+pTFRhLy/AsGConsXHRWJjXD+57XQKBqJC482 # 2rpM+Zv/Cuk0+CQ1ZyvgDbjmjJnW4SLq8CdCPSWU5nR0W2rRnj7tfqAxM328y+l7 # vzhwRNGQ8cirOoo6CGJ/2XBjU02N7oJtpQUQwXEGahC0HVUzWLOhcGbyoYIDWTCC # AkECAQEwggEBoYHZpIHWMIHTMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGlu # Z3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBv # cmF0aW9uMS0wKwYDVQQLEyRNaWNyb3NvZnQgSXJlbGFuZCBPcGVyYXRpb25zIExp # bWl0ZWQxJzAlBgNVBAsTHm5TaGllbGQgVFNTIEVTTjo2QjA1LTA1RTAtRDk0NzEl # MCMGA1UEAxMcTWljcm9zb2Z0IFRpbWUtU3RhbXAgU2VydmljZaIjCgEBMAcGBSsO # AwIaAxUAKyp8q2VdgAq1VGkzd7PZwV6zNc2ggYMwgYCkfjB8MQswCQYDVQQGEwJV # UzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UE # ChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSYwJAYDVQQDEx1NaWNyb3NvZnQgVGlt # ZS1TdGFtcCBQQ0EgMjAxMDANBgkqhkiG9w0BAQsFAAIFAO4UXaQwIhgPMjAyNjA3 # MjkxMTA4MjBaGA8yMDI2MDczMDExMDgyMFowdzA9BgorBgEEAYRZCgQBMS8wLTAK # AgUA7hRdpAIBADAKAgEAAgIWxgIB/zAHAgEAAgISXDAKAgUA7hWvJAIBADA2Bgor # BgEEAYRZCgQCMSgwJjAMBgorBgEEAYRZCgMCoAowCAIBAAIDB6EgoQowCAIBAAID # AYagMA0GCSqGSIb3DQEBCwUAA4IBAQCb4DAr5izJNkOu5JqRC6Lbfv98u27IO6gD # zUFiHDq5tamNAIN7pr/mJpO0TNS82Zf0L1f4e0vgraTW/YvHwhqy1J9SurPRoiGS # ikDuImtX4BW8jexosFf5i805BU42BnMzXlv6o5Cnn3H8YPZbmX7uhipaP6hP8Kn5 # sOFkXIVv9htYx9oP3jdvRh639FUXUlAEkHuhUwJgmZqt59i9MT+BmC0usnCNwBQ1 # t+Mz9ZCOoA2OHDSNPutAQdfhwaeRuJ/L6d8S/mESg5QHMJq7idoBU6owlugN8+D6 # 2x9wjnlGHC1aNuoCbZ7Jd2mbMIsWVRdY/zMI3CEGzz+xBbDIHdBWMYIEDTCCBAkC # AQEwgZMwfDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNV # BAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEmMCQG # A1UEAxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAgUENBIDIwMTACEzMAAAIRRRg5m0PP # /GwAAQAAAhEwDQYJYIZIAWUDBAIBBQCgggFKMBoGCSqGSIb3DQEJAzENBgsqhkiG # 9w0BCRABBDAvBgkqhkiG9w0BCQQxIgQgSRHGP51kh6Oe01ZRh+2B69FDRwWM3RzN # daJuD+nY61kwgfoGCyqGSIb3DQEJEAIvMYHqMIHnMIHkMIG9BCAsrTOpmu+HTq1a # XFwvlhjF8p2nUCNNCEX/OWLHNDMmtzCBmDCBgKR+MHwxCzAJBgNVBAYTAlVTMRMw # EQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVN # aWNyb3NvZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMTHU1pY3Jvc29mdCBUaW1lLVN0 # YW1wIFBDQSAyMDEwAhMzAAACEUUYOZtDz/xsAAEAAAIRMCIEIBiveV2KDDtIjqzU # sSCq1dw/y7dGtQ7WhNUIQkV7nZzQMA0GCSqGSIb3DQEBCwUABIICAD0l9qOhK46E # dLMSekX7ITZX+dwOdDMiCGdeQLKixBpXdiEhehGDcDrR7AccrcSD9AEH5JDC/XWS # 1VP2eH0Uvwro3t/s7Jt71Cw2Z87dzcHrCgKq4xoyANCRy6ydPAXeDT/pp595HaK5 # KdxEpu2cJhN1iCPVi3WN2jykIOSr21eUZRhtzGkaPP0eKjFnRuDJvjkDntNgJ3Bu # NKvC+XpIw/gJam2rxObQzv2EmmAYPoZD5d965RO7AgKeCsnmKFE+T0xMlTUwZL6Z # /aSdZgBXDaVWUqSpmmBLa21hfCQgaQy8MpRHbZxLWBXFila+YRh7zSb3elpIRJjs # p7fXjsDqkeEaKTwNiKyYYyFDyTInzLbstVO0b9EOnxKNUh0w1AByq0Ra108kHbEk # 4pvft7/x/XgtMtb58HBHyPdmOwbm0k9r7bdal+WY8p5Bp8nZbx2wag/gF06hv0rC # eyi90puGHneK2CUUwYEcAD7/bb2w9LL7pxEHInWHVqjqOvlvsnYAOGTcGhJl/dDD # 7LPiDItYh8uUSmEcZz2q9VCvr0C1FXxYWYXxmp9wpGmi0QtMX72RxpefiBEV9eJ7 # m0NdQ/u8qUX5SBO+SC4o+NBYyhjkgK0KsvX4WeQXZp3EnxlgPf5FRl7RY49JfNZ+ # GPfebLCXN9cbNfsndcFTDwuv3cPw5+sS # SIG # End signature block |