// ValidateNetworkContext validates the context of a network request (router-broker, broker-handler, etc)
359548
func (c *Component) ValidateNetworkContext(ctx context.Context) (component *pb_discovery.Announcement, err error) {
	defer func() {
		if err != nil {
			time.Sleep(time.Second)
		}
	}()

	id, err := ttnctx.IDFromIncomingContext(ctx)
	if err != nil {
		return nil, err
	}

	serviceName, _, _, _ := ttnctx.ServiceInfoFromIncomingContext(ctx)
	if serviceName == "" {
		return nil, errors.NewErrInvalidArgument("Metadata", "service-name missing")
	}

	announcement, err := c.Discover(serviceName, id)
	if err != nil {
		return nil, err
	}

	if announcement.PublicKey == "" {
		return announcement, nil
	}

	token, err := ttnctx.TokenFromIncomingContext(ctx)
	if err != nil {
		return nil, err
	}

	var claims *jwt.StandardClaims
	claims, err = security.ValidateJWT(token, []byte(announcement.PublicKey))
	if err != nil {
		return
	}
	if claims.Issuer != id {
		err = errors.NewErrPermissionDenied(fmt.Sprintf("Token was issued by %s, not by %s", claims.Issuer, id))
		return
	}
	if claims.Subject != "" && claims.Subject != claims.Issuer && claims.Subject != c.Identity.ID {
		err = errors.NewErrPermissionDenied(fmt.Sprintf("Token was issued to connect with %s, not with %s", claims.Subject, c.Identity.ID))
		return
	}

	return announcement, nil
}
384547
func ValidateSecurityContext(sc *api.SecurityContext, fldPath *field.Path) field.ErrorList {
	allErrs := field.ErrorList{}
	//this should only be true for testing since SecurityContext is defaulted by the api
	if sc == nil {
		return allErrs
	}

	if sc.Privileged != nil {
		if *sc.Privileged && !capabilities.Get().AllowPrivileged {
			allErrs = append(allErrs, field.Forbidden(fldPath.Child("privileged"), "disallowed by policy"))
		}
	}

	if sc.RunAsUser != nil {
		if *sc.RunAsUser < 0 {
			allErrs = append(allErrs, field.Invalid(fldPath.Child("runAsUser"), *sc.RunAsUser, isNegativeErrorMsg))
		}
	}
	return allErrs
}
1042786
func (c *CNIConfig) ValidateNetworkList(ctx context.Context, list *NetworkConfigList) ([]string, error) {
	version := list.CNIVersion

	// holding map for seen caps (in case of duplicates)
	caps := map[string]interface{}{}

	errs := []error{}
	for _, net := range list.Plugins {
		if err := c.validatePlugin(ctx, net.Network.Type, version); err != nil {
			errs = append(errs, err)
		}
		for c, enabled := range net.Network.Capabilities {
			if !enabled {
				continue
			}
			caps[c] = struct{}{}
		}
	}

	if len(errs) > 0 {
		return nil, fmt.Errorf("%v", errs)
	}

	// make caps list
	cc := make([]string, 0, len(caps))
	for c := range caps {
		cc = append(cc, c)
	}

	return cc, nil
}
142218
func NewContext(req engine.Request, res engine.Response, e *Echo) Context {
	c := &xContext{
		Validator:   DefaultNopValidate,
		Translator:  DefaultNopTranslate,
		Emitter:     emitter.DefaultCondEmitter,
		Transaction: DefaultNopTransaction,
		context:     context.Background(),
		request:     req,
		response:    res,
		echo:        e,
		pvalues:     make([]string, *e.maxParam),
		store:       make(Store),
		handler:     NotFoundHandler,
		funcs:       make(map[string]interface{}),
		sessioner:   DefaultSession,
	}
	c.cookier = NewCookier(c)
	c.dataEngine = NewData(c)
	return c
}
1017003
func (sdnStrategy) Validate(ctx context.Context, obj runtime.Object) field.ErrorList {
	return validation.ValidateNetNamespace(obj.(*networkapi.NetNamespace))
}
553933
func ValidateNetworkOptions(binary string, ctx *cli.Context) (*NetworkConfigs, error) {
	// 1. validate and set plugin mode
	pluginMode := strings.ToLower(ctx.String("mode"))
	switch pluginMode {
	case core.Docker, core.Kubernetes, core.SwarmMode, core.Test:
		logrus.Infof("Using %s mode: %v", binary, pluginMode)
	case "":
		return nil, fmt.Errorf("%s mode is not set", binary)
	default:
		return nil, fmt.Errorf("unknown %s mode: %v", binary, pluginMode)
	}

	// 2. validate and set network mode
	networkMode := strings.ToLower(ctx.String("netmode"))
	switch networkMode {
	case "vlan", "vxlan":
		logrus.Infof("Using %s network mode: %v", binary, networkMode)
	case "":
		return nil, fmt.Errorf("%s network mode is not set", binary)
	default:
		return nil, fmt.Errorf("unknown %s network mode: %v", binary, networkMode)
	}

	// 3. validate forwarding mode
	forwardMode := strings.ToLower(ctx.String("fwdmode"))
	if forwardMode == "" {
		return nil, fmt.Errorf("unknown %s forwarding mode: %v", binary, forwardMode)
	} else if forwardMode != "bridge" && forwardMode != "routing" {
		return nil, fmt.Errorf("%s forwarding mode is not set", binary)
	} else if networkMode == "vxlan" && forwardMode == "bridge" {
		return nil, fmt.Errorf("invalid %s forwarding mode: %q (network mode: %q)", binary, forwardMode, networkMode)
	}
	// vxlan/vlan+routing, vlan+bridge are valid combinations
	logrus.Infof("Using %s forwarding mode: %v", binary, forwardMode)
	return &NetworkConfigs{
		Mode:        pluginMode,
		NetworkMode: networkMode,
		ForwardMode: forwardMode,
	}, nil
}
728288
func RequestClientContext(ctx reqContext.Context) (context.Client, bool) {
	clientContext, ok := ctx.Value(reqContextClient).(context.Client)
	return clientContext, ok
}
1069828
func WithContext(ctx context.Context) func(*Client) error {
	return func(c *Client) error {
		c.Ctx = ctx
		return nil
	}
}
1041165
func (c *Ctx) WithContext(ctx context.Context) {
	c.request = c.request.WithContext(ctx)
}
1340159
func (c *ValidateConfigCall) Context(ctx context.Context) *ValidateConfigCall {
	c.ctx_ = ctx
	return c
}
1204165
func (s *simpleProvider) ValidatePodSecurityContext(pod *api.Pod, fldPath *field.Path) field.ErrorList {
	allErrs := field.ErrorList{}

	sc := securitycontext.NewPodSecurityContextAccessor(pod.Spec.SecurityContext)

	fsGroups := []int64{}
	if fsGroup := sc.FSGroup(); fsGroup != nil {
		fsGroups = append(fsGroups, *fsGroup)
	}
	allErrs = append(allErrs, s.fsGroupStrategy.Validate(pod, fsGroups)...)
	allErrs = append(allErrs, s.supplementalGroupStrategy.Validate(pod, sc.SupplementalGroups())...)
	allErrs = append(allErrs, s.seccompStrategy.ValidatePod(pod)...)

	allErrs = append(allErrs, s.seLinuxStrategy.Validate(fldPath.Child("seLinuxOptions"), pod, nil, sc.SELinuxOptions())...)

	if !s.scc.AllowHostNetwork && sc.HostNetwork() {
		allErrs = append(allErrs, field.Invalid(fldPath.Child("hostNetwork"), sc.HostNetwork(), "Host network is not allowed to be used"))
	}

	if !s.scc.AllowHostPID && sc.HostPID() {
		allErrs = append(allErrs, field.Invalid(fldPath.Child("hostPID"), sc.HostPID(), "Host PID is not allowed to be used"))
	}

	if !s.scc.AllowHostIPC && sc.HostIPC() {
		allErrs = append(allErrs, field.Invalid(fldPath.Child("hostIPC"), sc.HostIPC(), "Host IPC is not allowed to be used"))
	}

	allErrs = append(allErrs, s.sysctlsStrategy.Validate(pod)...)

	if len(pod.Spec.Volumes) > 0 && !sccutil.SCCAllowsAllVolumes(s.scc) {
		allowedVolumes := sccutil.FSTypeToStringSetInternal(s.scc.Volumes)
		for i, v := range pod.Spec.Volumes {
			fsType, err := sccutil.GetVolumeFSType(v)
			if err != nil {
				allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "volumes").Index(i), string(fsType), err.Error()))
				continue
			}

			if !allowedVolumes.Has(string(fsType)) {
				allErrs = append(allErrs, field.Invalid(
					field.NewPath("spec", "volumes").Index(i), string(fsType),
					fmt.Sprintf("%s volumes are not allowed to be used", string(fsType))))
			}
		}
	}

	if len(pod.Spec.Volumes) > 0 && len(s.scc.AllowedFlexVolumes) > 0 && sccutil.SCCAllowsFSTypeInternal(s.scc, securityapi.FSTypeFlexVolume) {
		for i, v := range pod.Spec.Volumes {
			if v.FlexVolume == nil {
				continue
			}

			found := false
			driver := v.FlexVolume.Driver
			for _, allowedFlexVolume := range s.scc.AllowedFlexVolumes {
				if driver == allowedFlexVolume.Driver {
					found = true
					break
				}
			}
			if !found {
				allErrs = append(allErrs,
					field.Invalid(fldPath.Child("volumes").Index(i).Child("driver"), driver,
						"Flexvolume driver is not allowed to be used"))
			}
		}
	}

	return allErrs
}
800396
func (h *BasicRecovery) ServeHTTPContext(ctx context.Context, w http.ResponseWriter, r *http.Request) (err error) {
	defer func() {
		if e := errors.Recover(ctx, recover()); e != nil {
			err = e
		}
	}()

	err = h.handler.ServeHTTPContext(ctx, w, r)

	return
}
249613
func (call *MulticastCall) WithContext(ctx context.Context) *MulticastCall {
	call.ctx = ctx
	return call
}
28375
func AddContext(err error, context string) error {
	if err == nil {
		return nil
	}
	return Extend(err, New(context))
}
491748
func ValidateNetNamespace(netnamespace *networkapi.NetNamespace) field.ErrorList {
	allErrs := validation.ValidateObjectMeta(&netnamespace.ObjectMeta, false, path.ValidatePathSegmentName, field.NewPath("metadata"))

	if netnamespace.NetName != netnamespace.Name {
		allErrs = append(allErrs, field.Invalid(field.NewPath("netname"), netnamespace.NetName, fmt.Sprintf("must be the same as metadata.name: %q", netnamespace.Name)))
	}

	if err := ValidVNID(netnamespace.NetID); err != nil {
		allErrs = append(allErrs, field.Invalid(field.NewPath("netid"), netnamespace.NetID, err.Error()))
	}

	for i, ip := range netnamespace.EgressIPs {
		if _, err := validateIPv4(ip); err != nil {
			allErrs = append(allErrs, field.Invalid(field.NewPath("egressIPs").Index(i), ip, err.Error()))
		}
	}

	return allErrs
}
365619
func ValidateRequestContext(ctx context.Context) error {
	if _, hasDeadline := ctx.Deadline(); !hasDeadline {
		return yarpcerrors.Newf(yarpcerrors.CodeInvalidArgument, "missing TTL")
	}
	return nil
}
320447
func DialContext(ctx context.Context, network string, address string) (*Conn, error) {
	return DefaultDialer.DialContext(ctx, network, address)
}