// Check ensures that the ciphers, kex algorithms, and mac algorithms set
// are supported by golang.org/x/crypto/ssh. This ensures we don't start
// Teleport with invalid configuration.
349225
func (conf *FileConfig) Check() error {
	var sc ssh.Config
	sc.SetDefaults()

	for _, c := range conf.Ciphers {
		if utils.SliceContainsStr(sc.Ciphers, c) == false {
			return trace.BadParameter("cipher %q not supported", c)
		}
	}
	for _, k := range conf.KEXAlgorithms {
		if utils.SliceContainsStr(sc.KeyExchanges, k) == false {
			return trace.BadParameter("KEX %q not supported", k)
		}
	}
	for _, m := range conf.MACAlgorithms {
		if utils.SliceContainsStr(sc.MACs, m) == false {
			return trace.BadParameter("MAC %q not supported", m)
		}
	}

	return nil
}
704749
func (s *SecureConfig) Check(filePath string) (bool, error) {
	if len(s.Checksum) == 0 {
		return false, ErrSecureConfigNoChecksum
	}

	if s.Hash == nil {
		return false, ErrSecureConfigNoHash
	}

	file, err := os.Open(filePath)
	if err != nil {
		return false, err
	}
	defer file.Close()

	_, err = io.Copy(s.Hash, file)
	if err != nil {
		return false, err
	}

	sum := s.Hash.Sum(nil)

	return subtle.ConstantTimeCompare(sum, s.Checksum) == 1, nil
}
1086281
func (l *State) Checks() map[types.CheckID]*structs.HealthCheck {
	m := make(map[types.CheckID]*structs.HealthCheck)
	for id, c := range l.CheckStates() {
		m[id] = c.Check
	}
	return m
}
333927
func (p *proofSetT) check(ctx context.Context, world LoaderContext, parallel bool) (err error) {
	defer p.G().CTrace(ctx, "TeamLoader proofSet check", func() error { return err })()

	if parallel {
		return p.checkParallel(ctx, world)
	}

	var total int
	for _, v := range p.proofs {
		total += len(v)
	}

	var i int
	for _, v := range p.proofs {
		for _, proof := range v {
			p.G().Log.CDebugf(ctx, "TeamLoader proofSet check [%v / %v]", i, total)
			err = proof.check(ctx, p.G(), world, p)
			if err != nil {
				return err
			}
			i++
		}
	}
	return nil
}
931340
func (s ScryptAuth) Check(pw_cost uint, hash_ref, user_password, salt []byte) (chk bool, err error) {
	result_hash, err := s.Hash(pw_cost, user_password, salt)
	if err != nil {
		return false, err
	}
	if subtle.ConstantTimeCompare(result_hash, hash_ref) != 1 {
		return false, errors.New("Error: Hash verification failed")
	}
	return true, nil
}
211970
func (s *GrblStreamer) Check(m *vm.Machine) (err error) {
	defer func() {
		if r := recover(); r != nil {
			err = errors.New(fmt.Sprintf("%s", r))
		}
	}()
	gen := export.GrblGenerator{}
	gen.Init()
	gen.Write = func(string) {}
	export.HandleAllPositions(m, &gen)
	return nil
}
731098
func Check(d *certdata.Data) *errors.Errors {
	var e = errors.New(nil)

	if checkInternalName(d.Cert.Subject.CommonName) {
		e.Err("Certificate contains an internal server name in the common name '%s'", d.Cert.Subject.CommonName)
	}
	for _, n := range d.Cert.DNSNames {
		if checkInternalName(n) {
			e.Err("Certificate subjectAltName '%s' contains an internal server name", n)
		}
	}

	// Check for internal IP addresses
	for _, ip := range d.Cert.IPAddresses {
		if !ip.IsGlobalUnicast() {
			e.Err("Certificate subjectAltName '%v' contains a non global unicast IP address", ip)
		}
		if checkInternalIP(ip) {
			e.Err("Certificate subjectAltName '%v' contains a private or local IP address", ip)
		}
	}

	return e
}
295665
func Check(d *certdata.Data) *errors.Errors {
	var e = errors.New(nil)

	// TODO: Should we check against cross usage of certificate types (for example DV certificate with email address)?

	switch d.Type {
	case "PS":
		// TODO: Check EmailAddresses in the Subject DN
		if len(d.Cert.EmailAddresses) == 0 {
			e.Err("Certificate doesn't contain any subjectAltName")
			return e
		}
		for _, s := range d.Cert.EmailAddresses {
			// Splitting domain of mail address, using lowercase
			em := strings.SplitAfter(strings.ToLower(s), "@")
			if len(em) != 2 {
				e.Err("Certificate subjectAltName '%s' contains an invalid email address", s)
				continue
			}

			// Check email address domain part
			if _, err := idnaProfile.ToASCII(em[1]); err != nil {
				e.Err("Certificate subjectAltName '%s', %s", s, err.Error())
			}

			// TODO: Implement more checks for the left side of the @ sign
			if strings.Contains(em[0], " ") {
				e.Err("Certificate subjectAltName '%s' contains a whitespace", s)
			}
		}

	case "DV", "OV", "EV":
		if len(d.Cert.DNSNames) == 0 && len(d.Cert.IPAddresses) == 0 {
			e.Err("Certificate doesn't contain any subjectAltName")
			return e
		}

		// While the commonname is not a subjectAltName we use the same rule to
		// validate the domain name. Check with stripped wildcards as they are non
		// registrable.
		if _, err := idnaProfile.ToASCII(strings.TrimPrefix(strings.ToLower(d.Cert.Subject.CommonName), "*.")); err != nil && err != idnaUnderscoreError {
			e.Err("Certificate CommonName '%s', %s", d.Cert.Subject.CommonName, err.Error())
		}

		var cnInSan bool
		for _, s := range d.Cert.DNSNames {
			if strings.EqualFold(d.Cert.Subject.CommonName, s) {
				cnInSan = true
			}

			// Check subjectAltName with stripped wildcards as they are non registrable
			if _, err := idnaProfile.ToASCII(strings.TrimPrefix(strings.ToLower(s), "*.")); err != nil && err != idnaUnderscoreError {
				e.Err("Certificate subjectAltName '%s', %s", s, err.Error())
			}
		}

		// Maybe it's an IP address
		if !cnInSan {
			for _, s := range d.Cert.IPAddresses {
				if strings.EqualFold(d.Cert.Subject.CommonName, s.String()) {
					cnInSan = true
				}
			}
		}

		if !cnInSan {
			e.Err("Certificate CN is not listed in subjectAltName")
		}
	}

	return e
}
448988
func Check(d *certdata.Data) *errors.Errors {
	var e = errors.New(nil)

	switch d.Type {
	case "DV", "OV", "EV":
		if d.Cert.IsCA {
			e.Err("Certificate has set CA true")
		}
		if d.Cert.MaxPathLen == 0 && d.Cert.MaxPathLenZero {
			//e.Err("Certificate has set CA true")
		}
		if d.Cert.BasicConstraintsValid {
			//e.Err("Certificate has set CA true")
		}
	}

	return e
}
565237
func Check(ex pkix.Extension, d *certdata.Data) *errors.Errors {
	var e = errors.New(nil)

	// If the cert type isn't one of the `allowedCertTypes`, return an error
	if _, allowed := allowedCertTypes[d.Type]; !allowed {
		e.Err(certTypeErr)
	}

	// Per RFC 7633 "The TLS feature extension SHOULD NOT be marked critical"
	if ex.Critical {
		e.Err(critExtErr)
	}

	// Check that the extension value is the expected slice of DER encoded ASN.1
	if bytes.Compare(ex.Value, expectedExtensionValue) != 0 {
		e.Err(extValueErr)
	}

	return e
}
1275524
func (c *constraint) check(v *Version) bool {
	return c.function(v, c)
}
374410
func checkMAC(message, messageMAC, key []byte, hashFunc func() hash.Hash) bool {
	expectedMAC := genMAC(message, key, hashFunc)
	return hmac.Equal(messageMAC, expectedMAC)
}
688877
func (c *CredentialsStore) Check(username, password string) bool {
	pw, ok := c.store[username]
	if !ok {
		return false
	}
	return password == pw ||
		bcrypt.CompareHashAndPassword([]byte(pw), []byte(password)) == nil
}
332930
func (f *ConstraintFilter) Check(n *NodeInfo) bool {
	return constraint.NodeMatches(f.constraints, n.Node)
}
1307140
func (t *Time) Check(sc *stmtctx.StatementContext) error {
	return t.check(sc)
}
997865
func Check(c context.Context, tok string) error {
	_, err := xsrfToken.Validate(c, tok, state(c))
	return err
}
18376
func Check(d *certdata.Data) *errors.Errors {
	var e = errors.New(nil)

	if d.Cert.SerialNumber.Cmp(big.NewInt(0)) == -1 {
		e.Err("Certificate serial number MUST be a positive integer (%d)", d.Cert.SerialNumber)
	}

	// Remaining checks are not relevant for CA certificates
	if d.Cert.IsCA {
		return e
	}

	// https://cabforum.org/2016/07/08/ballot-164/
	if d.Cert.NotBefore.After(time.Date(2016, 9, 30, 0, 0, 0, 0, time.UTC)) {
		if d.Cert.SerialNumber.BitLen() < 64 {
			e.Err("Certificate serial number should be 64 bits but contains %d bits", d.Cert.SerialNumber.BitLen())
		}
	} else {
		// all new end-entity certificates must contain at least 20 bits of unpredictable random data (preferably in the serial number).
		if d.Cert.SerialNumber.BitLen() < 20 {
			e.Warning("Certificate serial number must contain at least 20 bits of unpredictable random data, found only %d bits", d.Cert.SerialNumber.BitLen())
		}
	}

	return nil
}