// Validates that there is at least 1 reachable, valid external CA for the given CA certificate.  Returns true if there is, false otherwise.
// Requires that the wanted cert is already normalized.
172115
func validateHasAtLeastOneExternalCA(ctx context.Context, externalCAs map[string][]*api.ExternalCA, securityConfig *ca.SecurityConfig,
	wantedCert []byte, desc string) ([]*api.ExternalCA, error) {
	specific, ok := externalCAs[string(wantedCert)]
	if ok {
		pool := x509.NewCertPool()
		pool.AppendCertsFromPEM(wantedCert)
		dialer := net.Dialer{Timeout: 5 * time.Second}
		opts := tls.Config{
			RootCAs:      pool,
			Certificates: securityConfig.ClientTLSCreds.Config().Certificates,
		}
		for i, ca := range specific {
			if ca.Protocol == api.ExternalCA_CAProtocolCFSSL {
				if err := validateExternalCAURL(&dialer, &opts, ca.URL); err != nil {
					log.G(ctx).WithError(err).Warnf("external CA # %d is unreachable or invalid", i+1)
				} else {
					return specific, nil
				}
			}
		}
	}
	return nil, status.Errorf(codes.InvalidArgument, "there must be at least one valid, reachable external CA corresponding to the %s CA certificate", desc)
}
650936
func ValidateCertificateDates(cert *x509.Certificate) error {
	if cert == nil {
		return nil
	}
	if time.Now().UTC().Before(cert.NotBefore) {
		return errors.New("Certificate provided is not valid until later date")
	}

	if time.Now().UTC().After(cert.NotAfter) {
		return errors.New("Certificate provided has expired")
	}
	return nil
}
832615
func (eid ExternalID) Validate(_ strfmt.Registry) error {
	if idRegex.Match([]byte(eid)) {
		return nil
	}

	return errInvalidID
}
607732
func validateCSR(obj *certificates.CertificateSigningRequest) error {
	csr, err := certificates.ParseCSR(obj)
	if err != nil {
		return err
	}
	// check that the signature is valid
	err = csr.CheckSignature()
	if err != nil {
		return err
	}
	return nil
}
877010
func (c *Certificate) Validate() error {
	if len(c.CertPEM) == 0 {
		return errors.NotValidf("missing cert PEM")
	}
	if len(c.KeyPEM) == 0 {
		return errors.NotValidf("missing key PEM")
	}
	return nil
}
859563
func (fw *Framework) ValidateSecurity() (errors []string, ok bool) {
	return fw.security.Validate()
}
994946
func (r *externalIPRanger) Validate(a admission.Attributes) error {
	if a.GetResource().GroupResource() != kapi.Resource("services") {
		return nil
	}

	svc, ok := a.GetObject().(*kapi.Service)
	// if we can't convert then we don't handle this object so just return
	if !ok {
		return nil
	}

	// Determine if an ingress ip address should be allowed as an
	// external ip by checking the loadbalancer status of the previous
	// object state. Only updates need to be validated against the
	// ingress ip since the loadbalancer status cannot be set on
	// create.
	ingressIP := ""
	retrieveIngressIP := a.GetOperation() == admission.Update &&
		r.allowIngressIP && svc.Spec.Type == kapi.ServiceTypeLoadBalancer
	if retrieveIngressIP {
		old, ok := a.GetOldObject().(*kapi.Service)
		ipPresent := ok && old != nil && len(old.Status.LoadBalancer.Ingress) > 0
		if ipPresent {
			ingressIP = old.Status.LoadBalancer.Ingress[0].IP
		}
	}

	var errs field.ErrorList
	switch {
	// administrator disabled externalIPs
	case len(svc.Spec.ExternalIPs) > 0 && len(r.admit) == 0:
		onlyIngressIP := len(svc.Spec.ExternalIPs) == 1 && svc.Spec.ExternalIPs[0] == ingressIP
		if !onlyIngressIP {
			errs = append(errs, field.Forbidden(field.NewPath("spec", "externalIPs"), "externalIPs have been disabled"))
		}
	// administrator has limited the range
	case len(svc.Spec.ExternalIPs) > 0 && len(r.admit) > 0:
		for i, s := range svc.Spec.ExternalIPs {
			ip := net.ParseIP(s)
			if ip == nil {
				errs = append(errs, field.Forbidden(field.NewPath("spec", "externalIPs").Index(i), "externalIPs must be a valid address"))
				continue
			}
			notIngressIP := s != ingressIP
			if (NetworkSlice(r.reject).Contains(ip) || !NetworkSlice(r.admit).Contains(ip)) && notIngressIP {
				errs = append(errs, field.Forbidden(field.NewPath("spec", "externalIPs").Index(i), "externalIP is not allowed"))
				continue
			}
		}
	}
	if len(errs) > 0 {
		return apierrs.NewInvalid(a.GetKind().GroupKind(), a.GetName(), errs)
	}
	return nil
}
1018571
func checkExpiringCerts(chain []*x509.Certificate) (expiringIntermediates []int) {
	now := time.Now()
	for i, cert := range chain {
		if cert.NotAfter.Sub(now).Hours() < 720 {
			expiringIntermediates = append(expiringIntermediates, i)
		}
	}
	return
}
1056449
func VerifyCertificate(cert *x509.Certificate) (revoked, ok bool) {
	revoked, ok, _ = VerifyCertificateError(cert)
	return revoked, ok
}
235640
func (m *CertificateValidationContext) Validate() error {
	if m == nil {
		return nil
	}

	{
		tmp := m.GetTrustedCa()

		if v, ok := interface{}(tmp).(interface{ Validate() error }); ok {

			if err := v.Validate(); err != nil {
				return CertificateValidationContextValidationError{
					field:  "TrustedCa",
					reason: "embedded message failed validation",
					cause:  err,
				}
			}
		}
	}

	for idx, item := range m.GetVerifyCertificateSpki() {
		_, _ = idx, item

		if len(item) != 44 {
			return CertificateValidationContextValidationError{
				field:  fmt.Sprintf("VerifyCertificateSpki[%v]", idx),
				reason: "value length must be 44 bytes",
			}
		}

	}

	for idx, item := range m.GetVerifyCertificateHash() {
		_, _ = idx, item

		if l := len(item); l < 64 || l > 95 {
			return CertificateValidationContextValidationError{
				field:  fmt.Sprintf("VerifyCertificateHash[%v]", idx),
				reason: "value length must be between 64 and 95 bytes, inclusive",
			}
		}

	}

	{
		tmp := m.GetRequireOcspStaple()

		if v, ok := interface{}(tmp).(interface{ Validate() error }); ok {

			if err := v.Validate(); err != nil {
				return CertificateValidationContextValidationError{
					field:  "RequireOcspStaple",
					reason: "embedded message failed validation",
					cause:  err,
				}
			}
		}
	}

	{
		tmp := m.GetRequireSignedCertificateTimestamp()

		if v, ok := interface{}(tmp).(interface{ Validate() error }); ok {

			if err := v.Validate(); err != nil {
				return CertificateValidationContextValidationError{
					field:  "RequireSignedCertificateTimestamp",
					reason: "embedded message failed validation",
					cause:  err,
				}
			}
		}
	}

	{
		tmp := m.GetCrl()

		if v, ok := interface{}(tmp).(interface{ Validate() error }); ok {

			if err := v.Validate(); err != nil {
				return CertificateValidationContextValidationError{
					field:  "Crl",
					reason: "embedded message failed validation",
					cause:  err,
				}
			}
		}
	}

	// no validation rules for AllowExpiredCertificate

	return nil
}
89861
func (key CredentialKey) Validate(_ interface{}) error {
	if credentialKeyRegex.Match([]byte(key)) {
		return nil
	}

	return errInvalidCredentialKey
}
1297786
func (m *Connection) Validate() error {
	if m == nil {
		return nil
	}

	{
		tmp := m.GetLocalAddress()

		if v, ok := interface{}(tmp).(interface{ Validate() error }); ok {

			if err := v.Validate(); err != nil {
				return ConnectionValidationError{
					field:  "LocalAddress",
					reason: "embedded message failed validation",
					cause:  err,
				}
			}
		}
	}

	{
		tmp := m.GetRemoteAddress()

		if v, ok := interface{}(tmp).(interface{ Validate() error }); ok {

			if err := v.Validate(); err != nil {
				return ConnectionValidationError{
					field:  "RemoteAddress",
					reason: "embedded message failed validation",
					cause:  err,
				}
			}
		}
	}

	return nil
}
1021435
func (a ARP) IsValid() bool {
	if len(a) < ARPSize {
		return false
	}
	const htypeEthernet = 1
	const macSize = 6
	return a.hardwareAddressSpace() == htypeEthernet &&
		a.protocolAddressSpace() == uint16(IPv4ProtocolNumber) &&
		a.hardwareAddressSize() == macSize &&
		a.protocolAddressSize() == IPv4AddressSize
}
417872
func (c *CertChecker) CheckCert(principal string, cert *ssh.Certificate) error {
	err := validate(cert)
	if err != nil {
		return trace.Wrap(err)
	}

	return c.CertChecker.CheckCert(principal, cert)
}
520307
func Check(d *certdata.Data) *errors.Errors {
	var e = errors.New(nil)

	// OCSP signing certificates should not any Authority Info Access Issuers
	if d.Type == "OCSP" {
		if len(d.Cert.IssuingCertificateURL) > 0 {
			e.Warning("OCSP signing certificate contains any Authority Info Access Issuers")
		}

		// no extra checks needed
		return e
	}

	// Self signed CA certificates should not contain any AIA Issuers
	if d.Type == "CA" && d.Cert.CheckSignatureFrom(d.Cert) == nil {
		if len(d.Cert.IssuingCertificateURL) != 0 {
			e.Warning("Self signed CA certificates should not contain any Authority Info Access Issuers")
		}
		return e
	}

	// Other certificates should contain at least one Authority Info Access Issuer
	if len(d.Cert.IssuingCertificateURL) == 0 {
		e.Err("Certificate contains no Authority Info Access Issuers")
		return e
	}

	for _, icu := range d.Cert.IssuingCertificateURL {
		l, err := url.Parse(icu)
		if err != nil {
			e.Err("Certificate contains an invalid Authority Info Access Issuer URL (%s)", icu)
		}
		if l.Scheme != "http" {
			e.Warning("Certificate contains a Authority Info Access Issuer with an non-preferred scheme (%s)", l.Scheme)
		}
	}

	return e
}
1197163
func IsValidRemote(remote string) bool {
	return urlutil.IsGitURL(remote) || urlutil.IsURL(remote)
}
903220
func Validate(passcode string, counter uint64, secret string) bool {
	rv, _ := ValidateCustom(
		passcode,
		counter,
		secret,
		ValidateOpts{
			Digits:    otp.DigitsSix,
			Algorithm: otp.AlgorithmSHA1,
		},
	)
	return rv
}