// Check verifies if the the required/allowed extended keyusages
// are set in relation to the certificate type.
//
// https://tools.ietf.org/html/rfc5280#section-4.2.1.12
//
507622
func Check(d *certdata.Data) *errors.Errors {
	var e = errors.New(nil)

	if len(d.Cert.ExtKeyUsage) == 0 && len(d.Cert.UnknownExtKeyUsage) == 0 {
		e.Err("Certificate contains no extended key usage")
		return e
	}

	for _, ku := range d.Cert.ExtKeyUsage {
		switch d.Type {
		case "DV", "OV", "EV":
			if ku != x509.ExtKeyUsageServerAuth && ku != x509.ExtKeyUsageClientAuth && ku != x509.ExtKeyUsageMicrosoftServerGatedCrypto {
				e.Err("Certificate contains an extended key usage different from ServerAuth, ClientAuth or ServerGatedCrypto")
				return e
			}
		case "PS":
			if ku != x509.ExtKeyUsageClientAuth && ku != x509.ExtKeyUsageEmailProtection {
				e.Err("Certificate contains an extended key usage different from ClientAuth or EmailProtection")
				return e
			}
		case "CS":
			if ku != x509.ExtKeyUsageCodeSigning {
				e.Err("Certificate contains an extended key usage different from ClientAuth or EmailProtection")
				return e
			}
		}
	}

	if len(d.Cert.UnknownExtKeyUsage) > 0 {
		// encryptedFileSystem 1.3.6.1.4.1.311.10.3.4
		//return fmt.Errorf("%s Certificate contains an unknown extented key usage", d.Type)
	}

	return e
}
882679
func (ex extensions) Check(ext pkix.Extension, d *certdata.Data) *errors.Errors {
	var e = errors.New(nil)
	var found bool

	for _, ec := range ex {
		if ec.oid.Equal(ext.Id) {
			found = true
			if ec.filter != nil && ec.filter.Check(d) {
				continue
			}
			e.Append(ec.f(ext, d))
		}
	}

	if !found {
		// Don't report private enterprise extensions as unknown, registered private
		// extensions have still been checked above.
		if !strings.HasPrefix(ext.Id.String(), "1.3.6.1.4.1.") {
			e.Warning("Certificate contains unknown extension (%s)", ext.Id.String())
		}
	}

	return e
}
565237
func Check(ex pkix.Extension, d *certdata.Data) *errors.Errors {
	var e = errors.New(nil)

	// If the cert type isn't one of the `allowedCertTypes`, return an error
	if _, allowed := allowedCertTypes[d.Type]; !allowed {
		e.Err(certTypeErr)
	}

	// Per RFC 7633 "The TLS feature extension SHOULD NOT be marked critical"
	if ex.Critical {
		e.Err(critExtErr)
	}

	// Check that the extension value is the expected slice of DER encoded ASN.1
	if bytes.Compare(ex.Value, expectedExtensionValue) != 0 {
		e.Err(extValueErr)
	}

	return e
}
465881
func (c *Certificate) Verify(data []byte, sig *Signature) error {
	return c.Key.Verify(data, sig)
}
21575
func (c *Verification) Check(m *VerifyCheckRequest) (*VerifyCheckResponse, error) {
	if len(m.RequestID) == 0 {
		return nil, errors.New("Invalid RequestID field specified")
	}

	if len(m.Code) == 0 {
		return nil, errors.New("Invalid Code field specified")
	}

	var verifyCheckResponse *VerifyCheckResponse

	if !c.client.useOauth {
		m.apiKey = c.client.apiKey
		m.apiSecret = c.client.apiSecret
	}

	var r *http.Request
	buf, err := json.Marshal(m)
	if err != nil {
		return nil, errors.New("invalid message struct - unable to convert to JSON")
	}
	b := bytes.NewBuffer(buf)
	r, err = http.NewRequest("POST", apiRootv2+"/verify/check/json", b)
	if err != nil {
		return nil, err
	}

	r.Header.Add("Accept", "application/json")
	r.Header.Add("Content-Type", "application/json")

	resp, err := c.client.HTTPClient.Do(r)
	if err != nil {
		return nil, err
	}

	defer resp.Body.Close()

	body, err := ioutil.ReadAll(resp.Body)
	if err != nil {
		return nil, err
	}

	err = json.Unmarshal(body, &verifyCheckResponse)
	if err != nil {
		return nil, err
	}
	return verifyCheckResponse, nil
}
164875
func (cte *ControllerTypeEvents) check(theType reflect.Type, fieldPath []int) {
	typeChecker := func(checkType reflect.Type) {
		for index := 0; index < checkType.NumMethod(); index++ {
			m := checkType.Method(index)
			// Must be two arguments, the second returns the controller type
			// Go cannot differentiate between promoted methods and
			// embedded methods, this allows the embedded method to be run
			// https://github.com/golang/go/issues/21162
			if m.Type.NumOut() == 2 && m.Type.Out(1) == checkType {
				if checkType.Kind() == reflect.Ptr {
					controllerLog.Debug("Found controller type event method pointer", "name", checkType.Elem().Name(), "methodname", m.Name)
				} else {
					controllerLog.Debug("Found controller type event method", "name", checkType.Name(), "methodname", m.Name)
				}
				controllerFieldPath := newFieldPath(checkType.Kind() == reflect.Ptr, m.Func, fieldPath)
				switch strings.ToLower(m.Name) {
				case "before":
					cte.Before = append([]*ControllerFieldPath{controllerFieldPath}, cte.Before...)
				case "after":
					cte.After = append(cte.After, controllerFieldPath)
				case "panic":
					cte.Panic = append(cte.Panic, controllerFieldPath)
				case "finally":
					cte.Finally = append(cte.Finally, controllerFieldPath)
				}
			}
		}
	}

	// Check methods of both types
	typeChecker(theType)
	typeChecker(reflect.PtrTo(theType))

	// Check for any sub controllers, ignore any pointers to controllers revel.Controller
	for i := 0; i < theType.NumField(); i++ {
		v := theType.Field(i)

		switch v.Type.Kind() {
		case reflect.Struct:
			cte.check(v.Type, append(fieldPath, i))
		}
	}
}
1371756
func AssertCertificateHasServerAuthUsage(t *testing.T, cert *x509.Certificate) {
	for i := range cert.ExtKeyUsage {
		if cert.ExtKeyUsage[i] == x509.ExtKeyUsageServerAuth {
			return
		}
	}
	t.Error("cert is not a ServerAuth")
}
1064897
func (e AuthService) Check() (bool, error) {
	url := "/authentication"

	resp, err := e.client.MakeRequest(
		"GET",
		url,
		0,
		nil,
	)
	if err != nil {
		return false, err
	}
	defer resp.Body.Close()

	switch resp.StatusCode {
	case http.StatusOK:
		return true, nil
	case http.StatusUnauthorized:
		fallthrough
	case http.StatusForbidden:
		return false, nil
	default:
		return false, e.client.handleUnexpectedResponse(resp)
	}
}
361467
func (i *OIDCAuthRequest) Check() error {
	if i.ConnectorID == "" {
		return trace.BadParameter("ConnectorID: missing value")
	}
	if i.StateToken == "" {
		return trace.BadParameter("StateToken: missing value")
	}
	if len(i.PublicKey) != 0 {
		_, _, _, _, err := ssh.ParseAuthorizedKey(i.PublicKey)
		if err != nil {
			return trace.BadParameter("PublicKey: bad key: %v", err)
		}
		if (i.CertTTL > defaults.MaxCertDuration) || (i.CertTTL < defaults.MinCertDuration) {
			return trace.BadParameter("CertTTL: wrong certificate TTL")
		}
	}

	return nil
}
1174292
func (ts *Store) Check(id string) (string, error) {
	treeStoreKeyLock, err := lock.SharedKeyLock(ts.lockDir, id)
	if err != nil {
		return "", errwrap.Wrap(errors.New("error locking tree store"), err)
	}
	defer treeStoreKeyLock.Close()

	return ts.check(id)
}
654980
func (val *Validation) Check() error {
	if val == nil || len(val.Errors) <= 0 {
		return nil
	}

	return val.constructErrorMessage()
}
1098425
func (sp *StandardProvider) Check() error {
	if sp.Paths.KeyFile == "" && sp.Paths.CertFile == "" {
		return nil
	}

	if sp.Paths.KeyFile == "" {
		return ErrMissingKeyPath
	}

	if sp.Paths.CertFile == "" {
		return ErrMissingCertPath
	}

	return nil
}
483981
func (r *CheckCertificateRPC) CheckCertificate(c context.Context, req *admin.CheckCertificateRequest) (*admin.CheckCertificateResponse, error) {
	// Deserialize the cert.
	der, err := utils.ParsePEM(req.CertPem, "CERTIFICATE")
	if err != nil {
		return nil, status.Errorf(codes.InvalidArgument, "can't parse 'cert_pem' - %s", err)
	}
	cert, err := x509.ParseCertificate(der)
	if err != nil {
		return nil, status.Errorf(codes.InvalidArgument, "can't parse 'cert-pem' - %s", err)
	}

	// Find a checker for the CA that signed the cert, check the certificate.
	checker, err := GetCertChecker(c, cert.Issuer.CommonName)
	if err == nil {
		_, err = checker.CheckCertificate(c, cert)
		if err == nil {
			return &admin.CheckCertificateResponse{
				IsValid: true,
			}, nil
		}
	}

	// Recognize error codes related to CA cert checking. Everything else is
	// transient errors.
	if details, ok := err.(Error); ok {
		return &admin.CheckCertificateResponse{
			IsValid:       false,
			InvalidReason: details.Error(),
		}, nil
	}
	return nil, status.Errorf(codes.Internal, "failed to check the certificate - %s", err)
}
870539
func (c *Client) Check() error {
	if c.State() != imap.SelectedState {
		return ErrNoMailboxSelected
	}

	cmd := new(commands.Check)

	status, err := c.execute(cmd, nil)
	if err != nil {
		return err
	}

	return status.Err()
}
336610
func (sc ServiceCheck) Check() error {
	if len(sc.Name) == 0 {
		return fmt.Errorf("statsd.ServiceCheck name is required")
	}
	if byte(sc.Status) < 0 || byte(sc.Status) > 3 {
		return fmt.Errorf("statsd.ServiceCheck status has invalid value")
	}
	return nil
}
935856
func (k *Key) CheckCert() error {
	key, _, _, _, err := ssh.ParseAuthorizedKey(k.Cert)
	if err != nil {
		return trace.Wrap(err)
	}

	cert, ok := key.(*ssh.Certificate)
	if !ok {
		return trace.BadParameter("found key, not certificate")
	}
	if len(cert.ValidPrincipals) == 0 {
		return trace.BadParameter("principals are required")
	}

	// A valid principal is always passed in because the principals are not being
	// checked here, but rather the validity period, signature, and algorithms.
	certChecker := utils.CertChecker{}
	err = certChecker.CheckCert(cert.ValidPrincipals[0], cert)
	if err != nil {
		return trace.Wrap(err)
	}

	return nil
}
1216920
func (u *updater) Check() error {
	u.mu.Lock()
	defer u.mu.Unlock()

	return u.status
}