// IsTechnicallyConstrained determines if a given certificate is technically constrained.
// Slightly modified from https://github.com/jcjones/gx509/blob/master/gx509/technicalconstraints.go
513581
func IsTechnicallyConstrained(cert *x509.Certificate) bool {
	// There must be Extended Key Usage flags
	if len(cert.ExtKeyUsage) == 0 {
		return false
	}

	// For certificates with a notBefore before 23 August 2016, the
	// id-Netscape-stepUp OID (aka Netscape Server Gated Crypto ("nsSGC")) is
	// treated as equivalent to id-kp-serverAuth.
	nsSGCCutoff := time.Date(2016, time.August, 23, 0, 0, 0, 0, time.UTC)

	stepUpEquivalentToServerAuth := cert.NotBefore.Before(nsSGCCutoff)
	var hasServerAuth bool
	var hasStepUp bool

	for _, usage := range cert.ExtKeyUsage {
		switch usage {
		case x509.ExtKeyUsageAny:
			// Do not permit ExtKeyUsageAny
			return false
		case x509.ExtKeyUsageServerAuth:
			hasServerAuth = true
		case x509.ExtKeyUsageNetscapeServerGatedCrypto:
			hasStepUp = true
		}
	}

	// Must be marked for Server Auth, or have StepUp and be from before the cutoff
	if !(hasServerAuth || (stepUpEquivalentToServerAuth && hasStepUp)) {
		return true
	}

	// For iPAddresses in excludedSubtrees, both IPv4 and IPv6 must be present
	// and the constraints must cover the entire range (0.0.0.0/0 for IPv4 and
	// ::0/0 for IPv6).
	var excludesIPv4 bool
	var excludesIPv6 bool
	constraints, _ := Get(cert)
	for _, cidr := range constraints.ExcludedIPRanges {
		if cidr.IP.Equal(net.IPv4zero) && isAllZeros(cidr.Mask, net.IPv4len) {
			excludesIPv4 = true
		}
		if cidr.IP.Equal(net.IPv6zero) && isAllZeros(cidr.Mask, net.IPv6len) {
			excludesIPv6 = true
		}
	}

	hasIPAddressInPermittedSubtrees := len(constraints.PermittedIPRanges) > 0
	hasIPAddressesInExcludedSubtrees := excludesIPv4 && excludesIPv6

	// There must be at least one DNSname constraint
	hasDNSName := len(cert.PermittedDNSDomains) > 0 ||
		len(constraints.ExcludedDNSDomains) > 0

	if hasDNSName && (hasIPAddressInPermittedSubtrees ||
		hasIPAddressesInExcludedSubtrees) {
		return true
	}
	return false
}
689450
func (c *Client) SetConstraints(application string, constraints constraints.Value) error {
	args := params.SetConstraints{
		ApplicationName: application,
		Constraints:     constraints,
	}
	return c.facade.FacadeCall("SetConstraints", args, nil)
}
1316524
func IsCompatibleRange(constraint, ver string) bool {
	sv, err := semver.NewVersion(ver)
	if err != nil {
		return false
	}

	c, err := semver.NewConstraint(constraint)
	if err != nil {
		return false
	}
	return c.Check(sv)
}
93213
func (e *extractorImpl) GetConstraints(applications ...string) ([]constraints.Value, error) {
	return e.application.GetConstraints(applications...)
}
901340
func NewConstraint() *constraint {
	return &constraint{
		Handler: admission.NewHandler(admission.Create, admission.Update),
	}
}
774992
func ParseConstraints(ctx *cmd.Context, cons string) (constraints.Value, error) {
	if cons == "" {
		return constraints.Value{}, nil
	}
	constraint, aliases, err := constraints.ParseWithAliases(cons)
	// we always do these, even on errors, so that the error messages have
	// context.
	for alias, canonical := range aliases {
		ctx.Infof("Warning: constraint %q is deprecated in favor of %q.\n", alias, canonical)
	}
	if err != nil {
		return constraints.Value{}, err
	}
	return constraint, nil
}
502762
func NewConstraint(v string) (Constraints, error) {
	vs := strings.Split(v, ",")
	result := make([]*Constraint, len(vs))
	for i, single := range vs {
		c, err := parseSingle(single)
		if err != nil {
			return nil, err
		}

		result[i] = c
	}

	return Constraints(result), nil
}
967067
func (g *TaskGroup) Constrain(c *Constraint) *TaskGroup {
	g.Constraints = append(g.Constraints, c)
	return g
}
764265
func validateAwsEcsPlacementConstraint(constType, constExpr string) error {
	switch constType {
	case "distinctInstance":
		// Expression can be nil for distinctInstance
		return nil
	case "memberOf":
		if constExpr == "" {
			return fmt.Errorf("Expression cannot be nil for 'memberOf' type")
		}
	default:
		return fmt.Errorf("Unknown type provided: %q", constType)
	}
	return nil
}
936183
func checkPriKeyConstraint(col *table.Column, hasDefaultValue, hasNullFlag bool, outPriKeyConstraint *ast.Constraint) error {
	// Primary key should not be null.
	if mysql.HasPriKeyFlag(col.Flag) && hasDefaultValue && col.GetDefaultValue() == nil {
		return types.ErrInvalidDefault.GenWithStackByArgs(col.Name)
	}
	// Set primary key flag for outer primary key constraint.
	// Such as: create table t1 (id int , age int, primary key(id))
	if !mysql.HasPriKeyFlag(col.Flag) && outPriKeyConstraint != nil {
		for _, key := range outPriKeyConstraint.Keys {
			if key.Column.Name.L != col.Name.L {
				continue
			}
			col.Flag |= mysql.PriKeyFlag
			break
		}
	}
	// Primary key should not be null.
	if mysql.HasPriKeyFlag(col.Flag) && hasNullFlag {
		return ErrPrimaryCantHaveNull
	}
	return nil
}
923017
func (s *Shape) IsRequired(member string) bool {
	ref, ok := s.MemberRefs[member]
	if !ok {
		panic(fmt.Sprintf(
			"attempted to check required for unknown member, %s.%s",
			s.ShapeName, member,
		))
	}
	if ref.IdempotencyToken || ref.Shape.IdempotencyToken {
		return false
	}
	if ref.Location == "uri" || ref.HostLabel {
		return true
	}
	for _, n := range s.Required {
		if n == member {
			return true
		}
	}
	return false
}
445095
func dataForTableConstraints(schemas []*model.DBInfo) [][]types.Datum {
	var rows [][]types.Datum
	for _, schema := range schemas {
		for _, tbl := range schema.Tables {
			if tbl.PKIsHandle {
				record := types.MakeDatums(
					catalogVal,           // CONSTRAINT_CATALOG
					schema.Name.O,        // CONSTRAINT_SCHEMA
					mysql.PrimaryKeyName, // CONSTRAINT_NAME
					schema.Name.O,        // TABLE_SCHEMA
					tbl.Name.O,           // TABLE_NAME
					primaryKeyType,       // CONSTRAINT_TYPE
				)
				rows = append(rows, record)
			}

			for _, idx := range tbl.Indices {
				var cname, ctype string
				if idx.Primary {
					cname = mysql.PrimaryKeyName
					ctype = primaryKeyType
				} else if idx.Unique {
					cname = idx.Name.O
					ctype = uniqueKeyType
				} else {
					// The index has no constriant.
					continue
				}
				record := types.MakeDatums(
					catalogVal,    // CONSTRAINT_CATALOG
					schema.Name.O, // CONSTRAINT_SCHEMA
					cname,         // CONSTRAINT_NAME
					schema.Name.O, // TABLE_SCHEMA
					tbl.Name.O,    // TABLE_NAME
					ctype,         // CONSTRAINT_TYPE
				)
				rows = append(rows, record)
			}
		}
	}
	return rows
}
676870
func (cs Constraints) Check(v *Version) bool {
	for _, c := range cs {
		if !c.Check(v) {
			return false
		}
	}

	return true
}
923540
func (p environStatePolicy) ConstraintsValidator(ctx context.ProviderCallContext) (constraints.Validator, error) {
	model, err := p.st.Model()
	if err != nil {
		return nil, errors.Trace(err)
	}

	if model.Type() == state.ModelTypeIAAS {
		env, err := p.getEnviron(p.st)
		if err != nil {
			return nil, err
		}
		return env.ConstraintsValidator(ctx)
	}
	broker, err := p.getBroker(p.st)
	if err != nil {
		return nil, errors.Trace(err)
	}
	return broker.ConstraintsValidator(ctx)
}
1181059
func (e *environ) ConstraintsValidator(ctx context.ProviderCallContext) (constraints.Validator, error) {
	validator := constraints.NewValidator()
	validator.RegisterUnsupported([]string{constraints.CpuPower, constraints.VirtType})
	validator.RegisterConflicts([]string{constraints.InstanceType}, []string{constraints.Mem})
	validator.RegisterVocabulary(constraints.Arch, []string{arch.AMD64, arch.ARM64, arch.I386, arch.PPC64EL})
	return validator, nil
}
544213
func (s Constraints) Allows(v Version) bool {
	return s.raw.Check(v.raw)
}
37676
func (s *HTTPServer) checkCoordinateDisabled(resp http.ResponseWriter, req *http.Request) bool {
	if !s.agent.config.DisableCoordinates {
		return false
	}

	resp.WriteHeader(http.StatusUnauthorized)
	fmt.Fprint(resp, "Coordinate support disabled")
	return true
}