// checkLimitsForObtainingNewCerts checks to see if name can be issued right
// now according to mitigating factors we keep track of and preferences the
// user has set. If a non-nil error is returned, do not issue a new certificate
// for name.
501567
func (cg configGroup) checkLimitsForObtainingNewCerts(name string, cfg *Config) error {
	// User can set hard limit for number of certs for the process to issue
	if cfg.OnDemandState.MaxObtain > 0 &&
		atomic.LoadInt32(&cfg.OnDemandState.ObtainedCount) >= cfg.OnDemandState.MaxObtain {
		return fmt.Errorf("%s: maximum certificates issued (%d)", name, cfg.OnDemandState.MaxObtain)
	}

	// Make sure name hasn't failed a challenge recently
	failedIssuanceMu.RLock()
	when, ok := failedIssuance[name]
	failedIssuanceMu.RUnlock()
	if ok {
		return fmt.Errorf("%s: throttled; refusing to issue cert since last attempt on %s failed", name, when.String())
	}

	// Make sure, if we've issued a few certificates already, that we haven't
	// issued any recently
	lastIssueTimeMu.Lock()
	since := time.Since(lastIssueTime)
	lastIssueTimeMu.Unlock()
	if atomic.LoadInt32(&cfg.OnDemandState.ObtainedCount) >= 10 && since < 10*time.Minute {
		return fmt.Errorf("%s: throttled; last certificate was obtained %v ago", name, since)
	}

	// 👍Good to go
	return nil
}
723986
func (c *TabletConfig) verifyTransactionLimitConfig() error {
	actual, dryRun := c.EnableTransactionLimit, c.EnableTransactionLimitDryRun
	if actual && dryRun {
		return errors.New("only one of two flags allowed: -enable_transaction_limit or -enable_transaction_limit_dry_run")
	}

	// Skip other checks if this is not enabled
	if !actual && !dryRun {
		return nil
	}

	var (
		byUser      = c.TransactionLimitByUsername
		byPrincipal = c.TransactionLimitByPrincipal
		byComp      = c.TransactionLimitByComponent
		bySubcomp   = c.TransactionLimitBySubcomponent
	)
	if byAny := byUser || byPrincipal || byComp || bySubcomp; !byAny {
		return errors.New("no user discriminating fields selected for transaction limiter, everyone would share single chunk of transaction pool. Override with at least one of -transaction_limit_by flags set to true")
	}
	if v := c.TransactionLimitPerUser; v <= 0 || v >= 1 {
		return fmt.Errorf("-transaction_limit_per_user should be a fraction within range (0, 1) (specified value: %v)", v)
	}
	if limit := int(c.TransactionLimitPerUser * float64(c.TransactionCap)); limit == 0 {
		return fmt.Errorf("effective transaction limit per user is 0 due to rounding, increase -transaction_limit_per_user")
	}
	return nil
}
437080
func (n *Namespace) CheckAndSetDefaults() error {
	if err := n.Metadata.CheckAndSetDefaults(); err != nil {
		return trace.Wrap(err)
	}
	isValid := IsValidNamespace(n.Metadata.Name)
	if !isValid {
		return trace.BadParameter("namespace %q is invalid", n.Metadata.Name)
	}

	return nil
}
599606
func (s *Server) NewAccountsAllowed() bool {
	s.mu.Lock()
	defer s.mu.Unlock()
	return s.opts.AllowNewAccounts
}
1066191
func (ssa *SQLStorageAuthority) checkFQDNSetExists(selector oneSelectorFunc, names []string) (bool, error) {
	var count int64
	err := selector(
		&count,
		`SELECT COUNT(1) FROM fqdnSets
		WHERE setHash = ?
		LIMIT 1`,
		hashNames(names),
	)
	return count > 0, err
}
964950
func (v *Validator) CheckCapabilities() (errs error) {
	if v.platform != "linux" {
		errs = multierror.Append(errs, fmt.Errorf("For %q platform, the configuration structure does not support process.capabilities", v.platform))
		return
	}

	process := v.spec.Process
	var effective, permitted, inheritable, ambient bool
	caps := make(map[string][]string)

	for _, cap := range process.Capabilities.Bounding {
		caps[cap] = append(caps[cap], "bounding")
	}
	for _, cap := range process.Capabilities.Effective {
		caps[cap] = append(caps[cap], "effective")
	}
	for _, cap := range process.Capabilities.Inheritable {
		caps[cap] = append(caps[cap], "inheritable")
	}
	for _, cap := range process.Capabilities.Permitted {
		caps[cap] = append(caps[cap], "permitted")
	}
	for _, cap := range process.Capabilities.Ambient {
		caps[cap] = append(caps[cap], "ambient")
	}

	for capability, owns := range caps {
		if err := CapValid(capability, v.HostSpecific); err != nil {
			errs = multierror.Append(errs, fmt.Errorf("capability %q is not valid, man capabilities(7)", capability))
		}

		effective, permitted, ambient, inheritable = false, false, false, false
		for _, set := range owns {
			if set == "effective" {
				effective = true
				continue
			}
			if set == "inheritable" {
				inheritable = true
				continue
			}
			if set == "permitted" {
				permitted = true
				continue
			}
			if set == "ambient" {
				ambient = true
				continue
			}
		}
		if effective && !permitted {
			errs = multierror.Append(errs, fmt.Errorf("effective capability %q is not allowed, as it's not permitted", capability))
		}
		if ambient && !(permitted && inheritable) {
			errs = multierror.Append(errs, fmt.Errorf("ambient capability %q is not allowed, as it's not permitted and inheribate", capability))
		}
	}

	return
}
694012
func (l *TeamLoader) seqnosContains(xs []keybase1.Seqno, y keybase1.Seqno) bool {
	for _, x := range xs {
		if x.Eq(y) {
			return true
		}
	}
	return false
}
160548
func Check(d *certdata.Data) *errors.Errors {
	var e = errors.New(nil)

	switch d.Type {
	case "EV":
		if strings.LastIndex(d.Cert.Subject.CommonName, "*") > -1 {
			e.Err("Certificate should not contain a wildcard")
		}
		for _, n := range d.Cert.DNSNames {
			if strings.LastIndex(n, "*") > -1 {
				e.Err("Certificate subjectAltName '%s' should not contain a wildcard", n)
			}
		}
	case "DV", "OV":
		if strings.LastIndex(d.Cert.Subject.CommonName, "*") > 0 {
			e.Err("Certificate wildcard is only allowed as prefix")
		}
		for _, n := range d.Cert.DNSNames {
			if strings.LastIndex(n, "*") > 0 {
				e.Err("Certificate subjectAltName '%s' wildcard is only allowed as prefix", n)
			}
		}
	}

	return e
}
1204655
func (t *WorkItemLinkType) CheckValidForCreation() error {
	if t.Name == "" {
		return errors.NewBadParameterError("name", t.Name)
	}
	if t.ForwardName == "" {
		return errors.NewBadParameterError("forward_name", t.ForwardName)
	}
	if t.ReverseName == "" {
		return errors.NewBadParameterError("reverse_name", t.ReverseName)
	}
	if err := t.Topology.CheckValid(); err != nil {
		return errs.WithStack(err)
	}
	if t.SpaceTemplateID == uuid.Nil {
		return errors.NewBadParameterError("space_template_id", t.SpaceTemplateID)
	}
	return nil
}
565237
func Check(ex pkix.Extension, d *certdata.Data) *errors.Errors {
	var e = errors.New(nil)

	// If the cert type isn't one of the `allowedCertTypes`, return an error
	if _, allowed := allowedCertTypes[d.Type]; !allowed {
		e.Err(certTypeErr)
	}

	// Per RFC 7633 "The TLS feature extension SHOULD NOT be marked critical"
	if ex.Critical {
		e.Err(critExtErr)
	}

	// Check that the extension value is the expected slice of DER encoded ASN.1
	if bytes.Compare(ex.Value, expectedExtensionValue) != 0 {
		e.Err(extValueErr)
	}

	return e
}
469912
func checkIfReadyForAdditionalControlPlane(initConfiguration *kubeadmapi.ClusterConfiguration, hasCertificateKey bool) error {
	// blocks if the cluster was created without a stable control plane endpoint
	if initConfiguration.ControlPlaneEndpoint == "" {
		return errors.New("unable to add a new control plane instance a cluster that doesn't have a stable controlPlaneEndpoint address")
	}

	if !hasCertificateKey {
		// checks if the certificates that must be equal across controlplane instances are provided
		if ret, err := certs.SharedCertificateExists(initConfiguration); !ret {
			return err
		}
	}

	return nil
}
504918
func (r *RoleV2) CheckAndSetDefaults() error {
	// make sure we have defaults for all fields
	if r.Metadata.Name == "" {
		return trace.BadParameter("missing parameter Name")
	}
	if r.Metadata.Namespace == "" {
		r.Metadata.Namespace = defaults.Namespace
	}
	if r.Spec.MaxSessionTTL == 0 {
		r.Spec.MaxSessionTTL = Duration(defaults.MaxCertDuration)
	}
	if r.Spec.MaxSessionTTL.Duration() < defaults.MinCertDuration {
		return trace.BadParameter("maximum session TTL can not be less than %v", defaults.MinCertDuration)
	}
	if r.Spec.Namespaces == nil {
		r.Spec.Namespaces = []string{defaults.Namespace}
	}
	if r.Spec.NodeLabels == nil {
		r.Spec.NodeLabels = map[string]string{Wildcard: Wildcard}
	}
	if r.Spec.Resources == nil {
		r.Spec.Resources = map[string][]string{
			KindSSHSession:    RO(),
			KindRole:          RO(),
			KindNode:          RO(),
			KindAuthServer:    RO(),
			KindReverseTunnel: RO(),
			KindCertAuthority: RO(),
		}
	}

	// restrict wildcards
	for _, login := range r.Spec.Logins {
		if login == Wildcard {
			return trace.BadParameter("wildcard matcher is not allowed in logins")
		}
	}
	for key, val := range r.Spec.NodeLabels {
		if key == Wildcard && val != Wildcard {
			return trace.BadParameter("selector *:<val> is not supported")
		}
	}

	return nil
}
363165
func IsValidSysctlName(name string) bool {
	if len(name) > SysctlMaxLength {
		return false
	}
	return sysctlRegexp.MatchString(name)
}
1089827
func domainsForRateLimiting(names []string) ([]string, error) {
	var domains []string
	for _, name := range names {
		domain, err := publicsuffix.Domain(name)
		if err != nil {
			// The only possible errors are:
			// (1) publicsuffix.Domain is giving garbage values
			// (2) the public suffix is the domain itself
			// We assume 2 and do not include it in the result.
			continue
		}
		domains = append(domains, domain)
	}
	return core.UniqueLowerNames(domains), nil
}
1066813
func NewContainsRangeFilter(binName string, indexCollectionType IndexCollectionType, begin, end int64) *Filter {
	vBegin, vEnd := NewValue(begin), NewValue(end)
	return newFilter(binName, indexCollectionType, vBegin.GetType(), vBegin, vEnd)
}
370945
func newLimitRanges(c *CoreV1Client, namespace string) *limitRanges {
	return &limitRanges{
		client: c.RESTClient(),
		ns:     namespace,
	}
}
69893
func containsLimit(execs []*tipb.Executor) bool {
	for _, exec := range execs {
		if exec.Limit != nil {
			return true
		}
	}
	return false
}