// check if the SPKI hash of a cert is blacklisted
515218
func evalBlacklist(spkihash string) bool {
	for _, blacklisted := range blacklist {
		if strings.ToUpper(spkihash) == strings.ToUpper(blacklisted) {
			return true
		}
	}
	return false
}
680054
func (s CertSet) Lookup(cert *x509.Certificate) bool {
	return s[SHA1RawPublicKey(cert)]
}
1341034
func (agent *ActionAgent) BlacklistedTables() []string {
	agent.mutex.Lock()
	defer agent.mutex.Unlock()
	return agent._blacklistedTables
}
1242925
func Blacklisting() echo.HandlerFunc {

	// swagger:route GET /users/{id}/blacklisting users blacklisting GetBlacklisting
	//
	// Show the user that placed the specified user in their blacklist
	//
	// You can personalize the request via query string parameters
	//
	//	Produces:
	//	- application/json
	//
	//	Security:
	//		oauth: profile:read
	//
	//	Responses:
	//		default: UsersIdBlacklisting

	return func(c echo.Context) error {
		if !rest.IsGranted("profile:read", c) {
			return rest.InvalidScopeResponse("profile:read", c)
		}
		blacklisting := c.Get("other").(*nerdz.User).Blacklisting()
		return rest.SelectFields(rest.GetUsersInfo(blacklisting), c)
	}
}
1238810
func (s *Server) checkAuthforWarnings() {
	warn := false
	if s.opts.Password != "" && !isBcrypt(s.opts.Password) {
		warn = true
	}
	for _, u := range s.users {
		// Skip warn if using TLS certs based auth
		// unless a password has been left in the config.
		if u.Password == "" && s.opts.TLSMap {
			continue
		}

		if !isBcrypt(u.Password) {
			warn = true
			break
		}
	}
	if warn {
		// Warning about using plaintext passwords.
		s.Warnf("Plaintext passwords detected, use nkeys or bcrypt.")
	}
}
767491
func IsPayToWitnessScriptHash(script []byte) bool {
	pops, err := parseScript(script)
	if err != nil {
		return false
	}
	return isWitnessScriptHash(pops)
}
993410
func (ya *YubiAuth) HttpsVerifyCertificate(verifyCertificate bool) {
	// Lock
	ya.use.Lock()
	defer ya.use.Unlock()

	// save setting
	ya.verifyCertificate = verifyCertificate

	// rebuild workers (client has to be changed)
	ya.buildWorkers()
}
232555
func keyExistsInList(cert data.PublicKey, ids map[string]bool) error {
	pubKeyID, err := utils.CanonicalKeyID(cert)
	if err != nil {
		return fmt.Errorf("failed to obtain the public key id from the given certificate: %v", err)
	}
	if _, ok := ids[pubKeyID]; ok {
		return nil
	}
	return errKeyNotFound{}
}
437811
func (c *Certificate) CheckCRLSignature(crl *pkix.CertificateList) error {
	algo := getSignatureAlgorithmFromAI(crl.SignatureAlgorithm)
	return c.CheckSignature(algo, crl.TBSCertList.Raw, crl.SignatureValue.RightAlign())
}
903660
func Check(d *certdata.Data) *errors.Errors {
	var e = errors.New(nil)
	for _, ext := range d.Cert.Extensions {
		// Check for any imported extensions and run all matching
		e.Append(checks.Extensions.Check(ext, d))
	}
	return e
}
345114
func CheckRequiredKeys(cb config.Backend) error {
	if err := config.CheckConfig("/deis/platform/", "domain", cb); err != nil {
		return fmt.Errorf(`Missing platform domain, use:
deisctl config platform set domain=<your-domain>`)
	}

	if err := config.CheckConfig("/deis/platform/", "sshPrivateKey", cb); err != nil {
		fmt.Printf(`Warning: Missing sshPrivateKey, "deis run" will be unavailable. Use:
deisctl config platform set sshPrivateKey=<path-to-key>
`)
	}
	return nil
}
1368905
func IsValidHasher(hasher string) bool {
	switch hasher {
	case
		Argon2Hasher,
		BCryptHasher,
		BCryptSHA256Hasher,
		CryptHasher,
		MD5Hasher,
		PBKDF2SHA1Hasher,
		PBKDF2SHA256Hasher,
		SHA1Hasher,
		UnsaltedMD5Hasher,
		UnsaltedSHA1Hasher:
		return true
	}

	return false
}
419314
func Blacklist() echo.HandlerFunc {

	// swagger:route GET /me/blacklist me info blacklist getMeBlacklist
	//
	// Shows the blacklist informations for the current user
	//
	// You can personalize the request via query string parameters
	//
	//	Produces:
	//	- application/json
	//
	//	Security:
	//		oauth: profile:read
	//
	//	Responses:
	//		default: MeBlacklist

	return func(c echo.Context) error {
		return user.Blacklist()(c)
	}
}
482558
func certificateCheckCallback(_cert *C.git_cert, _valid C.int, _host *C.char, data unsafe.Pointer) int {
	callbacks, _ := pointerHandles.Get(data).(*RemoteCallbacks)
	// if there's no callback set, we need to make sure we fail if the library didn't consider this cert valid
	if callbacks.CertificateCheckCallback == nil {
		if _valid == 1 {
			return 0
		} else {
			return C.GIT_ECERTIFICATE
		}
	}
	host := C.GoString(_host)
	valid := _valid != 0

	var cert Certificate
	if _cert.cert_type == C.GIT_CERT_X509 {
		cert.Kind = CertificateX509
		ccert := (*C.git_cert_x509)(unsafe.Pointer(_cert))
		x509_certs, err := x509.ParseCertificates(C.GoBytes(ccert.data, C.int(ccert.len)))
		if err != nil {
			return C.GIT_EUSER
		}

		// we assume there's only one, which should hold true for any web server we want to talk to
		cert.X509 = x509_certs[0]
	} else if _cert.cert_type == C.GIT_CERT_HOSTKEY_LIBSSH2 {
		cert.Kind = CertificateHostkey
		ccert := (*C.git_cert_hostkey)(unsafe.Pointer(_cert))
		cert.Hostkey.Kind = HostkeyKind(ccert._type)
		C.memcpy(unsafe.Pointer(&cert.Hostkey.HashMD5[0]), unsafe.Pointer(&ccert.hash_md5[0]), C.size_t(len(cert.Hostkey.HashMD5)))
		C.memcpy(unsafe.Pointer(&cert.Hostkey.HashSHA1[0]), unsafe.Pointer(&ccert.hash_sha1[0]), C.size_t(len(cert.Hostkey.HashSHA1)))
	} else {
		cstr := C.CString("Unsupported certificate type")
		C.giterr_set_str(C.GITERR_NET, cstr)
		C.free(unsafe.Pointer(cstr))
		return -1 // we don't support anything else atm
	}

	return int(callbacks.CertificateCheckCallback(&cert, valid, host))
}
827271
func (c certificate) Check(d *certdata.Data) *errors.Errors {
	var e = errors.New(nil)

	for _, cc := range c {
		if cc.filter != nil && !cc.filter.Check(d) {
			continue
		}
		e.Append(cc.f(d))
	}

	return e
}
551848
func Check(d *certdata.Data) *errors.Errors {
	var e = errors.New(nil)

	gkp := goodkey.NewKeyPolicy()
	err := gkp.GoodKey(d.Cert.PublicKey)
	if err != nil {
		e.Err("Certificate %s", strings.ToLower(err.Error()))
		return e
	}

	return e
}
1159330
func (s *Server) processTrustedKeys() bool {
	if trustedKeys != "" && !s.initStampedTrustedKeys() {
		return false
	} else if s.opts.TrustedKeys != nil {
		for _, key := range s.opts.TrustedKeys {
			if !nkeys.IsValidPublicOperatorKey(key) {
				return false
			}
		}
		s.trustedKeys = s.opts.TrustedKeys
	}
	return true
}