// Permitted returns true if the IP has been whitelisted.
191470
func (wl *BasicNet) Permitted(ip net.IP) bool {
	if !validIP(ip) { // see whitelist.go for this function
		return false
	}

	wl.lock.Lock()
	defer wl.lock.Unlock()
	for i := range wl.whitelist {
		if wl.whitelist[i].Contains(ip) {
			return true
		}
	}
	return false
}
901247
func (checker UserSubjectChecker) Allowed(subject rbac.Subject, ctx *RoleBindingRestrictionContext) (bool, error) {
	if subject.Kind != rbac.UserKind {
		return false, nil
	}

	for _, userName := range checker.userRestriction.Users {
		if subject.Name == userName {
			return true, nil
		}
	}

	if len(checker.userRestriction.Groups) != 0 {
		subjectGroups, err := ctx.groupsForUser(subject)
		if err != nil {
			return false, err
		}

		for _, groupName := range checker.userRestriction.Groups {
			for _, group := range subjectGroups {
				if group.Name == groupName {
					return true, nil
				}
			}
		}
	}

	if len(checker.userRestriction.Selectors) != 0 {
		labelSet, err := ctx.labelSetForUser(subject)
		if err != nil {
			return false, err
		}

		for _, labelSelector := range checker.userRestriction.Selectors {
			selector, err := metav1.LabelSelectorAsSelector(&labelSelector)
			if err != nil {
				return false, err
			}

			if selector.Matches(labelSet) {
				return true, nil
			}
		}
	}

	return false, nil
}
637035
func (c *Cors) areHeadersAllowed(requestedHeaders []string) bool {
	if c.allowedHeadersAll || len(requestedHeaders) == 0 {
		return true
	}
	for _, header := range requestedHeaders {
		header = http.CanonicalHeaderKey(header)
		found := false
		for _, h := range c.allowedHeaders {
			if h == header {
				found = true
			}
		}
		if !found {
			return false
		}
	}
	return true
}
727718
func (s *Session) Allowed(p Permission) bool {
	if err := s.Expired(); err != nil {
		return false
	}

	return PermissionAllowed(p, s.Permissions)
}
728132
func (s *HTTPServer) checkACLDisabled(resp http.ResponseWriter, req *http.Request) bool {
	if s.agent.delegate.ACLsEnabled() {
		return false
	}

	resp.WriteHeader(http.StatusUnauthorized)
	fmt.Fprint(resp, "ACL support disabled")
	return true
}
350825
func (ctx *Context) IP(trustedProxy ...bool) net.IP {
	trusted := ctx.Setting(SetTrustedProxy).(bool)
	if len(trustedProxy) > 0 {
		trusted = trustedProxy[0]
	}

	if trusted {
		ip := ctx.Req.Header.Get(HeaderXForwardedFor)
		if ip == "" {
			ip = ctx.Req.Header.Get(HeaderXRealIP)
		} else if i := strings.IndexByte(ip, ','); i >= 0 {
			ip = ip[0:i]
		}

		if realIP := net.ParseIP(ip); realIP != nil {
			return realIP
		}
	}

	ra := ctx.Req.RemoteAddr
	ra, _, _ = net.SplitHostPort(ra)
	return net.ParseIP(ra)
}
1008653
func IsUserAllowed(user string, allowed *RangeList) bool {
	if allowed == nil || allowed.Empty() {
		return true
	}
	uid, err := strconv.Atoi(user)
	if err != nil {
		return false
	}
	return allowed.Contains(uid)
}
727981
func (l *Limiter) Allow(name string, maxn int64, period time.Duration) (count int64, delay time.Duration, allow bool) {
	return l.AllowN(name, maxn, period, 1)
}
480513
func isWhitelisted(addr net.Addr) bool {
	if len(cfg.whitelists) == 0 {
		return false
	}

	host, _, err := net.SplitHostPort(addr.String())
	if err != nil {
		srvrLog.Warnf("Unable to SplitHostPort on '%s': %v", addr, err)
		return false
	}
	ip := net.ParseIP(host)
	if ip == nil {
		srvrLog.Warnf("Unable to parse IP '%s'", addr)
		return false
	}

	for _, ipnet := range cfg.whitelists {
		if ipnet.Contains(ip) {
			return true
		}
	}
	return false
}
1241678
func ipv6only(ip net.IP) net.IP {
	if supportsIPv6 && len(ip) == net.IPv6len && ip.To4() == nil {
		return ip
	}
	return nil
}
544213
func (s Constraints) Allows(v Version) bool {
	return s.raw.Check(v.raw)
}
1285000
func (f *Machine) Allows(b uint8) bool {
	return f.isLegal(f.state, b)
}
1248141
func IsPublicAddr(ip net.IP) bool {
	for _, block := range privateIPBlocks {
		if block.Contains(ip) {
			return false
		}
	}
	return true
}
1181257
func (self *qbsWrapped) Allow(id int64, method string, pb PBundle) bool {
	var obj interface{}
	switch method {
	case "GET":
		obj = self.find
	case "PUT":
		obj = self.put
	case "DELETE":
		obj = self.del
	}
	allow, ok := obj.(Allower)
	if !ok {
		return true
	}
	return allow.Allow(id, method, pb)

}
1354354
func (xff *XFF) allowed(sip string) bool {
	if xff.allowAll {
		return true
	} else if ip := net.ParseIP(sip); ip != nil && ipInMasks(ip, xff.allowedMasks) {
		return true
	}
	return false
}
567879
func (pc parseCtx) permitsOption() bool {
	return pc.ctxType == fileCtx ||
		pc.ctxType == msgCtx ||
		pc.ctxType == oneOfCtx ||
		pc.ctxType == enumCtx ||
		pc.ctxType == serviceCtx ||
		pc.ctxType == rpcCtx
}
949956
func PermissionAllowed(p Permission, ps []Permission) bool {
	pID := ID(0)
	if p.ID != nil {
		pID = *p.ID
		if !pID.Valid() {
			return false
		}
	}

	for _, perm := range ps {
		permID := ID(0)
		if perm.ID != nil {
			permID = *perm.ID
			if !permID.Valid() {
				return false
			}
		}
		if perm.Action == p.Action && perm.Resource == p.Resource && permID == pID {
			return true
		}
	}
	return false
}