// CheckAccessHTTP disallows all HTTP access.
325863
func (fp FallbackPolicy) CheckAccessHTTP(req *http.Request, role string) error {
	return errFallback
}
69267
func (exp *explorerUI) SyncStatusAPIIntercept(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		if exp.ShowingSyncStatusPage() {
			exp.HandleApiRequestsOnSync(w, r)
			return
		}
		// Otherwise, proceed to the next http handler.
		next.ServeHTTP(w, r)
	})
}
1260383
func SetAcceptedHeaders(resp *http.Response) {
	SetLocationHeader(resp, TestURL)
	SetRetryHeader(resp, TestDelay)
}
465267
func CheckBearerAuth(r *http.Request) *BearerAuth {
	authHeader := r.Header.Get("Authorization")
	authForm := r.FormValue("code")
	if authHeader == "" && authForm == "" {
		return nil
	}
	token := authForm
	if authHeader != "" {
		s := strings.SplitN(authHeader, " ", 2)
		if (len(s) != 2 || strings.ToLower(s[0]) != "bearer") && token == "" {
			return nil
		}
		//Use authorization header token only if token type is bearer else query string access token would be returned
		if len(s) > 0 && strings.ToLower(s[0]) == "bearer" {
			token = s[1]
		}
	}
	return &BearerAuth{Code: token}
}
297039
func (b accessPerms) isValidAccessPERM() bool {
	switch b {
	case accessNone, accessDownload, accessUpload, accessPublic:
		return true
	}
	return false
}
614305
func (s *VolumeServer) checkAccessForVolumeId(
	ctx context.Context,
	volumeId string,
	accessType api.Ownership_AccessType,
) error {
	// Inspect will check access for us
	resp, err := s.Inspect(ctx, &api.SdkVolumeInspectRequest{
		VolumeId: volumeId,
	})
	if err != nil {
		return err
	}
	if !resp.GetVolume().IsPermitted(ctx, accessType) {
		return status.Errorf(codes.PermissionDenied, "Access denied to volume %v", resp.GetVolume().GetId())
	}
	return nil
}
552165
func checkAccessModes(claim *v1.PersistentVolumeClaim, volume *v1.PersistentVolume) bool {
	pvModesMap := map[v1.PersistentVolumeAccessMode]bool{}
	for _, mode := range volume.Spec.AccessModes {
		pvModesMap[mode] = true
	}

	for _, mode := range claim.Spec.AccessModes {
		_, ok := pvModesMap[mode]
		if !ok {
			return false
		}
	}
	return true
}
588036
func (s *Service) PeeringAccept(ctx context.Context, spaceIdentity string, peeringPcxID string) (*Peering, error) {
	var peering Peering
	return &peering, s.Post(ctx, &peering, fmt.Sprintf("/spaces/%v/peerings/%v/actions/accept", spaceIdentity, peeringPcxID), nil)
}
441360
func (bf *HtpasswdFile) ServeHTTP(res http.ResponseWriter, req *http.Request) {
	// if everything works, we return, otherwise we get to the
	// end where we do an http.Error to stop the request
	auth := req.Header.Get("Authorization")

	if auth != "" {
		userPassword, err := base64.StdEncoding.DecodeString(strings.TrimPrefix(auth, "Basic "))
		if err == nil {
			parts := strings.SplitN(string(userPassword), ":", 2)
			if len(parts) == 2 {
				user := parts[0]
				pw := parts[1]

				bf.mutex.Lock()
				matcher, ok := bf.passwds[user]
				bf.mutex.Unlock()

				if ok && matcher.MatchesPassword(pw) {
					// we are good
					return
				}
			}
		}
	}

	res.Header().Set("WWW-Authenticate", "Basic realm=\""+bf.realm+"\"")
	http.Error(res, "Not Authorized", http.StatusUnauthorized)
}
1183244
func (s *server) checkHostCert(logger *log.Entry, user string, clusterName string, cert *ssh.Certificate) error {
	if cert.CertType != ssh.HostCert {
		return trace.BadParameter("expected host cert, got wrong cert type: %d", cert.CertType)
	}

	// fetch keys of the certificate authority to check
	// if there is a match
	keys, err := s.getTrustedCAKeysByID(services.CertAuthID{
		Type:       services.HostCA,
		DomainName: clusterName,
	})
	if err != nil {
		return trace.Wrap(err)
	}

	// match key of the certificate authority with the signature key
	var match bool
	for _, k := range keys {
		if sshutils.KeysEqual(k, cert.SignatureKey) {
			match = true
			break
		}
	}
	if !match {
		return trace.NotFound("cluster %v has no matching CA keys", clusterName)
	}

	checker := utils.CertChecker{}
	if err := checker.CheckCert(user, cert); err != nil {
		return trace.BadParameter(err.Error())
	}

	return nil
}
1030771
func (p *ProxyLB) SetHTTPHealthCheck(hostHeader, path string, delayLoop int) {
	if delayLoop <= 0 {
		delayLoop = 10
	}

	p.Settings.ProxyLB.HealthCheck.Protocol = "http"
	p.Settings.ProxyLB.HealthCheck.Host = hostHeader
	p.Settings.ProxyLB.HealthCheck.Path = path
	p.Settings.ProxyLB.HealthCheck.DelayLoop = delayLoop
}
1219699
func (am *aclMgmtImpl) CheckACL(resName string, channelID string, idinfo interface{}) error {
	//use the resource based config provider (which will in turn default to 1.0 provider)
	return am.rescfgProvider.CheckACL(resName, channelID, idinfo)
}
781013
func checkSSH() error {
	const ERROR_SERVICE_DOES_NOT_EXIST syscall.Errno = 0x424

	const msgFmt = "%s service not running and start type is disabled.  " +
		"To enable ssh on Windows you must run the enable_ssh job from the " +
		"windows-utilities-release."

	m, err := mgr.Connect()
	if err != nil {
		return fmt.Errorf("opening service control manager: %s", err)
	}
	defer m.Disconnect()

	sshd, err := m.OpenService("sshd")
	if err != nil {
		if err == ERROR_SERVICE_DOES_NOT_EXIST {
			return errors.New("sshd is not installed")
		}
		return fmt.Errorf("opening service sshd: %s", err)
	}
	defer sshd.Close()

	st, err := sshd.Query()
	if err != nil {
		return fmt.Errorf("querying status of service (sshd): %s", err)
	}
	if st.State != svc.Running {
		if serviceDisabled(sshd) {
			return fmt.Errorf(msgFmt, "sshd")
		}
		return errors.New("sshd service is not running")
	}

	return nil
}
847020
func (tc *TeleportClient) accessPoint(clt auth.AccessPoint, proxyHostPort string, clusterName string) (auth.AccessPoint, error) {
	// If no caching policy was set or on Windows (where Teleport does not
	// support file locking at the moment), return direct access to the access
	// point.
	if tc.CachePolicy == nil || runtime.GOOS == teleport.WindowsOS {
		log.Debugf("not using caching access point")
		return clt, nil
	}
	return clt, nil
}
672528
func (api *BaseAPI) checkOfferAccess(backend Backend, offerUUID string, perm permission.Access) (permission.Access, error) {
	apiUser := api.Authorizer.GetAuthTag().(names.UserTag)
	access, err := backend.GetOfferAccess(offerUUID, apiUser)
	if err != nil && !errors.IsNotFound(err) {
		return permission.NoAccess, errors.Trace(err)
	}
	if !access.EqualOrGreaterOfferAccessThan(permission.ReadAccess) {
		return permission.NoAccess, nil
	}
	return access, nil
}
642529
func (c *CertChecker) CheckHostKey(addr string, remote net.Addr, key ssh.PublicKey) error {
	err := validate(key)
	if err != nil {
		return trace.Wrap(err)
	}

	return c.CertChecker.CheckHostKey(addr, remote, key)
}
398323
func CheckHostnameIPMismatch(local string, hostsMap map[string][]string) ([]string, error) {
	var message string

	test := func(message string, filter func(string) bool) ([]string, error) {
		var mismatched []string

		for _, hostports := range hostsMap {
			for _, hostport := range hostports {
				if filter(hostport) {
					mismatched = append(mismatched, hostport)
				}
			}
		}

		if len(mismatched) > 0 {
			return mismatched, errors.New(message)
		}

		return nil, nil
	}

	if HostportPattern.MatchString(local) {
		message = "Your host identifier looks like an IP address and there are bootstrap " +
			"hosts that appear to be specified with hostnames. These inconsistencies may " +
			"lead to subtle node communication issues."
		return test(message, func(hostport string) bool {
			return !HostportPattern.MatchString(hostport)
		})
	}

	message = "Your host identifier looks like a hostname and there are bootstrap hosts " +
		"that appear to be specified with IP addresses. These inconsistencies may lead " +
		"to subtle node communication issues"

	return test(message, func(hostport string) bool {
		return HostportPattern.MatchString(hostport)
	})
}