// NewRegistryWhitelister creates a whitelister that admits registry domains and pull specs based on the given
// list of allowed registries and the current domain name of the integrated Docker registry.
322967
func NewRegistryWhitelister(
	whitelist openshiftcontrolplanev1.AllowedRegistries,
	registryHostRetriever RegistryHostnameRetriever,
) (RegistryWhitelister, error) {
	errs := []error{}
	rw := registryWhitelister{
		whitelist:             make([]allowedHostPortGlobs, 0, len(whitelist)),
		pullSpecs:             sets.NewString(),
		registryHostRetriever: registryHostRetriever,
	}
	// iterate in reversed order to make the patterns appear in the same order as given (patterns are prepended)
	for i := len(whitelist) - 1; i >= 0; i-- {
		registry := whitelist[i]
		transport := WhitelistTransportSecure
		if registry.Insecure {
			transport = WhitelistTransportInsecure
		}
		err := rw.WhitelistRegistry(registry.DomainName, transport)
		if err != nil {
			errs = append(errs, err)
		}
	}

	if len(errs) > 0 {
		return nil, kerrutil.NewAggregate(errs)
	}
	return &rw, nil
}
538840
func NewENSFilterer(address common.Address, filterer bind.ContractFilterer) (*ENSFilterer, error) {
	contract, err := bindENS(address, nil, nil, filterer)
	if err != nil {
		return nil, err
	}
	return &ENSFilterer{contract: contract}, nil
}
383133
func ValidateImageStreamWithWhitelister(
	whitelister whitelist.RegistryWhitelister,
	stream *imageapi.ImageStream,
) field.ErrorList {
	result := validation.ValidateObjectMeta(&stream.ObjectMeta, true, ValidateImageStreamName, field.NewPath("metadata"))

	// Ensure we can generate a valid docker image repository from namespace/name
	if len(stream.Namespace+"/"+stream.Name) > reference.NameTotalLengthMax {
		result = append(result, field.Invalid(field.NewPath("metadata", "name"), stream.Name, fmt.Sprintf("'namespace/name' cannot be longer than %d characters", reference.NameTotalLengthMax)))
	}

	insecureRepository := isRepositoryInsecure(stream)

	if len(stream.Spec.DockerImageRepository) != 0 {
		dockerImageRepositoryPath := field.NewPath("spec", "dockerImageRepository")
		isValid := true
		ref, err := imageapi.ParseDockerImageReference(stream.Spec.DockerImageRepository)
		if err != nil {
			result = append(result, field.Invalid(dockerImageRepositoryPath, stream.Spec.DockerImageRepository, err.Error()))
			isValid = false
		} else {
			if len(ref.Tag) > 0 {
				result = append(result, field.Invalid(dockerImageRepositoryPath, stream.Spec.DockerImageRepository, "the repository name may not contain a tag"))
				isValid = false
			}
			if len(ref.ID) > 0 {
				result = append(result, field.Invalid(dockerImageRepositoryPath, stream.Spec.DockerImageRepository, "the repository name may not contain an ID"))
				isValid = false
			}
		}
		if isValid && whitelister != nil {
			if err := whitelister.AdmitDockerImageReference(&ref, getWhitelistTransportForFlag(insecureRepository, true)); err != nil {
				result = append(result, field.Forbidden(dockerImageRepositoryPath, err.Error()))
			}
		}
	}
	for tag, tagRef := range stream.Spec.Tags {
		path := field.NewPath("spec", "tags").Key(tag)
		result = append(result, ValidateImageStreamTagReference(whitelister, insecureRepository, tagRef, path)...)
	}
	for tag, history := range stream.Status.Tags {
		for i, tagEvent := range history.Items {
			if len(tagEvent.DockerImageReference) == 0 {
				result = append(result, field.Required(field.NewPath("status", "tags").Key(tag).Child("items").Index(i).Child("dockerImageReference"), ""))
				continue
			}
			ref, err := imageapi.ParseDockerImageReference(tagEvent.DockerImageReference)
			if err != nil {
				result = append(result, field.Invalid(field.NewPath("status", "tags").Key(tag).Child("items").Index(i).Child("dockerImageReference"), tagEvent.DockerImageReference, err.Error()))
				continue
			}
			if whitelister != nil {
				insecure := false
				if tr, ok := stream.Spec.Tags[tag]; ok {
					insecure = tr.ImportPolicy.Insecure
				}
				transport := getWhitelistTransportForFlag(insecure || insecureRepository, true)
				if err := whitelister.AdmitDockerImageReference(&ref, transport); err != nil {
					result = append(result, field.Forbidden(field.NewPath("status", "tags").Key(tag).Child("items").Index(i).Child("dockerImageReference"), err.Error()))
				}
			}
		}
	}

	return result
}
783428
func NewRegistry(evaluators []quota.Evaluator) quota.Registry {
	return &simpleRegistry{
		evaluators: evaluatorsByGroupResource(evaluators),
	}
}
1197640
func (s *UpdateOriginEndpointInput) SetWhitelist(v []*string) *UpdateOriginEndpointInput {
	s.Whitelist = v
	return s
}
1010931
func NewProxyRegistry(factory ProxyFactory) ProxyRegistry {
	return &proxyRegistry{
		registry:     make(map[string]Proxy),
		proxyFactory: factory,
	}
}
316285
func NewRegistry(s Storage, status, internal rest.Updater) Registry {
	return &storage{Storage: s, status: status, internal: internal}
}
241120
func NewRegisteredServicesContainer(privateKey, publicKey []byte, hub events.Hub) *restful.Container {
	f := filters.NewJWTFilter(publicKey, "/users/login")
	container := restful.NewContainer()
	container.Filter(f.Filter)
	container.Add(usersWebService(privateKey, hub))
	return container
}
1045111
func ValidateImageStreamUpdateWithWhitelister(
	whitelister whitelist.RegistryWhitelister,
	newStream, oldStream *imageapi.ImageStream,
) field.ErrorList {
	result := validation.ValidateObjectMetaUpdate(&newStream.ObjectMeta, &oldStream.ObjectMeta, field.NewPath("metadata"))

	if whitelister != nil {
		// whitelist old pull specs no longer present on the whitelist
		whitelister = whitelister.Copy()
		whitelister.WhitelistPullSpecs(collectImageStreamSpecImageReferences(oldStream).List()...)
		for ref := range collectImageStreamStatusImageReferences(oldStream) {
			whitelister.WhitelistPullSpecs(ref)
		}
	}

	result = append(result, ValidateImageStreamWithWhitelister(whitelister, newStream)...)

	return result
}
1287986
func NewRegistry() *Registry {
	r := &Registry{}
	r.functions = make(map[string]*function)
	return r
}
480513
func isWhitelisted(addr net.Addr) bool {
	if len(cfg.whitelists) == 0 {
		return false
	}

	host, _, err := net.SplitHostPort(addr.String())
	if err != nil {
		srvrLog.Warnf("Unable to SplitHostPort on '%s': %v", addr, err)
		return false
	}
	ip := net.ParseIP(host)
	if ip == nil {
		srvrLog.Warnf("Unable to parse IP '%s'", addr)
		return false
	}

	for _, ipnet := range cfg.whitelists {
		if ipnet.Contains(ip) {
			return true
		}
	}
	return false
}
577466
func proxyWhitelisted(r *http.Request) bool {
	for _, url := range []string{"/raft/promote", "/raft/demote", "/shutdown"} {
		if strings.HasPrefix(r.URL.Path, url) {
			return true
		}
	}
	return false
}
1138134
func NewENSRegistryTransactor(address common.Address, transactor bind.ContractTransactor) (*ENSRegistryTransactor, error) {
	contract, err := bindENSRegistry(address, nil, transactor, nil)
	if err != nil {
		return nil, err
	}
	return &ENSRegistryTransactor{contract: contract}, nil
}
220658
func NewRegistry() *Registry {
	return &Registry{
		collectorsByID:  map[uint64]Collector{},
		descIDs:         map[uint64]struct{}{},
		dimHashesByName: map[string]uint64{},
	}
}
879020
func newPrometheusRegistry() (*prometheus.Registry, error) {
	r := prometheus.NewRegistry()
	if err := r.Register(prometheus.NewGoCollector()); err != nil {
		return nil, errors.Trace(err)
	}
	if err := r.Register(prometheus.NewProcessCollector(
		prometheus.ProcessCollectorOpts{})); err != nil {
		return nil, errors.Trace(err)
	}
	return r, nil
}
1166826
func (client *Client) AddListenerWhiteListItem(loadBalancerId string, port int, sourceItems string) (err error) {
	args := &CommonListenerWhiteListItemArgs{
		LoadBalancerId: loadBalancerId,
		ListenerPort:   port,
		SourceItems:    sourceItems,
	}
	response := &CommonLoadBalancerListenerResponse{}
	err = client.Invoke("AddListenerWhiteListItem", args, response)
	return err
}
1299861
func filterWhitelist(whitelist *vulnerabilitiesWhitelist, vs []*clair.Vulnerability, imageName string) []*clair.Vulnerability {
	generalWhitelist := whitelist.General
	imageWhitelist := whitelist.Images

	filteredVs := make([]*clair.Vulnerability, 0, len(vs))

	for _, v := range vs {
		if _, exists := generalWhitelist[v.Name]; !exists {
			if _, exists := imageWhitelist[imageName][v.Name]; !exists {
				//vulnerability is not in the image whitelist, so add it to the list to return
				filteredVs = append(filteredVs, v)
			}
		}
	}

	return filteredVs
}