// Match another permission
486365
func (p *StdPermission) Match(a Permission) bool {
	return p.IDStr == a.ID()
}
458833
func ruleMatchesResource(r *audit.PolicyRule, attrs authorizer.Attributes) bool {
	if !attrs.IsResourceRequest() {
		return false
	}

	if len(r.Namespaces) > 0 {
		if !hasString(r.Namespaces, attrs.GetNamespace()) { // Non-namespaced resources use the empty string.
			return false
		}
	}
	if len(r.Resources) == 0 {
		return true
	}

	apiGroup := attrs.GetAPIGroup()
	resource := attrs.GetResource()
	subresource := attrs.GetSubresource()
	combinedResource := resource
	// If subresource, the resource in the policy must match "(resource)/(subresource)"
	if subresource != "" {
		combinedResource = resource + "/" + subresource
	}

	name := attrs.GetName()

	for _, gr := range r.Resources {
		if gr.Group == apiGroup {
			if len(gr.Resources) == 0 {
				return true
			}
			for _, res := range gr.Resources {
				if len(gr.ResourceNames) == 0 || hasString(gr.ResourceNames, name) {
					// match "*"
					if res == combinedResource || res == "*" {
						return true
					}
					// match "*/subresource"
					if len(subresource) > 0 && strings.HasPrefix(res, "*/") && subresource == strings.TrimLeft(res, "*/") {
						return true
					}
					// match "resource/*"
					if strings.HasSuffix(res, "/*") && resource == strings.TrimRight(res, "/*") {
						return true
					}
				}
			}
		}
	}
	return false
}
1025368
func (s *Intention) Match(
	args *structs.IntentionQueryRequest,
	reply *structs.IndexedIntentionMatches) error {
	// Forward if necessary
	if done, err := s.srv.forward("Intention.Match", args, args, reply); done {
		return err
	}

	// Get the ACL token for the request for the checks below.
	rule, err := s.srv.ResolveToken(args.Token)
	if err != nil {
		return err
	}

	if rule != nil {
		// We go through each entry and test the destination to check if it
		// matches.
		for _, entry := range args.Match.Entries {
			if prefix := entry.Name; prefix != "" && !rule.IntentionRead(prefix) {
				s.srv.logger.Printf("[WARN] consul.intention: Operation on intention prefix '%s' denied due to ACLs", prefix)
				return acl.ErrPermissionDenied
			}
		}
	}

	return s.srv.blockingQuery(
		&args.QueryOptions,
		&reply.QueryMeta,
		func(ws memdb.WatchSet, state *state.Store) error {
			index, matches, err := state.IntentionMatch(ws, args.Match)
			if err != nil {
				return err
			}

			reply.Index = index
			reply.Matches = matches
			return nil
		},
	)
}
548399
func (abp *attrPolicyBuilder) Matching(regex *regexp.Regexp) *attrPolicyBuilder {

	abp.regexp = regex

	return abp
}
588178
func (p Path) Matches(other string) bool {
	if CaseSensitivePath {
		return strings.HasPrefix(string(p), other)
	}
	return strings.HasPrefix(strings.ToLower(string(p)), strings.ToLower(other))
}
1341519
func (bp BasePermissions) Get(ty PermFlag) (bool, error) {
	if ty == 0 {
		return false, ErrInvalidPermission(ty)
	}
	if !bp.IsSet(ty) {
		return false, ErrValueNotSet(ty)
	}
	return bp.Perms&ty == ty, nil
}
221896
func Match(filters [][3]string, fw *choria.Framework, log *logrus.Entry) bool {
	matched := false
	var err error

	for _, filter := range filters {
		matched, err = HasFact(filter[0], filter[1], filter[2], fw.Config.FactSourceFile, log)
		if err != nil {
			log.Warnf("Failed to match fact '%#v': %s", filter, err)
			return false
		}

		if matched == false {
			log.Debugf("Failed to match fact filter '%#v'", filter)
			break
		}
	}

	return matched
}
1108980
func (src List) Match(f Filter) (List, error) {
	var result List
	for _, tools := range src {
		if f.match(tools) {
			result = append(result, tools)
		}
	}
	if len(result) == 0 {
		return nil, ErrNoMatches
	}
	return result, nil
}
1130995
func (t *TeamLDAPMapping) GetPermission() string {
	if t == nil || t.Permission == nil {
		return ""
	}
	return *t.Permission
}
135927
func (*Rar) Match(file io.ReadSeeker) (bool, error) {
	currentPos, err := file.Seek(0, io.SeekCurrent)
	if err != nil {
		return false, err
	}
	_, err = file.Seek(0, 0)
	if err != nil {
		return false, err
	}
	defer file.Seek(currentPos, io.SeekStart)

	buf := make([]byte, 8)
	if n, err := file.Read(buf); err != nil || n < 8 {
		return false, nil
	}
	hasTarHeader := bytes.Equal(buf[:7], []byte("Rar!\x1a\x07\x00")) || // ver 1.5
		bytes.Equal(buf, []byte("Rar!\x1a\x07\x01\x00")) // ver 5.0
	return hasTarHeader, nil
}
950315
func (m *Permission) Validate() error {
	if m == nil {
		return nil
	}

	switch m.Rule.(type) {

	case *Permission_AndRules:

		{
			tmp := m.GetAndRules()

			if v, ok := interface{}(tmp).(interface{ Validate() error }); ok {

				if err := v.Validate(); err != nil {
					return PermissionValidationError{
						field:  "AndRules",
						reason: "embedded message failed validation",
						cause:  err,
					}
				}
			}
		}

	case *Permission_OrRules:

		{
			tmp := m.GetOrRules()

			if v, ok := interface{}(tmp).(interface{ Validate() error }); ok {

				if err := v.Validate(); err != nil {
					return PermissionValidationError{
						field:  "OrRules",
						reason: "embedded message failed validation",
						cause:  err,
					}
				}
			}
		}

	case *Permission_Any:

		if m.GetAny() != true {
			return PermissionValidationError{
				field:  "Any",
				reason: "value must equal true",
			}
		}

	case *Permission_Header:

		{
			tmp := m.GetHeader()

			if v, ok := interface{}(tmp).(interface{ Validate() error }); ok {

				if err := v.Validate(); err != nil {
					return PermissionValidationError{
						field:  "Header",
						reason: "embedded message failed validation",
						cause:  err,
					}
				}
			}
		}

	case *Permission_DestinationIp:

		{
			tmp := m.GetDestinationIp()

			if v, ok := interface{}(tmp).(interface{ Validate() error }); ok {

				if err := v.Validate(); err != nil {
					return PermissionValidationError{
						field:  "DestinationIp",
						reason: "embedded message failed validation",
						cause:  err,
					}
				}
			}
		}

	case *Permission_DestinationPort:

		if m.GetDestinationPort() > 65535 {
			return PermissionValidationError{
				field:  "DestinationPort",
				reason: "value must be less than or equal to 65535",
			}
		}

	case *Permission_Metadata:

		{
			tmp := m.GetMetadata()

			if v, ok := interface{}(tmp).(interface{ Validate() error }); ok {

				if err := v.Validate(); err != nil {
					return PermissionValidationError{
						field:  "Metadata",
						reason: "embedded message failed validation",
						cause:  err,
					}
				}
			}
		}

	case *Permission_NotRule:

		{
			tmp := m.GetNotRule()

			if v, ok := interface{}(tmp).(interface{ Validate() error }); ok {

				if err := v.Validate(); err != nil {
					return PermissionValidationError{
						field:  "NotRule",
						reason: "embedded message failed validation",
						cause:  err,
					}
				}
			}
		}

	case *Permission_RequestedServerName:

		{
			tmp := m.GetRequestedServerName()

			if v, ok := interface{}(tmp).(interface{ Validate() error }); ok {

				if err := v.Validate(); err != nil {
					return PermissionValidationError{
						field:  "RequestedServerName",
						reason: "embedded message failed validation",
						cause:  err,
					}
				}
			}
		}

	default:
		return PermissionValidationError{
			field:  "Rule",
			reason: "value is required",
		}

	}

	return nil
}
441275
func (c *ACLCache) GetMatchingAction(ip []byte, port uint16) (report *policy.FlowPolicy, packet *policy.FlowPolicy, err error) {

	report, packet, err = c.reject.getMatchingAction(ip, port, report)
	if err == nil {
		return
	}

	report, packet, err = c.accept.getMatchingAction(ip, port, report)
	if err == nil {
		return
	}

	report, packet, err = c.observe.getMatchingAction(ip, port, report)
	if err == nil {
		return
	}

	if report == nil {
		report = catchAllPolicy
	}

	if packet == nil {
		packet = catchAllPolicy
	}

	return report, packet, errors.New("no match")
}
738089
func ruleMatches(r *audit.PolicyRule, attrs authorizer.Attributes) bool {
	user := attrs.GetUser()
	if len(r.Users) > 0 {
		if user == nil || !hasString(r.Users, user.GetName()) {
			return false
		}
	}
	if len(r.UserGroups) > 0 {
		if user == nil {
			return false
		}
		matched := false
		for _, group := range user.GetGroups() {
			if hasString(r.UserGroups, group) {
				matched = true
				break
			}
		}
		if !matched {
			return false
		}
	}
	if len(r.Verbs) > 0 {
		if !hasString(r.Verbs, attrs.GetVerb()) {
			return false
		}
	}

	if len(r.Namespaces) > 0 || len(r.Resources) > 0 {
		return ruleMatchesResource(r, attrs)
	}

	if len(r.NonResourceURLs) > 0 {
		return ruleMatchesNonResource(r, attrs)
	}

	return true
}
90169
func (id ID) MatchesPrivateKey(sk ic.PrivKey) bool {
	return id.MatchesPublicKey(sk.GetPublic())
}
843743
func matchRule(rule, s string) bool {
	// no rule
	rl := len(rule)
	if rl == 0 {
		return false
	}

	// '*xxx' || 'xxx*'
	if rule[0:1] == "*" || rule[rl-1:rl] == "*" {
		// get the matching string from the rule
		match := strings.TrimSpace(strings.Join(strings.Split(rule, "*"), ""))

		// '*' or '*******'
		if len(match) == 0 {
			return true
		}

		// '*xxx*'
		if rule[0:1] == "*" && rule[rl-1:rl] == "*" {
			return strings.Contains(s, match)
		}

		// '*xxx'
		if rule[0:1] == "*" {
			return strings.HasSuffix(s, match)
		}

		// 'xxx*'
		return strings.HasPrefix(s, match)
	}

	// no wildcard stars given in rule
	return rule == s
}
1017746
func (p *LayerPermission) Match(a Permission) bool {
	if p.IDStr == a.ID() {
		return true
	}
	q, ok := a.(*LayerPermission)
	if !ok {
		return false
	}
	players := strings.Split(p.IDStr, p.Sep)
	qlayers := strings.Split(q.IDStr, q.Sep)
	// layer counts of q should be less than that of p
	if len(players) > len(qlayers) {
		return false
	}
	for k, pv := range players {
		if pv != qlayers[k] {
			return false
		}
	}
	return true
}
1024935
func (r *Rules) FindMatchingRule(c context.Context, q *RulesQuery) (*admin.DelegationRule, error) {
	var matches []*admin.DelegationRule
	for _, rule := range r.rules {
		switch yes, err := rule.matchesQuery(c, q); {
		case err != nil:
			return nil, err // usually transient
		case yes:
			matches = append(matches, rule.rule)
		}
	}

	if len(matches) == 0 {
		return nil, fmt.Errorf("no matching delegation rules in the config")
	}

	if len(matches) > 1 {
		names := make([]string, len(matches))
		for i, m := range matches {
			names[i] = fmt.Sprintf("%q", m.Name)
		}
		return nil, fmt.Errorf(
			"ambiguous request, multiple delegation rules match (%s)",
			strings.Join(names, ", "))
	}

	return matches[0], nil
}