// GetIntermediateCerts parses a list of x509 Certificates and returns all of the
// ones marked as a CA, to be used as intermediates
492330
func GetIntermediateCerts(certs []*x509.Certificate) []*x509.Certificate {
	var intCerts []*x509.Certificate
	for _, cert := range certs {
		if cert.IsCA {
			intCerts = append(intCerts, cert)
		}
	}
	return intCerts
}
1130506
func getCRLResponses(cert certificate.Certificate) ([][]byte, error) {
	var wg sync.WaitGroup
	var out [][]byte

	crlPoints := cert.X509v3Extensions.CRLDistributionPoints
	wg.Add(len(crlPoints))
	for i := range crlPoints {
		go func(point string, wg *sync.WaitGroup) {
			defer wg.Done()

			resp, err := httpClient.Get(point)
			if err != nil {
				return
			}
			defer resp.Body.Close()
			bs, err := ioutil.ReadAll(resp.Body)
			if err != nil {
				return
			}
			out = append(out, bs)
		}(crlPoints[i], &wg)
	}
	wg.Wait()

	if len(out) > 0 {
		return out, nil
	}
	return nil, fmt.Errorf("Unable to load CRL data for certificate %s", cert.Subject)
}
325604
func (p *Plugin) GetInterfaceStats() status.InterfaceStats {
	p.access.Lock()
	defer p.access.Unlock()

	return *p.interfaceStat
}
1021124
func (req *IdpAuthnRequest) getSPEncryptionCert() (*x509.Certificate, error) {
	certStr := ""
	for _, keyDescriptor := range req.SPSSODescriptor.KeyDescriptors {
		if keyDescriptor.Use == "encryption" {
			certStr = keyDescriptor.KeyInfo.Certificate
			break
		}
	}

	// If there are no certs explicitly labeled for encryption, return the first
	// non-empty cert we find.
	if certStr == "" {
		for _, keyDescriptor := range req.SPSSODescriptor.KeyDescriptors {
			if keyDescriptor.Use == "" && keyDescriptor.KeyInfo.Certificate != "" {
				certStr = keyDescriptor.KeyInfo.Certificate
				break
			}
		}
	}

	if certStr == "" {
		return nil, os.ErrNotExist
	}

	// cleanup whitespace and re-encode a PEM
	certStr = regexp.MustCompile(`\s+`).ReplaceAllString(certStr, "")
	certBytes, err := base64.StdEncoding.DecodeString(certStr)
	if err != nil {
		return nil, fmt.Errorf("cannot decode certificate base64: %v", err)
	}
	cert, err := x509.ParseCertificate(certBytes)
	if err != nil {
		return nil, fmt.Errorf("cannot parse certificate: %v", err)
	}
	return cert, nil
}
580930
func (c *Certs) GetCertificate(hello *tls.ClientHelloInfo) (*tls.Certificate, error) {
	c.RLock()
	defer c.RUnlock()
	return &c.cert, nil
}
785422
func (sd *SignedData) X509Certificates() ([]*x509.Certificate, error) {
	// Certificates field is optional. Handle missing value.
	if sd.Certificates == nil {
		return nil, nil
	}

	// Empty set
	if len(sd.Certificates) == 0 {
		return []*x509.Certificate{}, nil
	}

	certs := make([]*x509.Certificate, 0, len(sd.Certificates))
	for _, raw := range sd.Certificates {
		if raw.Class != asn1.ClassUniversal || raw.Tag != asn1.TagSequence {
			return nil, ErrUnsupported
		}

		x509, err := x509.ParseCertificate(raw.FullBytes)
		if err != nil {
			return nil, err
		}

		certs = append(certs, x509)
	}

	return certs, nil
}
880889
func (a *AuthServer) GetAllTunnelConnections(opts ...services.MarshalOption) (conns []services.TunnelConnection, err error) {
	return a.GetCache().GetAllTunnelConnections(opts...)
}
462130
func fetchCertIDs() ([]certID, error) {
	resp, err := http.Get("https://support.apple.com/en-us/HT204132")
	if err != nil {
		return nil, err
	}
	defer resp.Body.Close()
	body, err := ioutil.ReadAll(resp.Body)
	if err != nil {
		return nil, err
	}
	text := string(body)
	text = text[strings.Index(text, "<section id=trusted"):]
	text = text[:strings.Index(text, "</section>")]

	lines := strings.Split(text, "\n")
	var ids []certID
	var id certID
	for i, ln := range lines {
		if i == len(lines)-1 {
			break
		}
		const sn = "Serial Number:"
		if ln == sn {
			id.serialNumber = "0x" + strings.Replace(strings.TrimSpace(lines[i+1]), ":", "", -1)
			continue
		}
		if strings.HasPrefix(ln, sn) {
			// extract hex value from parentheses.
			id.serialNumber = ln[strings.Index(ln, "(")+1 : len(ln)-1]
			continue
		}
		if strings.TrimSpace(ln) == "X509v3 Subject Key Identifier:" {
			id.subjectKeyID = "0x" + strings.Replace(strings.TrimSpace(lines[i+1]), ":", "", -1)
			ids = append(ids, id)
			id = certID{}
		}
	}
	return ids, nil
}
1201104
func GetInterfaces() (Interfaces, error) {
	interfaces, err := net.Interfaces()
	if err != nil {
		Logln("Can't get interfaces.", err)
		return nil, err
	}
	var ifaces Interfaces
	for _, iface := range interfaces {
		ifaces = append(ifaces, Interface(iface))
	}
	return ifaces, nil
}
931561
func (c *Conn) GetVerifyResults() error {
	result := C.SSL_get_verify_result(c.ssl)
	if int(result) != 0 {
		return errors.New(C.GoString(
			C.X509_verify_cert_error_string(result)))
	}
	return nil
}
159995
func (s *InstanceSecrets) GetCAs() []services.CertAuthority {
	hostCA := services.NewCertAuthority(services.HostCA, s.SiteName, [][]byte{s.PrivKey}, [][]byte{s.PubKey}, []string{})
	hostCA.SetTLSKeyPairs([]services.TLSKeyPair{{Cert: s.TLSCACert, Key: s.PrivKey}})
	return []services.CertAuthority{
		hostCA,
		services.NewCertAuthority(services.UserCA, s.SiteName, [][]byte{s.PrivKey}, [][]byte{s.PubKey}, []string{services.RoleNameForCertAuthority(s.SiteName)}),
	}
}
722166
func (r Network_Component_Firewall) GetRules() (resp []datatypes.Network_Component_Firewall_Rule, err error) {
	err = r.Session.DoRequest("SoftLayer_Network_Component_Firewall", "getRules", nil, &r.Options, &resp)
	return
}
1233354
func (g *gatewayCfg) getConnAttempts() int {
	g.Lock()
	ca := g.connAttempts
	g.Unlock()
	return ca
}
1315381
func getCachedCerts(c context.Context) (*signing.PublicCertificates, error) {
	v, err := certCache.Fetch(c, func(interface{}) (interface{}, time.Duration, error) {
		aeCerts, err := info.PublicCertificates(c)
		if err != nil {
			return nil, 0, err
		}
		certs := make([]signing.Certificate, len(aeCerts))
		for i, ac := range aeCerts {
			certs[i] = signing.Certificate{
				KeyName:            ac.KeyName,
				X509CertificatePEM: string(ac.Data),
			}
		}
		inf, err := getCachedInfo(c)
		if err != nil {
			return nil, 0, err
		}
		return &signing.PublicCertificates{
			AppID:              inf.AppID,
			ServiceAccountName: inf.ServiceAccountName,
			Certificates:       certs,
			Timestamp:          signing.JSONTime(clock.Now(c)),
		}, time.Hour, nil
	})
	if err != nil {
		return nil, err
	}
	return v.(*signing.PublicCertificates), nil
}
640361
func (c *Cache) GetCertAuthorities(caType services.CertAuthType, loadSigningKeys bool, opts ...services.MarshalOption) ([]services.CertAuthority, error) {
	return c.trustCache.GetCertAuthorities(caType, loadSigningKeys, services.AddOptions(opts, services.SkipValidation())...)
}
99374
func getCertExtensions(cert *x509.Certificate) Extensions {
	// initialize []string to store them as `[]` instead of null
	san := make([]string, 0)
	san = append(san, cert.DNSNames...)
	crld := make([]string, 0)
	crld = append(crld, cert.CRLDistributionPoints...)
	constraints, _ := certconstraints.Get(cert)
	ipNetSliceToStringSlice := func(in []*net.IPNet) []string {
		out := make([]string, 0)
		for _, ipnet := range in {
			out = append(out, ipnet.String())
		}
		return out
	}
	permittedIPAddresses := ipNetSliceToStringSlice(constraints.PermittedIPRanges)
	excludedIPAddresses := ipNetSliceToStringSlice(constraints.ExcludedIPRanges)
	ext := Extensions{
		AuthorityKeyId:           base64.StdEncoding.EncodeToString(cert.AuthorityKeyId),
		SubjectKeyId:             base64.StdEncoding.EncodeToString(cert.SubjectKeyId),
		KeyUsage:                 getKeyUsages(cert),
		ExtendedKeyUsage:         getExtKeyUsages(cert),
		ExtendedKeyUsageOID:      getExtKeyUsageOIDs(cert),
		PolicyIdentifiers:        getPolicyIdentifiers(cert),
		SubjectAlternativeName:   san,
		CRLDistributionPoints:    crld,
		PermittedDNSDomains:      constraints.PermittedDNSDomains,
		ExcludedDNSDomains:       constraints.ExcludedDNSDomains,
		PermittedIPAddresses:     permittedIPAddresses,
		ExcludedIPAddresses:      excludedIPAddresses,
		IsTechnicallyConstrained: certconstraints.IsTechnicallyConstrained(cert),
	}
	return ext
}
330408
func TLSCerts(ca CertAuthority) [][]byte {
	pairs := ca.GetTLSKeyPairs()
	out := make([][]byte, len(pairs))
	for i, pair := range pairs {
		out[i] = append([]byte{}, pair.Cert...)
	}
	return out
}