//export certificateCheckCallback
482558
func certificateCheckCallback(_cert *C.git_cert, _valid C.int, _host *C.char, data unsafe.Pointer) int {
	callbacks, _ := pointerHandles.Get(data).(*RemoteCallbacks)
	// if there's no callback set, we need to make sure we fail if the library didn't consider this cert valid
	if callbacks.CertificateCheckCallback == nil {
		if _valid == 1 {
			return 0
		} else {
			return C.GIT_ECERTIFICATE
		}
	}
	host := C.GoString(_host)
	valid := _valid != 0

	var cert Certificate
	if _cert.cert_type == C.GIT_CERT_X509 {
		cert.Kind = CertificateX509
		ccert := (*C.git_cert_x509)(unsafe.Pointer(_cert))
		x509_certs, err := x509.ParseCertificates(C.GoBytes(ccert.data, C.int(ccert.len)))
		if err != nil {
			return C.GIT_EUSER
		}

		// we assume there's only one, which should hold true for any web server we want to talk to
		cert.X509 = x509_certs[0]
	} else if _cert.cert_type == C.GIT_CERT_HOSTKEY_LIBSSH2 {
		cert.Kind = CertificateHostkey
		ccert := (*C.git_cert_hostkey)(unsafe.Pointer(_cert))
		cert.Hostkey.Kind = HostkeyKind(ccert._type)
		C.memcpy(unsafe.Pointer(&cert.Hostkey.HashMD5[0]), unsafe.Pointer(&ccert.hash_md5[0]), C.size_t(len(cert.Hostkey.HashMD5)))
		C.memcpy(unsafe.Pointer(&cert.Hostkey.HashSHA1[0]), unsafe.Pointer(&ccert.hash_sha1[0]), C.size_t(len(cert.Hostkey.HashSHA1)))
	} else {
		cstr := C.CString("Unsupported certificate type")
		C.giterr_set_str(C.GITERR_NET, cstr)
		C.free(unsafe.Pointer(cstr))
		return -1 // we don't support anything else atm
	}

	return int(callbacks.CertificateCheckCallback(&cert, valid, host))
}
160548
func Check(d *certdata.Data) *errors.Errors {
	var e = errors.New(nil)

	switch d.Type {
	case "EV":
		if strings.LastIndex(d.Cert.Subject.CommonName, "*") > -1 {
			e.Err("Certificate should not contain a wildcard")
		}
		for _, n := range d.Cert.DNSNames {
			if strings.LastIndex(n, "*") > -1 {
				e.Err("Certificate subjectAltName '%s' should not contain a wildcard", n)
			}
		}
	case "DV", "OV":
		if strings.LastIndex(d.Cert.Subject.CommonName, "*") > 0 {
			e.Err("Certificate wildcard is only allowed as prefix")
		}
		for _, n := range d.Cert.DNSNames {
			if strings.LastIndex(n, "*") > 0 {
				e.Err("Certificate subjectAltName '%s' wildcard is only allowed as prefix", n)
			}
		}
	}

	return e
}
928724
func Check(ex pkix.Extension, d *certdata.Data) *errors.Errors {
	var e = errors.New(nil)

	if ex.Critical {
		e.Err("SubjectKeyId extension set critical")
	}

	return e
}
56820
func (f *StringForwarder) invokeCallback(callback func(string), msg string) {
	f.mu.Unlock()
	defer f.mu.Lock()
	callback(msg)
}
437811
func (c *Certificate) CheckCRLSignature(crl *pkix.CertificateList) error {
	algo := getSignatureAlgorithmFromAI(crl.SignatureAlgorithm)
	return c.CheckSignature(algo, crl.TBSCertList.Raw, crl.SignatureValue.RightAlign())
}
1018571
func checkExpiringCerts(chain []*x509.Certificate) (expiringIntermediates []int) {
	now := time.Now()
	for i, cert := range chain {
		if cert.NotAfter.Sub(now).Hours() < 720 {
			expiringIntermediates = append(expiringIntermediates, i)
		}
	}
	return
}
1227623
func (ch Challenge) CheckConsistencyForClientOffer() error {
	if err := ch.checkConsistency(); err != nil {
		return err
	}

	// Before completion, the key authorization field should be empty
	if ch.ProvidedKeyAuthorization != "" {
		return fmt.Errorf("A response to this challenge was already submitted.")
	}
	return nil
}
1004416
func SetHealthcheckInterval(interval time.Duration) ClientOptionFunc {
	return func(c *Client) error {
		c.healthcheckInterval = interval
		return nil
	}
}
1186424
func go_ssl_verify_cb_thunk(p unsafe.Pointer, ok C.int, ctx *C.X509_STORE_CTX) C.int {
	defer func() {
		if err := recover(); err != nil {
			logger.Critf("openssl: verify callback panic'd: %v", err)
			os.Exit(1)
		}
	}()
	verify_cb := (*SSL)(p).verify_cb
	// set up defaults just in case verify_cb is nil
	if verify_cb != nil {
		store := &CertificateStoreCtx{ctx: ctx}
		if verify_cb(ok == 1, store) {
			ok = 1
		} else {
			ok = 0
		}
	}
	return ok
}
497843
func (m *MockInterface) Certificates() v1beta14.CertificatesV1beta1Interface {
	ret := m.ctrl.Call(m, "Certificates")
	ret0, _ := ret[0].(v1beta14.CertificatesV1beta1Interface)
	return ret0
}
1122838
func (h *AuthHandlers) hostKeyCallback(hostname string, remote net.Addr, key ssh.PublicKey) error {
	// If strict host key checking is enabled, reject host key fallback.
	clusterConfig, err := h.AccessPoint.GetClusterConfig()
	if err != nil {
		return trace.Wrap(err)
	}
	if clusterConfig.GetProxyChecksHostKeys() == services.HostKeyCheckYes {
		return trace.AccessDenied("remote host presented a public key, expected a host certificate")
	}

	// If strict host key checking is not enabled, log that Teleport trusted an
	// insecure key, but allow the request to go through.
	h.Warn("Insecure configuration! Strict host key checking disabled, allowing login without checking host key of type %v.", key.Type())
	return nil
}
1118742
func CheckCertificate(c context.Context, cert *x509.Certificate) (*certconfig.CA, error) {
	checker, err := GetCertChecker(c, cert.Issuer.CommonName)
	if err != nil {
		return nil, err
	}
	return checker.CheckCertificate(c, cert)
}
90289
func (h *hostKeyChecker) Check() {
	defer func() {
		// send a finished message unless we're already stopped and nobody
		// is listening
		if h.Finished != nil {
			select {
			case h.Finished <- struct{}{}:
			case <-h.Stop:
			}
		}
	}()
	// TODO(jam): 2017-01-24 One limitation of our algorithm, is that we don't
	// try to limit the negotiation of the keys to our set of possible keys.
	// For example, say we only know about the RSA key for the remote host, but
	// it has been updated to use a ECDSA key as well. Gocrypto/ssh might
	// negotiate to use the "more secure" ECDSA key and we will see that
	// as an invalid key.
	sshconfig := &ssh.ClientConfig{
		HostKeyCallback: h.hostKeyCallback,
	}
	addr := h.HostPort.NetAddr()
	logger.Debugf("dialing %s to check host keys", addr)
	conn, err := h.Dialer.Dial("tcp", addr)
	if err != nil {
		logger.Debugf("dial %s failed with: %v", addr, err)
		return
	}
	// No need to do the key exchange if we're already stopping
	select {
	case <-h.Stop:
		conn.Close()
		return
	default:
	}
	logger.Debugf("connected to %s, initiating ssh handshake", addr)
	// NewClientConn will close the underlying net.Conn if it gets an error
	client, _, _, err := ssh.NewClientConn(conn, addr, sshconfig)
	if err == nil {
		// We don't expect this case, because we don't support Auth,
		// but make sure to close it anyway.
		client.Close()
	} else {
		// no need to log these two messages, that's already been done
		// in hostKeyCallback
		if !strings.Contains(err.Error(), hostKeyAccepted.Error()) &&
			!strings.Contains(err.Error(), hostKeyNotInList.Error()) {
			logger.Debugf("%v", err)
		}
	}
}
18376
func Check(d *certdata.Data) *errors.Errors {
	var e = errors.New(nil)

	if d.Cert.SerialNumber.Cmp(big.NewInt(0)) == -1 {
		e.Err("Certificate serial number MUST be a positive integer (%d)", d.Cert.SerialNumber)
	}

	// Remaining checks are not relevant for CA certificates
	if d.Cert.IsCA {
		return e
	}

	// https://cabforum.org/2016/07/08/ballot-164/
	if d.Cert.NotBefore.After(time.Date(2016, 9, 30, 0, 0, 0, 0, time.UTC)) {
		if d.Cert.SerialNumber.BitLen() < 64 {
			e.Err("Certificate serial number should be 64 bits but contains %d bits", d.Cert.SerialNumber.BitLen())
		}
	} else {
		// all new end-entity certificates must contain at least 20 bits of unpredictable random data (preferably in the serial number).
		if d.Cert.SerialNumber.BitLen() < 20 {
			e.Warning("Certificate serial number must contain at least 20 bits of unpredictable random data, found only %d bits", d.Cert.SerialNumber.BitLen())
		}
	}

	return nil
}
143414
func scanCallbackFunc(message C.int, messageData, userData unsafe.Pointer) C.int {
	cbc, ok := callbackData.Get(userData).(*scanCallbackContainer)
	if !ok {
		return C.CALLBACK_ERROR
	}
	var abort bool
	var err error
	switch message {
	case C.CALLBACK_MSG_RULE_MATCHING:
		if c, ok := cbc.ScanCallback.(ScanCallbackMatch); ok {
			r := (*C.YR_RULE)(messageData)
			abort, err = c.RuleMatching(&Rule{r})
		}
	case C.CALLBACK_MSG_RULE_NOT_MATCHING:
		if c, ok := cbc.ScanCallback.(ScanCallbackNoMatch); ok {
			r := (*C.YR_RULE)(messageData)
			abort, err = c.RuleNotMatching(&Rule{r})
		}
	case C.CALLBACK_MSG_SCAN_FINISHED:
		if c, ok := cbc.ScanCallback.(ScanCallbackFinished); ok {
			abort, err = c.ScanFinished()
		}
	case C.CALLBACK_MSG_IMPORT_MODULE:
		if c, ok := cbc.ScanCallback.(ScanCallbackModuleImport); ok {
			mi := (*C.YR_MODULE_IMPORT)(messageData)
			var buf []byte
			if buf, abort, err = c.ImportModule(C.GoString(mi.module_name)); len(buf) == 0 {
				break
			}
			cbuf := C.calloc(1, C.size_t(len(buf)))
			outbuf := make([]byte, 0)
			hdr := (*reflect.SliceHeader)(unsafe.Pointer(&outbuf))
			hdr.Data, hdr.Len = uintptr(cbuf), len(buf)
			copy(outbuf, buf)
			mi.module_data, mi.module_data_size = unsafe.Pointer(&outbuf[0]), C.size_t(len(outbuf))
			cbc.addCPointer(cbuf)
		}
	case C.CALLBACK_MSG_MODULE_IMPORTED:
		if c, ok := cbc.ScanCallback.(ScanCallbackModuleImportFinished); ok {
			obj := (*C.YR_OBJECT)(messageData)
			abort, err = c.ModuleImported(&Object{obj})
		}
	}

	if err != nil {
		return C.CALLBACK_ERROR
	}
	if abort {
		return C.CALLBACK_ABORT
	}
	return C.CALLBACK_CONTINUE
}
505952
func webTokenCallback(jwtToken *jwtgo.Token) (interface{}, error) {
	if _, ok := jwtToken.Method.(*jwtgo.SigningMethodHMAC); !ok {
		return nil, fmt.Errorf("Unexpected signing method: %v", jwtToken.Header["alg"])
	}

	if err := jwtToken.Claims.Valid(); err != nil {
		return nil, errAuthentication
	}

	if claims, ok := jwtToken.Claims.(*jwtgo.StandardClaims); ok {
		if claims.Subject == globalServerConfig.GetCredential().AccessKey {
			return []byte(globalServerConfig.GetCredential().SecretKey), nil
		}
		if globalIAMSys == nil {
			return nil, errInvalidAccessKeyID
		}
		cred, ok := globalIAMSys.GetUser(claims.Subject)
		if !ok {
			return nil, errInvalidAccessKeyID
		}
		return []byte(cred.SecretKey), nil
	}

	return nil, errAuthentication
}
507622
func Check(d *certdata.Data) *errors.Errors {
	var e = errors.New(nil)

	if len(d.Cert.ExtKeyUsage) == 0 && len(d.Cert.UnknownExtKeyUsage) == 0 {
		e.Err("Certificate contains no extended key usage")
		return e
	}

	for _, ku := range d.Cert.ExtKeyUsage {
		switch d.Type {
		case "DV", "OV", "EV":
			if ku != x509.ExtKeyUsageServerAuth && ku != x509.ExtKeyUsageClientAuth && ku != x509.ExtKeyUsageMicrosoftServerGatedCrypto {
				e.Err("Certificate contains an extended key usage different from ServerAuth, ClientAuth or ServerGatedCrypto")
				return e
			}
		case "PS":
			if ku != x509.ExtKeyUsageClientAuth && ku != x509.ExtKeyUsageEmailProtection {
				e.Err("Certificate contains an extended key usage different from ClientAuth or EmailProtection")
				return e
			}
		case "CS":
			if ku != x509.ExtKeyUsageCodeSigning {
				e.Err("Certificate contains an extended key usage different from ClientAuth or EmailProtection")
				return e
			}
		}
	}

	if len(d.Cert.UnknownExtKeyUsage) > 0 {
		// encryptedFileSystem 1.3.6.1.4.1.311.10.3.4
		//return fmt.Errorf("%s Certificate contains an unknown extented key usage", d.Type)
	}

	return e
}