// New returns a RBAC structure.
// The default role structure will be used.
979139
func New() *RBAC {
	return &RBAC{
		roles:   make(Roles),
		parents: make(map[string]map[string]struct{}),
	}
}
163885
func New(config *Config, authorizer Authorizer) (*NodeAuthorizer, error) {
	utils.Logger.Info("starting the node authorization service",
		zap.String("listen", config.Listen),
		zap.String("version", Version))

	if authorizer == nil {
		return nil, errors.New("no authorizer")
	}

	if err := config.IsValid(); err != nil {
		return nil, fmt.Errorf("configuration error: %s", err)
	}

	return &NodeAuthorizer{
		authorizer: authorizer,
		config:     config,
	}, nil
}
1106419
func New(displayNameLen, roleNameLen, usernameLen int) func() (interface{}, error) {
	return func() (interface{}, error) {
		db := new(displayNameLen, roleNameLen, usernameLen)
		// Wrap the plugin with middleware to sanitize errors
		dbType := dbplugin.NewDatabaseErrorSanitizerMiddleware(db, db.SecretValues)

		return dbType, nil
	}
}
548477
func New(client RedisClient, key string, opts *Options) *Locker {
	var o Options
	if opts != nil {
		o = *opts
	}
	o.normalize()

	return &Locker{client: client, key: key, opts: o}
}
397913
func New(url string, options ...func(rpc *EthRPC)) *EthRPC {
	rpc := &EthRPC{
		url:    url,
		client: http.DefaultClient,
		log:    log.New(os.Stderr, "", log.LstdFlags),
	}
	for _, option := range options {
		option(rpc)
	}

	return rpc
}
342585
func New() (interface{}, error) {
	db := new()
	dbType := dbplugin.NewDatabaseErrorSanitizerMiddleware(db, db.secretValues)

	return dbType, nil
}
833944
func New(ctx context.Context, alias string, url *backend.URL, cfgdir string, agent *client.Client) (*Store, error) {
	cfg := &api.Config{
		Address: fmt.Sprintf("%s://%s:%s", url.Scheme, url.Host, url.Port),
	}
	// configure TLS, if necessary
	if err := configureTLS(url.Query, cfg); err != nil {
		return nil, err
	}

	client, err := api.NewClient(cfg)
	if err != nil {
		return nil, err
	}

	s := &Store{
		api:    client,
		alias:  alias,
		url:    url,
		path:   url.Path,
		cfgdir: cfgdir,
	}

	token := url.Query.Get("token")
	key := fmt.Sprintf("vault-%s-%s", alias, url.String())
	if token == "" {
		out.Debug(ctx, "Requesting token from secrets config: %s", key)
		t, err := s.loadSecret(ctx, key)
		if err != nil {
			return nil, errors.Wrapf(err, "failed to load token from secrets config: %s", err)
		}
		out.Debug(ctx, "Got token from secrets config: '%s'", t)
		token = t
	}
	out.Debug(ctx, "Vault-Token: '%s'", token)

	s.api.SetToken(token)

	// test connection and save token if it works
	if _, err := s.List(ctx, ""); err != nil {
		out.Debug(ctx, "Vault access not working. removing saved token")
		_ = s.eraseSecret
		return nil, err
	}
	out.Debug(ctx, "Vault access OK. saving token")
	if err := s.storeSecret(ctx, key, token); err != nil {
		return nil, err
	}

	return s, nil
}
787842
func New(rpcClnts []NetLocker, rpcOwnNode int) (*Dsync, error) {
	if len(rpcClnts) < 2 {
		return nil, errors.New("Dsync is not designed for less than 2 nodes")
	} else if len(rpcClnts) > 32 {
		return nil, errors.New("Dsync is not designed for more than 32 nodes")
	}

	if rpcOwnNode > len(rpcClnts) {
		return nil, errors.New("Index for own node is too large")
	}

	ds := &Dsync{}
	ds.dNodeCount = len(rpcClnts)

	// With odd number of nodes, write and read quorum is basically the same
	ds.dquorum = int(ds.dNodeCount/2) + 1
	ds.dquorumReads = int(math.Ceil(float64(ds.dNodeCount) / 2.0))
	ds.ownNode = rpcOwnNode

	// Initialize node name and rpc path for each NetLocker object.
	ds.rpcClnts = make([]NetLocker, ds.dNodeCount)
	copy(ds.rpcClnts, rpcClnts)

	return ds, nil
}
1295714
func New(metadata map[string]string) ([]*x509.Certificate, error) {
	roots := initSystemRoots()
	if len(roots) == 0 {
		return nil, errors.New("transport: unable to find system roots")
	}
	return roots, nil
}
308304
func New(pool *redis.Pool, src, id string) *DefaultWorker {
	heartbeater := heartbeat.New(
		id,
		fmt.Sprintf("%s:%s", src, "ticks"),
		defaultHeartInterval, pool)

	return &DefaultWorker{
		pool:           pool,
		availableTasks: queue.NewByteQueue(pool, src),
		workingTasks:   queue.NewDurableQueue(pool, src, getWorkingQueueName(src, id)),

		lifecycle: NewLifecycle(pool),
		detector:  heartbeater.Detector(),
		heart:     heartbeater.Heart(),
		janitor:   nilJanitor{},

		state: closed,
	}
}
595616
func New(params *stripe.IssuingDisputeParams) (*stripe.IssuingDispute, error) {
	return getC().New(params)
}
611697
func (m *residentManager) new() *Resident {
	id := m.residentCount.next()

	r := &Resident{
		id:             id,
		deregister:     func() { m.deregister(id) },
		nextResourceId: func() uint64 { return m.resourceCount.next() },
		workers:        make(map[uint64]worker.Worker),
	}

	m.mu.Lock()
	m.residents[r.id] = r
	m.mu.Unlock()

	return r
}
843341
func New(
	mutualAuth bool,
	filterQueue *fqconfig.FilterQueue,
	collector collector.EventCollector,
	serverID string,
	validity time.Duration,
	service packetprocessor.PacketProcessor,
	secrets secrets.Secrets,
	mode constants.ModeType,
	procMountPoint string,
	ExternalIPCacheTimeout time.Duration,
	packetLogs bool,
	tokenaccessor tokenaccessor.TokenAccessor,
	puFromContextID cache.DataStore,
	cfg *runtime.Configuration,
) *Datapath {

	if ExternalIPCacheTimeout <= 0 {
		var err error
		ExternalIPCacheTimeout, err = time.ParseDuration(enforcerconstants.DefaultExternalIPTimeout)
		if err != nil {
			ExternalIPCacheTimeout = time.Second
		}
	}

	if mode == constants.RemoteContainer || mode == constants.LocalServer {
		// Make conntrack liberal for TCP

		sysctlCmd, err := exec.LookPath("sysctl")
		if err != nil {
			zap.L().Fatal("sysctl command must be installed", zap.Error(err))
		}

		cmd := exec.Command(sysctlCmd, "-w", "net.netfilter.nf_conntrack_tcp_be_liberal=1")
		if err := cmd.Run(); err != nil {
			zap.L().Fatal("Failed to set conntrack options", zap.Error(err))
		}

		if mode == constants.LocalServer && !buildflags.IsLegacyKernel() {
			cmd = exec.Command(sysctlCmd, "-w", "net.ipv4.ip_early_demux=0")
			if err := cmd.Run(); err != nil {
				zap.L().Fatal("Failed to set early demux options", zap.Error(err))
			}
		}
	}

	contextIDFromTCPPort := portcache.NewPortCache("contextIDFromTCPPort")
	contextIDFromUDPPort := portcache.NewPortCache("contextIDFromUDPPort")

	udpSocketWriter, err := GetUDPRawSocket(afinetrawsocket.ApplicationRawSocketMark, "udp")
	if err != nil {
		zap.L().Fatal("Unable to create raw socket for udp packet transmission", zap.Error(err))
	}

	d := &Datapath{
		puFromMark:           cache.NewCache("puFromMark"),
		puFromUser:           cache.NewCache("puFromUser"),
		contextIDFromTCPPort: contextIDFromTCPPort,
		contextIDFromUDPPort: contextIDFromUDPPort,

		puFromContextID: puFromContextID,

		sourcePortConnectionCache: cache.NewCacheWithExpiration("sourcePortConnectionCache", time.Second*24),
		appOrigConnectionTracker:  cache.NewCacheWithExpiration("appOrigConnectionTracker", time.Second*24),
		appReplyConnectionTracker: cache.NewCacheWithExpiration("appReplyConnectionTracker", time.Second*24),
		netOrigConnectionTracker:  cache.NewCacheWithExpiration("netOrigConnectionTracker", time.Second*24),
		netReplyConnectionTracker: cache.NewCacheWithExpiration("netReplyConnectionTracker", time.Second*24),

		udpSourcePortConnectionCache: cache.NewCacheWithExpiration("udpSourcePortConnectionCache", time.Second*60),
		udpAppOrigConnectionTracker:  cache.NewCacheWithExpiration("udpAppOrigConnectionTracker", time.Second*60),
		udpAppReplyConnectionTracker: cache.NewCacheWithExpiration("udpAppReplyConnectionTracker", time.Second*60),
		udpNetOrigConnectionTracker:  cache.NewCacheWithExpiration("udpNetOrigConnectionTracker", time.Second*60),
		udpNetReplyConnectionTracker: cache.NewCacheWithExpiration("udpNetReplyConnectionTracker", time.Second*60),
		udpNatConnectionTracker:      cache.NewCacheWithExpiration("udpNatConnectionTracker", time.Second*60),
		udpFinPacketTracker:          cache.NewCacheWithExpiration("udpFinPacketTracker", time.Second*60),

		packetTracingCache:     cache.NewCache("PacketTracingCache"),
		targetNetworks:         acls.NewACLCache(),
		ExternalIPCacheTimeout: ExternalIPCacheTimeout,
		filterQueue:            filterQueue,
		mutualAuthorization:    mutualAuth,
		service:                service,
		collector:              collector,
		tokenAccessor:          tokenaccessor,
		secrets:                secrets,
		ackSize:                secrets.AckSize(),
		mode:                   mode,
		procMountPoint:         procMountPoint,
		packetLogs:             packetLogs,
		udpSocketWriter:        udpSocketWriter,
		puToPortsMap:           map[string]map[string]bool{},
	}

	if err = d.SetTargetNetworks(cfg); err != nil {
		zap.L().Error("Error adding target networks to the ACLs", zap.Error(err))
	}

	packet.PacketLogLevel = packetLogs

	d.nflogger = nflog.NewNFLogger(11, 10, d.puInfoDelegate, collector)

	if mode != constants.RemoteContainer {
		go d.autoPortDiscovery()
	}

	return d
}
950490
func New(realm string, credentials map[string][]string) func(http.Handler) http.Handler {
	return func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			username, password, ok := r.BasicAuth()
			if !ok {
				unauthorized(w, realm)
				return
			}

			validPasswords, userFound := credentials[username]
			if !userFound {
				unauthorized(w, realm)
				return
			}

			for _, validPassword := range validPasswords {
				if password == validPassword {
					next.ServeHTTP(w, r)
					return
				}
			}

			unauthorized(w, realm)
		})
	}
}
225011
func New(db *gorm.DB, keyPairs ...[]byte) *Store {
	return NewOptions(db, Options{}, keyPairs...)
}
86966
func New(endpoint string) *Auth {
	auth := &Auth{Endpoint: endpoint}
	auth.ensureDefaults()
	return auth
}
1259474
func New(address, authType string, params map[string]string) (*Client, error) {
	if authType == "" {
		return nil, errors.New("you have to set the auth type when using the vault backend")
	}
	log.Info("Vault authentication backend set to %s", authType)
	conf, err := getConfig(address, params["cert"], params["key"], params["caCert"])

	if err != nil {
		return nil, err
	}

	c, err := vaultapi.NewClient(conf)
	if err != nil {
		return nil, err
	}

	if err := authenticate(c, authType, params); err != nil {
		return nil, err
	}
	return &Client{c}, nil
}