xds-api 0.2.0

// This file is @generated by prost-build.
/// \[#next-free-field: 6\]
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct TlsParameters {
    /// Minimum TLS protocol version. By default, it's ``TLSv1_2`` for both clients and servers.
    ///
    /// TLS protocol versions below TLSv1_2 require setting compatible ciphers with the
    /// ``cipher_suites`` setting as the default ciphers no longer include compatible ciphers.
    ///
    /// .. attention::
    ///
    ///    Using TLS protocol versions below TLSv1_2 has serious security considerations and risks.
    #[prost(enumeration = "tls_parameters::TlsProtocol", tag = "1")]
    pub tls_minimum_protocol_version: i32,
    /// Maximum TLS protocol version. By default, it's ``TLSv1_2`` for clients and ``TLSv1_3`` for
    /// servers.
    #[prost(enumeration = "tls_parameters::TlsProtocol", tag = "2")]
    pub tls_maximum_protocol_version: i32,
    /// If specified, the TLS listener will only support the specified `cipher list
    /// <<https://commondatastorage.googleapis.com/chromium-boringssl-docs/ssl.h.html#Cipher-suite-configuration>`_>
    /// when negotiating TLS 1.0-1.2 (this setting has no effect when negotiating TLS 1.3).
    ///
    /// If not specified, a default list will be used. Defaults are different for server (downstream) and
    /// client (upstream) TLS configurations.
    /// Defaults will change over time in response to security considerations; If you care, configure
    /// it instead of using the default.
    ///
    /// In non-FIPS builds, the default server cipher list is:
    ///
    /// .. code-block:: none
    ///
    ///    \[ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305\]
    ///    \[ECDHE-RSA-AES128-GCM-SHA256|ECDHE-RSA-CHACHA20-POLY1305\]
    ///    ECDHE-ECDSA-AES256-GCM-SHA384
    ///    ECDHE-RSA-AES256-GCM-SHA384
    ///
    /// In builds using :ref:`BoringSSL FIPS <arch_overview_ssl_fips>`, the default server cipher list is:
    ///
    /// .. code-block:: none
    ///
    ///    ECDHE-ECDSA-AES128-GCM-SHA256
    ///    ECDHE-RSA-AES128-GCM-SHA256
    ///    ECDHE-ECDSA-AES256-GCM-SHA384
    ///    ECDHE-RSA-AES256-GCM-SHA384
    ///
    /// In non-FIPS builds, the default client cipher list is:
    ///
    /// .. code-block:: none
    ///
    ///    \[ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305\]
    ///    \[ECDHE-RSA-AES128-GCM-SHA256|ECDHE-RSA-CHACHA20-POLY1305\]
    ///    ECDHE-ECDSA-AES256-GCM-SHA384
    ///    ECDHE-RSA-AES256-GCM-SHA384
    ///
    /// In builds using :ref:`BoringSSL FIPS <arch_overview_ssl_fips>`, the default client cipher list is:
    ///
    /// .. code-block:: none
    ///
    ///    ECDHE-ECDSA-AES128-GCM-SHA256
    ///    ECDHE-RSA-AES128-GCM-SHA256
    ///    ECDHE-ECDSA-AES256-GCM-SHA384
    ///    ECDHE-RSA-AES256-GCM-SHA384
    #[prost(string, repeated, tag = "3")]
    pub cipher_suites: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
    /// If specified, the TLS connection will only support the specified ECDH
    /// curves. If not specified, the default curves will be used.
    ///
    /// In non-FIPS builds, the default curves are:
    ///
    /// .. code-block:: none
    ///
    ///    X25519
    ///    P-256
    ///
    /// In builds using :ref:`BoringSSL FIPS <arch_overview_ssl_fips>`, the default curve is:
    ///
    /// .. code-block:: none
    ///
    ///    P-256
    #[prost(string, repeated, tag = "4")]
    pub ecdh_curves: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
    /// If specified, the TLS connection will only support the specified signature algorithms.
    /// The list is ordered by preference.
    /// If not specified, the default signature algorithms defined by BoringSSL will be used.
    ///
    /// Default signature algorithms selected by BoringSSL (may be out of date):
    ///
    /// .. code-block:: none
    ///
    ///    ecdsa_secp256r1_sha256
    ///    rsa_pss_rsae_sha256
    ///    rsa_pkcs1_sha256
    ///    ecdsa_secp384r1_sha384
    ///    rsa_pss_rsae_sha384
    ///    rsa_pkcs1_sha384
    ///    rsa_pss_rsae_sha512
    ///    rsa_pkcs1_sha512
    ///    rsa_pkcs1_sha1
    ///
    /// Signature algorithms supported by BoringSSL (may be out of date):
    ///
    /// .. code-block:: none
    ///
    ///    rsa_pkcs1_sha256
    ///    rsa_pkcs1_sha384
    ///    rsa_pkcs1_sha512
    ///    ecdsa_secp256r1_sha256
    ///    ecdsa_secp384r1_sha384
    ///    ecdsa_secp521r1_sha512
    ///    rsa_pss_rsae_sha256
    ///    rsa_pss_rsae_sha384
    ///    rsa_pss_rsae_sha512
    ///    ed25519
    ///    rsa_pkcs1_sha1
    ///    ecdsa_sha1
    #[prost(string, repeated, tag = "5")]
    pub signature_algorithms: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
}
/// Nested message and enum types in `TlsParameters`.
pub mod tls_parameters {
    #[derive(
        Clone,
        Copy,
        Debug,
        PartialEq,
        Eq,
        Hash,
        PartialOrd,
        Ord,
        ::prost::Enumeration
    )]
    #[repr(i32)]
    pub enum TlsProtocol {
        /// Envoy will choose the optimal TLS version.
        TlsAuto = 0,
        /// TLS 1.0
        TlSv10 = 1,
        /// TLS 1.1
        TlSv11 = 2,
        /// TLS 1.2
        TlSv12 = 3,
        /// TLS 1.3
        TlSv13 = 4,
    }
    impl TlsProtocol {
        /// String value of the enum field names used in the ProtoBuf definition.
        ///
        /// The values are not transformed in any way and thus are considered stable
        /// (if the ProtoBuf definition does not change) and safe for programmatic use.
        pub fn as_str_name(&self) -> &'static str {
            match self {
                Self::TlsAuto => "TLS_AUTO",
                Self::TlSv10 => "TLSv1_0",
                Self::TlSv11 => "TLSv1_1",
                Self::TlSv12 => "TLSv1_2",
                Self::TlSv13 => "TLSv1_3",
            }
        }
        /// Creates an enum from field names used in the ProtoBuf definition.
        pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
            match value {
                "TLS_AUTO" => Some(Self::TlsAuto),
                "TLSv1_0" => Some(Self::TlSv10),
                "TLSv1_1" => Some(Self::TlSv11),
                "TLSv1_2" => Some(Self::TlSv12),
                "TLSv1_3" => Some(Self::TlSv13),
                _ => None,
            }
        }
    }
}
impl ::prost::Name for TlsParameters {
    const NAME: &'static str = "TlsParameters";
    const PACKAGE: &'static str = "envoy.extensions.transport_sockets.tls.v3";
    fn full_name() -> ::prost::alloc::string::String {
        "envoy.extensions.transport_sockets.tls.v3.TlsParameters".into()
    }
    fn type_url() -> ::prost::alloc::string::String {
        "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.TlsParameters"
            .into()
    }
}
/// BoringSSL private key method configuration. The private key methods are used for external
/// (potentially asynchronous) signing and decryption operations. Some use cases for private key
/// methods would be TPM support and TLS acceleration.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct PrivateKeyProvider {
    /// Private key method provider name. The name must match a
    /// supported private key method provider type.
    #[prost(string, tag = "1")]
    pub provider_name: ::prost::alloc::string::String,
    /// If the private key provider isn't available (eg. the required hardware capability doesn't existed),
    /// Envoy will fallback to the BoringSSL default implementation when the ``fallback`` is true.
    /// The default value is ``false``.
    #[prost(bool, tag = "4")]
    pub fallback: bool,
    /// Private key method provider specific configuration.
    #[prost(oneof = "private_key_provider::ConfigType", tags = "3")]
    pub config_type: ::core::option::Option<private_key_provider::ConfigType>,
}
/// Nested message and enum types in `PrivateKeyProvider`.
pub mod private_key_provider {
    /// Private key method provider specific configuration.
    #[derive(Clone, PartialEq, ::prost::Oneof)]
    pub enum ConfigType {
        #[prost(message, tag = "3")]
        TypedConfig(super::super::super::super::super::super::google::protobuf::Any),
    }
}
impl ::prost::Name for PrivateKeyProvider {
    const NAME: &'static str = "PrivateKeyProvider";
    const PACKAGE: &'static str = "envoy.extensions.transport_sockets.tls.v3";
    fn full_name() -> ::prost::alloc::string::String {
        "envoy.extensions.transport_sockets.tls.v3.PrivateKeyProvider".into()
    }
    fn type_url() -> ::prost::alloc::string::String {
        "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.PrivateKeyProvider"
            .into()
    }
}
/// \[#next-free-field: 9\]
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct TlsCertificate {
    /// The TLS certificate chain.
    ///
    /// If ``certificate_chain`` is a filesystem path, a watch will be added to the
    /// parent directory for any file moves to support rotation. This currently
    /// only applies to dynamic secrets, when the ``TlsCertificate`` is delivered via
    /// SDS.
    #[prost(message, optional, tag = "1")]
    pub certificate_chain: ::core::option::Option<
        super::super::super::super::config::core::v3::DataSource,
    >,
    /// The TLS private key.
    ///
    /// If ``private_key`` is a filesystem path, a watch will be added to the parent
    /// directory for any file moves to support rotation. This currently only
    /// applies to dynamic secrets, when the ``TlsCertificate`` is delivered via SDS.
    #[prost(message, optional, tag = "2")]
    pub private_key: ::core::option::Option<
        super::super::super::super::config::core::v3::DataSource,
    >,
    /// ``Pkcs12`` data containing TLS certificate, chain, and private key.
    ///
    /// If ``pkcs12`` is a filesystem path, the file will be read, but no watch will
    /// be added to the parent directory, since ``pkcs12`` isn't used by SDS.
    /// This field is mutually exclusive with ``certificate_chain``, ``private_key`` and ``private_key_provider``.
    /// This can't be marked as ``oneof`` due to API compatibility reasons. Setting
    /// both :ref:`private_key <envoy_v3_api_field_extensions.transport_sockets.tls.v3.TlsCertificate.private_key>`,
    /// :ref:`certificate_chain <envoy_v3_api_field_extensions.transport_sockets.tls.v3.TlsCertificate.certificate_chain>`,
    /// or :ref:`private_key_provider <envoy_v3_api_field_extensions.transport_sockets.tls.v3.TlsCertificate.private_key_provider>`
    /// and :ref:`pkcs12 <envoy_v3_api_field_extensions.transport_sockets.tls.v3.TlsCertificate.pkcs12>`
    /// fields will result in an error. Use :ref:`password
    /// <envoy_v3_api_field_extensions.transport_sockets.tls.v3.TlsCertificate.password>`
    /// to specify the password to unprotect the ``PKCS12`` data, if necessary.
    #[prost(message, optional, tag = "8")]
    pub pkcs12: ::core::option::Option<
        super::super::super::super::config::core::v3::DataSource,
    >,
    /// If specified, updates of file-based ``certificate_chain`` and ``private_key``
    /// sources will be triggered by this watch. The certificate/key pair will be
    /// read together and validated for atomic read consistency (i.e. no
    /// intervening modification occurred between cert/key read, verified by file
    /// hash comparisons). This allows explicit control over the path watched, by
    /// default the parent directories of the filesystem paths in
    /// ``certificate_chain`` and ``private_key`` are watched if this field is not
    /// specified. This only applies when a ``TlsCertificate`` is delivered by SDS
    /// with references to filesystem paths. See the :ref:`SDS key rotation
    /// <sds_key_rotation>` documentation for further details.
    #[prost(message, optional, tag = "7")]
    pub watched_directory: ::core::option::Option<
        super::super::super::super::config::core::v3::WatchedDirectory,
    >,
    /// BoringSSL private key method provider. This is an alternative to :ref:`private_key
    /// <envoy_v3_api_field_extensions.transport_sockets.tls.v3.TlsCertificate.private_key>` field. This can't be
    /// marked as ``oneof`` due to API compatibility reasons. Setting both :ref:`private_key
    /// <envoy_v3_api_field_extensions.transport_sockets.tls.v3.TlsCertificate.private_key>` and
    /// :ref:`private_key_provider
    /// <envoy_v3_api_field_extensions.transport_sockets.tls.v3.TlsCertificate.private_key_provider>` fields will result in an
    /// error.
    #[prost(message, optional, tag = "6")]
    pub private_key_provider: ::core::option::Option<PrivateKeyProvider>,
    /// The password to decrypt the TLS private key. If this field is not set, it is assumed that the
    /// TLS private key is not password encrypted.
    #[prost(message, optional, tag = "3")]
    pub password: ::core::option::Option<
        super::super::super::super::config::core::v3::DataSource,
    >,
    /// The OCSP response to be stapled with this certificate during the handshake.
    /// The response must be DER-encoded and may only be  provided via ``filename`` or
    /// ``inline_bytes``. The response may pertain to only one certificate.
    #[prost(message, optional, tag = "4")]
    pub ocsp_staple: ::core::option::Option<
        super::super::super::super::config::core::v3::DataSource,
    >,
    /// \[#not-implemented-hide:\]
    #[prost(message, repeated, tag = "5")]
    pub signed_certificate_timestamp: ::prost::alloc::vec::Vec<
        super::super::super::super::config::core::v3::DataSource,
    >,
}
impl ::prost::Name for TlsCertificate {
    const NAME: &'static str = "TlsCertificate";
    const PACKAGE: &'static str = "envoy.extensions.transport_sockets.tls.v3";
    fn full_name() -> ::prost::alloc::string::String {
        "envoy.extensions.transport_sockets.tls.v3.TlsCertificate".into()
    }
    fn type_url() -> ::prost::alloc::string::String {
        "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.TlsCertificate"
            .into()
    }
}
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct TlsSessionTicketKeys {
    /// Keys for encrypting and decrypting TLS session tickets. The
    /// first key in the array contains the key to encrypt all new sessions created by this context.
    /// All keys are candidates for decrypting received tickets. This allows for easy rotation of keys
    /// by, for example, putting the new key first, and the previous key second.
    ///
    /// If :ref:`session_ticket_keys <envoy_v3_api_field_extensions.transport_sockets.tls.v3.DownstreamTlsContext.session_ticket_keys>`
    /// is not specified, the TLS library will still support resuming sessions via tickets, but it will
    /// use an internally-generated and managed key, so sessions cannot be resumed across hot restarts
    /// or on different hosts.
    ///
    /// Each key must contain exactly 80 bytes of cryptographically-secure random data. For
    /// example, the output of ``openssl rand 80``.
    ///
    /// .. attention::
    ///
    ///    Using this feature has serious security considerations and risks. Improper handling of keys
    ///    may result in loss of secrecy in connections, even if ciphers supporting perfect forward
    ///    secrecy are used. See <https://www.imperialviolet.org/2013/06/27/botchingpfs.html> for some
    ///    discussion. To minimize the risk, you must:
    ///
    ///    * Keep the session ticket keys at least as secure as your TLS certificate private keys
    ///    * Rotate session ticket keys at least daily, and preferably hourly
    ///    * Always generate keys using a cryptographically-secure random data source
    #[prost(message, repeated, tag = "1")]
    pub keys: ::prost::alloc::vec::Vec<
        super::super::super::super::config::core::v3::DataSource,
    >,
}
impl ::prost::Name for TlsSessionTicketKeys {
    const NAME: &'static str = "TlsSessionTicketKeys";
    const PACKAGE: &'static str = "envoy.extensions.transport_sockets.tls.v3";
    fn full_name() -> ::prost::alloc::string::String {
        "envoy.extensions.transport_sockets.tls.v3.TlsSessionTicketKeys".into()
    }
    fn type_url() -> ::prost::alloc::string::String {
        "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.TlsSessionTicketKeys"
            .into()
    }
}
/// Indicates a certificate to be obtained from a named CertificateProvider plugin instance.
/// The plugin instances are defined in the client's bootstrap file.
/// The plugin allows certificates to be fetched/refreshed over the network asynchronously with
/// respect to the TLS handshake.
/// \[#not-implemented-hide:\]
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct CertificateProviderPluginInstance {
    /// Provider instance name. If not present, defaults to "default".
    ///
    /// Instance names should generally be defined not in terms of the underlying provider
    /// implementation (e.g., "file_watcher") but rather in terms of the function of the
    /// certificates (e.g., "foo_deployment_identity").
    #[prost(string, tag = "1")]
    pub instance_name: ::prost::alloc::string::String,
    /// Opaque name used to specify certificate instances or types. For example, "ROOTCA" to specify
    /// a root-certificate (validation context) or "example.com" to specify a certificate for a
    /// particular domain. Not all provider instances will actually use this field, so the value
    /// defaults to the empty string.
    #[prost(string, tag = "2")]
    pub certificate_name: ::prost::alloc::string::String,
}
impl ::prost::Name for CertificateProviderPluginInstance {
    const NAME: &'static str = "CertificateProviderPluginInstance";
    const PACKAGE: &'static str = "envoy.extensions.transport_sockets.tls.v3";
    fn full_name() -> ::prost::alloc::string::String {
        "envoy.extensions.transport_sockets.tls.v3.CertificateProviderPluginInstance"
            .into()
    }
    fn type_url() -> ::prost::alloc::string::String {
        "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.CertificateProviderPluginInstance"
            .into()
    }
}
/// Matcher for subject alternative names, to match both type and value of the SAN.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct SubjectAltNameMatcher {
    /// Specification of type of SAN. Note that the default enum value is an invalid choice.
    #[prost(enumeration = "subject_alt_name_matcher::SanType", tag = "1")]
    pub san_type: i32,
    /// Matcher for SAN value.
    #[prost(message, optional, tag = "2")]
    pub matcher: ::core::option::Option<
        super::super::super::super::r#type::matcher::v3::StringMatcher,
    >,
}
/// Nested message and enum types in `SubjectAltNameMatcher`.
pub mod subject_alt_name_matcher {
    /// Indicates the choice of GeneralName as defined in section 4.2.1.5 of RFC 5280 to match
    /// against.
    #[derive(
        Clone,
        Copy,
        Debug,
        PartialEq,
        Eq,
        Hash,
        PartialOrd,
        Ord,
        ::prost::Enumeration
    )]
    #[repr(i32)]
    pub enum SanType {
        Unspecified = 0,
        Email = 1,
        Dns = 2,
        Uri = 3,
        IpAddress = 4,
    }
    impl SanType {
        /// String value of the enum field names used in the ProtoBuf definition.
        ///
        /// The values are not transformed in any way and thus are considered stable
        /// (if the ProtoBuf definition does not change) and safe for programmatic use.
        pub fn as_str_name(&self) -> &'static str {
            match self {
                Self::Unspecified => "SAN_TYPE_UNSPECIFIED",
                Self::Email => "EMAIL",
                Self::Dns => "DNS",
                Self::Uri => "URI",
                Self::IpAddress => "IP_ADDRESS",
            }
        }
        /// Creates an enum from field names used in the ProtoBuf definition.
        pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
            match value {
                "SAN_TYPE_UNSPECIFIED" => Some(Self::Unspecified),
                "EMAIL" => Some(Self::Email),
                "DNS" => Some(Self::Dns),
                "URI" => Some(Self::Uri),
                "IP_ADDRESS" => Some(Self::IpAddress),
                _ => None,
            }
        }
    }
}
impl ::prost::Name for SubjectAltNameMatcher {
    const NAME: &'static str = "SubjectAltNameMatcher";
    const PACKAGE: &'static str = "envoy.extensions.transport_sockets.tls.v3";
    fn full_name() -> ::prost::alloc::string::String {
        "envoy.extensions.transport_sockets.tls.v3.SubjectAltNameMatcher".into()
    }
    fn type_url() -> ::prost::alloc::string::String {
        "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.SubjectAltNameMatcher"
            .into()
    }
}
/// \[#next-free-field: 18\]
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct CertificateValidationContext {
    /// TLS certificate data containing certificate authority certificates to use in verifying
    /// a presented peer certificate (e.g. server certificate for clusters or client certificate
    /// for listeners). If not specified and a peer certificate is presented it will not be
    /// verified. By default, a client certificate is optional, unless one of the additional
    /// options (:ref:`require_client_certificate
    /// <envoy_v3_api_field_extensions.transport_sockets.tls.v3.DownstreamTlsContext.require_client_certificate>`,
    /// :ref:`verify_certificate_spki
    /// <envoy_v3_api_field_extensions.transport_sockets.tls.v3.CertificateValidationContext.verify_certificate_spki>`,
    /// :ref:`verify_certificate_hash
    /// <envoy_v3_api_field_extensions.transport_sockets.tls.v3.CertificateValidationContext.verify_certificate_hash>`, or
    /// :ref:`match_typed_subject_alt_names
    /// <envoy_v3_api_field_extensions.transport_sockets.tls.v3.CertificateValidationContext.match_typed_subject_alt_names>`) is also
    /// specified.
    ///
    /// It can optionally contain certificate revocation lists, in which case Envoy will verify
    /// that the presented peer certificate has not been revoked by one of the included CRLs. Note
    /// that if a CRL is provided for any certificate authority in a trust chain, a CRL must be
    /// provided for all certificate authorities in that chain. Failure to do so will result in
    /// verification failure for both revoked and unrevoked certificates from that chain.
    /// The behavior of requiring all certificates to contain CRLs can be altered by
    /// setting :ref:`only_verify_leaf_cert_crl <envoy_v3_api_field_extensions.transport_sockets.tls.v3.CertificateValidationContext.only_verify_leaf_cert_crl>`
    /// true. If set to true, only the final certificate in the chain undergoes CRL verification.
    ///
    /// See :ref:`the TLS overview <arch_overview_ssl_enabling_verification>` for a list of common
    /// system CA locations.
    ///
    /// If ``trusted_ca`` is a filesystem path, a watch will be added to the parent
    /// directory for any file moves to support rotation. This currently only
    /// applies to dynamic secrets, when the ``CertificateValidationContext`` is
    /// delivered via SDS.
    ///
    /// X509_V_FLAG_PARTIAL_CHAIN is set by default, so non-root/intermediate ca certificate in ``trusted_ca``
    /// can be treated as trust anchor as well. It allows verification with building valid partial chain instead
    /// of a full chain.
    ///
    /// If ``ca_certificate_provider_instance`` is set, it takes precedence over ``trusted_ca``.
    #[prost(message, optional, tag = "1")]
    pub trusted_ca: ::core::option::Option<
        super::super::super::super::config::core::v3::DataSource,
    >,
    /// Certificate provider instance for fetching TLS certificates.
    ///
    /// If set, takes precedence over ``trusted_ca``.
    /// \[#not-implemented-hide:\]
    #[prost(message, optional, tag = "13")]
    pub ca_certificate_provider_instance: ::core::option::Option<
        CertificateProviderPluginInstance,
    >,
    /// Use system root certs for validation.
    /// If present, system root certs are used only if neither of the ``trusted_ca``
    /// or ``ca_certificate_provider_instance`` fields are set.
    /// \[#not-implemented-hide:\]
    #[prost(message, optional, tag = "17")]
    pub system_root_certs: ::core::option::Option<
        certificate_validation_context::SystemRootCerts,
    >,
    /// If specified, updates of a file-based ``trusted_ca`` source will be triggered
    /// by this watch. This allows explicit control over the path watched, by
    /// default the parent directory of the filesystem path in ``trusted_ca`` is
    /// watched if this field is not specified. This only applies when a
    /// ``CertificateValidationContext`` is delivered by SDS with references to
    /// filesystem paths. See the :ref:`SDS key rotation <sds_key_rotation>`
    /// documentation for further details.
    #[prost(message, optional, tag = "11")]
    pub watched_directory: ::core::option::Option<
        super::super::super::super::config::core::v3::WatchedDirectory,
    >,
    /// An optional list of base64-encoded SHA-256 hashes. If specified, Envoy will verify that the
    /// SHA-256 of the DER-encoded Subject Public Key Information (SPKI) of the presented certificate
    /// matches one of the specified values.
    ///
    /// A base64-encoded SHA-256 of the Subject Public Key Information (SPKI) of the certificate
    /// can be generated with the following command:
    ///
    /// .. code-block:: bash
    ///
    ///    $ openssl x509 -in path/to/client.crt -noout -pubkey
    ///      | openssl pkey -pubin -outform DER
    ///      | openssl dgst -sha256 -binary
    ///      | openssl enc -base64
    ///    NvqYIYSbgK2vCJpQhObf77vv+bQWtc5ek5RIOwPiC9A=
    ///
    /// This is the format used in HTTP Public Key Pinning.
    ///
    /// When both:
    /// :ref:`verify_certificate_hash
    /// <envoy_v3_api_field_extensions.transport_sockets.tls.v3.CertificateValidationContext.verify_certificate_hash>` and
    /// :ref:`verify_certificate_spki
    /// <envoy_v3_api_field_extensions.transport_sockets.tls.v3.CertificateValidationContext.verify_certificate_spki>` are specified,
    /// a hash matching value from either of the lists will result in the certificate being accepted.
    ///
    /// .. attention::
    ///
    ///    This option is preferred over :ref:`verify_certificate_hash
    ///    <envoy_v3_api_field_extensions.transport_sockets.tls.v3.CertificateValidationContext.verify_certificate_hash>`,
    ///    because SPKI is tied to a private key, so it doesn't change when the certificate
    ///    is renewed using the same private key.
    #[prost(string, repeated, tag = "3")]
    pub verify_certificate_spki: ::prost::alloc::vec::Vec<
        ::prost::alloc::string::String,
    >,
    /// An optional list of hex-encoded SHA-256 hashes. If specified, Envoy will verify that
    /// the SHA-256 of the DER-encoded presented certificate matches one of the specified values.
    ///
    /// A hex-encoded SHA-256 of the certificate can be generated with the following command:
    ///
    /// .. code-block:: bash
    ///
    ///    $ openssl x509 -in path/to/client.crt -outform DER | openssl dgst -sha256 | cut -d" " -f2
    ///    df6ff72fe9116521268f6f2dd4966f51df479883fe7037b39f75916ac3049d1a
    ///
    /// A long hex-encoded and colon-separated SHA-256 (a.k.a. "fingerprint") of the certificate
    /// can be generated with the following command:
    ///
    /// .. code-block:: bash
    ///
    ///    $ openssl x509 -in path/to/client.crt -noout -fingerprint -sha256 | cut -d"=" -f2
    ///    DF:6F:F7:2F:E9:11:65:21:26:8F:6F:2D:D4:96:6F:51:DF:47:98:83:FE:70:37:B3:9F:75:91:6A:C3:04:9D:1A
    ///
    /// Both of those formats are acceptable.
    ///
    /// When both:
    /// :ref:`verify_certificate_hash
    /// <envoy_v3_api_field_extensions.transport_sockets.tls.v3.CertificateValidationContext.verify_certificate_hash>` and
    /// :ref:`verify_certificate_spki
    /// <envoy_v3_api_field_extensions.transport_sockets.tls.v3.CertificateValidationContext.verify_certificate_spki>` are specified,
    /// a hash matching value from either of the lists will result in the certificate being accepted.
    #[prost(string, repeated, tag = "2")]
    pub verify_certificate_hash: ::prost::alloc::vec::Vec<
        ::prost::alloc::string::String,
    >,
    /// An optional list of Subject Alternative name matchers. If specified, Envoy will verify that the
    /// Subject Alternative Name of the presented certificate matches one of the specified matchers.
    /// The matching uses "any" semantics, that is to say, the SAN is verified if at least one matcher is
    /// matched.
    ///
    /// When a certificate has wildcard DNS SAN entries, to match a specific client, it should be
    /// configured with exact match type in the :ref:`string matcher <envoy_v3_api_msg_type.matcher.v3.StringMatcher>`.
    /// For example if the certificate has "\*.example.com" as DNS SAN entry, to allow only "api.example.com",
    /// it should be configured as shown below.
    ///
    /// .. code-block:: yaml
    ///
    ///   match_typed_subject_alt_names:
    ///   - san_type: DNS
    ///     matcher:
    ///       exact: "api.example.com"
    ///
    /// .. attention::
    ///
    ///    Subject Alternative Names are easily spoofable and verifying only them is insecure,
    ///    therefore this option must be used together with :ref:`trusted_ca
    ///    <envoy_v3_api_field_extensions.transport_sockets.tls.v3.CertificateValidationContext.trusted_ca>`.
    #[prost(message, repeated, tag = "15")]
    pub match_typed_subject_alt_names: ::prost::alloc::vec::Vec<SubjectAltNameMatcher>,
    /// This field is deprecated in favor of
    /// :ref:`match_typed_subject_alt_names
    /// <envoy_v3_api_field_extensions.transport_sockets.tls.v3.CertificateValidationContext.match_typed_subject_alt_names>`.
    /// Note that if both this field and :ref:`match_typed_subject_alt_names
    /// <envoy_v3_api_field_extensions.transport_sockets.tls.v3.CertificateValidationContext.match_typed_subject_alt_names>`
    /// are specified, the former (deprecated field) is ignored.
    #[deprecated]
    #[prost(message, repeated, tag = "9")]
    pub match_subject_alt_names: ::prost::alloc::vec::Vec<
        super::super::super::super::r#type::matcher::v3::StringMatcher,
    >,
    /// \[#not-implemented-hide:\] Must present signed certificate time-stamp.
    #[prost(message, optional, tag = "6")]
    pub require_signed_certificate_timestamp: ::core::option::Option<
        super::super::super::super::super::google::protobuf::BoolValue,
    >,
    /// An optional `certificate revocation list
    /// <<https://en.wikipedia.org/wiki/Certificate_revocation_list>`_>
    /// (in PEM format). If specified, Envoy will verify that the presented peer
    /// certificate has not been revoked by this CRL. If this DataSource contains
    /// multiple CRLs, all of them will be used. Note that if a CRL is provided
    /// for any certificate authority in a trust chain, a CRL must be provided
    /// for all certificate authorities in that chain. Failure to do so will
    /// result in verification failure for both revoked and unrevoked certificates
    /// from that chain. This default behavior can be altered by setting
    /// :ref:`only_verify_leaf_cert_crl <envoy_v3_api_field_extensions.transport_sockets.tls.v3.CertificateValidationContext.only_verify_leaf_cert_crl>` to
    /// true.
    ///
    /// If ``crl`` is a filesystem path, a watch will be added to the parent
    /// directory for any file moves to support rotation. This currently only
    /// applies to dynamic secrets, when the ``CertificateValidationContext`` is
    /// delivered via SDS.
    #[prost(message, optional, tag = "7")]
    pub crl: ::core::option::Option<
        super::super::super::super::config::core::v3::DataSource,
    >,
    /// If specified, Envoy will not reject expired certificates.
    #[prost(bool, tag = "8")]
    pub allow_expired_certificate: bool,
    /// Certificate trust chain verification mode.
    #[prost(
        enumeration = "certificate_validation_context::TrustChainVerification",
        tag = "10"
    )]
    pub trust_chain_verification: i32,
    /// The configuration of an extension specific certificate validator.
    /// If specified, all validation is done by the specified validator,
    /// and the behavior of all other validation settings is defined by the specified validator (and may be entirely ignored, unused, and unvalidated).
    /// Refer to the documentation for the specified validator. If you do not want a custom validation algorithm, do not set this field.
    /// \[#extension-category: envoy.tls.cert_validator\]
    #[prost(message, optional, tag = "12")]
    pub custom_validator_config: ::core::option::Option<
        super::super::super::super::config::core::v3::TypedExtensionConfig,
    >,
    /// If this option is set to true, only the certificate at the end of the
    /// certificate chain will be subject to validation by :ref:`CRL <envoy_v3_api_field_extensions.transport_sockets.tls.v3.CertificateValidationContext.crl>`.
    #[prost(bool, tag = "14")]
    pub only_verify_leaf_cert_crl: bool,
    /// Defines maximum depth of a certificate chain accepted in verification, the default limit is 100, though this can be system-dependent.
    /// This number does not include the leaf but includes the trust anchor, so a depth of 1 allows the leaf and one CA certificate. If a trusted issuer
    /// appears in the chain, but in a depth larger than configured, the certificate validation will fail.
    /// This matches the semantics of ``SSL_CTX_set_verify_depth`` in OpenSSL 1.0.x and older versions of BoringSSL. It differs from ``SSL_CTX_set_verify_depth``
    /// in OpenSSL 1.1.x and newer versions of BoringSSL in that the trust anchor is included.
    /// Trusted issues are specified by setting :ref:`trusted_ca <envoy_v3_api_field_extensions.transport_sockets.tls.v3.CertificateValidationContext.trusted_ca>`
    #[prost(message, optional, tag = "16")]
    pub max_verify_depth: ::core::option::Option<
        super::super::super::super::super::google::protobuf::UInt32Value,
    >,
}
/// Nested message and enum types in `CertificateValidationContext`.
pub mod certificate_validation_context {
    #[derive(Clone, Copy, PartialEq, ::prost::Message)]
    pub struct SystemRootCerts {}
    impl ::prost::Name for SystemRootCerts {
        const NAME: &'static str = "SystemRootCerts";
        const PACKAGE: &'static str = "envoy.extensions.transport_sockets.tls.v3";
        fn full_name() -> ::prost::alloc::string::String {
            "envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext.SystemRootCerts"
                .into()
        }
        fn type_url() -> ::prost::alloc::string::String {
            "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext.SystemRootCerts"
                .into()
        }
    }
    /// Peer certificate verification mode.
    #[derive(
        Clone,
        Copy,
        Debug,
        PartialEq,
        Eq,
        Hash,
        PartialOrd,
        Ord,
        ::prost::Enumeration
    )]
    #[repr(i32)]
    pub enum TrustChainVerification {
        /// Perform default certificate verification (e.g., against CA / verification lists)
        VerifyTrustChain = 0,
        /// Connections where the certificate fails verification will be permitted.
        /// For HTTP connections, the result of certificate verification can be used in route matching. (
        /// see :ref:`validated <envoy_v3_api_field_config.route.v3.RouteMatch.TlsContextMatchOptions.validated>` ).
        AcceptUntrusted = 1,
    }
    impl TrustChainVerification {
        /// String value of the enum field names used in the ProtoBuf definition.
        ///
        /// The values are not transformed in any way and thus are considered stable
        /// (if the ProtoBuf definition does not change) and safe for programmatic use.
        pub fn as_str_name(&self) -> &'static str {
            match self {
                Self::VerifyTrustChain => "VERIFY_TRUST_CHAIN",
                Self::AcceptUntrusted => "ACCEPT_UNTRUSTED",
            }
        }
        /// Creates an enum from field names used in the ProtoBuf definition.
        pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
            match value {
                "VERIFY_TRUST_CHAIN" => Some(Self::VerifyTrustChain),
                "ACCEPT_UNTRUSTED" => Some(Self::AcceptUntrusted),
                _ => None,
            }
        }
    }
}
impl ::prost::Name for CertificateValidationContext {
    const NAME: &'static str = "CertificateValidationContext";
    const PACKAGE: &'static str = "envoy.extensions.transport_sockets.tls.v3";
    fn full_name() -> ::prost::alloc::string::String {
        "envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext".into()
    }
    fn type_url() -> ::prost::alloc::string::String {
        "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext"
            .into()
    }
}
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct GenericSecret {
    /// Secret of generic type and is available to filters.
    #[prost(message, optional, tag = "1")]
    pub secret: ::core::option::Option<
        super::super::super::super::config::core::v3::DataSource,
    >,
}
impl ::prost::Name for GenericSecret {
    const NAME: &'static str = "GenericSecret";
    const PACKAGE: &'static str = "envoy.extensions.transport_sockets.tls.v3";
    fn full_name() -> ::prost::alloc::string::String {
        "envoy.extensions.transport_sockets.tls.v3.GenericSecret".into()
    }
    fn type_url() -> ::prost::alloc::string::String {
        "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.GenericSecret"
            .into()
    }
}
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct SdsSecretConfig {
    /// Name by which the secret can be uniquely referred to. When both name and config are specified,
    /// then secret can be fetched and/or reloaded via SDS. When only name is specified, then secret
    /// will be loaded from static resources.
    #[prost(string, tag = "1")]
    pub name: ::prost::alloc::string::String,
    #[prost(message, optional, tag = "2")]
    pub sds_config: ::core::option::Option<
        super::super::super::super::config::core::v3::ConfigSource,
    >,
}
impl ::prost::Name for SdsSecretConfig {
    const NAME: &'static str = "SdsSecretConfig";
    const PACKAGE: &'static str = "envoy.extensions.transport_sockets.tls.v3";
    fn full_name() -> ::prost::alloc::string::String {
        "envoy.extensions.transport_sockets.tls.v3.SdsSecretConfig".into()
    }
    fn type_url() -> ::prost::alloc::string::String {
        "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.SdsSecretConfig"
            .into()
    }
}
/// \[#next-free-field: 6\]
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct Secret {
    /// Name (FQDN, UUID, SPKI, SHA256, etc.) by which the secret can be uniquely referred to.
    #[prost(string, tag = "1")]
    pub name: ::prost::alloc::string::String,
    #[prost(oneof = "secret::Type", tags = "2, 3, 4, 5")]
    pub r#type: ::core::option::Option<secret::Type>,
}
/// Nested message and enum types in `Secret`.
pub mod secret {
    #[derive(Clone, PartialEq, ::prost::Oneof)]
    pub enum Type {
        #[prost(message, tag = "2")]
        TlsCertificate(super::TlsCertificate),
        #[prost(message, tag = "3")]
        SessionTicketKeys(super::TlsSessionTicketKeys),
        #[prost(message, tag = "4")]
        ValidationContext(super::CertificateValidationContext),
        #[prost(message, tag = "5")]
        GenericSecret(super::GenericSecret),
    }
}
impl ::prost::Name for Secret {
    const NAME: &'static str = "Secret";
    const PACKAGE: &'static str = "envoy.extensions.transport_sockets.tls.v3";
    fn full_name() -> ::prost::alloc::string::String {
        "envoy.extensions.transport_sockets.tls.v3.Secret".into()
    }
    fn type_url() -> ::prost::alloc::string::String {
        "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret".into()
    }
}