// Code generated by protoc-gen-go. DO NOT EDIT.
// versions:
// 	protoc-gen-go v1.36.10
// 	protoc        v6.33.2
// source: envoy/extensions/filters/network/reverse_tunnel/v3/reverse_tunnel.proto

package reverse_tunnelv3

import (
	_ "github.com/cncf/xds/go/udpa/annotations"
	v3 "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
	_ "github.com/envoyproxy/protoc-gen-validate/validate"
	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
	durationpb "google.golang.org/protobuf/types/known/durationpb"
	reflect "reflect"
	sync "sync"
	unsafe "unsafe"
)

const (
	// Verify that this generated code is sufficiently up-to-date.
	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
	// Verify that runtime/protoimpl is sufficiently up-to-date.
	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
)

// Validation configuration for reverse tunnel identifiers.
// Validates the node ID, cluster ID, and tenant ID extracted from reverse tunnel handshake headers
// against expected values specified using format strings.
// [#next-free-field: 6]
type Validation struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Format string to extract the expected node identifier for validation.
	// The formatted value is compared against the “x-envoy-reverse-tunnel-node-id“ header
	// from the incoming handshake request. If they do not match, the connection is rejected
	// with HTTP “403 Forbidden“.
	//
	// Supports Envoy's :ref:`command operators <config_access_log_command_operators>`:
	//
	// * “%DYNAMIC_METADATA(namespace:key)%“: Extract expected value from dynamic metadata.
	// * “%FILTER_STATE(key)%“: Extract expected value from filter state.
	// * “%DOWNSTREAM_REMOTE_ADDRESS%“: Use downstream connection IP address.
	// * Plain strings: Use a static expected value.
	//
	// If empty, node ID validation is skipped.
	//
	// Example using dynamic metadata allowlist:
	//
	// .. code-block:: yaml
	//
	//	node_id_format: "%DYNAMIC_METADATA(envoy.reverse_tunnel.allowlist:expected_node_id)%"
	NodeIdFormat string `protobuf:"bytes,1,opt,name=node_id_format,json=nodeIdFormat,proto3" json:"node_id_format,omitempty"`
	// Format string to extract the expected cluster identifier for validation.
	// The formatted value is compared against the “x-envoy-reverse-tunnel-cluster-id“ header
	// from the incoming handshake request. If they do not match, the connection is rejected
	// with HTTP “403 Forbidden“.
	//
	// Supports the same :ref:`command operators <config_access_log_command_operators>` as
	// “node_id_format“.
	//
	// If empty, cluster ID validation is skipped.
	//
	// Example using filter state:
	//
	// .. code-block:: yaml
	//
	//	cluster_id_format: "%FILTER_STATE(expected_cluster_id)%"
	ClusterIdFormat string `protobuf:"bytes,2,opt,name=cluster_id_format,json=clusterIdFormat,proto3" json:"cluster_id_format,omitempty"`
	// Format string to extract the expected tenant identifier for validation.
	// The formatted value is compared against the “x-envoy-reverse-tunnel-tenant-id“ header
	// from the incoming handshake request. If they do not match, the connection is rejected
	// with HTTP “403 Forbidden“.
	//
	// Supports the same :ref:`command operators <config_access_log_command_operators>` as
	// “node_id_format“.
	//
	// If empty, tenant ID validation is skipped.
	TenantIdFormat string `protobuf:"bytes,5,opt,name=tenant_id_format,json=tenantIdFormat,proto3" json:"tenant_id_format,omitempty"`
	// Whether to emit validation results as dynamic metadata.
	// When enabled, the filter emits metadata under the namespace specified by
	// “dynamic_metadata_namespace“ containing:
	//
	// * “node_id“: The actual node ID from the handshake request.
	// * “cluster_id“: The actual cluster ID from the handshake request.
	// * “tenant_id“: The actual tenant ID from the handshake request.
	// * “validation_result“: Either “allowed“ or “denied“.
	//
	// This metadata can be used by subsequent filters or for access logging.
	// Defaults to “false“.
	EmitDynamicMetadata bool `protobuf:"varint,3,opt,name=emit_dynamic_metadata,json=emitDynamicMetadata,proto3" json:"emit_dynamic_metadata,omitempty"`
	// Namespace for emitted dynamic metadata when “emit_dynamic_metadata“ is “true“.
	// If not specified, defaults to “envoy.filters.network.reverse_tunnel“.
	DynamicMetadataNamespace string `protobuf:"bytes,4,opt,name=dynamic_metadata_namespace,json=dynamicMetadataNamespace,proto3" json:"dynamic_metadata_namespace,omitempty"`
	unknownFields            protoimpl.UnknownFields
	sizeCache                protoimpl.SizeCache
}

func (x *Validation) Reset() {
	*x = Validation{}
	mi := &file_envoy_extensions_filters_network_reverse_tunnel_v3_reverse_tunnel_proto_msgTypes[0]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *Validation) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*Validation) ProtoMessage() {}

func (x *Validation) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_extensions_filters_network_reverse_tunnel_v3_reverse_tunnel_proto_msgTypes[0]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use Validation.ProtoReflect.Descriptor instead.
func (*Validation) Descriptor() ([]byte, []int) {
	return file_envoy_extensions_filters_network_reverse_tunnel_v3_reverse_tunnel_proto_rawDescGZIP(), []int{0}
}

func (x *Validation) GetNodeIdFormat() string {
	if x != nil {
		return x.NodeIdFormat
	}
	return ""
}

func (x *Validation) GetClusterIdFormat() string {
	if x != nil {
		return x.ClusterIdFormat
	}
	return ""
}

func (x *Validation) GetTenantIdFormat() string {
	if x != nil {
		return x.TenantIdFormat
	}
	return ""
}

func (x *Validation) GetEmitDynamicMetadata() bool {
	if x != nil {
		return x.EmitDynamicMetadata
	}
	return false
}

func (x *Validation) GetDynamicMetadataNamespace() string {
	if x != nil {
		return x.DynamicMetadataNamespace
	}
	return ""
}

// Configuration for the reverse tunnel network filter.
// This filter handles reverse tunnel connection acceptance and rejection by processing
// HTTP requests where required identification values are provided via HTTP headers.
// [#next-free-field: 7]
type ReverseTunnel struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Ping interval for health checks on established reverse tunnel connections.
	// If not specified, defaults to “2 seconds“.
	PingInterval *durationpb.Duration `protobuf:"bytes,1,opt,name=ping_interval,json=pingInterval,proto3" json:"ping_interval,omitempty"`
	// Whether to automatically close connections after processing reverse tunnel requests.
	//
	// * When set to “true“, connections are closed after acceptance or rejection.
	// * When set to “false“, connections remain open for potential reuse.
	//
	// Defaults to “false“.
	AutoCloseConnections bool `protobuf:"varint,2,opt,name=auto_close_connections,json=autoCloseConnections,proto3" json:"auto_close_connections,omitempty"`
	// HTTP path to match for reverse tunnel requests.
	// If not specified, defaults to “/reverse_connections/request“.
	RequestPath string `protobuf:"bytes,3,opt,name=request_path,json=requestPath,proto3" json:"request_path,omitempty"`
	// HTTP method to match for reverse tunnel requests.
	// If not specified (“METHOD_UNSPECIFIED“), this defaults to “GET“.
	RequestMethod v3.RequestMethod `protobuf:"varint,4,opt,name=request_method,json=requestMethod,proto3,enum=envoy.config.core.v3.RequestMethod" json:"request_method,omitempty"`
	// Optional validation configuration for node, cluster, and tenant identifiers.
	// If specified, the filter validates the “x-envoy-reverse-tunnel-node-id“,
	// “x-envoy-reverse-tunnel-cluster-id“, and “x-envoy-reverse-tunnel-tenant-id“ headers
	// against expected values extracted using format strings. Requests that fail validation
	// are rejected with HTTP “403 Forbidden“.
	Validation *Validation `protobuf:"bytes,5,opt,name=validation,proto3" json:"validation,omitempty"`
	// Required cluster name for validating reverse tunnel connection initiations.
	// When set, the filter validates that the upstream cluster of the initiator envoy matches this name
	// via “x-envoy-reverse-tunnel-upstream-cluster-name“ header. Connections with mismatched or missing
	// cluster names are rejected with HTTP “400 Bad Request“. When empty, no cluster name validation is performed.
	RequiredClusterName string `protobuf:"bytes,6,opt,name=required_cluster_name,json=requiredClusterName,proto3" json:"required_cluster_name,omitempty"`
	unknownFields       protoimpl.UnknownFields
	sizeCache           protoimpl.SizeCache
}

func (x *ReverseTunnel) Reset() {
	*x = ReverseTunnel{}
	mi := &file_envoy_extensions_filters_network_reverse_tunnel_v3_reverse_tunnel_proto_msgTypes[1]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ReverseTunnel) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ReverseTunnel) ProtoMessage() {}

func (x *ReverseTunnel) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_extensions_filters_network_reverse_tunnel_v3_reverse_tunnel_proto_msgTypes[1]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ReverseTunnel.ProtoReflect.Descriptor instead.
func (*ReverseTunnel) Descriptor() ([]byte, []int) {
	return file_envoy_extensions_filters_network_reverse_tunnel_v3_reverse_tunnel_proto_rawDescGZIP(), []int{1}
}

func (x *ReverseTunnel) GetPingInterval() *durationpb.Duration {
	if x != nil {
		return x.PingInterval
	}
	return nil
}

func (x *ReverseTunnel) GetAutoCloseConnections() bool {
	if x != nil {
		return x.AutoCloseConnections
	}
	return false
}

func (x *ReverseTunnel) GetRequestPath() string {
	if x != nil {
		return x.RequestPath
	}
	return ""
}

func (x *ReverseTunnel) GetRequestMethod() v3.RequestMethod {
	if x != nil {
		return x.RequestMethod
	}
	return v3.RequestMethod(0)
}

func (x *ReverseTunnel) GetValidation() *Validation {
	if x != nil {
		return x.Validation
	}
	return nil
}

func (x *ReverseTunnel) GetRequiredClusterName() string {
	if x != nil {
		return x.RequiredClusterName
	}
	return ""
}

var File_envoy_extensions_filters_network_reverse_tunnel_v3_reverse_tunnel_proto protoreflect.FileDescriptor

const file_envoy_extensions_filters_network_reverse_tunnel_v3_reverse_tunnel_proto_rawDesc = "" +
	"\n" +
	"Genvoy/extensions/filters/network/reverse_tunnel/v3/reverse_tunnel.proto\x122envoy.extensions.filters.network.reverse_tunnel.v3\x1a\x1fenvoy/config/core/v3/base.proto\x1a\x1egoogle/protobuf/duration.proto\x1a\x1dudpa/annotations/status.proto\x1a\x17validate/validate.proto\"\xa2\x02\n" +
	"\n" +
	"Validation\x12.\n" +
	"\x0enode_id_format\x18\x01 \x01(\tB\b\xfaB\x05r\x03\x18\x80\bR\fnodeIdFormat\x124\n" +
	"\x11cluster_id_format\x18\x02 \x01(\tB\b\xfaB\x05r\x03\x18\x80\bR\x0fclusterIdFormat\x122\n" +
	"\x10tenant_id_format\x18\x05 \x01(\tB\b\xfaB\x05r\x03\x18\x80\bR\x0etenantIdFormat\x122\n" +
	"\x15emit_dynamic_metadata\x18\x03 \x01(\bR\x13emitDynamicMetadata\x12F\n" +
	"\x1adynamic_metadata_namespace\x18\x04 \x01(\tB\b\xfaB\x05r\x03\x18\xff\x01R\x18dynamicMetadataNamespace\"\xc1\x03\n" +
	"\rReverseTunnel\x12Q\n" +
	"\rping_interval\x18\x01 \x01(\v2\x19.google.protobuf.DurationB\x11\xfaB\x0e\xaa\x01\v\"\x03\b\xac\x022\x04\x10\xc0\x84=R\fpingInterval\x124\n" +
	"\x16auto_close_connections\x18\x02 \x01(\bR\x14autoCloseConnections\x120\n" +
	"\frequest_path\x18\x03 \x01(\tB\r\xfaB\n" +
	"r\b\x10\x01\x18\xff\x01\xd0\x01\x01R\vrequestPath\x12T\n" +
	"\x0erequest_method\x18\x04 \x01(\x0e2#.envoy.config.core.v3.RequestMethodB\b\xfaB\x05\x82\x01\x02\x10\x01R\rrequestMethod\x12^\n" +
	"\n" +
	"validation\x18\x05 \x01(\v2>.envoy.extensions.filters.network.reverse_tunnel.v3.ValidationR\n" +
	"validation\x12?\n" +
	"\x15required_cluster_name\x18\x06 \x01(\tB\v\xfaB\br\x06\x18\xff\x01\xd0\x01\x01R\x13requiredClusterNameB\xcc\x01\xba\x80\xc8\xd1\x06\x02\x10\x02\n" +
	"@io.envoyproxy.envoy.extensions.filters.network.reverse_tunnel.v3B\x12ReverseTunnelProtoP\x01Zjgithub.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/reverse_tunnel/v3;reverse_tunnelv3b\x06proto3"

var (
	file_envoy_extensions_filters_network_reverse_tunnel_v3_reverse_tunnel_proto_rawDescOnce sync.Once
	file_envoy_extensions_filters_network_reverse_tunnel_v3_reverse_tunnel_proto_rawDescData []byte
)

func file_envoy_extensions_filters_network_reverse_tunnel_v3_reverse_tunnel_proto_rawDescGZIP() []byte {
	file_envoy_extensions_filters_network_reverse_tunnel_v3_reverse_tunnel_proto_rawDescOnce.Do(func() {
		file_envoy_extensions_filters_network_reverse_tunnel_v3_reverse_tunnel_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_envoy_extensions_filters_network_reverse_tunnel_v3_reverse_tunnel_proto_rawDesc), len(file_envoy_extensions_filters_network_reverse_tunnel_v3_reverse_tunnel_proto_rawDesc)))
	})
	return file_envoy_extensions_filters_network_reverse_tunnel_v3_reverse_tunnel_proto_rawDescData
}

var file_envoy_extensions_filters_network_reverse_tunnel_v3_reverse_tunnel_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
var file_envoy_extensions_filters_network_reverse_tunnel_v3_reverse_tunnel_proto_goTypes = []any{
	(*Validation)(nil),          // 0: envoy.extensions.filters.network.reverse_tunnel.v3.Validation
	(*ReverseTunnel)(nil),       // 1: envoy.extensions.filters.network.reverse_tunnel.v3.ReverseTunnel
	(*durationpb.Duration)(nil), // 2: google.protobuf.Duration
	(v3.RequestMethod)(0),       // 3: envoy.config.core.v3.RequestMethod
}
var file_envoy_extensions_filters_network_reverse_tunnel_v3_reverse_tunnel_proto_depIdxs = []int32{
	2, // 0: envoy.extensions.filters.network.reverse_tunnel.v3.ReverseTunnel.ping_interval:type_name -> google.protobuf.Duration
	3, // 1: envoy.extensions.filters.network.reverse_tunnel.v3.ReverseTunnel.request_method:type_name -> envoy.config.core.v3.RequestMethod
	0, // 2: envoy.extensions.filters.network.reverse_tunnel.v3.ReverseTunnel.validation:type_name -> envoy.extensions.filters.network.reverse_tunnel.v3.Validation
	3, // [3:3] is the sub-list for method output_type
	3, // [3:3] is the sub-list for method input_type
	3, // [3:3] is the sub-list for extension type_name
	3, // [3:3] is the sub-list for extension extendee
	0, // [0:3] is the sub-list for field type_name
}

func init() { file_envoy_extensions_filters_network_reverse_tunnel_v3_reverse_tunnel_proto_init() }
func file_envoy_extensions_filters_network_reverse_tunnel_v3_reverse_tunnel_proto_init() {
	if File_envoy_extensions_filters_network_reverse_tunnel_v3_reverse_tunnel_proto != nil {
		return
	}
	type x struct{}
	out := protoimpl.TypeBuilder{
		File: protoimpl.DescBuilder{
			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
			RawDescriptor: unsafe.Slice(unsafe.StringData(file_envoy_extensions_filters_network_reverse_tunnel_v3_reverse_tunnel_proto_rawDesc), len(file_envoy_extensions_filters_network_reverse_tunnel_v3_reverse_tunnel_proto_rawDesc)),
			NumEnums:      0,
			NumMessages:   2,
			NumExtensions: 0,
			NumServices:   0,
		},
		GoTypes:           file_envoy_extensions_filters_network_reverse_tunnel_v3_reverse_tunnel_proto_goTypes,
		DependencyIndexes: file_envoy_extensions_filters_network_reverse_tunnel_v3_reverse_tunnel_proto_depIdxs,
		MessageInfos:      file_envoy_extensions_filters_network_reverse_tunnel_v3_reverse_tunnel_proto_msgTypes,
	}.Build()
	File_envoy_extensions_filters_network_reverse_tunnel_v3_reverse_tunnel_proto = out.File
	file_envoy_extensions_filters_network_reverse_tunnel_v3_reverse_tunnel_proto_goTypes = nil
	file_envoy_extensions_filters_network_reverse_tunnel_v3_reverse_tunnel_proto_depIdxs = nil
}
