s2a

type AlpnPolicy struct {

	// If true, the application MUST perform ALPN negotiation.
	EnableAlpnNegotiation bool `` /* 127-byte string literal not displayed */
	// The ordered list of ALPN protocols that specify how the application SHOULD
	// negotiate ALPN during the TLS handshake.
	//
	// The application MAY ignore any ALPN protocols in this list that are not
	// supported by the application.
	AlpnProtocols []AlpnProtocol `` /* 139-byte string literal not displayed */
	// contains filtered or unexported fields
}

type AlpnProtocol int32

type AuthenticationMechanism struct {

	// Applications may specify an identity associated to an authentication
	// mechanism. Otherwise, S2A assumes that the authentication mechanism is
	// associated with the default identity. If the default identity cannot be
	// determined, the request is rejected.
	Identity *Identity `protobuf:"bytes,1,opt,name=identity,proto3" json:"identity,omitempty"`
	// Types that are assignable to MechanismOneof:
	//
	//	*AuthenticationMechanism_Token
	MechanismOneof isAuthenticationMechanism_MechanismOneof `protobuf_oneof:"mechanism_oneof"`
	// contains filtered or unexported fields
}

type AuthenticationMechanism_Token struct {
	// A token that the application uses to authenticate itself to S2A.
	Token string `protobuf:"bytes,2,opt,name=token,proto3,oneof"`
}

type Ciphersuite int32

type ConnectionSide int32

type GetTlsConfigurationReq struct {

	// The role of the application in the TLS connection.
	ConnectionSide ConnectionSide `` /* 137-byte string literal not displayed */
	// The server name indication (SNI) extension, which MAY be populated when a
	// server is offloading to S2A. The SNI is used to determine the server
	// identity if the local identity in the request is empty.
	Sni string `protobuf:"bytes,2,opt,name=sni,proto3" json:"sni,omitempty"`
	// contains filtered or unexported fields
}

type GetTlsConfigurationResp struct {

	// Types that are assignable to TlsConfiguration:
	//
	//	*GetTlsConfigurationResp_ClientTlsConfiguration_
	//	*GetTlsConfigurationResp_ServerTlsConfiguration_
	TlsConfiguration isGetTlsConfigurationResp_TlsConfiguration `protobuf_oneof:"tls_configuration"`
	// contains filtered or unexported fields
}

type GetTlsConfigurationResp_ClientTlsConfiguration struct {

	// The certificate chain that the client MUST use for the TLS handshake.
	// It's a list of PEM-encoded certificates, ordered from leaf to root,
	// excluding the root.
	CertificateChain []string `protobuf:"bytes,1,rep,name=certificate_chain,json=certificateChain,proto3" json:"certificate_chain,omitempty"`
	// The minimum TLS version number that the client MUST use for the TLS
	// handshake. If this field is not provided, the client MUST use the default
	// minimum version of the client's TLS library.
	MinTlsVersion TLSVersion `` /* 132-byte string literal not displayed */
	// The maximum TLS version number that the client MUST use for the TLS
	// handshake. If this field is not provided, the client MUST use the default
	// maximum version of the client's TLS library.
	MaxTlsVersion TLSVersion `` /* 132-byte string literal not displayed */
	// The ordered list of TLS 1.0-1.2 ciphersuites that the client MAY offer to
	// negotiate in the TLS handshake.
	Ciphersuites []Ciphersuite `protobuf:"varint,6,rep,packed,name=ciphersuites,proto3,enum=grpc.gcp.s2a.Ciphersuite" json:"ciphersuites,omitempty"`
	// The policy that dictates how the client negotiates ALPN during the TLS
	// handshake.
	AlpnPolicy *AlpnPolicy `protobuf:"bytes,7,opt,name=alpn_policy,json=alpnPolicy,proto3" json:"alpn_policy,omitempty"`
	// contains filtered or unexported fields
}

type GetTlsConfigurationResp_ClientTlsConfiguration_ struct {
	ClientTlsConfiguration *GetTlsConfigurationResp_ClientTlsConfiguration `protobuf:"bytes,1,opt,name=client_tls_configuration,json=clientTlsConfiguration,proto3,oneof"`
}

type GetTlsConfigurationResp_ServerTlsConfiguration struct {

	// The certificate chain that the server MUST use for the TLS handshake.
	// It's a list of PEM-encoded certificates, ordered from leaf to root,
	// excluding the root.
	CertificateChain []string `protobuf:"bytes,1,rep,name=certificate_chain,json=certificateChain,proto3" json:"certificate_chain,omitempty"`
	// The minimum TLS version number that the server MUST use for the TLS
	// handshake. If this field is not provided, the server MUST use the default
	// minimum version of the server's TLS library.
	MinTlsVersion TLSVersion `` /* 132-byte string literal not displayed */
	// The maximum TLS version number that the server MUST use for the TLS
	// handshake. If this field is not provided, the server MUST use the default
	// maximum version of the server's TLS library.
	MaxTlsVersion TLSVersion `` /* 132-byte string literal not displayed */
	// The ordered list of TLS 1.0-1.2 ciphersuites that the server MAY offer to
	// negotiate in the TLS handshake.
	Ciphersuites []Ciphersuite `protobuf:"varint,10,rep,packed,name=ciphersuites,proto3,enum=grpc.gcp.s2a.Ciphersuite" json:"ciphersuites,omitempty"`
	// Whether to enable TLS resumption.
	TlsResumptionEnabled bool `protobuf:"varint,6,opt,name=tls_resumption_enabled,json=tlsResumptionEnabled,proto3" json:"tls_resumption_enabled,omitempty"`
	// Whether the server MUST request a client certificate (i.e. to negotiate
	// TLS vs. mTLS).
	RequestClientCertificate GetTlsConfigurationResp_ServerTlsConfiguration_RequestClientCertificate `` /* 226-byte string literal not displayed */
	// Returns the maximum number of extra bytes that
	// |OffloadResumptionKeyOperation| can add to the number of unencrypted
	// bytes to form the encrypted bytes.
	MaxOverheadOfTicketAead uint32 `` /* 137-byte string literal not displayed */
	// The policy that dictates how the server negotiates ALPN during the TLS
	// handshake.
	AlpnPolicy *AlpnPolicy `protobuf:"bytes,11,opt,name=alpn_policy,json=alpnPolicy,proto3" json:"alpn_policy,omitempty"`
	// contains filtered or unexported fields
}

type GetTlsConfigurationResp_ServerTlsConfiguration_ struct {
	ServerTlsConfiguration *GetTlsConfigurationResp_ServerTlsConfiguration `protobuf:"bytes,2,opt,name=server_tls_configuration,json=serverTlsConfiguration,proto3,oneof"`
}

type GetTlsConfigurationResp_ServerTlsConfiguration_RequestClientCertificate int32

type Identity struct {

	// Types that are assignable to IdentityOneof:
	//
	//	*Identity_SpiffeId
	//	*Identity_Hostname
	//	*Identity_Uid
	//	*Identity_Username
	//	*Identity_GcpId
	IdentityOneof isIdentity_IdentityOneof `protobuf_oneof:"identity_oneof"`
	// Additional identity-specific attributes.
	Attributes map[string]string `` /* 161-byte string literal not displayed */
	// contains filtered or unexported fields
}

type Identity_GcpId struct {
	// The GCP ID of a connection endpoint.
	GcpId string `protobuf:"bytes,6,opt,name=gcp_id,json=gcpId,proto3,oneof"`
}

type Identity_Hostname struct {
	// The hostname of a connection endpoint.
	Hostname string `protobuf:"bytes,2,opt,name=hostname,proto3,oneof"`
}

type Identity_SpiffeId struct {
	// The SPIFFE ID of a connection endpoint.
	SpiffeId string `protobuf:"bytes,1,opt,name=spiffe_id,json=spiffeId,proto3,oneof"`
}

type Identity_Uid struct {
	// The UID of a connection endpoint.
	Uid string `protobuf:"bytes,4,opt,name=uid,proto3,oneof"`
}

type Identity_Username struct {
	// The username of a connection endpoint.
	Username string `protobuf:"bytes,5,opt,name=username,proto3,oneof"`
}

type OffloadPrivateKeyOperationReq struct {

	// The operation the private key is used for.
	Operation OffloadPrivateKeyOperationReq_PrivateKeyOperation `` /* 140-byte string literal not displayed */
	// The signature algorithm to be used for signing operations.
	SignatureAlgorithm SignatureAlgorithm `` /* 153-byte string literal not displayed */
	// The input bytes to be signed or decrypted.
	//
	// Types that are assignable to InBytes:
	//
	//	*OffloadPrivateKeyOperationReq_RawBytes
	//	*OffloadPrivateKeyOperationReq_Sha256Digest
	//	*OffloadPrivateKeyOperationReq_Sha384Digest
	//	*OffloadPrivateKeyOperationReq_Sha512Digest
	InBytes isOffloadPrivateKeyOperationReq_InBytes `protobuf_oneof:"in_bytes"`
	// contains filtered or unexported fields
}

type OffloadPrivateKeyOperationReq_PrivateKeyOperation int32

type OffloadPrivateKeyOperationReq_RawBytes struct {
	// Raw bytes to be hashed and signed, or decrypted.
	RawBytes []byte `protobuf:"bytes,4,opt,name=raw_bytes,json=rawBytes,proto3,oneof"`
}

type OffloadPrivateKeyOperationReq_Sha256Digest struct {
	// A SHA256 hash to be signed. Must be 32 bytes.
	Sha256Digest []byte `protobuf:"bytes,5,opt,name=sha256_digest,json=sha256Digest,proto3,oneof"`
}

type OffloadPrivateKeyOperationReq_Sha384Digest struct {
	// A SHA384 hash to be signed. Must be 48 bytes.
	Sha384Digest []byte `protobuf:"bytes,6,opt,name=sha384_digest,json=sha384Digest,proto3,oneof"`
}

type OffloadPrivateKeyOperationReq_Sha512Digest struct {
	// A SHA512 hash to be signed. Must be 64 bytes.
	Sha512Digest []byte `protobuf:"bytes,7,opt,name=sha512_digest,json=sha512Digest,proto3,oneof"`
}

type OffloadPrivateKeyOperationResp struct {

	// The signed or decrypted output bytes.
	OutBytes []byte `protobuf:"bytes,1,opt,name=out_bytes,json=outBytes,proto3" json:"out_bytes,omitempty"`
	// contains filtered or unexported fields
}

type OffloadResumptionKeyOperationReq struct {

	// The operation the resumption key is used for.
	Operation OffloadResumptionKeyOperationReq_ResumptionKeyOperation `` /* 146-byte string literal not displayed */
	// The bytes to be encrypted or decrypted.
	InBytes []byte `protobuf:"bytes,2,opt,name=in_bytes,json=inBytes,proto3" json:"in_bytes,omitempty"`
	// contains filtered or unexported fields
}

type OffloadResumptionKeyOperationReq_ResumptionKeyOperation int32

type OffloadResumptionKeyOperationResp struct {

	// The encrypted or decrypted bytes.
	OutBytes []byte `protobuf:"bytes,1,opt,name=out_bytes,json=outBytes,proto3" json:"out_bytes,omitempty"`
	// contains filtered or unexported fields
}

type S2AContext struct {

	// The SPIFFE ID from the peer leaf certificate, if present.
	//
	// This field is only populated if the leaf certificate is a valid SPIFFE
	// SVID; in particular, there is a unique URI SAN and this URI SAN is a valid
	// SPIFFE ID.
	LeafCertSpiffeId string `protobuf:"bytes,1,opt,name=leaf_cert_spiffe_id,json=leafCertSpiffeId,proto3" json:"leaf_cert_spiffe_id,omitempty"`
	// The URIs that are present in the SubjectAltName extension of the peer leaf
	// certificate.
	//
	// Note that the extracted URIs are not validated and may not be properly
	// formatted.
	LeafCertUris []string `protobuf:"bytes,2,rep,name=leaf_cert_uris,json=leafCertUris,proto3" json:"leaf_cert_uris,omitempty"`
	// The DNSNames that are present in the SubjectAltName extension of the peer
	// leaf certificate.
	LeafCertDnsnames []string `protobuf:"bytes,3,rep,name=leaf_cert_dnsnames,json=leafCertDnsnames,proto3" json:"leaf_cert_dnsnames,omitempty"`
	// The (ordered) list of fingerprints in the certificate chain used to verify
	// the given leaf certificate. The order MUST be from leaf certificate
	// fingerprint to root certificate fingerprint.
	//
	// A fingerprint is the base-64 encoding of the SHA256 hash of the
	// DER-encoding of a certificate. The list MAY be populated even if the peer
	// certificate chain was NOT validated successfully.
	PeerCertificateChainFingerprints []string `` /* 161-byte string literal not displayed */
	// The local identity used during session setup.
	LocalIdentity *Identity `protobuf:"bytes,5,opt,name=local_identity,json=localIdentity,proto3" json:"local_identity,omitempty"`
	// The SHA256 hash of the DER-encoding of the local leaf certificate used in
	// the handshake.
	LocalLeafCertFingerprint []byte `` /* 137-byte string literal not displayed */
	// contains filtered or unexported fields
}

type SessionReq struct {

	// The identity corresponding to the TLS configurations that MUST be used for
	// the TLS handshake.
	//
	// If a managed identity already exists, the local identity and authentication
	// mechanisms are ignored. If a managed identity doesn't exist and the local
	// identity is not populated, S2A will try to deduce the managed identity to
	// use from the SNI extension. If that also fails, S2A uses the default
	// identity (if one exists).
	LocalIdentity *Identity `protobuf:"bytes,1,opt,name=local_identity,json=localIdentity,proto3" json:"local_identity,omitempty"`
	// The authentication mechanisms that the application wishes to use to
	// authenticate to S2A, ordered by preference. S2A will always use the first
	// authentication mechanism that matches the managed identity.
	AuthenticationMechanisms []*AuthenticationMechanism `` /* 133-byte string literal not displayed */
	// Types that are assignable to ReqOneof:
	//
	//	*SessionReq_GetTlsConfigurationReq
	//	*SessionReq_OffloadPrivateKeyOperationReq
	//	*SessionReq_OffloadResumptionKeyOperationReq
	//	*SessionReq_ValidatePeerCertificateChainReq
	ReqOneof isSessionReq_ReqOneof `protobuf_oneof:"req_oneof"`
	// contains filtered or unexported fields
}

type SessionReq_GetTlsConfigurationReq struct {
	// Requests the certificate chain and TLS configuration corresponding to the
	// local identity, which the application MUST use to negotiate the TLS
	// handshake.
	GetTlsConfigurationReq *GetTlsConfigurationReq `protobuf:"bytes,3,opt,name=get_tls_configuration_req,json=getTlsConfigurationReq,proto3,oneof"`
}

type SessionReq_OffloadPrivateKeyOperationReq struct {
	// Signs or decrypts the input bytes using a private key corresponding to
	// the local identity in the request.
	//
	// WARNING: More than one OffloadPrivateKeyOperationReq may be sent to the
	// S2Av2 by a server during a TLS 1.2 handshake.
	OffloadPrivateKeyOperationReq *OffloadPrivateKeyOperationReq `protobuf:"bytes,4,opt,name=offload_private_key_operation_req,json=offloadPrivateKeyOperationReq,proto3,oneof"`
}

type SessionReq_OffloadResumptionKeyOperationReq struct {
	// Encrypts or decrypts the input bytes using a resumption key corresponding
	// to the local identity in the request.
	OffloadResumptionKeyOperationReq *OffloadResumptionKeyOperationReq `protobuf:"bytes,5,opt,name=offload_resumption_key_operation_req,json=offloadResumptionKeyOperationReq,proto3,oneof"`
}

type SessionReq_ValidatePeerCertificateChainReq struct {
	// Verifies the peer's certificate chain using
	// (a) trust bundles corresponding to the local identity in the request, and
	// (b) the verification mode in the request.
	ValidatePeerCertificateChainReq *ValidatePeerCertificateChainReq `protobuf:"bytes,6,opt,name=validate_peer_certificate_chain_req,json=validatePeerCertificateChainReq,proto3,oneof"`
}

type SessionResp struct {

	// Status of the session response.
	//
	// The status field is populated so that if an error occurs when making an
	// individual request, then communication with the S2A may continue. If an
	// error is returned directly (e.g. at the gRPC layer), then it may result
	// that the bidirectional stream being closed.
	Status *Status `protobuf:"bytes,1,opt,name=status,proto3" json:"status,omitempty"`
	// Types that are assignable to RespOneof:
	//
	//	*SessionResp_GetTlsConfigurationResp
	//	*SessionResp_OffloadPrivateKeyOperationResp
	//	*SessionResp_OffloadResumptionKeyOperationResp
	//	*SessionResp_ValidatePeerCertificateChainResp
	RespOneof isSessionResp_RespOneof `protobuf_oneof:"resp_oneof"`
	// contains filtered or unexported fields
}

type SessionResp_GetTlsConfigurationResp struct {
	// Contains the certificate chain and TLS configurations corresponding to
	// the local identity.
	GetTlsConfigurationResp *GetTlsConfigurationResp `protobuf:"bytes,2,opt,name=get_tls_configuration_resp,json=getTlsConfigurationResp,proto3,oneof"`
}

type SessionResp_OffloadPrivateKeyOperationResp struct {
	// Contains the signed or encrypted output bytes using the private key
	// corresponding to the local identity.
	OffloadPrivateKeyOperationResp *OffloadPrivateKeyOperationResp `protobuf:"bytes,3,opt,name=offload_private_key_operation_resp,json=offloadPrivateKeyOperationResp,proto3,oneof"`
}

type SessionResp_OffloadResumptionKeyOperationResp struct {
	// Contains the encrypted or decrypted output bytes using the resumption key
	// corresponding to the local identity.
	OffloadResumptionKeyOperationResp *OffloadResumptionKeyOperationResp `protobuf:"bytes,4,opt,name=offload_resumption_key_operation_resp,json=offloadResumptionKeyOperationResp,proto3,oneof"`
}

type SessionResp_ValidatePeerCertificateChainResp struct {
	// Contains the validation result, peer identity and fingerprints of peer
	// certificates.
	ValidatePeerCertificateChainResp *ValidatePeerCertificateChainResp `protobuf:"bytes,5,opt,name=validate_peer_certificate_chain_resp,json=validatePeerCertificateChainResp,proto3,oneof"`
}

type SignatureAlgorithm int32

type Status struct {

	// The status code that is specific to the application and the implementation
	// of S2A, e.g., gRPC status code.
	Code uint32 `protobuf:"varint,1,opt,name=code,proto3" json:"code,omitempty"`
	// The status details.
	Details string `protobuf:"bytes,2,opt,name=details,proto3" json:"details,omitempty"`
	// contains filtered or unexported fields
}

type TLSVersion int32

type ValidatePeerCertificateChainReq struct {

	// The verification mode that S2A MUST use to validate the peer certificate
	// chain.
	Mode ValidatePeerCertificateChainReq_VerificationMode `` /* 129-byte string literal not displayed */
	// Types that are assignable to PeerOneof:
	//
	//	*ValidatePeerCertificateChainReq_ClientPeer_
	//	*ValidatePeerCertificateChainReq_ServerPeer_
	PeerOneof isValidatePeerCertificateChainReq_PeerOneof `protobuf_oneof:"peer_oneof"`
	// contains filtered or unexported fields
}

type ValidatePeerCertificateChainReq_ClientPeer struct {

	// The certificate chain to be verified. The chain MUST be a list of
	// DER-encoded certificates, ordered from leaf to root, excluding the root.
	CertificateChain [][]byte `protobuf:"bytes,1,rep,name=certificate_chain,json=certificateChain,proto3" json:"certificate_chain,omitempty"`
	// contains filtered or unexported fields
}

type ValidatePeerCertificateChainReq_ClientPeer_ struct {
	ClientPeer *ValidatePeerCertificateChainReq_ClientPeer `protobuf:"bytes,2,opt,name=client_peer,json=clientPeer,proto3,oneof"`
}

type ValidatePeerCertificateChainReq_ServerPeer struct {

	// The certificate chain to be verified. The chain MUST be a list of
	// DER-encoded certificates, ordered from leaf to root, excluding the root.
	CertificateChain [][]byte `protobuf:"bytes,1,rep,name=certificate_chain,json=certificateChain,proto3" json:"certificate_chain,omitempty"`
	// The expected hostname of the server.
	ServerHostname string `protobuf:"bytes,2,opt,name=server_hostname,json=serverHostname,proto3" json:"server_hostname,omitempty"`
	// The UnrestrictedClientPolicy specified by the user.
	SerializedUnrestrictedClientPolicy []byte `` /* 167-byte string literal not displayed */
	// contains filtered or unexported fields
}

type ValidatePeerCertificateChainReq_ServerPeer_ struct {
	ServerPeer *ValidatePeerCertificateChainReq_ServerPeer `protobuf:"bytes,3,opt,name=server_peer,json=serverPeer,proto3,oneof"`
}

type ValidatePeerCertificateChainReq_VerificationMode int32

type ValidatePeerCertificateChainResp struct {

	// The result of validating the peer certificate chain.
	ValidationResult ValidatePeerCertificateChainResp_ValidationResult `` /* 178-byte string literal not displayed */
	// The validation details. This field is only populated when the validation
	// result is NOT SUCCESS.
	ValidationDetails string `protobuf:"bytes,2,opt,name=validation_details,json=validationDetails,proto3" json:"validation_details,omitempty"`
	// The S2A context contains information from the peer certificate chain.
	//
	// The S2A context MAY be populated even if validation of the peer certificate
	// chain fails.
	Context *S2AContext `protobuf:"bytes,3,opt,name=context,proto3" json:"context,omitempty"`
	// contains filtered or unexported fields
}

type ValidatePeerCertificateChainResp_ValidationResult int32