go-control-plane: github.com/envoyproxy/go-control-plane/envoy/api/v2/auth Index | Files

package envoy_api_v2_auth

import "github.com/envoyproxy/go-control-plane/envoy/api/v2/auth"

Index

Package Files

cert.pb.go cert.pb.validate.go common.pb.go common.pb.validate.go secret.pb.go secret.pb.validate.go tls.pb.go tls.pb.validate.go

Variables

var (
    TlsParameters_TlsProtocol_name = map[int32]string{
        0:  "TLS_AUTO",
        1:  "TLSv1_0",
        2:  "TLSv1_1",
        3:  "TLSv1_2",
        4:  "TLSv1_3",
    }
    TlsParameters_TlsProtocol_value = map[string]int32{
        "TLS_AUTO": 0,
        "TLSv1_0":  1,
        "TLSv1_1":  2,
        "TLSv1_2":  3,
        "TLSv1_3":  4,
    }
)

Enum value maps for TlsParameters_TlsProtocol.

var (
    CertificateValidationContext_TrustChainVerification_name = map[int32]string{
        0:  "VERIFY_TRUST_CHAIN",
        1:  "ACCEPT_UNTRUSTED",
    }
    CertificateValidationContext_TrustChainVerification_value = map[string]int32{
        "VERIFY_TRUST_CHAIN": 0,
        "ACCEPT_UNTRUSTED":   1,
    }
)

Enum value maps for CertificateValidationContext_TrustChainVerification.

var File_envoy_api_v2_auth_cert_proto protoreflect.FileDescriptor
var File_envoy_api_v2_auth_common_proto protoreflect.FileDescriptor
var File_envoy_api_v2_auth_secret_proto protoreflect.FileDescriptor
var File_envoy_api_v2_auth_tls_proto protoreflect.FileDescriptor

type CertificateValidationContext Uses

type CertificateValidationContext struct {

    // TLS certificate data containing certificate authority certificates to use in verifying
    // a presented peer certificate (e.g. server certificate for clusters or client certificate
    // for listeners). If not specified and a peer certificate is presented it will not be
    // verified. By default, a client certificate is optional, unless one of the additional
    // options (:ref:`require_client_certificate
    // <envoy_api_field_auth.DownstreamTlsContext.require_client_certificate>`,
    // :ref:`verify_certificate_spki
    // <envoy_api_field_auth.CertificateValidationContext.verify_certificate_spki>`,
    // :ref:`verify_certificate_hash
    // <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>`, or
    // :ref:`match_subject_alt_names
    // <envoy_api_field_auth.CertificateValidationContext.match_subject_alt_names>`) is also
    // specified.
    //
    // It can optionally contain certificate revocation lists, in which case Envoy will verify
    // that the presented peer certificate has not been revoked by one of the included CRLs.
    //
    // See :ref:`the TLS overview <arch_overview_ssl_enabling_verification>` for a list of common
    // system CA locations.
    TrustedCa *core.DataSource `protobuf:"bytes,1,opt,name=trusted_ca,json=trustedCa,proto3" json:"trusted_ca,omitempty"`
    // An optional list of base64-encoded SHA-256 hashes. If specified, Envoy will verify that the
    // SHA-256 of the DER-encoded Subject Public Key Information (SPKI) of the presented certificate
    // matches one of the specified values.
    //
    // A base64-encoded SHA-256 of the Subject Public Key Information (SPKI) of the certificate
    // can be generated with the following command:
    //
    // .. code-block:: bash
    //
    //   $ openssl x509 -in path/to/client.crt -noout -pubkey
    //     | openssl pkey -pubin -outform DER
    //     | openssl dgst -sha256 -binary
    //     | openssl enc -base64
    //   NvqYIYSbgK2vCJpQhObf77vv+bQWtc5ek5RIOwPiC9A=
    //
    // This is the format used in HTTP Public Key Pinning.
    //
    // When both:
    // :ref:`verify_certificate_hash
    // <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>` and
    // :ref:`verify_certificate_spki
    // <envoy_api_field_auth.CertificateValidationContext.verify_certificate_spki>` are specified,
    // a hash matching value from either of the lists will result in the certificate being accepted.
    //
    // .. attention::
    //
    //   This option is preferred over :ref:`verify_certificate_hash
    //   <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>`,
    //   because SPKI is tied to a private key, so it doesn't change when the certificate
    //   is renewed using the same private key.
    VerifyCertificateSpki []string `protobuf:"bytes,3,rep,name=verify_certificate_spki,json=verifyCertificateSpki,proto3" json:"verify_certificate_spki,omitempty"`
    // An optional list of hex-encoded SHA-256 hashes. If specified, Envoy will verify that
    // the SHA-256 of the DER-encoded presented certificate matches one of the specified values.
    //
    // A hex-encoded SHA-256 of the certificate can be generated with the following command:
    //
    // .. code-block:: bash
    //
    //   $ openssl x509 -in path/to/client.crt -outform DER | openssl dgst -sha256 | cut -d" " -f2
    //   df6ff72fe9116521268f6f2dd4966f51df479883fe7037b39f75916ac3049d1a
    //
    // A long hex-encoded and colon-separated SHA-256 (a.k.a. "fingerprint") of the certificate
    // can be generated with the following command:
    //
    // .. code-block:: bash
    //
    //   $ openssl x509 -in path/to/client.crt -noout -fingerprint -sha256 | cut -d"=" -f2
    //   DF:6F:F7:2F:E9:11:65:21:26:8F:6F:2D:D4:96:6F:51:DF:47:98:83:FE:70:37:B3:9F:75:91:6A:C3:04:9D:1A
    //
    // Both of those formats are acceptable.
    //
    // When both:
    // :ref:`verify_certificate_hash
    // <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>` and
    // :ref:`verify_certificate_spki
    // <envoy_api_field_auth.CertificateValidationContext.verify_certificate_spki>` are specified,
    // a hash matching value from either of the lists will result in the certificate being accepted.
    VerifyCertificateHash []string `protobuf:"bytes,2,rep,name=verify_certificate_hash,json=verifyCertificateHash,proto3" json:"verify_certificate_hash,omitempty"`
    // An optional list of Subject Alternative Names. If specified, Envoy will verify that the
    // Subject Alternative Name of the presented certificate matches one of the specified values.
    //
    // .. attention::
    //
    //   Subject Alternative Names are easily spoofable and verifying only them is insecure,
    //   therefore this option must be used together with :ref:`trusted_ca
    //   <envoy_api_field_auth.CertificateValidationContext.trusted_ca>`.
    //
    // Deprecated: Do not use.
    VerifySubjectAltName []string `protobuf:"bytes,4,rep,name=verify_subject_alt_name,json=verifySubjectAltName,proto3" json:"verify_subject_alt_name,omitempty"`
    // An optional list of Subject Alternative name matchers. Envoy will verify that the
    // Subject Alternative Name of the presented certificate matches one of the specified matches.
    //
    // When a certificate has wildcard DNS SAN entries, to match a specific client, it should be
    // configured with exact match type in the :ref:`string matcher <envoy_api_msg_type.matcher.StringMatcher>`.
    // For example if the certificate has "\*.example.com" as DNS SAN entry, to allow only "api.example.com",
    // it should be configured as shown below.
    //
    // .. code-block:: yaml
    //
    //  match_subject_alt_names:
    //    exact: "api.example.com"
    //
    // .. attention::
    //
    //   Subject Alternative Names are easily spoofable and verifying only them is insecure,
    //   therefore this option must be used together with :ref:`trusted_ca
    //   <envoy_api_field_auth.CertificateValidationContext.trusted_ca>`.
    MatchSubjectAltNames []*matcher.StringMatcher `protobuf:"bytes,9,rep,name=match_subject_alt_names,json=matchSubjectAltNames,proto3" json:"match_subject_alt_names,omitempty"`
    // [#not-implemented-hide:] Must present a signed time-stamped OCSP response.
    RequireOcspStaple *wrappers.BoolValue `protobuf:"bytes,5,opt,name=require_ocsp_staple,json=requireOcspStaple,proto3" json:"require_ocsp_staple,omitempty"`
    // [#not-implemented-hide:] Must present signed certificate time-stamp.
    RequireSignedCertificateTimestamp *wrappers.BoolValue `protobuf:"bytes,6,opt,name=require_signed_certificate_timestamp,json=requireSignedCertificateTimestamp,proto3" json:"require_signed_certificate_timestamp,omitempty"`
    // An optional `certificate revocation list
    // <https://en.wikipedia.org/wiki/Certificate_revocation_list>`_
    // (in PEM format). If specified, Envoy will verify that the presented peer
    // certificate has not been revoked by this CRL. If this DataSource contains
    // multiple CRLs, all of them will be used.
    Crl *core.DataSource `protobuf:"bytes,7,opt,name=crl,proto3" json:"crl,omitempty"`
    // If specified, Envoy will not reject expired certificates.
    AllowExpiredCertificate bool `protobuf:"varint,8,opt,name=allow_expired_certificate,json=allowExpiredCertificate,proto3" json:"allow_expired_certificate,omitempty"`
    // Certificate trust chain verification mode.
    TrustChainVerification CertificateValidationContext_TrustChainVerification `protobuf:"varint,10,opt,name=trust_chain_verification,json=trustChainVerification,proto3,enum=envoy.api.v2.auth.CertificateValidationContext_TrustChainVerification" json:"trust_chain_verification,omitempty"`
    // contains filtered or unexported fields
}

[#next-free-field: 11]

func (*CertificateValidationContext) Descriptor Uses

func (*CertificateValidationContext) Descriptor() ([]byte, []int)

Deprecated: Use CertificateValidationContext.ProtoReflect.Descriptor instead.

func (*CertificateValidationContext) GetAllowExpiredCertificate Uses

func (x *CertificateValidationContext) GetAllowExpiredCertificate() bool

func (*CertificateValidationContext) GetCrl Uses

func (x *CertificateValidationContext) GetCrl() *core.DataSource

func (*CertificateValidationContext) GetMatchSubjectAltNames Uses

func (x *CertificateValidationContext) GetMatchSubjectAltNames() []*matcher.StringMatcher

func (*CertificateValidationContext) GetRequireOcspStaple Uses

func (x *CertificateValidationContext) GetRequireOcspStaple() *wrappers.BoolValue

func (*CertificateValidationContext) GetRequireSignedCertificateTimestamp Uses

func (x *CertificateValidationContext) GetRequireSignedCertificateTimestamp() *wrappers.BoolValue

func (*CertificateValidationContext) GetTrustChainVerification Uses

func (x *CertificateValidationContext) GetTrustChainVerification() CertificateValidationContext_TrustChainVerification

func (*CertificateValidationContext) GetTrustedCa Uses

func (x *CertificateValidationContext) GetTrustedCa() *core.DataSource

func (*CertificateValidationContext) GetVerifyCertificateHash Uses

func (x *CertificateValidationContext) GetVerifyCertificateHash() []string

func (*CertificateValidationContext) GetVerifyCertificateSpki Uses

func (x *CertificateValidationContext) GetVerifyCertificateSpki() []string

func (*CertificateValidationContext) GetVerifySubjectAltName Uses

func (x *CertificateValidationContext) GetVerifySubjectAltName() []string

Deprecated: Do not use.

func (*CertificateValidationContext) ProtoMessage Uses

func (*CertificateValidationContext) ProtoMessage()

func (*CertificateValidationContext) ProtoReflect Uses

func (x *CertificateValidationContext) ProtoReflect() protoreflect.Message

func (*CertificateValidationContext) Reset Uses

func (x *CertificateValidationContext) Reset()

func (*CertificateValidationContext) String Uses

func (x *CertificateValidationContext) String() string

func (*CertificateValidationContext) Validate Uses

func (m *CertificateValidationContext) Validate() error

Validate checks the field values on CertificateValidationContext with the rules defined in the proto definition for this message. If any rules are violated, an error is returned.

type CertificateValidationContextValidationError Uses

type CertificateValidationContextValidationError struct {
    // contains filtered or unexported fields
}

CertificateValidationContextValidationError is the validation error returned by CertificateValidationContext.Validate if the designated constraints aren't met.

func (CertificateValidationContextValidationError) Cause Uses

func (e CertificateValidationContextValidationError) Cause() error

Cause function returns cause value.

func (CertificateValidationContextValidationError) Error Uses

func (e CertificateValidationContextValidationError) Error() string

Error satisfies the builtin error interface

func (CertificateValidationContextValidationError) ErrorName Uses

func (e CertificateValidationContextValidationError) ErrorName() string

ErrorName returns error name.

func (CertificateValidationContextValidationError) Field Uses

func (e CertificateValidationContextValidationError) Field() string

Field function returns field value.

func (CertificateValidationContextValidationError) Key Uses

func (e CertificateValidationContextValidationError) Key() bool

Key function returns key value.

func (CertificateValidationContextValidationError) Reason Uses

func (e CertificateValidationContextValidationError) Reason() string

Reason function returns reason value.

type CertificateValidationContext_TrustChainVerification Uses

type CertificateValidationContext_TrustChainVerification int32

Peer certificate verification mode.

const (
    // Perform default certificate verification (e.g., against CA / verification lists)
    CertificateValidationContext_VERIFY_TRUST_CHAIN CertificateValidationContext_TrustChainVerification = 0
    // Connections where the certificate fails verification will be permitted.
    // For HTTP connections, the result of certificate verification can be used in route matching. (
    // see :ref:`validated <envoy_api_field_route.RouteMatch.TlsContextMatchOptions.validated>` ).
    CertificateValidationContext_ACCEPT_UNTRUSTED CertificateValidationContext_TrustChainVerification = 1
)

func (CertificateValidationContext_TrustChainVerification) Descriptor Uses

func (CertificateValidationContext_TrustChainVerification) Descriptor() protoreflect.EnumDescriptor

func (CertificateValidationContext_TrustChainVerification) Enum Uses

func (x CertificateValidationContext_TrustChainVerification) Enum() *CertificateValidationContext_TrustChainVerification

func (CertificateValidationContext_TrustChainVerification) EnumDescriptor Uses

func (CertificateValidationContext_TrustChainVerification) EnumDescriptor() ([]byte, []int)

Deprecated: Use CertificateValidationContext_TrustChainVerification.Descriptor instead.

func (CertificateValidationContext_TrustChainVerification) Number Uses

func (x CertificateValidationContext_TrustChainVerification) Number() protoreflect.EnumNumber

func (CertificateValidationContext_TrustChainVerification) String Uses

func (x CertificateValidationContext_TrustChainVerification) String() string

func (CertificateValidationContext_TrustChainVerification) Type Uses

func (CertificateValidationContext_TrustChainVerification) Type() protoreflect.EnumType

type CommonTlsContext Uses

type CommonTlsContext struct {

    // TLS protocol versions, cipher suites etc.
    TlsParams *TlsParameters `protobuf:"bytes,1,opt,name=tls_params,json=tlsParams,proto3" json:"tls_params,omitempty"`
    // :ref:`Multiple TLS certificates <arch_overview_ssl_cert_select>` can be associated with the
    // same context to allow both RSA and ECDSA certificates.
    //
    // Only a single TLS certificate is supported in client contexts. In server contexts, the first
    // RSA certificate is used for clients that only support RSA and the first ECDSA certificate is
    // used for clients that support ECDSA.
    TlsCertificates []*TlsCertificate `protobuf:"bytes,2,rep,name=tls_certificates,json=tlsCertificates,proto3" json:"tls_certificates,omitempty"`
    // Configs for fetching TLS certificates via SDS API.
    TlsCertificateSdsSecretConfigs []*SdsSecretConfig `protobuf:"bytes,6,rep,name=tls_certificate_sds_secret_configs,json=tlsCertificateSdsSecretConfigs,proto3" json:"tls_certificate_sds_secret_configs,omitempty"`
    // Types that are assignable to ValidationContextType:
    //	*CommonTlsContext_ValidationContext
    //	*CommonTlsContext_ValidationContextSdsSecretConfig
    //	*CommonTlsContext_CombinedValidationContext
    ValidationContextType isCommonTlsContext_ValidationContextType `protobuf_oneof:"validation_context_type"`
    // Supplies the list of ALPN protocols that the listener should expose. In
    // practice this is likely to be set to one of two values (see the
    // :ref:`codec_type
    // <envoy_api_field_config.filter.network.http_connection_manager.v2.HttpConnectionManager.codec_type>`
    // parameter in the HTTP connection manager for more information):
    //
    // * "h2,http/1.1" If the listener is going to support both HTTP/2 and HTTP/1.1.
    // * "http/1.1" If the listener is only going to support HTTP/1.1.
    //
    // There is no default for this parameter. If empty, Envoy will not expose ALPN.
    AlpnProtocols []string `protobuf:"bytes,4,rep,name=alpn_protocols,json=alpnProtocols,proto3" json:"alpn_protocols,omitempty"`
    // contains filtered or unexported fields
}

TLS context shared by both client and server TLS contexts. [#next-free-field: 9]

func (*CommonTlsContext) Descriptor Uses

func (*CommonTlsContext) Descriptor() ([]byte, []int)

Deprecated: Use CommonTlsContext.ProtoReflect.Descriptor instead.

func (*CommonTlsContext) GetAlpnProtocols Uses

func (x *CommonTlsContext) GetAlpnProtocols() []string

func (*CommonTlsContext) GetCombinedValidationContext Uses

func (x *CommonTlsContext) GetCombinedValidationContext() *CommonTlsContext_CombinedCertificateValidationContext

func (*CommonTlsContext) GetTlsCertificateSdsSecretConfigs Uses

func (x *CommonTlsContext) GetTlsCertificateSdsSecretConfigs() []*SdsSecretConfig

func (*CommonTlsContext) GetTlsCertificates Uses

func (x *CommonTlsContext) GetTlsCertificates() []*TlsCertificate

func (*CommonTlsContext) GetTlsParams Uses

func (x *CommonTlsContext) GetTlsParams() *TlsParameters

func (*CommonTlsContext) GetValidationContext Uses

func (x *CommonTlsContext) GetValidationContext() *CertificateValidationContext

func (*CommonTlsContext) GetValidationContextSdsSecretConfig Uses

func (x *CommonTlsContext) GetValidationContextSdsSecretConfig() *SdsSecretConfig

func (*CommonTlsContext) GetValidationContextType Uses

func (m *CommonTlsContext) GetValidationContextType() isCommonTlsContext_ValidationContextType

func (*CommonTlsContext) ProtoMessage Uses

func (*CommonTlsContext) ProtoMessage()

func (*CommonTlsContext) ProtoReflect Uses

func (x *CommonTlsContext) ProtoReflect() protoreflect.Message

func (*CommonTlsContext) Reset Uses

func (x *CommonTlsContext) Reset()

func (*CommonTlsContext) String Uses

func (x *CommonTlsContext) String() string

func (*CommonTlsContext) Validate Uses

func (m *CommonTlsContext) Validate() error

Validate checks the field values on CommonTlsContext with the rules defined in the proto definition for this message. If any rules are violated, an error is returned.

type CommonTlsContextValidationError Uses

type CommonTlsContextValidationError struct {
    // contains filtered or unexported fields
}

CommonTlsContextValidationError is the validation error returned by CommonTlsContext.Validate if the designated constraints aren't met.

func (CommonTlsContextValidationError) Cause Uses

func (e CommonTlsContextValidationError) Cause() error

Cause function returns cause value.

func (CommonTlsContextValidationError) Error Uses

func (e CommonTlsContextValidationError) Error() string

Error satisfies the builtin error interface

func (CommonTlsContextValidationError) ErrorName Uses

func (e CommonTlsContextValidationError) ErrorName() string

ErrorName returns error name.

func (CommonTlsContextValidationError) Field Uses

func (e CommonTlsContextValidationError) Field() string

Field function returns field value.

func (CommonTlsContextValidationError) Key Uses

func (e CommonTlsContextValidationError) Key() bool

Key function returns key value.

func (CommonTlsContextValidationError) Reason Uses

func (e CommonTlsContextValidationError) Reason() string

Reason function returns reason value.

type CommonTlsContext_CombinedCertificateValidationContext Uses

type CommonTlsContext_CombinedCertificateValidationContext struct {

    // How to validate peer certificates.
    DefaultValidationContext *CertificateValidationContext `protobuf:"bytes,1,opt,name=default_validation_context,json=defaultValidationContext,proto3" json:"default_validation_context,omitempty"`
    // Config for fetching validation context via SDS API.
    ValidationContextSdsSecretConfig *SdsSecretConfig `protobuf:"bytes,2,opt,name=validation_context_sds_secret_config,json=validationContextSdsSecretConfig,proto3" json:"validation_context_sds_secret_config,omitempty"`
    // contains filtered or unexported fields
}

func (*CommonTlsContext_CombinedCertificateValidationContext) Descriptor Uses

func (*CommonTlsContext_CombinedCertificateValidationContext) Descriptor() ([]byte, []int)

Deprecated: Use CommonTlsContext_CombinedCertificateValidationContext.ProtoReflect.Descriptor instead.

func (*CommonTlsContext_CombinedCertificateValidationContext) GetDefaultValidationContext Uses

func (x *CommonTlsContext_CombinedCertificateValidationContext) GetDefaultValidationContext() *CertificateValidationContext

func (*CommonTlsContext_CombinedCertificateValidationContext) GetValidationContextSdsSecretConfig Uses

func (x *CommonTlsContext_CombinedCertificateValidationContext) GetValidationContextSdsSecretConfig() *SdsSecretConfig

func (*CommonTlsContext_CombinedCertificateValidationContext) ProtoMessage Uses

func (*CommonTlsContext_CombinedCertificateValidationContext) ProtoMessage()

func (*CommonTlsContext_CombinedCertificateValidationContext) ProtoReflect Uses

func (x *CommonTlsContext_CombinedCertificateValidationContext) ProtoReflect() protoreflect.Message

func (*CommonTlsContext_CombinedCertificateValidationContext) Reset Uses

func (x *CommonTlsContext_CombinedCertificateValidationContext) Reset()

func (*CommonTlsContext_CombinedCertificateValidationContext) String Uses

func (x *CommonTlsContext_CombinedCertificateValidationContext) String() string

func (*CommonTlsContext_CombinedCertificateValidationContext) Validate Uses

func (m *CommonTlsContext_CombinedCertificateValidationContext) Validate() error

Validate checks the field values on CommonTlsContext_CombinedCertificateValidationContext with the rules defined in the proto definition for this message. If any rules are violated, an error is returned.

type CommonTlsContext_CombinedCertificateValidationContextValidationError Uses

type CommonTlsContext_CombinedCertificateValidationContextValidationError struct {
    // contains filtered or unexported fields
}

CommonTlsContext_CombinedCertificateValidationContextValidationError is the validation error returned by CommonTlsContext_CombinedCertificateValidationContext.Validate if the designated constraints aren't met.

func (CommonTlsContext_CombinedCertificateValidationContextValidationError) Cause Uses

func (e CommonTlsContext_CombinedCertificateValidationContextValidationError) Cause() error

Cause function returns cause value.

func (CommonTlsContext_CombinedCertificateValidationContextValidationError) Error Uses

func (e CommonTlsContext_CombinedCertificateValidationContextValidationError) Error() string

Error satisfies the builtin error interface

func (CommonTlsContext_CombinedCertificateValidationContextValidationError) ErrorName Uses

func (e CommonTlsContext_CombinedCertificateValidationContextValidationError) ErrorName() string

ErrorName returns error name.

func (CommonTlsContext_CombinedCertificateValidationContextValidationError) Field Uses

func (e CommonTlsContext_CombinedCertificateValidationContextValidationError) Field() string

Field function returns field value.

func (CommonTlsContext_CombinedCertificateValidationContextValidationError) Key Uses

func (e CommonTlsContext_CombinedCertificateValidationContextValidationError) Key() bool

Key function returns key value.

func (CommonTlsContext_CombinedCertificateValidationContextValidationError) Reason Uses

func (e CommonTlsContext_CombinedCertificateValidationContextValidationError) Reason() string

Reason function returns reason value.

type CommonTlsContext_CombinedValidationContext Uses

type CommonTlsContext_CombinedValidationContext struct {
    // Combined certificate validation context holds a default CertificateValidationContext
    // and SDS config. When SDS server returns dynamic CertificateValidationContext, both dynamic
    // and default CertificateValidationContext are merged into a new CertificateValidationContext
    // for validation. This merge is done by Message::MergeFrom(), so dynamic
    // CertificateValidationContext overwrites singular fields in default
    // CertificateValidationContext, and concatenates repeated fields to default
    // CertificateValidationContext, and logical OR is applied to boolean fields.
    CombinedValidationContext *CommonTlsContext_CombinedCertificateValidationContext `protobuf:"bytes,8,opt,name=combined_validation_context,json=combinedValidationContext,proto3,oneof"`
}

type CommonTlsContext_ValidationContext Uses

type CommonTlsContext_ValidationContext struct {
    // How to validate peer certificates.
    ValidationContext *CertificateValidationContext `protobuf:"bytes,3,opt,name=validation_context,json=validationContext,proto3,oneof"`
}

type CommonTlsContext_ValidationContextSdsSecretConfig Uses

type CommonTlsContext_ValidationContextSdsSecretConfig struct {
    // Config for fetching validation context via SDS API.
    ValidationContextSdsSecretConfig *SdsSecretConfig `protobuf:"bytes,7,opt,name=validation_context_sds_secret_config,json=validationContextSdsSecretConfig,proto3,oneof"`
}

type DownstreamTlsContext Uses

type DownstreamTlsContext struct {

    // Common TLS context settings.
    CommonTlsContext *CommonTlsContext `protobuf:"bytes,1,opt,name=common_tls_context,json=commonTlsContext,proto3" json:"common_tls_context,omitempty"`
    // If specified, Envoy will reject connections without a valid client
    // certificate.
    RequireClientCertificate *wrappers.BoolValue `protobuf:"bytes,2,opt,name=require_client_certificate,json=requireClientCertificate,proto3" json:"require_client_certificate,omitempty"`
    // If specified, Envoy will reject connections without a valid and matching SNI.
    // [#not-implemented-hide:]
    RequireSni *wrappers.BoolValue `protobuf:"bytes,3,opt,name=require_sni,json=requireSni,proto3" json:"require_sni,omitempty"`
    // Types that are assignable to SessionTicketKeysType:
    //	*DownstreamTlsContext_SessionTicketKeys
    //	*DownstreamTlsContext_SessionTicketKeysSdsSecretConfig
    //	*DownstreamTlsContext_DisableStatelessSessionResumption
    SessionTicketKeysType isDownstreamTlsContext_SessionTicketKeysType `protobuf_oneof:"session_ticket_keys_type"`
    // If specified, session_timeout will change maximum lifetime (in seconds) of TLS session
    // Currently this value is used as a hint to `TLS session ticket lifetime (for TLSv1.2)
    // <https://tools.ietf.org/html/rfc5077#section-5.6>`
    // only seconds could be specified (fractional seconds are going to be ignored).
    SessionTimeout *duration.Duration `protobuf:"bytes,6,opt,name=session_timeout,json=sessionTimeout,proto3" json:"session_timeout,omitempty"`
    // contains filtered or unexported fields
}

[#next-free-field: 8]

func (*DownstreamTlsContext) Descriptor Uses

func (*DownstreamTlsContext) Descriptor() ([]byte, []int)

Deprecated: Use DownstreamTlsContext.ProtoReflect.Descriptor instead.

func (*DownstreamTlsContext) GetCommonTlsContext Uses

func (x *DownstreamTlsContext) GetCommonTlsContext() *CommonTlsContext

func (*DownstreamTlsContext) GetDisableStatelessSessionResumption Uses

func (x *DownstreamTlsContext) GetDisableStatelessSessionResumption() bool

func (*DownstreamTlsContext) GetRequireClientCertificate Uses

func (x *DownstreamTlsContext) GetRequireClientCertificate() *wrappers.BoolValue

func (*DownstreamTlsContext) GetRequireSni Uses

func (x *DownstreamTlsContext) GetRequireSni() *wrappers.BoolValue

func (*DownstreamTlsContext) GetSessionTicketKeys Uses

func (x *DownstreamTlsContext) GetSessionTicketKeys() *TlsSessionTicketKeys

func (*DownstreamTlsContext) GetSessionTicketKeysSdsSecretConfig Uses

func (x *DownstreamTlsContext) GetSessionTicketKeysSdsSecretConfig() *SdsSecretConfig

func (*DownstreamTlsContext) GetSessionTicketKeysType Uses

func (m *DownstreamTlsContext) GetSessionTicketKeysType() isDownstreamTlsContext_SessionTicketKeysType

func (*DownstreamTlsContext) GetSessionTimeout Uses

func (x *DownstreamTlsContext) GetSessionTimeout() *duration.Duration

func (*DownstreamTlsContext) ProtoMessage Uses

func (*DownstreamTlsContext) ProtoMessage()

func (*DownstreamTlsContext) ProtoReflect Uses

func (x *DownstreamTlsContext) ProtoReflect() protoreflect.Message

func (*DownstreamTlsContext) Reset Uses

func (x *DownstreamTlsContext) Reset()

func (*DownstreamTlsContext) String Uses

func (x *DownstreamTlsContext) String() string

func (*DownstreamTlsContext) Validate Uses

func (m *DownstreamTlsContext) Validate() error

Validate checks the field values on DownstreamTlsContext with the rules defined in the proto definition for this message. If any rules are violated, an error is returned.

type DownstreamTlsContextValidationError Uses

type DownstreamTlsContextValidationError struct {
    // contains filtered or unexported fields
}

DownstreamTlsContextValidationError is the validation error returned by DownstreamTlsContext.Validate if the designated constraints aren't met.

func (DownstreamTlsContextValidationError) Cause Uses

func (e DownstreamTlsContextValidationError) Cause() error

Cause function returns cause value.

func (DownstreamTlsContextValidationError) Error Uses

func (e DownstreamTlsContextValidationError) Error() string

Error satisfies the builtin error interface

func (DownstreamTlsContextValidationError) ErrorName Uses

func (e DownstreamTlsContextValidationError) ErrorName() string

ErrorName returns error name.

func (DownstreamTlsContextValidationError) Field Uses

func (e DownstreamTlsContextValidationError) Field() string

Field function returns field value.

func (DownstreamTlsContextValidationError) Key Uses

func (e DownstreamTlsContextValidationError) Key() bool

Key function returns key value.

func (DownstreamTlsContextValidationError) Reason Uses

func (e DownstreamTlsContextValidationError) Reason() string

Reason function returns reason value.

type DownstreamTlsContext_DisableStatelessSessionResumption Uses

type DownstreamTlsContext_DisableStatelessSessionResumption struct {
    // Config for controlling stateless TLS session resumption: setting this to true will cause the TLS
    // server to not issue TLS session tickets for the purposes of stateless TLS session resumption.
    // If set to false, the TLS server will issue TLS session tickets and encrypt/decrypt them using
    // the keys specified through either :ref:`session_ticket_keys <envoy_api_field_auth.DownstreamTlsContext.session_ticket_keys>`
    // or :ref:`session_ticket_keys_sds_secret_config <envoy_api_field_auth.DownstreamTlsContext.session_ticket_keys_sds_secret_config>`.
    // If this config is set to false and no keys are explicitly configured, the TLS server will issue
    // TLS session tickets and encrypt/decrypt them using an internally-generated and managed key, with the
    // implication that sessions cannot be resumed across hot restarts or on different hosts.
    DisableStatelessSessionResumption bool `protobuf:"varint,7,opt,name=disable_stateless_session_resumption,json=disableStatelessSessionResumption,proto3,oneof"`
}

type DownstreamTlsContext_SessionTicketKeys Uses

type DownstreamTlsContext_SessionTicketKeys struct {
    // TLS session ticket key settings.
    SessionTicketKeys *TlsSessionTicketKeys `protobuf:"bytes,4,opt,name=session_ticket_keys,json=sessionTicketKeys,proto3,oneof"`
}

type DownstreamTlsContext_SessionTicketKeysSdsSecretConfig Uses

type DownstreamTlsContext_SessionTicketKeysSdsSecretConfig struct {
    // Config for fetching TLS session ticket keys via SDS API.
    SessionTicketKeysSdsSecretConfig *SdsSecretConfig `protobuf:"bytes,5,opt,name=session_ticket_keys_sds_secret_config,json=sessionTicketKeysSdsSecretConfig,proto3,oneof"`
}

type GenericSecret Uses

type GenericSecret struct {

    // Secret of generic type and is available to filters.
    Secret *core.DataSource `protobuf:"bytes,1,opt,name=secret,proto3" json:"secret,omitempty"`
    // contains filtered or unexported fields
}

func (*GenericSecret) Descriptor Uses

func (*GenericSecret) Descriptor() ([]byte, []int)

Deprecated: Use GenericSecret.ProtoReflect.Descriptor instead.

func (*GenericSecret) GetSecret Uses

func (x *GenericSecret) GetSecret() *core.DataSource

func (*GenericSecret) ProtoMessage Uses

func (*GenericSecret) ProtoMessage()

func (*GenericSecret) ProtoReflect Uses

func (x *GenericSecret) ProtoReflect() protoreflect.Message

func (*GenericSecret) Reset Uses

func (x *GenericSecret) Reset()

func (*GenericSecret) String Uses

func (x *GenericSecret) String() string

func (*GenericSecret) Validate Uses

func (m *GenericSecret) Validate() error

Validate checks the field values on GenericSecret with the rules defined in the proto definition for this message. If any rules are violated, an error is returned.

type GenericSecretValidationError Uses

type GenericSecretValidationError struct {
    // contains filtered or unexported fields
}

GenericSecretValidationError is the validation error returned by GenericSecret.Validate if the designated constraints aren't met.

func (GenericSecretValidationError) Cause Uses

func (e GenericSecretValidationError) Cause() error

Cause function returns cause value.

func (GenericSecretValidationError) Error Uses

func (e GenericSecretValidationError) Error() string

Error satisfies the builtin error interface

func (GenericSecretValidationError) ErrorName Uses

func (e GenericSecretValidationError) ErrorName() string

ErrorName returns error name.

func (GenericSecretValidationError) Field Uses

func (e GenericSecretValidationError) Field() string

Field function returns field value.

func (GenericSecretValidationError) Key Uses

func (e GenericSecretValidationError) Key() bool

Key function returns key value.

func (GenericSecretValidationError) Reason Uses

func (e GenericSecretValidationError) Reason() string

Reason function returns reason value.

type PrivateKeyProvider Uses

type PrivateKeyProvider struct {

    // Private key method provider name. The name must match a
    // supported private key method provider type.
    ProviderName string `protobuf:"bytes,1,opt,name=provider_name,json=providerName,proto3" json:"provider_name,omitempty"`
    // Private key method provider specific configuration.
    //
    // Types that are assignable to ConfigType:
    //	*PrivateKeyProvider_Config
    //	*PrivateKeyProvider_TypedConfig
    ConfigType isPrivateKeyProvider_ConfigType `protobuf_oneof:"config_type"`
    // contains filtered or unexported fields
}

BoringSSL private key method configuration. The private key methods are used for external (potentially asynchronous) signing and decryption operations. Some use cases for private key methods would be TPM support and TLS acceleration.

func (*PrivateKeyProvider) Descriptor Uses

func (*PrivateKeyProvider) Descriptor() ([]byte, []int)

Deprecated: Use PrivateKeyProvider.ProtoReflect.Descriptor instead.

func (*PrivateKeyProvider) GetConfig Uses

func (x *PrivateKeyProvider) GetConfig() *_struct.Struct

Deprecated: Do not use.

func (*PrivateKeyProvider) GetConfigType Uses

func (m *PrivateKeyProvider) GetConfigType() isPrivateKeyProvider_ConfigType

func (*PrivateKeyProvider) GetProviderName Uses

func (x *PrivateKeyProvider) GetProviderName() string

func (*PrivateKeyProvider) GetTypedConfig Uses

func (x *PrivateKeyProvider) GetTypedConfig() *any.Any

func (*PrivateKeyProvider) ProtoMessage Uses

func (*PrivateKeyProvider) ProtoMessage()

func (*PrivateKeyProvider) ProtoReflect Uses

func (x *PrivateKeyProvider) ProtoReflect() protoreflect.Message

func (*PrivateKeyProvider) Reset Uses

func (x *PrivateKeyProvider) Reset()

func (*PrivateKeyProvider) String Uses

func (x *PrivateKeyProvider) String() string

func (*PrivateKeyProvider) Validate Uses

func (m *PrivateKeyProvider) Validate() error

Validate checks the field values on PrivateKeyProvider with the rules defined in the proto definition for this message. If any rules are violated, an error is returned.

type PrivateKeyProviderValidationError Uses

type PrivateKeyProviderValidationError struct {
    // contains filtered or unexported fields
}

PrivateKeyProviderValidationError is the validation error returned by PrivateKeyProvider.Validate if the designated constraints aren't met.

func (PrivateKeyProviderValidationError) Cause Uses

func (e PrivateKeyProviderValidationError) Cause() error

Cause function returns cause value.

func (PrivateKeyProviderValidationError) Error Uses

func (e PrivateKeyProviderValidationError) Error() string

Error satisfies the builtin error interface

func (PrivateKeyProviderValidationError) ErrorName Uses

func (e PrivateKeyProviderValidationError) ErrorName() string

ErrorName returns error name.

func (PrivateKeyProviderValidationError) Field Uses

func (e PrivateKeyProviderValidationError) Field() string

Field function returns field value.

func (PrivateKeyProviderValidationError) Key Uses

func (e PrivateKeyProviderValidationError) Key() bool

Key function returns key value.

func (PrivateKeyProviderValidationError) Reason Uses

func (e PrivateKeyProviderValidationError) Reason() string

Reason function returns reason value.

type PrivateKeyProvider_Config Uses

type PrivateKeyProvider_Config struct {
    // Deprecated: Do not use.
    Config *_struct.Struct `protobuf:"bytes,2,opt,name=config,proto3,oneof"`
}

type PrivateKeyProvider_TypedConfig Uses

type PrivateKeyProvider_TypedConfig struct {
    TypedConfig *any.Any `protobuf:"bytes,3,opt,name=typed_config,json=typedConfig,proto3,oneof"`
}

type SdsSecretConfig Uses

type SdsSecretConfig struct {

    // Name (FQDN, UUID, SPKI, SHA256, etc.) by which the secret can be uniquely referred to.
    // When both name and config are specified, then secret can be fetched and/or reloaded via
    // SDS. When only name is specified, then secret will be loaded from static resources.
    Name      string             `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
    SdsConfig *core.ConfigSource `protobuf:"bytes,2,opt,name=sds_config,json=sdsConfig,proto3" json:"sds_config,omitempty"`
    // contains filtered or unexported fields
}

func (*SdsSecretConfig) Descriptor Uses

func (*SdsSecretConfig) Descriptor() ([]byte, []int)

Deprecated: Use SdsSecretConfig.ProtoReflect.Descriptor instead.

func (*SdsSecretConfig) GetName Uses

func (x *SdsSecretConfig) GetName() string

func (*SdsSecretConfig) GetSdsConfig Uses

func (x *SdsSecretConfig) GetSdsConfig() *core.ConfigSource

func (*SdsSecretConfig) ProtoMessage Uses

func (*SdsSecretConfig) ProtoMessage()

func (*SdsSecretConfig) ProtoReflect Uses

func (x *SdsSecretConfig) ProtoReflect() protoreflect.Message

func (*SdsSecretConfig) Reset Uses

func (x *SdsSecretConfig) Reset()

func (*SdsSecretConfig) String Uses

func (x *SdsSecretConfig) String() string

func (*SdsSecretConfig) Validate Uses

func (m *SdsSecretConfig) Validate() error

Validate checks the field values on SdsSecretConfig with the rules defined in the proto definition for this message. If any rules are violated, an error is returned.

type SdsSecretConfigValidationError Uses

type SdsSecretConfigValidationError struct {
    // contains filtered or unexported fields
}

SdsSecretConfigValidationError is the validation error returned by SdsSecretConfig.Validate if the designated constraints aren't met.

func (SdsSecretConfigValidationError) Cause Uses

func (e SdsSecretConfigValidationError) Cause() error

Cause function returns cause value.

func (SdsSecretConfigValidationError) Error Uses

func (e SdsSecretConfigValidationError) Error() string

Error satisfies the builtin error interface

func (SdsSecretConfigValidationError) ErrorName Uses

func (e SdsSecretConfigValidationError) ErrorName() string

ErrorName returns error name.

func (SdsSecretConfigValidationError) Field Uses

func (e SdsSecretConfigValidationError) Field() string

Field function returns field value.

func (SdsSecretConfigValidationError) Key Uses

func (e SdsSecretConfigValidationError) Key() bool

Key function returns key value.

func (SdsSecretConfigValidationError) Reason Uses

func (e SdsSecretConfigValidationError) Reason() string

Reason function returns reason value.

type Secret Uses

type Secret struct {

    // Name (FQDN, UUID, SPKI, SHA256, etc.) by which the secret can be uniquely referred to.
    Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
    // Types that are assignable to Type:
    //	*Secret_TlsCertificate
    //	*Secret_SessionTicketKeys
    //	*Secret_ValidationContext
    //	*Secret_GenericSecret
    Type isSecret_Type `protobuf_oneof:"type"`
    // contains filtered or unexported fields
}

[#next-free-field: 6]

func (*Secret) Descriptor Uses

func (*Secret) Descriptor() ([]byte, []int)

Deprecated: Use Secret.ProtoReflect.Descriptor instead.

func (*Secret) GetGenericSecret Uses

func (x *Secret) GetGenericSecret() *GenericSecret

func (*Secret) GetName Uses

func (x *Secret) GetName() string

func (*Secret) GetSessionTicketKeys Uses

func (x *Secret) GetSessionTicketKeys() *TlsSessionTicketKeys

func (*Secret) GetTlsCertificate Uses

func (x *Secret) GetTlsCertificate() *TlsCertificate

func (*Secret) GetType Uses

func (m *Secret) GetType() isSecret_Type

func (*Secret) GetValidationContext Uses

func (x *Secret) GetValidationContext() *CertificateValidationContext

func (*Secret) ProtoMessage Uses

func (*Secret) ProtoMessage()

func (*Secret) ProtoReflect Uses

func (x *Secret) ProtoReflect() protoreflect.Message

func (*Secret) Reset Uses

func (x *Secret) Reset()

func (*Secret) String Uses

func (x *Secret) String() string

func (*Secret) Validate Uses

func (m *Secret) Validate() error

Validate checks the field values on Secret with the rules defined in the proto definition for this message. If any rules are violated, an error is returned.

type SecretValidationError Uses

type SecretValidationError struct {
    // contains filtered or unexported fields
}

SecretValidationError is the validation error returned by Secret.Validate if the designated constraints aren't met.

func (SecretValidationError) Cause Uses

func (e SecretValidationError) Cause() error

Cause function returns cause value.

func (SecretValidationError) Error Uses

func (e SecretValidationError) Error() string

Error satisfies the builtin error interface

func (SecretValidationError) ErrorName Uses

func (e SecretValidationError) ErrorName() string

ErrorName returns error name.

func (SecretValidationError) Field Uses

func (e SecretValidationError) Field() string

Field function returns field value.

func (SecretValidationError) Key Uses

func (e SecretValidationError) Key() bool

Key function returns key value.

func (SecretValidationError) Reason Uses

func (e SecretValidationError) Reason() string

Reason function returns reason value.

type Secret_GenericSecret Uses

type Secret_GenericSecret struct {
    GenericSecret *GenericSecret `protobuf:"bytes,5,opt,name=generic_secret,json=genericSecret,proto3,oneof"`
}

type Secret_SessionTicketKeys Uses

type Secret_SessionTicketKeys struct {
    SessionTicketKeys *TlsSessionTicketKeys `protobuf:"bytes,3,opt,name=session_ticket_keys,json=sessionTicketKeys,proto3,oneof"`
}

type Secret_TlsCertificate Uses

type Secret_TlsCertificate struct {
    TlsCertificate *TlsCertificate `protobuf:"bytes,2,opt,name=tls_certificate,json=tlsCertificate,proto3,oneof"`
}

type Secret_ValidationContext Uses

type Secret_ValidationContext struct {
    ValidationContext *CertificateValidationContext `protobuf:"bytes,4,opt,name=validation_context,json=validationContext,proto3,oneof"`
}

type TlsCertificate Uses

type TlsCertificate struct {

    // The TLS certificate chain.
    CertificateChain *core.DataSource `protobuf:"bytes,1,opt,name=certificate_chain,json=certificateChain,proto3" json:"certificate_chain,omitempty"`
    // The TLS private key.
    PrivateKey *core.DataSource `protobuf:"bytes,2,opt,name=private_key,json=privateKey,proto3" json:"private_key,omitempty"`
    // BoringSSL private key method provider. This is an alternative to :ref:`private_key
    // <envoy_api_field_auth.TlsCertificate.private_key>` field. This can't be
    // marked as ``oneof`` due to API compatibility reasons. Setting both :ref:`private_key
    // <envoy_api_field_auth.TlsCertificate.private_key>` and
    // :ref:`private_key_provider
    // <envoy_api_field_auth.TlsCertificate.private_key_provider>` fields will result in an
    // error.
    PrivateKeyProvider *PrivateKeyProvider `protobuf:"bytes,6,opt,name=private_key_provider,json=privateKeyProvider,proto3" json:"private_key_provider,omitempty"`
    // The password to decrypt the TLS private key. If this field is not set, it is assumed that the
    // TLS private key is not password encrypted.
    Password *core.DataSource `protobuf:"bytes,3,opt,name=password,proto3" json:"password,omitempty"`
    // [#not-implemented-hide:]
    OcspStaple *core.DataSource `protobuf:"bytes,4,opt,name=ocsp_staple,json=ocspStaple,proto3" json:"ocsp_staple,omitempty"`
    // [#not-implemented-hide:]
    SignedCertificateTimestamp []*core.DataSource `protobuf:"bytes,5,rep,name=signed_certificate_timestamp,json=signedCertificateTimestamp,proto3" json:"signed_certificate_timestamp,omitempty"`
    // contains filtered or unexported fields
}

[#next-free-field: 7]

func (*TlsCertificate) Descriptor Uses

func (*TlsCertificate) Descriptor() ([]byte, []int)

Deprecated: Use TlsCertificate.ProtoReflect.Descriptor instead.

func (*TlsCertificate) GetCertificateChain Uses

func (x *TlsCertificate) GetCertificateChain() *core.DataSource

func (*TlsCertificate) GetOcspStaple Uses

func (x *TlsCertificate) GetOcspStaple() *core.DataSource

func (*TlsCertificate) GetPassword Uses

func (x *TlsCertificate) GetPassword() *core.DataSource

func (*TlsCertificate) GetPrivateKey Uses

func (x *TlsCertificate) GetPrivateKey() *core.DataSource

func (*TlsCertificate) GetPrivateKeyProvider Uses

func (x *TlsCertificate) GetPrivateKeyProvider() *PrivateKeyProvider

func (*TlsCertificate) GetSignedCertificateTimestamp Uses

func (x *TlsCertificate) GetSignedCertificateTimestamp() []*core.DataSource

func (*TlsCertificate) ProtoMessage Uses

func (*TlsCertificate) ProtoMessage()

func (*TlsCertificate) ProtoReflect Uses

func (x *TlsCertificate) ProtoReflect() protoreflect.Message

func (*TlsCertificate) Reset Uses

func (x *TlsCertificate) Reset()

func (*TlsCertificate) String Uses

func (x *TlsCertificate) String() string

func (*TlsCertificate) Validate Uses

func (m *TlsCertificate) Validate() error

Validate checks the field values on TlsCertificate with the rules defined in the proto definition for this message. If any rules are violated, an error is returned.

type TlsCertificateValidationError Uses

type TlsCertificateValidationError struct {
    // contains filtered or unexported fields
}

TlsCertificateValidationError is the validation error returned by TlsCertificate.Validate if the designated constraints aren't met.

func (TlsCertificateValidationError) Cause Uses

func (e TlsCertificateValidationError) Cause() error

Cause function returns cause value.

func (TlsCertificateValidationError) Error Uses

func (e TlsCertificateValidationError) Error() string

Error satisfies the builtin error interface

func (TlsCertificateValidationError) ErrorName Uses

func (e TlsCertificateValidationError) ErrorName() string

ErrorName returns error name.

func (TlsCertificateValidationError) Field Uses

func (e TlsCertificateValidationError) Field() string

Field function returns field value.

func (TlsCertificateValidationError) Key Uses

func (e TlsCertificateValidationError) Key() bool

Key function returns key value.

func (TlsCertificateValidationError) Reason Uses

func (e TlsCertificateValidationError) Reason() string

Reason function returns reason value.

type TlsParameters Uses

type TlsParameters struct {

    // Minimum TLS protocol version. By default, it's ``TLSv1_2`` for clients and ``TLSv1_0`` for
    // servers.
    TlsMinimumProtocolVersion TlsParameters_TlsProtocol `protobuf:"varint,1,opt,name=tls_minimum_protocol_version,json=tlsMinimumProtocolVersion,proto3,enum=envoy.api.v2.auth.TlsParameters_TlsProtocol" json:"tls_minimum_protocol_version,omitempty"`
    // Maximum TLS protocol version. By default, it's ``TLSv1_2`` for clients and ``TLSv1_3`` for
    // servers.
    TlsMaximumProtocolVersion TlsParameters_TlsProtocol `protobuf:"varint,2,opt,name=tls_maximum_protocol_version,json=tlsMaximumProtocolVersion,proto3,enum=envoy.api.v2.auth.TlsParameters_TlsProtocol" json:"tls_maximum_protocol_version,omitempty"`
    // If specified, the TLS listener will only support the specified `cipher list
    // <https://commondatastorage.googleapis.com/chromium-boringssl-docs/ssl.h.html#Cipher-suite-configuration>`_
    // when negotiating TLS 1.0-1.2 (this setting has no effect when negotiating TLS 1.3). If not
    // specified, the default list will be used.
    //
    // In non-FIPS builds, the default cipher list is:
    //
    // .. code-block:: none
    //
    //   [ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305]
    //   [ECDHE-RSA-AES128-GCM-SHA256|ECDHE-RSA-CHACHA20-POLY1305]
    //   ECDHE-ECDSA-AES128-SHA
    //   ECDHE-RSA-AES128-SHA
    //   AES128-GCM-SHA256
    //   AES128-SHA
    //   ECDHE-ECDSA-AES256-GCM-SHA384
    //   ECDHE-RSA-AES256-GCM-SHA384
    //   ECDHE-ECDSA-AES256-SHA
    //   ECDHE-RSA-AES256-SHA
    //   AES256-GCM-SHA384
    //   AES256-SHA
    //
    // In builds using :ref:`BoringSSL FIPS <arch_overview_ssl_fips>`, the default cipher list is:
    //
    // .. code-block:: none
    //
    //   ECDHE-ECDSA-AES128-GCM-SHA256
    //   ECDHE-RSA-AES128-GCM-SHA256
    //   ECDHE-ECDSA-AES128-SHA
    //   ECDHE-RSA-AES128-SHA
    //   AES128-GCM-SHA256
    //   AES128-SHA
    //   ECDHE-ECDSA-AES256-GCM-SHA384
    //   ECDHE-RSA-AES256-GCM-SHA384
    //   ECDHE-ECDSA-AES256-SHA
    //   ECDHE-RSA-AES256-SHA
    //   AES256-GCM-SHA384
    //   AES256-SHA
    CipherSuites []string `protobuf:"bytes,3,rep,name=cipher_suites,json=cipherSuites,proto3" json:"cipher_suites,omitempty"`
    // If specified, the TLS connection will only support the specified ECDH
    // curves. If not specified, the default curves will be used.
    //
    // In non-FIPS builds, the default curves are:
    //
    // .. code-block:: none
    //
    //   X25519
    //   P-256
    //
    // In builds using :ref:`BoringSSL FIPS <arch_overview_ssl_fips>`, the default curve is:
    //
    // .. code-block:: none
    //
    //   P-256
    EcdhCurves []string `protobuf:"bytes,4,rep,name=ecdh_curves,json=ecdhCurves,proto3" json:"ecdh_curves,omitempty"`
    // contains filtered or unexported fields
}

func (*TlsParameters) Descriptor Uses

func (*TlsParameters) Descriptor() ([]byte, []int)

Deprecated: Use TlsParameters.ProtoReflect.Descriptor instead.

func (*TlsParameters) GetCipherSuites Uses

func (x *TlsParameters) GetCipherSuites() []string

func (*TlsParameters) GetEcdhCurves Uses

func (x *TlsParameters) GetEcdhCurves() []string

func (*TlsParameters) GetTlsMaximumProtocolVersion Uses

func (x *TlsParameters) GetTlsMaximumProtocolVersion() TlsParameters_TlsProtocol

func (*TlsParameters) GetTlsMinimumProtocolVersion Uses

func (x *TlsParameters) GetTlsMinimumProtocolVersion() TlsParameters_TlsProtocol

func (*TlsParameters) ProtoMessage Uses

func (*TlsParameters) ProtoMessage()

func (*TlsParameters) ProtoReflect Uses

func (x *TlsParameters) ProtoReflect() protoreflect.Message

func (*TlsParameters) Reset Uses

func (x *TlsParameters) Reset()

func (*TlsParameters) String Uses

func (x *TlsParameters) String() string

func (*TlsParameters) Validate Uses

func (m *TlsParameters) Validate() error

Validate checks the field values on TlsParameters with the rules defined in the proto definition for this message. If any rules are violated, an error is returned.

type TlsParametersValidationError Uses

type TlsParametersValidationError struct {
    // contains filtered or unexported fields
}

TlsParametersValidationError is the validation error returned by TlsParameters.Validate if the designated constraints aren't met.

func (TlsParametersValidationError) Cause Uses

func (e TlsParametersValidationError) Cause() error

Cause function returns cause value.

func (TlsParametersValidationError) Error Uses

func (e TlsParametersValidationError) Error() string

Error satisfies the builtin error interface

func (TlsParametersValidationError) ErrorName Uses

func (e TlsParametersValidationError) ErrorName() string

ErrorName returns error name.

func (TlsParametersValidationError) Field Uses

func (e TlsParametersValidationError) Field() string

Field function returns field value.

func (TlsParametersValidationError) Key Uses

func (e TlsParametersValidationError) Key() bool

Key function returns key value.

func (TlsParametersValidationError) Reason Uses

func (e TlsParametersValidationError) Reason() string

Reason function returns reason value.

type TlsParameters_TlsProtocol Uses

type TlsParameters_TlsProtocol int32
const (
    // Envoy will choose the optimal TLS version.
    TlsParameters_TLS_AUTO TlsParameters_TlsProtocol = 0
    // TLS 1.0
    TlsParameters_TLSv1_0 TlsParameters_TlsProtocol = 1
    // TLS 1.1
    TlsParameters_TLSv1_1 TlsParameters_TlsProtocol = 2
    // TLS 1.2
    TlsParameters_TLSv1_2 TlsParameters_TlsProtocol = 3
    // TLS 1.3
    TlsParameters_TLSv1_3 TlsParameters_TlsProtocol = 4
)

func (TlsParameters_TlsProtocol) Descriptor Uses

func (TlsParameters_TlsProtocol) Descriptor() protoreflect.EnumDescriptor

func (TlsParameters_TlsProtocol) Enum Uses

func (x TlsParameters_TlsProtocol) Enum() *TlsParameters_TlsProtocol

func (TlsParameters_TlsProtocol) EnumDescriptor Uses

func (TlsParameters_TlsProtocol) EnumDescriptor() ([]byte, []int)

Deprecated: Use TlsParameters_TlsProtocol.Descriptor instead.

func (TlsParameters_TlsProtocol) Number Uses

func (x TlsParameters_TlsProtocol) Number() protoreflect.EnumNumber

func (TlsParameters_TlsProtocol) String Uses

func (x TlsParameters_TlsProtocol) String() string

func (TlsParameters_TlsProtocol) Type Uses

func (TlsParameters_TlsProtocol) Type() protoreflect.EnumType

type TlsSessionTicketKeys Uses

type TlsSessionTicketKeys struct {

    // Keys for encrypting and decrypting TLS session tickets. The
    // first key in the array contains the key to encrypt all new sessions created by this context.
    // All keys are candidates for decrypting received tickets. This allows for easy rotation of keys
    // by, for example, putting the new key first, and the previous key second.
    //
    // If :ref:`session_ticket_keys <envoy_api_field_auth.DownstreamTlsContext.session_ticket_keys>`
    // is not specified, the TLS library will still support resuming sessions via tickets, but it will
    // use an internally-generated and managed key, so sessions cannot be resumed across hot restarts
    // or on different hosts.
    //
    // Each key must contain exactly 80 bytes of cryptographically-secure random data. For
    // example, the output of ``openssl rand 80``.
    //
    // .. attention::
    //
    //   Using this feature has serious security considerations and risks. Improper handling of keys
    //   may result in loss of secrecy in connections, even if ciphers supporting perfect forward
    //   secrecy are used. See https://www.imperialviolet.org/2013/06/27/botchingpfs.html for some
    //   discussion. To minimize the risk, you must:
    //
    //   * Keep the session ticket keys at least as secure as your TLS certificate private keys
    //   * Rotate session ticket keys at least daily, and preferably hourly
    //   * Always generate keys using a cryptographically-secure random data source
    Keys []*core.DataSource `protobuf:"bytes,1,rep,name=keys,proto3" json:"keys,omitempty"`
    // contains filtered or unexported fields
}

func (*TlsSessionTicketKeys) Descriptor Uses

func (*TlsSessionTicketKeys) Descriptor() ([]byte, []int)

Deprecated: Use TlsSessionTicketKeys.ProtoReflect.Descriptor instead.

func (*TlsSessionTicketKeys) GetKeys Uses

func (x *TlsSessionTicketKeys) GetKeys() []*core.DataSource

func (*TlsSessionTicketKeys) ProtoMessage Uses

func (*TlsSessionTicketKeys) ProtoMessage()

func (*TlsSessionTicketKeys) ProtoReflect Uses

func (x *TlsSessionTicketKeys) ProtoReflect() protoreflect.Message

func (*TlsSessionTicketKeys) Reset Uses

func (x *TlsSessionTicketKeys) Reset()

func (*TlsSessionTicketKeys) String Uses

func (x *TlsSessionTicketKeys) String() string

func (*TlsSessionTicketKeys) Validate Uses

func (m *TlsSessionTicketKeys) Validate() error

Validate checks the field values on TlsSessionTicketKeys with the rules defined in the proto definition for this message. If any rules are violated, an error is returned.

type TlsSessionTicketKeysValidationError Uses

type TlsSessionTicketKeysValidationError struct {
    // contains filtered or unexported fields
}

TlsSessionTicketKeysValidationError is the validation error returned by TlsSessionTicketKeys.Validate if the designated constraints aren't met.

func (TlsSessionTicketKeysValidationError) Cause Uses

func (e TlsSessionTicketKeysValidationError) Cause() error

Cause function returns cause value.

func (TlsSessionTicketKeysValidationError) Error Uses

func (e TlsSessionTicketKeysValidationError) Error() string

Error satisfies the builtin error interface

func (TlsSessionTicketKeysValidationError) ErrorName Uses

func (e TlsSessionTicketKeysValidationError) ErrorName() string

ErrorName returns error name.

func (TlsSessionTicketKeysValidationError) Field Uses

func (e TlsSessionTicketKeysValidationError) Field() string

Field function returns field value.

func (TlsSessionTicketKeysValidationError) Key Uses

func (e TlsSessionTicketKeysValidationError) Key() bool

Key function returns key value.

func (TlsSessionTicketKeysValidationError) Reason Uses

func (e TlsSessionTicketKeysValidationError) Reason() string

Reason function returns reason value.

type UpstreamTlsContext Uses

type UpstreamTlsContext struct {

    // Common TLS context settings.
    //
    // .. attention::
    //
    //   Server certificate verification is not enabled by default. Configure
    //   :ref:`trusted_ca<envoy_api_field_auth.CertificateValidationContext.trusted_ca>` to enable
    //   verification.
    CommonTlsContext *CommonTlsContext `protobuf:"bytes,1,opt,name=common_tls_context,json=commonTlsContext,proto3" json:"common_tls_context,omitempty"`
    // SNI string to use when creating TLS backend connections.
    Sni string `protobuf:"bytes,2,opt,name=sni,proto3" json:"sni,omitempty"`
    // If true, server-initiated TLS renegotiation will be allowed.
    //
    // .. attention::
    //
    //   TLS renegotiation is considered insecure and shouldn't be used unless absolutely necessary.
    AllowRenegotiation bool `protobuf:"varint,3,opt,name=allow_renegotiation,json=allowRenegotiation,proto3" json:"allow_renegotiation,omitempty"`
    // Maximum number of session keys (Pre-Shared Keys for TLSv1.3+, Session IDs and Session Tickets
    // for TLSv1.2 and older) to store for the purpose of session resumption.
    //
    // Defaults to 1, setting this to 0 disables session resumption.
    MaxSessionKeys *wrappers.UInt32Value `protobuf:"bytes,4,opt,name=max_session_keys,json=maxSessionKeys,proto3" json:"max_session_keys,omitempty"`
    // contains filtered or unexported fields
}

func (*UpstreamTlsContext) Descriptor Uses

func (*UpstreamTlsContext) Descriptor() ([]byte, []int)

Deprecated: Use UpstreamTlsContext.ProtoReflect.Descriptor instead.

func (*UpstreamTlsContext) GetAllowRenegotiation Uses

func (x *UpstreamTlsContext) GetAllowRenegotiation() bool

func (*UpstreamTlsContext) GetCommonTlsContext Uses

func (x *UpstreamTlsContext) GetCommonTlsContext() *CommonTlsContext

func (*UpstreamTlsContext) GetMaxSessionKeys Uses

func (x *UpstreamTlsContext) GetMaxSessionKeys() *wrappers.UInt32Value

func (*UpstreamTlsContext) GetSni Uses

func (x *UpstreamTlsContext) GetSni() string

func (*UpstreamTlsContext) ProtoMessage Uses

func (*UpstreamTlsContext) ProtoMessage()

func (*UpstreamTlsContext) ProtoReflect Uses

func (x *UpstreamTlsContext) ProtoReflect() protoreflect.Message

func (*UpstreamTlsContext) Reset Uses

func (x *UpstreamTlsContext) Reset()

func (*UpstreamTlsContext) String Uses

func (x *UpstreamTlsContext) String() string

func (*UpstreamTlsContext) Validate Uses

func (m *UpstreamTlsContext) Validate() error

Validate checks the field values on UpstreamTlsContext with the rules defined in the proto definition for this message. If any rules are violated, an error is returned.

type UpstreamTlsContextValidationError Uses

type UpstreamTlsContextValidationError struct {
    // contains filtered or unexported fields
}

UpstreamTlsContextValidationError is the validation error returned by UpstreamTlsContext.Validate if the designated constraints aren't met.

func (UpstreamTlsContextValidationError) Cause Uses

func (e UpstreamTlsContextValidationError) Cause() error

Cause function returns cause value.

func (UpstreamTlsContextValidationError) Error Uses

func (e UpstreamTlsContextValidationError) Error() string

Error satisfies the builtin error interface

func (UpstreamTlsContextValidationError) ErrorName Uses

func (e UpstreamTlsContextValidationError) ErrorName() string

ErrorName returns error name.

func (UpstreamTlsContextValidationError) Field Uses

func (e UpstreamTlsContextValidationError) Field() string

Field function returns field value.

func (UpstreamTlsContextValidationError) Key Uses

func (e UpstreamTlsContextValidationError) Key() bool

Key function returns key value.

func (UpstreamTlsContextValidationError) Reason Uses

func (e UpstreamTlsContextValidationError) Reason() string

Reason function returns reason value.

Package envoy_api_v2_auth imports 24 packages (graph) and is imported by 81 packages. Updated 2021-01-08. Refresh now. Tools for package owners.