syntax = "proto3";

package envoy.extensions.filters.network.ext_authz.v3;

import "envoy/config/core/v3/config_source.proto";
import "envoy/config/core/v3/grpc_service.proto";
import "envoy/type/matcher/v3/metadata.proto";

import "udpa/annotations/status.proto";
import "udpa/annotations/versioning.proto";
import "validate/validate.proto";

option java_package = "io.envoyproxy.envoy.extensions.filters.network.ext_authz.v3";
option java_outer_classname = "ExtAuthzProto";
option java_multiple_files = true;
option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/ext_authz/v3;ext_authzv3";
option (udpa.annotations.file_status).package_version_status = ACTIVE;

// [#protodoc-title: Network External Authorization ]
// The network layer external authorization service configuration
// :ref:`configuration overview <config_network_filters_ext_authz>`.
// [#extension: envoy.filters.network.ext_authz]

// External Authorization filter calls out to an external service over the
// gRPC Authorization API defined by
// :ref:`CheckRequest <envoy_v3_api_msg_service.auth.v3.CheckRequest>`.
// A failed check will cause this filter to close the TCP connection.
// [#next-free-field: 10]
message ExtAuthz {
  option (udpa.annotations.versioning).previous_message_type =
      "envoy.config.filter.network.ext_authz.v2.ExtAuthz";

  // The prefix to use when emitting statistics.
  string stat_prefix = 1 [(validate.rules).string = {min_len: 1}];

  // The external authorization gRPC service configuration.
  // The default timeout is set to 200ms by this filter.
  config.core.v3.GrpcService grpc_service = 2;

  // The filter's behaviour in case the external authorization service does
  // not respond back. When it is set to true, Envoy will also allow traffic in case of
  // communication failure between authorization service and the proxy.
  // Defaults to false.
  bool failure_mode_allow = 3;

  // Specifies if the peer certificate is sent to the external service.
  //
  // When this field is true, Envoy will include the peer X.509 certificate, if available, in the
  // :ref:`certificate<envoy_v3_api_field_service.auth.v3.AttributeContext.Peer.certificate>`.
  bool include_peer_certificate = 4;

  // API version for ext_authz transport protocol. This describes the ext_authz gRPC endpoint and
  // version of Check{Request,Response} used on the wire.
  config.core.v3.ApiVersion transport_api_version = 5
      [(validate.rules).enum = {defined_only: true}];

  // Specifies if the filter is enabled with metadata matcher.
  // If this field is not specified, the filter will be enabled for all requests.
  type.matcher.v3.MetadataMatcher filter_enabled_metadata = 6;

  // Optional labels that will be passed to :ref:`labels<envoy_v3_api_field_service.auth.v3.AttributeContext.Peer.labels>` in
  // :ref:`destination<envoy_v3_api_field_service.auth.v3.AttributeContext.destination>`.
  // The labels will be read from :ref:`metadata<envoy_v3_api_msg_config.core.v3.Node>` with the specified key.
  string bootstrap_metadata_labels_key = 7;

  // Specifies if the TLS session level details like SNI are sent to the external service.
  //
  // When this field is true, Envoy will include the SNI name used for TLSClientHello, if available, in the
  // :ref:`tls_session<envoy_v3_api_field_service.auth.v3.AttributeContext.tls_session>`.
  bool include_tls_session = 8;

  // When set to ``true``, the filter will send a TLS ``access_denied(49)`` alert before closing
  // the connection when authorization is denied. This provides better visibility to TLS clients
  // about the reason for connection closure. This alert is only sent for TLS connections. The
  // non-TLS connections will be closed without sending an alert.
  //
  // Defaults to ``false``.
  bool send_tls_alert_on_denial = 9;
}
