package proto.control_plane.v1

Get desktop application:
View/edit binary Protocol Buffers messages

• rpc ChainRenewal (ChainRenewalRequest, ChainRenewalResponse)

  renewal.proto:26

  RenewChain creates a chain from the chain request.

  message ChainRenewalRequest

  renewal.proto:29

  • optional crypto.v1.SignedMessage signed_request = 1

    The signed certificate chain renewal requests. The body of the SignedMessage is the serialized ChainRenewalRequestBody.

  • bytes cms_signed_request = 2

    The certificate signing request. The content is an ASN.1 DER encoded CMS SignedData structure that contains an ASN.1 DER encoded PKCS #10 request.

  message ChainRenewalResponse

  renewal.proto:44

  • optional crypto.v1.SignedMessage signed_response = 1

    The signed certificate chain renewal response. The body of the SignedMessage is the serialized ChainRenewalResponseBody.

  • bytes cms_signed_response = 2

    The renewed certificate chain. The content is an ASN.1 DER encoded CMS SignedData structure that contains the certificate chain. The chain is the concatenation of the ASN.1 DER encoded certificates.

• rpc DRKeyLevel1 (DRKeyLevel1Request, DRKeyLevel1Response)

  drkey.proto:26

  Return the Level1Key that matches the request

  message DRKeyLevel1Request

  drkey.proto:61

  DRKeyLevel1Request leaves out the 'dstIA' field which can be extracted from the transport itself (ideally from authenticated information).

  • optional google.protobuf.Timestamp val_time = 1

    Point in time where requested key is valid.

  • drkey.v1.Protocol protocol_id = 2

    Protocol value.

  message DRKeyLevel1Response

  drkey.proto:71

  DRKeyLevel1Response leaves out the 'dstIA' and 'srcIA' fields which can be extracted from the transport itself (ideally from authenticated information).

  • optional google.protobuf.Timestamp epoch_begin = 1

    Begin of the validity period

  • optional google.protobuf.Timestamp epoch_end = 2

    End of the validity period

  • bytes key = 3

    Level1 key

• rpc DRKeyIntraLevel1 (DRKeyIntraLevel1Request, DRKeyIntraLevel1Response)

  drkey.proto:31

  Return the ASAS that matches the request

  message DRKeyIntraLevel1Request

  drkey.proto:80

  • optional google.protobuf.Timestamp val_time = 1

    Point in time where requested key is valid.

  • drkey.v1.Protocol protocol_id = 2

    Protocol value.

  • uint64 src_ia = 3

    Src ISD-AS of the requested DRKey.

  • uint64 dst_ia = 4

    Dst ISD-AS of the requested DRKey.

  message DRKeyIntraLevel1Response

  drkey.proto:91

  • optional google.protobuf.Timestamp epoch_begin = 1

    Begin of validity period of DRKey.

  • optional google.protobuf.Timestamp epoch_end = 2

    End of validity period of DRKey.

  • bytes key = 3

    Level1 key.

• rpc DRKeyASHost (DRKeyASHostRequest, DRKeyASHostResponse)

  drkey.proto:33

  Return the AS-Host that matches the request

  message DRKeyASHostRequest

  drkey.proto:122

  • optional google.protobuf.Timestamp val_time = 1

    Point in time where requested key is valid.

  • drkey.v1.Protocol protocol_id = 2

    Protocol value.

  • uint64 src_ia = 3

    Src ISD-AS of the requested DRKey.

  • uint64 dst_ia = 4

    Dst ISD-AS of the requested DRKey.

  • string dst_host = 5

    Dst Host of the request DRKey.

  message DRKeyASHostResponse

  drkey.proto:135

  • optional google.protobuf.Timestamp epoch_begin = 1

    Begin of validity period of DRKey.

  • optional google.protobuf.Timestamp epoch_end = 2

    End of validity period of DRKey.

  • bytes key = 3

    Level2 key.

• rpc DRKeyHostAS (DRKeyHostASRequest, DRKeyHostASResponse)

  drkey.proto:35

  Return the Host-AS that matches the request

  message DRKeyHostASRequest

  drkey.proto:100

  • optional google.protobuf.Timestamp val_time = 1

    Point in time where requested key is valid.

  • drkey.v1.Protocol protocol_id = 2

    Protocol value.

  • uint64 src_ia = 3

    Src ISD-AS of the requested DRKey.

  • uint64 dst_ia = 4

    Dst ISD-AS of the requested DRKey.

  • string src_host = 5

    Src Host of the request DRKey.

  message DRKeyHostASResponse

  drkey.proto:113

  • optional google.protobuf.Timestamp epoch_begin = 1

    Begin of validity period of DRKey.

  • optional google.protobuf.Timestamp epoch_end = 2

    End of validity period of DRKey.

  • bytes key = 3

    Level2 key.

• rpc DRKeyHostHost (DRKeyHostHostRequest, DRKeyHostHostResponse)

  drkey.proto:37

  Return the Host-Host that matches the request

  message DRKeyHostHostRequest

  drkey.proto:144

  • optional google.protobuf.Timestamp val_time = 1

    Point in time where requested key is valid.

  • drkey.v1.Protocol protocol_id = 2

    Protocol value.

  • uint64 src_ia = 3

    Src ISD-AS of the requested DRKey.

  • uint64 dst_ia = 4

    Dst ISD-AS of the requested DRKey.

  • string src_host = 5

    Src Host of the request DRKey.

  • string dst_host = 6

    Dst Host of the request DRKey.

  message DRKeyHostHostResponse

  drkey.proto:159

  • optional google.protobuf.Timestamp epoch_begin = 1

    Begin of validity period of DRKey.

  • optional google.protobuf.Timestamp epoch_end = 2

    End of validity period of DRKey.

  • bytes key = 3

    Level2 key.

• rpc DRKeySecretValue (DRKeySecretValueRequest, DRKeySecretValueResponse)

  drkey.proto:39

  Return the SecretValue that matches the request

  message DRKeySecretValueRequest

  drkey.proto:43

  • optional google.protobuf.Timestamp val_time = 1

    Point in time when the requested key is valid.

  • drkey.v1.Protocol protocol_id = 2

    Protocol value.

  message DRKeySecretValueResponse

  drkey.proto:50

  • optional google.protobuf.Timestamp epoch_begin = 1

    Begin of the validity period.

  • optional google.protobuf.Timestamp epoch_end = 2

    End of the validity period.

  • bytes key = 3

    SecretValue key.

• rpc Beacon (BeaconRequest, BeaconResponse)

  seg.proto:82

  Beacon sends a beacon to the remote.

  message BeaconRequest

  seg.proto:85

  • optional PathSegment segment = 1

    Beacon in form of a partial path segment.

  message BeaconResponse

  seg.proto:90

  (message has no fields)

• rpc Segments (SegmentsRequest, SegmentsResponse)

  seg.proto:38

  Segments returns all segments that match the request.

  message SegmentsRequest

  seg.proto:41

  • uint64 src_isd_as = 1

    The source ISD-AS of the segment.

  • uint64 dst_isd_as = 2

    The destination ISD-AS of the segment.

  message SegmentsResponse

  seg.proto:48

  • map<int32, SegmentsResponse.Segments> segments = 1

    Mapping from path segment type to path segments. The key is the integer representation of the SegmentType enum.

  • repeated bytes deprecated_signed_revocations = 1000

    Deprecated list of signed revocations. Will be removed with header v1.

• rpc SegmentsRegistration (SegmentsRegistrationRequest, SegmentsRegistrationResponse)

  seg.proto:64

  SegmentsRegistration registers segments at the remote.

  message SegmentsRegistrationRequest

  seg.proto:67

  • map<int32, SegmentsRegistrationRequest.Segments> segments = 1

    Mapping from path segment type to path segments. The key is the integer representation of the SegmentType enum.

  message SegmentsRegistrationResponse

  seg.proto:78

  (message has no fields)

• rpc Chains (ChainsRequest, ChainsResponse)

  cppki.proto:25

  Return the certificate chains that match the request.

  message ChainsRequest

  cppki.proto:30

  • uint64 isd_as = 1

    ISD-AS of Subject in the AS certificate.

  • bytes subject_key_id = 2

    SubjectKeyID in the AS certificate.

  • optional google.protobuf.Timestamp at_least_valid_until = 3

    Point in time at which the AS certificate must still be valid. In seconds since UNIX epoch.

  • optional google.protobuf.Timestamp at_least_valid_since = 4

    Point in time at which the AS certificate must be or must have been valid. In seconds since UNIX epoch.

  message ChainsResponse

  cppki.proto:43

  • repeated Chain chains = 1

    List of chains that match the request.

• rpc TRC (TRCRequest, TRCResponse)

  cppki.proto:27

  Return a specific TRC that matches the request.

  message TRCRequest

  cppki.proto:55

  • uint32 isd = 1

    ISD of the TRC.

  • uint64 base = 2

    BaseNumber of the TRC.

  • uint64 serial = 3

    SerialNumber of the TRC.

  message TRCResponse

  cppki.proto:64

  • bytes trc = 1

    Raw TRC.

Used in: PathSegment

• optional crypto.v1.SignedMessage signed = 1

  The signed part of the AS entry. The body of the SignedMessage is the serialized ASEntrySignedBody. The signature input is defined as following: input(ps, i) = signed.header_and_body || associated_data(ps, i) associated_data(ps, i) = ps.segment_info || ps.as_entries[1].signed.header_and_body || ps.as_entries[1].signed.signature || ... ps.as_entries[i-1].signed.header_and_body || ps.as_entries[i-1].signed.signature

• optional PathSegmentUnsignedExtensions unsigned = 2

  The unsigned part of the AS entry.

• uint64 isd_as = 1

  ISD-AS of the AS that created this AS entry.

• uint64 next_isd_as = 2

  ISD-AS of the downstream AS.

• optional HopEntry hop_entry = 3

  The required regular hop entry.

• repeated PeerEntry peer_entries = 4

  Optional peer entries.

• uint32 mtu = 5

  Intra AS MTU.

• optional PathSegmentExtensions extensions = 6

  Optional extensions.

BandwidthInfo specifies approximate maximum link bandwidth. The separate intra and inter AS bandwidth information allows to reconstruct bandwidth values for all paths (cross-over, shortcut, peering) based on this ASEntry. All values are in Kbit/s.

Used in: StaticInfoExtension

• map<uint64, uint64> intra = 1

  Bandwidth between construction-egress interface and the relevant other interfaces. These are: - construction-ingress interface (if any) - sibling child interfaces, - core interfaces, if this is the start of a segment, or the end of a core segment - peer interfaces The key is the interface identifier of the other interface.

• map<uint64, uint64> inter = 2

  Bandwidth between the local interface and the interface in the neighbor AS for the relevant links. These are: - link at construction-egress interface (if any) - peer links The key is the interface identifier of the local interface associated with the link.

Used in: ChainRenewalResponseBody, ChainsResponse

• bytes as_cert = 1

  AS certificate in the chain.

• bytes ca_cert = 2

  CA certificate in the chain.

• bytes csr = 1

  The raw certificate signature request (PKCS #10).

• optional Chain chain = 1

  The renewed certificate chain.

Used in: PathSegmentExtensions

• optional DigestExtension.Digest epic = 1000

  The digest of the detached EPIC extension. The hash input is defined as follows: input = totalLen || epic.Detached.AuthHopEntry || epic.Detached.AuthPeerEntries[0] || epic.Detached.AuthPeerEntries[1] || ... epic.Detached.AuthPeerEntries[n-1] Here, 'n' denotes the number of peer entries. 'totalLen' is equal to (n+1), and therefore encodes the total number of authenticators used in the hash.

Used in: DigestExtension

• bytes digest = 1

  Raw digest of the metadata.

Used in: StaticInfoExtension

• float latitude = 1

  Latitude of the geographic coordinate, in the WGS 84 datum.

• float longitude = 2

  Longitude of the geographic coordinate, in the WGS 84 datum.

• string address = 3

  Civic address of the location.

Used in: PathSegmentExtensions

• bool is_hidden = 1

  Indicate if this is a hidden path.

Used in: ASEntrySignedBody

• optional HopField hop_field = 1

  Material to create the data-plane hop field.

• uint32 ingress_mtu = 2

  MTU on the ingress link.

Used in: HopEntry, PeerEntry

• uint64 ingress = 1

  Ingress interface identifier.

• uint64 egress = 2

  Egress interface identifier.

• uint32 exp_time = 3

  8-bit encoded expiration offset relative to the segment creation timestamp.

• bytes mac = 4

  MAC used in the dataplane to verify the hop field.

LatencyInfo specifies approximate lower-bound latency values. The separate intra and inter AS latency information allows to reconstruct latency values for all paths (cross-over, shortcut, peering) based on this ASEntry. All values are in microseconds.

Used in: StaticInfoExtension

• map<uint64, uint32> intra = 1

  Latency between construction-egress interface and the relevant other interfaces. These are: - construction-ingress interface (if any) - sibling child interfaces, - core interfaces, at start or end of a segment - peer interfaces The key is the interface identifier of the other interface.

• map<uint64, uint32> inter = 2

  Latency between the local interface and the interface in the neighbor AS for the relevant links. These are: - link at construction-egress interface (if any) - peer links The key is the interface identifier of the local interface associated with the link.

Used in: StaticInfoExtension

• LINK_TYPE_UNSPECIFIED = 0

  Unspecified link type.

• LINK_TYPE_DIRECT = 1

  Direct physical connection.

• LINK_TYPE_MULTI_HOP = 2

  Connection with local routing/switching.

• LINK_TYPE_OPEN_NET = 3

  Connection overlayed over publicly routed Internet.

Used in: BeaconRequest, SegmentsRegistrationRequest.Segments, SegmentsResponse.Segments, hidden_segment.v1.Segments

• bytes segment_info = 1

  The encoded SegmentInformation. It is used for signature input.

• repeated ASEntry as_entries = 2

  Entries of ASes on the path.

Used in: ASEntrySignedBody

• optional StaticInfoExtension static_info = 1

  Optional static info extension.

• optional HiddenPathExtension hidden_path = 2

  Optional hidden path extension.

• optional DigestExtension digests = 1000

  Optional digests of detached extensions.

Used in: ASEntry

• optional experimental.v1.EPICDetachedExtension epic = 1000

  Optional EPIC extension.

Used in: ASEntrySignedBody

• uint64 peer_isd_as = 1

  ISD-AS of peer AS. This is used to match peering segments during path construction.

• uint64 peer_interface = 2

  Remote peer interface identifier. This is used to match peering segments during path construction.

• uint32 peer_mtu = 3

  MTU on the peering link.

• optional HopField hop_field = 4

  Material to create the data-plane hop field

• int64 timestamp = 1

  Segment creation time set by the originating AS. Segment expiration time is computed relative to this timestamp. The timestamp is encoded as number of seconds elapsed since January 1, 1970 UTC.

• uint32 segment_id = 2

  The 16-bit segment ID integer used for MAC computation.

• SEGMENT_TYPE_UNSPECIFIED = 0

  Unknown segment type.

• SEGMENT_TYPE_UP = 1

  Up segment.

• SEGMENT_TYPE_DOWN = 2

  Down segment.

• SEGMENT_TYPE_CORE = 3

  Core segment.

Used in: SegmentsRegistrationRequest

• repeated PathSegment segments = 1

  List of path segments.

Used in: SegmentsResponse

• repeated PathSegment segments = 1

  List of path segments.

A ServiceResolutionRequest must always fit within a UDP datagram. If the request does not fit, there is no mechanism for clients and servers to establish control-plane reachability.

(message has no fields)

A ServiceResolutionResponse must always fit within a UDP datagram. If the response does not fit, there is no mechanism for clients and servers to establish control-plane reachability.

• map<string, Transport> transports = 1

  Supported transports to reach the service, List of known transports: - QUIC Unknown values should be ignored by clients.

Used in: PathSegmentExtensions

• optional LatencyInfo latency = 1

  Approximate, lower-bound latency for paths based on this ASEntry.

• optional BandwidthInfo bandwidth = 2

  Approximate, maximum bandwidth for paths based on this ASEntry.

• map<uint64, GeoCoordinates> geo = 3

  Geographical coordinates describing the location of the routers for relevant interfaces of this AS. The key is the interface identifier.

• map<uint64, LinkType> link_type = 4

  Description of the underlying network for the inter-AS links, for the relevant interfaces of this AS. The key is the interface identifier.

• map<uint64, uint32> internal_hops = 5

  Number of AS internal hops between the construction-egress and the relevant other interfaces. These are: - construction-ingress interface (if any) - sibling child interfaces, - core interfaces, at start or end of a segment - peer interfaces The key is the interface identifier of the other interface.

• string note = 6

  Generic note

Used in: ServiceResolutionResponse

• string address = 1

  Protocol specific server address descriptor. Supported address format for QUIC: 192.168.0.1:80 [2001:db8::1]:80 Missing ports / zero port / invalid port values should be treated by clients as errors.

VerificationKeyID is used to identify certificates that authenticate the verification key used to verify signatures.

• uint64 isd_as = 1

  ISD-AS of the subject.

• bytes subject_key_id = 2

  SubjectKeyID referenced in the certificate.

• uint64 trc_base = 3

  Base number of the latest TRC available to the signer at the time of signature creation.

• uint64 trc_serial = 4

  Serial number of the latest TRC available to the signer at the time of signature creation.