// Copyright 2025 Envoy Project Authors
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
// 
//     http://www.apache.org/licenses/LICENSE-2.0
// 
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package envoy.extensions.quic.connection_id_generator.quic_lb.v3;

import "envoy/config/core/v3/base.proto";
import "envoy/extensions/transport_sockets/tls/v3/secret.proto";

import "xds/annotations/v3/status.proto";

import "udpa/annotations/status.proto";
import "validate/validate.proto";

option java_package = "io.envoyproxy.envoy.extensions.quic.connection_id_generator.quic_lb.v3";
option java_outer_classname = "QuicLbProto";
option java_multiple_files = true;
option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/quic/connection_id_generator/quic_lb/v3;quic_lbv3";
option (udpa.annotations.file_status).package_version_status = ACTIVE;

// [#protodoc-title: QUIC-LB connection ID generator config]
// [#extension: envoy.quic.connection_id_generator.quic_lb]

// Configuration for a connection ID generator implementation for the QUIC-LB draft RFC for
// routable connection IDs.
//
// Connection IDs always have the length self encoded, as described in
// https://datatracker.ietf.org/doc/html/draft-ietf-quic-load-balancers#name-length-self-description.
//
// See https://datatracker.ietf.org/doc/html/draft-ietf-quic-load-balancers for details.
//
// .. warning::
//
//    This is still a work in progress. Performance is expected to be poor. Interoperability testing
//    has not yet been performed.
// [#next-free-field: 6]
message Config {
  option (xds.annotations.v3.message_status).work_in_progress = true;

  // Use the unencrypted mode. This is useful for testing, but allows for linking different CIDs
  // for the same connection, and leaks information about the valid server IDs in use. This should
  // only be used for testing.
  bool unsafe_unencrypted_testing_mode = 1;

  // Must be at least 1 octet.
  // The length of server_id and nonce_length_bytes must be 18 or less.
  // See https://datatracker.ietf.org/doc/html/draft-ietf-quic-load-balancers#name-server-id-allocation.
  config.core.v3.DataSource server_id = 2 [(validate.rules).message = {required: true}];

  // Optional validation of the expected server ID length. If this is non-zero and the value in ``server_id``
  // does not have a matching length, a configuration error is generated. This can be useful for validating
  // that the server ID is valid.
  uint32 expected_server_id_length = 3 [(validate.rules).uint32 = {lte: 18}];

  // The nonce length must be at least 4 bytes.
  // The length of server_id and nonce_length_bytes must be 18 bytes or less.
  uint32 nonce_length_bytes = 4 [(validate.rules).uint32 = {lte: 16 gte: 4}];

  // Configuration to fetch the encryption key and configuration version.
  //
  // The SDS service is for a :ref:`GenericSecret <envoy_v3_api_msg_extensions.transport_sockets.tls.v3.GenericSecret>`.
  // The data should populate :ref:`secrets <envoy_v3_api_field_extensions.transport_sockets.tls.v3.GenericSecret.secrets>`:
  //
  // "encryption_key" must contain the 16 byte encryption key.
  //
  // "configuration_version" must contain a 1 byte unsigned integer of value less than 7.
  // See https://datatracker.ietf.org/doc/html/draft-ietf-quic-load-balancers#name-config-rotation.
  transport_sockets.tls.v3.SdsSecretConfig encryption_parameters = 5
      [(validate.rules).message = {required: true}];
}
