// Copyright 2025 Envoy Project Authors
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
// 
//     http://www.apache.org/licenses/LICENSE-2.0
// 
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package envoy.extensions.filters.network.sni_dynamic_forward_proxy.v3;

import "envoy/extensions/common/dynamic_forward_proxy/v3/dns_cache.proto";

import "udpa/annotations/status.proto";
import "validate/validate.proto";

option java_package = "io.envoyproxy.envoy.extensions.filters.network.sni_dynamic_forward_proxy.v3";
option java_outer_classname = "SniDynamicForwardProxyProto";
option java_multiple_files = true;
option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/sni_dynamic_forward_proxy/v3;sni_dynamic_forward_proxyv3";
option (udpa.annotations.file_status).package_version_status = ACTIVE;

// [#protodoc-title: SNI dynamic forward proxy]

// Configuration for the SNI-based dynamic forward proxy filter. See the
// :ref:`architecture overview <arch_overview_http_dynamic_forward_proxy>` for
// more information. Note this filter must be configured along with
// :ref:`TLS inspector listener filter <config_listener_filters_tls_inspector>`
// to work.
// [#extension: envoy.filters.network.sni_dynamic_forward_proxy]
message FilterConfig {
  // The DNS cache configuration that the filter will attach to. Note this
  // configuration must match that of associated :ref:`dynamic forward proxy
  // cluster configuration
  // <envoy_v3_api_field_extensions.clusters.dynamic_forward_proxy.v3.ClusterConfig.dns_cache_config>`.
  common.dynamic_forward_proxy.v3.DnsCacheConfig dns_cache_config = 1
      [(validate.rules).message = {required: true}];

  oneof port_specifier {
    // The port number to connect to the upstream.
    uint32 port_value = 2 [(validate.rules).uint32 = {lte: 65535 gt: 0}];
  }

  // When this flag is set, the filter will add the resolved upstream address in the filter
  // state. The state should be saved with key
  // ``envoy.stream.upstream_address`` (See
  // :repo:`upstream_address.h<source/common/stream_info/upstream_address.h>`).
  bool save_upstream_address = 3;
}
