// Copyright 2025 Envoy Project Authors
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
// 
//     http://www.apache.org/licenses/LICENSE-2.0
// 
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package envoy.extensions.filters.http.ip_tagging.v3;

import "envoy/config/core/v3/address.proto";

import "udpa/annotations/status.proto";
import "udpa/annotations/versioning.proto";
import "validate/validate.proto";

option java_package = "io.envoyproxy.envoy.extensions.filters.http.ip_tagging.v3";
option java_outer_classname = "IpTaggingProto";
option java_multiple_files = true;
option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/ip_tagging/v3;ip_taggingv3";
option (udpa.annotations.file_status).package_version_status = ACTIVE;

// [#protodoc-title: IP tagging]
// IP tagging :ref:`configuration overview <config_http_filters_ip_tagging>`.
// [#extension: envoy.filters.http.ip_tagging]

// [#next-free-field: 6]
message IPTagging {
  option (udpa.annotations.versioning).previous_message_type =
      "envoy.config.filter.http.ip_tagging.v2.IPTagging";

  // The type of requests the filter should apply to. The supported types
  // are internal, external or both. The
  // :ref:`x-forwarded-for<config_http_conn_man_headers_x-forwarded-for_internal_origin>` header is
  // used to determine if a request is internal and will result in
  // :ref:`x-envoy-internal<config_http_conn_man_headers_x-envoy-internal>`
  // being set. The filter defaults to both, and it will apply to all request types.
  enum RequestType {
    // Both external and internal requests will be tagged. This is the default value.
    BOTH = 0;

    // Only internal requests will be tagged.
    INTERNAL = 1;

    // Only external requests will be tagged.
    EXTERNAL = 2;
  }

  // Supplies the IP tag name and the IP address subnets.
  message IPTag {
    option (udpa.annotations.versioning).previous_message_type =
        "envoy.config.filter.http.ip_tagging.v2.IPTagging.IPTag";

    // Specifies the IP tag name to apply.
    string ip_tag_name = 1;

    // A list of IP address subnets that will be tagged with
    // ip_tag_name. Both IPv4 and IPv6 are supported.
    repeated config.core.v3.CidrRange ip_list = 2;
  }

  // Specify to which header the tags will be written.
  message IpTagHeader {
    // Describes how to apply the tags to the headers.
    enum HeaderAction {
      // (DEFAULT) The header specified in :ref:`ip_tag_header <envoy_v3_api_field_extensions.filters.http.ip_tagging.v3.IPTagging.ip_tag_header>`
      // will be dropped, before the tags are applied. The incoming header will be "sanitized" regardless of whether the request is internal or external.
      //
      // Note that the header will be visible unsanitized to any filters that are invoked before the ip-tag-header filter, unless it has an *x-envoy* prefix.
      SANITIZE = 0;

      // Tags will be appended to the header specified in
      // :ref:`ip_tag_header <envoy_v3_api_field_extensions.filters.http.ip_tagging.v3.IPTagging.ip_tag_header>`.
      //
      // Please note that this could cause the header to retain values set by the http client regardless of whether the request is internal or external.
      APPEND_IF_EXISTS_OR_ADD = 1;
    }

    // Header to use for ip-tagging.
    //
    // This header will be sanitized based on the config in
    // :ref:`action <envoy_v3_api_field_extensions.filters.http.ip_tagging.v3.IPTagging.IpTagHeader.action>`
    // rather than the defaults for x-envoy prefixed headers.
    string header = 1
        [(validate.rules).string = {min_len: 1 well_known_regex: HTTP_HEADER_NAME strict: false}];

    // Control if the :ref:`header <envoy_v3_api_field_extensions.filters.http.ip_tagging.v3.IPTagging.IpTagHeader.header>`
    // will be sanitized, or be appended to.
    //
    // Default: *SANITIZE*.
    HeaderAction action = 2;
  }

  // The type of request the filter should apply to.
  RequestType request_type = 1 [(validate.rules).enum = {defined_only: true}];

  // [#comment:TODO(ccaraman): Extend functionality to load IP tags from file system.
  // Tracked by issue https://github.com/envoyproxy/envoy/issues/2695]
  // The set of IP tags for the filter.
  repeated IPTag ip_tags = 4 [(validate.rules).repeated = {min_items: 1}];

  // Specify to which header the tags will be written.
  //
  // If left unspecified, the tags will be appended to the ``x-envoy-ip-tags`` header.
  IpTagHeader ip_tag_header = 5;
}
