// Code generated by protoc-gen-go. DO NOT EDIT.
// versions:
// 	protoc-gen-go v1.36.10
// 	protoc        v6.33.2
// source: envoy/api/v2/auth/common.proto

package auth

import (
	_ "github.com/cncf/xds/go/udpa/annotations"
	core "github.com/envoyproxy/go-control-plane/envoy/api/v2/core"
	matcher "github.com/envoyproxy/go-control-plane/envoy/type/matcher"
	_ "github.com/envoyproxy/protoc-gen-validate/validate"
	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
	anypb "google.golang.org/protobuf/types/known/anypb"
	structpb "google.golang.org/protobuf/types/known/structpb"
	wrapperspb "google.golang.org/protobuf/types/known/wrapperspb"
	reflect "reflect"
	sync "sync"
	unsafe "unsafe"
)

const (
	// Verify that this generated code is sufficiently up-to-date.
	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
	// Verify that runtime/protoimpl is sufficiently up-to-date.
	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
)

type TlsParameters_TlsProtocol int32

const (
	// Envoy will choose the optimal TLS version.
	TlsParameters_TLS_AUTO TlsParameters_TlsProtocol = 0
	// TLS 1.0
	TlsParameters_TLSv1_0 TlsParameters_TlsProtocol = 1
	// TLS 1.1
	TlsParameters_TLSv1_1 TlsParameters_TlsProtocol = 2
	// TLS 1.2
	TlsParameters_TLSv1_2 TlsParameters_TlsProtocol = 3
	// TLS 1.3
	TlsParameters_TLSv1_3 TlsParameters_TlsProtocol = 4
)

// Enum value maps for TlsParameters_TlsProtocol.
var (
	TlsParameters_TlsProtocol_name = map[int32]string{
		0: "TLS_AUTO",
		1: "TLSv1_0",
		2: "TLSv1_1",
		3: "TLSv1_2",
		4: "TLSv1_3",
	}
	TlsParameters_TlsProtocol_value = map[string]int32{
		"TLS_AUTO": 0,
		"TLSv1_0":  1,
		"TLSv1_1":  2,
		"TLSv1_2":  3,
		"TLSv1_3":  4,
	}
)

func (x TlsParameters_TlsProtocol) Enum() *TlsParameters_TlsProtocol {
	p := new(TlsParameters_TlsProtocol)
	*p = x
	return p
}

func (x TlsParameters_TlsProtocol) String() string {
	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
}

func (TlsParameters_TlsProtocol) Descriptor() protoreflect.EnumDescriptor {
	return file_envoy_api_v2_auth_common_proto_enumTypes[0].Descriptor()
}

func (TlsParameters_TlsProtocol) Type() protoreflect.EnumType {
	return &file_envoy_api_v2_auth_common_proto_enumTypes[0]
}

func (x TlsParameters_TlsProtocol) Number() protoreflect.EnumNumber {
	return protoreflect.EnumNumber(x)
}

// Deprecated: Use TlsParameters_TlsProtocol.Descriptor instead.
func (TlsParameters_TlsProtocol) EnumDescriptor() ([]byte, []int) {
	return file_envoy_api_v2_auth_common_proto_rawDescGZIP(), []int{0, 0}
}

// Peer certificate verification mode.
type CertificateValidationContext_TrustChainVerification int32

const (
	// Perform default certificate verification (e.g., against CA / verification lists)
	CertificateValidationContext_VERIFY_TRUST_CHAIN CertificateValidationContext_TrustChainVerification = 0
	// Connections where the certificate fails verification will be permitted.
	// For HTTP connections, the result of certificate verification can be used in route matching. (
	// see :ref:`validated <envoy_api_field_route.RouteMatch.TlsContextMatchOptions.validated>` ).
	CertificateValidationContext_ACCEPT_UNTRUSTED CertificateValidationContext_TrustChainVerification = 1
)

// Enum value maps for CertificateValidationContext_TrustChainVerification.
var (
	CertificateValidationContext_TrustChainVerification_name = map[int32]string{
		0: "VERIFY_TRUST_CHAIN",
		1: "ACCEPT_UNTRUSTED",
	}
	CertificateValidationContext_TrustChainVerification_value = map[string]int32{
		"VERIFY_TRUST_CHAIN": 0,
		"ACCEPT_UNTRUSTED":   1,
	}
)

func (x CertificateValidationContext_TrustChainVerification) Enum() *CertificateValidationContext_TrustChainVerification {
	p := new(CertificateValidationContext_TrustChainVerification)
	*p = x
	return p
}

func (x CertificateValidationContext_TrustChainVerification) String() string {
	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
}

func (CertificateValidationContext_TrustChainVerification) Descriptor() protoreflect.EnumDescriptor {
	return file_envoy_api_v2_auth_common_proto_enumTypes[1].Descriptor()
}

func (CertificateValidationContext_TrustChainVerification) Type() protoreflect.EnumType {
	return &file_envoy_api_v2_auth_common_proto_enumTypes[1]
}

func (x CertificateValidationContext_TrustChainVerification) Number() protoreflect.EnumNumber {
	return protoreflect.EnumNumber(x)
}

// Deprecated: Use CertificateValidationContext_TrustChainVerification.Descriptor instead.
func (CertificateValidationContext_TrustChainVerification) EnumDescriptor() ([]byte, []int) {
	return file_envoy_api_v2_auth_common_proto_rawDescGZIP(), []int{4, 0}
}

type TlsParameters struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Minimum TLS protocol version. By default, it's “TLSv1_2“ for both clients and servers.
	TlsMinimumProtocolVersion TlsParameters_TlsProtocol `protobuf:"varint,1,opt,name=tls_minimum_protocol_version,json=tlsMinimumProtocolVersion,proto3,enum=envoy.api.v2.auth.TlsParameters_TlsProtocol" json:"tls_minimum_protocol_version,omitempty"`
	// Maximum TLS protocol version. By default, it's “TLSv1_2“ for clients and “TLSv1_3“ for
	// servers.
	TlsMaximumProtocolVersion TlsParameters_TlsProtocol `protobuf:"varint,2,opt,name=tls_maximum_protocol_version,json=tlsMaximumProtocolVersion,proto3,enum=envoy.api.v2.auth.TlsParameters_TlsProtocol" json:"tls_maximum_protocol_version,omitempty"`
	// If specified, the TLS listener will only support the specified `cipher list
	// <https://commondatastorage.googleapis.com/chromium-boringssl-docs/ssl.h.html#Cipher-suite-configuration>`_
	// when negotiating TLS 1.0-1.2 (this setting has no effect when negotiating TLS 1.3). If not
	// specified, the default list will be used.
	//
	// In non-FIPS builds, the default cipher list is:
	//
	// .. code-block:: none
	//
	//	[ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305]
	//	[ECDHE-RSA-AES128-GCM-SHA256|ECDHE-RSA-CHACHA20-POLY1305]
	//	ECDHE-ECDSA-AES128-SHA
	//	ECDHE-RSA-AES128-SHA
	//	AES128-GCM-SHA256
	//	AES128-SHA
	//	ECDHE-ECDSA-AES256-GCM-SHA384
	//	ECDHE-RSA-AES256-GCM-SHA384
	//	ECDHE-ECDSA-AES256-SHA
	//	ECDHE-RSA-AES256-SHA
	//	AES256-GCM-SHA384
	//	AES256-SHA
	//
	// In builds using :ref:`BoringSSL FIPS <arch_overview_ssl_fips>`, the default cipher list is:
	//
	// .. code-block:: none
	//
	//	ECDHE-ECDSA-AES128-GCM-SHA256
	//	ECDHE-RSA-AES128-GCM-SHA256
	//	ECDHE-ECDSA-AES128-SHA
	//	ECDHE-RSA-AES128-SHA
	//	AES128-GCM-SHA256
	//	AES128-SHA
	//	ECDHE-ECDSA-AES256-GCM-SHA384
	//	ECDHE-RSA-AES256-GCM-SHA384
	//	ECDHE-ECDSA-AES256-SHA
	//	ECDHE-RSA-AES256-SHA
	//	AES256-GCM-SHA384
	//	AES256-SHA
	CipherSuites []string `protobuf:"bytes,3,rep,name=cipher_suites,json=cipherSuites,proto3" json:"cipher_suites,omitempty"`
	// If specified, the TLS connection will only support the specified ECDH
	// curves. If not specified, the default curves will be used.
	//
	// In non-FIPS builds, the default curves are:
	//
	// .. code-block:: none
	//
	//	X25519
	//	P-256
	//
	// In builds using :ref:`BoringSSL FIPS <arch_overview_ssl_fips>`, the default curve is:
	//
	// .. code-block:: none
	//
	//	P-256
	EcdhCurves    []string `protobuf:"bytes,4,rep,name=ecdh_curves,json=ecdhCurves,proto3" json:"ecdh_curves,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *TlsParameters) Reset() {
	*x = TlsParameters{}
	mi := &file_envoy_api_v2_auth_common_proto_msgTypes[0]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *TlsParameters) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*TlsParameters) ProtoMessage() {}

func (x *TlsParameters) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_api_v2_auth_common_proto_msgTypes[0]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use TlsParameters.ProtoReflect.Descriptor instead.
func (*TlsParameters) Descriptor() ([]byte, []int) {
	return file_envoy_api_v2_auth_common_proto_rawDescGZIP(), []int{0}
}

func (x *TlsParameters) GetTlsMinimumProtocolVersion() TlsParameters_TlsProtocol {
	if x != nil {
		return x.TlsMinimumProtocolVersion
	}
	return TlsParameters_TLS_AUTO
}

func (x *TlsParameters) GetTlsMaximumProtocolVersion() TlsParameters_TlsProtocol {
	if x != nil {
		return x.TlsMaximumProtocolVersion
	}
	return TlsParameters_TLS_AUTO
}

func (x *TlsParameters) GetCipherSuites() []string {
	if x != nil {
		return x.CipherSuites
	}
	return nil
}

func (x *TlsParameters) GetEcdhCurves() []string {
	if x != nil {
		return x.EcdhCurves
	}
	return nil
}

// BoringSSL private key method configuration. The private key methods are used for external
// (potentially asynchronous) signing and decryption operations. Some use cases for private key
// methods would be TPM support and TLS acceleration.
type PrivateKeyProvider struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Private key method provider name. The name must match a
	// supported private key method provider type.
	ProviderName string `protobuf:"bytes,1,opt,name=provider_name,json=providerName,proto3" json:"provider_name,omitempty"`
	// Private key method provider specific configuration.
	//
	// Types that are valid to be assigned to ConfigType:
	//
	//	*PrivateKeyProvider_Config
	//	*PrivateKeyProvider_TypedConfig
	ConfigType    isPrivateKeyProvider_ConfigType `protobuf_oneof:"config_type"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *PrivateKeyProvider) Reset() {
	*x = PrivateKeyProvider{}
	mi := &file_envoy_api_v2_auth_common_proto_msgTypes[1]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *PrivateKeyProvider) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*PrivateKeyProvider) ProtoMessage() {}

func (x *PrivateKeyProvider) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_api_v2_auth_common_proto_msgTypes[1]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use PrivateKeyProvider.ProtoReflect.Descriptor instead.
func (*PrivateKeyProvider) Descriptor() ([]byte, []int) {
	return file_envoy_api_v2_auth_common_proto_rawDescGZIP(), []int{1}
}

func (x *PrivateKeyProvider) GetProviderName() string {
	if x != nil {
		return x.ProviderName
	}
	return ""
}

func (x *PrivateKeyProvider) GetConfigType() isPrivateKeyProvider_ConfigType {
	if x != nil {
		return x.ConfigType
	}
	return nil
}

// Deprecated: Marked as deprecated in envoy/api/v2/auth/common.proto.
func (x *PrivateKeyProvider) GetConfig() *structpb.Struct {
	if x != nil {
		if x, ok := x.ConfigType.(*PrivateKeyProvider_Config); ok {
			return x.Config
		}
	}
	return nil
}

func (x *PrivateKeyProvider) GetTypedConfig() *anypb.Any {
	if x != nil {
		if x, ok := x.ConfigType.(*PrivateKeyProvider_TypedConfig); ok {
			return x.TypedConfig
		}
	}
	return nil
}

type isPrivateKeyProvider_ConfigType interface {
	isPrivateKeyProvider_ConfigType()
}

type PrivateKeyProvider_Config struct {
	// Deprecated: Marked as deprecated in envoy/api/v2/auth/common.proto.
	Config *structpb.Struct `protobuf:"bytes,2,opt,name=config,proto3,oneof"`
}

type PrivateKeyProvider_TypedConfig struct {
	TypedConfig *anypb.Any `protobuf:"bytes,3,opt,name=typed_config,json=typedConfig,proto3,oneof"`
}

func (*PrivateKeyProvider_Config) isPrivateKeyProvider_ConfigType() {}

func (*PrivateKeyProvider_TypedConfig) isPrivateKeyProvider_ConfigType() {}

// [#next-free-field: 7]
type TlsCertificate struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// The TLS certificate chain.
	CertificateChain *core.DataSource `protobuf:"bytes,1,opt,name=certificate_chain,json=certificateChain,proto3" json:"certificate_chain,omitempty"`
	// The TLS private key.
	PrivateKey *core.DataSource `protobuf:"bytes,2,opt,name=private_key,json=privateKey,proto3" json:"private_key,omitempty"`
	// BoringSSL private key method provider. This is an alternative to :ref:`private_key
	// <envoy_api_field_auth.TlsCertificate.private_key>` field. This can't be
	// marked as “oneof“ due to API compatibility reasons. Setting both :ref:`private_key
	// <envoy_api_field_auth.TlsCertificate.private_key>` and
	// :ref:`private_key_provider
	// <envoy_api_field_auth.TlsCertificate.private_key_provider>` fields will result in an
	// error.
	PrivateKeyProvider *PrivateKeyProvider `protobuf:"bytes,6,opt,name=private_key_provider,json=privateKeyProvider,proto3" json:"private_key_provider,omitempty"`
	// The password to decrypt the TLS private key. If this field is not set, it is assumed that the
	// TLS private key is not password encrypted.
	Password *core.DataSource `protobuf:"bytes,3,opt,name=password,proto3" json:"password,omitempty"`
	// [#not-implemented-hide:]
	OcspStaple *core.DataSource `protobuf:"bytes,4,opt,name=ocsp_staple,json=ocspStaple,proto3" json:"ocsp_staple,omitempty"`
	// [#not-implemented-hide:]
	SignedCertificateTimestamp []*core.DataSource `protobuf:"bytes,5,rep,name=signed_certificate_timestamp,json=signedCertificateTimestamp,proto3" json:"signed_certificate_timestamp,omitempty"`
	unknownFields              protoimpl.UnknownFields
	sizeCache                  protoimpl.SizeCache
}

func (x *TlsCertificate) Reset() {
	*x = TlsCertificate{}
	mi := &file_envoy_api_v2_auth_common_proto_msgTypes[2]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *TlsCertificate) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*TlsCertificate) ProtoMessage() {}

func (x *TlsCertificate) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_api_v2_auth_common_proto_msgTypes[2]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use TlsCertificate.ProtoReflect.Descriptor instead.
func (*TlsCertificate) Descriptor() ([]byte, []int) {
	return file_envoy_api_v2_auth_common_proto_rawDescGZIP(), []int{2}
}

func (x *TlsCertificate) GetCertificateChain() *core.DataSource {
	if x != nil {
		return x.CertificateChain
	}
	return nil
}

func (x *TlsCertificate) GetPrivateKey() *core.DataSource {
	if x != nil {
		return x.PrivateKey
	}
	return nil
}

func (x *TlsCertificate) GetPrivateKeyProvider() *PrivateKeyProvider {
	if x != nil {
		return x.PrivateKeyProvider
	}
	return nil
}

func (x *TlsCertificate) GetPassword() *core.DataSource {
	if x != nil {
		return x.Password
	}
	return nil
}

func (x *TlsCertificate) GetOcspStaple() *core.DataSource {
	if x != nil {
		return x.OcspStaple
	}
	return nil
}

func (x *TlsCertificate) GetSignedCertificateTimestamp() []*core.DataSource {
	if x != nil {
		return x.SignedCertificateTimestamp
	}
	return nil
}

type TlsSessionTicketKeys struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Keys for encrypting and decrypting TLS session tickets. The
	// first key in the array contains the key to encrypt all new sessions created by this context.
	// All keys are candidates for decrypting received tickets. This allows for easy rotation of keys
	// by, for example, putting the new key first, and the previous key second.
	//
	// If :ref:`session_ticket_keys <envoy_api_field_auth.DownstreamTlsContext.session_ticket_keys>`
	// is not specified, the TLS library will still support resuming sessions via tickets, but it will
	// use an internally-generated and managed key, so sessions cannot be resumed across hot restarts
	// or on different hosts.
	//
	// Each key must contain exactly 80 bytes of cryptographically-secure random data. For
	// example, the output of “openssl rand 80“.
	//
	// .. attention::
	//
	//	Using this feature has serious security considerations and risks. Improper handling of keys
	//	may result in loss of secrecy in connections, even if ciphers supporting perfect forward
	//	secrecy are used. See https://www.imperialviolet.org/2013/06/27/botchingpfs.html for some
	//	discussion. To minimize the risk, you must:
	//
	//	* Keep the session ticket keys at least as secure as your TLS certificate private keys
	//	* Rotate session ticket keys at least daily, and preferably hourly
	//	* Always generate keys using a cryptographically-secure random data source
	Keys          []*core.DataSource `protobuf:"bytes,1,rep,name=keys,proto3" json:"keys,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *TlsSessionTicketKeys) Reset() {
	*x = TlsSessionTicketKeys{}
	mi := &file_envoy_api_v2_auth_common_proto_msgTypes[3]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *TlsSessionTicketKeys) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*TlsSessionTicketKeys) ProtoMessage() {}

func (x *TlsSessionTicketKeys) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_api_v2_auth_common_proto_msgTypes[3]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use TlsSessionTicketKeys.ProtoReflect.Descriptor instead.
func (*TlsSessionTicketKeys) Descriptor() ([]byte, []int) {
	return file_envoy_api_v2_auth_common_proto_rawDescGZIP(), []int{3}
}

func (x *TlsSessionTicketKeys) GetKeys() []*core.DataSource {
	if x != nil {
		return x.Keys
	}
	return nil
}

// [#next-free-field: 11]
type CertificateValidationContext struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// TLS certificate data containing certificate authority certificates to use in verifying
	// a presented peer certificate (e.g. server certificate for clusters or client certificate
	// for listeners). If not specified and a peer certificate is presented it will not be
	// verified. By default, a client certificate is optional, unless one of the additional
	// options (:ref:`require_client_certificate
	// <envoy_api_field_auth.DownstreamTlsContext.require_client_certificate>`,
	// :ref:`verify_certificate_spki
	// <envoy_api_field_auth.CertificateValidationContext.verify_certificate_spki>`,
	// :ref:`verify_certificate_hash
	// <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>`, or
	// :ref:`match_subject_alt_names
	// <envoy_api_field_auth.CertificateValidationContext.match_subject_alt_names>`) is also
	// specified.
	//
	// It can optionally contain certificate revocation lists, in which case Envoy will verify
	// that the presented peer certificate has not been revoked by one of the included CRLs.
	//
	// See :ref:`the TLS overview <arch_overview_ssl_enabling_verification>` for a list of common
	// system CA locations.
	TrustedCa *core.DataSource `protobuf:"bytes,1,opt,name=trusted_ca,json=trustedCa,proto3" json:"trusted_ca,omitempty"`
	// An optional list of base64-encoded SHA-256 hashes. If specified, Envoy will verify that the
	// SHA-256 of the DER-encoded Subject Public Key Information (SPKI) of the presented certificate
	// matches one of the specified values.
	//
	// A base64-encoded SHA-256 of the Subject Public Key Information (SPKI) of the certificate
	// can be generated with the following command:
	//
	// .. code-block:: bash
	//
	//	$ openssl x509 -in path/to/client.crt -noout -pubkey
	//	  | openssl pkey -pubin -outform DER
	//	  | openssl dgst -sha256 -binary
	//	  | openssl enc -base64
	//	NvqYIYSbgK2vCJpQhObf77vv+bQWtc5ek5RIOwPiC9A=
	//
	// This is the format used in HTTP Public Key Pinning.
	//
	// When both:
	// :ref:`verify_certificate_hash
	// <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>` and
	// :ref:`verify_certificate_spki
	// <envoy_api_field_auth.CertificateValidationContext.verify_certificate_spki>` are specified,
	// a hash matching value from either of the lists will result in the certificate being accepted.
	//
	// .. attention::
	//
	//	This option is preferred over :ref:`verify_certificate_hash
	//	<envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>`,
	//	because SPKI is tied to a private key, so it doesn't change when the certificate
	//	is renewed using the same private key.
	VerifyCertificateSpki []string `protobuf:"bytes,3,rep,name=verify_certificate_spki,json=verifyCertificateSpki,proto3" json:"verify_certificate_spki,omitempty"`
	// An optional list of hex-encoded SHA-256 hashes. If specified, Envoy will verify that
	// the SHA-256 of the DER-encoded presented certificate matches one of the specified values.
	//
	// A hex-encoded SHA-256 of the certificate can be generated with the following command:
	//
	// .. code-block:: bash
	//
	//	$ openssl x509 -in path/to/client.crt -outform DER | openssl dgst -sha256 | cut -d" " -f2
	//	df6ff72fe9116521268f6f2dd4966f51df479883fe7037b39f75916ac3049d1a
	//
	// A long hex-encoded and colon-separated SHA-256 (a.k.a. "fingerprint") of the certificate
	// can be generated with the following command:
	//
	// .. code-block:: bash
	//
	//	$ openssl x509 -in path/to/client.crt -noout -fingerprint -sha256 | cut -d"=" -f2
	//	DF:6F:F7:2F:E9:11:65:21:26:8F:6F:2D:D4:96:6F:51:DF:47:98:83:FE:70:37:B3:9F:75:91:6A:C3:04:9D:1A
	//
	// Both of those formats are acceptable.
	//
	// When both:
	// :ref:`verify_certificate_hash
	// <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>` and
	// :ref:`verify_certificate_spki
	// <envoy_api_field_auth.CertificateValidationContext.verify_certificate_spki>` are specified,
	// a hash matching value from either of the lists will result in the certificate being accepted.
	VerifyCertificateHash []string `protobuf:"bytes,2,rep,name=verify_certificate_hash,json=verifyCertificateHash,proto3" json:"verify_certificate_hash,omitempty"`
	// An optional list of Subject Alternative Names. If specified, Envoy will verify that the
	// Subject Alternative Name of the presented certificate matches one of the specified values.
	//
	// .. attention::
	//
	//	Subject Alternative Names are easily spoofable and verifying only them is insecure,
	//	therefore this option must be used together with :ref:`trusted_ca
	//	<envoy_api_field_auth.CertificateValidationContext.trusted_ca>`.
	//
	// Deprecated: Marked as deprecated in envoy/api/v2/auth/common.proto.
	VerifySubjectAltName []string `protobuf:"bytes,4,rep,name=verify_subject_alt_name,json=verifySubjectAltName,proto3" json:"verify_subject_alt_name,omitempty"`
	// An optional list of Subject Alternative name matchers. Envoy will verify that the
	// Subject Alternative Name of the presented certificate matches one of the specified matches.
	//
	// When a certificate has wildcard DNS SAN entries, to match a specific client, it should be
	// configured with exact match type in the :ref:`string matcher <envoy_api_msg_type.matcher.StringMatcher>`.
	// For example if the certificate has "\*.example.com" as DNS SAN entry, to allow only "api.example.com",
	// it should be configured as shown below.
	//
	// .. code-block:: yaml
	//
	//	match_subject_alt_names:
	//	  exact: "api.example.com"
	//
	// .. attention::
	//
	//	Subject Alternative Names are easily spoofable and verifying only them is insecure,
	//	therefore this option must be used together with :ref:`trusted_ca
	//	<envoy_api_field_auth.CertificateValidationContext.trusted_ca>`.
	MatchSubjectAltNames []*matcher.StringMatcher `protobuf:"bytes,9,rep,name=match_subject_alt_names,json=matchSubjectAltNames,proto3" json:"match_subject_alt_names,omitempty"`
	// [#not-implemented-hide:] Must present a signed time-stamped OCSP response.
	RequireOcspStaple *wrapperspb.BoolValue `protobuf:"bytes,5,opt,name=require_ocsp_staple,json=requireOcspStaple,proto3" json:"require_ocsp_staple,omitempty"`
	// [#not-implemented-hide:] Must present signed certificate time-stamp.
	RequireSignedCertificateTimestamp *wrapperspb.BoolValue `protobuf:"bytes,6,opt,name=require_signed_certificate_timestamp,json=requireSignedCertificateTimestamp,proto3" json:"require_signed_certificate_timestamp,omitempty"`
	// An optional `certificate revocation list
	// <https://en.wikipedia.org/wiki/Certificate_revocation_list>`_
	// (in PEM format). If specified, Envoy will verify that the presented peer
	// certificate has not been revoked by this CRL. If this DataSource contains
	// multiple CRLs, all of them will be used.
	Crl *core.DataSource `protobuf:"bytes,7,opt,name=crl,proto3" json:"crl,omitempty"`
	// If specified, Envoy will not reject expired certificates.
	AllowExpiredCertificate bool `protobuf:"varint,8,opt,name=allow_expired_certificate,json=allowExpiredCertificate,proto3" json:"allow_expired_certificate,omitempty"`
	// Certificate trust chain verification mode.
	TrustChainVerification CertificateValidationContext_TrustChainVerification `protobuf:"varint,10,opt,name=trust_chain_verification,json=trustChainVerification,proto3,enum=envoy.api.v2.auth.CertificateValidationContext_TrustChainVerification" json:"trust_chain_verification,omitempty"`
	unknownFields          protoimpl.UnknownFields
	sizeCache              protoimpl.SizeCache
}

func (x *CertificateValidationContext) Reset() {
	*x = CertificateValidationContext{}
	mi := &file_envoy_api_v2_auth_common_proto_msgTypes[4]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *CertificateValidationContext) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*CertificateValidationContext) ProtoMessage() {}

func (x *CertificateValidationContext) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_api_v2_auth_common_proto_msgTypes[4]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use CertificateValidationContext.ProtoReflect.Descriptor instead.
func (*CertificateValidationContext) Descriptor() ([]byte, []int) {
	return file_envoy_api_v2_auth_common_proto_rawDescGZIP(), []int{4}
}

func (x *CertificateValidationContext) GetTrustedCa() *core.DataSource {
	if x != nil {
		return x.TrustedCa
	}
	return nil
}

func (x *CertificateValidationContext) GetVerifyCertificateSpki() []string {
	if x != nil {
		return x.VerifyCertificateSpki
	}
	return nil
}

func (x *CertificateValidationContext) GetVerifyCertificateHash() []string {
	if x != nil {
		return x.VerifyCertificateHash
	}
	return nil
}

// Deprecated: Marked as deprecated in envoy/api/v2/auth/common.proto.
func (x *CertificateValidationContext) GetVerifySubjectAltName() []string {
	if x != nil {
		return x.VerifySubjectAltName
	}
	return nil
}

func (x *CertificateValidationContext) GetMatchSubjectAltNames() []*matcher.StringMatcher {
	if x != nil {
		return x.MatchSubjectAltNames
	}
	return nil
}

func (x *CertificateValidationContext) GetRequireOcspStaple() *wrapperspb.BoolValue {
	if x != nil {
		return x.RequireOcspStaple
	}
	return nil
}

func (x *CertificateValidationContext) GetRequireSignedCertificateTimestamp() *wrapperspb.BoolValue {
	if x != nil {
		return x.RequireSignedCertificateTimestamp
	}
	return nil
}

func (x *CertificateValidationContext) GetCrl() *core.DataSource {
	if x != nil {
		return x.Crl
	}
	return nil
}

func (x *CertificateValidationContext) GetAllowExpiredCertificate() bool {
	if x != nil {
		return x.AllowExpiredCertificate
	}
	return false
}

func (x *CertificateValidationContext) GetTrustChainVerification() CertificateValidationContext_TrustChainVerification {
	if x != nil {
		return x.TrustChainVerification
	}
	return CertificateValidationContext_VERIFY_TRUST_CHAIN
}

var File_envoy_api_v2_auth_common_proto protoreflect.FileDescriptor

const file_envoy_api_v2_auth_common_proto_rawDesc = "" +
	"\n" +
	"\x1eenvoy/api/v2/auth/common.proto\x12\x11envoy.api.v2.auth\x1a\x1cenvoy/api/v2/core/base.proto\x1a\x1fenvoy/type/matcher/string.proto\x1a\x19google/protobuf/any.proto\x1a\x1cgoogle/protobuf/struct.proto\x1a\x1egoogle/protobuf/wrappers.proto\x1a\x1eudpa/annotations/migrate.proto\x1a udpa/annotations/sensitive.proto\x1a\x1dudpa/annotations/status.proto\x1a\x17validate/validate.proto\"\x98\x03\n" +
	"\rTlsParameters\x12w\n" +
	"\x1ctls_minimum_protocol_version\x18\x01 \x01(\x0e2,.envoy.api.v2.auth.TlsParameters.TlsProtocolB\b\xfaB\x05\x82\x01\x02\x10\x01R\x19tlsMinimumProtocolVersion\x12w\n" +
	"\x1ctls_maximum_protocol_version\x18\x02 \x01(\x0e2,.envoy.api.v2.auth.TlsParameters.TlsProtocolB\b\xfaB\x05\x82\x01\x02\x10\x01R\x19tlsMaximumProtocolVersion\x12#\n" +
	"\rcipher_suites\x18\x03 \x03(\tR\fcipherSuites\x12\x1f\n" +
	"\vecdh_curves\x18\x04 \x03(\tR\n" +
	"ecdhCurves\"O\n" +
	"\vTlsProtocol\x12\f\n" +
	"\bTLS_AUTO\x10\x00\x12\v\n" +
	"\aTLSv1_0\x10\x01\x12\v\n" +
	"\aTLSv1_1\x10\x02\x12\v\n" +
	"\aTLSv1_2\x10\x03\x12\v\n" +
	"\aTLSv1_3\x10\x04\"\xd1\x01\n" +
	"\x12PrivateKeyProvider\x12,\n" +
	"\rprovider_name\x18\x01 \x01(\tB\a\xfaB\x04r\x02 \x01R\fproviderName\x12;\n" +
	"\x06config\x18\x02 \x01(\v2\x17.google.protobuf.StructB\b\xb8\xb7\x8b\xa4\x02\x01\x18\x01H\x00R\x06config\x12A\n" +
	"\ftyped_config\x18\x03 \x01(\v2\x14.google.protobuf.AnyB\x06\xb8\xb7\x8b\xa4\x02\x01H\x00R\vtypedConfigB\r\n" +
	"\vconfig_type\"\xe1\x03\n" +
	"\x0eTlsCertificate\x12J\n" +
	"\x11certificate_chain\x18\x01 \x01(\v2\x1d.envoy.api.v2.core.DataSourceR\x10certificateChain\x12F\n" +
	"\vprivate_key\x18\x02 \x01(\v2\x1d.envoy.api.v2.core.DataSourceB\x06\xb8\xb7\x8b\xa4\x02\x01R\n" +
	"privateKey\x12W\n" +
	"\x14private_key_provider\x18\x06 \x01(\v2%.envoy.api.v2.auth.PrivateKeyProviderR\x12privateKeyProvider\x12A\n" +
	"\bpassword\x18\x03 \x01(\v2\x1d.envoy.api.v2.core.DataSourceB\x06\xb8\xb7\x8b\xa4\x02\x01R\bpassword\x12>\n" +
	"\vocsp_staple\x18\x04 \x01(\v2\x1d.envoy.api.v2.core.DataSourceR\n" +
	"ocspStaple\x12_\n" +
	"\x1csigned_certificate_timestamp\x18\x05 \x03(\v2\x1d.envoy.api.v2.core.DataSourceR\x1asignedCertificateTimestamp\"Y\n" +
	"\x14TlsSessionTicketKeys\x12A\n" +
	"\x04keys\x18\x01 \x03(\v2\x1d.envoy.api.v2.core.DataSourceB\x0e\xfaB\x05\x92\x01\x02\b\x01\xb8\xb7\x8b\xa4\x02\x01R\x04keys\"\xfc\x06\n" +
	"\x1cCertificateValidationContext\x12<\n" +
	"\n" +
	"trusted_ca\x18\x01 \x01(\v2\x1d.envoy.api.v2.core.DataSourceR\ttrustedCa\x12F\n" +
	"\x17verify_certificate_spki\x18\x03 \x03(\tB\x0e\xfaB\v\x92\x01\b\"\x06r\x04 ,(,R\x15verifyCertificateSpki\x12F\n" +
	"\x17verify_certificate_hash\x18\x02 \x03(\tB\x0e\xfaB\v\x92\x01\b\"\x06r\x04 @(_R\x15verifyCertificateHash\x129\n" +
	"\x17verify_subject_alt_name\x18\x04 \x03(\tB\x02\x18\x01R\x14verifySubjectAltName\x12X\n" +
	"\x17match_subject_alt_names\x18\t \x03(\v2!.envoy.type.matcher.StringMatcherR\x14matchSubjectAltNames\x12J\n" +
	"\x13require_ocsp_staple\x18\x05 \x01(\v2\x1a.google.protobuf.BoolValueR\x11requireOcspStaple\x12k\n" +
	"$require_signed_certificate_timestamp\x18\x06 \x01(\v2\x1a.google.protobuf.BoolValueR!requireSignedCertificateTimestamp\x12/\n" +
	"\x03crl\x18\a \x01(\v2\x1d.envoy.api.v2.core.DataSourceR\x03crl\x12:\n" +
	"\x19allow_expired_certificate\x18\b \x01(\bR\x17allowExpiredCertificate\x12\x8a\x01\n" +
	"\x18trust_chain_verification\x18\n" +
	" \x01(\x0e2F.envoy.api.v2.auth.CertificateValidationContext.TrustChainVerificationB\b\xfaB\x05\x82\x01\x02\x10\x01R\x16trustChainVerification\"F\n" +
	"\x16TrustChainVerification\x12\x16\n" +
	"\x12VERIFY_TRUST_CHAIN\x10\x00\x12\x14\n" +
	"\x10ACCEPT_UNTRUSTED\x10\x01B\xa3\x01\xf2\x98\xfe\x8f\x05+\x12)envoy.extensions.transport_sockets.tls.v3\xba\x80\xc8\xd1\x06\x02\x10\x01\n" +
	"\x1fio.envoyproxy.envoy.api.v2.authB\vCommonProtoP\x01Z8github.com/envoyproxy/go-control-plane/envoy/api/v2/authb\x06proto3"

var (
	file_envoy_api_v2_auth_common_proto_rawDescOnce sync.Once
	file_envoy_api_v2_auth_common_proto_rawDescData []byte
)

func file_envoy_api_v2_auth_common_proto_rawDescGZIP() []byte {
	file_envoy_api_v2_auth_common_proto_rawDescOnce.Do(func() {
		file_envoy_api_v2_auth_common_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_envoy_api_v2_auth_common_proto_rawDesc), len(file_envoy_api_v2_auth_common_proto_rawDesc)))
	})
	return file_envoy_api_v2_auth_common_proto_rawDescData
}

var file_envoy_api_v2_auth_common_proto_enumTypes = make([]protoimpl.EnumInfo, 2)
var file_envoy_api_v2_auth_common_proto_msgTypes = make([]protoimpl.MessageInfo, 5)
var file_envoy_api_v2_auth_common_proto_goTypes = []any{
	(TlsParameters_TlsProtocol)(0),                           // 0: envoy.api.v2.auth.TlsParameters.TlsProtocol
	(CertificateValidationContext_TrustChainVerification)(0), // 1: envoy.api.v2.auth.CertificateValidationContext.TrustChainVerification
	(*TlsParameters)(nil),                                    // 2: envoy.api.v2.auth.TlsParameters
	(*PrivateKeyProvider)(nil),                               // 3: envoy.api.v2.auth.PrivateKeyProvider
	(*TlsCertificate)(nil),                                   // 4: envoy.api.v2.auth.TlsCertificate
	(*TlsSessionTicketKeys)(nil),                             // 5: envoy.api.v2.auth.TlsSessionTicketKeys
	(*CertificateValidationContext)(nil),                     // 6: envoy.api.v2.auth.CertificateValidationContext
	(*structpb.Struct)(nil),                                  // 7: google.protobuf.Struct
	(*anypb.Any)(nil),                                        // 8: google.protobuf.Any
	(*core.DataSource)(nil),                                  // 9: envoy.api.v2.core.DataSource
	(*matcher.StringMatcher)(nil),                            // 10: envoy.type.matcher.StringMatcher
	(*wrapperspb.BoolValue)(nil),                             // 11: google.protobuf.BoolValue
}
var file_envoy_api_v2_auth_common_proto_depIdxs = []int32{
	0,  // 0: envoy.api.v2.auth.TlsParameters.tls_minimum_protocol_version:type_name -> envoy.api.v2.auth.TlsParameters.TlsProtocol
	0,  // 1: envoy.api.v2.auth.TlsParameters.tls_maximum_protocol_version:type_name -> envoy.api.v2.auth.TlsParameters.TlsProtocol
	7,  // 2: envoy.api.v2.auth.PrivateKeyProvider.config:type_name -> google.protobuf.Struct
	8,  // 3: envoy.api.v2.auth.PrivateKeyProvider.typed_config:type_name -> google.protobuf.Any
	9,  // 4: envoy.api.v2.auth.TlsCertificate.certificate_chain:type_name -> envoy.api.v2.core.DataSource
	9,  // 5: envoy.api.v2.auth.TlsCertificate.private_key:type_name -> envoy.api.v2.core.DataSource
	3,  // 6: envoy.api.v2.auth.TlsCertificate.private_key_provider:type_name -> envoy.api.v2.auth.PrivateKeyProvider
	9,  // 7: envoy.api.v2.auth.TlsCertificate.password:type_name -> envoy.api.v2.core.DataSource
	9,  // 8: envoy.api.v2.auth.TlsCertificate.ocsp_staple:type_name -> envoy.api.v2.core.DataSource
	9,  // 9: envoy.api.v2.auth.TlsCertificate.signed_certificate_timestamp:type_name -> envoy.api.v2.core.DataSource
	9,  // 10: envoy.api.v2.auth.TlsSessionTicketKeys.keys:type_name -> envoy.api.v2.core.DataSource
	9,  // 11: envoy.api.v2.auth.CertificateValidationContext.trusted_ca:type_name -> envoy.api.v2.core.DataSource
	10, // 12: envoy.api.v2.auth.CertificateValidationContext.match_subject_alt_names:type_name -> envoy.type.matcher.StringMatcher
	11, // 13: envoy.api.v2.auth.CertificateValidationContext.require_ocsp_staple:type_name -> google.protobuf.BoolValue
	11, // 14: envoy.api.v2.auth.CertificateValidationContext.require_signed_certificate_timestamp:type_name -> google.protobuf.BoolValue
	9,  // 15: envoy.api.v2.auth.CertificateValidationContext.crl:type_name -> envoy.api.v2.core.DataSource
	1,  // 16: envoy.api.v2.auth.CertificateValidationContext.trust_chain_verification:type_name -> envoy.api.v2.auth.CertificateValidationContext.TrustChainVerification
	17, // [17:17] is the sub-list for method output_type
	17, // [17:17] is the sub-list for method input_type
	17, // [17:17] is the sub-list for extension type_name
	17, // [17:17] is the sub-list for extension extendee
	0,  // [0:17] is the sub-list for field type_name
}

func init() { file_envoy_api_v2_auth_common_proto_init() }
func file_envoy_api_v2_auth_common_proto_init() {
	if File_envoy_api_v2_auth_common_proto != nil {
		return
	}
	file_envoy_api_v2_auth_common_proto_msgTypes[1].OneofWrappers = []any{
		(*PrivateKeyProvider_Config)(nil),
		(*PrivateKeyProvider_TypedConfig)(nil),
	}
	type x struct{}
	out := protoimpl.TypeBuilder{
		File: protoimpl.DescBuilder{
			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
			RawDescriptor: unsafe.Slice(unsafe.StringData(file_envoy_api_v2_auth_common_proto_rawDesc), len(file_envoy_api_v2_auth_common_proto_rawDesc)),
			NumEnums:      2,
			NumMessages:   5,
			NumExtensions: 0,
			NumServices:   0,
		},
		GoTypes:           file_envoy_api_v2_auth_common_proto_goTypes,
		DependencyIndexes: file_envoy_api_v2_auth_common_proto_depIdxs,
		EnumInfos:         file_envoy_api_v2_auth_common_proto_enumTypes,
		MessageInfos:      file_envoy_api_v2_auth_common_proto_msgTypes,
	}.Build()
	File_envoy_api_v2_auth_common_proto = out.File
	file_envoy_api_v2_auth_common_proto_goTypes = nil
	file_envoy_api_v2_auth_common_proto_depIdxs = nil
}