cert.pb.go

// Code generated by protoc-gen-go. DO NOT EDIT.
// source: envoy/api/v2/auth/cert.proto

package envoy_api_v2_auth

import (
	fmt "fmt"
	core "github.com/altipla-consulting/envoy-api/envoy/api/v2/core"
	_ "github.com/envoyproxy/protoc-gen-validate/validate"
	types "github.com/gogo/protobuf/types"
	proto "github.com/golang/protobuf/proto"
	math "math"
)

// Reference imports to suppress errors if they are not otherwise used.
var _ = proto.Marshal
var _ = fmt.Errorf
var _ = math.Inf

// This is a compile-time assertion to ensure that this generated file
// is compatible with the proto package it is being compiled against.
// A compilation error at this line likely means your copy of the
// proto package needs to be updated.
const _ = proto.ProtoPackageIsVersion3 // please upgrade the proto package

type TlsParameters_TlsProtocol int32

const (
	// Envoy will choose the optimal TLS version.
	TlsParameters_TLS_AUTO TlsParameters_TlsProtocol = 0
	// TLS 1.0
	TlsParameters_TLSv1_0 TlsParameters_TlsProtocol = 1
	// TLS 1.1
	TlsParameters_TLSv1_1 TlsParameters_TlsProtocol = 2
	// TLS 1.2
	TlsParameters_TLSv1_2 TlsParameters_TlsProtocol = 3
	// TLS 1.3
	TlsParameters_TLSv1_3 TlsParameters_TlsProtocol = 4
)

var TlsParameters_TlsProtocol_name = map[int32]string{
	0: "TLS_AUTO",
	1: "TLSv1_0",
	2: "TLSv1_1",
	3: "TLSv1_2",
	4: "TLSv1_3",
}

var TlsParameters_TlsProtocol_value = map[string]int32{
	"TLS_AUTO": 0,
	"TLSv1_0":  1,
	"TLSv1_1":  2,
	"TLSv1_2":  3,
	"TLSv1_3":  4,
}

func (x TlsParameters_TlsProtocol) String() string {
	return proto.EnumName(TlsParameters_TlsProtocol_name, int32(x))
}

func (TlsParameters_TlsProtocol) EnumDescriptor() ([]byte, []int) {
	return fileDescriptor_0c3851c0865b2745, []int{0, 0}
}

type TlsParameters struct {
	// Minimum TLS protocol version. By default, it's ``TLSv1_0``.
	TlsMinimumProtocolVersion TlsParameters_TlsProtocol `protobuf:"varint,1,opt,name=tls_minimum_protocol_version,json=tlsMinimumProtocolVersion,proto3,enum=envoy.api.v2.auth.TlsParameters_TlsProtocol" json:"tls_minimum_protocol_version,omitempty"`
	// Maximum TLS protocol version. By default, it's ``TLSv1_3`` for servers in non-FIPS builds, and
	// ``TLSv1_2`` for clients and for servers using :ref:`BoringSSL FIPS <arch_overview_ssl_fips>`.
	TlsMaximumProtocolVersion TlsParameters_TlsProtocol `protobuf:"varint,2,opt,name=tls_maximum_protocol_version,json=tlsMaximumProtocolVersion,proto3,enum=envoy.api.v2.auth.TlsParameters_TlsProtocol" json:"tls_maximum_protocol_version,omitempty"`
	// If specified, the TLS listener will only support the specified `cipher list
	// <https://commondatastorage.googleapis.com/chromium-boringssl-docs/ssl.h.html#Cipher-suite-configuration>`_
	// when negotiating TLS 1.0-1.2 (this setting has no effect when negotiating TLS 1.3). If not
	// specified, the default list will be used.
	//
	// In non-FIPS builds, the default cipher list is:
	//
	// .. code-block:: none
	//
	//   [ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305]
	//   [ECDHE-RSA-AES128-GCM-SHA256|ECDHE-RSA-CHACHA20-POLY1305]
	//   ECDHE-ECDSA-AES128-SHA
	//   ECDHE-RSA-AES128-SHA
	//   AES128-GCM-SHA256
	//   AES128-SHA
	//   ECDHE-ECDSA-AES256-GCM-SHA384
	//   ECDHE-RSA-AES256-GCM-SHA384
	//   ECDHE-ECDSA-AES256-SHA
	//   ECDHE-RSA-AES256-SHA
	//   AES256-GCM-SHA384
	//   AES256-SHA
	//
	// In builds using :ref:`BoringSSL FIPS <arch_overview_ssl_fips>`, the default cipher list is:
	//
	// .. code-block:: none
	//
	//   ECDHE-ECDSA-AES128-GCM-SHA256
	//   ECDHE-RSA-AES128-GCM-SHA256
	//   ECDHE-ECDSA-AES128-SHA
	//   ECDHE-RSA-AES128-SHA
	//   AES128-GCM-SHA256
	//   AES128-SHA
	//   ECDHE-ECDSA-AES256-GCM-SHA384
	//   ECDHE-RSA-AES256-GCM-SHA384
	//   ECDHE-ECDSA-AES256-SHA
	//   ECDHE-RSA-AES256-SHA
	//   AES256-GCM-SHA384
	//   AES256-SHA
	CipherSuites []string `protobuf:"bytes,3,rep,name=cipher_suites,json=cipherSuites,proto3" json:"cipher_suites,omitempty"`
	// If specified, the TLS connection will only support the specified ECDH
	// curves. If not specified, the default curves will be used.
	//
	// In non-FIPS builds, the default curves are:
	//
	// .. code-block:: none
	//
	//   X25519
	//   P-256
	//
	// In builds using :ref:`BoringSSL FIPS <arch_overview_ssl_fips>`, the default curve is:
	//
	// .. code-block:: none
	//
	//   P-256
	EcdhCurves           []string `protobuf:"bytes,4,rep,name=ecdh_curves,json=ecdhCurves,proto3" json:"ecdh_curves,omitempty"`
	XXX_NoUnkeyedLiteral struct{} `json:"-"`
	XXX_unrecognized     []byte   `json:"-"`
	XXX_sizecache        int32    `json:"-"`
}

func (m *TlsParameters) Reset()         { *m = TlsParameters{} }
func (m *TlsParameters) String() string { return proto.CompactTextString(m) }
func (*TlsParameters) ProtoMessage()    {}
func (*TlsParameters) Descriptor() ([]byte, []int) {
	return fileDescriptor_0c3851c0865b2745, []int{0}
}

func (m *TlsParameters) XXX_Unmarshal(b []byte) error {
	return xxx_messageInfo_TlsParameters.Unmarshal(m, b)
}
func (m *TlsParameters) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
	return xxx_messageInfo_TlsParameters.Marshal(b, m, deterministic)
}
func (m *TlsParameters) XXX_Merge(src proto.Message) {
	xxx_messageInfo_TlsParameters.Merge(m, src)
}
func (m *TlsParameters) XXX_Size() int {
	return xxx_messageInfo_TlsParameters.Size(m)
}
func (m *TlsParameters) XXX_DiscardUnknown() {
	xxx_messageInfo_TlsParameters.DiscardUnknown(m)
}

var xxx_messageInfo_TlsParameters proto.InternalMessageInfo

func (m *TlsParameters) GetTlsMinimumProtocolVersion() TlsParameters_TlsProtocol {
	if m != nil {
		return m.TlsMinimumProtocolVersion
	}
	return TlsParameters_TLS_AUTO
}

func (m *TlsParameters) GetTlsMaximumProtocolVersion() TlsParameters_TlsProtocol {
	if m != nil {
		return m.TlsMaximumProtocolVersion
	}
	return TlsParameters_TLS_AUTO
}

func (m *TlsParameters) GetCipherSuites() []string {
	if m != nil {
		return m.CipherSuites
	}
	return nil
}

func (m *TlsParameters) GetEcdhCurves() []string {
	if m != nil {
		return m.EcdhCurves
	}
	return nil
}

// BoringSSL private key method configuration. The private key methods are used for external
// (potentially asynchronous) signing and decryption operations. Some use cases for private key
// methods would be TPM support and TLS acceleration.
type PrivateKeyProvider struct {
	// Private key method provider name. The name must match a
	// supported private key method provider type.
	ProviderName string `protobuf:"bytes,1,opt,name=provider_name,json=providerName,proto3" json:"provider_name,omitempty"`
	// Private key method provider specific configuration.
	//
	// Types that are valid to be assigned to ConfigType:
	//	*PrivateKeyProvider_Config
	//	*PrivateKeyProvider_TypedConfig
	ConfigType           isPrivateKeyProvider_ConfigType `protobuf_oneof:"config_type"`
	XXX_NoUnkeyedLiteral struct{}                        `json:"-"`
	XXX_unrecognized     []byte                          `json:"-"`
	XXX_sizecache        int32                           `json:"-"`
}

func (m *PrivateKeyProvider) Reset()         { *m = PrivateKeyProvider{} }
func (m *PrivateKeyProvider) String() string { return proto.CompactTextString(m) }
func (*PrivateKeyProvider) ProtoMessage()    {}
func (*PrivateKeyProvider) Descriptor() ([]byte, []int) {
	return fileDescriptor_0c3851c0865b2745, []int{1}
}

func (m *PrivateKeyProvider) XXX_Unmarshal(b []byte) error {
	return xxx_messageInfo_PrivateKeyProvider.Unmarshal(m, b)
}
func (m *PrivateKeyProvider) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
	return xxx_messageInfo_PrivateKeyProvider.Marshal(b, m, deterministic)
}
func (m *PrivateKeyProvider) XXX_Merge(src proto.Message) {
	xxx_messageInfo_PrivateKeyProvider.Merge(m, src)
}
func (m *PrivateKeyProvider) XXX_Size() int {
	return xxx_messageInfo_PrivateKeyProvider.Size(m)
}
func (m *PrivateKeyProvider) XXX_DiscardUnknown() {
	xxx_messageInfo_PrivateKeyProvider.DiscardUnknown(m)
}

var xxx_messageInfo_PrivateKeyProvider proto.InternalMessageInfo

func (m *PrivateKeyProvider) GetProviderName() string {
	if m != nil {
		return m.ProviderName
	}
	return ""
}

type isPrivateKeyProvider_ConfigType interface {
	isPrivateKeyProvider_ConfigType()
}

type PrivateKeyProvider_Config struct {
	Config *types.Struct `protobuf:"bytes,2,opt,name=config,proto3,oneof"`
}

type PrivateKeyProvider_TypedConfig struct {
	TypedConfig *types.Any `protobuf:"bytes,3,opt,name=typed_config,json=typedConfig,proto3,oneof"`
}

func (*PrivateKeyProvider_Config) isPrivateKeyProvider_ConfigType() {}

func (*PrivateKeyProvider_TypedConfig) isPrivateKeyProvider_ConfigType() {}

func (m *PrivateKeyProvider) GetConfigType() isPrivateKeyProvider_ConfigType {
	if m != nil {
		return m.ConfigType
	}
	return nil
}

func (m *PrivateKeyProvider) GetConfig() *types.Struct {
	if x, ok := m.GetConfigType().(*PrivateKeyProvider_Config); ok {
		return x.Config
	}
	return nil
}

func (m *PrivateKeyProvider) GetTypedConfig() *types.Any {
	if x, ok := m.GetConfigType().(*PrivateKeyProvider_TypedConfig); ok {
		return x.TypedConfig
	}
	return nil
}

// XXX_OneofWrappers is for the internal use of the proto package.
func (*PrivateKeyProvider) XXX_OneofWrappers() []interface{} {
	return []interface{}{
		(*PrivateKeyProvider_Config)(nil),
		(*PrivateKeyProvider_TypedConfig)(nil),
	}
}

// [#next-free-field: 7]
type TlsCertificate struct {
	// The TLS certificate chain.
	CertificateChain *core.DataSource `protobuf:"bytes,1,opt,name=certificate_chain,json=certificateChain,proto3" json:"certificate_chain,omitempty"`
	// The TLS private key.
	PrivateKey *core.DataSource `protobuf:"bytes,2,opt,name=private_key,json=privateKey,proto3" json:"private_key,omitempty"`
	// BoringSSL private key method provider. This is an alternative to :ref:`private_key
	// <envoy_api_field_auth.TlsCertificate.private_key>` field. This can't be
	// marked as ``oneof`` due to API compatibility reasons. Setting both :ref:`private_key
	// <envoy_api_field_auth.TlsCertificate.private_key>` and
	// :ref:`private_key_provider
	// <envoy_api_field_auth.TlsCertificate.private_key_provider>` fields will result in an
	// error.
	PrivateKeyProvider *PrivateKeyProvider `protobuf:"bytes,6,opt,name=private_key_provider,json=privateKeyProvider,proto3" json:"private_key_provider,omitempty"`
	// The password to decrypt the TLS private key. If this field is not set, it is assumed that the
	// TLS private key is not password encrypted.
	Password *core.DataSource `protobuf:"bytes,3,opt,name=password,proto3" json:"password,omitempty"`
	// [#not-implemented-hide:]
	OcspStaple *core.DataSource `protobuf:"bytes,4,opt,name=ocsp_staple,json=ocspStaple,proto3" json:"ocsp_staple,omitempty"`
	// [#not-implemented-hide:]
	SignedCertificateTimestamp []*core.DataSource `protobuf:"bytes,5,rep,name=signed_certificate_timestamp,json=signedCertificateTimestamp,proto3" json:"signed_certificate_timestamp,omitempty"`
	XXX_NoUnkeyedLiteral       struct{}           `json:"-"`
	XXX_unrecognized           []byte             `json:"-"`
	XXX_sizecache              int32              `json:"-"`
}

func (m *TlsCertificate) Reset()         { *m = TlsCertificate{} }
func (m *TlsCertificate) String() string { return proto.CompactTextString(m) }
func (*TlsCertificate) ProtoMessage()    {}
func (*TlsCertificate) Descriptor() ([]byte, []int) {
	return fileDescriptor_0c3851c0865b2745, []int{2}
}

func (m *TlsCertificate) XXX_Unmarshal(b []byte) error {
	return xxx_messageInfo_TlsCertificate.Unmarshal(m, b)
}
func (m *TlsCertificate) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
	return xxx_messageInfo_TlsCertificate.Marshal(b, m, deterministic)
}
func (m *TlsCertificate) XXX_Merge(src proto.Message) {
	xxx_messageInfo_TlsCertificate.Merge(m, src)
}
func (m *TlsCertificate) XXX_Size() int {
	return xxx_messageInfo_TlsCertificate.Size(m)
}
func (m *TlsCertificate) XXX_DiscardUnknown() {
	xxx_messageInfo_TlsCertificate.DiscardUnknown(m)
}

var xxx_messageInfo_TlsCertificate proto.InternalMessageInfo

func (m *TlsCertificate) GetCertificateChain() *core.DataSource {
	if m != nil {
		return m.CertificateChain
	}
	return nil
}

func (m *TlsCertificate) GetPrivateKey() *core.DataSource {
	if m != nil {
		return m.PrivateKey
	}
	return nil
}

func (m *TlsCertificate) GetPrivateKeyProvider() *PrivateKeyProvider {
	if m != nil {
		return m.PrivateKeyProvider
	}
	return nil
}

func (m *TlsCertificate) GetPassword() *core.DataSource {
	if m != nil {
		return m.Password
	}
	return nil
}

func (m *TlsCertificate) GetOcspStaple() *core.DataSource {
	if m != nil {
		return m.OcspStaple
	}
	return nil
}

func (m *TlsCertificate) GetSignedCertificateTimestamp() []*core.DataSource {
	if m != nil {
		return m.SignedCertificateTimestamp
	}
	return nil
}

type TlsSessionTicketKeys struct {
	// Keys for encrypting and decrypting TLS session tickets. The
	// first key in the array contains the key to encrypt all new sessions created by this context.
	// All keys are candidates for decrypting received tickets. This allows for easy rotation of keys
	// by, for example, putting the new key first, and the previous key second.
	//
	// If :ref:`session_ticket_keys <envoy_api_field_auth.DownstreamTlsContext.session_ticket_keys>`
	// is not specified, the TLS library will still support resuming sessions via tickets, but it will
	// use an internally-generated and managed key, so sessions cannot be resumed across hot restarts
	// or on different hosts.
	//
	// Each key must contain exactly 80 bytes of cryptographically-secure random data. For
	// example, the output of ``openssl rand 80``.
	//
	// .. attention::
	//
	//   Using this feature has serious security considerations and risks. Improper handling of keys
	//   may result in loss of secrecy in connections, even if ciphers supporting perfect forward
	//   secrecy are used. See https://www.imperialviolet.org/2013/06/27/botchingpfs.html for some
	//   discussion. To minimize the risk, you must:
	//
	//   * Keep the session ticket keys at least as secure as your TLS certificate private keys
	//   * Rotate session ticket keys at least daily, and preferably hourly
	//   * Always generate keys using a cryptographically-secure random data source
	Keys                 []*core.DataSource `protobuf:"bytes,1,rep,name=keys,proto3" json:"keys,omitempty"`
	XXX_NoUnkeyedLiteral struct{}           `json:"-"`
	XXX_unrecognized     []byte             `json:"-"`
	XXX_sizecache        int32              `json:"-"`
}

func (m *TlsSessionTicketKeys) Reset()         { *m = TlsSessionTicketKeys{} }
func (m *TlsSessionTicketKeys) String() string { return proto.CompactTextString(m) }
func (*TlsSessionTicketKeys) ProtoMessage()    {}
func (*TlsSessionTicketKeys) Descriptor() ([]byte, []int) {
	return fileDescriptor_0c3851c0865b2745, []int{3}
}

func (m *TlsSessionTicketKeys) XXX_Unmarshal(b []byte) error {
	return xxx_messageInfo_TlsSessionTicketKeys.Unmarshal(m, b)
}
func (m *TlsSessionTicketKeys) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
	return xxx_messageInfo_TlsSessionTicketKeys.Marshal(b, m, deterministic)
}
func (m *TlsSessionTicketKeys) XXX_Merge(src proto.Message) {
	xxx_messageInfo_TlsSessionTicketKeys.Merge(m, src)
}
func (m *TlsSessionTicketKeys) XXX_Size() int {
	return xxx_messageInfo_TlsSessionTicketKeys.Size(m)
}
func (m *TlsSessionTicketKeys) XXX_DiscardUnknown() {
	xxx_messageInfo_TlsSessionTicketKeys.DiscardUnknown(m)
}

var xxx_messageInfo_TlsSessionTicketKeys proto.InternalMessageInfo

func (m *TlsSessionTicketKeys) GetKeys() []*core.DataSource {
	if m != nil {
		return m.Keys
	}
	return nil
}

// [#next-free-field: 9]
type CertificateValidationContext struct {
	// TLS certificate data containing certificate authority certificates to use in verifying
	// a presented peer certificate (e.g. server certificate for clusters or client certificate
	// for listeners). If not specified and a peer certificate is presented it will not be
	// verified. By default, a client certificate is optional, unless one of the additional
	// options (:ref:`require_client_certificate
	// <envoy_api_field_auth.DownstreamTlsContext.require_client_certificate>`,
	// :ref:`verify_certificate_spki
	// <envoy_api_field_auth.CertificateValidationContext.verify_certificate_spki>`,
	// :ref:`verify_certificate_hash
	// <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>`, or
	// :ref:`verify_subject_alt_name
	// <envoy_api_field_auth.CertificateValidationContext.verify_subject_alt_name>`) is also
	// specified.
	//
	// It can optionally contain certificate revocation lists, in which case Envoy will verify
	// that the presented peer certificate has not been revoked by one of the included CRLs.
	//
	// See :ref:`the TLS overview <arch_overview_ssl_enabling_verification>` for a list of common
	// system CA locations.
	TrustedCa *core.DataSource `protobuf:"bytes,1,opt,name=trusted_ca,json=trustedCa,proto3" json:"trusted_ca,omitempty"`
	// An optional list of base64-encoded SHA-256 hashes. If specified, Envoy will verify that the
	// SHA-256 of the DER-encoded Subject Public Key Information (SPKI) of the presented certificate
	// matches one of the specified values.
	//
	// A base64-encoded SHA-256 of the Subject Public Key Information (SPKI) of the certificate
	// can be generated with the following command:
	//
	// .. code-block:: bash
	//
	//   $ openssl x509 -in path/to/client.crt -noout -pubkey
	//     | openssl pkey -pubin -outform DER
	//     | openssl dgst -sha256 -binary
	//     | openssl enc -base64
	//   NvqYIYSbgK2vCJpQhObf77vv+bQWtc5ek5RIOwPiC9A=
	//
	// This is the format used in HTTP Public Key Pinning.
	//
	// When both:
	// :ref:`verify_certificate_hash
	// <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>` and
	// :ref:`verify_certificate_spki
	// <envoy_api_field_auth.CertificateValidationContext.verify_certificate_spki>` are specified,
	// a hash matching value from either of the lists will result in the certificate being accepted.
	//
	// .. attention::
	//
	//   This option is preferred over :ref:`verify_certificate_hash
	//   <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>`,
	//   because SPKI is tied to a private key, so it doesn't change when the certificate
	//   is renewed using the same private key.
	VerifyCertificateSpki []string `protobuf:"bytes,3,rep,name=verify_certificate_spki,json=verifyCertificateSpki,proto3" json:"verify_certificate_spki,omitempty"`
	// An optional list of hex-encoded SHA-256 hashes. If specified, Envoy will verify that
	// the SHA-256 of the DER-encoded presented certificate matches one of the specified values.
	//
	// A hex-encoded SHA-256 of the certificate can be generated with the following command:
	//
	// .. code-block:: bash
	//
	//   $ openssl x509 -in path/to/client.crt -outform DER | openssl dgst -sha256 | cut -d" " -f2
	//   df6ff72fe9116521268f6f2dd4966f51df479883fe7037b39f75916ac3049d1a
	//
	// A long hex-encoded and colon-separated SHA-256 (a.k.a. "fingerprint") of the certificate
	// can be generated with the following command:
	//
	// .. code-block:: bash
	//
	//   $ openssl x509 -in path/to/client.crt -noout -fingerprint -sha256 | cut -d"=" -f2
	//   DF:6F:F7:2F:E9:11:65:21:26:8F:6F:2D:D4:96:6F:51:DF:47:98:83:FE:70:37:B3:9F:75:91:6A:C3:04:9D:1A
	//
	// Both of those formats are acceptable.
	//
	// When both:
	// :ref:`verify_certificate_hash
	// <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>` and
	// :ref:`verify_certificate_spki
	// <envoy_api_field_auth.CertificateValidationContext.verify_certificate_spki>` are specified,
	// a hash matching value from either of the lists will result in the certificate being accepted.
	VerifyCertificateHash []string `protobuf:"bytes,2,rep,name=verify_certificate_hash,json=verifyCertificateHash,proto3" json:"verify_certificate_hash,omitempty"`
	// An optional list of Subject Alternative Names. If specified, Envoy will verify that the
	// Subject Alternative Name of the presented certificate matches one of the specified values.
	//
	// .. attention::
	//
	//   Subject Alternative Names are easily spoofable and verifying only them is insecure,
	//   therefore this option must be used together with :ref:`trusted_ca
	//   <envoy_api_field_auth.CertificateValidationContext.trusted_ca>`.
	VerifySubjectAltName []string `protobuf:"bytes,4,rep,name=verify_subject_alt_name,json=verifySubjectAltName,proto3" json:"verify_subject_alt_name,omitempty"`
	// [#not-implemented-hide:] Must present a signed time-stamped OCSP response.
	RequireOcspStaple *types.BoolValue `protobuf:"bytes,5,opt,name=require_ocsp_staple,json=requireOcspStaple,proto3" json:"require_ocsp_staple,omitempty"`
	// [#not-implemented-hide:] Must present signed certificate time-stamp.
	RequireSignedCertificateTimestamp *types.BoolValue `protobuf:"bytes,6,opt,name=require_signed_certificate_timestamp,json=requireSignedCertificateTimestamp,proto3" json:"require_signed_certificate_timestamp,omitempty"`
	// An optional `certificate revocation list
	// <https://en.wikipedia.org/wiki/Certificate_revocation_list>`_
	// (in PEM format). If specified, Envoy will verify that the presented peer
	// certificate has not been revoked by this CRL. If this DataSource contains
	// multiple CRLs, all of them will be used.
	Crl *core.DataSource `protobuf:"bytes,7,opt,name=crl,proto3" json:"crl,omitempty"`
	// If specified, Envoy will not reject expired certificates.
	AllowExpiredCertificate bool     `protobuf:"varint,8,opt,name=allow_expired_certificate,json=allowExpiredCertificate,proto3" json:"allow_expired_certificate,omitempty"`
	XXX_NoUnkeyedLiteral    struct{} `json:"-"`
	XXX_unrecognized        []byte   `json:"-"`
	XXX_sizecache           int32    `json:"-"`
}

func (m *CertificateValidationContext) Reset()         { *m = CertificateValidationContext{} }
func (m *CertificateValidationContext) String() string { return proto.CompactTextString(m) }
func (*CertificateValidationContext) ProtoMessage()    {}
func (*CertificateValidationContext) Descriptor() ([]byte, []int) {
	return fileDescriptor_0c3851c0865b2745, []int{4}
}

func (m *CertificateValidationContext) XXX_Unmarshal(b []byte) error {
	return xxx_messageInfo_CertificateValidationContext.Unmarshal(m, b)
}
func (m *CertificateValidationContext) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
	return xxx_messageInfo_CertificateValidationContext.Marshal(b, m, deterministic)
}
func (m *CertificateValidationContext) XXX_Merge(src proto.Message) {
	xxx_messageInfo_CertificateValidationContext.Merge(m, src)
}
func (m *CertificateValidationContext) XXX_Size() int {
	return xxx_messageInfo_CertificateValidationContext.Size(m)
}
func (m *CertificateValidationContext) XXX_DiscardUnknown() {
	xxx_messageInfo_CertificateValidationContext.DiscardUnknown(m)
}

var xxx_messageInfo_CertificateValidationContext proto.InternalMessageInfo

func (m *CertificateValidationContext) GetTrustedCa() *core.DataSource {
	if m != nil {
		return m.TrustedCa
	}
	return nil
}

func (m *CertificateValidationContext) GetVerifyCertificateSpki() []string {
	if m != nil {
		return m.VerifyCertificateSpki
	}
	return nil
}

func (m *CertificateValidationContext) GetVerifyCertificateHash() []string {
	if m != nil {
		return m.VerifyCertificateHash
	}
	return nil
}

func (m *CertificateValidationContext) GetVerifySubjectAltName() []string {
	if m != nil {
		return m.VerifySubjectAltName
	}
	return nil
}

func (m *CertificateValidationContext) GetRequireOcspStaple() *types.BoolValue {
	if m != nil {
		return m.RequireOcspStaple
	}
	return nil
}

func (m *CertificateValidationContext) GetRequireSignedCertificateTimestamp() *types.BoolValue {
	if m != nil {
		return m.RequireSignedCertificateTimestamp
	}
	return nil
}

func (m *CertificateValidationContext) GetCrl() *core.DataSource {
	if m != nil {
		return m.Crl
	}
	return nil
}

func (m *CertificateValidationContext) GetAllowExpiredCertificate() bool {
	if m != nil {
		return m.AllowExpiredCertificate
	}
	return false
}

// TLS context shared by both client and server TLS contexts.
// [#next-free-field: 9]
type CommonTlsContext struct {
	// TLS protocol versions, cipher suites etc.
	TlsParams *TlsParameters `protobuf:"bytes,1,opt,name=tls_params,json=tlsParams,proto3" json:"tls_params,omitempty"`
	// :ref:`Multiple TLS certificates <arch_overview_ssl_cert_select>` can be associated with the
	// same context to allow both RSA and ECDSA certificates.
	//
	// Only a single TLS certificate is supported in client contexts. In server contexts, the first
	// RSA certificate is used for clients that only support RSA and the first ECDSA certificate is
	// used for clients that support ECDSA.
	TlsCertificates []*TlsCertificate `protobuf:"bytes,2,rep,name=tls_certificates,json=tlsCertificates,proto3" json:"tls_certificates,omitempty"`
	// Configs for fetching TLS certificates via SDS API.
	TlsCertificateSdsSecretConfigs []*SdsSecretConfig `protobuf:"bytes,6,rep,name=tls_certificate_sds_secret_configs,json=tlsCertificateSdsSecretConfigs,proto3" json:"tls_certificate_sds_secret_configs,omitempty"`
	// Types that are valid to be assigned to ValidationContextType:
	//	*CommonTlsContext_ValidationContext
	//	*CommonTlsContext_ValidationContextSdsSecretConfig
	//	*CommonTlsContext_CombinedValidationContext
	ValidationContextType isCommonTlsContext_ValidationContextType `protobuf_oneof:"validation_context_type"`
	// Supplies the list of ALPN protocols that the listener should expose. In
	// practice this is likely to be set to one of two values (see the
	// :ref:`codec_type
	// <envoy_api_field_config.filter.network.http_connection_manager.v2.HttpConnectionManager.codec_type>`
	// parameter in the HTTP connection manager for more information):
	//
	// * "h2,http/1.1" If the listener is going to support both HTTP/2 and HTTP/1.1.
	// * "http/1.1" If the listener is only going to support HTTP/1.1.
	//
	// There is no default for this parameter. If empty, Envoy will not expose ALPN.
	AlpnProtocols        []string `protobuf:"bytes,4,rep,name=alpn_protocols,json=alpnProtocols,proto3" json:"alpn_protocols,omitempty"`
	XXX_NoUnkeyedLiteral struct{} `json:"-"`
	XXX_unrecognized     []byte   `json:"-"`
	XXX_sizecache        int32    `json:"-"`
}

func (m *CommonTlsContext) Reset()         { *m = CommonTlsContext{} }
func (m *CommonTlsContext) String() string { return proto.CompactTextString(m) }
func (*CommonTlsContext) ProtoMessage()    {}
func (*CommonTlsContext) Descriptor() ([]byte, []int) {
	return fileDescriptor_0c3851c0865b2745, []int{5}
}

func (m *CommonTlsContext) XXX_Unmarshal(b []byte) error {
	return xxx_messageInfo_CommonTlsContext.Unmarshal(m, b)
}
func (m *CommonTlsContext) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
	return xxx_messageInfo_CommonTlsContext.Marshal(b, m, deterministic)
}
func (m *CommonTlsContext) XXX_Merge(src proto.Message) {
	xxx_messageInfo_CommonTlsContext.Merge(m, src)
}
func (m *CommonTlsContext) XXX_Size() int {
	return xxx_messageInfo_CommonTlsContext.Size(m)
}
func (m *CommonTlsContext) XXX_DiscardUnknown() {
	xxx_messageInfo_CommonTlsContext.DiscardUnknown(m)
}

var xxx_messageInfo_CommonTlsContext proto.InternalMessageInfo

func (m *CommonTlsContext) GetTlsParams() *TlsParameters {
	if m != nil {
		return m.TlsParams
	}
	return nil
}

func (m *CommonTlsContext) GetTlsCertificates() []*TlsCertificate {
	if m != nil {
		return m.TlsCertificates
	}
	return nil
}

func (m *CommonTlsContext) GetTlsCertificateSdsSecretConfigs() []*SdsSecretConfig {
	if m != nil {
		return m.TlsCertificateSdsSecretConfigs
	}
	return nil
}

type isCommonTlsContext_ValidationContextType interface {
	isCommonTlsContext_ValidationContextType()
}

type CommonTlsContext_ValidationContext struct {
	ValidationContext *CertificateValidationContext `protobuf:"bytes,3,opt,name=validation_context,json=validationContext,proto3,oneof"`
}

type CommonTlsContext_ValidationContextSdsSecretConfig struct {
	ValidationContextSdsSecretConfig *SdsSecretConfig `protobuf:"bytes,7,opt,name=validation_context_sds_secret_config,json=validationContextSdsSecretConfig,proto3,oneof"`
}

type CommonTlsContext_CombinedValidationContext struct {
	CombinedValidationContext *CommonTlsContext_CombinedCertificateValidationContext `protobuf:"bytes,8,opt,name=combined_validation_context,json=combinedValidationContext,proto3,oneof"`
}

func (*CommonTlsContext_ValidationContext) isCommonTlsContext_ValidationContextType() {}

func (*CommonTlsContext_ValidationContextSdsSecretConfig) isCommonTlsContext_ValidationContextType() {}

func (*CommonTlsContext_CombinedValidationContext) isCommonTlsContext_ValidationContextType() {}

func (m *CommonTlsContext) GetValidationContextType() isCommonTlsContext_ValidationContextType {
	if m != nil {
		return m.ValidationContextType
	}
	return nil
}

func (m *CommonTlsContext) GetValidationContext() *CertificateValidationContext {
	if x, ok := m.GetValidationContextType().(*CommonTlsContext_ValidationContext); ok {
		return x.ValidationContext
	}
	return nil
}

func (m *CommonTlsContext) GetValidationContextSdsSecretConfig() *SdsSecretConfig {
	if x, ok := m.GetValidationContextType().(*CommonTlsContext_ValidationContextSdsSecretConfig); ok {
		return x.ValidationContextSdsSecretConfig
	}
	return nil
}

func (m *CommonTlsContext) GetCombinedValidationContext() *CommonTlsContext_CombinedCertificateValidationContext {
	if x, ok := m.GetValidationContextType().(*CommonTlsContext_CombinedValidationContext); ok {
		return x.CombinedValidationContext
	}
	return nil
}

func (m *CommonTlsContext) GetAlpnProtocols() []string {
	if m != nil {
		return m.AlpnProtocols
	}
	return nil
}

// XXX_OneofWrappers is for the internal use of the proto package.
func (*CommonTlsContext) XXX_OneofWrappers() []interface{} {
	return []interface{}{
		(*CommonTlsContext_ValidationContext)(nil),
		(*CommonTlsContext_ValidationContextSdsSecretConfig)(nil),
		(*CommonTlsContext_CombinedValidationContext)(nil),
	}
}

type CommonTlsContext_CombinedCertificateValidationContext struct {
	// How to validate peer certificates.
	DefaultValidationContext *CertificateValidationContext `protobuf:"bytes,1,opt,name=default_validation_context,json=defaultValidationContext,proto3" json:"default_validation_context,omitempty"`
	// Config for fetching validation context via SDS API.
	ValidationContextSdsSecretConfig *SdsSecretConfig `protobuf:"bytes,2,opt,name=validation_context_sds_secret_config,json=validationContextSdsSecretConfig,proto3" json:"validation_context_sds_secret_config,omitempty"`
	XXX_NoUnkeyedLiteral             struct{}         `json:"-"`
	XXX_unrecognized                 []byte           `json:"-"`
	XXX_sizecache                    int32            `json:"-"`
}

func (m *CommonTlsContext_CombinedCertificateValidationContext) Reset() {
	*m = CommonTlsContext_CombinedCertificateValidationContext{}
}
func (m *CommonTlsContext_CombinedCertificateValidationContext) String() string {
	return proto.CompactTextString(m)
}
func (*CommonTlsContext_CombinedCertificateValidationContext) ProtoMessage() {}
func (*CommonTlsContext_CombinedCertificateValidationContext) Descriptor() ([]byte, []int) {
	return fileDescriptor_0c3851c0865b2745, []int{5, 0}
}

func (m *CommonTlsContext_CombinedCertificateValidationContext) XXX_Unmarshal(b []byte) error {
	return xxx_messageInfo_CommonTlsContext_CombinedCertificateValidationContext.Unmarshal(m, b)
}
func (m *CommonTlsContext_CombinedCertificateValidationContext) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
	return xxx_messageInfo_CommonTlsContext_CombinedCertificateValidationContext.Marshal(b, m, deterministic)
}
func (m *CommonTlsContext_CombinedCertificateValidationContext) XXX_Merge(src proto.Message) {
	xxx_messageInfo_CommonTlsContext_CombinedCertificateValidationContext.Merge(m, src)
}
func (m *CommonTlsContext_CombinedCertificateValidationContext) XXX_Size() int {
	return xxx_messageInfo_CommonTlsContext_CombinedCertificateValidationContext.Size(m)
}
func (m *CommonTlsContext_CombinedCertificateValidationContext) XXX_DiscardUnknown() {
	xxx_messageInfo_CommonTlsContext_CombinedCertificateValidationContext.DiscardUnknown(m)
}

var xxx_messageInfo_CommonTlsContext_CombinedCertificateValidationContext proto.InternalMessageInfo

func (m *CommonTlsContext_CombinedCertificateValidationContext) GetDefaultValidationContext() *CertificateValidationContext {
	if m != nil {
		return m.DefaultValidationContext
	}
	return nil
}

func (m *CommonTlsContext_CombinedCertificateValidationContext) GetValidationContextSdsSecretConfig() *SdsSecretConfig {
	if m != nil {
		return m.ValidationContextSdsSecretConfig
	}
	return nil
}

type UpstreamTlsContext struct {
	// Common TLS context settings.
	//
	// .. attention::
	//
	//   Server certificate verification is not enabled by default. Configure
	//   :ref:`trusted_ca<envoy_api_field_auth.CertificateValidationContext.trusted_ca>` to enable
	//   verification.
	CommonTlsContext *CommonTlsContext `protobuf:"bytes,1,opt,name=common_tls_context,json=commonTlsContext,proto3" json:"common_tls_context,omitempty"`
	// SNI string to use when creating TLS backend connections.
	Sni string `protobuf:"bytes,2,opt,name=sni,proto3" json:"sni,omitempty"`
	// If true, server-initiated TLS renegotiation will be allowed.
	//
	// .. attention::
	//
	//   TLS renegotiation is considered insecure and shouldn't be used unless absolutely necessary.
	AllowRenegotiation bool `protobuf:"varint,3,opt,name=allow_renegotiation,json=allowRenegotiation,proto3" json:"allow_renegotiation,omitempty"`
	// Maximum number of session keys (Pre-Shared Keys for TLSv1.3+, Session IDs and Session Tickets
	// for TLSv1.2 and older) to store for the purpose of session resumption.
	//
	// Defaults to 1, setting this to 0 disables session resumption.
	MaxSessionKeys       *types.UInt32Value `protobuf:"bytes,4,opt,name=max_session_keys,json=maxSessionKeys,proto3" json:"max_session_keys,omitempty"`
	XXX_NoUnkeyedLiteral struct{}           `json:"-"`
	XXX_unrecognized     []byte             `json:"-"`
	XXX_sizecache        int32              `json:"-"`
}

func (m *UpstreamTlsContext) Reset()         { *m = UpstreamTlsContext{} }
func (m *UpstreamTlsContext) String() string { return proto.CompactTextString(m) }
func (*UpstreamTlsContext) ProtoMessage()    {}
func (*UpstreamTlsContext) Descriptor() ([]byte, []int) {
	return fileDescriptor_0c3851c0865b2745, []int{6}
}

func (m *UpstreamTlsContext) XXX_Unmarshal(b []byte) error {
	return xxx_messageInfo_UpstreamTlsContext.Unmarshal(m, b)
}
func (m *UpstreamTlsContext) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
	return xxx_messageInfo_UpstreamTlsContext.Marshal(b, m, deterministic)
}
func (m *UpstreamTlsContext) XXX_Merge(src proto.Message) {
	xxx_messageInfo_UpstreamTlsContext.Merge(m, src)
}
func (m *UpstreamTlsContext) XXX_Size() int {
	return xxx_messageInfo_UpstreamTlsContext.Size(m)
}
func (m *UpstreamTlsContext) XXX_DiscardUnknown() {
	xxx_messageInfo_UpstreamTlsContext.DiscardUnknown(m)
}

var xxx_messageInfo_UpstreamTlsContext proto.InternalMessageInfo

func (m *UpstreamTlsContext) GetCommonTlsContext() *CommonTlsContext {
	if m != nil {
		return m.CommonTlsContext
	}
	return nil
}

func (m *UpstreamTlsContext) GetSni() string {
	if m != nil {
		return m.Sni
	}
	return ""
}

func (m *UpstreamTlsContext) GetAllowRenegotiation() bool {
	if m != nil {
		return m.AllowRenegotiation
	}
	return false
}

func (m *UpstreamTlsContext) GetMaxSessionKeys() *types.UInt32Value {
	if m != nil {
		return m.MaxSessionKeys
	}
	return nil
}

// [#next-free-field: 6]
type DownstreamTlsContext struct {
	// Common TLS context settings.
	CommonTlsContext *CommonTlsContext `protobuf:"bytes,1,opt,name=common_tls_context,json=commonTlsContext,proto3" json:"common_tls_context,omitempty"`
	// If specified, Envoy will reject connections without a valid client
	// certificate.
	RequireClientCertificate *types.BoolValue `protobuf:"bytes,2,opt,name=require_client_certificate,json=requireClientCertificate,proto3" json:"require_client_certificate,omitempty"`
	// If specified, Envoy will reject connections without a valid and matching SNI.
	// [#not-implemented-hide:]
	RequireSni *types.BoolValue `protobuf:"bytes,3,opt,name=require_sni,json=requireSni,proto3" json:"require_sni,omitempty"`
	// Types that are valid to be assigned to SessionTicketKeysType:
	//	*DownstreamTlsContext_SessionTicketKeys
	//	*DownstreamTlsContext_SessionTicketKeysSdsSecretConfig
	SessionTicketKeysType isDownstreamTlsContext_SessionTicketKeysType `protobuf_oneof:"session_ticket_keys_type"`
	XXX_NoUnkeyedLiteral  struct{}                                     `json:"-"`
	XXX_unrecognized      []byte                                       `json:"-"`
	XXX_sizecache         int32                                        `json:"-"`
}

func (m *DownstreamTlsContext) Reset()         { *m = DownstreamTlsContext{} }
func (m *DownstreamTlsContext) String() string { return proto.CompactTextString(m) }
func (*DownstreamTlsContext) ProtoMessage()    {}
func (*DownstreamTlsContext) Descriptor() ([]byte, []int) {
	return fileDescriptor_0c3851c0865b2745, []int{7}
}

func (m *DownstreamTlsContext) XXX_Unmarshal(b []byte) error {
	return xxx_messageInfo_DownstreamTlsContext.Unmarshal(m, b)
}
func (m *DownstreamTlsContext) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
	return xxx_messageInfo_DownstreamTlsContext.Marshal(b, m, deterministic)
}
func (m *DownstreamTlsContext) XXX_Merge(src proto.Message) {
	xxx_messageInfo_DownstreamTlsContext.Merge(m, src)
}
func (m *DownstreamTlsContext) XXX_Size() int {
	return xxx_messageInfo_DownstreamTlsContext.Size(m)
}
func (m *DownstreamTlsContext) XXX_DiscardUnknown() {
	xxx_messageInfo_DownstreamTlsContext.DiscardUnknown(m)
}

var xxx_messageInfo_DownstreamTlsContext proto.InternalMessageInfo

func (m *DownstreamTlsContext) GetCommonTlsContext() *CommonTlsContext {
	if m != nil {
		return m.CommonTlsContext
	}
	return nil
}

func (m *DownstreamTlsContext) GetRequireClientCertificate() *types.BoolValue {
	if m != nil {
		return m.RequireClientCertificate
	}
	return nil
}

func (m *DownstreamTlsContext) GetRequireSni() *types.BoolValue {
	if m != nil {
		return m.RequireSni
	}
	return nil
}

type isDownstreamTlsContext_SessionTicketKeysType interface {
	isDownstreamTlsContext_SessionTicketKeysType()
}

type DownstreamTlsContext_SessionTicketKeys struct {
	SessionTicketKeys *TlsSessionTicketKeys `protobuf:"bytes,4,opt,name=session_ticket_keys,json=sessionTicketKeys,proto3,oneof"`
}

type DownstreamTlsContext_SessionTicketKeysSdsSecretConfig struct {
	SessionTicketKeysSdsSecretConfig *SdsSecretConfig `protobuf:"bytes,5,opt,name=session_ticket_keys_sds_secret_config,json=sessionTicketKeysSdsSecretConfig,proto3,oneof"`
}

func (*DownstreamTlsContext_SessionTicketKeys) isDownstreamTlsContext_SessionTicketKeysType() {}

func (*DownstreamTlsContext_SessionTicketKeysSdsSecretConfig) isDownstreamTlsContext_SessionTicketKeysType() {
}

func (m *DownstreamTlsContext) GetSessionTicketKeysType() isDownstreamTlsContext_SessionTicketKeysType {
	if m != nil {
		return m.SessionTicketKeysType
	}
	return nil
}

func (m *DownstreamTlsContext) GetSessionTicketKeys() *TlsSessionTicketKeys {
	if x, ok := m.GetSessionTicketKeysType().(*DownstreamTlsContext_SessionTicketKeys); ok {
		return x.SessionTicketKeys
	}
	return nil
}

func (m *DownstreamTlsContext) GetSessionTicketKeysSdsSecretConfig() *SdsSecretConfig {
	if x, ok := m.GetSessionTicketKeysType().(*DownstreamTlsContext_SessionTicketKeysSdsSecretConfig); ok {
		return x.SessionTicketKeysSdsSecretConfig
	}
	return nil
}

// XXX_OneofWrappers is for the internal use of the proto package.
func (*DownstreamTlsContext) XXX_OneofWrappers() []interface{} {
	return []interface{}{
		(*DownstreamTlsContext_SessionTicketKeys)(nil),
		(*DownstreamTlsContext_SessionTicketKeysSdsSecretConfig)(nil),
	}
}

type SdsSecretConfig struct {
	// Name (FQDN, UUID, SPKI, SHA256, etc.) by which the secret can be uniquely referred to.
	// When both name and config are specified, then secret can be fetched and/or reloaded via SDS.
	// When only name is specified, then secret will be loaded from static
	// resources.
	Name                 string             `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	SdsConfig            *core.ConfigSource `protobuf:"bytes,2,opt,name=sds_config,json=sdsConfig,proto3" json:"sds_config,omitempty"`
	XXX_NoUnkeyedLiteral struct{}           `json:"-"`
	XXX_unrecognized     []byte             `json:"-"`
	XXX_sizecache        int32              `json:"-"`
}

func (m *SdsSecretConfig) Reset()         { *m = SdsSecretConfig{} }
func (m *SdsSecretConfig) String() string { return proto.CompactTextString(m) }
func (*SdsSecretConfig) ProtoMessage()    {}
func (*SdsSecretConfig) Descriptor() ([]byte, []int) {
	return fileDescriptor_0c3851c0865b2745, []int{8}
}

func (m *SdsSecretConfig) XXX_Unmarshal(b []byte) error {
	return xxx_messageInfo_SdsSecretConfig.Unmarshal(m, b)
}
func (m *SdsSecretConfig) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
	return xxx_messageInfo_SdsSecretConfig.Marshal(b, m, deterministic)
}
func (m *SdsSecretConfig) XXX_Merge(src proto.Message) {
	xxx_messageInfo_SdsSecretConfig.Merge(m, src)
}
func (m *SdsSecretConfig) XXX_Size() int {
	return xxx_messageInfo_SdsSecretConfig.Size(m)
}
func (m *SdsSecretConfig) XXX_DiscardUnknown() {
	xxx_messageInfo_SdsSecretConfig.DiscardUnknown(m)
}

var xxx_messageInfo_SdsSecretConfig proto.InternalMessageInfo

func (m *SdsSecretConfig) GetName() string {
	if m != nil {
		return m.Name
	}
	return ""
}

func (m *SdsSecretConfig) GetSdsConfig() *core.ConfigSource {
	if m != nil {
		return m.SdsConfig
	}
	return nil
}

type Secret struct {
	// Name (FQDN, UUID, SPKI, SHA256, etc.) by which the secret can be uniquely referred to.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Types that are valid to be assigned to Type:
	//	*Secret_TlsCertificate
	//	*Secret_SessionTicketKeys
	//	*Secret_ValidationContext
	Type                 isSecret_Type `protobuf_oneof:"type"`
	XXX_NoUnkeyedLiteral struct{}      `json:"-"`
	XXX_unrecognized     []byte        `json:"-"`
	XXX_sizecache        int32         `json:"-"`
}

func (m *Secret) Reset()         { *m = Secret{} }
func (m *Secret) String() string { return proto.CompactTextString(m) }
func (*Secret) ProtoMessage()    {}
func (*Secret) Descriptor() ([]byte, []int) {
	return fileDescriptor_0c3851c0865b2745, []int{9}
}

func (m *Secret) XXX_Unmarshal(b []byte) error {
	return xxx_messageInfo_Secret.Unmarshal(m, b)
}
func (m *Secret) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
	return xxx_messageInfo_Secret.Marshal(b, m, deterministic)
}
func (m *Secret) XXX_Merge(src proto.Message) {
	xxx_messageInfo_Secret.Merge(m, src)
}
func (m *Secret) XXX_Size() int {
	return xxx_messageInfo_Secret.Size(m)
}
func (m *Secret) XXX_DiscardUnknown() {
	xxx_messageInfo_Secret.DiscardUnknown(m)
}

var xxx_messageInfo_Secret proto.InternalMessageInfo

func (m *Secret) GetName() string {
	if m != nil {
		return m.Name
	}
	return ""
}

type isSecret_Type interface {
	isSecret_Type()
}

type Secret_TlsCertificate struct {
	TlsCertificate *TlsCertificate `protobuf:"bytes,2,opt,name=tls_certificate,json=tlsCertificate,proto3,oneof"`
}

type Secret_SessionTicketKeys struct {
	SessionTicketKeys *TlsSessionTicketKeys `protobuf:"bytes,3,opt,name=session_ticket_keys,json=sessionTicketKeys,proto3,oneof"`
}

type Secret_ValidationContext struct {
	ValidationContext *CertificateValidationContext `protobuf:"bytes,4,opt,name=validation_context,json=validationContext,proto3,oneof"`
}

func (*Secret_TlsCertificate) isSecret_Type() {}

func (*Secret_SessionTicketKeys) isSecret_Type() {}

func (*Secret_ValidationContext) isSecret_Type() {}

func (m *Secret) GetType() isSecret_Type {
	if m != nil {
		return m.Type
	}
	return nil
}

func (m *Secret) GetTlsCertificate() *TlsCertificate {
	if x, ok := m.GetType().(*Secret_TlsCertificate); ok {
		return x.TlsCertificate
	}
	return nil
}

func (m *Secret) GetSessionTicketKeys() *TlsSessionTicketKeys {
	if x, ok := m.GetType().(*Secret_SessionTicketKeys); ok {
		return x.SessionTicketKeys
	}
	return nil
}

func (m *Secret) GetValidationContext() *CertificateValidationContext {
	if x, ok := m.GetType().(*Secret_ValidationContext); ok {
		return x.ValidationContext
	}
	return nil
}

// XXX_OneofWrappers is for the internal use of the proto package.
func (*Secret) XXX_OneofWrappers() []interface{} {
	return []interface{}{
		(*Secret_TlsCertificate)(nil),
		(*Secret_SessionTicketKeys)(nil),
		(*Secret_ValidationContext)(nil),
	}
}

func init() {
	proto.RegisterEnum("envoy.api.v2.auth.TlsParameters_TlsProtocol", TlsParameters_TlsProtocol_name, TlsParameters_TlsProtocol_value)
	proto.RegisterType((*TlsParameters)(nil), "envoy.api.v2.auth.TlsParameters")
	proto.RegisterType((*PrivateKeyProvider)(nil), "envoy.api.v2.auth.PrivateKeyProvider")
	proto.RegisterType((*TlsCertificate)(nil), "envoy.api.v2.auth.TlsCertificate")
	proto.RegisterType((*TlsSessionTicketKeys)(nil), "envoy.api.v2.auth.TlsSessionTicketKeys")
	proto.RegisterType((*CertificateValidationContext)(nil), "envoy.api.v2.auth.CertificateValidationContext")
	proto.RegisterType((*CommonTlsContext)(nil), "envoy.api.v2.auth.CommonTlsContext")
	proto.RegisterType((*CommonTlsContext_CombinedCertificateValidationContext)(nil), "envoy.api.v2.auth.CommonTlsContext.CombinedCertificateValidationContext")
	proto.RegisterType((*UpstreamTlsContext)(nil), "envoy.api.v2.auth.UpstreamTlsContext")
	proto.RegisterType((*DownstreamTlsContext)(nil), "envoy.api.v2.auth.DownstreamTlsContext")
	proto.RegisterType((*SdsSecretConfig)(nil), "envoy.api.v2.auth.SdsSecretConfig")
	proto.RegisterType((*Secret)(nil), "envoy.api.v2.auth.Secret")
}

func init() { proto.RegisterFile("envoy/api/v2/auth/cert.proto", fileDescriptor_0c3851c0865b2745) }

var fileDescriptor_0c3851c0865b2745 = []byte{
	// 1415 bytes of a gzipped FileDescriptorProto
	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xbc, 0x57, 0xcd, 0x72, 0x1b, 0x45,
	0x10, 0xf6, 0x4a, 0xb2, 0x2c, 0xb7, 0x6c, 0x47, 0x9e, 0x98, 0xf2, 0x5a, 0x98, 0x44, 0x51, 0xe2,
	0xc2, 0x07, 0x97, 0x44, 0x94, 0xe2, 0x10, 0x42, 0x05, 0x22, 0x85, 0x94, 0x48, 0x0c, 0x31, 0x2b,
	0x25, 0xc0, 0x69, 0x19, 0xaf, 0xc6, 0xd6, 0xe0, 0xfd, 0x63, 0x66, 0x24, 0x4b, 0x55, 0x9c, 0x38,
	0xe6, 0x98, 0x13, 0x17, 0x9e, 0x81, 0x47, 0xe0, 0xcc, 0x91, 0xb7, 0xe0, 0xc4, 0x03, 0xa4, 0xa8,
	0x82, 0xda, 0x99, 0x5d, 0x79, 0xa5, 0xdd, 0x58, 0x02, 0x52, 0xdc, 0xb4, 0xd3, 0xdd, 0x5f, 0x4f,
	0x77, 0x7f, 0xdd, 0x3d, 0x82, 0x5d, 0xe2, 0x0e, 0xbd, 0x71, 0x1d, 0xfb, 0xb4, 0x3e, 0x6c, 0xd4,
	0xf1, 0x40, 0xf4, 0xeb, 0x16, 0x61, 0xa2, 0xe6, 0x33, 0x4f, 0x78, 0x68, 0x53, 0x4a, 0x6b, 0xd8,
	0xa7, 0xb5, 0x61, 0xa3, 0x16, 0x48, 0xcb, 0xd3, 0x06, 0x96, 0xc7, 0x48, 0xfd, 0x18, 0x73, 0xa2,
	0x0c, 0xca, 0x7b, 0x49, 0xa9, 0xe5, 0xb9, 0x27, 0xf4, 0xd4, 0xe4, 0xde, 0x80, 0x59, 0x91, 0xda,
	0xce, 0xa9, 0xe7, 0x9d, 0xda, 0xa4, 0x2e, 0xbf, 0x8e, 0x07, 0x27, 0x75, 0xec, 0x8e, 0x43, 0xd1,
	0xee, 0xac, 0x88, 0x0b, 0x36, 0xb0, 0xc2, 0x0b, 0x95, 0xaf, 0xcd, 0x4a, 0xcf, 0x19, 0xf6, 0x7d,
	0xc2, 0x78, 0x28, 0xdf, 0x1e, 0x62, 0x9b, 0xf6, 0xb0, 0x20, 0xf5, 0xe8, 0x87, 0x12, 0x54, 0x7f,
	0xcc, 0xc2, 0x7a, 0xd7, 0xe6, 0x47, 0x98, 0x61, 0x87, 0x08, 0xc2, 0x38, 0x3a, 0x87, 0x5d, 0x61,
	0x73, 0xd3, 0xa1, 0x2e, 0x75, 0x06, 0x8e, 0x29, 0xd5, 0x2c, 0xcf, 0x36, 0x87, 0x84, 0x71, 0xea,
	0xb9, 0xba, 0x56, 0xd1, 0xf6, 0x37, 0x1a, 0x07, 0xb5, 0x44, 0x0a, 0x6a, 0x53, 0x38, 0xf2, 0x2b,
	0xb4, 0x6d, 0x16, 0x5e, 0x35, 0x97, 0x7f, 0xd0, 0x32, 0x25, 0xcd, 0xd8, 0x11, 0x36, 0xff, 0x4c,
	0x41, 0x47, 0xd2, 0xe7, 0x0a, 0x78, 0xe2, 0x18, 0x8f, 0xd2, 0x1d, 0x67, 0xfe, 0xbb, 0x63, 0x05,
	0x3d, 0xeb, 0xf8, 0x26, 0xac, 0x5b, 0xd4, 0xef, 0x13, 0x66, 0xf2, 0x01, 0x15, 0x84, 0xeb, 0xd9,
	0x4a, 0x76, 0x7f, 0xd5, 0x58, 0x53, 0x87, 0x1d, 0x79, 0x86, 0xae, 0x43, 0x91, 0x58, 0xbd, 0xbe,
	0x69, 0x0d, 0xd8, 0x90, 0x70, 0x3d, 0x27, 0x55, 0x20, 0x38, 0x6a, 0xc9, 0x93, 0xea, 0x53, 0x28,
	0xc6, 0x3c, 0xa3, 0x35, 0x28, 0x74, 0x0f, 0x3b, 0xe6, 0x83, 0x67, 0xdd, 0xa7, 0xa5, 0x25, 0x54,
	0x84, 0x95, 0xee, 0x61, 0x67, 0x78, 0xdb, 0x7c, 0xaf, 0xa4, 0x5d, 0x7c, 0xdc, 0x2e, 0x65, 0x2e,
	0x3e, 0x1a, 0xa5, 0xec, 0xc5, 0xc7, 0x9d, 0x52, 0xae, 0xfa, 0x8b, 0x06, 0xe8, 0x88, 0xd1, 0x21,
	0x16, 0xe4, 0x09, 0x19, 0x1f, 0x31, 0x6f, 0x48, 0x7b, 0x84, 0xa1, 0x03, 0x58, 0xf7, 0xc3, 0xdf,
	0xa6, 0x8b, 0x1d, 0x22, 0x0b, 0xb2, 0xda, 0x5c, 0x79, 0xd5, 0xcc, 0xb1, 0x4c, 0x45, 0x33, 0xd6,
	0x22, 0xe9, 0xe7, 0xd8, 0x21, 0xe8, 0x36, 0xe4, 0x15, 0xd1, 0x64, 0xfa, 0x8a, 0x8d, 0xed, 0x9a,
	0x62, 0x4a, 0x2d, 0x62, 0x4a, 0xad, 0x23, 0x79, 0xd4, 0x5e, 0x32, 0x42, 0x45, 0x74, 0x17, 0xd6,
	0xc4, 0xd8, 0x27, 0x3d, 0x33, 0x34, 0xcc, 0x4a, 0xc3, 0xad, 0x84, 0xe1, 0x03, 0x77, 0xdc, 0x5e,
	0x32, 0x8a, 0x52, 0xb7, 0x25, 0x55, 0x9b, 0xeb, 0x50, 0x0c, 0x69, 0x1d, 0x9c, 0x56, 0x7f, 0xcb,
	0xc2, 0x46, 0xd7, 0xe6, 0x2d, 0xc2, 0x04, 0x3d, 0xa1, 0x16, 0x16, 0x04, 0x3d, 0x86, 0x4d, 0xeb,
	0xe2, 0xd3, 0xb4, 0xfa, 0x98, 0x2a, 0x4a, 0x15, 0x1b, 0xef, 0x4c, 0x57, 0x36, 0x68, 0x92, 0xda,
	0x43, 0x2c, 0x70, 0x47, 0x76, 0x88, 0x51, 0x8a, 0xd9, 0xb5, 0x02, 0x33, 0x74, 0x1f, 0x8a, 0xbe,
	0xca, 0x8f, 0x79, 0x46, 0xc6, 0x61, 0x80, 0x73, 0x50, 0xc0, 0x9f, 0x64, 0x14, 0x7d, 0x09, 0x5b,
	0x31, 0x7b, 0x33, 0xca, 0x9b, 0x9e, 0x97, 0x40, 0x7b, 0x29, 0x44, 0x4b, 0x96, 0xc3, 0x40, 0x7e,
	0xb2, 0x44, 0x77, 0xa1, 0xe0, 0x63, 0xce, 0xcf, 0x3d, 0xd6, 0x0b, 0xb3, 0x37, 0xe7, 0x56, 0x13,
	0xf5, 0x20, 0x26, 0xcf, 0xe2, 0xbe, 0xc9, 0x05, 0xf6, 0x6d, 0xa2, 0xe7, 0x16, 0x8a, 0x29, 0xb0,
	0xe8, 0x48, 0x03, 0x64, 0xc2, 0x2e, 0xa7, 0xa7, 0x6e, 0x50, 0xbd, 0x58, 0x9a, 0x05, 0x75, 0x08,
	0x17, 0xd8, 0xf1, 0xf5, 0xe5, 0x4a, 0x76, 0x3e, 0x60, 0x59, 0x41, 0xc4, 0xea, 0xd6, 0x8d, 0x00,
	0xaa, 0x1d, 0xd8, 0xea, 0xda, 0xbc, 0x43, 0x78, 0xd0, 0x3a, 0x5d, 0x6a, 0x9d, 0x11, 0xf1, 0x84,
	0x8c, 0x39, 0xba, 0x07, 0xb9, 0x33, 0x32, 0xe6, 0xba, 0xb6, 0x80, 0x03, 0xd9, 0x96, 0x2f, 0xb5,
	0x4c, 0x41, 0x33, 0xa4, 0x51, 0xf5, 0xd7, 0x1c, 0xec, 0xc6, 0xbc, 0x3d, 0x57, 0x33, 0x8a, 0x7a,
	0x6e, 0xcb, 0x73, 0x05, 0x19, 0x09, 0xf4, 0x21, 0x80, 0x60, 0x03, 0x2e, 0x82, 0xb8, 0xf0, 0x62,
	0x7c, 0x59, 0x0d, 0x0d, 0x5a, 0x18, 0x3d, 0x82, 0xed, 0x21, 0x61, 0xf4, 0x64, 0x3c, 0x95, 0x14,
	0xee, 0x9f, 0x51, 0xd5, 0xea, 0xcd, 0x8d, 0x57, 0xcd, 0xe2, 0x4b, 0xad, 0x50, 0xcd, 0xb3, 0x5c,
	0xe5, 0x60, 0xff, 0xc0, 0x78, 0x4b, 0xa9, 0xc7, 0xae, 0xd4, 0xf1, 0xcf, 0xe8, 0x6b, 0x70, 0xfa,
	0x98, 0xf7, 0xf5, 0x4c, 0x02, 0xe7, 0xe3, 0x7d, 0x33, 0x05, 0xa7, 0x8d, 0x79, 0x1f, 0xbd, 0x3f,
	0xc1, 0xe1, 0x83, 0xe3, 0x6f, 0x89, 0x25, 0x4c, 0x6c, 0x0b, 0xd5, 0xcc, 0x6a, 0xae, 0x6c, 0x29,
	0x71, 0x47, 0x49, 0x1f, 0xd8, 0x42, 0xf6, 0xf2, 0x63, 0xb8, 0xca, 0xc8, 0x77, 0x03, 0xca, 0x88,
	0x19, 0xe7, 0xc8, 0xb2, 0xcc, 0x46, 0x39, 0xd1, 0x9f, 0x4d, 0xcf, 0xb3, 0x9f, 0x63, 0x7b, 0x40,
	0x8c, 0xcd, 0xd0, 0xec, 0xe9, 0x05, 0x4f, 0xce, 0xe0, 0x56, 0x84, 0x75, 0x29, 0x5f, 0xf2, 0x73,
	0xc1, 0x6f, 0x84, 0x38, 0x9d, 0xd7, 0x72, 0x06, 0xd5, 0x21, 0x6b, 0x31, 0x5b, 0x5f, 0x59, 0xa4,
	0x6c, 0x81, 0x26, 0xfa, 0x00, 0x76, 0xb0, 0x6d, 0x7b, 0xe7, 0x26, 0x19, 0xf9, 0x94, 0x4d, 0x5f,
	0x4e, 0x2f, 0x54, 0xb4, 0xfd, 0x82, 0xb1, 0x2d, 0x15, 0x3e, 0x51, 0xf2, 0x98, 0xd7, 0xea, 0xef,
	0x2b, 0x50, 0x6a, 0x79, 0x8e, 0xe3, 0xb9, 0xc1, 0xe8, 0x09, 0xf9, 0xf3, 0x11, 0x40, 0xb0, 0x5b,
	0xfc, 0x60, 0x4b, 0xf0, 0x90, 0x3f, 0x95, 0x79, 0x9b, 0xc4, 0x58, 0x15, 0xe1, 0x27, 0x47, 0x87,
	0x50, 0x0a, 0x00, 0x62, 0xf7, 0xe0, 0xb2, 0xe6, 0xc5, 0xc6, 0x8d, 0x74, 0x98, 0xd8, 0x95, 0x8c,
	0x2b, 0x62, 0xea, 0x9b, 0xa3, 0x11, 0x54, 0x67, 0xd0, 0x4c, 0xde, 0xe3, 0x26, 0x27, 0x16, 0x23,
	0x22, 0x9c, 0xbb, 0x5c, 0xcf, 0x4b, 0xfc, 0x6a, 0x0a, 0x7e, 0xa7, 0xc7, 0x3b, 0x52, 0x37, 0x9c,
	0xbb, 0x61, 0x3f, 0x95, 0x34, 0xe3, 0xda, 0xb4, 0xab, 0x19, 0x45, 0x8e, 0xbe, 0x01, 0x34, 0x9c,
	0x74, 0x57, 0xe0, 0x29, 0x48, 0x4f, 0x38, 0xa4, 0xea, 0x29, 0x9e, 0x2e, 0xeb, 0xca, 0xf6, 0x92,
	0xb1, 0x39, 0x4c, 0xb4, 0xaa, 0x80, 0x5b, 0x49, 0x0f, 0xc9, 0xf0, 0x42, 0x36, 0x2c, 0x10, 0x5d,
	0x7b, 0xc9, 0xa8, 0x24, 0xdc, 0xcc, 0xe8, 0xa0, 0x17, 0x1a, 0xbc, 0x6d, 0x79, 0xce, 0x31, 0x0d,
	0xa8, 0x9c, 0x12, 0x61, 0x41, 0x7a, 0x6b, 0xa7, 0x45, 0x38, 0xc3, 0x95, 0xe0, 0x40, 0xc2, 0xcc,
	0x09, 0x7d, 0x27, 0x72, 0x97, 0x9c, 0x56, 0x7b, 0xb0, 0x81, 0x6d, 0xdf, 0x9d, 0x3c, 0x61, 0xa2,
	0xe7, 0xc2, 0x7a, 0x70, 0x1a, 0xbd, 0x10, 0x78, 0xf9, 0xa7, 0x0c, 0xdc, 0x5a, 0xc4, 0x19, 0x3a,
	0x87, 0x72, 0x8f, 0x9c, 0xe0, 0x81, 0x2d, 0xd2, 0x42, 0xd3, 0xfe, 0x55, 0xf1, 0x24, 0x67, 0x5e,
	0x48, 0xce, 0xe8, 0x21, 0x78, 0xd2, 0xf1, 0xf7, 0x0b, 0xd6, 0x32, 0xb3, 0x68, 0x2d, 0x63, 0x5e,
	0xe7, 0xd6, 0xb4, 0xb9, 0x03, 0xdb, 0x29, 0xde, 0x83, 0x97, 0xc5, 0xe3, 0x5c, 0x61, 0xb9, 0x94,
	0xaf, 0xfe, 0xa9, 0x01, 0x7a, 0xe6, 0x73, 0xc1, 0x08, 0x76, 0x62, 0xcd, 0xfe, 0x05, 0x20, 0x4b,
	0x16, 0xd5, 0x94, 0x4d, 0x36, 0x95, 0xa6, 0x9b, 0x0b, 0x30, 0xc0, 0x28, 0x59, 0xb3, 0xf3, 0xa3,
	0x0c, 0x59, 0xee, 0x52, 0x19, 0xe7, 0xaa, 0x8c, 0x81, 0x65, 0xf7, 0xff, 0xd2, 0x8c, 0xe0, 0x10,
	0xd5, 0xe1, 0xaa, 0x1a, 0x56, 0x8c, 0xb8, 0xe4, 0xd4, 0x13, 0x54, 0xde, 0x57, 0xf6, 0x54, 0xc1,
	0x40, 0x52, 0x64, 0xc4, 0x25, 0xe8, 0x11, 0x94, 0x1c, 0x3c, 0x32, 0xb9, 0xda, 0xa1, 0xa6, 0x5c,
	0x9b, 0x6a, 0xd1, 0xef, 0x26, 0xe6, 0xec, 0xb3, 0x4f, 0x5d, 0x71, 0xa7, 0xa1, 0x26, 0xed, 0x86,
	0x83, 0x47, 0xe1, 0xe2, 0x0d, 0x56, 0x6e, 0xf5, 0x8f, 0x2c, 0x6c, 0x3d, 0xf4, 0xce, 0xdd, 0xff,
	0x23, 0x01, 0x5f, 0x41, 0x39, 0xda, 0x17, 0x96, 0x4d, 0x89, 0x2b, 0xa6, 0x46, 0x72, 0x66, 0xee,
	0x96, 0xd0, 0x43, 0xeb, 0x96, 0x34, 0x8e, 0xbf, 0x08, 0xef, 0x41, 0x71, 0xb2, 0x89, 0x5c, 0x1a,
	0x8e, 0xa2, 0xcb, 0xa0, 0x20, 0x5a, 0x38, 0x2e, 0x45, 0x5f, 0xc3, 0xd5, 0x28, 0x8d, 0x42, 0xbe,
	0x45, 0xe2, 0xd9, 0x7c, 0x37, 0x7d, 0x32, 0x27, 0xde, 0x2e, 0xc1, 0x1c, 0xe3, 0x89, 0x07, 0xcd,
	0x00, 0xf6, 0x52, 0xa0, 0x53, 0xc8, 0xbf, 0xfc, 0x4f, 0x06, 0x59, 0xc2, 0xcf, 0x2c, 0xe9, 0xcb,
	0xa0, 0xa7, 0xb9, 0x95, 0xef, 0x69, 0x02, 0x57, 0x66, 0xe7, 0x1e, 0x82, 0xdc, 0xc5, 0x9f, 0x00,
	0x43, 0xfe, 0x46, 0xf7, 0x01, 0x82, 0x5b, 0x4e, 0xf5, 0xe6, 0xf5, 0x94, 0xad, 0xab, 0x20, 0xa2,
	0xe7, 0x12, 0xef, 0x71, 0x75, 0x50, 0xfd, 0x39, 0x03, 0x79, 0xe5, 0x24, 0x15, 0xfe, 0x10, 0xae,
	0xcc, 0x2c, 0xaf, 0xd0, 0xc7, 0xfc, 0x4d, 0xd8, 0x5e, 0x32, 0x36, 0xa6, 0x17, 0xd4, 0xeb, 0x2a,
	0x98, 0x7d, 0x03, 0x15, 0x4c, 0xdf, 0x75, 0xb9, 0x37, 0xb7, 0xeb, 0x9a, 0x79, 0xc8, 0x05, 0x85,
	0x69, 0xd6, 0xe0, 0x3a, 0xf5, 0x14, 0xa2, 0xcf, 0xbc, 0xd1, 0x38, 0x09, 0xde, 0x5c, 0x0d, 0xd0,
	0xe5, 0xec, 0x3f, 0xd2, 0x8e, 0xf3, 0x92, 0xd6, 0x77, 0xfe, 0x0e, 0x00, 0x00, 0xff, 0xff, 0xb1,
	0x53, 0xd7, 0x7e, 0x66, 0x10, 0x00, 0x00,
}