// Copyright 2023 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

// Generated by the C++ microgenerator.
// If you make any local changes, they will be lost.
// file:///workspace/generator/discovery/compute_public_google_rest_v1.json
// revision: 20231110

syntax = "proto3";

package google.cloud.cpp.compute.v1;

// Represents a rule that describes one or more match conditions along with the
// action to be taken when traffic matches this condition (allow or deny).
message FirewallPolicyRule {
  // The Action to perform when the client connection triggers the rule. Valid
  // actions are "allow", "deny" and "goto_next".
  optional string action = 1 [json_name = "action"];

  // An optional description for this resource.
  optional string description = 2 [json_name = "description"];

  // The direction in which this rule applies.
  // EGRESS:
  // INGRESS:
  optional string direction = 3 [json_name = "direction"];

  // Denotes whether the firewall policy rule is disabled. When set to true, the
  // firewall policy rule is not enforced and traffic behaves as if it did not
  // exist. If this is unspecified, the firewall policy rule will be enabled.
  optional bool disabled = 4 [json_name = "disabled"];

  // Denotes whether to enable logging for a particular rule. If logging is
  // enabled, logs will be exported to the configured export destination in
  // Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot
  // enable logging on "goto_next" rules.
  optional bool enable_logging = 5 [json_name = "enableLogging"];

  // [Output only] Type of the resource. Always compute#firewallPolicyRule for
  // firewall policy rules
  optional string kind = 6 [json_name = "kind"];

  // A match condition that incoming traffic is evaluated against. If it
  // evaluates to true, the corresponding 'action' is enforced.
  optional FirewallPolicyRuleMatcher match = 7 [json_name = "match"];

  // An integer indicating the priority of a rule in the list. The priority must
  // be a positive value between 0 and 2147483647. Rules are evaluated from
  // highest to lowest priority where 0 is the highest priority and 2147483647
  // is the lowest prority.
  optional int32 priority = 8 [json_name = "priority"];

  // An optional name for the rule. This field is not a unique identifier and
  // can be updated.
  optional string rule_name = 9 [json_name = "ruleName"];

  // [Output Only] Calculation of the complexity of a single firewall policy
  // rule.
  optional int32 rule_tuple_count = 10 [json_name = "ruleTupleCount"];

  // A list of network resource URLs to which this rule applies. This field
  // allows you to control which network's VMs get this rule. If this field is
  // left blank, all VMs within the organization will receive the rule.
  repeated string target_resources = 11 [json_name = "targetResources"];

  // A list of secure tags that controls which instances the firewall rule
  // applies to. If targetSecureTag are specified, then the firewall rule
  // applies only to instances in the VPC network that have one of those
  // EFFECTIVE secure tags, if all the target_secure_tag are in INEFFECTIVE
  // state, then this rule will be ignored. targetSecureTag may not be set at
  // the same time as targetServiceAccounts. If neither targetServiceAccounts
  // nor targetSecureTag are specified, the firewall rule applies to all
  // instances on the specified network. Maximum number of target label tags
  // allowed is 256.
  repeated FirewallPolicyRuleSecureTag target_secure_tags = 12
      [json_name = "targetSecureTags"];

  // A list of service accounts indicating the sets of instances that are
  // applied with this rule.
  repeated string target_service_accounts = 13
      [json_name = "targetServiceAccounts"];
}

// Represents a match condition that incoming traffic is evaluated against.
// Exactly one field must be specified.
message FirewallPolicyRuleMatcher {
  // Address groups which should be matched against the traffic destination.
  // Maximum number of destination address groups is 10.
  repeated string dest_address_groups = 5 [json_name = "destAddressGroups"];

  // Fully Qualified Domain Name (FQDN) which should be matched against traffic
  // destination. Maximum number of destination fqdn allowed is 100.
  repeated string dest_fqdns = 6 [json_name = "destFqdns"];

  // CIDR IP address range. Maximum number of destination CIDR IP ranges allowed
  // is 5000.
  repeated string dest_ip_ranges = 1 [json_name = "destIpRanges"];

  // Region codes whose IP addresses will be used to match for destination of
  // traffic. Should be specified as 2 letter country code defined as per ISO
  // 3166 alpha-2 country codes. ex."US" Maximum number of dest region codes
  // allowed is 5000.
  repeated string dest_region_codes = 7 [json_name = "destRegionCodes"];

  // Names of Network Threat Intelligence lists. The IPs in these lists will be
  // matched against traffic destination.
  repeated string dest_threat_intelligences = 8
      [json_name = "destThreatIntelligences"];

  // Pairs of IP protocols and ports that the rule should match.
  repeated FirewallPolicyRuleMatcherLayer4Config layer4_configs = 2
      [json_name = "layer4Configs"];

  // Address groups which should be matched against the traffic source. Maximum
  // number of source address groups is 10.
  repeated string src_address_groups = 9 [json_name = "srcAddressGroups"];

  // Fully Qualified Domain Name (FQDN) which should be matched against traffic
  // source. Maximum number of source fqdn allowed is 100.
  repeated string src_fqdns = 10 [json_name = "srcFqdns"];

  // CIDR IP address range. Maximum number of source CIDR IP ranges allowed is
  // 5000.
  repeated string src_ip_ranges = 3 [json_name = "srcIpRanges"];

  // Region codes whose IP addresses will be used to match for source of
  // traffic. Should be specified as 2 letter country code defined as per ISO
  // 3166 alpha-2 country codes. ex."US" Maximum number of source region codes
  // allowed is 5000.
  repeated string src_region_codes = 11 [json_name = "srcRegionCodes"];

  // List of secure tag values, which should be matched at the source of the
  // traffic. For INGRESS rule, if all the srcSecureTag are INEFFECTIVE, and
  // there is no srcIpRange, this rule will be ignored. Maximum number of source
  // tag values allowed is 256.
  repeated FirewallPolicyRuleSecureTag src_secure_tags = 4
      [json_name = "srcSecureTags"];

  // Names of Network Threat Intelligence lists. The IPs in these lists will be
  // matched against traffic source.
  repeated string src_threat_intelligences = 12
      [json_name = "srcThreatIntelligences"];
}

message FirewallPolicyRuleMatcherLayer4Config {
  // The IP protocol to which this rule applies. The protocol type is required
  // when creating a firewall rule. This value can either be one of the
  // following well known protocol strings (tcp, udp, icmp, esp, ah, ipip,
  // sctp), or the IP protocol number.
  optional string ip_protocol = 1 [json_name = "ipProtocol"];

  // An optional list of ports to which this rule applies. This field is only
  // applicable for UDP or TCP protocol. Each entry must be either an integer or
  // a range. If not specified, this rule applies to connections through any
  // port. Example inputs include: ["22"], ["80","443"], and ["12345-12349"].
  repeated string ports = 2 [json_name = "ports"];
}

message FirewallPolicyRuleSecureTag {
  // Name of the secure tag, created with TagManager's TagValue API.
  optional string name = 1 [json_name = "name"];

  // [Output Only] State of the secure tag, either `EFFECTIVE` or `INEFFECTIVE`.
  // A secure tag is `INEFFECTIVE` when it is deleted or its network is deleted.
  // EFFECTIVE:
  // INEFFECTIVE:
  optional string state = 2 [json_name = "state"];
}
