// Code generated by protoc-gen-go. DO NOT EDIT.
// versions:
// 	protoc-gen-go v1.36.10
// 	protoc        v7.35.1
// source: envoy/extensions/transport_sockets/tls/v3/tls.proto

package tlsv3

import (
	_ "github.com/cncf/xds/go/udpa/annotations"
	_ "github.com/envoyproxy/go-control-plane/envoy/annotations"
	v3 "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
	_ "github.com/envoyproxy/protoc-gen-validate/validate"
	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
	durationpb "google.golang.org/protobuf/types/known/durationpb"
	wrapperspb "google.golang.org/protobuf/types/known/wrapperspb"
	reflect "reflect"
	sync "sync"
	unsafe "unsafe"
)

const (
	// Verify that this generated code is sufficiently up-to-date.
	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
	// Verify that runtime/protoimpl is sufficiently up-to-date.
	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
)

type DownstreamTlsContext_OcspStaplePolicy int32

const (
	// OCSP responses are optional. If absent or expired, the certificate is used without stapling.
	DownstreamTlsContext_LENIENT_STAPLING DownstreamTlsContext_OcspStaplePolicy = 0
	// OCSP responses are optional. If absent, the certificate is used without stapling. If present but expired,
	// the certificate is not used for subsequent connections. Connections are rejected if no suitable certificate
	// is found.
	DownstreamTlsContext_STRICT_STAPLING DownstreamTlsContext_OcspStaplePolicy = 1
	// OCSP responses are required. Connections fail if a certificate lacks a valid OCSP response. Expired responses
	// prevent certificate use in new connections, and connections are rejected if no suitable certificate is available.
	DownstreamTlsContext_MUST_STAPLE DownstreamTlsContext_OcspStaplePolicy = 2
)

// Enum value maps for DownstreamTlsContext_OcspStaplePolicy.
var (
	DownstreamTlsContext_OcspStaplePolicy_name = map[int32]string{
		0: "LENIENT_STAPLING",
		1: "STRICT_STAPLING",
		2: "MUST_STAPLE",
	}
	DownstreamTlsContext_OcspStaplePolicy_value = map[string]int32{
		"LENIENT_STAPLING": 0,
		"STRICT_STAPLING":  1,
		"MUST_STAPLE":      2,
	}
)

func (x DownstreamTlsContext_OcspStaplePolicy) Enum() *DownstreamTlsContext_OcspStaplePolicy {
	p := new(DownstreamTlsContext_OcspStaplePolicy)
	*p = x
	return p
}

func (x DownstreamTlsContext_OcspStaplePolicy) String() string {
	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
}

func (DownstreamTlsContext_OcspStaplePolicy) Descriptor() protoreflect.EnumDescriptor {
	return file_envoy_extensions_transport_sockets_tls_v3_tls_proto_enumTypes[0].Descriptor()
}

func (DownstreamTlsContext_OcspStaplePolicy) Type() protoreflect.EnumType {
	return &file_envoy_extensions_transport_sockets_tls_v3_tls_proto_enumTypes[0]
}

func (x DownstreamTlsContext_OcspStaplePolicy) Number() protoreflect.EnumNumber {
	return protoreflect.EnumNumber(x)
}

// Deprecated: Use DownstreamTlsContext_OcspStaplePolicy.Descriptor instead.
func (DownstreamTlsContext_OcspStaplePolicy) EnumDescriptor() ([]byte, []int) {
	return file_envoy_extensions_transport_sockets_tls_v3_tls_proto_rawDescGZIP(), []int{1, 0}
}

// [#next-free-field: 8]
type UpstreamTlsContext struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Common TLS context settings.
	//
	// .. attention::
	//
	//	Server certificate verification is not enabled by default. To enable verification, configure
	//	:ref:`trusted_ca<envoy_v3_api_field_extensions.transport_sockets.tls.v3.CertificateValidationContext.trusted_ca>`.
	CommonTlsContext *CommonTlsContext `protobuf:"bytes,1,opt,name=common_tls_context,json=commonTlsContext,proto3" json:"common_tls_context,omitempty"`
	// SNI string to use when creating TLS backend connections.
	Sni string `protobuf:"bytes,2,opt,name=sni,proto3" json:"sni,omitempty"`
	// If true, replaces the SNI for the connection with the hostname of the upstream host, if
	// the hostname is known due to either a DNS cluster type or the
	// :ref:`hostname <envoy_v3_api_field_config.endpoint.v3.Endpoint.hostname>` is set on
	// the host.
	//
	// See :ref:`SNI configuration <start_quick_start_securing_sni_client>` for details on how this
	// interacts with other validation options.
	AutoHostSni bool `protobuf:"varint,6,opt,name=auto_host_sni,json=autoHostSni,proto3" json:"auto_host_sni,omitempty"`
	// If true, replaces any Subject Alternative Name (SAN) validations with a validation for a DNS SAN matching
	// the SNI value sent. The validation uses the actual requested SNI, regardless of how the SNI is configured.
	//
	// For common cases where an SNI value is present and the server certificate should include a corresponding SAN,
	// this option ensures the SAN is properly validated.
	//
	// See the :ref:`validation configuration <start_quick_start_securing_validation>` for how this interacts with
	// other validation options.
	AutoSniSanValidation bool `protobuf:"varint,7,opt,name=auto_sni_san_validation,json=autoSniSanValidation,proto3" json:"auto_sni_san_validation,omitempty"`
	// If true, server-initiated TLS renegotiation will be allowed.
	//
	// .. attention::
	//
	//	TLS renegotiation is considered insecure and shouldn't be used unless absolutely necessary.
	AllowRenegotiation bool `protobuf:"varint,3,opt,name=allow_renegotiation,json=allowRenegotiation,proto3" json:"allow_renegotiation,omitempty"`
	// Maximum number of session keys (Pre-Shared Keys for TLSv1.3+, Session IDs and Session Tickets
	// for TLSv1.2 and older) to be stored for session resumption.
	//
	// Defaults to 1, setting this to 0 disables session resumption.
	MaxSessionKeys *wrapperspb.UInt32Value `protobuf:"bytes,4,opt,name=max_session_keys,json=maxSessionKeys,proto3" json:"max_session_keys,omitempty"`
	// Controls enforcement of the “keyUsage“ extension in peer certificates. If set to “true“,
	// the handshake will fail if the “keyUsage“ is incompatible with TLS usage.
	//
	// .. attention::
	//
	//	This field is deprecated and ignored. Envoy now always enforces the ``keyUsage`` extension
	//	in peer certificates, making this option unconfigurable.
	//
	// Deprecated: Marked as deprecated in envoy/extensions/transport_sockets/tls/v3/tls.proto.
	EnforceRsaKeyUsage *wrapperspb.BoolValue `protobuf:"bytes,5,opt,name=enforce_rsa_key_usage,json=enforceRsaKeyUsage,proto3" json:"enforce_rsa_key_usage,omitempty"`
	unknownFields      protoimpl.UnknownFields
	sizeCache          protoimpl.SizeCache
}

func (x *UpstreamTlsContext) Reset() {
	*x = UpstreamTlsContext{}
	mi := &file_envoy_extensions_transport_sockets_tls_v3_tls_proto_msgTypes[0]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *UpstreamTlsContext) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*UpstreamTlsContext) ProtoMessage() {}

func (x *UpstreamTlsContext) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_extensions_transport_sockets_tls_v3_tls_proto_msgTypes[0]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use UpstreamTlsContext.ProtoReflect.Descriptor instead.
func (*UpstreamTlsContext) Descriptor() ([]byte, []int) {
	return file_envoy_extensions_transport_sockets_tls_v3_tls_proto_rawDescGZIP(), []int{0}
}

func (x *UpstreamTlsContext) GetCommonTlsContext() *CommonTlsContext {
	if x != nil {
		return x.CommonTlsContext
	}
	return nil
}

func (x *UpstreamTlsContext) GetSni() string {
	if x != nil {
		return x.Sni
	}
	return ""
}

func (x *UpstreamTlsContext) GetAutoHostSni() bool {
	if x != nil {
		return x.AutoHostSni
	}
	return false
}

func (x *UpstreamTlsContext) GetAutoSniSanValidation() bool {
	if x != nil {
		return x.AutoSniSanValidation
	}
	return false
}

func (x *UpstreamTlsContext) GetAllowRenegotiation() bool {
	if x != nil {
		return x.AllowRenegotiation
	}
	return false
}

func (x *UpstreamTlsContext) GetMaxSessionKeys() *wrapperspb.UInt32Value {
	if x != nil {
		return x.MaxSessionKeys
	}
	return nil
}

// Deprecated: Marked as deprecated in envoy/extensions/transport_sockets/tls/v3/tls.proto.
func (x *UpstreamTlsContext) GetEnforceRsaKeyUsage() *wrapperspb.BoolValue {
	if x != nil {
		return x.EnforceRsaKeyUsage
	}
	return nil
}

// [#next-free-field: 12]
type DownstreamTlsContext struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Common TLS context settings.
	CommonTlsContext *CommonTlsContext `protobuf:"bytes,1,opt,name=common_tls_context,json=commonTlsContext,proto3" json:"common_tls_context,omitempty"`
	// If specified, Envoy will reject connections without a valid client
	// certificate.
	RequireClientCertificate *wrapperspb.BoolValue `protobuf:"bytes,2,opt,name=require_client_certificate,json=requireClientCertificate,proto3" json:"require_client_certificate,omitempty"`
	// If specified, Envoy will reject connections without a valid and matching SNI.
	// [#not-implemented-hide:]
	RequireSni *wrapperspb.BoolValue `protobuf:"bytes,3,opt,name=require_sni,json=requireSni,proto3" json:"require_sni,omitempty"`
	// Types that are valid to be assigned to SessionTicketKeysType:
	//
	//	*DownstreamTlsContext_SessionTicketKeys
	//	*DownstreamTlsContext_SessionTicketKeysSdsSecretConfig
	//	*DownstreamTlsContext_DisableStatelessSessionResumption
	SessionTicketKeysType isDownstreamTlsContext_SessionTicketKeysType `protobuf_oneof:"session_ticket_keys_type"`
	// If “true“, the TLS server will not maintain a session cache of TLS sessions.
	//
	// .. note::
	//
	//	This applies only to TLSv1.2 and earlier.
	DisableStatefulSessionResumption bool `protobuf:"varint,10,opt,name=disable_stateful_session_resumption,json=disableStatefulSessionResumption,proto3" json:"disable_stateful_session_resumption,omitempty"`
	// Maximum lifetime of TLS sessions. If specified, “session_timeout“ will change the maximum lifetime
	// of the TLS session.
	//
	// This serves as a hint for the `TLS session ticket lifetime (for TLSv1.2) <https://tools.ietf.org/html/rfc5077#section-5.6>`_.
	// Only whole seconds are considered; fractional seconds are ignored.
	SessionTimeout *durationpb.Duration `protobuf:"bytes,6,opt,name=session_timeout,json=sessionTimeout,proto3" json:"session_timeout,omitempty"`
	// Configuration for handling certificates without an OCSP response or with expired responses.
	//
	// Defaults to “LENIENT_STAPLING“
	OcspStaplePolicy DownstreamTlsContext_OcspStaplePolicy `protobuf:"varint,8,opt,name=ocsp_staple_policy,json=ocspStaplePolicy,proto3,enum=envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext_OcspStaplePolicy" json:"ocsp_staple_policy,omitempty"`
	// Multiple certificates are allowed in Downstream transport socket to serve different SNI.
	// This option controls the behavior when no matching certificate is found for the received SNI value,
	// or no SNI value was sent. If enabled, all certificates will be evaluated for a match for non-SNI criteria
	// such as key type and OCSP settings. If disabled, the first provided certificate will be used.
	// Defaults to “false“. See more details in :ref:`Multiple TLS certificates <arch_overview_ssl_cert_select>`.
	FullScanCertsOnSniMismatch *wrapperspb.BoolValue `protobuf:"bytes,9,opt,name=full_scan_certs_on_sni_mismatch,json=fullScanCertsOnSniMismatch,proto3" json:"full_scan_certs_on_sni_mismatch,omitempty"`
	// If “true“, the downstream client's preferred cipher is used during the handshake. If “false“, Envoy
	// uses its preferred cipher.
	//
	// .. note::
	//
	//	This has no effect when using TLSv1_3.
	PreferClientCiphers bool `protobuf:"varint,11,opt,name=prefer_client_ciphers,json=preferClientCiphers,proto3" json:"prefer_client_ciphers,omitempty"`
	unknownFields       protoimpl.UnknownFields
	sizeCache           protoimpl.SizeCache
}

func (x *DownstreamTlsContext) Reset() {
	*x = DownstreamTlsContext{}
	mi := &file_envoy_extensions_transport_sockets_tls_v3_tls_proto_msgTypes[1]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *DownstreamTlsContext) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*DownstreamTlsContext) ProtoMessage() {}

func (x *DownstreamTlsContext) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_extensions_transport_sockets_tls_v3_tls_proto_msgTypes[1]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use DownstreamTlsContext.ProtoReflect.Descriptor instead.
func (*DownstreamTlsContext) Descriptor() ([]byte, []int) {
	return file_envoy_extensions_transport_sockets_tls_v3_tls_proto_rawDescGZIP(), []int{1}
}

func (x *DownstreamTlsContext) GetCommonTlsContext() *CommonTlsContext {
	if x != nil {
		return x.CommonTlsContext
	}
	return nil
}

func (x *DownstreamTlsContext) GetRequireClientCertificate() *wrapperspb.BoolValue {
	if x != nil {
		return x.RequireClientCertificate
	}
	return nil
}

func (x *DownstreamTlsContext) GetRequireSni() *wrapperspb.BoolValue {
	if x != nil {
		return x.RequireSni
	}
	return nil
}

func (x *DownstreamTlsContext) GetSessionTicketKeysType() isDownstreamTlsContext_SessionTicketKeysType {
	if x != nil {
		return x.SessionTicketKeysType
	}
	return nil
}

func (x *DownstreamTlsContext) GetSessionTicketKeys() *TlsSessionTicketKeys {
	if x != nil {
		if x, ok := x.SessionTicketKeysType.(*DownstreamTlsContext_SessionTicketKeys); ok {
			return x.SessionTicketKeys
		}
	}
	return nil
}

func (x *DownstreamTlsContext) GetSessionTicketKeysSdsSecretConfig() *SdsSecretConfig {
	if x != nil {
		if x, ok := x.SessionTicketKeysType.(*DownstreamTlsContext_SessionTicketKeysSdsSecretConfig); ok {
			return x.SessionTicketKeysSdsSecretConfig
		}
	}
	return nil
}

func (x *DownstreamTlsContext) GetDisableStatelessSessionResumption() bool {
	if x != nil {
		if x, ok := x.SessionTicketKeysType.(*DownstreamTlsContext_DisableStatelessSessionResumption); ok {
			return x.DisableStatelessSessionResumption
		}
	}
	return false
}

func (x *DownstreamTlsContext) GetDisableStatefulSessionResumption() bool {
	if x != nil {
		return x.DisableStatefulSessionResumption
	}
	return false
}

func (x *DownstreamTlsContext) GetSessionTimeout() *durationpb.Duration {
	if x != nil {
		return x.SessionTimeout
	}
	return nil
}

func (x *DownstreamTlsContext) GetOcspStaplePolicy() DownstreamTlsContext_OcspStaplePolicy {
	if x != nil {
		return x.OcspStaplePolicy
	}
	return DownstreamTlsContext_LENIENT_STAPLING
}

func (x *DownstreamTlsContext) GetFullScanCertsOnSniMismatch() *wrapperspb.BoolValue {
	if x != nil {
		return x.FullScanCertsOnSniMismatch
	}
	return nil
}

func (x *DownstreamTlsContext) GetPreferClientCiphers() bool {
	if x != nil {
		return x.PreferClientCiphers
	}
	return false
}

type isDownstreamTlsContext_SessionTicketKeysType interface {
	isDownstreamTlsContext_SessionTicketKeysType()
}

type DownstreamTlsContext_SessionTicketKeys struct {
	// TLS session ticket key settings.
	SessionTicketKeys *TlsSessionTicketKeys `protobuf:"bytes,4,opt,name=session_ticket_keys,json=sessionTicketKeys,proto3,oneof"`
}

type DownstreamTlsContext_SessionTicketKeysSdsSecretConfig struct {
	// Config for fetching TLS session ticket keys via SDS API.
	SessionTicketKeysSdsSecretConfig *SdsSecretConfig `protobuf:"bytes,5,opt,name=session_ticket_keys_sds_secret_config,json=sessionTicketKeysSdsSecretConfig,proto3,oneof"`
}

type DownstreamTlsContext_DisableStatelessSessionResumption struct {
	// Config for controlling stateless TLS session resumption: setting this to true will cause the TLS
	// server to not issue TLS session tickets for the purposes of stateless TLS session resumption.
	// If set to false, the TLS server will issue TLS session tickets and encrypt/decrypt them using
	// the keys specified through either :ref:`session_ticket_keys <envoy_v3_api_field_extensions.transport_sockets.tls.v3.DownstreamTlsContext.session_ticket_keys>`
	// or :ref:`session_ticket_keys_sds_secret_config <envoy_v3_api_field_extensions.transport_sockets.tls.v3.DownstreamTlsContext.session_ticket_keys_sds_secret_config>`.
	// If this config is set to false and no keys are explicitly configured, the TLS server will issue
	// TLS session tickets and encrypt/decrypt them using an internally-generated and managed key, with the
	// implication that sessions cannot be resumed across hot restarts or on different hosts.
	DisableStatelessSessionResumption bool `protobuf:"varint,7,opt,name=disable_stateless_session_resumption,json=disableStatelessSessionResumption,proto3,oneof"`
}

func (*DownstreamTlsContext_SessionTicketKeys) isDownstreamTlsContext_SessionTicketKeysType() {}

func (*DownstreamTlsContext_SessionTicketKeysSdsSecretConfig) isDownstreamTlsContext_SessionTicketKeysType() {
}

func (*DownstreamTlsContext_DisableStatelessSessionResumption) isDownstreamTlsContext_SessionTicketKeysType() {
}

// TLS key log configuration.
// The key log file format is "format used by NSS for its SSLKEYLOGFILE debugging output" (text taken from openssl man page)
type TlsKeyLog struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Path to save the TLS key log.
	Path string `protobuf:"bytes,1,opt,name=path,proto3" json:"path,omitempty"`
	// Local IP address ranges to filter connections for TLS key logging. If not set, matches any local IP address.
	LocalAddressRange []*v3.CidrRange `protobuf:"bytes,2,rep,name=local_address_range,json=localAddressRange,proto3" json:"local_address_range,omitempty"`
	// Remote IP address ranges to filter connections for TLS key logging. If not set, matches any remote IP address.
	RemoteAddressRange []*v3.CidrRange `protobuf:"bytes,3,rep,name=remote_address_range,json=remoteAddressRange,proto3" json:"remote_address_range,omitempty"`
	unknownFields      protoimpl.UnknownFields
	sizeCache          protoimpl.SizeCache
}

func (x *TlsKeyLog) Reset() {
	*x = TlsKeyLog{}
	mi := &file_envoy_extensions_transport_sockets_tls_v3_tls_proto_msgTypes[2]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *TlsKeyLog) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*TlsKeyLog) ProtoMessage() {}

func (x *TlsKeyLog) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_extensions_transport_sockets_tls_v3_tls_proto_msgTypes[2]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use TlsKeyLog.ProtoReflect.Descriptor instead.
func (*TlsKeyLog) Descriptor() ([]byte, []int) {
	return file_envoy_extensions_transport_sockets_tls_v3_tls_proto_rawDescGZIP(), []int{2}
}

func (x *TlsKeyLog) GetPath() string {
	if x != nil {
		return x.Path
	}
	return ""
}

func (x *TlsKeyLog) GetLocalAddressRange() []*v3.CidrRange {
	if x != nil {
		return x.LocalAddressRange
	}
	return nil
}

func (x *TlsKeyLog) GetRemoteAddressRange() []*v3.CidrRange {
	if x != nil {
		return x.RemoteAddressRange
	}
	return nil
}

// TLS context shared by both client and server TLS contexts.
// [#next-free-field: 17]
type CommonTlsContext struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// TLS protocol versions, cipher suites etc.
	TlsParams *TlsParameters `protobuf:"bytes,1,opt,name=tls_params,json=tlsParams,proto3" json:"tls_params,omitempty"`
	// Only a single TLS certificate is supported in client contexts. In server contexts,
	// :ref:`Multiple TLS certificates <arch_overview_ssl_cert_select>` can be associated with the
	// same context to allow both RSA and ECDSA certificates and support SNI-based selection.
	//
	// If “tls_certificate_provider_instance“ is set, this field is ignored.
	// If this field is set, “tls_certificate_sds_secret_configs“ is ignored.
	TlsCertificates []*TlsCertificate `protobuf:"bytes,2,rep,name=tls_certificates,json=tlsCertificates,proto3" json:"tls_certificates,omitempty"`
	// Configs for fetching TLS certificates via SDS API. Note SDS API allows certificates to be
	// fetched/refreshed over the network asynchronously with respect to the TLS handshake.
	//
	// The same number and types of certificates as :ref:`tls_certificates <envoy_v3_api_field_extensions.transport_sockets.tls.v3.CommonTlsContext.tls_certificates>`
	// are valid in the certificates fetched through this setting.
	//
	// If “tls_certificates“ or “tls_certificate_provider_instance“ are set, this field
	// is ignored.
	TlsCertificateSdsSecretConfigs []*SdsSecretConfig `protobuf:"bytes,6,rep,name=tls_certificate_sds_secret_configs,json=tlsCertificateSdsSecretConfigs,proto3" json:"tls_certificate_sds_secret_configs,omitempty"`
	// Certificate provider instance for fetching TLS certs.
	//
	// If this field is set, “tls_certificates“ and “tls_certificate_provider_instance“
	// are ignored.
	// [#not-implemented-hide:]
	TlsCertificateProviderInstance *CertificateProviderPluginInstance `protobuf:"bytes,14,opt,name=tls_certificate_provider_instance,json=tlsCertificateProviderInstance,proto3" json:"tls_certificate_provider_instance,omitempty"`
	// Custom TLS certificate selector.
	//
	// For the downstream TLS socket, select a TLS certificate based on TLS client hello. If empty,
	// defaults to native TLS certificate selection behavior: DNS SANs or Subject Common Name in TLS
	// certificates is extracted as server name pattern to match SNI.
	//
	// For the upstream TLS socket, select a TLS certificate based on TLS server hello and the
	// transport socket options.
	// [#extension-category: envoy.tls.certificate_selectors,envoy.tls.upstream_certificate_selectors]
	CustomTlsCertificateSelector *v3.TypedExtensionConfig `protobuf:"bytes,16,opt,name=custom_tls_certificate_selector,json=customTlsCertificateSelector,proto3" json:"custom_tls_certificate_selector,omitempty"`
	// Certificate provider for fetching TLS certificates.
	// [#not-implemented-hide:]
	//
	// Deprecated: Marked as deprecated in envoy/extensions/transport_sockets/tls/v3/tls.proto.
	TlsCertificateCertificateProvider *CommonTlsContext_CertificateProvider `protobuf:"bytes,9,opt,name=tls_certificate_certificate_provider,json=tlsCertificateCertificateProvider,proto3" json:"tls_certificate_certificate_provider,omitempty"`
	// Certificate provider instance for fetching TLS certificates.
	// [#not-implemented-hide:]
	//
	// Deprecated: Marked as deprecated in envoy/extensions/transport_sockets/tls/v3/tls.proto.
	TlsCertificateCertificateProviderInstance *CommonTlsContext_CertificateProviderInstance `protobuf:"bytes,11,opt,name=tls_certificate_certificate_provider_instance,json=tlsCertificateCertificateProviderInstance,proto3" json:"tls_certificate_certificate_provider_instance,omitempty"`
	// Types that are valid to be assigned to ValidationContextType:
	//
	//	*CommonTlsContext_ValidationContext
	//	*CommonTlsContext_ValidationContextSdsSecretConfig
	//	*CommonTlsContext_CombinedValidationContext
	//	*CommonTlsContext_ValidationContextCertificateProvider
	//	*CommonTlsContext_ValidationContextCertificateProviderInstance
	ValidationContextType isCommonTlsContext_ValidationContextType `protobuf_oneof:"validation_context_type"`
	// Supplies the list of ALPN protocols that the listener should expose. In
	// practice this is likely to be set to one of two values (see the
	// :ref:`codec_type
	// <envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.codec_type>`
	// parameter in the HTTP connection manager for more information):
	//
	// * "h2,http/1.1" If the listener is going to support both HTTP/2 and HTTP/1.1.
	// * "http/1.1" If the listener is only going to support HTTP/1.1.
	//
	// There is no default for this parameter. If empty, Envoy will not expose ALPN.
	AlpnProtocols []string `protobuf:"bytes,4,rep,name=alpn_protocols,json=alpnProtocols,proto3" json:"alpn_protocols,omitempty"`
	// Custom TLS handshaker. If empty, defaults to native TLS handshaking
	// behavior.
	CustomHandshaker *v3.TypedExtensionConfig `protobuf:"bytes,13,opt,name=custom_handshaker,json=customHandshaker,proto3" json:"custom_handshaker,omitempty"`
	// TLS key log configuration
	KeyLog        *TlsKeyLog `protobuf:"bytes,15,opt,name=key_log,json=keyLog,proto3" json:"key_log,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *CommonTlsContext) Reset() {
	*x = CommonTlsContext{}
	mi := &file_envoy_extensions_transport_sockets_tls_v3_tls_proto_msgTypes[3]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *CommonTlsContext) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*CommonTlsContext) ProtoMessage() {}

func (x *CommonTlsContext) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_extensions_transport_sockets_tls_v3_tls_proto_msgTypes[3]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use CommonTlsContext.ProtoReflect.Descriptor instead.
func (*CommonTlsContext) Descriptor() ([]byte, []int) {
	return file_envoy_extensions_transport_sockets_tls_v3_tls_proto_rawDescGZIP(), []int{3}
}

func (x *CommonTlsContext) GetTlsParams() *TlsParameters {
	if x != nil {
		return x.TlsParams
	}
	return nil
}

func (x *CommonTlsContext) GetTlsCertificates() []*TlsCertificate {
	if x != nil {
		return x.TlsCertificates
	}
	return nil
}

func (x *CommonTlsContext) GetTlsCertificateSdsSecretConfigs() []*SdsSecretConfig {
	if x != nil {
		return x.TlsCertificateSdsSecretConfigs
	}
	return nil
}

func (x *CommonTlsContext) GetTlsCertificateProviderInstance() *CertificateProviderPluginInstance {
	if x != nil {
		return x.TlsCertificateProviderInstance
	}
	return nil
}

func (x *CommonTlsContext) GetCustomTlsCertificateSelector() *v3.TypedExtensionConfig {
	if x != nil {
		return x.CustomTlsCertificateSelector
	}
	return nil
}

// Deprecated: Marked as deprecated in envoy/extensions/transport_sockets/tls/v3/tls.proto.
func (x *CommonTlsContext) GetTlsCertificateCertificateProvider() *CommonTlsContext_CertificateProvider {
	if x != nil {
		return x.TlsCertificateCertificateProvider
	}
	return nil
}

// Deprecated: Marked as deprecated in envoy/extensions/transport_sockets/tls/v3/tls.proto.
func (x *CommonTlsContext) GetTlsCertificateCertificateProviderInstance() *CommonTlsContext_CertificateProviderInstance {
	if x != nil {
		return x.TlsCertificateCertificateProviderInstance
	}
	return nil
}

func (x *CommonTlsContext) GetValidationContextType() isCommonTlsContext_ValidationContextType {
	if x != nil {
		return x.ValidationContextType
	}
	return nil
}

func (x *CommonTlsContext) GetValidationContext() *CertificateValidationContext {
	if x != nil {
		if x, ok := x.ValidationContextType.(*CommonTlsContext_ValidationContext); ok {
			return x.ValidationContext
		}
	}
	return nil
}

func (x *CommonTlsContext) GetValidationContextSdsSecretConfig() *SdsSecretConfig {
	if x != nil {
		if x, ok := x.ValidationContextType.(*CommonTlsContext_ValidationContextSdsSecretConfig); ok {
			return x.ValidationContextSdsSecretConfig
		}
	}
	return nil
}

func (x *CommonTlsContext) GetCombinedValidationContext() *CommonTlsContext_CombinedCertificateValidationContext {
	if x != nil {
		if x, ok := x.ValidationContextType.(*CommonTlsContext_CombinedValidationContext); ok {
			return x.CombinedValidationContext
		}
	}
	return nil
}

// Deprecated: Marked as deprecated in envoy/extensions/transport_sockets/tls/v3/tls.proto.
func (x *CommonTlsContext) GetValidationContextCertificateProvider() *CommonTlsContext_CertificateProvider {
	if x != nil {
		if x, ok := x.ValidationContextType.(*CommonTlsContext_ValidationContextCertificateProvider); ok {
			return x.ValidationContextCertificateProvider
		}
	}
	return nil
}

// Deprecated: Marked as deprecated in envoy/extensions/transport_sockets/tls/v3/tls.proto.
func (x *CommonTlsContext) GetValidationContextCertificateProviderInstance() *CommonTlsContext_CertificateProviderInstance {
	if x != nil {
		if x, ok := x.ValidationContextType.(*CommonTlsContext_ValidationContextCertificateProviderInstance); ok {
			return x.ValidationContextCertificateProviderInstance
		}
	}
	return nil
}

func (x *CommonTlsContext) GetAlpnProtocols() []string {
	if x != nil {
		return x.AlpnProtocols
	}
	return nil
}

func (x *CommonTlsContext) GetCustomHandshaker() *v3.TypedExtensionConfig {
	if x != nil {
		return x.CustomHandshaker
	}
	return nil
}

func (x *CommonTlsContext) GetKeyLog() *TlsKeyLog {
	if x != nil {
		return x.KeyLog
	}
	return nil
}

type isCommonTlsContext_ValidationContextType interface {
	isCommonTlsContext_ValidationContextType()
}

type CommonTlsContext_ValidationContext struct {
	// How to validate peer certificates.
	ValidationContext *CertificateValidationContext `protobuf:"bytes,3,opt,name=validation_context,json=validationContext,proto3,oneof"`
}

type CommonTlsContext_ValidationContextSdsSecretConfig struct {
	// Config for fetching validation context via SDS API. Note SDS API allows certificates to be
	// fetched/refreshed over the network asynchronously with respect to the TLS handshake.
	ValidationContextSdsSecretConfig *SdsSecretConfig `protobuf:"bytes,7,opt,name=validation_context_sds_secret_config,json=validationContextSdsSecretConfig,proto3,oneof"`
}

type CommonTlsContext_CombinedValidationContext struct {
	// Combines the default “CertificateValidationContext“ with the SDS-provided dynamic context for certificate
	// validation.
	//
	// When the SDS server returns a dynamic “CertificateValidationContext“, it is merged
	// with the default context using “Message::MergeFrom()“. The merging rules are as follows:
	//
	// * **Singular Fields:** Dynamic fields override the default singular fields.
	// * **Repeated Fields:** Dynamic repeated fields are concatenated with the default repeated fields.
	// * **Boolean Fields:** Boolean fields are combined using a logical OR operation.
	//
	// The resulting “CertificateValidationContext“ is used to perform certificate validation.
	CombinedValidationContext *CommonTlsContext_CombinedCertificateValidationContext `protobuf:"bytes,8,opt,name=combined_validation_context,json=combinedValidationContext,proto3,oneof"`
}

type CommonTlsContext_ValidationContextCertificateProvider struct {
	// Certificate provider for fetching validation context.
	// [#not-implemented-hide:]
	//
	// Deprecated: Marked as deprecated in envoy/extensions/transport_sockets/tls/v3/tls.proto.
	ValidationContextCertificateProvider *CommonTlsContext_CertificateProvider `protobuf:"bytes,10,opt,name=validation_context_certificate_provider,json=validationContextCertificateProvider,proto3,oneof"`
}

type CommonTlsContext_ValidationContextCertificateProviderInstance struct {
	// Certificate provider instance for fetching validation context.
	// [#not-implemented-hide:]
	//
	// Deprecated: Marked as deprecated in envoy/extensions/transport_sockets/tls/v3/tls.proto.
	ValidationContextCertificateProviderInstance *CommonTlsContext_CertificateProviderInstance `protobuf:"bytes,12,opt,name=validation_context_certificate_provider_instance,json=validationContextCertificateProviderInstance,proto3,oneof"`
}

func (*CommonTlsContext_ValidationContext) isCommonTlsContext_ValidationContextType() {}

func (*CommonTlsContext_ValidationContextSdsSecretConfig) isCommonTlsContext_ValidationContextType() {
}

func (*CommonTlsContext_CombinedValidationContext) isCommonTlsContext_ValidationContextType() {}

func (*CommonTlsContext_ValidationContextCertificateProvider) isCommonTlsContext_ValidationContextType() {
}

func (*CommonTlsContext_ValidationContextCertificateProviderInstance) isCommonTlsContext_ValidationContextType() {
}

// Config for the Certificate Provider to fetch certificates. Certificates are fetched/refreshed asynchronously over
// the network relative to the TLS handshake.
//
// DEPRECATED: This message is not currently used, but if we ever do need it, we will want to
// move it out of CommonTlsContext and into common.proto, similar to the existing
// CertificateProviderPluginInstance message.
//
// [#not-implemented-hide:]
type CommonTlsContext_CertificateProvider struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// opaque name used to specify certificate instances or types. For example, "ROOTCA" to specify
	// a root-certificate (validation context) or "TLS" to specify a new tls-certificate.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Provider specific config.
	// Note: an implementation is expected to dedup multiple instances of the same config
	// to maintain a single certificate-provider instance. The sharing can happen, for
	// example, among multiple clusters or between the tls_certificate and validation_context
	// certificate providers of a cluster.
	// This config could be supplied inline or (in future) a named xDS resource.
	//
	// Types that are valid to be assigned to Config:
	//
	//	*CommonTlsContext_CertificateProvider_TypedConfig
	Config        isCommonTlsContext_CertificateProvider_Config `protobuf_oneof:"config"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *CommonTlsContext_CertificateProvider) Reset() {
	*x = CommonTlsContext_CertificateProvider{}
	mi := &file_envoy_extensions_transport_sockets_tls_v3_tls_proto_msgTypes[4]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *CommonTlsContext_CertificateProvider) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*CommonTlsContext_CertificateProvider) ProtoMessage() {}

func (x *CommonTlsContext_CertificateProvider) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_extensions_transport_sockets_tls_v3_tls_proto_msgTypes[4]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use CommonTlsContext_CertificateProvider.ProtoReflect.Descriptor instead.
func (*CommonTlsContext_CertificateProvider) Descriptor() ([]byte, []int) {
	return file_envoy_extensions_transport_sockets_tls_v3_tls_proto_rawDescGZIP(), []int{3, 0}
}

func (x *CommonTlsContext_CertificateProvider) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

func (x *CommonTlsContext_CertificateProvider) GetConfig() isCommonTlsContext_CertificateProvider_Config {
	if x != nil {
		return x.Config
	}
	return nil
}

func (x *CommonTlsContext_CertificateProvider) GetTypedConfig() *v3.TypedExtensionConfig {
	if x != nil {
		if x, ok := x.Config.(*CommonTlsContext_CertificateProvider_TypedConfig); ok {
			return x.TypedConfig
		}
	}
	return nil
}

type isCommonTlsContext_CertificateProvider_Config interface {
	isCommonTlsContext_CertificateProvider_Config()
}

type CommonTlsContext_CertificateProvider_TypedConfig struct {
	TypedConfig *v3.TypedExtensionConfig `protobuf:"bytes,2,opt,name=typed_config,json=typedConfig,proto3,oneof"`
}

func (*CommonTlsContext_CertificateProvider_TypedConfig) isCommonTlsContext_CertificateProvider_Config() {
}

// Similar to CertificateProvider above, but allows the provider instances to be configured on
// the client side instead of being sent from the control plane.
//
// DEPRECATED: This message was moved outside of CommonTlsContext
// and now lives in common.proto.
//
// [#not-implemented-hide:]
type CommonTlsContext_CertificateProviderInstance struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Provider instance name. This name must be defined in the client's configuration (e.g., a
	// bootstrap file) to correspond to a provider instance (i.e., the same data in the typed_config
	// field that would be sent in the CertificateProvider message if the config was sent by the
	// control plane). If not present, defaults to "default".
	//
	// Instance names should generally be defined not in terms of the underlying provider
	// implementation (e.g., "file_watcher") but rather in terms of the function of the
	// certificates (e.g., "foo_deployment_identity").
	InstanceName string `protobuf:"bytes,1,opt,name=instance_name,json=instanceName,proto3" json:"instance_name,omitempty"`
	// Opaque name used to specify certificate instances or types. For example, "ROOTCA" to specify
	// a root-certificate (validation context) or "example.com" to specify a certificate for a
	// particular domain. Not all provider instances will actually use this field, so the value
	// defaults to the empty string.
	CertificateName string `protobuf:"bytes,2,opt,name=certificate_name,json=certificateName,proto3" json:"certificate_name,omitempty"`
	unknownFields   protoimpl.UnknownFields
	sizeCache       protoimpl.SizeCache
}

func (x *CommonTlsContext_CertificateProviderInstance) Reset() {
	*x = CommonTlsContext_CertificateProviderInstance{}
	mi := &file_envoy_extensions_transport_sockets_tls_v3_tls_proto_msgTypes[5]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *CommonTlsContext_CertificateProviderInstance) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*CommonTlsContext_CertificateProviderInstance) ProtoMessage() {}

func (x *CommonTlsContext_CertificateProviderInstance) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_extensions_transport_sockets_tls_v3_tls_proto_msgTypes[5]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use CommonTlsContext_CertificateProviderInstance.ProtoReflect.Descriptor instead.
func (*CommonTlsContext_CertificateProviderInstance) Descriptor() ([]byte, []int) {
	return file_envoy_extensions_transport_sockets_tls_v3_tls_proto_rawDescGZIP(), []int{3, 1}
}

func (x *CommonTlsContext_CertificateProviderInstance) GetInstanceName() string {
	if x != nil {
		return x.InstanceName
	}
	return ""
}

func (x *CommonTlsContext_CertificateProviderInstance) GetCertificateName() string {
	if x != nil {
		return x.CertificateName
	}
	return ""
}

type CommonTlsContext_CombinedCertificateValidationContext struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// How to validate peer certificates.
	DefaultValidationContext *CertificateValidationContext `protobuf:"bytes,1,opt,name=default_validation_context,json=defaultValidationContext,proto3" json:"default_validation_context,omitempty"`
	// Config for fetching validation context via SDS API. Note SDS API allows certificates to be
	// fetched/refreshed over the network asynchronously with respect to the TLS handshake.
	ValidationContextSdsSecretConfig *SdsSecretConfig `protobuf:"bytes,2,opt,name=validation_context_sds_secret_config,json=validationContextSdsSecretConfig,proto3" json:"validation_context_sds_secret_config,omitempty"`
	// Certificate provider for fetching CA certs. This will populate the
	// “default_validation_context.trusted_ca“ field.
	// [#not-implemented-hide:]
	//
	// Deprecated: Marked as deprecated in envoy/extensions/transport_sockets/tls/v3/tls.proto.
	ValidationContextCertificateProvider *CommonTlsContext_CertificateProvider `protobuf:"bytes,3,opt,name=validation_context_certificate_provider,json=validationContextCertificateProvider,proto3" json:"validation_context_certificate_provider,omitempty"`
	// Certificate provider instance for fetching CA certs. This will populate the
	// “default_validation_context.trusted_ca“ field.
	// [#not-implemented-hide:]
	//
	// Deprecated: Marked as deprecated in envoy/extensions/transport_sockets/tls/v3/tls.proto.
	ValidationContextCertificateProviderInstance *CommonTlsContext_CertificateProviderInstance `protobuf:"bytes,4,opt,name=validation_context_certificate_provider_instance,json=validationContextCertificateProviderInstance,proto3" json:"validation_context_certificate_provider_instance,omitempty"`
	unknownFields                                protoimpl.UnknownFields
	sizeCache                                    protoimpl.SizeCache
}

func (x *CommonTlsContext_CombinedCertificateValidationContext) Reset() {
	*x = CommonTlsContext_CombinedCertificateValidationContext{}
	mi := &file_envoy_extensions_transport_sockets_tls_v3_tls_proto_msgTypes[6]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *CommonTlsContext_CombinedCertificateValidationContext) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*CommonTlsContext_CombinedCertificateValidationContext) ProtoMessage() {}

func (x *CommonTlsContext_CombinedCertificateValidationContext) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_extensions_transport_sockets_tls_v3_tls_proto_msgTypes[6]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use CommonTlsContext_CombinedCertificateValidationContext.ProtoReflect.Descriptor instead.
func (*CommonTlsContext_CombinedCertificateValidationContext) Descriptor() ([]byte, []int) {
	return file_envoy_extensions_transport_sockets_tls_v3_tls_proto_rawDescGZIP(), []int{3, 2}
}

func (x *CommonTlsContext_CombinedCertificateValidationContext) GetDefaultValidationContext() *CertificateValidationContext {
	if x != nil {
		return x.DefaultValidationContext
	}
	return nil
}

func (x *CommonTlsContext_CombinedCertificateValidationContext) GetValidationContextSdsSecretConfig() *SdsSecretConfig {
	if x != nil {
		return x.ValidationContextSdsSecretConfig
	}
	return nil
}

// Deprecated: Marked as deprecated in envoy/extensions/transport_sockets/tls/v3/tls.proto.
func (x *CommonTlsContext_CombinedCertificateValidationContext) GetValidationContextCertificateProvider() *CommonTlsContext_CertificateProvider {
	if x != nil {
		return x.ValidationContextCertificateProvider
	}
	return nil
}

// Deprecated: Marked as deprecated in envoy/extensions/transport_sockets/tls/v3/tls.proto.
func (x *CommonTlsContext_CombinedCertificateValidationContext) GetValidationContextCertificateProviderInstance() *CommonTlsContext_CertificateProviderInstance {
	if x != nil {
		return x.ValidationContextCertificateProviderInstance
	}
	return nil
}

var File_envoy_extensions_transport_sockets_tls_v3_tls_proto protoreflect.FileDescriptor

const file_envoy_extensions_transport_sockets_tls_v3_tls_proto_rawDesc = "" +
	"\n" +
	"3envoy/extensions/transport_sockets/tls/v3/tls.proto\x12)envoy.extensions.transport_sockets.tls.v3\x1a\"envoy/config/core/v3/address.proto\x1a$envoy/config/core/v3/extension.proto\x1a6envoy/extensions/transport_sockets/tls/v3/common.proto\x1a6envoy/extensions/transport_sockets/tls/v3/secret.proto\x1a\x1egoogle/protobuf/duration.proto\x1a\x1egoogle/protobuf/wrappers.proto\x1a#envoy/annotations/deprecation.proto\x1a\x1dudpa/annotations/status.proto\x1a!udpa/annotations/versioning.proto\x1a\x17validate/validate.proto\"\xf8\x03\n" +
	"\x12UpstreamTlsContext\x12i\n" +
	"\x12common_tls_context\x18\x01 \x01(\v2;.envoy.extensions.transport_sockets.tls.v3.CommonTlsContextR\x10commonTlsContext\x12\x1a\n" +
	"\x03sni\x18\x02 \x01(\tB\b\xfaB\x05r\x03(\xff\x01R\x03sni\x12\"\n" +
	"\rauto_host_sni\x18\x06 \x01(\bR\vautoHostSni\x125\n" +
	"\x17auto_sni_san_validation\x18\a \x01(\bR\x14autoSniSanValidation\x12/\n" +
	"\x13allow_renegotiation\x18\x03 \x01(\bR\x12allowRenegotiation\x12F\n" +
	"\x10max_session_keys\x18\x04 \x01(\v2\x1c.google.protobuf.UInt32ValueR\x0emaxSessionKeys\x12Z\n" +
	"\x15enforce_rsa_key_usage\x18\x05 \x01(\v2\x1a.google.protobuf.BoolValueB\v\x92ǆ\xd8\x04\x033.0\x18\x01R\x12enforceRsaKeyUsage:+\x9aň\x1e&\n" +
	"$envoy.api.v2.auth.UpstreamTlsContext\"\xce\t\n" +
	"\x14DownstreamTlsContext\x12i\n" +
	"\x12common_tls_context\x18\x01 \x01(\v2;.envoy.extensions.transport_sockets.tls.v3.CommonTlsContextR\x10commonTlsContext\x12X\n" +
	"\x1arequire_client_certificate\x18\x02 \x01(\v2\x1a.google.protobuf.BoolValueR\x18requireClientCertificate\x12;\n" +
	"\vrequire_sni\x18\x03 \x01(\v2\x1a.google.protobuf.BoolValueR\n" +
	"requireSni\x12q\n" +
	"\x13session_ticket_keys\x18\x04 \x01(\v2?.envoy.extensions.transport_sockets.tls.v3.TlsSessionTicketKeysH\x00R\x11sessionTicketKeys\x12\x8d\x01\n" +
	"%session_ticket_keys_sds_secret_config\x18\x05 \x01(\v2:.envoy.extensions.transport_sockets.tls.v3.SdsSecretConfigH\x00R sessionTicketKeysSdsSecretConfig\x12Q\n" +
	"$disable_stateless_session_resumption\x18\a \x01(\bH\x00R!disableStatelessSessionResumption\x12M\n" +
	"#disable_stateful_session_resumption\x18\n" +
	" \x01(\bR disableStatefulSessionResumption\x12T\n" +
	"\x0fsession_timeout\x18\x06 \x01(\v2\x19.google.protobuf.DurationB\x10\xfaB\r\xaa\x01\n" +
	"\x1a\x06\b\x80\x80\x80\x80\x102\x00R\x0esessionTimeout\x12\x88\x01\n" +
	"\x12ocsp_staple_policy\x18\b \x01(\x0e2P.envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext.OcspStaplePolicyB\b\xfaB\x05\x82\x01\x02\x10\x01R\x10ocspStaplePolicy\x12_\n" +
	"\x1ffull_scan_certs_on_sni_mismatch\x18\t \x01(\v2\x1a.google.protobuf.BoolValueR\x1afullScanCertsOnSniMismatch\x122\n" +
	"\x15prefer_client_ciphers\x18\v \x01(\bR\x13preferClientCiphers\"N\n" +
	"\x10OcspStaplePolicy\x12\x14\n" +
	"\x10LENIENT_STAPLING\x10\x00\x12\x13\n" +
	"\x0fSTRICT_STAPLING\x10\x01\x12\x0f\n" +
	"\vMUST_STAPLE\x10\x02:-\x9aň\x1e(\n" +
	"&envoy.api.v2.auth.DownstreamTlsContextB\x1a\n" +
	"\x18session_ticket_keys_type\"\xcc\x01\n" +
	"\tTlsKeyLog\x12\x1b\n" +
	"\x04path\x18\x01 \x01(\tB\a\xfaB\x04r\x02\x10\x01R\x04path\x12O\n" +
	"\x13local_address_range\x18\x02 \x03(\v2\x1f.envoy.config.core.v3.CidrRangeR\x11localAddressRange\x12Q\n" +
	"\x14remote_address_range\x18\x03 \x03(\v2\x1f.envoy.config.core.v3.CidrRangeR\x12remoteAddressRange\"\xdd\x18\n" +
	"\x10CommonTlsContext\x12W\n" +
	"\n" +
	"tls_params\x18\x01 \x01(\v28.envoy.extensions.transport_sockets.tls.v3.TlsParametersR\ttlsParams\x12d\n" +
	"\x10tls_certificates\x18\x02 \x03(\v29.envoy.extensions.transport_sockets.tls.v3.TlsCertificateR\x0ftlsCertificates\x12\x86\x01\n" +
	"\"tls_certificate_sds_secret_configs\x18\x06 \x03(\v2:.envoy.extensions.transport_sockets.tls.v3.SdsSecretConfigR\x1etlsCertificateSdsSecretConfigs\x12\x97\x01\n" +
	"!tls_certificate_provider_instance\x18\x0e \x01(\v2L.envoy.extensions.transport_sockets.tls.v3.CertificateProviderPluginInstanceR\x1etlsCertificateProviderInstance\x12q\n" +
	"\x1fcustom_tls_certificate_selector\x18\x10 \x01(\v2*.envoy.config.core.v3.TypedExtensionConfigR\x1ccustomTlsCertificateSelector\x12\xad\x01\n" +
	"$tls_certificate_certificate_provider\x18\t \x01(\v2O.envoy.extensions.transport_sockets.tls.v3.CommonTlsContext.CertificateProviderB\v\x92ǆ\xd8\x04\x033.0\x18\x01R!tlsCertificateCertificateProvider\x12\xc6\x01\n" +
	"-tls_certificate_certificate_provider_instance\x18\v \x01(\v2W.envoy.extensions.transport_sockets.tls.v3.CommonTlsContext.CertificateProviderInstanceB\v\x92ǆ\xd8\x04\x033.0\x18\x01R)tlsCertificateCertificateProviderInstance\x12x\n" +
	"\x12validation_context\x18\x03 \x01(\v2G.envoy.extensions.transport_sockets.tls.v3.CertificateValidationContextH\x00R\x11validationContext\x12\x8c\x01\n" +
	"$validation_context_sds_secret_config\x18\a \x01(\v2:.envoy.extensions.transport_sockets.tls.v3.SdsSecretConfigH\x00R validationContextSdsSecretConfig\x12\xa2\x01\n" +
	"\x1bcombined_validation_context\x18\b \x01(\v2`.envoy.extensions.transport_sockets.tls.v3.CommonTlsContext.CombinedCertificateValidationContextH\x00R\x19combinedValidationContext\x12\xb5\x01\n" +
	"'validation_context_certificate_provider\x18\n" +
	" \x01(\v2O.envoy.extensions.transport_sockets.tls.v3.CommonTlsContext.CertificateProviderB\v\x92ǆ\xd8\x04\x033.0\x18\x01H\x00R$validationContextCertificateProvider\x12\xce\x01\n" +
	"0validation_context_certificate_provider_instance\x18\f \x01(\v2W.envoy.extensions.transport_sockets.tls.v3.CommonTlsContext.CertificateProviderInstanceB\v\x92ǆ\xd8\x04\x033.0\x18\x01H\x00R,validationContextCertificateProviderInstance\x12%\n" +
	"\x0ealpn_protocols\x18\x04 \x03(\tR\ralpnProtocols\x12W\n" +
	"\x11custom_handshaker\x18\r \x01(\v2*.envoy.config.core.v3.TypedExtensionConfigR\x10customHandshaker\x12M\n" +
	"\akey_log\x18\x0f \x01(\v24.envoy.extensions.transport_sockets.tls.v3.TlsKeyLogR\x06keyLog\x1a\x92\x01\n" +
	"\x13CertificateProvider\x12\x1b\n" +
	"\x04name\x18\x01 \x01(\tB\a\xfaB\x04r\x02\x10\x01R\x04name\x12O\n" +
	"\ftyped_config\x18\x02 \x01(\v2*.envoy.config.core.v3.TypedExtensionConfigH\x00R\vtypedConfigB\r\n" +
	"\x06config\x12\x03\xf8B\x01\x1am\n" +
	"\x1bCertificateProviderInstance\x12#\n" +
	"\rinstance_name\x18\x01 \x01(\tR\finstanceName\x12)\n" +
	"\x10certificate_name\x18\x02 \x01(\tR\x0fcertificateName\x1a\xa4\x06\n" +
	"$CombinedCertificateValidationContext\x12\x8f\x01\n" +
	"\x1adefault_validation_context\x18\x01 \x01(\v2G.envoy.extensions.transport_sockets.tls.v3.CertificateValidationContextB\b\xfaB\x05\x8a\x01\x02\x10\x01R\x18defaultValidationContext\x12\x94\x01\n" +
	"$validation_context_sds_secret_config\x18\x02 \x01(\v2:.envoy.extensions.transport_sockets.tls.v3.SdsSecretConfigB\b\xfaB\x05\x8a\x01\x02\x10\x01R validationContextSdsSecretConfig\x12\xb3\x01\n" +
	"'validation_context_certificate_provider\x18\x03 \x01(\v2O.envoy.extensions.transport_sockets.tls.v3.CommonTlsContext.CertificateProviderB\v\x92ǆ\xd8\x04\x033.0\x18\x01R$validationContextCertificateProvider\x12\xcc\x01\n" +
	"0validation_context_certificate_provider_instance\x18\x04 \x01(\v2W.envoy.extensions.transport_sockets.tls.v3.CommonTlsContext.CertificateProviderInstanceB\v\x92ǆ\xd8\x04\x033.0\x18\x01R,validationContextCertificateProviderInstance:N\x9aň\x1eI\n" +
	"Genvoy.api.v2.auth.CommonTlsContext.CombinedCertificateValidationContext:)\x9aň\x1e$\n" +
	"\"envoy.api.v2.auth.CommonTlsContextB\x19\n" +
	"\x17validation_context_typeJ\x04\b\x05\x10\x06B\xa5\x01\xba\x80\xc8\xd1\x06\x02\x10\x02\n" +
	"7io.envoyproxy.envoy.extensions.transport_sockets.tls.v3B\bTlsProtoP\x01ZVgithub.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3;tlsv3b\x06proto3"

var (
	file_envoy_extensions_transport_sockets_tls_v3_tls_proto_rawDescOnce sync.Once
	file_envoy_extensions_transport_sockets_tls_v3_tls_proto_rawDescData []byte
)

func file_envoy_extensions_transport_sockets_tls_v3_tls_proto_rawDescGZIP() []byte {
	file_envoy_extensions_transport_sockets_tls_v3_tls_proto_rawDescOnce.Do(func() {
		file_envoy_extensions_transport_sockets_tls_v3_tls_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_envoy_extensions_transport_sockets_tls_v3_tls_proto_rawDesc), len(file_envoy_extensions_transport_sockets_tls_v3_tls_proto_rawDesc)))
	})
	return file_envoy_extensions_transport_sockets_tls_v3_tls_proto_rawDescData
}

var file_envoy_extensions_transport_sockets_tls_v3_tls_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
var file_envoy_extensions_transport_sockets_tls_v3_tls_proto_msgTypes = make([]protoimpl.MessageInfo, 7)
var file_envoy_extensions_transport_sockets_tls_v3_tls_proto_goTypes = []any{
	(DownstreamTlsContext_OcspStaplePolicy)(0),                    // 0: envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext.OcspStaplePolicy
	(*UpstreamTlsContext)(nil),                                    // 1: envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
	(*DownstreamTlsContext)(nil),                                  // 2: envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
	(*TlsKeyLog)(nil),                                             // 3: envoy.extensions.transport_sockets.tls.v3.TlsKeyLog
	(*CommonTlsContext)(nil),                                      // 4: envoy.extensions.transport_sockets.tls.v3.CommonTlsContext
	(*CommonTlsContext_CertificateProvider)(nil),                  // 5: envoy.extensions.transport_sockets.tls.v3.CommonTlsContext.CertificateProvider
	(*CommonTlsContext_CertificateProviderInstance)(nil),          // 6: envoy.extensions.transport_sockets.tls.v3.CommonTlsContext.CertificateProviderInstance
	(*CommonTlsContext_CombinedCertificateValidationContext)(nil), // 7: envoy.extensions.transport_sockets.tls.v3.CommonTlsContext.CombinedCertificateValidationContext
	(*wrapperspb.UInt32Value)(nil),                                // 8: google.protobuf.UInt32Value
	(*wrapperspb.BoolValue)(nil),                                  // 9: google.protobuf.BoolValue
	(*TlsSessionTicketKeys)(nil),                                  // 10: envoy.extensions.transport_sockets.tls.v3.TlsSessionTicketKeys
	(*SdsSecretConfig)(nil),                                       // 11: envoy.extensions.transport_sockets.tls.v3.SdsSecretConfig
	(*durationpb.Duration)(nil),                                   // 12: google.protobuf.Duration
	(*v3.CidrRange)(nil),                                          // 13: envoy.config.core.v3.CidrRange
	(*TlsParameters)(nil),                                         // 14: envoy.extensions.transport_sockets.tls.v3.TlsParameters
	(*TlsCertificate)(nil),                                        // 15: envoy.extensions.transport_sockets.tls.v3.TlsCertificate
	(*CertificateProviderPluginInstance)(nil),                     // 16: envoy.extensions.transport_sockets.tls.v3.CertificateProviderPluginInstance
	(*v3.TypedExtensionConfig)(nil),                               // 17: envoy.config.core.v3.TypedExtensionConfig
	(*CertificateValidationContext)(nil),                          // 18: envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext
}
var file_envoy_extensions_transport_sockets_tls_v3_tls_proto_depIdxs = []int32{
	4,  // 0: envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext.common_tls_context:type_name -> envoy.extensions.transport_sockets.tls.v3.CommonTlsContext
	8,  // 1: envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext.max_session_keys:type_name -> google.protobuf.UInt32Value
	9,  // 2: envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext.enforce_rsa_key_usage:type_name -> google.protobuf.BoolValue
	4,  // 3: envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext.common_tls_context:type_name -> envoy.extensions.transport_sockets.tls.v3.CommonTlsContext
	9,  // 4: envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext.require_client_certificate:type_name -> google.protobuf.BoolValue
	9,  // 5: envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext.require_sni:type_name -> google.protobuf.BoolValue
	10, // 6: envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext.session_ticket_keys:type_name -> envoy.extensions.transport_sockets.tls.v3.TlsSessionTicketKeys
	11, // 7: envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext.session_ticket_keys_sds_secret_config:type_name -> envoy.extensions.transport_sockets.tls.v3.SdsSecretConfig
	12, // 8: envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext.session_timeout:type_name -> google.protobuf.Duration
	0,  // 9: envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext.ocsp_staple_policy:type_name -> envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext.OcspStaplePolicy
	9,  // 10: envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext.full_scan_certs_on_sni_mismatch:type_name -> google.protobuf.BoolValue
	13, // 11: envoy.extensions.transport_sockets.tls.v3.TlsKeyLog.local_address_range:type_name -> envoy.config.core.v3.CidrRange
	13, // 12: envoy.extensions.transport_sockets.tls.v3.TlsKeyLog.remote_address_range:type_name -> envoy.config.core.v3.CidrRange
	14, // 13: envoy.extensions.transport_sockets.tls.v3.CommonTlsContext.tls_params:type_name -> envoy.extensions.transport_sockets.tls.v3.TlsParameters
	15, // 14: envoy.extensions.transport_sockets.tls.v3.CommonTlsContext.tls_certificates:type_name -> envoy.extensions.transport_sockets.tls.v3.TlsCertificate
	11, // 15: envoy.extensions.transport_sockets.tls.v3.CommonTlsContext.tls_certificate_sds_secret_configs:type_name -> envoy.extensions.transport_sockets.tls.v3.SdsSecretConfig
	16, // 16: envoy.extensions.transport_sockets.tls.v3.CommonTlsContext.tls_certificate_provider_instance:type_name -> envoy.extensions.transport_sockets.tls.v3.CertificateProviderPluginInstance
	17, // 17: envoy.extensions.transport_sockets.tls.v3.CommonTlsContext.custom_tls_certificate_selector:type_name -> envoy.config.core.v3.TypedExtensionConfig
	5,  // 18: envoy.extensions.transport_sockets.tls.v3.CommonTlsContext.tls_certificate_certificate_provider:type_name -> envoy.extensions.transport_sockets.tls.v3.CommonTlsContext.CertificateProvider
	6,  // 19: envoy.extensions.transport_sockets.tls.v3.CommonTlsContext.tls_certificate_certificate_provider_instance:type_name -> envoy.extensions.transport_sockets.tls.v3.CommonTlsContext.CertificateProviderInstance
	18, // 20: envoy.extensions.transport_sockets.tls.v3.CommonTlsContext.validation_context:type_name -> envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext
	11, // 21: envoy.extensions.transport_sockets.tls.v3.CommonTlsContext.validation_context_sds_secret_config:type_name -> envoy.extensions.transport_sockets.tls.v3.SdsSecretConfig
	7,  // 22: envoy.extensions.transport_sockets.tls.v3.CommonTlsContext.combined_validation_context:type_name -> envoy.extensions.transport_sockets.tls.v3.CommonTlsContext.CombinedCertificateValidationContext
	5,  // 23: envoy.extensions.transport_sockets.tls.v3.CommonTlsContext.validation_context_certificate_provider:type_name -> envoy.extensions.transport_sockets.tls.v3.CommonTlsContext.CertificateProvider
	6,  // 24: envoy.extensions.transport_sockets.tls.v3.CommonTlsContext.validation_context_certificate_provider_instance:type_name -> envoy.extensions.transport_sockets.tls.v3.CommonTlsContext.CertificateProviderInstance
	17, // 25: envoy.extensions.transport_sockets.tls.v3.CommonTlsContext.custom_handshaker:type_name -> envoy.config.core.v3.TypedExtensionConfig
	3,  // 26: envoy.extensions.transport_sockets.tls.v3.CommonTlsContext.key_log:type_name -> envoy.extensions.transport_sockets.tls.v3.TlsKeyLog
	17, // 27: envoy.extensions.transport_sockets.tls.v3.CommonTlsContext.CertificateProvider.typed_config:type_name -> envoy.config.core.v3.TypedExtensionConfig
	18, // 28: envoy.extensions.transport_sockets.tls.v3.CommonTlsContext.CombinedCertificateValidationContext.default_validation_context:type_name -> envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext
	11, // 29: envoy.extensions.transport_sockets.tls.v3.CommonTlsContext.CombinedCertificateValidationContext.validation_context_sds_secret_config:type_name -> envoy.extensions.transport_sockets.tls.v3.SdsSecretConfig
	5,  // 30: envoy.extensions.transport_sockets.tls.v3.CommonTlsContext.CombinedCertificateValidationContext.validation_context_certificate_provider:type_name -> envoy.extensions.transport_sockets.tls.v3.CommonTlsContext.CertificateProvider
	6,  // 31: envoy.extensions.transport_sockets.tls.v3.CommonTlsContext.CombinedCertificateValidationContext.validation_context_certificate_provider_instance:type_name -> envoy.extensions.transport_sockets.tls.v3.CommonTlsContext.CertificateProviderInstance
	32, // [32:32] is the sub-list for method output_type
	32, // [32:32] is the sub-list for method input_type
	32, // [32:32] is the sub-list for extension type_name
	32, // [32:32] is the sub-list for extension extendee
	0,  // [0:32] is the sub-list for field type_name
}

func init() { file_envoy_extensions_transport_sockets_tls_v3_tls_proto_init() }
func file_envoy_extensions_transport_sockets_tls_v3_tls_proto_init() {
	if File_envoy_extensions_transport_sockets_tls_v3_tls_proto != nil {
		return
	}
	file_envoy_extensions_transport_sockets_tls_v3_common_proto_init()
	file_envoy_extensions_transport_sockets_tls_v3_secret_proto_init()
	file_envoy_extensions_transport_sockets_tls_v3_tls_proto_msgTypes[1].OneofWrappers = []any{
		(*DownstreamTlsContext_SessionTicketKeys)(nil),
		(*DownstreamTlsContext_SessionTicketKeysSdsSecretConfig)(nil),
		(*DownstreamTlsContext_DisableStatelessSessionResumption)(nil),
	}
	file_envoy_extensions_transport_sockets_tls_v3_tls_proto_msgTypes[3].OneofWrappers = []any{
		(*CommonTlsContext_ValidationContext)(nil),
		(*CommonTlsContext_ValidationContextSdsSecretConfig)(nil),
		(*CommonTlsContext_CombinedValidationContext)(nil),
		(*CommonTlsContext_ValidationContextCertificateProvider)(nil),
		(*CommonTlsContext_ValidationContextCertificateProviderInstance)(nil),
	}
	file_envoy_extensions_transport_sockets_tls_v3_tls_proto_msgTypes[4].OneofWrappers = []any{
		(*CommonTlsContext_CertificateProvider_TypedConfig)(nil),
	}
	type x struct{}
	out := protoimpl.TypeBuilder{
		File: protoimpl.DescBuilder{
			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
			RawDescriptor: unsafe.Slice(unsafe.StringData(file_envoy_extensions_transport_sockets_tls_v3_tls_proto_rawDesc), len(file_envoy_extensions_transport_sockets_tls_v3_tls_proto_rawDesc)),
			NumEnums:      1,
			NumMessages:   7,
			NumExtensions: 0,
			NumServices:   0,
		},
		GoTypes:           file_envoy_extensions_transport_sockets_tls_v3_tls_proto_goTypes,
		DependencyIndexes: file_envoy_extensions_transport_sockets_tls_v3_tls_proto_depIdxs,
		EnumInfos:         file_envoy_extensions_transport_sockets_tls_v3_tls_proto_enumTypes,
		MessageInfos:      file_envoy_extensions_transport_sockets_tls_v3_tls_proto_msgTypes,
	}.Build()
	File_envoy_extensions_transport_sockets_tls_v3_tls_proto = out.File
	file_envoy_extensions_transport_sockets_tls_v3_tls_proto_goTypes = nil
	file_envoy_extensions_transport_sockets_tls_v3_tls_proto_depIdxs = nil
}
