syntax = "proto3";

package envoy.extensions.rbac.matchers.upstream_ip_port.v3;

import "envoy/config/core/v3/address.proto";
import "envoy/type/v3/range.proto";

import "udpa/annotations/status.proto";

option java_package = "io.envoyproxy.envoy.extensions.rbac.matchers.upstream_ip_port.v3";
option java_outer_classname = "UpstreamIpPortMatcherProto";
option java_multiple_files = true;
option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/rbac/matchers/upstream_ip_port/v3;upstream_ip_portv3";
option (udpa.annotations.file_status).package_version_status = ACTIVE;

// [#protodoc-title: RBAC upstream IP and port matcher plugin]
// [#extension: envoy.rbac.matchers.upstream_ip_port]

// This is configuration for matching upstream ip and port.
// Note that although both fields are optional, at least one of IP or port must be supplied. If only
// one is supplied the other is a wildcard match.
// This matcher requires a filter in the chain to have saved the upstream address in the
// filter state before the matcher is executed by RBAC filter. The state should be saved with key
// `envoy.stream.upstream_address` (See
// :repo:`upstream_address.h<source/common/stream_info/upstream_address.h>`).
// Also, See :repo:`proxy_filter.cc<
// source/extensions/filters/http/dynamic_forward_proxy/proxy_filter.cc>` for an example of a
// filter which populates the FilterState.
message UpstreamIpPortMatcher {
  // A CIDR block that will be used to match the upstream IP.
  // Both Ipv4 and Ipv6 ranges can be matched.
  config.core.v3.CidrRange upstream_ip = 1;

  // A port range that will be used to match the upstream port.
  type.v3.Int64Range upstream_port_range = 2;
}
