syntax = "proto3";

package talos.resource.definitions.network;

option go_package = "github.com/siderolabs/talos/pkg/machinery/api/resource/definitions/network";
option java_package = "dev.talos.api.resource.definitions.network";

import "common/common.proto";
import "google/protobuf/duration.proto";
import "resource/definitions/enums/enums.proto";
import "resource/definitions/runtime/runtime.proto";

// AddressSpecSpec describes status of rendered secrets.
message AddressSpecSpec {
  common.NetIPPrefix address = 1;
  string link_name = 2;
  talos.resource.definitions.enums.NethelpersFamily family = 3;
  talos.resource.definitions.enums.NethelpersScope scope = 4;
  uint32 flags = 5;
  bool announce_with_arp = 6;
  talos.resource.definitions.enums.NetworkConfigLayer config_layer = 7;
  uint32 priority = 8;
}

// AddressStatusSpec describes status of rendered secrets.
message AddressStatusSpec {
  common.NetIPPrefix address = 1;
  common.NetIP local = 2;
  common.NetIP broadcast = 3;
  common.NetIP anycast = 4;
  common.NetIP multicast = 5;
  uint32 link_index = 6;
  string link_name = 7;
  talos.resource.definitions.enums.NethelpersFamily family = 8;
  talos.resource.definitions.enums.NethelpersScope scope = 9;
  uint32 flags = 10;
  uint32 priority = 11;
}

// BondMasterSpec describes bond settings if Kind == "bond".
message BondMasterSpec {
  talos.resource.definitions.enums.NethelpersBondMode mode = 1;
  talos.resource.definitions.enums.NethelpersBondXmitHashPolicy hash_policy = 2;
  talos.resource.definitions.enums.NethelpersLACPRate lacp_rate = 3;
  talos.resource.definitions.enums.NethelpersARPValidate arp_validate = 4;
  talos.resource.definitions.enums.NethelpersARPAllTargets arp_all_targets = 5;
  uint32 primary_index = 6;
  talos.resource.definitions.enums.NethelpersPrimaryReselect primary_reselect = 7;
  talos.resource.definitions.enums.NethelpersFailOverMAC fail_over_mac = 8;
  talos.resource.definitions.enums.NethelpersADSelect ad_select = 9;
  uint32 mii_mon = 10;
  uint32 up_delay = 11;
  uint32 down_delay = 12;
  uint32 arp_interval = 13;
  uint32 resend_igmp = 14;
  uint32 min_links = 15;
  uint32 lp_interval = 16;
  uint32 packets_per_slave = 17;
  uint32 num_peer_notif = 18;
  uint32 tlb_dynamic_lb = 19;
  uint32 all_slaves_active = 20;
  bool use_carrier = 21;
  uint32 ad_actor_sys_prio = 22;
  uint32 ad_user_port_key = 23;
  uint32 peer_notify_delay = 24;
  repeated common.NetIP arpip_targets = 25;
  repeated common.NetIP nsip6_targets = 26;
  talos.resource.definitions.enums.NethelpersADLACPActive adlacp_active = 27;
  uint32 missed_max = 28;
}

// BondSlave contains a bond's master name and slave index.
message BondSlave {
  string master_name = 1;
  int64 slave_index = 2;
}

// BridgeMasterSpec describes bridge settings if Kind == "bridge".
message BridgeMasterSpec {
  STPSpec stp = 1;
  BridgeVLANSpec vlan = 2;
}

// BridgeSlave contains the name of the master bridge of a bridged interface
message BridgeSlave {
  string master_name = 1;
}

// BridgeVLANSpec describes VLAN settings of a bridge.
message BridgeVLANSpec {
  bool filtering_enabled = 1;
}

// ClientIdentifierSpec is a shared DHCP4/DHCP6 client identifier spec.
message ClientIdentifierSpec {
  talos.resource.definitions.enums.NethelpersClientIdentifier client_identifier = 1;
  string duid_raw_hex = 2;
}

// DHCP4OperatorSpec describes DHCP4 operator options.
message DHCP4OperatorSpec {
  uint32 route_metric = 1;
  bool skip_hostname_request = 2;
  ClientIdentifierSpec client_identifier = 3;
}

// DHCP6OperatorSpec describes DHCP6 operator options.
message DHCP6OperatorSpec {
  uint32 route_metric = 2;
  bool skip_hostname_request = 3;
  ClientIdentifierSpec client_identifier = 4;
}

// DNSResolveCacheSpec describes DNS servers status.
message DNSResolveCacheSpec {
  string status = 1;
}

// EthernetChannelsSpec describes config of Ethernet channels.
message EthernetChannelsSpec {
  uint32 rx = 1;
  uint32 tx = 2;
  uint32 other = 3;
  uint32 combined = 4;
}

// EthernetChannelsStatus describes status of Ethernet channels.
message EthernetChannelsStatus {
  uint32 rx_max = 1;
  uint32 tx_max = 2;
  uint32 other_max = 3;
  uint32 combined_max = 4;
  uint32 rx = 5;
  uint32 tx = 6;
  uint32 other = 7;
  uint32 combined = 8;
}

// EthernetFeatureStatus describes status of Ethernet features.
message EthernetFeatureStatus {
  string name = 1;
  string status = 2;
}

// EthernetRingsSpec describes config of Ethernet rings.
message EthernetRingsSpec {
  uint32 rx = 1;
  uint32 rx_mini = 2;
  uint32 rx_jumbo = 3;
  uint32 tx = 4;
  uint32 rx_buf_len = 5;
  uint32 cqe_size = 6;
  bool tx_push = 7;
  bool rx_push = 8;
  uint32 tx_push_buf_len = 9;
  bool tcp_data_split = 10;
}

// EthernetRingsStatus describes status of Ethernet rings.
message EthernetRingsStatus {
  uint32 rx_max = 1;
  uint32 rx_mini_max = 2;
  uint32 rx_jumbo_max = 3;
  uint32 tx_max = 4;
  uint32 tx_push_buf_len_max = 5;
  uint32 rx = 6;
  uint32 rx_mini = 7;
  uint32 rx_jumbo = 8;
  uint32 tx = 9;
  uint32 rx_buf_len = 10;
  uint32 cqe_size = 11;
  bool tx_push = 12;
  bool rx_push = 13;
  uint32 tx_push_buf_len = 14;
  bool tcp_data_split = 15;
}

// EthernetSpecSpec describes config of Ethernet link.
message EthernetSpecSpec {
  EthernetRingsSpec rings = 1;
  map<string, bool> features = 2;
  EthernetChannelsSpec channels = 3;
  repeated talos.resource.definitions.enums.NethelpersWOLMode wake_on_lan = 4;
}

// EthernetStatusSpec describes status of rendered secrets.
message EthernetStatusSpec {
  bool link_state = 1;
  int64 speed_megabits = 2;
  talos.resource.definitions.enums.NethelpersPort port = 3;
  talos.resource.definitions.enums.NethelpersDuplex duplex = 4;
  repeated string our_modes = 5;
  repeated string peer_modes = 6;
  EthernetRingsStatus rings = 7;
  repeated EthernetFeatureStatus features = 8;
  EthernetChannelsStatus channels = 9;
  repeated talos.resource.definitions.enums.NethelpersWOLMode wake_on_lan = 10;
}

// HardwareAddrSpec describes spec for the link.
message HardwareAddrSpec {
  string name = 1;
  bytes hardware_addr = 2;
}

// HostDNSConfigSpec describes host DNS config.
message HostDNSConfigSpec {
  bool enabled = 1;
  repeated common.NetIPPort listen_addresses = 2;
  common.NetIP service_host_dns_address = 3;
  bool resolve_member_names = 4;
}

// HostnameSpecSpec describes node hostname.
message HostnameSpecSpec {
  string hostname = 1;
  string domainname = 2;
  talos.resource.definitions.enums.NetworkConfigLayer config_layer = 3;
}

// HostnameStatusSpec describes node hostname.
message HostnameStatusSpec {
  string hostname = 1;
  string domainname = 2;
}

// LinkAliasSpecSpec describes status of rendered secrets.
message LinkAliasSpecSpec {
  string alias = 1;
}

// LinkRefreshSpec describes status of rendered secrets.
message LinkRefreshSpec {
  int64 generation = 1;
}

// LinkSpecSpec describes spec for the link.
message LinkSpecSpec {
  string name = 1;
  bool logical = 2;
  bool up = 3;
  uint32 mtu = 4;
  string kind = 5;
  talos.resource.definitions.enums.NethelpersLinkType type = 6;
  string parent_name = 7;
  BondSlave bond_slave = 8;
  BridgeSlave bridge_slave = 9;
  VLANSpec vlan = 10;
  BondMasterSpec bond_master = 11;
  BridgeMasterSpec bridge_master = 12;
  WireguardSpec wireguard = 13;
  talos.resource.definitions.enums.NetworkConfigLayer config_layer = 14;
  bytes hardware_address = 15;
  bool multicast = 16;
  VRFMasterSpec vrf_master = 17;
  VRFSlave vrf_slave = 18;
}

// LinkStatusSpec describes status of rendered secrets.
message LinkStatusSpec {
  uint32 index = 1;
  talos.resource.definitions.enums.NethelpersLinkType type = 2;
  uint32 link_index = 3;
  uint32 flags = 4;
  bytes hardware_addr = 5;
  bytes broadcast_addr = 6;
  uint32 mtu = 7;
  string queue_disc = 8;
  uint32 master_index = 9;
  talos.resource.definitions.enums.NethelpersOperationalState operational_state = 10;
  string kind = 11;
  string slave_kind = 12;
  string bus_path = 13;
  string pciid = 14;
  string driver = 15;
  string driver_version = 16;
  string firmware_version = 17;
  string product_id = 18;
  string vendor_id = 19;
  string product = 20;
  string vendor = 21;
  bool link_state = 22;
  int64 speed_megabits = 23;
  talos.resource.definitions.enums.NethelpersPort port = 24;
  talos.resource.definitions.enums.NethelpersDuplex duplex = 25;
  VLANSpec vlan = 26;
  BridgeMasterSpec bridge_master = 27;
  BondMasterSpec bond_master = 28;
  WireguardSpec wireguard = 29;
  bytes permanent_addr = 30;
  string alias = 31;
  repeated string alt_names = 32;
  VRFMasterSpec vrf_master = 33;
}

// NfTablesAddressMatch describes the match on the IP address.
message NfTablesAddressMatch {
  repeated common.NetIPPrefix include_subnets = 1;
  repeated common.NetIPPrefix exclude_subnets = 2;
  bool invert = 3;
}

// NfTablesChainSpec describes status of rendered secrets.
message NfTablesChainSpec {
  string type = 1;
  talos.resource.definitions.enums.NethelpersNfTablesChainHook hook = 2;
  talos.resource.definitions.enums.NethelpersNfTablesChainPriority priority = 3;
  repeated NfTablesRule rules = 4;
  talos.resource.definitions.enums.NethelpersNfTablesVerdict policy = 5;
}

// NfTablesClampMSS describes the TCP MSS clamping operation.
//
// MSS is limited by the `MaxMTU` so that:
// - IPv4: MSS = MaxMTU - 40
// - IPv6: MSS = MaxMTU - 60.
message NfTablesClampMSS {
  uint32 mtu = 1;
}

// NfTablesConntrackStateMatch describes the match on the connection tracking state.
message NfTablesConntrackStateMatch {
  repeated talos.resource.definitions.enums.NethelpersConntrackState states = 1;
}

// NfTablesICMPTypeMatch describes the match on the ICMP type.
message NfTablesICMPTypeMatch {
  repeated talos.resource.definitions.enums.NethelpersICMPType types = 1;
}

// NfTablesIfNameMatch describes the match on the interface name.
message NfTablesIfNameMatch {
  talos.resource.definitions.enums.NethelpersMatchOperator operator = 2;
  repeated string interface_names = 3;
}

// NfTablesLayer4Match describes the match on the transport layer protocol.
message NfTablesLayer4Match {
  talos.resource.definitions.enums.NethelpersProtocol protocol = 1;
  NfTablesPortMatch match_source_port = 2;
  NfTablesPortMatch match_destination_port = 3;
  NfTablesICMPTypeMatch match_icmp_type = 4;
}

// NfTablesLimitMatch describes the match on the packet rate.
message NfTablesLimitMatch {
  uint64 packet_rate_per_second = 1;
}

// NfTablesMark encodes packet mark match/update operation.
//
// When used as a match computes the following condition:
// (mark & mask) ^ xor == value
//
// When used as an update computes the following operation:
// mark = (mark & mask) ^ xor.
message NfTablesMark {
  uint32 mask = 1;
  uint32 xor = 2;
  uint32 value = 3;
}

// NfTablesPortMatch describes the match on the transport layer port.
message NfTablesPortMatch {
  repeated PortRange ranges = 1;
}

// NfTablesRule describes a single rule in the nftables chain.
message NfTablesRule {
  NfTablesIfNameMatch match_o_if_name = 1;
  talos.resource.definitions.enums.NethelpersNfTablesVerdict verdict = 2;
  NfTablesMark match_mark = 3;
  NfTablesMark set_mark = 4;
  NfTablesAddressMatch match_source_address = 5;
  NfTablesAddressMatch match_destination_address = 6;
  NfTablesLayer4Match match_layer4 = 7;
  NfTablesIfNameMatch match_i_if_name = 8;
  NfTablesClampMSS clamp_mss = 9;
  NfTablesLimitMatch match_limit = 10;
  NfTablesConntrackStateMatch match_conntrack_state = 11;
  bool anon_counter = 12;
}

// NodeAddressFilterSpec describes a filter for NodeAddresses.
message NodeAddressFilterSpec {
  repeated common.NetIPPrefix include_subnets = 1;
  repeated common.NetIPPrefix exclude_subnets = 2;
}

// NodeAddressSortAlgorithmSpec describes a filter for NodeAddresses.
message NodeAddressSortAlgorithmSpec {
  talos.resource.definitions.enums.NethelpersAddressSortAlgorithm algorithm = 1;
}

// NodeAddressSpec describes a set of node addresses.
message NodeAddressSpec {
  repeated common.NetIPPrefix addresses = 1;
  talos.resource.definitions.enums.NethelpersAddressSortAlgorithm sort_algorithm = 2;
}

// OperatorSpecSpec describes operator specification.
message OperatorSpecSpec {
  talos.resource.definitions.enums.NetworkOperator operator = 1;
  string link_name = 2;
  bool require_up = 3;
  DHCP4OperatorSpec dhcp4 = 4;
  DHCP6OperatorSpec dhcp6 = 5;
  VIPOperatorSpec vip = 6;
  talos.resource.definitions.enums.NetworkConfigLayer config_layer = 7;
}

// PlatformConfigSpec describes platform network configuration.
//
// This structure is marshaled to STATE partition to persist cached network configuration across
// reboots.
message PlatformConfigSpec {
  repeated AddressSpecSpec addresses = 1;
  repeated LinkSpecSpec links = 2;
  repeated RouteSpecSpec routes = 3;
  repeated HostnameSpecSpec hostnames = 4;
  repeated ResolverSpecSpec resolvers = 5;
  repeated TimeServerSpecSpec time_servers = 6;
  repeated OperatorSpecSpec operators = 7;
  repeated common.NetIP external_ips = 8;
  repeated ProbeSpecSpec probes = 9;
  talos.resource.definitions.runtime.PlatformMetadataSpec metadata = 10;
}

// PortRange describes a range of ports.
//
// Range is [lo, hi].
message PortRange {
  uint32 lo = 1;
  uint32 hi = 2;
}

// ProbeSpecSpec describes the Probe.
message ProbeSpecSpec {
  google.protobuf.Duration interval = 1;
  int64 failure_threshold = 2;
  TCPProbeSpec tcp = 3;
  talos.resource.definitions.enums.NetworkConfigLayer config_layer = 4;
}

// ProbeStatusSpec describes the Probe.
message ProbeStatusSpec {
  bool success = 1;
  string last_error = 2;
}

// ResolverSpecSpec describes DNS resolvers.
message ResolverSpecSpec {
  repeated common.NetIP dns_servers = 1;
  talos.resource.definitions.enums.NetworkConfigLayer config_layer = 2;
  repeated string search_domains = 3;
}

// ResolverStatusSpec describes DNS resolvers.
message ResolverStatusSpec {
  repeated common.NetIP dns_servers = 1;
  repeated string search_domains = 2;
}

// RouteSpecSpec describes the route.
message RouteSpecSpec {
  talos.resource.definitions.enums.NethelpersFamily family = 1;
  common.NetIPPrefix destination = 2;
  common.NetIP source = 3;
  common.NetIP gateway = 4;
  string out_link_name = 5;
  talos.resource.definitions.enums.NethelpersRoutingTable table = 6;
  uint32 priority = 7;
  talos.resource.definitions.enums.NethelpersScope scope = 8;
  talos.resource.definitions.enums.NethelpersRouteType type = 9;
  uint32 flags = 10;
  talos.resource.definitions.enums.NethelpersRouteProtocol protocol = 11;
  talos.resource.definitions.enums.NetworkConfigLayer config_layer = 12;
  uint32 mtu = 13;
}

// RouteStatusSpec describes status of rendered secrets.
message RouteStatusSpec {
  talos.resource.definitions.enums.NethelpersFamily family = 1;
  common.NetIPPrefix destination = 2;
  common.NetIP source = 3;
  common.NetIP gateway = 4;
  uint32 out_link_index = 5;
  string out_link_name = 6;
  talos.resource.definitions.enums.NethelpersRoutingTable table = 7;
  uint32 priority = 8;
  talos.resource.definitions.enums.NethelpersScope scope = 9;
  talos.resource.definitions.enums.NethelpersRouteType type = 10;
  uint32 flags = 11;
  talos.resource.definitions.enums.NethelpersRouteProtocol protocol = 12;
  uint32 mtu = 13;
}

// RoutingRuleSpecSpec describes the routing rule.
message RoutingRuleSpecSpec {
  talos.resource.definitions.enums.NethelpersFamily family = 1;
  common.NetIPPrefix src = 2;
  common.NetIPPrefix dst = 3;
  talos.resource.definitions.enums.NethelpersRoutingTable table = 4;
  uint32 priority = 5;
  talos.resource.definitions.enums.NethelpersRoutingRuleAction action = 6;
  string iif_name = 7;
  string oif_name = 8;
  uint32 fw_mark = 9;
  uint32 fw_mask = 10;
  talos.resource.definitions.enums.NetworkConfigLayer config_layer = 11;
}

// RoutingRuleStatusSpec describes the observed routing rule state.
message RoutingRuleStatusSpec {
  talos.resource.definitions.enums.NethelpersFamily family = 1;
  common.NetIPPrefix src = 2;
  common.NetIPPrefix dst = 3;
  talos.resource.definitions.enums.NethelpersRoutingTable table = 4;
  uint32 priority = 5;
  talos.resource.definitions.enums.NethelpersRoutingRuleAction action = 6;
  string iif_name = 7;
  string oif_name = 8;
  uint32 fw_mark = 9;
  uint32 fw_mask = 10;
}

// STPSpec describes Spanning Tree Protocol (STP) settings of a bridge.
message STPSpec {
  bool enabled = 1;
}

// StatusSpec describes network state.
message StatusSpec {
  bool address_ready = 1;
  bool connectivity_ready = 2;
  bool hostname_ready = 3;
  bool etc_files_ready = 4;
}

// TCPProbeSpec describes the TCP Probe.
message TCPProbeSpec {
  string endpoint = 1;
  google.protobuf.Duration timeout = 2;
}

// TimeServerSpecSpec describes NTP servers.
message TimeServerSpecSpec {
  repeated string ntp_servers = 1;
  talos.resource.definitions.enums.NetworkConfigLayer config_layer = 2;
}

// TimeServerStatusSpec describes NTP servers.
message TimeServerStatusSpec {
  repeated string ntp_servers = 1;
}

// VIPEquinixMetalSpec describes virtual (elastic) IP settings for Equinix Metal.
message VIPEquinixMetalSpec {
  string project_id = 1;
  string device_id = 2;
  string api_token = 3;
}

// VIPHCloudSpec describes virtual (elastic) IP settings for Hetzner Cloud.
message VIPHCloudSpec {
  int64 device_id = 1;
  int64 network_id = 2;
  string api_token = 3;
}

// VIPOperatorSpec describes virtual IP operator options.
message VIPOperatorSpec {
  common.NetIP ip = 1;
  bool gratuitous_arp = 2;
  VIPEquinixMetalSpec equinix_metal = 3;
  VIPHCloudSpec h_cloud = 4;
}

// VLANSpec describes VLAN settings if Kind == "vlan".
message VLANSpec {
  uint32 vid = 1;
  talos.resource.definitions.enums.NethelpersVLANProtocol protocol = 2;
}

// VRFMasterSpec describes vrf settings if Kind == "vrf".
message VRFMasterSpec {
  talos.resource.definitions.enums.NethelpersRoutingTable table = 1;
}

// VRFSlave contains the name of the master vrf for an interface
message VRFSlave {
  string master_name = 1;
}

// WireguardPeer describes a single peer.
message WireguardPeer {
  string public_key = 1;
  string preshared_key = 2;
  string endpoint = 3;
  google.protobuf.Duration persistent_keepalive_interval = 4;
  repeated common.NetIPPrefix allowed_ips = 5;
}

// WireguardSpec describes Wireguard settings if Kind == "wireguard".
message WireguardSpec {
  string private_key = 1;
  string public_key = 2;
  int64 listen_port = 3;
  int64 firewall_mark = 4;
  repeated WireguardPeer peers = 5;
}

