mirror of
https://github.com/netbirdio/netbird.git
synced 2026-09-20 05:39:07 +02:00
Add transparent proxy inspection engine with envoy sidecar support
This commit is contained in:
Viktor Liu
@@ -1533,6 +1533,12 @@ components:
|
||||
items:
|
||||
type: string
|
||||
example: "chacdk86lnnboviihd70"
|
||||
inspection_policies:
|
||||
description: Inspection policy IDs applied to traffic matching this policy. When set, traffic is routed through a transparent proxy on the destination network's routing peers.
|
||||
type: array
|
||||
items:
|
||||
type: string
|
||||
example: "chacdk86lnnboviihd71"
|
||||
rules:
|
||||
description: Policy rule object for policy UI editor
|
||||
type: array
|
||||
@@ -1551,6 +1557,12 @@ components:
|
||||
items:
|
||||
type: string
|
||||
example: "chacdk86lnnboviihd70"
|
||||
inspection_policies:
|
||||
description: Inspection policy IDs applied to traffic matching this policy
|
||||
type: array
|
||||
items:
|
||||
type: string
|
||||
example: "chacdk86lnnboviihd71"
|
||||
rules:
|
||||
description: Policy rule object for policy UI editor
|
||||
type: array
|
||||
@@ -1573,6 +1585,12 @@ components:
|
||||
items:
|
||||
type: string
|
||||
example: "chacdk86lnnboviihd70"
|
||||
inspection_policies:
|
||||
description: Inspection policy IDs applied to traffic matching this policy
|
||||
type: array
|
||||
items:
|
||||
type: string
|
||||
example: "chacdk86lnnboviihd71"
|
||||
rules:
|
||||
description: Policy rule object for policy UI editor
|
||||
type: array
|
||||
@@ -2050,6 +2068,9 @@ components:
|
||||
description: Network router status
|
||||
type: boolean
|
||||
example: true
|
||||
inspection:
|
||||
description: Optional traffic inspection configuration. When enabled, traffic through this routing peer is transparently proxied and inspected.
|
||||
$ref: '#/components/schemas/RouterInspectionConfig'
|
||||
required:
|
||||
# Only one property has to be set
|
||||
#- peer
|
||||
@@ -2057,6 +2078,174 @@ components:
|
||||
- metric
|
||||
- masquerade
|
||||
- enabled
|
||||
RouterInspectionConfig:
|
||||
type: object
|
||||
properties:
|
||||
enabled:
|
||||
description: Whether traffic inspection is active on this routing peer
|
||||
type: boolean
|
||||
example: false
|
||||
mode:
|
||||
description: Inspection mode
|
||||
type: string
|
||||
enum: [ "builtin", "envoy", "external" ]
|
||||
example: builtin
|
||||
external_url:
|
||||
description: External proxy URL (http:// or socks5://) when mode is external
|
||||
type: string
|
||||
example: "http://proxy.corp:8080"
|
||||
default_action:
|
||||
description: Action when no inspection rule matches
|
||||
type: string
|
||||
enum: [ "allow", "block", "inspect" ]
|
||||
example: allow
|
||||
redirect_ports:
|
||||
description: Destination ports to intercept. Empty means all ports.
|
||||
type: array
|
||||
items:
|
||||
type: integer
|
||||
example: [80, 443]
|
||||
icap:
|
||||
description: ICAP service configuration for external content scanning
|
||||
$ref: '#/components/schemas/InspectionICAPConfig'
|
||||
ca_cert_pem:
|
||||
description: PEM-encoded CA certificate for MITM TLS inspection
|
||||
type: string
|
||||
ca_key_pem:
|
||||
description: PEM-encoded CA private key for MITM TLS inspection
|
||||
type: string
|
||||
envoy_binary_path:
|
||||
description: Path to envoy binary when mode is envoy. Empty searches $PATH.
|
||||
type: string
|
||||
envoy_admin_port:
|
||||
description: Envoy admin API port for health checks. 0 picks a free port.
|
||||
type: integer
|
||||
required:
|
||||
- enabled
|
||||
InspectionPolicyMinimum:
|
||||
type: object
|
||||
properties:
|
||||
name:
|
||||
description: Human-readable name for this inspection policy
|
||||
type: string
|
||||
example: "Corporate web filtering"
|
||||
description:
|
||||
description: Description
|
||||
type: string
|
||||
enabled:
|
||||
description: Whether this inspection policy is active
|
||||
type: boolean
|
||||
example: true
|
||||
rules:
|
||||
description: L7 inspection rules
|
||||
type: array
|
||||
items:
|
||||
$ref: '#/components/schemas/InspectionPolicyRule'
|
||||
mode:
|
||||
description: Proxy operation mode
|
||||
type: string
|
||||
enum: [ "builtin", "envoy", "external" ]
|
||||
example: "builtin"
|
||||
external_url:
|
||||
description: External proxy URL (HTTP CONNECT or SOCKS5) when mode is external
|
||||
type: string
|
||||
example: "socks5://proxy.corp.com:1080"
|
||||
default_action:
|
||||
description: Action for recognized traffic when no rule matches
|
||||
type: string
|
||||
enum: [ "allow", "block", "inspect" ]
|
||||
example: "allow"
|
||||
redirect_ports:
|
||||
description: Destination ports to intercept at L4. Empty means all ports.
|
||||
type: array
|
||||
items:
|
||||
type: integer
|
||||
example: [80, 443]
|
||||
ca_cert_pem:
|
||||
description: PEM-encoded CA certificate for MITM TLS inspection
|
||||
type: string
|
||||
ca_key_pem:
|
||||
description: PEM-encoded CA private key for MITM TLS inspection
|
||||
type: string
|
||||
envoy_binary_path:
|
||||
description: Path to envoy binary when mode is envoy. Empty searches $PATH.
|
||||
type: string
|
||||
envoy_admin_port:
|
||||
description: Envoy admin API port for health checks. 0 picks a free port.
|
||||
type: integer
|
||||
icap:
|
||||
description: ICAP configuration for external content scanning
|
||||
$ref: '#/components/schemas/InspectionICAPConfig'
|
||||
required:
|
||||
- name
|
||||
- enabled
|
||||
- rules
|
||||
InspectionPolicy:
|
||||
allOf:
|
||||
- type: object
|
||||
properties:
|
||||
id:
|
||||
description: Inspection Policy ID
|
||||
type: string
|
||||
readOnly: true
|
||||
required:
|
||||
- id
|
||||
- $ref: '#/components/schemas/InspectionPolicyMinimum'
|
||||
InspectionPolicyRule:
|
||||
type: object
|
||||
properties:
|
||||
domains:
|
||||
description: Domain patterns to match via SNI or Host header. Supports wildcards (*.example.com).
|
||||
type: array
|
||||
items:
|
||||
type: string
|
||||
example: ["*.gambling.com", "*.betting.com"]
|
||||
networks:
|
||||
description: Destination CIDRs for optional L7 destination filtering
|
||||
type: array
|
||||
items:
|
||||
type: string
|
||||
example: ["10.0.0.0/8"]
|
||||
protocols:
|
||||
description: Protocols this rule applies to. Empty means all.
|
||||
type: array
|
||||
items:
|
||||
type: string
|
||||
enum: [ "http", "https", "h2", "h3", "websocket", "other" ]
|
||||
example: ["https", "h2"]
|
||||
paths:
|
||||
description: URL path patterns. Exact ("/login"), prefix ("/api/*"), contains ("*/admin/*"). HTTPS requires inspect (MITM). Empty means all paths.
|
||||
type: array
|
||||
items:
|
||||
type: string
|
||||
example: ["/admin/*", "/api/internal/*"]
|
||||
action:
|
||||
description: What to do with matched connections
|
||||
type: string
|
||||
enum: [ "allow", "block", "inspect" ]
|
||||
example: block
|
||||
priority:
|
||||
description: Evaluation order. Lower values are evaluated first.
|
||||
type: integer
|
||||
example: 1
|
||||
required:
|
||||
- action
|
||||
- priority
|
||||
InspectionICAPConfig:
|
||||
type: object
|
||||
properties:
|
||||
reqmod_url:
|
||||
description: ICAP REQMOD service URL
|
||||
type: string
|
||||
example: "icap://icap-server:1344/reqmod"
|
||||
respmod_url:
|
||||
description: ICAP RESPMOD service URL
|
||||
type: string
|
||||
example: "icap://icap-server:1344/respmod"
|
||||
max_connections:
|
||||
description: Maximum ICAP connection pool size
|
||||
type: integer
|
||||
example: 8
|
||||
NetworkRouter:
|
||||
allOf:
|
||||
- type: object
|
||||
@@ -7410,6 +7599,144 @@ paths:
|
||||
"$ref": "#/components/responses/forbidden"
|
||||
'500':
|
||||
"$ref": "#/components/responses/internal_error"
|
||||
/api/inspection-policies:
|
||||
get:
|
||||
summary: List all Inspection Policies
|
||||
description: Returns a list of all reusable inspection policy rule sets
|
||||
tags: [ Inspection Policies ]
|
||||
security:
|
||||
- BearerAuth: [ ]
|
||||
- TokenAuth: [ ]
|
||||
responses:
|
||||
'200':
|
||||
description: A JSON Array of Inspection Policies
|
||||
content:
|
||||
application/json:
|
||||
schema:
|
||||
type: array
|
||||
items:
|
||||
$ref: '#/components/schemas/InspectionPolicy'
|
||||
'400':
|
||||
"$ref": "#/components/responses/bad_request"
|
||||
'401':
|
||||
"$ref": "#/components/responses/requires_authentication"
|
||||
'403':
|
||||
"$ref": "#/components/responses/forbidden"
|
||||
'500':
|
||||
"$ref": "#/components/responses/internal_error"
|
||||
post:
|
||||
summary: Create an Inspection Policy
|
||||
description: Creates a reusable inspection policy rule set
|
||||
tags: [ Inspection Policies ]
|
||||
security:
|
||||
- BearerAuth: [ ]
|
||||
- TokenAuth: [ ]
|
||||
requestBody:
|
||||
content:
|
||||
application/json:
|
||||
schema:
|
||||
$ref: '#/components/schemas/InspectionPolicyMinimum'
|
||||
responses:
|
||||
'200':
|
||||
description: An Inspection Policy object
|
||||
content:
|
||||
application/json:
|
||||
schema:
|
||||
$ref: '#/components/schemas/InspectionPolicy'
|
||||
'400':
|
||||
"$ref": "#/components/responses/bad_request"
|
||||
'401':
|
||||
"$ref": "#/components/responses/requires_authentication"
|
||||
'403':
|
||||
"$ref": "#/components/responses/forbidden"
|
||||
'500':
|
||||
"$ref": "#/components/responses/internal_error"
|
||||
/api/inspection-policies/{policyId}:
|
||||
get:
|
||||
summary: Get an Inspection Policy
|
||||
description: Returns an inspection policy rule set
|
||||
tags: [ Inspection Policies ]
|
||||
security:
|
||||
- BearerAuth: [ ]
|
||||
- TokenAuth: [ ]
|
||||
parameters:
|
||||
- in: path
|
||||
name: policyId
|
||||
required: true
|
||||
schema:
|
||||
type: string
|
||||
responses:
|
||||
'200':
|
||||
description: An Inspection Policy object
|
||||
content:
|
||||
application/json:
|
||||
schema:
|
||||
$ref: '#/components/schemas/InspectionPolicy'
|
||||
'400':
|
||||
"$ref": "#/components/responses/bad_request"
|
||||
'401':
|
||||
"$ref": "#/components/responses/requires_authentication"
|
||||
'403':
|
||||
"$ref": "#/components/responses/forbidden"
|
||||
'500':
|
||||
"$ref": "#/components/responses/internal_error"
|
||||
put:
|
||||
summary: Update an Inspection Policy
|
||||
description: Updates an inspection policy rule set
|
||||
tags: [ Inspection Policies ]
|
||||
security:
|
||||
- BearerAuth: [ ]
|
||||
- TokenAuth: [ ]
|
||||
parameters:
|
||||
- in: path
|
||||
name: policyId
|
||||
required: true
|
||||
schema:
|
||||
type: string
|
||||
requestBody:
|
||||
content:
|
||||
application/json:
|
||||
schema:
|
||||
$ref: '#/components/schemas/InspectionPolicyMinimum'
|
||||
responses:
|
||||
'200':
|
||||
description: An Inspection Policy object
|
||||
content:
|
||||
application/json:
|
||||
schema:
|
||||
$ref: '#/components/schemas/InspectionPolicy'
|
||||
'400':
|
||||
"$ref": "#/components/responses/bad_request"
|
||||
'401':
|
||||
"$ref": "#/components/responses/requires_authentication"
|
||||
'403':
|
||||
"$ref": "#/components/responses/forbidden"
|
||||
'500':
|
||||
"$ref": "#/components/responses/internal_error"
|
||||
delete:
|
||||
summary: Delete an Inspection Policy
|
||||
description: Deletes an inspection policy rule set
|
||||
tags: [ Inspection Policies ]
|
||||
security:
|
||||
- BearerAuth: [ ]
|
||||
- TokenAuth: [ ]
|
||||
parameters:
|
||||
- in: path
|
||||
name: policyId
|
||||
required: true
|
||||
schema:
|
||||
type: string
|
||||
responses:
|
||||
'200':
|
||||
description: Successfully deleted
|
||||
'400':
|
||||
"$ref": "#/components/responses/bad_request"
|
||||
'401':
|
||||
"$ref": "#/components/responses/requires_authentication"
|
||||
'403':
|
||||
"$ref": "#/components/responses/forbidden"
|
||||
'500':
|
||||
"$ref": "#/components/responses/internal_error"
|
||||
/api/dns/nameservers:
|
||||
get:
|
||||
summary: List all Nameserver Groups
|
||||
|
||||
@@ -584,6 +584,141 @@ func (e IngressPortAllocationRequestPortRangeProtocol) Valid() bool {
|
||||
}
|
||||
}
|
||||
|
||||
// Defines values for InspectionPolicyDefaultAction.
|
||||
const (
|
||||
InspectionPolicyDefaultActionAllow InspectionPolicyDefaultAction = "allow"
|
||||
InspectionPolicyDefaultActionBlock InspectionPolicyDefaultAction = "block"
|
||||
InspectionPolicyDefaultActionInspect InspectionPolicyDefaultAction = "inspect"
|
||||
)
|
||||
|
||||
// Valid indicates whether the value is a known member of the InspectionPolicyDefaultAction enum.
|
||||
func (e InspectionPolicyDefaultAction) Valid() bool {
|
||||
switch e {
|
||||
case InspectionPolicyDefaultActionAllow:
|
||||
return true
|
||||
case InspectionPolicyDefaultActionBlock:
|
||||
return true
|
||||
case InspectionPolicyDefaultActionInspect:
|
||||
return true
|
||||
default:
|
||||
return false
|
||||
}
|
||||
}
|
||||
|
||||
// Defines values for InspectionPolicyMode.
|
||||
const (
|
||||
InspectionPolicyModeBuiltin InspectionPolicyMode = "builtin"
|
||||
InspectionPolicyModeEnvoy InspectionPolicyMode = "envoy"
|
||||
InspectionPolicyModeExternal InspectionPolicyMode = "external"
|
||||
)
|
||||
|
||||
// Valid indicates whether the value is a known member of the InspectionPolicyMode enum.
|
||||
func (e InspectionPolicyMode) Valid() bool {
|
||||
switch e {
|
||||
case InspectionPolicyModeBuiltin:
|
||||
return true
|
||||
case InspectionPolicyModeEnvoy:
|
||||
return true
|
||||
case InspectionPolicyModeExternal:
|
||||
return true
|
||||
default:
|
||||
return false
|
||||
}
|
||||
}
|
||||
|
||||
// Defines values for InspectionPolicyMinimumDefaultAction.
|
||||
const (
|
||||
InspectionPolicyMinimumDefaultActionAllow InspectionPolicyMinimumDefaultAction = "allow"
|
||||
InspectionPolicyMinimumDefaultActionBlock InspectionPolicyMinimumDefaultAction = "block"
|
||||
InspectionPolicyMinimumDefaultActionInspect InspectionPolicyMinimumDefaultAction = "inspect"
|
||||
)
|
||||
|
||||
// Valid indicates whether the value is a known member of the InspectionPolicyMinimumDefaultAction enum.
|
||||
func (e InspectionPolicyMinimumDefaultAction) Valid() bool {
|
||||
switch e {
|
||||
case InspectionPolicyMinimumDefaultActionAllow:
|
||||
return true
|
||||
case InspectionPolicyMinimumDefaultActionBlock:
|
||||
return true
|
||||
case InspectionPolicyMinimumDefaultActionInspect:
|
||||
return true
|
||||
default:
|
||||
return false
|
||||
}
|
||||
}
|
||||
|
||||
// Defines values for InspectionPolicyMinimumMode.
|
||||
const (
|
||||
InspectionPolicyMinimumModeBuiltin InspectionPolicyMinimumMode = "builtin"
|
||||
InspectionPolicyMinimumModeEnvoy InspectionPolicyMinimumMode = "envoy"
|
||||
InspectionPolicyMinimumModeExternal InspectionPolicyMinimumMode = "external"
|
||||
)
|
||||
|
||||
// Valid indicates whether the value is a known member of the InspectionPolicyMinimumMode enum.
|
||||
func (e InspectionPolicyMinimumMode) Valid() bool {
|
||||
switch e {
|
||||
case InspectionPolicyMinimumModeBuiltin:
|
||||
return true
|
||||
case InspectionPolicyMinimumModeEnvoy:
|
||||
return true
|
||||
case InspectionPolicyMinimumModeExternal:
|
||||
return true
|
||||
default:
|
||||
return false
|
||||
}
|
||||
}
|
||||
|
||||
// Defines values for InspectionPolicyRuleAction.
|
||||
const (
|
||||
InspectionPolicyRuleActionAllow InspectionPolicyRuleAction = "allow"
|
||||
InspectionPolicyRuleActionBlock InspectionPolicyRuleAction = "block"
|
||||
InspectionPolicyRuleActionInspect InspectionPolicyRuleAction = "inspect"
|
||||
)
|
||||
|
||||
// Valid indicates whether the value is a known member of the InspectionPolicyRuleAction enum.
|
||||
func (e InspectionPolicyRuleAction) Valid() bool {
|
||||
switch e {
|
||||
case InspectionPolicyRuleActionAllow:
|
||||
return true
|
||||
case InspectionPolicyRuleActionBlock:
|
||||
return true
|
||||
case InspectionPolicyRuleActionInspect:
|
||||
return true
|
||||
default:
|
||||
return false
|
||||
}
|
||||
}
|
||||
|
||||
// Defines values for InspectionPolicyRuleProtocols.
|
||||
const (
|
||||
InspectionPolicyRuleProtocolsH2 InspectionPolicyRuleProtocols = "h2"
|
||||
InspectionPolicyRuleProtocolsH3 InspectionPolicyRuleProtocols = "h3"
|
||||
InspectionPolicyRuleProtocolsHttp InspectionPolicyRuleProtocols = "http"
|
||||
InspectionPolicyRuleProtocolsHttps InspectionPolicyRuleProtocols = "https"
|
||||
InspectionPolicyRuleProtocolsOther InspectionPolicyRuleProtocols = "other"
|
||||
InspectionPolicyRuleProtocolsWebsocket InspectionPolicyRuleProtocols = "websocket"
|
||||
)
|
||||
|
||||
// Valid indicates whether the value is a known member of the InspectionPolicyRuleProtocols enum.
|
||||
func (e InspectionPolicyRuleProtocols) Valid() bool {
|
||||
switch e {
|
||||
case InspectionPolicyRuleProtocolsH2:
|
||||
return true
|
||||
case InspectionPolicyRuleProtocolsH3:
|
||||
return true
|
||||
case InspectionPolicyRuleProtocolsHttp:
|
||||
return true
|
||||
case InspectionPolicyRuleProtocolsHttps:
|
||||
return true
|
||||
case InspectionPolicyRuleProtocolsOther:
|
||||
return true
|
||||
case InspectionPolicyRuleProtocolsWebsocket:
|
||||
return true
|
||||
default:
|
||||
return false
|
||||
}
|
||||
}
|
||||
|
||||
// Defines values for IntegrationResponsePlatform.
|
||||
const (
|
||||
IntegrationResponsePlatformDatadog IntegrationResponsePlatform = "datadog"
|
||||
@@ -896,6 +1031,48 @@ func (e ReverseProxyDomainType) Valid() bool {
|
||||
}
|
||||
}
|
||||
|
||||
// Defines values for RouterInspectionConfigDefaultAction.
|
||||
const (
|
||||
RouterInspectionConfigDefaultActionAllow RouterInspectionConfigDefaultAction = "allow"
|
||||
RouterInspectionConfigDefaultActionBlock RouterInspectionConfigDefaultAction = "block"
|
||||
RouterInspectionConfigDefaultActionInspect RouterInspectionConfigDefaultAction = "inspect"
|
||||
)
|
||||
|
||||
// Valid indicates whether the value is a known member of the RouterInspectionConfigDefaultAction enum.
|
||||
func (e RouterInspectionConfigDefaultAction) Valid() bool {
|
||||
switch e {
|
||||
case RouterInspectionConfigDefaultActionAllow:
|
||||
return true
|
||||
case RouterInspectionConfigDefaultActionBlock:
|
||||
return true
|
||||
case RouterInspectionConfigDefaultActionInspect:
|
||||
return true
|
||||
default:
|
||||
return false
|
||||
}
|
||||
}
|
||||
|
||||
// Defines values for RouterInspectionConfigMode.
|
||||
const (
|
||||
RouterInspectionConfigModeBuiltin RouterInspectionConfigMode = "builtin"
|
||||
RouterInspectionConfigModeEnvoy RouterInspectionConfigMode = "envoy"
|
||||
RouterInspectionConfigModeExternal RouterInspectionConfigMode = "external"
|
||||
)
|
||||
|
||||
// Valid indicates whether the value is a known member of the RouterInspectionConfigMode enum.
|
||||
func (e RouterInspectionConfigMode) Valid() bool {
|
||||
switch e {
|
||||
case RouterInspectionConfigModeBuiltin:
|
||||
return true
|
||||
case RouterInspectionConfigModeEnvoy:
|
||||
return true
|
||||
case RouterInspectionConfigModeExternal:
|
||||
return true
|
||||
default:
|
||||
return false
|
||||
}
|
||||
}
|
||||
|
||||
// Defines values for SentinelOneMatchAttributesNetworkStatus.
|
||||
const (
|
||||
SentinelOneMatchAttributesNetworkStatusConnected SentinelOneMatchAttributesNetworkStatus = "connected"
|
||||
@@ -2464,6 +2641,140 @@ type IngressPortAllocationRequestPortRange struct {
|
||||
// IngressPortAllocationRequestPortRangeProtocol The protocol accepted by the port range
|
||||
type IngressPortAllocationRequestPortRangeProtocol string
|
||||
|
||||
// InspectionICAPConfig defines model for InspectionICAPConfig.
|
||||
type InspectionICAPConfig struct {
|
||||
// MaxConnections Maximum ICAP connection pool size
|
||||
MaxConnections *int `json:"max_connections,omitempty"`
|
||||
|
||||
// ReqmodUrl ICAP REQMOD service URL
|
||||
ReqmodUrl *string `json:"reqmod_url,omitempty"`
|
||||
|
||||
// RespmodUrl ICAP RESPMOD service URL
|
||||
RespmodUrl *string `json:"respmod_url,omitempty"`
|
||||
}
|
||||
|
||||
// InspectionPolicy defines model for InspectionPolicy.
|
||||
type InspectionPolicy struct {
|
||||
// CaCertPem PEM-encoded CA certificate for MITM TLS inspection
|
||||
CaCertPem *string `json:"ca_cert_pem,omitempty"`
|
||||
|
||||
// CaKeyPem PEM-encoded CA private key for MITM TLS inspection
|
||||
CaKeyPem *string `json:"ca_key_pem,omitempty"`
|
||||
|
||||
// DefaultAction Action for recognized traffic when no rule matches
|
||||
DefaultAction *InspectionPolicyDefaultAction `json:"default_action,omitempty"`
|
||||
|
||||
// Description Description
|
||||
Description *string `json:"description,omitempty"`
|
||||
|
||||
// Enabled Whether this inspection policy is active
|
||||
Enabled bool `json:"enabled"`
|
||||
|
||||
// EnvoyAdminPort Envoy admin API port for health checks. 0 picks a free port.
|
||||
EnvoyAdminPort *int `json:"envoy_admin_port,omitempty"`
|
||||
|
||||
// EnvoyBinaryPath Path to envoy binary when mode is envoy. Empty searches $PATH.
|
||||
EnvoyBinaryPath *string `json:"envoy_binary_path,omitempty"`
|
||||
|
||||
// ExternalUrl External proxy URL (HTTP CONNECT or SOCKS5) when mode is external
|
||||
ExternalUrl *string `json:"external_url,omitempty"`
|
||||
Icap *InspectionICAPConfig `json:"icap,omitempty"`
|
||||
|
||||
// Id Inspection Policy ID
|
||||
Id *string `json:"id,omitempty"`
|
||||
|
||||
// Mode Proxy operation mode
|
||||
Mode *InspectionPolicyMode `json:"mode,omitempty"`
|
||||
|
||||
// Name Human-readable name for this inspection policy
|
||||
Name string `json:"name"`
|
||||
|
||||
// RedirectPorts Destination ports to intercept at L4. Empty means all ports.
|
||||
RedirectPorts *[]int `json:"redirect_ports,omitempty"`
|
||||
|
||||
// Rules L7 inspection rules
|
||||
Rules []InspectionPolicyRule `json:"rules"`
|
||||
}
|
||||
|
||||
// InspectionPolicyDefaultAction Action for recognized traffic when no rule matches
|
||||
type InspectionPolicyDefaultAction string
|
||||
|
||||
// InspectionPolicyMode Proxy operation mode
|
||||
type InspectionPolicyMode string
|
||||
|
||||
// InspectionPolicyMinimum defines model for InspectionPolicyMinimum.
|
||||
type InspectionPolicyMinimum struct {
|
||||
// CaCertPem PEM-encoded CA certificate for MITM TLS inspection
|
||||
CaCertPem *string `json:"ca_cert_pem,omitempty"`
|
||||
|
||||
// CaKeyPem PEM-encoded CA private key for MITM TLS inspection
|
||||
CaKeyPem *string `json:"ca_key_pem,omitempty"`
|
||||
|
||||
// DefaultAction Action for recognized traffic when no rule matches
|
||||
DefaultAction *InspectionPolicyMinimumDefaultAction `json:"default_action,omitempty"`
|
||||
|
||||
// Description Description
|
||||
Description *string `json:"description,omitempty"`
|
||||
|
||||
// Enabled Whether this inspection policy is active
|
||||
Enabled bool `json:"enabled"`
|
||||
|
||||
// EnvoyAdminPort Envoy admin API port for health checks. 0 picks a free port.
|
||||
EnvoyAdminPort *int `json:"envoy_admin_port,omitempty"`
|
||||
|
||||
// EnvoyBinaryPath Path to envoy binary when mode is envoy. Empty searches $PATH.
|
||||
EnvoyBinaryPath *string `json:"envoy_binary_path,omitempty"`
|
||||
|
||||
// ExternalUrl External proxy URL (HTTP CONNECT or SOCKS5) when mode is external
|
||||
ExternalUrl *string `json:"external_url,omitempty"`
|
||||
Icap *InspectionICAPConfig `json:"icap,omitempty"`
|
||||
|
||||
// Mode Proxy operation mode
|
||||
Mode *InspectionPolicyMinimumMode `json:"mode,omitempty"`
|
||||
|
||||
// Name Human-readable name for this inspection policy
|
||||
Name string `json:"name"`
|
||||
|
||||
// RedirectPorts Destination ports to intercept at L4. Empty means all ports.
|
||||
RedirectPorts *[]int `json:"redirect_ports,omitempty"`
|
||||
|
||||
// Rules L7 inspection rules
|
||||
Rules []InspectionPolicyRule `json:"rules"`
|
||||
}
|
||||
|
||||
// InspectionPolicyMinimumDefaultAction Action for recognized traffic when no rule matches
|
||||
type InspectionPolicyMinimumDefaultAction string
|
||||
|
||||
// InspectionPolicyMinimumMode Proxy operation mode
|
||||
type InspectionPolicyMinimumMode string
|
||||
|
||||
// InspectionPolicyRule defines model for InspectionPolicyRule.
|
||||
type InspectionPolicyRule struct {
|
||||
// Action What to do with matched connections
|
||||
Action InspectionPolicyRuleAction `json:"action"`
|
||||
|
||||
// Domains Domain patterns to match via SNI or Host header. Supports wildcards (*.example.com).
|
||||
Domains *[]string `json:"domains,omitempty"`
|
||||
|
||||
// Networks Destination CIDRs for optional L7 destination filtering
|
||||
Networks *[]string `json:"networks,omitempty"`
|
||||
|
||||
// Paths URL path patterns. Exact ("/login"), prefix ("/api/*"), contains ("*/admin/*"). HTTPS requires inspect (MITM). Empty means all paths.
|
||||
Paths *[]string `json:"paths,omitempty"`
|
||||
|
||||
// Priority Evaluation order. Lower values are evaluated first.
|
||||
Priority int `json:"priority"`
|
||||
|
||||
// Protocols Protocols this rule applies to. Empty means all.
|
||||
Protocols *[]InspectionPolicyRuleProtocols `json:"protocols,omitempty"`
|
||||
}
|
||||
|
||||
// InspectionPolicyRuleAction What to do with matched connections
|
||||
type InspectionPolicyRuleAction string
|
||||
|
||||
// InspectionPolicyRuleProtocols defines model for InspectionPolicyRule.Protocols.
|
||||
type InspectionPolicyRuleProtocols string
|
||||
|
||||
// InstanceStatus Instance status information
|
||||
type InstanceStatus struct {
|
||||
// SetupRequired Indicates whether the instance requires initial setup
|
||||
@@ -2774,7 +3085,8 @@ type NetworkRouter struct {
|
||||
Enabled bool `json:"enabled"`
|
||||
|
||||
// Id Network Router Id
|
||||
Id string `json:"id"`
|
||||
Id string `json:"id"`
|
||||
Inspection *RouterInspectionConfig `json:"inspection,omitempty"`
|
||||
|
||||
// Masquerade Indicate if peer should masquerade traffic to this route's prefix
|
||||
Masquerade bool `json:"masquerade"`
|
||||
@@ -2792,7 +3104,8 @@ type NetworkRouter struct {
|
||||
// NetworkRouterRequest defines model for NetworkRouterRequest.
|
||||
type NetworkRouterRequest struct {
|
||||
// Enabled Network router status
|
||||
Enabled bool `json:"enabled"`
|
||||
Enabled bool `json:"enabled"`
|
||||
Inspection *RouterInspectionConfig `json:"inspection,omitempty"`
|
||||
|
||||
// Masquerade Indicate if peer should masquerade traffic to this route's prefix
|
||||
Masquerade bool `json:"masquerade"`
|
||||
@@ -3380,6 +3693,9 @@ type Policy struct {
|
||||
// Id Policy ID
|
||||
Id *string `json:"id,omitempty"`
|
||||
|
||||
// InspectionPolicies Inspection policy IDs applied to traffic matching this policy
|
||||
InspectionPolicies *[]string `json:"inspection_policies,omitempty"`
|
||||
|
||||
// Name Policy name identifier
|
||||
Name string `json:"name"`
|
||||
|
||||
@@ -3398,6 +3714,9 @@ type PolicyCreate struct {
|
||||
// Enabled Policy status
|
||||
Enabled bool `json:"enabled"`
|
||||
|
||||
// InspectionPolicies Inspection policy IDs applied to traffic matching this policy
|
||||
InspectionPolicies *[]string `json:"inspection_policies,omitempty"`
|
||||
|
||||
// Name Policy name identifier
|
||||
Name string `json:"name"`
|
||||
|
||||
@@ -3558,6 +3877,9 @@ type PolicyUpdate struct {
|
||||
// Enabled Policy status
|
||||
Enabled bool `json:"enabled"`
|
||||
|
||||
// InspectionPolicies Inspection policy IDs applied to traffic matching this policy. When set, traffic is routed through a transparent proxy on the destination network's routing peers.
|
||||
InspectionPolicies *[]string `json:"inspection_policies,omitempty"`
|
||||
|
||||
// Name Policy name identifier
|
||||
Name string `json:"name"`
|
||||
|
||||
@@ -3874,6 +4196,43 @@ type RouteRequest struct {
|
||||
SkipAutoApply *bool `json:"skip_auto_apply,omitempty"`
|
||||
}
|
||||
|
||||
// RouterInspectionConfig defines model for RouterInspectionConfig.
|
||||
type RouterInspectionConfig struct {
|
||||
// CaCertPem PEM-encoded CA certificate for MITM TLS inspection
|
||||
CaCertPem *string `json:"ca_cert_pem,omitempty"`
|
||||
|
||||
// CaKeyPem PEM-encoded CA private key for MITM TLS inspection
|
||||
CaKeyPem *string `json:"ca_key_pem,omitempty"`
|
||||
|
||||
// DefaultAction Action when no inspection rule matches
|
||||
DefaultAction *RouterInspectionConfigDefaultAction `json:"default_action,omitempty"`
|
||||
|
||||
// Enabled Whether traffic inspection is active on this routing peer
|
||||
Enabled bool `json:"enabled"`
|
||||
|
||||
// EnvoyAdminPort Envoy admin API port for health checks. 0 picks a free port.
|
||||
EnvoyAdminPort *int `json:"envoy_admin_port,omitempty"`
|
||||
|
||||
// EnvoyBinaryPath Path to envoy binary when mode is envoy. Empty searches $PATH.
|
||||
EnvoyBinaryPath *string `json:"envoy_binary_path,omitempty"`
|
||||
|
||||
// ExternalUrl External proxy URL (http:// or socks5://) when mode is external
|
||||
ExternalUrl *string `json:"external_url,omitempty"`
|
||||
Icap *InspectionICAPConfig `json:"icap,omitempty"`
|
||||
|
||||
// Mode Inspection mode
|
||||
Mode *RouterInspectionConfigMode `json:"mode,omitempty"`
|
||||
|
||||
// RedirectPorts Destination ports to intercept. Empty means all ports.
|
||||
RedirectPorts *[]int `json:"redirect_ports,omitempty"`
|
||||
}
|
||||
|
||||
// RouterInspectionConfigDefaultAction Action when no inspection rule matches
|
||||
type RouterInspectionConfigDefaultAction string
|
||||
|
||||
// RouterInspectionConfigMode Inspection mode
|
||||
type RouterInspectionConfigMode string
|
||||
|
||||
// RulePortRange Policy rule affected ports range
|
||||
type RulePortRange struct {
|
||||
// End The ending port of the range
|
||||
@@ -4959,6 +5318,12 @@ type PostApiIngressPeersJSONRequestBody = IngressPeerCreateRequest
|
||||
// PutApiIngressPeersIngressPeerIdJSONRequestBody defines body for PutApiIngressPeersIngressPeerId for application/json ContentType.
|
||||
type PutApiIngressPeersIngressPeerIdJSONRequestBody = IngressPeerUpdateRequest
|
||||
|
||||
// PostApiInspectionPoliciesJSONRequestBody defines body for PostApiInspectionPolicies for application/json ContentType.
|
||||
type PostApiInspectionPoliciesJSONRequestBody = InspectionPolicyMinimum
|
||||
|
||||
// PutApiInspectionPoliciesPolicyIdJSONRequestBody defines body for PutApiInspectionPoliciesPolicyId for application/json ContentType.
|
||||
type PutApiInspectionPoliciesPolicyIdJSONRequestBody = InspectionPolicyMinimum
|
||||
|
||||
// CreateAzureIntegrationJSONRequestBody defines body for CreateAzureIntegration for application/json ContentType.
|
||||
type CreateAzureIntegrationJSONRequestBody = CreateAzureIntegrationRequest
|
||||
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -387,6 +387,9 @@ message NetworkMap {
|
||||
|
||||
// SSHAuth represents SSH authorization configuration
|
||||
SSHAuth sshAuth = 13;
|
||||
|
||||
// TransparentProxyConfig represents transparent proxy configuration for this peer
|
||||
TransparentProxyConfig transparentProxyConfig = 14;
|
||||
}
|
||||
|
||||
message SSHAuth {
|
||||
@@ -684,3 +687,90 @@ message StopExposeRequest {
|
||||
}
|
||||
|
||||
message StopExposeResponse {}
|
||||
|
||||
// TransparentProxyConfig configures the transparent forward proxy on a routing peer.
|
||||
message TransparentProxyConfig {
|
||||
bool enabled = 1;
|
||||
TransparentProxyMode mode = 2;
|
||||
// External proxy URL for MODE_EXTERNAL (http:// or socks5://)
|
||||
string externalProxyUrl = 3;
|
||||
TransparentProxyAction defaultAction = 4;
|
||||
|
||||
// L3/L4 interception: which traffic gets redirected to the proxy.
|
||||
// Admin decides: activate for these users/subnets on these ports.
|
||||
// Used for both kernel TPROXY rules and userspace forwarder source filtering.
|
||||
repeated string redirectSources = 5;
|
||||
// Destination ports to intercept. Empty means all ports.
|
||||
repeated uint32 redirectPorts = 6;
|
||||
|
||||
// L7 inspection rules: what the proxy does with intercepted traffic.
|
||||
repeated TransparentProxyRule rules = 7;
|
||||
|
||||
TransparentProxyICAPConfig icap = 8;
|
||||
// MITM CA certificate in PEM format
|
||||
bytes caCertPem = 9;
|
||||
// MITM CA private key in PEM format
|
||||
bytes caKeyPem = 10;
|
||||
// TPROXY listen port for kernel mode. 0 means auto-assign.
|
||||
uint32 listenPort = 11;
|
||||
|
||||
// Envoy sidecar configuration (MODE_ENVOY only)
|
||||
string envoyBinaryPath = 12;
|
||||
uint32 envoyAdminPort = 13;
|
||||
TransparentProxyEnvoySnippets envoySnippets = 14;
|
||||
}
|
||||
|
||||
enum TransparentProxyMode {
|
||||
TP_MODE_BUILTIN = 0;
|
||||
TP_MODE_EXTERNAL = 1;
|
||||
TP_MODE_ENVOY = 2;
|
||||
}
|
||||
|
||||
enum TransparentProxyAction {
|
||||
TP_ACTION_ALLOW = 0;
|
||||
TP_ACTION_BLOCK = 1;
|
||||
TP_ACTION_INSPECT = 2;
|
||||
}
|
||||
|
||||
enum TransparentProxyProtocol {
|
||||
TP_PROTO_ALL = 0;
|
||||
TP_PROTO_HTTP = 1;
|
||||
TP_PROTO_HTTPS = 2;
|
||||
TP_PROTO_H2 = 3;
|
||||
TP_PROTO_H3 = 4;
|
||||
TP_PROTO_WEBSOCKET = 5;
|
||||
TP_PROTO_OTHER = 6;
|
||||
}
|
||||
|
||||
// TransparentProxyRule is an L7 inspection rule evaluated by the proxy engine.
|
||||
message TransparentProxyRule {
|
||||
string id = 1;
|
||||
// Domain patterns to match via SNI or Host header (e.g., *.example.com)
|
||||
repeated string domains = 2;
|
||||
// Destination CIDRs for optional L7 destination filtering
|
||||
repeated string networks = 3;
|
||||
// Destination ports for optional per-rule port filtering
|
||||
repeated uint32 ports = 4;
|
||||
TransparentProxyAction action = 5;
|
||||
int32 priority = 6;
|
||||
// Protocols to match. Empty means all protocols.
|
||||
repeated TransparentProxyProtocol protocols = 7;
|
||||
// URL path patterns to match (HTTP only, requires inspect for HTTPS).
|
||||
// Supports prefix ("/api/"), exact ("/login"), and wildcard ("/admin/*").
|
||||
repeated string paths = 8;
|
||||
}
|
||||
|
||||
message TransparentProxyICAPConfig {
|
||||
string reqmodUrl = 1;
|
||||
string respmodUrl = 2;
|
||||
int32 maxConnections = 3;
|
||||
}
|
||||
|
||||
message TransparentProxyEnvoySnippets {
|
||||
// YAML injected into the HCM filter chain before the router filter.
|
||||
string httpFilters = 1;
|
||||
// YAML for additional upstream clusters referenced by filters.
|
||||
string clusters = 2;
|
||||
// YAML injected into the TLS filter chain before tcp_proxy (L4 filters).
|
||||
string networkFilters = 3;
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user