syntax = "proto3";

option go_package = "sensor";
option cc_enable_arenas = true;

import "google/protobuf/timestamp.proto";
import "internalapi/sensor/network_enums.proto";
import "storage/network_flow.proto";

package sensor;

message NetworkConnectionInfo {
    // Network connections that were added from the last time state was sent.
    repeated NetworkConnection updated_connections  = 1;

    // Listening endpoints that were added from the last time state was sent.
    repeated NetworkEndpoint updated_endpoints = 3;

    //For active connections, the timestamp of the entire message serves as the latest timestamp
    //that connection was deemed active
    google.protobuf.Timestamp time                  = 2;
}

// NetworkConnection tracks connection information about client and server.
message NetworkConnection {

    SocketFamily socket_family       = 1;
    NetworkAddress local_address        = 2;
    NetworkAddress remote_address       = 3;
    storage.L4Protocol protocol            = 4;
    ClientServerRole role            = 5;
    string container_id                 = 6;

    // If this connection was closed, this gives the timestamp when it was closed. If this is unset, we treat it as an
    // open connection.
    google.protobuf.Timestamp close_timestamp         = 11;
}

message NetworkEndpoint {
    SocketFamily socket_family    = 1;
    storage.L4Protocol protocol   = 2;
    // The address_data part might be empty to indicate "all interfaces", or to simply save space.
    NetworkAddress listen_address = 3;

    string container_id = 4;

    // If we're no longer listening on this endpoint, this gives the timestamp when the listen socket
    // was shutdown. If this is unset, we treat it as an actively listening endpoint.
    google.protobuf.Timestamp close_timestamp = 5;
}

message NetworkAddress {
    bytes  address_data = 1;  // semantics determined by socket_family of the given connection
    uint32 port         = 2;  // may be 0 if not applicable (e.g., icmp).
    // Represents an IPV4 or IPV6 network. First 4/16 bytes representing network address whereas following byte represents
    // the length of network prefix. If used, this field must have 5 or 17 bytes; otherwise it should be discarded.
    // `ip_network` and `address_data` usage should be mutually exclusive.
    bytes  ip_network   = 3;
}

