flowlog.proto

// Copyright(c) 2017-2019 Zededa, Inc.
// SPDX-License-Identifier: Apache-2.0

syntax = "proto3";

import "google/protobuf/timestamp.proto";

package org.lfedge.eve.flowlog;
option go_package  = "github.com/lf-edge/eve-api/go/flowlog";
option java_package = "org.lfedge.eve.flowlog";

message IpFlow {
  string src = 1;          // Source address
  int32  srcPort = 2;      // Source port
  string dest = 3;         // Destination address
  int32  destPort = 4;     // Destination port
  int32  protocol = 5;     // Protocol
}

message ScopeInfo {
  string uuid = 1;           // UUID of the instance or device
  string intf = 2;           // User visible name
  string localIntf = 3;      // Internal name of the interface
  string netInstUUID = 4;    // UUID of the network instance
}

enum ACLAction {
  ActionUnknown = 0;
  ActionDrop = 1;
  ActionAccept = 2;
}

message FlowRecord {
  IpFlow flow = 1;
  bool inbound = 2;                         // true if the connection originated from outside
  int32 aclId = 3;                          // Matching ACL
  string aclName = 4;                       // Name of the ACL
  // deprecated = 5;
  google.protobuf.Timestamp startTime = 6;  // Always non-zero
  google.protobuf.Timestamp endTime = 7;    // Zero() if flow has not ended
  int64 txBytes = 8;
  int64 txPkts = 9;
  int64 rxBytes = 10;
  int64 rxPkts = 11;
  ACLAction action = 12;
}

message DnsRequest {
  string hostName = 1;                          // Host name
  repeated string addrs = 2;                    // Ipv4 or Ipv6 address
  google.protobuf.Timestamp requestTime = 3;    // Time of DNS request
  int32 aclNum = 4;                             // ACL that resulted in DNS lookup
}

// This is the request payload for POST /api/v1/edgeDevice/flowlog
// FlowMessage carries device logs to the controller.
// The message is assumed to be protected by a TLS session bound to the
// device certificate.
message FlowMessage {
  string devId = 1;                 // Device UUID
  ScopeInfo scope = 2;
  repeated FlowRecord flows = 3;
  repeated DnsRequest dnsReqs = 4;
}