proxy

type BenchmarkResult struct {
	OpsPerSec   float64
	NsPerOp     int64
	BytesPerOp  int64
	AllocsPerOp int64
}

type HTTP2AwareProxy struct {
	*MITMProxy
	// contains filtered or unexported fields
}

type HTTP2Config struct {
	// EnableHTTP2 enables HTTP/2 support
	EnableHTTP2 bool

	// MaxConcurrentStreams limits concurrent streams per connection
	MaxConcurrentStreams uint32

	// MaxReadFrameSize is the maximum frame size to accept
	MaxReadFrameSize uint32

	// MaxDecoderHeaderTableSize controls header compression table size
	MaxDecoderHeaderTableSize uint32

	// MaxEncoderHeaderTableSize controls response header compression
	MaxEncoderHeaderTableSize uint32

	// IdleTimeout configures the idle connection timeout
	IdleTimeout time.Duration

	// PreferHTTP2Protocol tries to negotiate HTTP/2 first
	PreferHTTP2Protocol bool

	// EnablePush enables HTTP/2 server push (disabled by default for security)
	EnablePush bool
}

type HTTP2RateLimiter struct {
	// contains filtered or unexported fields
}

type HTTP3AwareProxy struct {
	// Embedded proxy for core functionality
	*Proxy

	// HTTP/3 specific config
	HTTP3Config *HTTP3Config
	// contains filtered or unexported fields
}

type HTTP3Config struct {
	// Enabled enables HTTP/3 support via TLS ALPN
	Enabled bool

	// ListenAddr is the address to listen on for HTTP/3
	ListenAddr string

	// Port is the port for HTTP/3 (default: 8443)
	Port int

	// MaxConcurrentStreams is the max concurrent streams per connection
	MaxConcurrentStreams uint32

	// MaxIdleConns is the max idle connections
	MaxIdleConns int

	// IdleTimeout is the idle connection timeout
	IdleTimeout time.Duration

	// ReadTimeout is the read timeout
	ReadTimeout time.Duration

	// WriteTimeout is the write timeout
	WriteTimeout time.Duration

	// HandleGzip enables gzip handling
	HandleGzip bool
}

type HTTP3Metrics struct {
	ActiveConnections int64
	TotalRequests     int64
	BytesReceived     int64
	BytesSent         int64
}

type Health struct {
	Status      string  `json:"status"`
	Uptime      float64 `json:"uptime"`
	MemoryUsage int64   `json:"memory_usage"`
	Goroutines  int32   `json:"goroutines"`
}

type Inspector interface {
	InspectRequest(req *Request) ([]Violation, error)
	InspectResponse(resp *Response) ([]Violation, error)
}

type MITMAttestation struct {
	// contains filtered or unexported fields
}

type MITMAttestationConfig struct {
	// Enable attestation checks
	Enabled bool

	// Require chain verification before interception
	RequireChainVerification bool

	// Enable CRL checking
	RequireCRL bool

	// Enable OCSP checking
	RequireOCSP bool

	// CRL check timeout
	CRLTimeout time.Duration

	// OCSP check timeout
	OCSPTimeout time.Duration

	// Trust anchors for certificate validation
	TrustAnchors []*pkiattest.TrustAnchor

	// Enable backdoor detection
	BackdoorPrevention bool

	// Fail closed (block on attestation failure)
	FailClosed bool

	// Log attestation results
	LogResults bool

	// Cache attestation results
	CacheResults bool

	// Cache TTL
	CacheTTL time.Duration
}

type MITMAttestationResult struct {
	Valid               bool
	Reason              string
	Certificate         *x509.Certificate
	ChainVerified       bool
	RevocationChecked   bool
	BackdoorChecked     bool
	BackdoorDetected    bool
	AttestationDuration time.Duration
	Timestamp           time.Time
}

type MITMConfig struct {
	// Enable MITM mode
	Enabled bool

	// Certificate Authority for generating certificates
	CA *tlspkg.CertificateAuthority

	// Listen address for MITM proxy
	BindAddress string

	// Upstream proxy (optional, for chaining)
	UpstreamProxy string

	// Maximum concurrent connections
	MaxConnections int

	// Connection timeout
	Timeout time.Duration

	// Enable TLS 1.3
	EnableTLS13 bool

	// Skip TLS verification for upstream connections
	InsecureSkipVerify bool

	// Enable content scanning
	EnableScanning bool

	// Scanner for content inspection
	Scanner *scanner.Scanner

	// Compliance manager for ATLAS/NIST checks
	ComplianceManager *compliance.ComplianceManager

	// Attestation configuration for PKI certificate validation
	AttestationConfig *MITMAttestationConfig
}

type MITMProxy struct {
	// contains filtered or unexported fields
}

type MLAnomalyResult struct {
	Anomalies        []ml.Anomaly   `json:"anomalies"`
	SeverityCounts   map[string]int `json:"severity_counts"`
	ShouldBlock      bool           `json:"should_block"`
	BlockingReason   string         `json:"blocking_reason"`
	AnalysisDuration time.Duration  `json:"analysis_duration_ms"`
	Method           string         `json:"method"`
	Path             string         `json:"path"`
	Size             int64          `json:"size"`
}

type MLMiddleware struct {
	// contains filtered or unexported fields
}

type MLMiddlewareConfig struct {
	// Enabled toggles ML anomaly detection on/off
	Enabled bool `json:"enabled"`

	// Sensitivity determines the threshold for anomaly detection
	// Options: "low", "medium", "high", "paranoid"
	Sensitivity string `json:"sensitivity"`

	// BlockOnHighSeverity determines if high-severity anomalies should be blocked
	BlockOnHighSeverity bool `json:"block_on_high_severity"`

	// BlockOnCriticalSeverity determines if critical-severity anomalies should be blocked
	BlockOnCriticalSeverity bool `json:"block_on_critical_severity"`

	// MinScoreToBlock minimum score to trigger blocking
	MinScoreToBlock float64 `json:"min_score_to_block"`

	// LogAllAnomalies whether to log all anomalies or only blocked ones
	LogAllAnomalies bool `json:"log_all_anomalies"`

	// SampleRate percentage of requests to analyze (0-100)
	// Use for high-throughput environments
	SampleRate int `json:"sample_rate"`

	// ExcludedPaths URL paths to exclude from ML analysis
	ExcludedPaths []string `json:"excluded_paths"`

	// ExcludedMethods HTTP methods to exclude from ML analysis
	ExcludedMethods []string `json:"excluded_methods"`

	// Detector holds the ML detector instance (set automatically)
	Detector *ml.Detector `json:"-"`
}

type MLOptions struct {
	// ML Detection settings
	EnableMLDetection         bool
	MLSensitivity             string
	MLBlockOnCriticalSeverity bool
	MLBlockOnHighSeverity     bool
	MLMinScoreToBlock         float64
	MLSampleRate              int
	MLExcludedPaths           []string
	MLExcludedMethods         []string

	// Advanced ML features
	EnablePromptInjectionDetection bool
	PromptInjectionSensitivity     int
	EnableContentAnalysis          bool
	EnableBehavioralAnalysis       bool
}

type MLStats struct {
	TotalRequests    int64            `json:"total_requests"`
	AnalyzedRequests int64            `json:"analyzed_requests"`
	BlockedRequests  int64            `json:"blocked_requests"`
	AnomalyCounts    map[string]int64 `json:"anomaly_counts"`
	LastUpdate       time.Time        `json:"last_update"`
	// contains filtered or unexported fields
}

type Metrics interface {
	RecordRequest(duration time.Duration, statusCode int)
	RecordViolation(violation Violation)
}

type Options struct {
	BindAddress    string
	Upstream       string
	TLS            *TLSConfig
	MaxBodySize    int64         // Default: 10MB
	Timeout        time.Duration // Default: 30s
	RateLimit      int           // Requests per minute, default: 100
	HTTP2          *HTTP2Config  // HTTP/2 configuration
	HTTP3          *HTTP3Config  // HTTP/3 configuration
	CircuitBreaker *resilience.CircuitBreakerConfig

	// ML Configuration - Integrated in v0.41.0
	EnableMLDetection              bool
	MLSensitivity                  string
	MLBlockOnCriticalSeverity      bool
	MLBlockOnHighSeverity          bool
	MLMinScoreToBlock              float64
	MLSampleRate                   int
	MLExcludedPaths                []string
	MLExcludedMethods              []string
	EnablePromptInjectionDetection bool
	PromptInjectionSensitivity     int
	EnableContentAnalysis          bool
	EnableBehavioralAnalysis       bool
}

type PKIAttestationIntegrator struct {
	// contains filtered or unexported fields
}

type PKIConfig struct {
	Enabled      bool
	RequireCRL   bool
	RequireOCSP  bool
	VerifyChain  bool
	TrustAnchors []*pkiattest.TrustAnchor
}

type Proxy struct {
	// contains filtered or unexported fields
}

type ProxyMetrics struct {
	// Request counts
	TotalRequests   int64
	BlockedRequests int64
	AllowedRequests int64

	// Latency
	AvgLatency time.Duration
	P99Latency time.Duration

	// TLS metrics
	TLSVersions  map[string]int64
	CipherSuites map[string]int64

	// Connection metrics
	ActiveConnections int64
	TotalConnections  int64
}

type ProxyOptions = Options

type ProxyTLSConfig struct {
	// Enable FIPS mode
	FIPSMode bool

	// Minimum TLS version
	MinTLSVersion uint16

	// Client certificate required
	RequireClientCert bool

	// Allowed cipher suites
	CipherSuites []uint16
}

type ProxyViolation struct {
	ID        string        `json:"id"`
	Type      ViolationType `json:"type"`
	Severity  Severity      `json:"severity"`
	Message   string        `json:"message"`
	ClientIP  string        `json:"client_ip"`
	Method    string        `json:"method"`
	Path      string        `json:"path"`
	Blocked   bool          `json:"blocked"`
	Timestamp time.Time     `json:"timestamp"`
}

type ProxyWithML struct {
	*Proxy
	MLMiddleware            *MLMiddleware
	PromptInjectionDetector *ml.PromptInjectionDetector
	ContentAnalyzer         *ml.ContentAnalyzer
	BehavioralAnalyzer      *ml.BehavioralAnalyzer
}

type RateLimiter struct {
	// contains filtered or unexported fields
}

type Request struct {
	Method    string
	URL       string
	Headers   http.Header
	Body      []byte
	SourceIP  string
	Timestamp time.Time
}

type Response struct {
	StatusCode int
	Headers    http.Header
	Body       []byte
	Timestamp  time.Time
	Duration   time.Duration
}

type Severity string

type Stats struct {
	RequestsTotal     int64   `json:"requests_total"`
	RequestsBlocked   int64   `json:"requests_blocked"`
	RequestsAllowed   int64   `json:"requests_allowed"`
	BytesIn           int64   `json:"bytes_in"`
	BytesOut          int64   `json:"bytes_out"`
	ActiveConnections int32   `json:"active_connections"`
	AvgLatencyMs      float64 `json:"avg_latency_ms"`
	P99LatencyMs      float64 `json:"p99_latency_ms"`
	Errors            int64   `json:"errors"`
}

type StatsStruct struct {
	RequestsTotal     int64
	RequestsBlocked   int64
	RequestsAllowed   int64
	BytesIn           int64
	BytesOut          int64
	ActiveConnections int64
	AvgLatencyMs      float64
	P99LatencyMs      float64
	Errors            int64
}

type StreamLimiter struct {
	// contains filtered or unexported fields
}

type TLSConfig struct {
	CertFile string
	KeyFile  string
	Config   *tls.Config
}

type TenantAwareProxy struct {
	*Proxy
	// contains filtered or unexported fields
}

type TenantMiddleware struct {
	// contains filtered or unexported fields
}

type Violation struct {
	Type     string
	Message  string
	Severity string
}

type ViolationType string