feat: Add decryptor filter

Cargo.toml

@@ -150,6 +150,7 @@ cfg-if = "1.0.0"
 libflate = "2.0.0"
 form_urlencoded = "1.2.1"
 gxhash = "3.4.1"
+chacha20 = { version = "0.9.1", features = ["std"] }
 
 [dependencies.hyper-util]
 version = "0.1"

crates/proto-gen/gen.rs

@@ -202,6 +202,7 @@ fn execute(which: &str) {
                 "filters/capture/v1alpha1/capture",
                 "filters/compress/v1alpha1/compress",
                 "filters/concatenate/v1alpha1/concatenate",
+                "filters/decryptor/v1alpha1/decryptor",
                 "filters/debug/v1alpha1/debug",
                 "filters/drop/v1alpha1/drop",
                 "filters/firewall/v1alpha1/firewall",

crates/quilkin-proto/src/generated/quilkin/filters.rs

@@ -2,6 +2,7 @@ pub mod capture;
 pub mod compress;
 pub mod concatenate;
 pub mod debug;
+pub mod decryptor;
 pub mod drop;
 pub mod firewall;
 pub mod load_balancer;

crates/quilkin-proto/src/generated/quilkin/filters/decryptor.rs

@@ -0,0 +1 @@
+pub mod v1alpha1;

crates/quilkin-proto/src/generated/quilkin/filters/decryptor/v1alpha1.rs

@@ -0,0 +1,38 @@
+#[allow(clippy::derive_partial_eq_without_eq)]
+#[derive(Clone, PartialEq, ::prost::Message)]
+pub struct Decryptor {
+    #[prost(bytes = "vec", tag = "1")]
+    pub key: ::prost::alloc::vec::Vec<u8>,
+    #[prost(enumeration = "decryptor::Mode", tag = "2")]
+    pub mode: i32,
+    #[prost(message, optional, tag = "3")]
+    pub data_key: ::core::option::Option<::prost::alloc::string::String>,
+    #[prost(message, optional, tag = "4")]
+    pub nonce_key: ::core::option::Option<::prost::alloc::string::String>,
+}
+/// Nested message and enum types in `Decryptor`.
+pub mod decryptor {
+    #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
+    #[repr(i32)]
+    pub enum Mode {
+        Destination = 0,
+    }
+    impl Mode {
+        /// String value of the enum field names used in the ProtoBuf definition.
+        ///
+        /// The values are not transformed in any way and thus are considered stable
+        /// (if the ProtoBuf definition does not change) and safe for programmatic use.
+        pub fn as_str_name(&self) -> &'static str {
+            match self {
+                Mode::Destination => "Destination",
+            }
+        }
+        /// Creates an enum from field names used in the ProtoBuf definition.
+        pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
+            match value {
+                "Destination" => Some(Self::Destination),
+                _ => None,
+            }
+        }
+    }
+}

docs/src/services/xds/proto/index.md

@@ -37,6 +37,11 @@
 
     - [Concatenate.Strategy](#quilkin-filters-concatenate-v1alpha1-Concatenate-Strategy)
 
+- [quilkin/filters/decryptor/v1alpha1/decryptor.proto](#quilkin_filters_decryptor_v1alpha1_decryptor-proto)
+    - [Decryptor](#quilkin-filters-decryptor-v1alpha1-Decryptor)
+
+    - [Decryptor.Mode](#quilkin-filters-decryptor-v1alpha1-Decryptor-Mode)
+
 - [quilkin/filters/debug/v1alpha1/debug.proto](#quilkin_filters_debug_v1alpha1_debug-proto)
     - [Debug](#quilkin-filters-debug-v1alpha1-Debug)
 
@@ -507,6 +512,51 @@ of xDS servers to connect to in the relay itself.
 
 
 
+<a name="quilkin_filters_decryptor_v1alpha1_decryptor-proto"></a>
+<p align="right"><a href="#top">Top</a></p>
+
+## quilkin/filters/decryptor/v1alpha1/decryptor.proto
+
+
+
+<a name="quilkin-filters-decryptor-v1alpha1-Decryptor"></a>
+
+### Decryptor
+
+
+
+| Field | Type | Label | Description |
+| ----- | ---- | ----- | ----------- |
+| key | [bytes](#bytes) |  |  |
+| mode | [Decryptor.Mode](#quilkin-filters-decryptor-v1alpha1-Decryptor-Mode) |  |  |
+| data_key | [google.protobuf.StringValue](#google-protobuf-StringValue) |  |  |
+| nonce_key | [google.protobuf.StringValue](#google-protobuf-StringValue) |  |  |
+
+
+
+
+
+
+
+
+<a name="quilkin-filters-decryptor-v1alpha1-Decryptor-Mode"></a>
+
+### Decryptor.Mode
+
+
+| Name | Number | Description |
+| ---- | ------ | ----------- |
+| Destination | 0 |  |
+
+
+
+
+
+
+
+
+
+
 <a name="quilkin_filters_debug_v1alpha1_debug-proto"></a>
 <p align="right"><a href="#top">Top</a></p>
 

proto/quilkin/filters/decryptor/v1alpha1/decryptor.proto

@@ -0,0 +1,32 @@
+/*
+ * Copyright 2024 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+syntax = "proto3";
+
+package quilkin.filters.decryptor.v1alpha1;
+
+import "google/protobuf/wrappers.proto";
+
+message Decryptor {
+  enum Mode {
+    Destination = 0;
+  }
+
+  bytes key = 1;
+  Mode mode = 2;
+  google.protobuf.StringValue data_key = 3;
+  google.protobuf.StringValue nonce_key = 4;
+}

src/filters.rs

@@ -28,6 +28,7 @@ pub mod capture;
 pub mod compress;
 pub mod concatenate;
 pub mod debug;
+pub mod decryptor;
 pub mod drop;
 pub mod firewall;
 pub mod load_balancer;