{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "$id": "http://oasis-open.org/openc2/oc2slpf/v1.0/schema.json",
  "title": "oc2slpf version 1.0 json schema",
  "description": "This schema is intended to validate all possible content for the OpenC2 Stateless Packet Filter version 1.0",
  "type": "object",
  "oneOf": [
    {
      "$ref": "#/definitions/OpenC2_Command",
      "description": "A message defined by an Action-Target pair that is sent from a Producer and received by a Consumer"
    },
    {
      "$ref": "#/definitions/OpenC2_Response",
      "description": "A message from a Consumer to a Producer acknowledging a Command or returning the requested resources or status to a previously received Command"
    }
  ],
  "definitions": {
    "OpenC2_Command": {
      "title": "OpenC2 Command",
      "type": "object",
      "description": "The Command defines an Action to be performed on a Target",
      "additionalProperties": false,
      "required": [
        "action",
        "target"
      ],
      "properties": {
        "action": {
          "$ref": "#/definitions/Action",
          "description": "The task or activity to be performed (i.e., the 'verb')"
        },
        "target": {
          "$ref": "#/definitions/Target",
          "description": "The object of the Action. The Action is performed on the Target"
        },
        "args": {
          "$ref": "#/definitions/Args",
          "description": "Additional information that applies to the Command"
        },
        "actuator": {
          "$ref": "#/definitions/Actuator",
          "description": "The subject of the Action. The Actuator executes the Action on the Target"
        },
        "command_id": {
          "$ref": "#/definitions/Command_ID",
          "description": "An identifier of this Command"
        }
      }
    },
    "OpenC2_Response": {
      "title": "OpenC2 Response",
      "type": "object",
      "additionalProperties": false,
      "required": [
        "status"
      ],
      "properties": {
        "status": {
          "$ref": "#/definitions/Status_Code",
          "description": "An integer status code"
        },
        "status_text": {
          "type": "string",
          "description": "A free-form human-readable description of the response status"
        },
        "results": {
          "$ref": "#/definitions/Results",
          "description": "Map of key:value pairs that contain additional results based on the invoking Command"
        }
      }
    },
    "Action": {
      "title": "OpenC2 Action",
      "type": "string",
      "oneOf": [
        {
          "const": "query",
          "description": "Initiate a request for information. Used to communicate the supported options and determine the state or settings"
        },
        {
          "const": "deny",
          "description": "Prevent traffic or access"
        },
        {
          "const": "allow",
          "description": "Permit traffic or access"
        },
        {
          "const": "update",
          "description": "Instructs the Actuator to update its configuration by retrieving and processing a configuration file and update"
        },
        {
          "const": "delete",
          "description": "Remove an access rule"
        }
      ]
    },
    "Target": {
      "title": "OpenC2 Target",
      "type": "object",
      "properties": {
        "features": {
          "$ref": "#/definitions/Features",
          "description": "A set of items such as Action/Target pairs, profiles versions, options that are supported by the Actuator. The Target is used with the query Action to determine an Actuator's capabilities"
        },
        "file": {
          "$ref": "#/definitions/File",
          "description": "Properties of a file"
        },
        "ipv4_net": {
          "$ref": "#/definitions/IPv4_Net",
          "description": "The representation of one or more IPv4 addresses expressed using CIDR notation"
        },
        "ipv6_net": {
          "$ref": "#/definitions/IPv6_Net",
          "description": "The representation of one or more IPv6 addresses expressed using CIDR notation"
        },
        "ipv4_connection": {
          "$ref": "#/definitions/IPv4_Connection",
          "description": "a network connection as specified by a five-tuple (IPv4)"
        },
        "ipv6_connection": {
          "$ref": "#/definitions/IPv6_Connection",
          "description": "A network connection as specified by a five-tuple (IPv4)"
        },
        "slpf:rule_number": {
          "$ref": "#/definitions/slpf:Rule_ID",
          "description": "Immutable identifier assigned when a rule is created. Identifies a rule to be deleted"
        }
      },
      "minProperties": 1,
      "maxProperties": 1,
      "additionalProperties": false
    },
    "Actuator": {
      "title": "OpenC2 Actuator",
      "type": "object",
      "properties": {
        "slpf": {
          "$ref": "#/definitions/slpf:Actuator",
          "description": "Actuator specifiers defined in the Stateless Packet Filtering profile. A message can specify many Actuator types but for it to validate with this profile it must at least specify SLPF"
        }
      },
      "required": [
        "slpf"
      ],
      "additionalProperties": true
    },
    "Args": {
      "title": "OpenC2 Args",
      "type": "object",
      "additionalProperties": false,
      "minProperties": 1,
      "properties": {
        "start_time": {
          "$ref": "#/definitions/Date_Time",
          "description": "The specific date/time to initiate the action"
        },
        "stop_time": {
          "$ref": "#/definitions/Date_Time",
          "description": "The specific date/time to terminate the action"
        },
        "duration": {
          "$ref": "#/definitions/Duration",
          "description": "The length of time for an action to be in effect"
        },
        "response_requested": {
          "$ref": "#/definitions/Response_Type",
          "description": "The type of Response required for the Command: none, ack, status, complete"
        },
        "slpf": {
          "$ref": "#/definitions/slpf:Args",
          "description": "Command arguments defined in the Stateless Packet Filter profile"
        }
      }
    },
    "Status_Code": {
      "title": "OpenC2 Status Code",
      "type": "integer",
      "oneOf": [
        {
          "const": 102,
          "description": "Processing - an interim response used to inform the Producer that the Consumer has accepted the Command but has not yet completed it"
        },
        {
          "const": 200,
          "description": "OK - the Command has succeeded"
        },
        {
          "const": 400,
          "description": "Bad Request - the Consumer cannot process the Command due to something that is perceived to be a Producer error (e.g., malformed Command syntax)"
        },
        {
          "const": 500,
          "description": "Internal Error - the Consumer encountered an unexpected condition that prevented it from performing the Command"
        },
        {
          "const": 501,
          "description": "Not Implemented - the Consumer does not support the functionality required to perform the Command"
        }
      ]
    },
    "Results": {
      "title": "OpenC2 Response Results",
      "type": "object",
      "additionalProperties": false,
      "minProperties": 1,
      "properties": {
        "versions": {
          "type": "array",
          "description": "List of OpenC2 language versions supported by this Actuator",
          "uniqueItems": true,
          "minItems": 1,
          "items": {
            "$ref": "#/definitions/Version"
          }
        },
        "profiles": {
          "type": "array",
          "description": "list of profiles supported by this actuator",
          "uniqueItems": true,
          "minItems": 1,
          "items": {
            "$ref": "#/definitions/Nsid"
          }
        },
        "pairs": {
          "$ref": "#/definitions/Action_Targets",
          "description": "List of Targets applicable to each supported Action"
        },
        "rate_limit": {
          "type": "number",
          "description": "Maximum number of requests per minute supported by design or policy",
          "minimum": 0
        },
        "slpf": {
          "$ref": "#/definitions/slpf:Response",
          "description": "Response types defined in the Stateless Packet Filter profile"
        }
      }
    },
    "Features": {
      "title": "OpenC2 Features Items",
      "type": "array",
      "description": "An array of zero to ten names used to query an Actuator for its supported capabilities",
      "uniqueItems": true,
      "minItems": 0,
      "maxItems": 10,
      "items": {
        "$ref": "#/definitions/Feature"
      }
    },
    "File": {
      "title": "OpenC2 File",
      "type": "object",
      "additionalProperties": false,
      "minProperties": 1,
      "properties": {
        "name": {
          "type": "string",
          "description": "The name of the file as defined in the file system"
        },
        "path": {
          "type": "string",
          "description": "The absolute path to the location of the file in the file system"
        },
        "hashes": {
          "$ref": "#/definitions/Hashes",
          "description": "One or more cryptographic hash codes of the file contents"
        }
      }
    },
    "IPv4_Net": {
      "title": "OpenC2 IPv4 Net",
      "type": "string",
      "description": "IPv4 address as defined in [RFC0791] - CIDR prefix-length. If omitted, refers to a single host address",
      "pattern": "^((25[0-5]|2[0-4][0-9]|[01]?[0-9]?[0-9])\\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9]?[0-9])(\\/(3[0-2]|[0-2]?[0-9]))?"
    },
    "IPv4_Connection": {
      "title": "OpenC2 IPv4 Connection",
      "type": "object",
      "additionalProperties": false,
      "minProperties": 1,
      "properties": {
        "src_addr": {
          "$ref": "#/definitions/IPv4_Net",
          "description": "IPv4 source address range"
        },
        "src_port": {
          "$ref": "#/definitions/Port",
          "description": "Source service per [RFC6335]"
        },
        "dst_addr": {
          "$ref": "#/definitions/IPv4_Net",
          "description": "IPv4 destination address range"
        },
        "dst_port": {
          "$ref": "#/definitions/Port",
          "description": "Destination service per [RFC6335]"
        },
        "protocol": {
          "$ref": "#/definitions/L4_Protocol",
          "description": "Layer 4 protocol (e.g., TCP) - see L4_Protocol section"
        }
      }
    },
    "IPv6_Net": {
      "title": "OpenC2 IPv6 Net",
      "type": "string",
      "description": "IPv6 address as defined in [RFC8200] - CIDR prefix-length. If omitted, refers to a single host address",
      "pattern": "^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))(%.+)?s*(\\/([0-9]|[1-9][0-9]|1[0-1][0-9]|12[0-8]))?$"
    },
    "IPv6_Connection": {
      "title": "OpenC2 IPv6 Connection",
      "type": "object",
      "additionalProperties": false,
      "minProperties": 1,
      "properties": {
        "src_addr": {
          "$ref": "#/definitions/IPv6_Net",
          "description": "IPv6 source address range"
        },
        "src_port": {
          "$ref": "#/definitions/Port",
          "description": "Source service per [RFC6335]"
        },
        "dst_addr": {
          "$ref": "#/definitions/IPv6_Net",
          "description": "IPv6 destination address range"
        },
        "dst_port": {
          "$ref": "#/definitions/Port",
          "description": "Destination service per [RFC6335]"
        },
        "protocol": {
          "$ref": "#/definitions/L4_Protocol",
          "description": "Layer 4 protocol (e.g., TCP) - see L4_Protocol section"
        }
      }
    },
    "Action_Targets": {
      "title": "OpenC2 Action Target Pairs",
      "type": "object",
      "description": "Map of each action supported by this Actuator to the list of Targets applicable to the specific Action",
      "additionalProperties": false,
      "minProperties": 1,
      "properties": {
        "allow": {
          "type": "array",
          "description": "Permit traffic or access",
          "uniqueItems": true,
          "minItems": 1,
          "items": {
            "type": "string",
            "oneOf": [
              {
                "const": "ipv4_connection",
                "description": "A network connection as specified by a five-tuple (IPv4)"
              },
              {
                "const": "ipv6_connection",
                "description": "A network connection as specified by a five-tuple (IPv6)"
              },
              {
                "const": "ipv4_net",
                "description": "The representation of one or more IPv4 addresses expressed using CIDR notation"
              },
              {
                "const": "ipv6_net",
                "description": "The representation of one or more IPv6 addresses expressed using CIDR notation"
              }
            ]
          }
        },
        "deny": {
          "type": "array",
          "description": "Prevent traffic or access",
          "uniqueItems": true,
          "minItems": 1,
          "items": {
            "type": "string",
            "oneOf": [
              {
                "const": "ipv4_connection",
                "description": "A network connection as specified by a five-tuple (IPv4)"
              },
              {
                "const": "ipv6_connection",
                "description": "A network connection as specified by a five-tuple (IPv6)"
              },
              {
                "const": "ipv4_net",
                "description": "The representation of one or more IPv4 addresses expressed using CIDR notation"
              },
              {
                "const": "ipv6_net",
                "description": "The representation of one or more IPv6 addresses expressed using CIDR notation"
              }
            ]
          }
        },
        "query": {
          "type": "array",
          "description": "Initiate a request for information. Used to communicate the supported options and determine the state or settings",
          "uniqueItems": true,
          "minItems": 1,
          "items": {
            "type": "string",
            "oneOf": [
              {
                "const": "features",
                "description": "A set of items such as Action/Target pairs, profiles versions, options that are supported by the Actuator. The Target is used with the query Action to determine an Actuator's capabilities"
              }
            ]
          }
        },
        "delete": {
          "type": "array",
          "description": "Remove an access rule",
          "uniqueItems": true,
          "minItems": 1,
          "items": {
            "type": "string",
            "oneOf": [
              {
                "const": "slpf:rule_number",
                "description": "Immutable identifier assigned when a rule is created. Identifies a rule to be deleted"
              }
            ]
          }
        },
        "update": {
          "type": "array",
          "description": "Instructs the Actuator to update its configuration by retrieving and processing a configuration file and update",
          "uniqueItems": true,
          "minItems": 1,
          "items": {
            "type": "string",
            "oneOf": [
              {
                "const": "file",
                "description": "Properties of a file"
              }
            ]
          }
        }
      }
    },
    "Date_Time": {
      "title": "OpenC2 Date Time",
      "type": "integer",
      "description": "Date and Time - milliseconds since 00:00:00 UTC, 1 January 1970",
      "minimum": 0
    },
    "Duration": {
      "title": "OpenC2 Duration",
      "type": "integer",
      "description": "A length of time - number of milliseconds",
      "minimum": 0
    },
    "Feature": {
      "title": "OpenC2 Feature",
      "type": "string",
      "oneOf": [
        {
          "const": "versions",
          "description": "List of OpenC2 Language versions supported by this Actuator"
        },
        {
          "const": "profiles",
          "description": "List of profiles supported by this Actuator"
        },
        {
          "const": "pairs",
          "description": "List of supported Actions and applicable Targets"
        },
        {
          "const": "rate_limit",
          "description": "Maximum number of Commands per minute supported by design or policy"
        }
      ]
    },
    "Hashes": {
      "title": "OpenC2 Hashes",
      "type": "object",
      "additionalProperties": false,
      "minProperties": 1,
      "properties": {
        "md5": {
          "$ref": "#/definitions/Binary",
          "description": "MD5 hash as defined in [RFC1321]"
        },
        "sha1": {
          "$ref": "#/definitions/Binary",
          "description": "SHA1 hash as defined in [RFC6234]"
        },
        "sha256": {
          "$ref": "#/definitions/Binary",
          "description": "SHA256 hash as defined in [RFC6234]"
        }
      }
    },
    "Hostname": {
      "title": "OpenC2 Hostname",
      "type": "string",
      "description": "Internet host name as specified in [RFC1123]",
      "format": "hostname"
    },
    "L4_Protocol": {
      "title": "OpenC2 layer four protocol",
      "type": "string",
      "description": "Value of the protocol (IPv4) or next header (IPv6) field in an IP packet. Any IANA value - [RFC5237]",
      "oneOf": [
        {
          "const": "icmp",
          "description": "Internet Control Message Protocol - [RFC0792]"
        },
        {
          "const": "tcp",
          "description": "Transmission Control Protocol - [RFC0793]"
        },
        {
          "const": "udp",
          "description": "User Datagram Protocol - [RFC0768]"
        },
        {
          "const": "sctp",
          "description": "Stream Control Transmission Protocol - [RFC4960]"
        }
      ]
    },
    "Nsid": {
      "title": "Namespace Identifier",
      "type": "string",
      "description": "A short identifier that refers to a namespace",
      "minLength": 1,
      "maxLength": 16
    },
    "Port": {
      "title": "OpenC2 Port",
      "type": "integer",
      "description": "Transport Protocol Port Number - [RFC6335]",
      "minimum": 0,
      "maximum": 65535
    },
    "Response_Type": {
      "title": "OpenC2 Response Type",
      "type": "string",
      "oneOf": [
        {
          "const": "none",
          "description": "No response"
        },
        {
          "const": "ack",
          "description": "Respond when Command received"
        },
        {
          "const": "status",
          "description": "Respond with progress toward Command completion"
        },
        {
          "const": "complete",
          "description": "Respond when all aspects of Command completed"
        }
      ]
    },
    "Version": {
      "title": "OpenC2 Version",
      "type": "string",
      "description": "Major.Minor version number",
      "pattern": "^\\d+\\.\\d+$"
    },
    "Binary": {
      "title": "OpenC2 Binary",
      "type": "string",
      "contentEncoding": "base64"
    },
    "Command_ID": {
      "title": "OpenC2 Command Identifier",
      "type": "string"
    },
    "slpf:Args": {
      "title": "SLPF Args Specifiers",
      "type": "object",
      "additionalProperties": false,
      "minProperties": 1,
      "properties": {
        "drop_process": {
          "$ref": "#/definitions/slpf:Drop_Process",
          "description": "Specifies how to handle denied packets"
        },
        "persistent": {
          "type": "boolean",
          "description": "Normal operations assume any changes to a device are to be implemented persistently. Setting the persistent modifier to FALSE results in a change that is not persistent in the event of a reboot or restart"
        },
        "direction": {
          "$ref": "#/definitions/slpf:Direction",
          "description": "Specifies whether to apply rules to incoming or outgoing traffic. If omitted, rules are applied to both"
        },
        "insert_rule": {
          "$ref": "#/definitions/slpf:Rule_ID",
          "description": "Specifies the identifier of the rule within a list, typically used in a top-down rule list"
        }
      }
    },
    "slpf:Drop_Process": {
      "title": "SLPF drop process types",
      "type": "string",
      "oneOf": [
        {
          "const": "none",
          "description": "Drop the packet and do not send a notification to the source of the packet"
        },
        {
          "const": "reject",
          "description": "Drop the packet and send an ICMP host unreachable (or equivalent) to the source of the packet"
        },
        {
          "const": "false_ack",
          "description": "Drop the traffic and send a false acknowledgment"
        }
      ]
    },
    "slpf:Direction": {
      "title": "SLPF direction types",
      "type": "string",
      "oneOf": [
        {
          "const": "both",
          "description": "Apply rules to all traffic"
        },
        {
          "const": "ingress",
          "description": "Apply rules to incoming traffic only"
        },
        {
          "const": "egress",
          "description": "Apply rules to outgoing traffic only"
        }
      ]
    },
    "slpf:Rule_ID": {
      "title": "SLPF access rule identifier",
      "type": "integer",
      "description": "Immutable identifier assigned when a rule is created. Identifies a rule to be deleted"
    },
    "slpf:Actuator": {
      "title": "SLPF Actuator specifiers",
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "hostname": {
          "$ref": "#/definitions/Hostname",
          "description": "[RFC1123] hostname (can be a domain name or IP address) for a particular device with SLPF functionality"
        },
        "named_group": {
          "type": "string",
          "description": "User defined collection of devices with SLPF functionality"
        },
        "asset_id": {
          "type": "string",
          "description": "Unique identifier for a particular SLPF"
        },
        "asset_tuple": {
          "type": "array",
          "description": "Unique tuple identifier for a particular SLPF consisting of a list of up to 10 strings",
          "uniqueItems": true,
          "minItems": 1,
          "maxItems": 10,
          "items": {
            "title": "SLPF asset tuple",
            "type": "string"
          }
        }
      }
    },
    "slpf:Response": {
      "title": "SLPF response types",
      "type": "object",
      "additionalProperties": false,
      "minProperties": 1,
      "properties": {
        "rule_number": {
          "$ref": "#/definitions/slpf:Rule_ID",
          "description": "Rule identifier returned from allow or deny Command"
        }
      }
    }
  }
}