fticks_hashmac has moved.

[libradsec.git] / radsecproxy.conf.5.xml

diff --git a/radsecproxy.conf.5.xml b/radsecproxy.conf.5.xml
index 406f2bf..bfc701e 100644 (file)
--- a/radsecproxy.conf.5.xml
+++ b/radsecproxy.conf.5.xml
@@ -98,7 +98,7 @@ blocktype name {
     <para>
       There is one special option that can be used both as a basic
       option and inside all blocks. That is the option
     <para>
       There is one special option that can be used both as a basic
       option and inside all blocks. That is the option

-      <literal>include</literal> where the value specifies files to be
+      <literal>Include</literal> where the value specifies files to be

       included. The value can be a single file, or it can use normal
       shell globbing to specify multiple files, e.g.:
       <blockquote>
       included. The value can be a single file, or it can use normal
       shell globbing to specify multiple files, e.g.:
       <blockquote>


@@ -110,7 +110,7 @@ blocktype name {
       the order they are specified, when reaching the end of a file,
       the next file is read. When reaching the end of the last
       included file, the proxy returns to read the next line following
       the order they are specified, when reaching the end of a file,
       the next file is read. When reaching the end of the last
       included file, the proxy returns to read the next line following

-      the <literal>include</literal> option. Included files may again
+      the <literal>Include</literal> option. Included files may again

       include other files.
     </para>
   </refsect1>
       include other files.
     </para>
   </refsect1>


@@ -126,7 +126,7 @@ blocktype name {
     </para>
     <variablelist>
       <varlistentry>
     </para>
     <variablelist>
       <varlistentry>

-        <term><literal>logLevel</literal></term>
+        <term><literal>LogLevel</literal></term>

         <listitem>
          <para>
            This option specifies the debug level. It must be set to
         <listitem>
          <para>
            This option specifies the debug level. It must be set to


@@ -138,7 +138,7 @@ blocktype name {
         </listitem>
       </varlistentry>
       <varlistentry>
         </listitem>
       </varlistentry>
       <varlistentry>

-        <term><literal>logDestination</literal></term>
+        <term><literal>LogDestination</literal></term>

         <listitem>
          <para>
            This specifies where the log messages should go. By
         <listitem>
          <para>
            This specifies where the log messages should go. By


@@ -168,8 +168,64 @@ blocktype name {
          </para>
         </listitem>
       </varlistentry>
          </para>
         </listitem>
       </varlistentry>

+

       <varlistentry>
       <varlistentry>

-        <term><literal>listenUDP</literal></term>
+        <term><literal>FTicksReporting</literal></term>
+        <listitem>
+         <para>
+           The FTicksReporting option is used to enable F-Ticks
+           logging and can be set to <literal>None</literal>,
+           <literal>Basic</literal> or <literal>Full</literal>.  Its
+           default value is <literal>None</literal>.
+
+           See <literal>radsecproxy.conf-example</literal> for
+           details.  Note that radsecproxy has to be configured with
+           support for F-Ticks (<literal>--enable-fticks</literal>)
+           for this option to have any effect.
+         </para>
+       </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><literal>FTicksMAC</literal></term>
+        <listitem>
+         <para>
+           The FTicksMAC option can be used to control if and how
+           Calling-Station-Id is being logged.  It can be set to one
+           of <literal>Static</literal>, <literal>Original</literal>,
+           <literal>VendorHashed</literal>,
+           <literal>VendorKeyHashed</literal>,
+           <literal>FullyHashed</literal> or
+           <literal>FullyKeyHashed</literal>.
+
+           Its default value is <static>Static</static>.
+
+           See <literal>radsecproxy.conf-example</literal> for
+           details.  Note that radsecproxy has to be configured with
+           support for F-Ticks (<literal>--enable-fticks</literal>)
+           for this option to have any effect.
+         </para>
+       </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><literal>FTicksKey</literal></term>
+        <listitem>
+         <para>
+           The FTicksKey option is used to specify the key to use
+           when producing HMAC's as an effect of specifying
+           VendorKeyHashed or FullyKeyHashed for the FTicksMAC
+           option.
+
+           Note that radsecproxy has to be configured with support
+           for F-Ticks (<literal>--enable-fticks</literal>) for this
+           option to have any effect.
+         </para>
+       </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><literal>ListenUDP</literal></term>

         <listitem>
          <para>
            Normally the proxy will listen to the standard RADIUS UDP
         <listitem>
          <para>
            Normally the proxy will listen to the standard RADIUS UDP


@@ -194,10 +250,10 @@ blocktype name {
         </listitem>
       </varlistentry>
       <varlistentry>
         </listitem>
       </varlistentry>
       <varlistentry>

-        <term><literal>listenTCP</literal></term>
+        <term><literal>ListenTCP</literal></term>

         <listitem>
          <para>
         <listitem>
          <para>

-           This option is similar to the <literal>listenUDP</literal>
+           This option is similar to the <literal>ListenUDP</literal>

            option, except that it is used for receiving connections
            from TCP clients. The default port number is
            <literal>1812</literal>.
            option, except that it is used for receiving connections
            from TCP clients. The default port number is
            <literal>1812</literal>.


@@ -205,22 +261,22 @@ blocktype name {
         </listitem>
       </varlistentry>
       <varlistentry>
         </listitem>
       </varlistentry>
       <varlistentry>

-        <term><literal>listenTLS</literal></term>
+        <term><literal>ListenTLS</literal></term>

         <listitem>
          <para>
         <listitem>
          <para>

-           This is similar to the <literal>listenUDP</literal>
+           This is similar to the <literal>ListenUDP</literal>

            option, except that it is used for receiving connections
            from TLS clients. The default port number is
            <literal>2083</literal>. Note that this option was
            option, except that it is used for receiving connections
            from TLS clients. The default port number is
            <literal>2083</literal>. Note that this option was

-           previously called <literal>listenTCP</literal>.
+           previously called <literal>ListenTCP</literal>.

          </para>
         </listitem>
       </varlistentry>
       <varlistentry>
          </para>
         </listitem>
       </varlistentry>
       <varlistentry>

-        <term><literal>listenDTLS</literal></term>
+        <term><literal>ListenDTLS</literal></term>

         <listitem>
          <para>
         <listitem>
          <para>

-           This is similar to the <literal>listenUDP</literal>
+           This is similar to the <literal>ListenUDP</literal>

            option, except that it is used for receiving connections
            from DTLS clients. The default port number is
            <literal>2083</literal>.
            option, except that it is used for receiving connections
            from DTLS clients. The default port number is
            <literal>2083</literal>.


@@ -228,7 +284,7 @@ blocktype name {
         </listitem>
       </varlistentry>
       <varlistentry>
         </listitem>
       </varlistentry>
       <varlistentry>

-        <term><literal>sourceUDP</literal></term>
+        <term><literal>SourceUDP</literal></term>

         <listitem>
          <para>
            This can be used to specify source address and/or source
         <listitem>
          <para>
            This can be used to specify source address and/or source


@@ -238,7 +294,7 @@ blocktype name {
         </listitem>
       </varlistentry>
       <varlistentry>
         </listitem>
       </varlistentry>
       <varlistentry>

-        <term><literal>sourceTCP</literal></term>
+        <term><literal>SourceTCP</literal></term>

         <listitem>
          <para>
            This can be used to specify source address and/or source
         <listitem>
          <para>
            This can be used to specify source address and/or source


@@ -247,7 +303,7 @@ blocktype name {
         </listitem>
       </varlistentry>
       <varlistentry>
         </listitem>
       </varlistentry>
       <varlistentry>

-        <term><literal>sourceTLS</literal></term>
+        <term><literal>SourceTLS</literal></term>

         <listitem>
          <para>
            This can be used to specify source address and/or source
         <listitem>
          <para>
            This can be used to specify source address and/or source


@@ -256,7 +312,7 @@ blocktype name {
         </listitem>
       </varlistentry>
       <varlistentry>
         </listitem>
       </varlistentry>
       <varlistentry>

-        <term><literal>sourceDTLS</literal></term>
+        <term><literal>SourceDTLS</literal></term>

         <listitem>
          <para>
            This can be used to specify source address and/or source
         <listitem>
          <para>
            This can be used to specify source address and/or source


@@ -278,13 +334,13 @@ blocktype name {
         </listitem>
       </varlistentry>
       <varlistentry>
         </listitem>
       </varlistentry>
       <varlistentry>

-        <term><literal>addTTL</literal></term>
+        <term><literal>AddTTL</literal></term>

         <listitem>
          <para>
            If a TTL attribute is present, the proxy will decrement
            the value and discard the message if zero. Normally the
            proxy does nothing if no TTL attribute is present. If you
         <listitem>
          <para>
            If a TTL attribute is present, the proxy will decrement
            the value and discard the message if zero. Normally the
            proxy does nothing if no TTL attribute is present. If you

-           use the addTTL option with a value 1-255, the proxy will
+           use the AddTTL option with a value 1-255, the proxy will

            when forwarding a message with no TTL attribute, add one
            with the specified value. Note that this option can also
            be specified for a client/server. It will then override
            when forwarding a message with no TTL attribute, add one
            with the specified value. Note that this option can also
            be specified for a client/server. It will then override


@@ -294,7 +350,7 @@ blocktype name {
         </listitem>
       </varlistentry>
       <varlistentry>
         </listitem>
       </varlistentry>
       <varlistentry>

-        <term><literal>loopPrevention</literal></term>
+        <term><literal>LoopPrevention</literal></term>

         <listitem>
          <para>
            This can be set to <literal>on</literal> or
         <listitem>
          <para>
            This can be set to <literal>on</literal> or


@@ -310,7 +366,7 @@ blocktype name {
         </listitem>
       </varlistentry>
       <varlistentry>
         </listitem>
       </varlistentry>
       <varlistentry>

-        <term><literal>include</literal></term>
+        <term><literal>Include</literal></term>

         <listitem>
          <para>
            This is not a normal configuration option; it can be
         <listitem>
          <para>
            This is not a normal configuration option; it can be


@@ -386,9 +442,9 @@ blocktype name {
       <literal>secret</literal>, <literal>tls</literal>,
       <literal>certificateNameCheck</literal>,
       <literal>matchCertificateAttribute</literal>,
       <literal>secret</literal>, <literal>tls</literal>,
       <literal>certificateNameCheck</literal>,
       <literal>matchCertificateAttribute</literal>,

-      <literal>duplicateInterval</literal>, <literal>addTTL</literal>,
-      <literal>rewrite</literal>, <literal>rewriteIn</literal>,
-      <literal>rewriteOut</literal> and
+      <literal>duplicateInterval</literal>, <literal>AddTTL</literal>,
+      <literal>fticksVISCOUNTRY</literal>, <literal>rewrite</literal>,
+      <literal>rewriteIn</literal>, <literal>rewriteOut</literal>, and

       <literal>rewriteAttribute</literal>.
 
       We already discussed the <literal>host</literal> option. The
       <literal>rewriteAttribute</literal>.
 
       We already discussed the <literal>host</literal> option. The


@@ -438,12 +494,17 @@ blocktype name {
       one), or returned a copy of the previous reply.
     </para>
     <para>
       one), or returned a copy of the previous reply.
     </para>
     <para>

-      The <literal>addTTL</literal> option is similar to the
-      <literal>addTTL</literal> option used in the basic config. See
+      The <literal>AddTTL</literal> option is similar to the
+      <literal>AddTTL</literal> option used in the basic config. See

       that for details. Any value configured here overrides the basic
       one when sending messages to this client.
     </para>
     <para>
       that for details. Any value configured here overrides the basic
       one when sending messages to this client.
     </para>
     <para>

+      The <literal>fticksVISCOUNTRY</literal> option configures
+      clients eligible to F-Ticks logging as defined by the
+      <literal>FTicksReporting</literal> basic option.
+    </para>
+    <para>

       The <literal>rewrite</literal> option is deprecated. Use
       <literal>rewriteIn</literal> instead.
     </para>
       The <literal>rewrite</literal> option is deprecated. Use
       <literal>rewriteIn</literal> instead.
     </para>


@@ -525,12 +586,12 @@ blocktype name {
       <literal>type</literal>, <literal>secret</literal>,
       <literal>tls</literal>, <literal>certificateNameCheck</literal>,
       <literal>matchCertificateAttribute</literal>,
       <literal>type</literal>, <literal>secret</literal>,
       <literal>tls</literal>, <literal>certificateNameCheck</literal>,
       <literal>matchCertificateAttribute</literal>,

-      <literal>addTTL</literal>, <literal>rewrite</literal>,
+      <literal>AddTTL</literal>, <literal>rewrite</literal>,

       <literal>rewriteIn</literal>, <literal>rewriteOut</literal>,
       <literal>statusServer</literal>, <literal>retryCount</literal>,
       <literal>retryInterval</literal>,
       <literal>dynamicLookupCommand</literal> and
       <literal>rewriteIn</literal>, <literal>rewriteOut</literal>,
       <literal>statusServer</literal>, <literal>retryCount</literal>,
       <literal>retryInterval</literal>,
       <literal>dynamicLookupCommand</literal> and

-      <literal>loopPrevention</literal>.
+      <literal>LoopPrevention</literal>.

     </para>
     <para>
       We already discussed the <literal>host</literal> option. The
     </para>
     <para>
       We already discussed the <literal>host</literal> option. The


@@ -539,7 +600,7 @@ blocktype name {
       <literal>secret</literal>, <literal>tls</literal>,
       <literal>certificateNameCheck</literal>,
       <literal>matchCertificateAttribute</literal>,
       <literal>secret</literal>, <literal>tls</literal>,
       <literal>certificateNameCheck</literal>,
       <literal>matchCertificateAttribute</literal>,

-      <literal>addTTL</literal>, <literal>rewrite</literal>,
+      <literal>AddTTL</literal>, <literal>rewrite</literal>,

       <literal>rewriteIn</literal> and <literal>rewriteOut</literal>
       are just as specified for the <literal>client block</literal>
       above, except that <literal>defaultServer</literal> (and not
       <literal>rewriteIn</literal> and <literal>rewriteOut</literal>
       are just as specified for the <literal>client block</literal>
       above, except that <literal>defaultServer</literal> (and not


@@ -570,7 +631,7 @@ blocktype name {
       documented separately/later.
     </para>
     <para>
       documented separately/later.
     </para>
     <para>

-      Using the <literal>loopPrevention</literal> option here
+      Using the <literal>LoopPrevention</literal> option here

       overrides any basic setting of this option.  See section
       <literal>BASIC OPTIONS</literal> for details on this option.
     </para>
       overrides any basic setting of this option.  See section
       <literal>BASIC OPTIONS</literal> for details on this option.
     </para>