site: Read public peer keys from key file

[secnet.git] / README

diff --git a/README b/README
index 5a4db52c9f2a54166c0ea3e2e5caa9b9e54a4410..05b073fd72988c7121db7a1f2a742a546ba24dc5 100644 (file)
--- a/README
+++ b/README
@@ -18,7 +18,7 @@ secnet is
   Copyright 1995-2003 Peter Benie
   Copyright 2011      Richard Kettlewell
   Copyright 2012      Matthew Vernon
-  Copyright 2013-2017 Mark Wooding
+  Copyright 2013-2019 Mark Wooding
   Copyright 1995-2013 Simon Tatham
 
 secnet is distributed under the terms of the GNU General Public
@@ -193,6 +193,17 @@ Usage: secnet [OPTION]...
       --help              display this help and exit
       --version           output version information and exit
 
+* base91s
+
+secnet defines a variant of the base91 encoding `basE91', from
+ http://base91.sourceforge.net/
+
+base91s is the same as baseE91 except that:
+ - in the encoded charset, `"' is replaced with `-'
+ - spaces, newlines etc. and other characters outside the charset
+    are not permitted (although in some places they may be ignored,
+    this is not guaranteed).
+
 * secnet builtin modules
 
 ** resolver
@@ -315,7 +326,8 @@ Defines:
   syslog (closure => log closure)
 
 logfile: dict argument
-  filename (string): where to log to
+  filename (string): where to log to; default is stderr
+  prefix (string): added to messages [""]
   class (string list): what type of messages to log
     { "debug-config", M_DEBUG_CONFIG },
     { "debug-phase", M_DEBUG_PHASE },
@@ -380,12 +392,15 @@ site: dict argument
    them.
   resolver (resolver closure)
   random (randomsrc closure)
-  local-key (rsaprivkey closure)
+  key-cache (privcache closure)
+  local-key (rsaprivkey closure): Deprecated; use key-cache instead.
   address (string list): optional, DNS name(s) used to find our peer;
     address literals are supported too if enclosed in `[' `]'.
   port (integer): mandatory if 'address' is specified: the port used
     to contact our peer
-  key (rsapubkey closure): our peer's public key
+  peer-keys (string): path (prefix) for peer public key set file(s);
+    see README.make-secnet-sites re `pub' etc.
+  key (rsapubkey closure): our peer's public key (obsolete)
   transform (transform closure): how to mangle packets sent between sites
   dh (dh closure)
   hash (hash closure)
@@ -545,12 +560,34 @@ tun: dict argument
 I recommend you don't specify the 'interface' option unless you're
 doing something that requires the interface name to be constant.
 
+** privcache
+
+Cache of dynamically loaded private keys.
+
+Defines:
+  priv-cache (closure => privcache closure)
+
+priv-cache: dict argument
+  privkeys (string): path prefix for private keys.  Each key is
+    looked for at this path prefix followed by the 10-character 
+    hex key id.
+  privcache-size (integer): optional, maximum number of private
+    keys to retain at once. [5]
+  privkey-max (integer): optional, maximum size of private key
+    file in bytes. [4095]
+
 ** rsa
 
 Defines:
+  sigscheme algorithm 00 "rsa1"
   rsa-private (closure => rsaprivkey closure)
   rsa-public (closure => rsapubkey closure)
 
+rsa1 sigscheme algorithm:
+  private key: SSH private key file, version 1, no password
+  public key: SSH public key file, version 1
+    (length, restrictions, email, etc., ignored)
+
 rsa-private: string[,bool]
   arg1: filename of SSH private key file (version 1, no password)
   arg2: whether to check that the key is usable [default True]