diff options
| author | John Estabrook <jestabro@vyos.io> | 2025-10-01 08:15:11 -0500 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2025-10-01 08:15:11 -0500 |
| commit | 31f8bd8e762ddd999e8cefd52786353f43ea4c1c (patch) | |
| tree | 7c73c42d0fed9f653017931b9304f27c74e12b2b /interface-definitions | |
| parent | ebf27d5fb3d9203256d2cd49e0f4cf810bae03b1 (diff) | |
| parent | 68f2cec785b6705c71d17b30114355569c489d66 (diff) | |
| download | vyos-1x-31f8bd8e762ddd999e8cefd52786353f43ea4c1c.tar.gz vyos-1x-31f8bd8e762ddd999e8cefd52786353f43ea4c1c.zip | |
Merge pull request #4734 from alexandr-san4ez/T4251-current
syslog: T4251: Add TLS support to syslog
Diffstat (limited to 'interface-definitions')
| -rw-r--r-- | interface-definitions/system_syslog.xml.in | 54 |
1 files changed, 54 insertions, 0 deletions
diff --git a/interface-definitions/system_syslog.xml.in b/interface-definitions/system_syslog.xml.in index 116cbde73..78217882f 100644 --- a/interface-definitions/system_syslog.xml.in +++ b/interface-definitions/system_syslog.xml.in @@ -65,6 +65,60 @@ #include <include/protocol-tcp-udp.xml.i> #include <include/source-address-ipv4-ipv6.xml.i> #include <include/interface/vrf.xml.i> + <node name="tls"> + <properties> + <help>Transport Layer Security (TLS) options for secure syslog</help> + </properties> + <children> + <leafNode name="enable"> + <properties> + <help>Enable TLS encryption for log transmission to this remote syslog server</help> + <valueless/> + </properties> + </leafNode> + <!-- CA cert help should describe trust anchor for server/client validation --> + #include <include/pki/ca-certificate.xml.i> + <!-- Certificate help should specify identity for mutual authentication --> + #include <include/pki/certificate.xml.i> + <leafNode name="auth-mode"> + <properties> + <help>Specify the authentication and verification method for the remote peer's certificate during the TLS handshake</help> + <completionHelp> + <list>anon fingerprint certvalid name</list> + </completionHelp> + <valueHelp> + <format>anon</format> + <description>Allow encrypted connection without verifying the peer's identity (anonymous TLS)</description> + </valueHelp> + <valueHelp> + <format>fingerprint</format> + <description>Authenticate peer by matching its certificate fingerprint to a configured, permitted list (`permitted-peers` option)</description> + </valueHelp> + <valueHelp> + <format>certvalid</format> + <description>Authenticate peer if it presents a certificate signed by a trusted CA</description> + </valueHelp> + <valueHelp> + <format>name</format> + <description>Authenticate peer by verifying its certificate subject name against a configured value (`permitted-peers` option)</description> + </valueHelp> + <constraint> + <regex>(anon|fingerprint|certvalid|name)</regex> + </constraint> + </properties> + <defaultValue>anon</defaultValue> + </leafNode> + <leafNode name="permitted-peers"> + <properties> + <help>Comma-separated list of allowed peer certificate fingerprints or subject names</help> + <valueHelp> + <format>txt</format> + <description>Comma-separated fingerprints or peer names.\nFor example:\n - 'SHA1:DD:23:E3:E7:70:F5:B4:13:44:16:78:A5:5A:8C:39:48:53:A6:DD:25,SHA256:10:C4:26:1D:CB:3C:AB:12:DB:1A:F0:47:37:AE:6D:D2:DE:66:B5:71:B7:2E:5B:BB:AE:0C:7E:7F:5F:0D:E9:64'\n - 'logs.example.com'</description> + </valueHelp> + </properties> + </leafNode> + </children> + </node> </children> </tagNode> <node name="local"> |