diff options
Diffstat (limited to 'interface-definitions/system_syslog.xml.in')
| -rw-r--r-- | interface-definitions/system_syslog.xml.in | 49 |
1 files changed, 49 insertions, 0 deletions
diff --git a/interface-definitions/system_syslog.xml.in b/interface-definitions/system_syslog.xml.in index 116cbde73..221b4320f 100644 --- a/interface-definitions/system_syslog.xml.in +++ b/interface-definitions/system_syslog.xml.in @@ -65,6 +65,55 @@ #include <include/protocol-tcp-udp.xml.i> #include <include/source-address-ipv4-ipv6.xml.i> #include <include/interface/vrf.xml.i> + <node name="tls"> + <properties> + <help>Transport Layer Security (TLS) options for secure syslog</help> + </properties> + <children> + <!-- CA cert help should describe trust anchor for server/client validation --> + #include <include/pki/ca-certificate.xml.i> + <!-- Certificate help should specify identity for mutual authentication --> + #include <include/pki/certificate.xml.i> + <leafNode name="auth-mode"> + <properties> + <help>Specify the authentication and verification method for the remote peer's certificate during the TLS handshake</help> + <completionHelp> + <list>anon fingerprint certvalid name</list> + </completionHelp> + <valueHelp> + <format>anon</format> + <description>Allow encrypted connection without verifying the peer's identity (anonymous TLS)</description> + </valueHelp> + <valueHelp> + <format>fingerprint</format> + <description>Authenticate peer by matching its certificate fingerprint to a configured, permitted list (`permitted-peer` option)</description> + </valueHelp> + <valueHelp> + <format>certvalid</format> + <description>Authenticate peer if it presents a certificate signed by a trusted CA</description> + </valueHelp> + <valueHelp> + <format>name</format> + <description>Authenticate peer by verifying its certificate subject name against a configured value (`permitted-peer` option)</description> + </valueHelp> + <constraint> + <regex>(anon|fingerprint|certvalid|name)</regex> + </constraint> + </properties> + <defaultValue>anon</defaultValue> + </leafNode> + <leafNode name="permitted-peer"> + <properties> + <help>Allowed peer certificate fingerprint or subject name</help> + <valueHelp> + <format>txt</format> + <description>Peer fingerprint - SHA1:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX or subject name - logs.example.com</description> + </valueHelp> + <multi/> + </properties> + </leafNode> + </children> + </node> </children> </tagNode> <node name="local"> |