replace plaintext secret transmission with time-limited hmac-based bearer tokens

[hippotat] / README.config

diff --git a/README.config b/README.config
index 2b58512..842573c 100644 (file)
--- a/README.config
+++ b/README.config
@@ -21,7 +21,7 @@ Exceptional settings:
      Used by server to select the appropriate parts of the
      rest of the configuration.  Ignored by the client.
 
      Used by server to select the appropriate parts of the
      rest of the configuration.  Ignored by the client.
 

-  password
+  secret

      Looked up in the usual way, but used by client and server to
      determine which possible peerings to try to set up, and which to
      ignore.
      Looked up in the usual way, but used by client and server to
      determine which possible peerings to try to set up, and which to
      ignore.


@@ -32,11 +32,11 @@ Exceptional settings:
      (LIMIT sections do not count.)
 
      The server queue packets for, and accept requests from, each
      (LIMIT sections do not count.)
 
      The server queue packets for, and accept requests from, each

-     putative client for which the config search yields a password.
+     putative client for which the config search yields a secret.

 
      Each client will create a local interface, and try to communicate
      with the server, for each possible pair (putative server,
 
      Each client will create a local interface, and try to communicate
      with the server, for each possible pair (putative server,

-     putative client) for which the config search yields a password.
+     putative client) for which the config search yields a secret.

 
   ipif
      Command to run to create and communicate with local network
 
   ipif
      Command to run to create and communicate with local network


@@ -122,6 +122,16 @@ Ordinary settings, used by both, not client-specific:
      Virtual interface name on the client.  [hippo%d]
      Any %d is interpolated (by the kernel).
 
      Virtual interface name on the client.  [hippo%d]
      Any %d is interpolated (by the kernel).
 

+Ordinary settings, used by server only:
+
+  max_clock_skew
+     Permissible clock skew between client and server.
+     hippotat will not work if clock skew is more than this.
+     Conversely: when moving client from one public network to
+     another, the first network can deny service to the client for
+     this period after the client leaves the first network.
+     [300s]
+

 Ordinary settings, used by client only:
 
   http_timeout_grace
 Ordinary settings, used by client only:
 
   http_timeout_grace