doc update

doc/sample.config

@@ -15,6 +15,10 @@ auth = "plain[./sample.passwd]"
 #max-clients = 1024
 max-clients = 16
 
+# Limit the number of client connections to one every X milliseconds 
+# (X is the provided value). Set to zero for no limit.
+#rate-limit-ms = 100
+
 # Limit the number of identical clients (i.e., users connecting multiple times)
 # Unset or set to zero for unlimited.
 max-same-clients = 2
@@ -36,6 +40,9 @@ try-mtu-discovery = false
 # The key may be a file, or any URL supported by GnuTLS (e.g., 
 # tpmkey:uuid=xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx;storage=user
 # or pkcs11:object=my-vpn-key;object-type=private)
+#
+# There may be multiple certificate and key pairs and each key
+# should correspond to the preceding certificate.
 server-cert = ../test-cert.pem
 server-key = ../test-key.pem
 
@@ -43,7 +50,16 @@ server-key = ../test-key.pem
 # for the DHE ciphersuites (by default this server supports ECDHE).
 # Can be generated using:
 # certtool --generate-dh-params --outfile /path/to/dh.pem
-#dh-params = dh.pem
+#dh-params = /path/to/dh.pem
+
+# If you have a certificate from a CA that provides an OCSP
+# service you may provide a fresh OCSP status response within
+# the TLS handshake. That will prevent the client from connecting
+# independently on the OCSP server.
+# You can update this response periodically using:
+# ocsptool --ask --load-cert=your_cert --load-issuer=your_ca --outfile response
+# Make sure that you replace the following file in an atomic way.
+#ocsp-response = /path/to/ocsp.der
 
 # In case PKCS #11 or TPM keys are used the PINs should be available
 # in files. The srk-pin-file is applicable to TPM keys only (It's the storage
@@ -72,18 +88,16 @@ server-key = ../test-key.pem
 #crl = /path/to/crl.pem
 
 # GnuTLS priority string
-tls-priorities = "PERFORMANCE:%SERVER_PRECEDENCE"
-
-# The default server directory
-#chroot-dir = /path/to/chroot
+tls-priorities = "PERFORMANCE:%SERVER_PRECEDENCE:%COMPAT"
+#tls-priorities = "PERFORMANCE:%SERVER_PRECEDENCE:%COMPAT:+ESTREAM-SALSA20-256:+SALSA20-256:+UMAC-96"
 
 # The time (in seconds) that a client is allowed to stay connected prior
 # to authentication
 auth-timeout = 40
 
-# The time (in seconds) that a client is not allowed to reconnect after a failed
-# authentication attempt.
-min-reauth-time = 10
+# The time (in seconds) that a client is not allowed to reconnect after 
+# a failed authentication attempt.
+#min-reauth-time = 2
 
 # Cookie validity time (in seconds)
 # Once a client is authenticated he's provided a cookie with
@@ -99,7 +113,8 @@ cookie-validity = 172800
 # Parameters are passed on the environment.
 # REASON, USERNAME, GROUPNAME, HOSTNAME (the hostname selected by client), 
 # DEVICE, IP_REAL (the real IP of the client), IP_LOCAL (the local IP
-# in the P-t-P connect), IP_REMOTE (the VPN IP of the client).
+# in the P-t-P connection), IP_REMOTE (the VPN IP of the client). REASON
+# may be "connect" or "disconnect".
 #connect-script = /usr/bin/myscript
 #disconnect-script = /usr/bin/myscript
 
@@ -109,10 +124,15 @@ use-utmp = true
 # PID file
 pid-file = /var/run/ocserv.pid
 
+# The default server directory. Does not require any devices present.
+#chroot-dir = /path/to/chroot
+
 # socket file used for IPC, will be appended with .PID
 # It must be accessible within the chroot environment (if any)
 socket-file = /var/run/ocserv-socket
 
+# The user the worker processes will be run as. It should be
+# unique (no other services run as this user).
 run-as-user = nobody
 run-as-group = nogroup
 
@@ -129,10 +149,17 @@ ipv4-netmask = 255.255.255.0
 # ipv4-dns = 192.168.2.1
 ipv4-dns = local
 
+# The NBNS server (if any)
+#ipv4-nbns = 192.168.2.3
+
 #ipv6-address = 
 #ipv6-mask = 
 #ipv6-dns = 
 
+# Prior to leasing any IP from the pool ping it to verify that
+# it is not in use by another (unrelated to this server) host.
+ping-leases = false
+
 # Leave empty to assign the default MTU of the device
 # mtu =