Make it easier to bootstrap the PKI for SSL connections in OpenFlow.

[openvswitch] / controller / controller.8.in

diff --git a/controller/controller.8.in b/controller/controller.8.in
index d3c91957dfd7ace651c783084fefa8ae3b976ddf..1df6b7528e02736d7684c380ec7872086c0fd570 100644 (file)
--- a/controller/controller.8.in
+++ b/controller/controller.8.in
@@ -28,6 +28,11 @@ this form is used.
 Listens for TCP connections from remote OpenFlow switches on
 \fIport\fR (default: 975).
 
+.TP
+\fBpunix:\fIfile\fR
+Listens for connections from OpenFlow switches on the Unix domain
+server socket named \fIfile\fR.
+
 .TP
 \fBnl:\fIdp_idx\fR
 The local Netlink datapath numbered \fIdp_idx\fR, as configured with
@@ -46,6 +51,10 @@ The specified SSL \fIport\fR (default: 976) on the given remote
 The specified TCP \fIport\fR (default: 975) on the given remote
 \fIhost\fR.
 
+.TP
+\fBunix:\fIfile\fR
+The Unix domain server socket named \fIfile\fR.
+
 .SH OPTIONS
 .TP
 \fB-p\fR, \fB--private-key=\fIprivkey.pem\fR
@@ -59,10 +68,24 @@ controller's certificate authority (CA), that certifies the switch's
 private key to identify a trustworthy switch.
 
 .TP
-\fB-C\fR, \fB--ca-cert=\fIcacert.pem\fR
+\fB-C\fR, \fB--ca-cert=\fIswitch-cacert.pem\fR
 Specifies a PEM file containing the CA certificate used to verify that
 the switch is connected to a trustworthy controller.
 
+.TP
+\fB--peer-ca-cert=\fIcontroller-cacert.pem\fR
+Specifies a PEM file that contains one or more additional certificates
+to send to switches.  \fIcontroller-cacert.pem\fR should be the CA
+certificate used to sign the controller's own certificate (the
+certificate specified on \fB-c\fR or \fB--certificate\fR).
+
+This option is not useful in normal operation, because the switch must
+already have the controller CA certificate for it to have any
+confidence in the controller's identity.  However, this option allows
+a newly installed switch to obtain the controller CA certificate on
+first boot using, e.g., the \fB--bootstrap-ca-cert\fR option to
+\fBsecchan\fR(8).
+
 .TP
 .BR \-n ", " \-\^\-noflow
 By default, the controller sets up a flow in each OpenFlow switch
@@ -108,6 +131,16 @@ the PID of the running process.  If \fIpidfile\fR is not specified, or
 if it does not begin with \fB/\fR, then it is created in
 \fB@rundir@\fR.
 
+.TP
+\fB-f\fR, \fB--force\fR
+By default, when \fB-P\fR or \fB--pidfile\fR is specified and the
+specified pidfile already exists and is locked by a running process,
+\fBcontroller\fR refuses to start.  Specify \fB-f\fR or \fB--force\fR
+to cause it to instead overwrite the pidfile.
+
+When \fB-P\fR or \fB--pidfile\fR is not specified, this option has no
+effect.
+
 .TP
 \fB-D\fR, \fB--detach\fR
 Causes \fBcontroller\fR to detach itself from the foreground session and
@@ -118,17 +151,18 @@ run as a background process.
 Prints a brief help message to the console.
 
 .TP
-\fB-v\fR \fImodule\fB:\fIfacility\fB:\fIlevel\fR, \fB--verbose=\fImodule\fB:\fIfacility\fB:\fIlevel\fR
+\fB-v\fImodule\fR[\fB:\fIfacility\fR[\fB:\fIlevel\fR]], \fB--verbose=\fImodule\fR[\fB:\fIfacility\fR[\fB:\fIlevel\fR]]
 Sets the logging level for \fImodule\fR in \fIfacility\fR to
 \fIlevel\fR.  The \fImodule\fR may be any valid module name (as
 displayed by the \fB--list\fR action on \fBvlogconf\fR(8)), or the
 special name \fBANY\fR to set the logging levels for all modules.  The
 \fIfacility\fR may be \fBsyslog\fR or \fBconsole\fR to set the levels
 for logging to the system log or to the console, respectively, or
-\fBANY\fR to set the logging levels for both facilities.  The
-\fIlevel\fR must be one of \fBemer\fR, \fBerr\fR, \fBwarn\fR, or
-\fBdbg\fR, designating the minimum severity of a message for it to be
-logged.
+\fBANY\fR to set the logging levels for both facilities.  If it is
+omitted, \fIfacility\fR defaults to \fBANY\fR.  The \fIlevel\fR must
+be one of \fBemer\fR, \fBerr\fR, \fBwarn\fR, or \fBdbg\fR, designating
+the minimum severity of a message for it to be logged.  If it is
+omitted, \fIlevel\fR defaults to \fBdbg\fR.
 
 .TP
 \fB-v\fR, \fB--verbose\fR