Commit dfc14eaced for strongswan.org

commit dfc14eaced817327d917c0d751c9f3097945fce1
Author: Tobias Brunner <tobias@strongswan.org>
Date:   Tue Sep 15 12:29:00 2026 +0200

    conf: Add documentation for charon-tkm-specific settings

diff --git a/conf/Makefile.am b/conf/Makefile.am
index d7fc3c716d..c8e4d59a60 100644
--- a/conf/Makefile.am
+++ b/conf/Makefile.am
@@ -17,6 +17,7 @@ options = \
 	options/charon-logging.opt \
 	options/charon-nm.opt \
 	options/charon-systemd.opt \
+	options/charon-tkm.opt \
 	options/imcv.opt \
 	options/imv_policy_manager.opt \
 	options/iptfs.opt \
diff --git a/conf/options/charon-tkm.opt b/conf/options/charon-tkm.opt
new file mode 100644
index 0000000000..fcda85ae51
--- /dev/null
+++ b/conf/options/charon-tkm.opt
@@ -0,0 +1,36 @@
+charon-tkm.ike_socket = /tmp/tkm.rpc.ike
+	Path to the socket to communicate with the TKM.
+
+charon-tkm.ees_socket = /tmp/tkm.rpc.ees
+	Path to the TKM event socket (to deliver IPsec SA events).
+
+charon-tkm.ca_mapping { # }
+	Section to define mappings from CA certificates to TKM CA context
+	identifiers.
+
+charon-tkm.ca_mapping.<name> { # }
+	<name> is an arbitrary name for a particular CA mapping.
+
+charon-tkm.ca_mapping.<name>.fingerprint
+	Hex-encoded SHA-1 hash of the subjectPublicKey of the mapped CA certificate.
+
+charon-tkm.ca_mapping.<name>.id
+	TKM CA context identifier of the mapped CA certificate.
+
+charon-tkm.ke_mapping {}
+	Section to define mappings from IKEv2/IANA key exchange method identifiers
+	to TKM KEA context identifiers.
+
+charon-tkm.proposal_mapping.ike {}
+	Section to define mappings from TKM IA context identifiers to IKE proposal
+	strings.
+
+charon-tkm.proposal_mapping.esp {}
+	Section to define mappings from TKM EA context identifiers to ESP proposal
+	strings.
+
+charon-tkm.sig_mapping {}
+	Section to define mappings from signature scheme identifiers (as ENUM name
+	defined in `signature_scheme_names`) to TKM SIGA context identifiers. Only
+	schemes whose parameters are fully determined by the scheme itself can be
+	mapped (RSA-PSS is currently not supported).
diff --git a/configure.ac b/configure.ac
index 50b06c4390..89327946f3 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1856,6 +1856,7 @@ AM_COND_IF([USE_NM], [strongswan_options=${strongswan_options}" charon-nm"])
 AM_COND_IF([USE_PKI], [strongswan_options=${strongswan_options}" pki"])
 AM_COND_IF([USE_SWANCTL], [strongswan_options=${strongswan_options}" swanctl"])
 AM_COND_IF([USE_SYSTEMD], [strongswan_options=${strongswan_options}" charon-systemd"])
+AM_COND_IF([USE_TKM], [strongswan_options=${strongswan_options}" charon-tkm"])

 AC_SUBST(strongswan_options)