implement auth, improve session stats

config.yaml.dist

@@ -39,3 +39,34 @@ peers:
   #   desired_min_tx: 1s
   #   required_min_rx: 1s
   #   detect_mult: 5
+  #
+  # Authentication (RFC 5880 section 6.7), per peer and off by default. Both ends must be configured identically; a
+  # peer that does not authenticate as configured is discarded. `key_id` is a number (0-255) that must match the remote's.
+  # Keys are used verbatim (not hashed or derived), so they must be exactly the length shown. Give them as a string;
+  # use YAML double-quoted escapes (\x00, \x1b, ...) for bytes that are not printable. Strings are UTF-8, so only bytes
+  # 0x00-0x7f can be written this way. To use bytes 0x80-0xff, give the key as a list of integers instead, one per
+  # byte (hex is fine), with the same length requirement:
+  #   key: [0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x61, 0x62, 0x63, 0x64, 0x80, 0xff]
+  #
+  # Keyed MD5: `key` is exactly 16 bytes. `meticulous` (default true) selects Meticulous Keyed MD5, in which every
+  # packet must carry a newer sequence number; the remote must be set to the same mode.
+  # - address: 192.0.2.4
+  #   auth:
+  #     type: md5
+  #     key_id: 1
+  #     key: "0123456789abcdef"
+  #     meticulous: true
+  #
+  # Keyed SHA1: `key` is exactly 20 bytes. `meticulous` as above.
+  # - address: 192.0.2.5
+  #   auth:
+  #     type: sha1
+  #     key_id: 1
+  #     key: "0123456789abcdef\x00\x01\x7f\x1b"
+  #
+  # Simple password: 1 to 16 bytes, sent in the clear. Provides no protection against an attacker on the path.
+  # - address: 192.0.2.6
+  #   auth:
+  #     type: password
+  #     key_id: 1
+  #     password: "secret"