strongSwan

= strongswan.conf =

== Overview ==

While the [wiki:IpsecConf ipsec.conf] configuration file is well suited to define IPsec related configuration parameters, it is not useful for other strongSwan applications to read options from this file. The file is hard to parse and only starter is capable of doing so.

As the number of components of the strongSwan project is growing, we need a more flexible configuration file, easy to extend and useable by all components. The configuration format uses hierarchal sections and a list of key/value pairs in each section. 

Since 4.2.1, a default strongswan.conf gets installed in your sysconfdir, e.g. ''/etc/strongswan.conf''.

== Syntax ==

Each section has a name, followed by C-Style curly brackets defining the sections body. Each section body contains a set of subsections and key/value pairs:

{{{

settings := (section|keyvalue)*

section  := name { settings }

keyvalue := key = value\n

}}}

Values must be terminated by a newline. Comments are possible using the #-character, but be careful: The parser implementation is currently limited and does not like brackets in comments. Section names and keys may contain any printable character except:

{{{

. { } # \n \t space

}}}

An example might look like this:

{{{

a = b

section-one {

  somevalue = asdf

  subsection {

    othervalue = xxx

  }

  # yei, a comment 

  yetanother = zz

}

section-two {

  x = 12

}

}}}

Indentation is optional, you may use tabs or spaces.

== Reading values ==

The config file is read by libstrongswan during library initialization. Values are accessed using a dot-separated section list and a key: Accessing '''section-one.subsection.othervalue''' will return '''xxx'''.

Have a look at the [source:trunk/src/libstrongswan/settings.h settings interface] how to query values.

== Defined keys ==

The following keys are currently defined (using dot notation).

||charon.close_ike_on_child_failure||Close the IKE_SA if setup of the CHILD_SA along with IKE_AUTH failed||

||charon.hash_and_url||Enable hash and URL support||

||charon.install_routes||Install routes into a separate routing table for established IPsec tunnels||

||charon.routing_table||Numerical routing table to install routes to||

||charon.routing_table_prio||Priority of the routing table||

||charon.load||Plugins to load in charon||

||charon.plugins.sql.database||Database URI for charons [wiki:SQL] plugin||

||charon.plugins.sql.loglevel||Loglevel for logging to [wiki:SQL] database||

||charon.plugins.sql.lease_history||Disable logging of [wiki:SQL] IP pool leases||

||charon.reuse_ikesa||Whether to initiate CHILD_SA within existing IKE_SAs

||charon.threads||Number of worker threads in charon||

||manager.database||Credential database URI for manager||

||manager.debug||Enable debugging in manager||

||manager.load||Plugins to load in manager||

||manager.socket||FastCGI socket of manager, to run it statically||

||manager.threads||Threads to use for request handling||

||manager.timeout||Session timeout for manager||

||medcli.database||Mediation client database URI||

||medcli.dpd||DPD timeout to use in mediation client plugin||

||medsrv.database||Mediation server database URI||

||medsrv.debug||Debugging in mediation server web application||

||medsrv.dpd||DPD timeout to use in mediation server plugin||

||medsrv.load||Plugins to load in mediation server plugin||

||medsrv.password_length||Minimum password length required for mediation server user accounts||

||medsrv.rekey||Rekeying time on mediation connections in mediation server plugin||

||medsrv.socket||Run Mediation server web application statically on socket||

||medsrv.threads||Number of thread for mediation service web application||

||medsrv.timeout||Session timeout for mediation service||

||openac.load||Plugins to load in ipsec openac tool||

||pool.load||Plugins to load in ipsec pool tool||