strongSwan

= strongswan.conf =

Overview

While the [wiki:IpsecConf ipsec.conf] configuration file is well suited to define IPsec related configuration parameters, it is not useful for other strongSwan applications to read options from this file. The file is hard to parse and only starter is capable of doing so.

As the number of components of the strongSwan project is growing, we need a more flexible configuration file, easy to extend and useable by all components. The configuration format uses hierarchal sections and a list of key/value pairs in each section.

Since 4.2.1, a default strongswan.conf gets installed in your sysconfdir, e.g. ''/etc/strongswan.conf''.

Syntax

Each section has a name, followed by C-Style curly brackets defining the sections body. Each section body contains a set of subsections and key/value pairs: {{{
settings := (section|keyvalue)*
section := name { settings }
keyvalue := key = value\n
}}}
Values must be terminated by a newline. Comments are possible using the #-character, but be careful: The parser implementation is currently limited and does not like brackets in comments. Section names and keys may contain any printable character except: {{{
. { } # \n \t space
}}}
An example might look like this: {{{
a = b
section-one {
somevalue = asdf
subsection {
othervalue = xxx
} # yei, a comment
yetanother = zz
}
section-two {
x = 12
}
}}}
Indentation is optional, you may use tabs or spaces.

Reading values

The config file is read by libstrongswan during library initialization. Values are accessed using a dot-separated section list and a key: Accessing '''section-one.subsection.othervalue''' will return '''xxx'''.
Have a look at the [source:trunk/src/libstrongswan/settings.h settings interface] how to query values.

Defined keys
The following keys are currently defined (using dot notation).

	charon.close_ike_on_child_failure		Close the IKE_SA if setup of the CHILD_SA along with IKE_AUTH failed
	charon.hash_and_url		Enable hash and URL support
	charon.install_routes		Install routes into a separate routing table for established IPsec tunnels
	charon.routing_table		Numerical routing table to install routes to
	charon.routing_table_prio		Priority of the routing table
	charon.load		Plugins to load in charon
	charon.plugins.sql.database		Database URI for charons [wiki:SQL] plugin
	charon.plugins.sql.loglevel		Loglevel for logging to [wiki:SQL] database
	charon.plugins.sql.lease_history		Disable logging of [wiki:SQL] IP pool leases
	charon.reuse_ikesa		Whether to initiate CHILD_SA within existing IKE_SAs		charon.threads		Number of worker threads in charon
	manager.database		Credential database URI for manager
	manager.debug		Enable debugging in manager
	manager.load		Plugins to load in manager
	manager.socket		FastCGI socket of manager, to run it statically
	manager.threads		Threads to use for request handling
	manager.timeout		Session timeout for manager
	medcli.database		Mediation client database URI
	medcli.dpd		DPD timeout to use in mediation client plugin
	medsrv.database		Mediation server database URI
	medsrv.debug		Debugging in mediation server web application
	medsrv.dpd		DPD timeout to use in mediation server plugin
	medsrv.load		Plugins to load in mediation server plugin
	medsrv.password_length		Minimum password length required for mediation server user accounts
	medsrv.rekey		Rekeying time on mediation connections in mediation server plugin
	medsrv.socket		Run Mediation server web application statically on socket
	medsrv.threads		Number of thread for mediation service web application
	medsrv.timeout		Session timeout for mediation service
	openac.load		Plugins to load in ipsec openac tool
	pool.load		Plugins to load in ipsec pool tool