strongswan.conf¶

Overview¶

While the ipsec.conf configuration file is well suited to define IPsec related configuration parameters, it is not useful for other strongSwan applications to read options from this file. The file is hard to parse and only ipsec starter is capable of doing so. As the number of components of the strongSwan project is continually growing, we needed a more flexible configuration file that is easy to extend and can be used by all components. The new configuration format consists of hierarchical sections and a list of key/value pairs in each section. Starting with the strongSwan 4.2.1 release, a default strongswan.conf file is installed in your sysconfdir, e.g. /etc/strongswan.conf.

Syntax¶

Each section has a name, followed by C-Style curly brackets defining the sections body. Each section body contains a set of subsections and key/value pairs:

settings := (section|keyvalue)*
section  := name { settings }
keyvalue := key = value\n

Values must be terminated by a newline. Comments are possible using the #-character, but be careful: The parser implementation is currently limited and does not like brackets in comments. Section names and keys may contain any printable character except:

. { } # \n \t space

An example might look like this:

a = b
section-one {
  somevalue = asdf
  subsection {
    othervalue = xxx
  }
  # yei, a comment 
  yetanother = zz
}
section-two {
  x = 12
}

Indentation is optional, you may use tabs or spaces.

Reading values¶

The config file is read by libstrongswan during library initialization. Values are accessed using a dot-separated section list and a key:
Accessing section-one.subsection.othervalue will return xxx. Have a look at the [source:trunk/src/libstrongswan/settings.h settings interface] how to query values.

Defined keys¶

The following keys are currently defined (using dot notation).