Appendix G - IPSEC
User Guide
397
begin with white space too. There may be only one section of a given type with a given
name.
Lines within the section are generally of the following form:
parameter=value
(Note the mandatory preceding white space.) There can be white space on either side of the
=. Parameter names follow the same syntax as section names, and are specific to a section
type. Unless otherwise explicitly specified, no parameter name may appear more than once
in a section.
An empty
value
stands for the system default value (if any) of the parameter, i.e., it is roughly
equivalent to omitting the parameter line entirely. A
value
may contain white space only if
the entire
value
is enclosed in double quotes ("); a
value
cannot itself contain a double quote,
nor may it be continued across more than one line.
Numeric values are specified to be either an integer (a sequence of digits) or a decimal num-
ber (sequence of digits optionally followed by “.” and another sequence of digits).
There is currently one parameter which is available in any type of section:
A section with name
%default
specifies defaults for sections of the same type. For each
parameter in it, any section of that type which does not have a parameter of the same name
gets a copy of the one from the %default section. There may be multiple %default sections of
a given type, but only one default may be supplied for any specific parameter name, and all
%default sections of a given type must precede all non-%default sections of that type. %default
sections may not contain
also
parameters.
Currently there are two types of sections: a
config
section specifies general configuration
information for IPsec, while a
conn
section specifies an IPsec connection.
also
The value is a section name; the parameters of that section are appended to this
section, as if they had been written as part of it. The specified section must exist,
must follow the current one, and must have the same section type. (Nesting is
permitted, and there may be more than one
also
in a single section, although it is
forbidden to append the same section more than once.) This allows, for example,
keeping the encryption keys for a connection in a separate file from the rest of
the description, by using both an
also
parameter and an
include
line.
