New upstream version 1.24.2 upstream/1.24.2

1 files changed, 4 insertions, 4 deletions

diff --git a/docs/api/settings-spec.xml b/docs/api/settings-spec.xml
index 9564e7ae..20dd0a26 100644
--- a/docs/api/settings-spec.xml
+++ b/docs/api/settings-spec.xml
@@ -40,10 +40,10 @@
     <row><entry><screen>altsubject-matches<indexterm zone="settings-802-1x"><primary sortas="altsubject-matches">altsubject-matches</primary></indexterm></screen></entry><entry><screen>array of string</screen></entry><entry><screen/></entry><entry>List of strings to be matched against the altSubjectName of the certificate presented by the authentication server. If the list is empty, no verification of the server certificate's altSubjectName is performed.</entry></row>
     <row><entry><screen>anonymous-identity<indexterm zone="settings-802-1x"><primary sortas="anonymous-identity">anonymous-identity</primary></indexterm></screen></entry><entry><screen>string</screen></entry><entry><screen/></entry><entry>Anonymous identity string for EAP authentication methods.  Used as the unencrypted identity with EAP types that support different tunneled identity like EAP-TTLS.</entry></row>
     <row><entry><screen>auth-timeout<indexterm zone="settings-802-1x"><primary sortas="auth-timeout">auth-timeout</primary></indexterm></screen></entry><entry><screen>int32</screen></entry><entry><screen>0</screen></entry><entry>A timeout for the authentication. Zero means the global default; if the global default is not set, the authentication timeout is 25 seconds.</entry></row>
-    <row><entry><screen>ca-cert<indexterm zone="settings-802-1x"><primary sortas="ca-cert">ca-cert</primary></indexterm></screen></entry><entry><screen>byte array</screen></entry><entry><screen/></entry><entry>Contains the CA certificate if used by the EAP method specified in the "eap" property. Certificate data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended.</entry></row>
+    <row><entry><screen>ca-cert<indexterm zone="settings-802-1x"><primary sortas="ca-cert">ca-cert</primary></indexterm></screen></entry><entry><screen>byte array</screen></entry><entry><screen/></entry><entry>Contains the CA certificate if used by the EAP method specified in the "eap" property. Certificate data is specified using a "scheme"; three are currently supported: blob, path and pkcs#11 URL. When using the blob scheme this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended. Note that enabling NMSetting8021x:system-ca-certs will override this setting to use the built-in path, if the built-in path is not a directory.</entry></row>
     <row><entry><screen>ca-cert-password<indexterm zone="settings-802-1x"><primary sortas="ca-cert-password">ca-cert-password</primary></indexterm></screen></entry><entry><screen>string</screen></entry><entry><screen/></entry><entry>The password used to access the CA certificate stored in "ca-cert" property. Only makes sense if the certificate is stored on a PKCS#11 token that requires a login.</entry></row>
     <row><entry><screen>ca-cert-password-flags<indexterm zone="settings-802-1x"><primary sortas="ca-cert-password-flags">ca-cert-password-flags</primary></indexterm></screen></entry><entry><screen>NMSettingSecretFlags (uint32)</screen></entry><entry><screen/></entry><entry>Flags indicating how to handle the "ca-cert-password" property.</entry></row>
-    <row><entry><screen>ca-path<indexterm zone="settings-802-1x"><primary sortas="ca-path">ca-path</primary></indexterm></screen></entry><entry><screen>string</screen></entry><entry><screen/></entry><entry>UTF-8 encoded path to a directory containing PEM or DER formatted certificates to be added to the verification chain in addition to the certificate specified in the "ca-cert" property.</entry></row>
+    <row><entry><screen>ca-path<indexterm zone="settings-802-1x"><primary sortas="ca-path">ca-path</primary></indexterm></screen></entry><entry><screen>string</screen></entry><entry><screen/></entry><entry>UTF-8 encoded path to a directory containing PEM or DER formatted certificates to be added to the verification chain in addition to the certificate specified in the "ca-cert" property. If NMSetting8021x:system-ca-certs is enabled and the built-in CA path is an existing directory, then this setting is ignored.</entry></row>
     <row><entry><screen>client-cert<indexterm zone="settings-802-1x"><primary sortas="client-cert">client-cert</primary></indexterm></screen></entry><entry><screen>byte array</screen></entry><entry><screen/></entry><entry>Contains the client certificate if used by the EAP method specified in the "eap" property. Certificate data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte.</entry></row>
     <row><entry><screen>client-cert-password<indexterm zone="settings-802-1x"><primary sortas="client-cert-password">client-cert-password</primary></indexterm></screen></entry><entry><screen>string</screen></entry><entry><screen/></entry><entry>The password used to access the client certificate stored in "client-cert" property. Only makes sense if the certificate is stored on a PKCS#11 token that requires a login.</entry></row>
     <row><entry><screen>client-cert-password-flags<indexterm zone="settings-802-1x"><primary sortas="client-cert-password-flags">client-cert-password-flags</primary></indexterm></screen></entry><entry><screen>NMSettingSecretFlags (uint32)</screen></entry><entry><screen/></entry><entry>Flags indicating how to handle the "client-cert-password" property.</entry></row>
@@ -64,10 +64,10 @@
     <row><entry><screen>phase2-altsubject-matches<indexterm zone="settings-802-1x"><primary sortas="phase2-altsubject-matches">phase2-altsubject-matches</primary></indexterm></screen></entry><entry><screen>array of string</screen></entry><entry><screen/></entry><entry>List of strings to be matched against the altSubjectName of the certificate presented by the authentication server during the inner "phase 2" authentication. If the list is empty, no verification of the server certificate's altSubjectName is performed.</entry></row>
     <row><entry><screen>phase2-auth<indexterm zone="settings-802-1x"><primary sortas="phase2-auth">phase2-auth</primary></indexterm></screen></entry><entry><screen>string</screen></entry><entry><screen/></entry><entry>Specifies the allowed "phase 2" inner non-EAP authentication method when an EAP method that uses an inner TLS tunnel is specified in the "eap" property.  Recognized non-EAP "phase 2" methods are "pap", "chap", "mschap", "mschapv2", "gtc", "otp", "md5", and "tls". Each "phase 2" inner method requires specific parameters for successful authentication; see the wpa_supplicant documentation for more details.</entry></row>
     <row><entry><screen>phase2-autheap<indexterm zone="settings-802-1x"><primary sortas="phase2-autheap">phase2-autheap</primary></indexterm></screen></entry><entry><screen>string</screen></entry><entry><screen/></entry><entry>Specifies the allowed "phase 2" inner EAP-based authentication method when an EAP method that uses an inner TLS tunnel is specified in the "eap" property.  Recognized EAP-based "phase 2" methods are "md5", "mschapv2", "otp", "gtc", and "tls". Each "phase 2" inner method requires specific parameters for successful authentication; see the wpa_supplicant documentation for more details.</entry></row>
-    <row><entry><screen>phase2-ca-cert<indexterm zone="settings-802-1x"><primary sortas="phase2-ca-cert">phase2-ca-cert</primary></indexterm></screen></entry><entry><screen>byte array</screen></entry><entry><screen/></entry><entry>Contains the "phase 2" CA certificate if used by the EAP method specified in the "phase2-auth" or "phase2-autheap" properties. Certificate data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended.</entry></row>
+    <row><entry><screen>phase2-ca-cert<indexterm zone="settings-802-1x"><primary sortas="phase2-ca-cert">phase2-ca-cert</primary></indexterm></screen></entry><entry><screen>byte array</screen></entry><entry><screen/></entry><entry>Contains the "phase 2" CA certificate if used by the EAP method specified in the "phase2-auth" or "phase2-autheap" properties. Certificate data is specified using a "scheme"; three are currently supported: blob, path and pkcs#11 URL. When using the blob scheme this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended. Note that enabling NMSetting8021x:system-ca-certs will override this setting to use the built-in path, if the built-in path is not a directory.</entry></row>
     <row><entry><screen>phase2-ca-cert-password<indexterm zone="settings-802-1x"><primary sortas="phase2-ca-cert-password">phase2-ca-cert-password</primary></indexterm></screen></entry><entry><screen>string</screen></entry><entry><screen/></entry><entry>The password used to access the "phase2" CA certificate stored in "phase2-ca-cert" property. Only makes sense if the certificate is stored on a PKCS#11 token that requires a login.</entry></row>
     <row><entry><screen>phase2-ca-cert-password-flags<indexterm zone="settings-802-1x"><primary sortas="phase2-ca-cert-password-flags">phase2-ca-cert-password-flags</primary></indexterm></screen></entry><entry><screen>NMSettingSecretFlags (uint32)</screen></entry><entry><screen/></entry><entry>Flags indicating how to handle the "phase2-ca-cert-password" property.</entry></row>
-    <row><entry><screen>phase2-ca-path<indexterm zone="settings-802-1x"><primary sortas="phase2-ca-path">phase2-ca-path</primary></indexterm></screen></entry><entry><screen>string</screen></entry><entry><screen/></entry><entry>UTF-8 encoded path to a directory containing PEM or DER formatted certificates to be added to the verification chain in addition to the certificate specified in the "phase2-ca-cert" property.</entry></row>
+    <row><entry><screen>phase2-ca-path<indexterm zone="settings-802-1x"><primary sortas="phase2-ca-path">phase2-ca-path</primary></indexterm></screen></entry><entry><screen>string</screen></entry><entry><screen/></entry><entry>UTF-8 encoded path to a directory containing PEM or DER formatted certificates to be added to the verification chain in addition to the certificate specified in the "phase2-ca-cert" property. If NMSetting8021x:system-ca-certs is enabled and the built-in CA path is an existing directory, then this setting is ignored.</entry></row>
     <row><entry><screen>phase2-client-cert<indexterm zone="settings-802-1x"><primary sortas="phase2-client-cert">phase2-client-cert</primary></indexterm></screen></entry><entry><screen>byte array</screen></entry><entry><screen/></entry><entry>Contains the "phase 2" client certificate if used by the EAP method specified in the "phase2-auth" or "phase2-autheap" properties. Certificate data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended.</entry></row>
     <row><entry><screen>phase2-client-cert-password<indexterm zone="settings-802-1x"><primary sortas="phase2-client-cert-password">phase2-client-cert-password</primary></indexterm></screen></entry><entry><screen>string</screen></entry><entry><screen/></entry><entry>The password used to access the "phase2" client certificate stored in "phase2-client-cert" property. Only makes sense if the certificate is stored on a PKCS#11 token that requires a login.</entry></row>
     <row><entry><screen>phase2-client-cert-password-flags<indexterm zone="settings-802-1x"><primary sortas="phase2-client-cert-password-flags">phase2-client-cert-password-flags</primary></indexterm></screen></entry><entry><screen>NMSettingSecretFlags (uint32)</screen></entry><entry><screen/></entry><entry>Flags indicating how to handle the "phase2-client-cert-password" property.</entry></row>