Imported Upstream version 0.9.0 upstream/0.9.0

1 files changed, 43 insertions, 7 deletions

diff --git a/docs/api/settings-spec.xml b/docs/api/settings-spec.xml
index 6be79b15..fd320b63 100644
--- a/docs/api/settings-spec.xml
+++ b/docs/api/settings-spec.xml
@@ -53,6 +53,18 @@
         <entry>UTF-8 encoded path to a directory containing PEM or DER formatted certificates to be added to the verification chain in addition to the certificate specified in the 'ca-cert' property.</entry>
       </row>
       <row>
+        <entry><screen>subject-match</screen></entry>
+        <entry><screen>string</screen></entry>
+        <entry><screen></screen></entry>
+        <entry>Substring to be matched against the subject of the certificate presented by the authentication server. When unset, no verification of the authentication server certificate's subject is performed.</entry>
+      </row>
+      <row>
+        <entry><screen>altsubject-matches</screen></entry>
+        <entry><screen>array of string</screen></entry>
+        <entry><screen>[]</screen></entry>
+        <entry>List of strings to be matched against the altSubjectName of the certificate presented by the authentication server. If the list is empty, no verification of the server certificate's altSubjectName is performed.</entry>
+      </row>
+      <row>
         <entry><screen>client-cert</screen></entry>
         <entry><screen>byte array</screen></entry>
         <entry><screen>[]</screen></entry>
@@ -101,10 +113,22 @@
         <entry>UTF-8 encoded path to a directory containing PEM or DER formatted certificates to be added to the verification chain in addition to the certificate specified in the 'phase2-ca-cert' property.</entry>
       </row>
       <row>
+        <entry><screen>phase2-subject-match</screen></entry>
+        <entry><screen>string</screen></entry>
+        <entry><screen></screen></entry>
+        <entry>Substring to be matched against the subject of the certificate presented by the authentication server during the inner 'phase2' authentication. When unset, no verification of the authentication server certificate's subject is performed.</entry>
+      </row>
+      <row>
+        <entry><screen>phase2-altsubject-matches</screen></entry>
+        <entry><screen>array of string</screen></entry>
+        <entry><screen>[]</screen></entry>
+        <entry>List of strings to be matched against List of strings to be matched against the altSubjectName of the certificate presented by the authentication server during the inner 'phase 2' authentication. If the list is empty, no verification of the server certificate's altSubjectName is performed.</entry>
+      </row>
+      <row>
         <entry><screen>phase2-client-cert</screen></entry>
         <entry><screen>byte array</screen></entry>
         <entry><screen>[]</screen></entry>
-        <entry>Contains the 'phase 2' client certificate if used by the EAP method specified in the 'phase2-eap' or 'phase2-autheap' properties. Certificate data is specified using a 'scheme'; two are currently supported: blob and path.  When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data.  When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string 'file://' and ending with a terminating NULL byte.</entry>
+        <entry>Contains the 'phase 2' client certificate if used by the EAP method specified in the 'phase2-auth' or 'phase2-autheap' properties. Certificate data is specified using a 'scheme'; two are currently supported: blob and path.  When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data.  When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string 'file://' and ending with a terminating NULL byte.</entry>
       </row>
       <row>
         <entry><screen>password</screen></entry>
@@ -140,7 +164,7 @@
         <entry><screen>phase2-private-key</screen></entry>
         <entry><screen>byte array</screen></entry>
         <entry><screen>[]</screen></entry>
-        <entry>Contains the 'phase 2' inner private key when the 'phase2-eap' or 'phase2-autheap' property is set to 'tls'.  Key data is specified using a 'scheme'; two are currently supported: blob and path. When using the blob scheme and private keys, this property should be set to the key's encrypted PEM encoded data. When using private keys with the path scheme, this property should be set to the full UTF-8 encoded path of the key, prefixed with the string 'file://' and ending with a terminating NULL byte.  When using PKCS#12 format private keys and the blob scheme, this property should be set to the PKCS#12 data and the 'phase2-private-key-password' property must be set to password used to decrypt the PKCS#12 certificate and key.  When using PKCS#12 files and the path scheme, this property should be set to the full UTF-8 encoded path of the key, prefixed with the string 'file://' and and ending with a terminating NULL byte, and as with the blob scheme the 'phase2-private-key-password' property must be set to the password used to decode the PKCS#12 private key and certificate.</entry>
+        <entry>Contains the 'phase 2' inner private key when the 'phase2-auth' or 'phase2-autheap' property is set to 'tls'.  Key data is specified using a 'scheme'; two are currently supported: blob and path. When using the blob scheme and private keys, this property should be set to the key's encrypted PEM encoded data. When using private keys with the path scheme, this property should be set to the full UTF-8 encoded path of the key, prefixed with the string 'file://' and ending with a terminating NULL byte.  When using PKCS#12 format private keys and the blob scheme, this property should be set to the PKCS#12 data and the 'phase2-private-key-password' property must be set to password used to decrypt the PKCS#12 certificate and key.  When using PKCS#12 files and the path scheme, this property should be set to the full UTF-8 encoded path of the key, prefixed with the string 'file://' and and ending with a terminating NULL byte, and as with the blob scheme the 'phase2-private-key-password' property must be set to the password used to decode the PKCS#12 private key and certificate.</entry>
       </row>
       <row>
         <entry><screen>phase2-private-key-password</screen></entry>
@@ -326,7 +350,7 @@
         <entry><screen>number</screen></entry>
         <entry><screen>string</screen></entry>
         <entry><screen></screen></entry>
-        <entry>Number to dial when establishing a PPP data session with the GSM-based mobile broadband network.  In most cases, leave the number blank and a number selecting the APN specified in the 'apn' property will be used automatically when required.</entry>
+        <entry>Number to dial when establishing a PPP data session with the GSM-based mobile broadband network.  Many modems do not require PPP for connections to the mobile network and thus this property should be left blank, which allows NetworkManager to select the appropriate settings automatically.</entry>
       </row>
       <row>
         <entry><screen>username</screen></entry>
@@ -553,7 +577,7 @@
       <row>
         <entry><screen>may-fail</screen></entry>
         <entry><screen>boolean</screen></entry>
-        <entry><screen>FALSE</screen></entry>
+        <entry><screen>TRUE</screen></entry>
         <entry>If TRUE, allow overall network configuration to proceed even if IPv6 configuration times out. Note that at least one IP configuration must succeed or overall network configuration will still fail.  For example, in IPv4-only networks, setting this property to TRUE allows the overall network configuration to succeed if IPv6 configuration fails but IPv4 configuration completes successfully.</entry>
       </row>
     </tbody>
@@ -851,7 +875,7 @@
         <entry><screen>user-name</screen></entry>
         <entry><screen>string</screen></entry>
         <entry><screen></screen></entry>
-        <entry>User name of the currently logged in user for connections provided by the user settings service.  This name is provided to the VPN plugin to use in lieu of a custom username provided by that VPN plugins specific configuration.  The VPN plugin itself decides which user name to use.</entry>
+        <entry>If the VPN connection requires a user name for authentication, that name should be provided here.  If the connection is available to more than one user, and the VPN requires each user to supply a different name, then leave this property empty.  If this property is empty, NetworkManager will automatically supply the username of the user which requested the VPN connection.</entry>
       </row>
       <row>
         <entry><screen>data</screen></entry>
@@ -956,6 +980,12 @@
         <entry>If specified, request that the device use this MAC address instead of its permanent MAC address.  This is known as MAC cloning or spoofing.</entry>
       </row>
       <row>
+        <entry><screen>mac-address-blacklist</screen></entry>
+        <entry><screen>array of string</screen></entry>
+        <entry><screen>[]</screen></entry>
+        <entry>If specified, this connection will never apply to the ethernet device whose permanent MAC address matches an address in the list.  Each MAC address is in the standard hex-digits-and-colons notation (00:11:22:33:44:55).</entry>
+      </row>
+      <row>
         <entry><screen>mtu</screen></entry>
         <entry><screen>uint32</screen></entry>
         <entry><screen>0</screen></entry>
@@ -963,7 +993,7 @@
       </row>
       <row>
         <entry><screen>s390-subchannels</screen></entry>
-        <entry><screen>GPtrArray_gchararray_</screen></entry>
+        <entry><screen>array of string</screen></entry>
         <entry><screen>[]</screen></entry>
         <entry>Identifies specific subchannels that this network device uses for communcation with z/VM or s390 host.  Like the 'mac-address' property for non-z/VM devices, this property can be used to ensure this connection only applies to the network device that uses these subchannels. The list should contain exactly 3 strings, and each string may only be composed of hexadecimal characters and the period (.) character.</entry>
       </row>
@@ -1055,6 +1085,12 @@
         <entry>If specified, request that the WiFi device use this MAC address instead of its permanent MAC address.  This is known as MAC cloning or spoofing.</entry>
       </row>
       <row>
+        <entry><screen>mac-address-blacklist</screen></entry>
+        <entry><screen>array of string</screen></entry>
+        <entry><screen>[]</screen></entry>
+        <entry>If specified, this connection will never apply to the WiFi device whose permanent MAC address matches an address in the list.  Each MAC address is in the standard hex-digits-and-colons notation (00:11:22:33:44:55).</entry>
+      </row>
+      <row>
         <entry><screen>mtu</screen></entry>
         <entry><screen>uint32</screen></entry>
         <entry><screen>0</screen></entry>
@@ -1064,7 +1100,7 @@
         <entry><screen>seen-bssids</screen></entry>
         <entry><screen>array of string</screen></entry>
         <entry><screen>[]</screen></entry>
-        <entry>A list of BSSIDs (each BSSID formatted as a MAC address like '00:11:22:33:44:55') that have been detected as part of the WiFI network.  The settings service will usually populate this property by periodically asking NetworkManager what the device's current AP is while connected to the network (or monitoring the device's 'active-ap' property) and adding the current AP's BSSID to this list.  This list helps NetworkManager find hidden APs by matching up scan results with the BSSIDs in this list.</entry>
+        <entry>A list of BSSIDs (each BSSID formatted as a MAC address like 00:11:22:33:44:55') that have been detected as part of the WiFI network. NetworkManager internally tracks previously seen BSSIDs so this property is no longer of much use.</entry>
       </row>
       <row>
         <entry><screen>security</screen></entry>