summary refs log tree commit diff
path: root/docs/api/settings-spec.xml
diff options
context:
space:
mode:
Diffstat (limited to 'docs/api/settings-spec.xml')
-rw-r--r--docs/api/settings-spec.xml28
1 files changed, 24 insertions, 4 deletions
diff --git a/docs/api/settings-spec.xml b/docs/api/settings-spec.xml
index bdff11c1..3a1105e0 100644
--- a/docs/api/settings-spec.xml
+++ b/docs/api/settings-spec.xml
@@ -12,7 +12,7 @@ Note that autoconnect is not implemented for VPN profiles. See "secondaries" as
 
 If multiple profiles are ready to autoconnect on the same device, the one with the better "connection.autoconnect-priority" is chosen. If the priorities are equal, then the most recently connected profile is activated. If the profiles were not connected earlier or their "connection.timestamp" is identical, the choice is undefined.
 
-Depending on "connection.multi-connect", a profile can (auto)connect only once at a time or multiple times.</entry></row><row><entry><screen>autoconnect-ports<indexterm zone="settings-connection"><primary sortas="autoconnect-ports">autoconnect-ports</primary></indexterm></screen></entry><entry><screen>NMTernary (int32)</screen></entry><entry><screen/></entry><entry>Whether or not ports of this connection should be automatically brought up when NetworkManager activates this connection. This only has a real effect for controller connections. The properties "autoconnect", "autoconnect-priority" and "autoconnect-retries" are unrelated to this setting. The permitted values are: 0: leave port connections untouched, 1: activate all the port connections with this connection, -1: default. If -1 (default) is set, global connection.autoconnect-ports is read to determine the real value. If it is default as well, this fallbacks to 0.</entry></row><row><entry><screen>autoconnect-priority<indexterm zone="settings-connection"><primary sortas="autoconnect-priority">autoconnect-priority</primary></indexterm></screen></entry><entry><screen>int32</screen></entry><entry><screen>0</screen></entry><entry>The autoconnect priority in range -999 to 999. If the connection is set to autoconnect, connections with higher priority will be preferred. The higher number means higher priority. Defaults to 0. Note that this property only matters if there are more than one candidate profile to select for autoconnect. In case of equal priority, the profile used most recently is chosen.</entry></row><row><entry><screen>autoconnect-retries<indexterm zone="settings-connection"><primary sortas="autoconnect-retries">autoconnect-retries</primary></indexterm></screen></entry><entry><screen>int32</screen></entry><entry><screen>-1</screen></entry><entry>The number of times a connection should be tried when autoactivating before giving up. Zero means forever, -1 means the global default (4 times if not overridden). Setting this to 1 means to try activation only once before blocking autoconnect. Note that after a timeout, NetworkManager will try to autoconnect again.</entry></row><row><entry><screen>autoconnect-slaves<indexterm zone="settings-connection"><primary sortas="autoconnect-slaves">autoconnect-slaves</primary></indexterm></screen></entry><entry><screen>NMSettingConnectionAutoconnectSlaves (int32)</screen></entry><entry><screen/></entry><entry>Whether or not slaves of this connection should be automatically brought up when NetworkManager activates this connection. This only has a real effect for master connections. The properties "autoconnect", "autoconnect-priority" and "autoconnect-retries" are unrelated to this setting. The permitted values are: 0: leave slave connections untouched, 1: activate all the slave connections with this connection, -1: default. If -1 (default) is set, global connection.autoconnect-slaves is read to determine the real value. If it is default as well, this fallbacks to 0.</entry></row><row><entry><screen>controller<indexterm zone="settings-connection"><primary sortas="controller">controller</primary></indexterm></screen></entry><entry><screen>string</screen></entry><entry><screen/></entry><entry>Interface name of the controller device or UUID of the controller connection.</entry></row><row><entry><screen>dns-over-tls<indexterm zone="settings-connection"><primary sortas="dns-over-tls">dns-over-tls</primary></indexterm></screen></entry><entry><screen>int32</screen></entry><entry><screen>-1</screen></entry><entry>Whether DNSOverTls (dns-over-tls) is enabled for the connection. DNSOverTls is a technology which uses TLS to encrypt dns traffic.
+Depending on "connection.multi-connect", a profile can (auto)connect only once at a time or multiple times.</entry></row><row><entry><screen>autoconnect-ports<indexterm zone="settings-connection"><primary sortas="autoconnect-ports">autoconnect-ports</primary></indexterm></screen></entry><entry><screen>int32</screen></entry><entry><screen>-1</screen></entry><entry>Whether or not ports of this connection should be automatically brought up when NetworkManager activates this connection. This only has a real effect for controller connections. The properties "autoconnect", "autoconnect-priority" and "autoconnect-retries" are unrelated to this setting. The permitted values are: 0: leave port connections untouched, 1: activate all the port connections with this connection, -1: default. If -1 (default) is set, global connection.autoconnect-ports is read to determine the real value. If it is default as well, this fallbacks to 0.</entry></row><row><entry><screen>autoconnect-priority<indexterm zone="settings-connection"><primary sortas="autoconnect-priority">autoconnect-priority</primary></indexterm></screen></entry><entry><screen>int32</screen></entry><entry><screen>0</screen></entry><entry>The autoconnect priority in range -999 to 999. If the connection is set to autoconnect, connections with higher priority will be preferred. The higher number means higher priority. Defaults to 0. Note that this property only matters if there are more than one candidate profile to select for autoconnect. In case of equal priority, the profile used most recently is chosen.</entry></row><row><entry><screen>autoconnect-retries<indexterm zone="settings-connection"><primary sortas="autoconnect-retries">autoconnect-retries</primary></indexterm></screen></entry><entry><screen>int32</screen></entry><entry><screen>-1</screen></entry><entry>The number of times a connection should be tried when autoactivating before giving up. Zero means forever, -1 means the global default (4 times if not overridden). Setting this to 1 means to try activation only once before blocking autoconnect. Note that after a timeout, NetworkManager will try to autoconnect again.</entry></row><row><entry><screen>autoconnect-slaves<indexterm zone="settings-connection"><primary sortas="autoconnect-slaves">autoconnect-slaves</primary></indexterm></screen></entry><entry><screen>NMSettingConnectionAutoconnectSlaves (int32)</screen></entry><entry><screen/></entry><entry>Whether or not slaves of this connection should be automatically brought up when NetworkManager activates this connection. This only has a real effect for master connections. The properties "autoconnect", "autoconnect-priority" and "autoconnect-retries" are unrelated to this setting. The permitted values are: 0: leave slave connections untouched, 1: activate all the slave connections with this connection, -1: default. If -1 (default) is set, global connection.autoconnect-slaves is read to determine the real value. If it is default as well, this fallbacks to 0.</entry></row><row><entry><screen>controller<indexterm zone="settings-connection"><primary sortas="controller">controller</primary></indexterm></screen></entry><entry><screen>string</screen></entry><entry><screen/></entry><entry>Interface name of the controller device or UUID of the controller connection.</entry></row><row><entry><screen>dns-over-tls<indexterm zone="settings-connection"><primary sortas="dns-over-tls">dns-over-tls</primary></indexterm></screen></entry><entry><screen>int32</screen></entry><entry><screen>-1</screen></entry><entry>Whether DNSOverTls (dns-over-tls) is enabled for the connection. DNSOverTls is a technology which uses TLS to encrypt dns traffic.
 
 The permitted values are: "yes" (2) use DNSOverTls and disabled fallback, "opportunistic" (1) use DNSOverTls but allow fallback to unencrypted resolution, "no" (0) don't ever use DNSOverTls. If unspecified "default" depends on the plugin used. Systemd-resolved uses global setting.
 
@@ -142,7 +142,11 @@ Since 1.34, NULL is the default and means "fabric". Before 1.34, NULL was reject
             Properties
         </title><para><table><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody/></tgroup></table></para></refsect1></refentry><refentry id="settings-generic"><refnamediv><refname>generic</refname><refpurpose>Generic Link Settings</refpurpose></refnamediv><refsect1 role="properties"><title id="settings-generic.properties">
             Properties
-        </title><para><table><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody/></tgroup></table></para></refsect1></refentry><refentry id="settings-gsm"><refnamediv><refname>gsm</refname><refpurpose>GSM-based Mobile Broadband Settings</refpurpose></refnamediv><refsect1 role="properties"><title id="settings-gsm.properties">
+        </title><para><table><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody><row><entry><screen>device-handler<indexterm zone="settings-generic"><primary sortas="device-handler">device-handler</primary></indexterm></screen></entry><entry><screen>string</screen></entry><entry><screen/></entry><entry>Name of the device handler that will be invoked to add and delete the device for this connection. The name can only contain ASCII alphanumeric characters and '-', '_', '.'. It cannot start with '.'.
+
+See the NetworkManager-dispatcher(8) man page for more details about how to write the device handler.
+
+By setting this property the generic connection becomes "virtual", meaning that it can be activated without an existing device; the device will be created at the time the connection is started by invoking the device-handler.</entry></row></tbody></tgroup></table></para></refsect1></refentry><refentry id="settings-gsm"><refnamediv><refname>gsm</refname><refpurpose>GSM-based Mobile Broadband Settings</refpurpose></refnamediv><refsect1 role="properties"><title id="settings-gsm.properties">
             Properties
         </title><para><table><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody><row><entry><screen>apn<indexterm zone="settings-gsm"><primary sortas="apn">apn</primary></indexterm></screen></entry><entry><screen>string</screen></entry><entry><screen/></entry><entry>The GPRS Access Point Name specifying the APN used when establishing a data session with the GSM-based network.  The APN often determines how the user will be billed for their network usage and whether the user has access to the Internet or just a provider-specific walled-garden, so it is important to use the correct APN for the user's mobile broadband plan. The APN may only be composed of the characters a-z, 0-9, ., and - per GSM 03.60 Section 14.9.
 
@@ -356,7 +360,13 @@ When set, the token is used as IPv6 interface identifier instead of the hardware
             Properties
         </title><para><table><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody><row><entry><screen>encapsulation-limit<indexterm zone="settings-ip-tunnel"><primary sortas="encapsulation-limit">encapsulation-limit</primary></indexterm></screen></entry><entry><screen>uint32</screen></entry><entry><screen>0</screen></entry><entry>How many additional levels of encapsulation are permitted to be prepended to packets. This property applies only to IPv6 tunnels. To disable this option, add 0x1 (ip6-ign-encap-limit) to ip-tunnel flags.</entry></row><row><entry><screen>flags<indexterm zone="settings-ip-tunnel"><primary sortas="flags">flags</primary></indexterm></screen></entry><entry><screen>uint32</screen></entry><entry><screen>0</screen></entry><entry>Tunnel flags. Currently, the following values are supported: 0x1 (ip6-ign-encap-limit), 0x2 (ip6-use-orig-tclass), 0x4 (ip6-use-orig-flowlabel), 0x8 (ip6-mip6-dev), 0x10 (ip6-rcv-dscp-copy), 0x20 (ip6-use-orig-fwmark). They are valid only for IPv6 tunnels.</entry></row><row><entry><screen>flow-label<indexterm zone="settings-ip-tunnel"><primary sortas="flow-label">flow-label</primary></indexterm></screen></entry><entry><screen>uint32</screen></entry><entry><screen>0</screen></entry><entry>The flow label to assign to tunnel packets. This property applies only to IPv6 tunnels.</entry></row><row><entry><screen>fwmark<indexterm zone="settings-ip-tunnel"><primary sortas="fwmark">fwmark</primary></indexterm></screen></entry><entry><screen>uint32</screen></entry><entry><screen>0</screen></entry><entry>The fwmark value to assign to tunnel packets. This property can be set to a non zero value only on VTI and VTI6 tunnels.</entry></row><row><entry><screen>input-key<indexterm zone="settings-ip-tunnel"><primary sortas="input-key">input-key</primary></indexterm></screen></entry><entry><screen>string</screen></entry><entry><screen/></entry><entry>The key used for tunnel input packets; the property is valid only for certain tunnel modes (GRE, IP6GRE). If empty, no key is used.</entry></row><row><entry><screen>local<indexterm zone="settings-ip-tunnel"><primary sortas="local">local</primary></indexterm></screen></entry><entry><screen>string</screen></entry><entry><screen/></entry><entry>The local endpoint of the tunnel; the value can be empty, otherwise it must contain an IPv4 or IPv6 address.</entry></row><row><entry><screen>mode<indexterm zone="settings-ip-tunnel"><primary sortas="mode">mode</primary></indexterm></screen></entry><entry><screen>uint32</screen></entry><entry><screen>0</screen></entry><entry>The tunneling mode. Valid values: 1 (ipip), 2 (gre), 3 (sit), 4 (isatap), 5 (vti), 6 (ip6ip6), 7 (ipip6), 8 (ip6gre), 9 (vti6), 10 (gretap) and 11 (ip6gretap)</entry></row><row><entry><screen>mtu<indexterm zone="settings-ip-tunnel"><primary sortas="mtu">mtu</primary></indexterm></screen></entry><entry><screen>uint32</screen></entry><entry><screen>0</screen></entry><entry>If non-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple fragments.</entry></row><row><entry><screen>output-key<indexterm zone="settings-ip-tunnel"><primary sortas="output-key">output-key</primary></indexterm></screen></entry><entry><screen>string</screen></entry><entry><screen/></entry><entry>The key used for tunnel output packets; the property is valid only for certain tunnel modes (GRE, IP6GRE). If empty, no key is used.</entry></row><row><entry><screen>parent<indexterm zone="settings-ip-tunnel"><primary sortas="parent">parent</primary></indexterm></screen></entry><entry><screen>string</screen></entry><entry><screen/></entry><entry>If given, specifies the parent interface name or parent connection UUID the new device will be bound to so that tunneled packets will only be routed via that interface.</entry></row><row><entry><screen>path-mtu-discovery<indexterm zone="settings-ip-tunnel"><primary sortas="path-mtu-discovery">path-mtu-discovery</primary></indexterm></screen></entry><entry><screen>boolean</screen></entry><entry><screen>TRUE</screen></entry><entry>Whether to enable Path MTU Discovery on this tunnel.</entry></row><row><entry><screen>remote<indexterm zone="settings-ip-tunnel"><primary sortas="remote">remote</primary></indexterm></screen></entry><entry><screen>string</screen></entry><entry><screen/></entry><entry>The remote endpoint of the tunnel; the value must contain an IPv4 or IPv6 address.</entry></row><row><entry><screen>tos<indexterm zone="settings-ip-tunnel"><primary sortas="tos">tos</primary></indexterm></screen></entry><entry><screen>uint32</screen></entry><entry><screen>0</screen></entry><entry>The type of service (IPv4) or traffic class (IPv6) field to be set on tunneled packets.</entry></row><row><entry><screen>ttl<indexterm zone="settings-ip-tunnel"><primary sortas="ttl">ttl</primary></indexterm></screen></entry><entry><screen>uint32</screen></entry><entry><screen>0</screen></entry><entry>The TTL to assign to tunneled packets. 0 is a special value meaning that packets inherit the TTL value.</entry></row></tbody></tgroup></table></para></refsect1></refentry><refentry id="settings-macsec"><refnamediv><refname>macsec</refname><refpurpose>MACSec Settings</refpurpose></refnamediv><refsect1 role="properties"><title id="settings-macsec.properties">
             Properties
-        </title><para><table><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody><row><entry><screen>encrypt<indexterm zone="settings-macsec"><primary sortas="encrypt">encrypt</primary></indexterm></screen></entry><entry><screen>boolean</screen></entry><entry><screen>TRUE</screen></entry><entry>Whether the transmitted traffic must be encrypted.</entry></row><row><entry><screen>mka-cak<indexterm zone="settings-macsec"><primary sortas="mka-cak">mka-cak</primary></indexterm></screen></entry><entry><screen>string</screen></entry><entry><screen/></entry><entry>The pre-shared CAK (Connectivity Association Key) for MACsec Key Agreement. Must be a string of 32 hexadecimal characters.</entry></row><row><entry><screen>mka-cak-flags<indexterm zone="settings-macsec"><primary sortas="mka-cak-flags">mka-cak-flags</primary></indexterm></screen></entry><entry><screen>NMSettingSecretFlags (uint32)</screen></entry><entry><screen/></entry><entry>Flags indicating how to handle the "mka-cak" property.</entry></row><row><entry><screen>mka-ckn<indexterm zone="settings-macsec"><primary sortas="mka-ckn">mka-ckn</primary></indexterm></screen></entry><entry><screen>string</screen></entry><entry><screen/></entry><entry>The pre-shared CKN (Connectivity-association Key Name) for MACsec Key Agreement. Must be a string of hexadecimal characters with a even length between 2 and 64.</entry></row><row><entry><screen>mode<indexterm zone="settings-macsec"><primary sortas="mode">mode</primary></indexterm></screen></entry><entry><screen>int32</screen></entry><entry><screen>0</screen></entry><entry>Specifies how the CAK (Connectivity Association Key) for MKA (MACsec Key Agreement) is obtained.</entry></row><row><entry><screen>parent<indexterm zone="settings-macsec"><primary sortas="parent">parent</primary></indexterm></screen></entry><entry><screen>string</screen></entry><entry><screen/></entry><entry>If given, specifies the parent interface name or parent connection UUID from which this MACSEC interface should be created.  If this property is not specified, the connection must contain an "802-3-ethernet" setting with a "mac-address" property.</entry></row><row><entry><screen>port<indexterm zone="settings-macsec"><primary sortas="port">port</primary></indexterm></screen></entry><entry><screen>int32</screen></entry><entry><screen>1</screen></entry><entry>The port component of the SCI (Secure Channel Identifier), between 1 and 65534.</entry></row><row><entry><screen>send-sci<indexterm zone="settings-macsec"><primary sortas="send-sci">send-sci</primary></indexterm></screen></entry><entry><screen>boolean</screen></entry><entry><screen>TRUE</screen></entry><entry>Specifies whether the SCI (Secure Channel Identifier) is included in every packet.</entry></row><row><entry><screen>validation<indexterm zone="settings-macsec"><primary sortas="validation">validation</primary></indexterm></screen></entry><entry><screen>int32</screen></entry><entry><screen>2</screen></entry><entry>Specifies the validation mode for incoming frames.</entry></row></tbody></tgroup></table></para></refsect1></refentry><refentry id="settings-macvlan"><refnamediv><refname>macvlan</refname><refpurpose>MAC VLAN Settings</refpurpose></refnamediv><refsect1 role="properties"><title id="settings-macvlan.properties">
+        </title><para><table><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody><row><entry><screen>encrypt<indexterm zone="settings-macsec"><primary sortas="encrypt">encrypt</primary></indexterm></screen></entry><entry><screen>boolean</screen></entry><entry><screen>TRUE</screen></entry><entry>Whether the transmitted traffic must be encrypted.</entry></row><row><entry><screen>mka-cak<indexterm zone="settings-macsec"><primary sortas="mka-cak">mka-cak</primary></indexterm></screen></entry><entry><screen>string</screen></entry><entry><screen/></entry><entry>The pre-shared CAK (Connectivity Association Key) for MACsec Key Agreement. Must be a string of 32 hexadecimal characters.</entry></row><row><entry><screen>mka-cak-flags<indexterm zone="settings-macsec"><primary sortas="mka-cak-flags">mka-cak-flags</primary></indexterm></screen></entry><entry><screen>NMSettingSecretFlags (uint32)</screen></entry><entry><screen/></entry><entry>Flags indicating how to handle the "mka-cak" property.</entry></row><row><entry><screen>mka-ckn<indexterm zone="settings-macsec"><primary sortas="mka-ckn">mka-ckn</primary></indexterm></screen></entry><entry><screen>string</screen></entry><entry><screen/></entry><entry>The pre-shared CKN (Connectivity-association Key Name) for MACsec Key Agreement. Must be a string of hexadecimal characters with a even length between 2 and 64.</entry></row><row><entry><screen>mode<indexterm zone="settings-macsec"><primary sortas="mode">mode</primary></indexterm></screen></entry><entry><screen>int32</screen></entry><entry><screen>0</screen></entry><entry>Specifies how the CAK (Connectivity Association Key) for MKA (MACsec Key Agreement) is obtained.</entry></row><row><entry><screen>offload<indexterm zone="settings-macsec"><primary sortas="offload">offload</primary></indexterm></screen></entry><entry><screen>int32</screen></entry><entry><screen>-1</screen></entry><entry>Specifies the MACsec offload mode.
+
+0 (off) disables MACsec offload.
+
+1 (phy) and 2 (mac) request offload respectively to the PHY or to the MAC; if the selected mode is not available, the connection will fail.
+
+-1 (default) uses the global default value specified in NetworkManager configuration; if no global default is defined, the built-in default is 0 (off).</entry></row><row><entry><screen>parent<indexterm zone="settings-macsec"><primary sortas="parent">parent</primary></indexterm></screen></entry><entry><screen>string</screen></entry><entry><screen/></entry><entry>If given, specifies the parent interface name or parent connection UUID from which this MACSEC interface should be created.  If this property is not specified, the connection must contain an "802-3-ethernet" setting with a "mac-address" property.</entry></row><row><entry><screen>port<indexterm zone="settings-macsec"><primary sortas="port">port</primary></indexterm></screen></entry><entry><screen>int32</screen></entry><entry><screen>1</screen></entry><entry>The port component of the SCI (Secure Channel Identifier), between 1 and 65534.</entry></row><row><entry><screen>send-sci<indexterm zone="settings-macsec"><primary sortas="send-sci">send-sci</primary></indexterm></screen></entry><entry><screen>boolean</screen></entry><entry><screen>TRUE</screen></entry><entry>Specifies whether the SCI (Secure Channel Identifier) is included in every packet.</entry></row><row><entry><screen>validation<indexterm zone="settings-macsec"><primary sortas="validation">validation</primary></indexterm></screen></entry><entry><screen>int32</screen></entry><entry><screen>2</screen></entry><entry>Specifies the validation mode for incoming frames.</entry></row></tbody></tgroup></table></para></refsect1></refentry><refentry id="settings-macvlan"><refnamediv><refname>macvlan</refname><refpurpose>MAC VLAN Settings</refpurpose></refnamediv><refsect1 role="properties"><title id="settings-macvlan.properties">
             Properties
         </title><para><table><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody><row><entry><screen>mode<indexterm zone="settings-macvlan"><primary sortas="mode">mode</primary></indexterm></screen></entry><entry><screen>uint32</screen></entry><entry><screen>0</screen></entry><entry>The macvlan mode, which specifies the communication mechanism between multiple macvlans on the same lower device.</entry></row><row><entry><screen>parent<indexterm zone="settings-macvlan"><primary sortas="parent">parent</primary></indexterm></screen></entry><entry><screen>string</screen></entry><entry><screen/></entry><entry>If given, specifies the parent interface name or parent connection UUID from which this MAC-VLAN interface should be created.  If this property is not specified, the connection must contain an "802-3-ethernet" setting with a "mac-address" property.</entry></row><row><entry><screen>promiscuous<indexterm zone="settings-macvlan"><primary sortas="promiscuous">promiscuous</primary></indexterm></screen></entry><entry><screen>boolean</screen></entry><entry><screen>TRUE</screen></entry><entry>Whether the interface should be put in promiscuous mode.</entry></row><row><entry><screen>tap<indexterm zone="settings-macvlan"><primary sortas="tap">tap</primary></indexterm></screen></entry><entry><screen>boolean</screen></entry><entry><screen>FALSE</screen></entry><entry>Whether the interface should be a MACVTAP.</entry></row></tbody></tgroup></table></para></refsect1></refentry><refentry id="settings-match"><refnamediv><refname>match</refname><refpurpose>Match settings</refpurpose></refnamediv><refsect1 role="properties"><title id="settings-match.properties">
             Properties
@@ -406,7 +416,17 @@ If set to 1 (true), the kernel will try to bind VFs to a compatible driver and i
 
 If set to 0 (false), VFs will not be claimed and no network interfaces will be created for them.
 
-When set to -1 (default), the global default is used; in case the global default is unspecified it is assumed to be 1 (true).</entry></row><row><entry><screen>total-vfs<indexterm zone="settings-sriov"><primary sortas="total-vfs">total-vfs</primary></indexterm></screen></entry><entry><screen>uint32</screen></entry><entry><screen>0</screen></entry><entry>The total number of virtual functions to create.
+When set to -1 (default), the global default is used; in case the global default is unspecified it is assumed to be 1 (true).</entry></row><row><entry><screen>eswitch-encap-mode<indexterm zone="settings-sriov"><primary sortas="eswitch-encap-mode">eswitch-encap-mode</primary></indexterm></screen></entry><entry><screen>int32</screen></entry><entry><screen>-1</screen></entry><entry>Select the eswitch encapsulation support.
+
+Currently it's only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF.
+
+If set to -1 (preserve) (default) the eswitch encap-mode won't be modified by NetworkManager.</entry></row><row><entry><screen>eswitch-inline-mode<indexterm zone="settings-sriov"><primary sortas="eswitch-inline-mode">eswitch-inline-mode</primary></indexterm></screen></entry><entry><screen>int32</screen></entry><entry><screen>-1</screen></entry><entry>Select the eswitch inline-mode of the device. Some HWs need the VF driver to put part of the packet headers on the TX descriptor so the e-switch can do proper matching and steering.
+
+Currently it's only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF.
+
+If set to -1 (preserve) (default) the eswitch inline-mode won't be modified by NetworkManager.</entry></row><row><entry><screen>eswitch-mode<indexterm zone="settings-sriov"><primary sortas="eswitch-mode">eswitch-mode</primary></indexterm></screen></entry><entry><screen>int32</screen></entry><entry><screen>-1</screen></entry><entry>Select the eswitch mode of the device. Currently it's only supported for PCI PF devices, and only if the eswitch device is managed from the same PCI address than the PF.
+
+If set to -1 (preserve) (default) the eswitch mode won't be modified by NetworkManager.</entry></row><row><entry><screen>total-vfs<indexterm zone="settings-sriov"><primary sortas="total-vfs">total-vfs</primary></indexterm></screen></entry><entry><screen>uint32</screen></entry><entry><screen>0</screen></entry><entry>The total number of virtual functions to create.
 
 Note that when the sriov setting is present NetworkManager enforces the number of virtual functions on the interface (also when it is zero) during activation and resets it upon deactivation. To prevent any changes to SR-IOV parameters don't add a sriov setting to the connection.</entry></row><row><entry><screen>vfs<indexterm zone="settings-sriov"><primary sortas="vfs">vfs</primary></indexterm></screen></entry><entry><screen>array of vardict</screen></entry><entry><screen/></entry><entry>Array of virtual function descriptors.