diff options
Diffstat (limited to 'man/nm-settings-nmcli.xml')
| -rw-r--r-- | man/nm-settings-nmcli.xml | 512 |
1 files changed, 465 insertions, 47 deletions
diff --git a/man/nm-settings-nmcli.xml b/man/nm-settings-nmcli.xml index 87e85b18..12e11822 100644 --- a/man/nm-settings-nmcli.xml +++ b/man/nm-settings-nmcli.xml @@ -1,6 +1,6 @@ <?xml version="1.0"?> <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.3//EN" "http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd"> -<refentry id="nm-settings-nmcli"><refentryinfo><title>nm-settings-nmcli</title><author>NetworkManager developers</author></refentryinfo><refmeta><refentrytitle>nm-settings-nmcli</refentrytitle><manvolnum>5</manvolnum><refmiscinfo class="source">NetworkManager</refmiscinfo><refmiscinfo class="manual">Configuration</refmiscinfo><refmiscinfo class="version">1.32.12</refmiscinfo></refmeta><refnamediv><refname>nm-settings-nmcli</refname><refpurpose>Description of settings and properties of NetworkManager connection profiles for nmcli</refpurpose></refnamediv><refsect1 id="description"><title>Description</title><para> +<refentry id="nm-settings-nmcli"><refentryinfo><title>nm-settings-nmcli</title><author>NetworkManager developers</author></refentryinfo><refmeta><refentrytitle>nm-settings-nmcli</refentrytitle><manvolnum>5</manvolnum><refmiscinfo class="source">NetworkManager</refmiscinfo><refmiscinfo class="manual">Configuration</refmiscinfo><refmiscinfo class="version">1.34.0</refmiscinfo></refmeta><refnamediv><refname>nm-settings-nmcli</refname><refpurpose>Description of settings and properties of NetworkManager connection profiles for nmcli</refpurpose></refnamediv><refsect1 id="description"><title>Description</title><para> NetworkManager is based on a concept of connection profiles, sometimes referred to as connections only. These connection profiles contain a network configuration. When NetworkManager activates a connection profile on a network device the configuration will @@ -35,11 +35,12 @@ Properties: <variablelist><varlistentry><term><option id="nm-settings-nmcli.property.connection.auth-retries">auth-retries</option></term><listitem><para>The number of retries for the authentication. Zero means to try indefinitely; -1 means to use a global default. If the global default is not set, the authentication retries for 3 times before failing the connection. Currently, this only applies to 802-1x authentication.</para><para> Format: int32</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.connection.autoconnect">autoconnect</option></term><listitem><para> - Alias: autoconnect</para><para>Whether or not the connection should be automatically connected by NetworkManager when the resources for the connection are available. TRUE to automatically activate the connection, FALSE to require manual intervention to activate the connection. Note that autoconnect is not implemented for VPN profiles. See "secondaries" as an alternative to automatically connect VPN profiles.</para><para> - Format: boolean</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.connection.autoconnect-priority">autoconnect-priority</option></term><listitem><para>The autoconnect priority. If the connection is set to autoconnect, connections with higher priority will be preferred. Defaults to 0. The higher number means higher priority.</para><para> + Alias: autoconnect</para><para>Whether or not the connection should be automatically connected by NetworkManager when the resources for the connection are available. TRUE to automatically activate the connection, FALSE to require manual intervention to activate the connection. Autoconnect happens when the circumstances are suitable. That means for example that the device is currently managed and not active. Autoconnect thus never replaces or competes with an already active profile. Note that autoconnect is not implemented for VPN profiles. See "secondaries" as an alternative to automatically connect VPN profiles.</para><para> + Format: boolean</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.connection.autoconnect-priority">autoconnect-priority</option></term><listitem><para>The autoconnect priority in range -999 to 999. If the connection is set to autoconnect, connections with higher priority will be preferred. The higher number means higher priority. Defaults to 0. Note that this property only matters if there are more than one candidate profile to select for autoconnect. In case of equal priority, the profile used most recently is chosen.</para><para> Format: int32</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.connection.autoconnect-retries">autoconnect-retries</option></term><listitem><para>The number of times a connection should be tried when autoactivating before giving up. Zero means forever, -1 means the global default (4 times if not overridden). Setting this to 1 means to try activation only once before blocking autoconnect. Note that after a timeout, NetworkManager will try to autoconnect again.</para><para> Format: int32</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.connection.autoconnect-slaves">autoconnect-slaves</option></term><listitem><para>Whether or not slaves of this connection should be automatically brought up when NetworkManager activates this connection. This only has a real effect for master connections. The properties "autoconnect", "autoconnect-priority" and "autoconnect-retries" are unrelated to this setting. The permitted values are: 0: leave slave connections untouched, 1: activate all the slave connections with this connection, -1: default. If -1 (default) is set, global connection.autoconnect-slaves is read to determine the real value. If it is default as well, this fallbacks to 0.</para><para> - Format: NMSettingConnectionAutoconnectSlaves (int32)</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.connection.gateway-ping-timeout">gateway-ping-timeout</option></term><listitem><para>If greater than zero, delay success of IP addressing until either the timeout is reached, or an IP gateway replies to a ping.</para><para> + Format: NMSettingConnectionAutoconnectSlaves (int32)</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.connection.dns-over-tls">dns-over-tls</option></term><listitem><para>Whether DNSOverTls (dns-over-tls) is enabled for the connection. DNSOverTls is a technology which uses TLS to encrypt dns traffic. The permitted values are: "yes" (2) use DNSOverTls and disabled fallback, "opportunistic" (1) use DNSOverTls but allow fallback to unencrypted resolution, "no" (0) don't ever use DNSOverTls. If unspecified "default" depends on the plugin used. Systemd-resolved uses global setting. This feature requires a plugin which supports DNSOverTls. Otherwise, the setting has no effect. One such plugin is dns-systemd-resolved.</para><para> + Format: int32</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.connection.gateway-ping-timeout">gateway-ping-timeout</option></term><listitem><para>If greater than zero, delay success of IP addressing until either the timeout is reached, or an IP gateway replies to a ping.</para><para> Format: uint32</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.connection.id">id</option></term><listitem><para> Alias: con-name</para><para>A human readable unique identifier for the connection, like "Work Wi-Fi" or "T-Mobile 3G".</para><para> Format: string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.connection.interface-name">interface-name</option></term><listitem><para> @@ -76,14 +77,14 @@ Format: int32</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-1x.ca-cert">ca-cert</option></term><listitem><para>Contains the CA certificate if used by the EAP method specified in the "eap" property. Certificate data is specified using a "scheme"; three are currently supported: blob, path and pkcs#11 URL. When using the blob scheme this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended. Note that enabling NMSetting8021x:system-ca-certs will override this setting to use the built-in path, if the built-in path is not a directory.</para><para> Format: byte array</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-1x.ca-cert-password">ca-cert-password</option></term><listitem><para>The password used to access the CA certificate stored in "ca-cert" property. Only makes sense if the certificate is stored on a PKCS#11 token that requires a login.</para><para> Format: string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-1x.ca-cert-password-flags">ca-cert-password-flags</option></term><listitem><para>Flags indicating how to handle the "ca-cert-password" property. - See <xref linkend="secrets-flags"/> for flag values. - </para><para> + See <xref linkend="secrets-flags"/> for flag values. + </para><para> Format: NMSettingSecretFlags (uint32)</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-1x.ca-path">ca-path</option></term><listitem><para>UTF-8 encoded path to a directory containing PEM or DER formatted certificates to be added to the verification chain in addition to the certificate specified in the "ca-cert" property. If NMSetting8021x:system-ca-certs is enabled and the built-in CA path is an existing directory, then this setting is ignored.</para><para> Format: string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-1x.client-cert">client-cert</option></term><listitem><para>Contains the client certificate if used by the EAP method specified in the "eap" property. Certificate data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte.</para><para> Format: byte array</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-1x.client-cert-password">client-cert-password</option></term><listitem><para>The password used to access the client certificate stored in "client-cert" property. Only makes sense if the certificate is stored on a PKCS#11 token that requires a login.</para><para> Format: string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-1x.client-cert-password-flags">client-cert-password-flags</option></term><listitem><para>Flags indicating how to handle the "client-cert-password" property. - See <xref linkend="secrets-flags"/> for flag values. - </para><para> + See <xref linkend="secrets-flags"/> for flag values. + </para><para> Format: NMSettingSecretFlags (uint32)</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-1x.domain-match">domain-match</option></term><listitem><para>Constraint for server domain name. If set, this list of FQDNs is used as a match requirement for dNSName element(s) of the certificate presented by the authentication server. If a matching dNSName is found, this constraint is met. If no dNSName values are present, this constraint is matched against SubjectName CN using the same comparison. Multiple valid FQDNs can be passed as a ";" delimited list.</para><para> Format: string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-1x.domain-suffix-match">domain-suffix-match</option></term><listitem><para>Constraint for server domain name. If set, this FQDN is used as a suffix match requirement for dNSName element(s) of the certificate presented by the authentication server. If a matching dNSName is found, this constraint is met. If no dNSName values are present, this constraint is matched against SubjectName CN using same suffix match comparison. Since version 1.24, multiple valid FQDNs can be passed as a ";" delimited list.</para><para> Format: string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-1x.eap">eap</option></term><listitem><para>The allowed EAP method to be used when authenticating to the network with 802.1x. Valid methods are: "leap", "md5", "tls", "peap", "ttls", "pwd", and "fast". Each method requires different configuration using the properties of this setting; refer to wpa_supplicant documentation for the allowed combinations.</para><para> @@ -92,12 +93,12 @@ Format: boolean</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-1x.pac-file">pac-file</option></term><listitem><para>UTF-8 encoded file path containing PAC for EAP-FAST.</para><para> Format: string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-1x.password">password</option></term><listitem><para>UTF-8 encoded password used for EAP authentication methods. If both the "password" property and the "password-raw" property are specified, "password" is preferred.</para><para> Format: string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-1x.password-flags">password-flags</option></term><listitem><para>Flags indicating how to handle the "password" property. - See <xref linkend="secrets-flags"/> for flag values. - </para><para> + See <xref linkend="secrets-flags"/> for flag values. + </para><para> Format: NMSettingSecretFlags (uint32)</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-1x.password-raw">password-raw</option></term><listitem><para>Password used for EAP authentication methods, given as a byte array to allow passwords in other encodings than UTF-8 to be used. If both the "password" property and the "password-raw" property are specified, "password" is preferred.</para><para> Format: byte array</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-1x.password-raw-flags">password-raw-flags</option></term><listitem><para>Flags indicating how to handle the "password-raw" property. - See <xref linkend="secrets-flags"/> for flag values. - </para><para> + See <xref linkend="secrets-flags"/> for flag values. + </para><para> Format: NMSettingSecretFlags (uint32)</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-1x.phase1-auth-flags">phase1-auth-flags</option></term><listitem><para>Specifies authentication flags to use in "phase 1" outer authentication using NMSetting8021xAuthFlags options. The individual TLS versions can be explicitly disabled. If a certain TLS disable flag is not set, it is up to the supplicant to allow or forbid it. The TLS options map to tls_disable_tlsv1_x settings. See the wpa_supplicant documentation for more details.</para><para> Format: uint32</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-1x.phase1-fast-provisioning">phase1-fast-provisioning</option></term><listitem><para>Enables or disables in-line provisioning of EAP-FAST credentials when FAST is specified as the EAP method in the "eap" property. Recognized values are "0" (disabled), "1" (allow unauthenticated provisioning), "2" (allow authenticated provisioning), and "3" (allow both authenticated and unauthenticated provisioning). See the wpa_supplicant documentation for more details.</para><para> Format: string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-1x.phase1-peaplabel">phase1-peaplabel</option></term><listitem><para>Forces use of the new PEAP label during key derivation. Some RADIUS servers may require forcing the new PEAP label to interoperate with PEAPv1. Set to "1" to force use of the new PEAP label. See the wpa_supplicant documentation for more details.</para><para> @@ -108,31 +109,31 @@ Format: string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-1x.phase2-ca-cert">phase2-ca-cert</option></term><listitem><para>Contains the "phase 2" CA certificate if used by the EAP method specified in the "phase2-auth" or "phase2-autheap" properties. Certificate data is specified using a "scheme"; three are currently supported: blob, path and pkcs#11 URL. When using the blob scheme this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended. Note that enabling NMSetting8021x:system-ca-certs will override this setting to use the built-in path, if the built-in path is not a directory.</para><para> Format: byte array</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-1x.phase2-ca-cert-password">phase2-ca-cert-password</option></term><listitem><para>The password used to access the "phase2" CA certificate stored in "phase2-ca-cert" property. Only makes sense if the certificate is stored on a PKCS#11 token that requires a login.</para><para> Format: string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-1x.phase2-ca-cert-password-flags">phase2-ca-cert-password-flags</option></term><listitem><para>Flags indicating how to handle the "phase2-ca-cert-password" property. - See <xref linkend="secrets-flags"/> for flag values. - </para><para> + See <xref linkend="secrets-flags"/> for flag values. + </para><para> Format: NMSettingSecretFlags (uint32)</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-1x.phase2-ca-path">phase2-ca-path</option></term><listitem><para>UTF-8 encoded path to a directory containing PEM or DER formatted certificates to be added to the verification chain in addition to the certificate specified in the "phase2-ca-cert" property. If NMSetting8021x:system-ca-certs is enabled and the built-in CA path is an existing directory, then this setting is ignored.</para><para> Format: string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-1x.phase2-client-cert">phase2-client-cert</option></term><listitem><para>Contains the "phase 2" client certificate if used by the EAP method specified in the "phase2-auth" or "phase2-autheap" properties. Certificate data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended.</para><para> Format: byte array</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-1x.phase2-client-cert-password">phase2-client-cert-password</option></term><listitem><para>The password used to access the "phase2" client certificate stored in "phase2-client-cert" property. Only makes sense if the certificate is stored on a PKCS#11 token that requires a login.</para><para> Format: string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-1x.phase2-client-cert-password-flags">phase2-client-cert-password-flags</option></term><listitem><para>Flags indicating how to handle the "phase2-client-cert-password" property. - See <xref linkend="secrets-flags"/> for flag values. - </para><para> + See <xref linkend="secrets-flags"/> for flag values. + </para><para> Format: NMSettingSecretFlags (uint32)</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-1x.phase2-domain-match">phase2-domain-match</option></term><listitem><para>Constraint for server domain name. If set, this list of FQDNs is used as a match requirement for dNSName element(s) of the certificate presented by the authentication server during the inner "phase 2" authentication. If a matching dNSName is found, this constraint is met. If no dNSName values are present, this constraint is matched against SubjectName CN using the same comparison. Multiple valid FQDNs can be passed as a ";" delimited list.</para><para> Format: string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-1x.phase2-domain-suffix-match">phase2-domain-suffix-match</option></term><listitem><para>Constraint for server domain name. If set, this FQDN is used as a suffix match requirement for dNSName element(s) of the certificate presented by the authentication server during the inner "phase 2" authentication. If a matching dNSName is found, this constraint is met. If no dNSName values are present, this constraint is matched against SubjectName CN using same suffix match comparison. Since version 1.24, multiple valid FQDNs can be passed as a ";" delimited list.</para><para> Format: string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-1x.phase2-private-key">phase2-private-key</option></term><listitem><para>Contains the "phase 2" inner private key when the "phase2-auth" or "phase2-autheap" property is set to "tls". Key data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme and private keys, this property should be set to the key's encrypted PEM encoded data. When using private keys with the path scheme, this property should be set to the full UTF-8 encoded path of the key, prefixed with the string "file://" and ending with a terminating NUL byte. When using PKCS#12 format private keys and the blob scheme, this property should be set to the PKCS#12 data and the "phase2-private-key-password" property must be set to password used to decrypt the PKCS#12 certificate and key. When using PKCS#12 files and the path scheme, this property should be set to the full UTF-8 encoded path of the key, prefixed with the string "file://" and ending with a terminating NUL byte, and as with the blob scheme the "phase2-private-key-password" property must be set to the password used to decode the PKCS#12 private key and certificate.</para><para> Format: byte array</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-1x.phase2-private-key-password">phase2-private-key-password</option></term><listitem><para>The password used to decrypt the "phase 2" private key specified in the "phase2-private-key" property when the private key either uses the path scheme, or is a PKCS#12 format key.</para><para> Format: string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-1x.phase2-private-key-password-flags">phase2-private-key-password-flags</option></term><listitem><para>Flags indicating how to handle the "phase2-private-key-password" property. - See <xref linkend="secrets-flags"/> for flag values. - </para><para> + See <xref linkend="secrets-flags"/> for flag values. + </para><para> Format: NMSettingSecretFlags (uint32)</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-1x.phase2-subject-match">phase2-subject-match</option></term><listitem><para>Substring to be matched against the subject of the certificate presented by the authentication server during the inner "phase 2" authentication. When unset, no verification of the authentication server certificate's subject is performed. This property provides little security, if any, and its use is deprecated in favor of NMSetting8021x:phase2-domain-suffix-match.</para><para> Format: string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-1x.pin">pin</option></term><listitem><para>PIN used for EAP authentication methods.</para><para> Format: string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-1x.pin-flags">pin-flags</option></term><listitem><para>Flags indicating how to handle the "pin" property. - See <xref linkend="secrets-flags"/> for flag values. - </para><para> + See <xref linkend="secrets-flags"/> for flag values. + </para><para> Format: NMSettingSecretFlags (uint32)</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-1x.private-key">private-key</option></term><listitem><para>Contains the private key when the "eap" property is set to "tls". Key data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme and private keys, this property should be set to the key's encrypted PEM encoded data. When using private keys with the path scheme, this property should be set to the full UTF-8 encoded path of the key, prefixed with the string "file://" and ending with a terminating NUL byte. When using PKCS#12 format private keys and the blob scheme, this property should be set to the PKCS#12 data and the "private-key-password" property must be set to password used to decrypt the PKCS#12 certificate and key. When using PKCS#12 files and the path scheme, this property should be set to the full UTF-8 encoded path of the key, prefixed with the string "file://" and ending with a terminating NUL byte, and as with the blob scheme the "private-key-password" property must be set to the password used to decode the PKCS#12 private key and certificate. WARNING: "private-key" is not a "secret" property, and thus unencrypted private key data using the BLOB scheme may be readable by unprivileged users. Private keys should always be encrypted with a private key password to prevent unauthorized access to unencrypted private key data.</para><para> Format: byte array</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-1x.private-key-password">private-key-password</option></term><listitem><para>The password used to decrypt the private key specified in the "private-key" property when the private key either uses the path scheme, or if the private key is a PKCS#12 format key.</para><para> Format: string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-1x.private-key-password-flags">private-key-password-flags</option></term><listitem><para>Flags indicating how to handle the "private-key-password" property. - See <xref linkend="secrets-flags"/> for flag values. - </para><para> + See <xref linkend="secrets-flags"/> for flag values. + </para><para> Format: NMSettingSecretFlags (uint32)</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-1x.subject-match">subject-match</option></term><listitem><para>Substring to be matched against the subject of the certificate presented by the authentication server. When unset, no verification of the authentication server certificate's subject is performed. This property provides little security, if any, and its use is deprecated in favor of NMSetting8021x:domain-suffix-match.</para><para> Format: string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-1x.system-ca-certs">system-ca-certs</option></term><listitem><para>When TRUE, overrides the "ca-path" and "phase2-ca-path" properties using the system CA directory specified at configure time with the --system-ca-path switch. The certificates in this directory are added to the verification chain in addition to any certificates specified by the "ca-cert" and "phase2-ca-cert" properties. If the path provided with --system-ca-path is rather a file name (bundle of trusted CA certificates), it overrides "ca-cert" and "phase2-ca-cert" properties instead (sets ca_cert/ca_cert2 options for wpa_supplicant).</para><para> Format: boolean</para></listitem></varlistentry></variablelist></para></refsect2><refsect2><title>adsl setting</title><para>ADSL Settings.</para><para> @@ -142,8 +143,8 @@ Format: string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.adsl.password">password</option></term><listitem><para> Alias: password</para><para>Password used to authenticate with the ADSL service.</para><para> Format: string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.adsl.password-flags">password-flags</option></term><listitem><para>Flags indicating how to handle the "password" property. - See <xref linkend="secrets-flags"/> for flag values. - </para><para> + See <xref linkend="secrets-flags"/> for flag values. + </para><para> Format: NMSettingSecretFlags (uint32)</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.adsl.protocol">protocol</option></term><listitem><para> Alias: protocol</para><para>ADSL connection protocol. Can be "pppoa", "pppoe" or "ipoatm".</para><para> Format: string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.adsl.username">username</option></term><listitem><para> @@ -213,14 +214,14 @@ Format: string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.cdma.password">password</option></term><listitem><para> Alias: password</para><para>The password used to authenticate with the network, if required. Many providers do not require a password, or accept any password. But if a password is required, it is specified here.</para><para> Format: string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.cdma.password-flags">password-flags</option></term><listitem><para>Flags indicating how to handle the "password" property. - See <xref linkend="secrets-flags"/> for flag values. - </para><para> + See <xref linkend="secrets-flags"/> for flag values. + </para><para> Format: NMSettingSecretFlags (uint32)</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.cdma.username">username</option></term><listitem><para> Alias: user</para><para>The username used to authenticate with the network, if required. Many providers do not require a username, or accept any username. But if a username is required, it is specified here.</para><para> Format: string</para></listitem></varlistentry></variablelist></para></refsect2><refsect2><title>dcb setting</title><para>Data Center Bridging Settings.</para><para> Properties: <variablelist><varlistentry><term><option id="nm-settings-nmcli.property.dcb.app-fcoe-flags">app-fcoe-flags</option></term><listitem><para>Specifies the NMSettingDcbFlags for the DCB FCoE application. Flags may be any combination of NM_SETTING_DCB_FLAG_ENABLE (0x1), NM_SETTING_DCB_FLAG_ADVERTISE (0x2), and NM_SETTING_DCB_FLAG_WILLING (0x4).</para><para> - Format: NMSettingDcbFlags (uint32)</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.dcb.app-fcoe-mode">app-fcoe-mode</option></term><listitem><para>The FCoE controller mode; either "fabric" (default) or "vn2vn".</para><para> + Format: NMSettingDcbFlags (uint32)</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.dcb.app-fcoe-mode">app-fcoe-mode</option></term><listitem><para>The FCoE controller mode; either "fabric" or "vn2vn". Since 1.34, NULL is the default and means "fabric". Before 1.34, NULL was rejected as invalid and the default was "fabric".</para><para> Format: string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.dcb.app-fcoe-priority">app-fcoe-priority</option></term><listitem><para>The highest User Priority (0 - 7) which FCoE frames should use, or -1 for default priority. Only used when the "app-fcoe-flags" property includes the NM_SETTING_DCB_FLAG_ENABLE (0x1) flag.</para><para> Format: int32</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.dcb.app-fip-flags">app-fip-flags</option></term><listitem><para>Specifies the NMSettingDcbFlags for the DCB FIP application. Flags may be any combination of NM_SETTING_DCB_FLAG_ENABLE (0x1), NM_SETTING_DCB_FLAG_ADVERTISE (0x2), and NM_SETTING_DCB_FLAG_WILLING (0x4).</para><para> Format: NMSettingDcbFlags (uint32)</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.dcb.app-fip-priority">app-fip-priority</option></term><listitem><para>The highest User Priority (0 - 7) which FIP frames should use, or -1 for default priority. Only used when the "app-fip-flags" property includes the NM_SETTING_DCB_FLAG_ENABLE (0x1) flag.</para><para> @@ -249,12 +250,12 @@ Format: string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.gsm.password">password</option></term><listitem><para> Alias: password</para><para>The password used to authenticate with the network, if required. Many providers do not require a password, or accept any password. But if a password is required, it is specified here.</para><para> Format: string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.gsm.password-flags">password-flags</option></term><listitem><para>Flags indicating how to handle the "password" property. - See <xref linkend="secrets-flags"/> for flag values. - </para><para> + See <xref linkend="secrets-flags"/> for flag values. + </para><para> Format: NMSettingSecretFlags (uint32)</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.gsm.pin">pin</option></term><listitem><para>If the SIM is locked with a PIN it must be unlocked before any other operations are requested. Specify the PIN here to allow operation of the device.</para><para> Format: string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.gsm.pin-flags">pin-flags</option></term><listitem><para>Flags indicating how to handle the "pin" property. - See <xref linkend="secrets-flags"/> for flag values. - </para><para> + See <xref linkend="secrets-flags"/> for flag values. + </para><para> Format: NMSettingSecretFlags (uint32)</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.gsm.sim-id">sim-id</option></term><listitem><para>The SIM card unique identifier (as given by the WWAN management service) which this connection applies to. If given, the connection will apply to any device also allowed by "device-id" which contains a SIM card matching the given identifier.</para><para> Format: string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.gsm.sim-operator-id">sim-operator-id</option></term><listitem><para>A MCC/MNC string like "310260" or "21601" identifying the specific mobile network operator which this connection applies to. If given, the connection will apply to any device also allowed by "device-id" and "sim-id" which contains a SIM card provisioned by the given operator.</para><para> Format: string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.gsm.username">username</option></term><listitem><para> @@ -355,8 +356,8 @@ Format: boolean</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.macsec.mka-cak">mka-cak</option></term><listitem><para> Alias: cak</para><para>The pre-shared CAK (Connectivity Association Key) for MACsec Key Agreement.</para><para> Format: string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.macsec.mka-cak-flags">mka-cak-flags</option></term><listitem><para>Flags indicating how to handle the "mka-cak" property. - See <xref linkend="secrets-flags"/> for flag values. - </para><para> + See <xref linkend="secrets-flags"/> for flag values. + </para><para> Format: NMSettingSecretFlags (uint32)</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.macsec.mka-ckn">mka-ckn</option></term><listitem><para> Alias: ckn</para><para>The pre-shared CKN (Connectivity-association Key Name) for MACsec Key Agreement.</para><para> Format: string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.macsec.mode">mode</option></term><listitem><para> @@ -442,8 +443,8 @@ Format: string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.pppoe.password">password</option></term><listitem><para> Alias: password</para><para>Password used to authenticate with the PPPoE service.</para><para> Format: string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.pppoe.password-flags">password-flags</option></term><listitem><para>Flags indicating how to handle the "password" property. - See <xref linkend="secrets-flags"/> for flag values. - </para><para> + See <xref linkend="secrets-flags"/> for flag values. + </para><para> Format: NMSettingSecretFlags (uint32)</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.pppoe.service">service</option></term><listitem><para> Alias: service</para><para>If specified, instruct PPPoE to only initiate sessions with access concentrators that provide the specified service. For most providers, this should be left blank. It is only required if there are multiple access concentrators or a specific service is known to be required.</para><para> Format: string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.pppoe.username">username</option></term><listitem><para> @@ -472,9 +473,422 @@ Format: uint32</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.sriov.vfs">vfs</option></term><listitem><para>Array of virtual function descriptors. Each VF descriptor is a dictionary mapping attribute names to GVariant values. The 'index' entry is mandatory for each VF. When represented as string a VF is in the form: "INDEX [ATTR=VALUE[ ATTR=VALUE]...]". for example: "2 mac=00:11:22:33:44:55 spoof-check=true". Multiple VFs can be specified using a comma as separator. Currently, the following attributes are supported: mac, spoof-check, trust, min-tx-rate, max-tx-rate, vlans. The "vlans" attribute is represented as a semicolon-separated list of VLAN descriptors, where each descriptor has the form "ID[.PRIORITY[.PROTO]]". PROTO can be either 'q' for 802.1Q (the default) or 'ad' for 802.1ad.</para><para> Format: array of vardict</para></listitem></varlistentry></variablelist></para></refsect2><refsect2><title>tc setting</title><para>Linux Traffic Control Settings.</para><para> Properties: - <variablelist><varlistentry><term><option id="nm-settings-nmcli.property.tc.qdiscs">qdiscs</option></term><listitem><para>Array of TC queueing disciplines. When the "tc" setting is present, qdiscs from this property are applied upon activation. If the property is empty, all qdiscs are removed and the device will only have the default qdisc assigned by kernel according to the "net.core.default_qdisc" sysctl. If the "tc" setting is not present, NetworkManager doesn't touch the qdiscs present on the interface.</para><para> - Format: array of vardict</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.tc.tfilters">tfilters</option></term><listitem><para>Array of TC traffic filters. When the "tc" setting is present, filters from this property are applied upon activation. If the property is empty, NetworkManager removes all the filters. If the "tc" setting is not present, NetworkManager doesn't touch the filters present on the interface.</para><para> - Format: array of vardict</para></listitem></varlistentry></variablelist></para></refsect2><refsect2><title>team setting</title><para>Teaming Settings.</para><para> + <variablelist><varlistentry><term><option id="nm-settings-nmcli.property.tc.qdiscs">qdiscs</option></term><listitem><para> +Array of TC queueing disciplines. qdisc is a basic block in the +Linux traffic control subsystem +</para><para> +Each qdisc can be specified by the following attributes: +</para><variablelist> +<varlistentry> +<term> +<varname>handle HANDLE</varname> +</term> +<listitem> +<para> +specifies the qdisc handle. A qdisc, which potentially can have children, gets +assigned a major number, called a 'handle', leaving the minor number namespace +available for classes. The handle is expressed as '10:'. It is customary to +explicitly assign a handle to qdiscs expected to have children. +</para> +</listitem> +</varlistentry> +<varlistentry> +<term> +<varname>parent HANDLE</varname> +</term> +<listitem> +<para> +specifies the handle of the parent qdisc the current qdisc must be +attached to. +</para> +</listitem> +</varlistentry> +<varlistentry> +<term> +<varname>root</varname> +</term> +<listitem> +<para> +specifies that the qdisc is attached to the root of device. +</para> +</listitem> +</varlistentry> +<varlistentry> +<term> +<varname>KIND</varname> +</term> +<listitem> +<para> +this is the qdisc kind. NetworkManager currently supports the +following kinds: fq_codel, sfq, tbf. Each qdisc kind has a +different set of parameters, described below. There are also some +kinds like pfifo, pfifo_fast, prio supported by NetworkManager +but their parameters are not supported by NetworkManager. +</para> +</listitem> +</varlistentry> +</variablelist><para> +Parameters for 'fq_codel': +</para><variablelist> +<varlistentry> +<term> +<varname>limit U32</varname> +</term> +<listitem> +<para> +the hard limit on the real queue size. When this limit is +reached, incoming packets are dropped. Default is 10240 packets. +</para> +</listitem> +</varlistentry> +<varlistentry> +<term> +<varname>memory_limit U32</varname> +</term> +<listitem> +<para> +sets a limit on the total number of bytes that can be queued in +this FQ-CoDel instance. The lower of the packet limit of the +limit parameter and the memory limit will be enforced. Default is +32 MB. +</para> +</listitem> +</varlistentry> +<varlistentry> +<term> +<varname>flows U32</varname> +</term> +<listitem> +<para> +the number of flows into which the incoming packets are +classified. Due to the stochastic nature of hashing, multiple +flows may end up being hashed into the same slot. Newer flows +have priority over older ones. This parameter can be set only at +load time since memory has to be allocated for the hash table. +Default value is 1024. +</para> +</listitem> +</varlistentry> +<varlistentry> +<term> +<varname>target U32</varname> +</term> +<listitem> +<para> +the acceptable minimum standing/persistent queue delay. This minimum +delay is identified by tracking the local minimum queue delay that packets +experience. The unit of measurement is microsecond(us). Default value is 5ms. +</para> +</listitem> +</varlistentry> +<varlistentry> +<term> +<varname>interval U32</varname> +</term> +<listitem> +<para> +used to ensure that the measured minimum delay does not become too stale. +The minimum delay must be experienced in the last epoch of length .B +interval. It should be set on the order of the worst-case RTT +through the bottleneck to give endpoints sufficient time to +react. Default value is 100ms. +</para> +</listitem> +</varlistentry> +<varlistentry> +<term> +<varname>quantum U32</varname> +</term> +<listitem> +<para> +the number of bytes used as 'deficit' in the fair queuing +algorithm. Default is set to 1514 bytes which corresponds to the +Ethernet MTU plus the hardware header length of 14 bytes. +</para> +</listitem> +</varlistentry> +<varlistentry> +<term> +<varname>ecn BOOL</varname> +</term> +<listitem> +<para> +can be used to mark packets instead of dropping them. ecn is turned +on by default. +</para> +</listitem> +</varlistentry> +<varlistentry> +<term> +<varname>ce_threshold U32</varname> +</term> +<listitem> +<para> +sets a threshold above which all packets are marked with ECN +Congestion Experienced. This is useful for DCTCP-style congestion +control algorithms that require marking at very shallow queueing +thresholds. +</para> +</listitem> +</varlistentry> +</variablelist><para> +Parameters for 'sfq': +</para><variablelist> +<varlistentry> +<term> +<varname>divisor U32</varname> +</term> +<listitem> +<para> +can be used to set a different hash table size, available +from kernel 2.6.39 onwards. The specified divisor must be +a power of two and cannot be larger than 65536. Default +value: 1024. +</para> +</listitem> +</varlistentry> +<varlistentry> +<term> +<varname>limit U32</varname> +</term> +<listitem> +<para> +Upper limit of the SFQ. Can be used to reduce the default +length of 127 packets. +</para> +</listitem> +</varlistentry> +<varlistentry> +<term> +<varname>depth U32</varname> +</term> +<listitem> +<para> +Limit of packets per flow. Default to +127 and can be lowered. +</para> +</listitem> +</varlistentry> +<varlistentry> +<term> +<varname>perturb_period U32</varname> +</term> +<listitem> +<para> +Interval in seconds for queue algorithm perturbation. +Defaults to 0, which means that no perturbation occurs. Do +not set too low for each perturbation may cause some +packet reordering or losses. Advised value: 60 This value +has no effect when external flow classification is used. +Its better to increase divisor value to lower risk of hash +collisions. +</para> +</listitem> +</varlistentry> +<varlistentry> +<term> +<varname>quantum U32</varname> +</term> +<listitem> +<para> +Amount of bytes a flow is allowed to dequeue during a +round of the round robin process. Defaults to the MTU of +the interface which is also the advised value and the +minimum value. +</para> +</listitem> +</varlistentry> +<varlistentry> +<term> +<varname>flows U32</varname> +</term> +<listitem> +<para> +Default value is 127. +</para> +</listitem> +</varlistentry> +</variablelist><para> +Parameters for 'tbf': +</para><variablelist> +<varlistentry> +<term> +<varname>rate U64</varname> +</term> +<listitem> +<para> +Bandwidth or rate. These parameters accept a floating +point number, possibly followed by either a unit (both SI +and IEC units supported), or a float followed by a percent +character to specify the rate as a percentage of the +device's speed. +</para> +</listitem> +</varlistentry> +<varlistentry> +<term> +<varname>burst U32</varname> +</term> +<listitem> +<para> +Also known as buffer or maxburst. Size of the bucket, in +bytes. This is the maximum amount of bytes that tokens can +be available for instantaneously. In general, larger +shaping rates require a larger buffer. For 10mbit/s on +Intel, you need at least 10kbyte buffer if you want to +reach your configured rate! +</para> +<para> +If your buffer is too small, packets may be dropped +because more tokens arrive per timer tick than fit in your +bucket. The minimum buffer size can be calculated by +dividing the rate by HZ. +</para> +<para> +Token usage calculations are performed using a table which +by default has a resolution of 8 packets. This resolution +can be changed by specifying the cell size with the burst. +For example, to specify a 6000 byte buffer with a 16 byte +cell size, set a burst of 6000/16. You will probably never +have to set this. Must be an integral power of 2. +</para> +</listitem> +</varlistentry> +<varlistentry> +<term> +<varname>limit U32</varname> +</term> +<listitem> +<para> +Limit is the number of bytes that can be queued waiting +for tokens to become available. +</para> +</listitem> +</varlistentry> +<varlistentry> +<term> +<varname>latency U32</varname> +</term> +<listitem> +<para> +specifies the maximum amount of time a packet can +sit in the TBF. The latency calculation takes into account +the size of the bucket, the rate and possibly the peakrate +(if set). The latency and limit are mutually exclusive. +</para> +</listitem> +</varlistentry> +</variablelist><para> + Format: GPtrArray(NMTCQdisc)</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.tc.tfilters">tfilters</option></term><listitem><para> +Array of TC traffic filters. Traffic control can manage the packet content during +classification by using filters. +</para><para> +Each tfilters can be specified by the following attributes: +</para><variablelist> +<varlistentry> +<term> +<varname>handle HANDLE</varname> +</term> +<listitem> +<para> +specifies the tfilters handle. A filter is used by a classful qdisc to determine in which class +a packet will be enqueued. It is important to notice that filters reside within qdiscs. Therefore, +see qdiscs handle for detailed information. +</para> +</listitem> +</varlistentry> +<varlistentry> +<term> +<varname>parent HANDLE</varname> +</term> +<listitem> +<para> +specifies the handle of the parent qdisc the current qdisc must be +attached to. +</para> +</listitem> +</varlistentry> +<varlistentry> +<term> +<varname>root</varname> +</term> +<listitem> +<para> +specifies that the qdisc is attached to the root of device. +</para> +</listitem> +</varlistentry> +<varlistentry> +<term> +<varname>KIND</varname> +</term> +<listitem> +<para> +this is the tfilters kind. NetworkManager currently supports +following kinds: mirred, simple. Each filter kind has a +different set of actions, described below. There are also some +other kinds like matchall, basic, u32 supported by NetworkManager. +</para> +</listitem> +</varlistentry> +</variablelist><para> +Actions for 'mirred': +</para><variablelist> +<varlistentry> +<term> +<varname>egress bool</varname> +</term> +<listitem> +<para> +Define whether the packet should exit from the interface. +</para> +</listitem> +</varlistentry> +<varlistentry> +<term> +<varname>ingress bool</varname> +</term> +<listitem> +<para> +Define whether the packet should come into the interface. +</para> +</listitem> +</varlistentry> +<varlistentry> +<term> +<varname>mirror bool</varname> +</term> +<listitem> +<para> +Define whether the packet should be copied to the destination space. +</para> +</listitem> +</varlistentry> +<varlistentry> +<term> +<varname>redirect bool</varname> +</term> +<listitem> +<para> +Define whether the packet should be moved to the destination space. +</para> +</listitem> +</varlistentry> +</variablelist><para> +Action for 'simple': +</para><variablelist> +<varlistentry> +<term> +<varname>sdata char[32]</varname> +</term> +<listitem> +<para> +The actual string to print. +</para> +</listitem> +</varlistentry> +</variablelist><para> + Format: GPtrArray(NMTCTfilter)</para></listitem></varlistentry></variablelist></para></refsect2><refsect2><title>team setting</title><para>Teaming Settings.</para><para> Properties: <variablelist><varlistentry><term><option id="nm-settings-nmcli.property.team.config">config</option></term><listitem><para> Alias: config</para><para>The JSON configuration for the team network interface. The property should contain raw JSON configuration data suitable for teamd, because the value is passed directly to teamd. If not specified, the default configuration is used. See man teamd.conf for the format details.</para><para> @@ -596,7 +1010,7 @@ Alias: mtu</para><para>If non-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple Ethernet frames.</para><para> Format: uint32</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-3-ethernet.port">port</option></term><listitem><para>Specific port type to use if the device supports multiple attachment methods. One of "tp" (Twisted Pair), "aui" (Attachment Unit Interface), "bnc" (Thin Ethernet) or "mii" (Media Independent Interface). If the device supports only one port type, this setting is ignored.</para><para> Format: string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-3-ethernet.s390-nettype">s390-nettype</option></term><listitem><para>s390 network device type; one of "qeth", "lcs", or "ctc", representing the different types of virtual network devices available on s390 systems.</para><para> - Format: string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-3-ethernet.s390-options">s390-options</option></term><listitem><para>Dictionary of key/value pairs of s390-specific device options. Both keys and values must be strings. Allowed keys include "portno", "layer2", "portname", "protocol", among others. Key names must contain only alphanumeric characters (ie, [a-zA-Z0-9]).</para><para> + Format: string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-3-ethernet.s390-options">s390-options</option></term><listitem><para>Dictionary of key/value pairs of s390-specific device options. Both keys and values must be strings. Allowed keys include "portno", "layer2", "portname", "protocol", among others. Key names must contain only alphanumeric characters (ie, [a-zA-Z0-9]). Currently, NetworkManager itself does nothing with this information. However, s390utils ships a udev rule which parses this information and applies it to the interface.</para><para> Format: dict of string to string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-3-ethernet.s390-subchannels">s390-subchannels</option></term><listitem><para>Identifies specific subchannels that this network device uses for communication with z/VM or s390 host. Like the "mac-address" property for non-z/VM devices, this property can be used to ensure this connection only applies to the network device that uses these subchannels. The list should contain exactly 3 strings, and each string may only be composed of hexadecimal characters and the period (.) character.</para><para> Format: array of string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-3-ethernet.speed">speed</option></term><listitem><para>When a value greater than 0 is set, configures the device to use the specified speed. If "auto-negotiate" is "yes" the specified speed will be the only one advertised during link negotiation: this works only for BASE-T 802.3 specifications and is useful for enforcing gigabit speeds, as in this case link negotiation is mandatory. If the value is unset (0, the default), the link configuration will be either skipped (if "auto-negotiate" is "no", the default) or will be auto-negotiated (if "auto-negotiate" is "yes") and the local device will advertise all the supported speeds. In Mbit/s, ie 100 == 100Mbit/s. Must be set together with the "duplex" property when non-zero. Before specifying a speed value be sure your device supports it.</para><para> Format: uint32</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-3-ethernet.wake-on-lan">wake-on-lan</option></term><listitem><para>The NMSettingWiredWakeOnLan options to enable. Not all devices support all options. May be any combination of NM_SETTING_WIRED_WAKE_ON_LAN_PHY (0x2), NM_SETTING_WIRED_WAKE_ON_LAN_UNICAST (0x4), NM_SETTING_WIRED_WAKE_ON_LAN_MULTICAST (0x8), NM_SETTING_WIRED_WAKE_ON_LAN_BROADCAST (0x10), NM_SETTING_WIRED_WAKE_ON_LAN_ARP (0x20), NM_SETTING_WIRED_WAKE_ON_LAN_MAGIC (0x40) or the special values NM_SETTING_WIRED_WAKE_ON_LAN_DEFAULT (0x1) (to use global settings) and NM_SETTING_WIRED_WAKE_ON_LAN_IGNORE (0x8000) (to disable management of Wake-on-LAN in NetworkManager).</para><para> @@ -611,8 +1025,8 @@ Format: uint32</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.wireguard.peer-routes">peer-routes</option></term><listitem><para>Whether to automatically add routes for the AllowedIPs ranges of the peers. If TRUE (the default), NetworkManager will automatically add routes in the routing tables according to ipv4.route-table and ipv6.route-table. Usually you want this automatism enabled. If FALSE, no such routes are added automatically. In this case, the user may want to configure static routes in ipv4.routes and ipv6.routes, respectively. Note that if the peer's AllowedIPs is "0.0.0.0/0" or "::/0" and the profile's ipv4.never-default or ipv6.never-default setting is enabled, the peer route for this peer won't be added automatically.</para><para> Format: boolean</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.wireguard.private-key">private-key</option></term><listitem><para>The 256 bit private-key in base64 encoding.</para><para> Format: string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.wireguard.private-key-flags">private-key-flags</option></term><listitem><para>Flags indicating how to handle the "private-key" property. - See <xref linkend="secrets-flags"/> for flag values. - </para><para> + See <xref linkend="secrets-flags"/> for flag values. + </para><para> Format: NMSettingSecretFlags (uint32)</para></listitem></varlistentry></variablelist></para></refsect2><refsect2><title>802-11-wireless setting</title><para> Alias: wifi</para><para>Wi-Fi Settings.</para><para> Properties: @@ -648,19 +1062,19 @@ Format: array of string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-11-wireless-security.key-mgmt">key-mgmt</option></term><listitem><para>Key management used for the connection. One of "none" (WEP or no password protection), "ieee8021x" (Dynamic WEP), "owe" (Opportunistic Wireless Encryption), "wpa-psk" (WPA2 + WPA3 personal), "sae" (WPA3 personal only), "wpa-eap" (WPA2 + WPA3 enterprise) or "wpa-eap-suite-b-192" (WPA3 enterprise only). This property must be set for any Wi-Fi connection that uses security.</para><para> Format: string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-11-wireless-security.leap-password">leap-password</option></term><listitem><para>The login password for legacy LEAP connections (ie, key-mgmt = "ieee8021x" and auth-alg = "leap").</para><para> Format: string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-11-wireless-security.leap-password-flags">leap-password-flags</option></term><listitem><para>Flags indicating how to handle the "leap-password" property. - See <xref linkend="secrets-flags"/> for flag values. - </para><para> + See <xref linkend="secrets-flags"/> for flag values. + </para><para> Format: NMSettingSecretFlags (uint32)</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-11-wireless-security.leap-username">leap-username</option></term><listitem><para>The login username for legacy LEAP connections (ie, key-mgmt = "ieee8021x" and auth-alg = "leap").</para><para> Format: string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-11-wireless-security.pairwise">pairwise</option></term><listitem><para>A list of pairwise encryption algorithms which prevents connections to Wi-Fi networks that do not utilize one of the algorithms in the list. For maximum compatibility leave this property empty. Each list element may be one of "tkip" or "ccmp".</para><para> Format: array of string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-11-wireless-security.pmf">pmf</option></term><listitem><para>Indicates whether Protected Management Frames (802.11w) must be enabled for the connection. One of NM_SETTING_WIRELESS_SECURITY_PMF_DEFAULT (0) (use global default value), NM_SETTING_WIRELESS_SECURITY_PMF_DISABLE (1) (disable PMF), NM_SETTING_WIRELESS_SECURITY_PMF_OPTIONAL (2) (enable PMF if the supplicant and the access point support it) or NM_SETTING_WIRELESS_SECURITY_PMF_REQUIRED (3) (enable PMF and fail if not supported). When set to NM_SETTING_WIRELESS_SECURITY_PMF_DEFAULT (0) and no global default is set, PMF will be optionally enabled.</para><para> Format: int32</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-11-wireless-security.proto">proto</option></term><listitem><para>List of strings specifying the allowed WPA protocol versions to use. Each element may be one "wpa" (allow WPA) or "rsn" (allow WPA2/RSN). If not specified, both WPA and RSN connections are allowed.</para><para> Format: array of string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-11-wireless-security.psk">psk</option></term><listitem><para>Pre-Shared-Key for WPA networks. For WPA-PSK, it's either an ASCII passphrase of 8 to 63 characters that is (as specified in the 802.11i standard) hashed to derive the actual key, or the key in form of 64 hexadecimal character. The WPA3-Personal networks use a passphrase of any length for SAE authentication.</para><para> Format: string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-11-wireless-security.psk-flags">psk-flags</option></term><listitem><para>Flags indicating how to handle the "psk" property. - See <xref linkend="secrets-flags"/> for flag values. - </para><para> + See <xref linkend="secrets-flags"/> for flag values. + </para><para> Format: NMSettingSecretFlags (uint32)</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-11-wireless-security.wep-key-flags">wep-key-flags</option></term><listitem><para>Flags indicating how to handle the "wep-key0", "wep-key1", "wep-key2", and "wep-key3" properties. - See <xref linkend="secrets-flags"/> for flag values. - </para><para> + See <xref linkend="secrets-flags"/> for flag values. + </para><para> Format: NMSettingSecretFlags (uint32)</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-11-wireless-security.wep-key-type">wep-key-type</option></term><listitem><para>Controls the interpretation of WEP keys. Allowed values are NM_WEP_KEY_TYPE_KEY (1), in which case the key is either a 10- or 26-character hexadecimal string, or a 5- or 13-character ASCII password; or NM_WEP_KEY_TYPE_PASSPHRASE (2), in which case the passphrase is provided as a string and will be hashed using the de-facto MD5 method to derive the actual WEP key.</para><para> Format: NMWepKeyType (uint32)</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-11-wireless-security.wep-key0">wep-key0</option></term><listitem><para>Index 0 WEP key. This is the WEP key used in most networks. See the "wep-key-type" property for a description of how this key is interpreted.</para><para> Format: string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.802-11-wireless-security.wep-key1">wep-key1</option></term><listitem><para>Index 1 WEP key. This WEP index is not used by most networks. See the "wep-key-type" property for a description of how this key is interpreted.</para><para> @@ -680,6 +1094,10 @@ Alias: pan-id</para><para>IEEE 802.15.4 Personal Area Network (PAN) identifier.</para><para> Format: uint32</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.wpan.short-address">short-address</option></term><listitem><para> Alias: short-addr</para><para>Short IEEE 802.15.4 address to be used within a restricted environment.</para><para> + Format: uint32</para></listitem></varlistentry></variablelist></para></refsect2><refsect2><title>bond-port setting</title><para>Bond Port Settings.</para><para> + Properties: + <variablelist><varlistentry><term><option id="nm-settings-nmcli.property.bond-port.queue-id">queue-id</option></term><listitem><para> + Alias: queue-id</para><para>The queue ID of this bond port. The maximum value of queue ID is the number of TX queues currently active in device.</para><para> Format: uint32</para></listitem></varlistentry></variablelist></para></refsect2><refsect2><title>hostname setting</title><para>Hostname settings.</para><para> Properties: <variablelist><varlistentry><term><option id="nm-settings-nmcli.property.hostname.from-dhcp">from-dhcp</option></term><listitem><para>Whether the system hostname can be determined from DHCP on this connection. When set to NM_TERNARY_DEFAULT (-1), the value from global configuration is used. If the property doesn't have a value in the global configuration, NetworkManager assumes the value to be NM_TERNARY_TRUE (1).</para><para> |