diff options
Diffstat (limited to 'man/nm-settings.5')
| -rw-r--r-- | man/nm-settings.5 | 353 |
1 files changed, 328 insertions, 25 deletions
diff --git a/man/nm-settings.5 b/man/nm-settings.5 index 24f31ebd..5bf03f10 100644 --- a/man/nm-settings.5 +++ b/man/nm-settings.5 @@ -2,12 +2,12 @@ .\" Title: nm-settings .\" Author: .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/> -.\" Date: 09/20/2017 +.\" Date: 11/03/2017 .\" Manual: Configuration -.\" Source: NetworkManager 1.8.4 +.\" Source: NetworkManager 1.9.90 .\" Language: English .\" -.TH "NM\-SETTINGS" "5" "" "NetworkManager 1\&.8\&.4" "Configuration" +.TH "NM\-SETTINGS" "5" "" "NetworkManager 1\&.9\&.90" "Configuration" .\" ----------------------------------------------------------------- .\" * Define some portability stuff .\" ----------------------------------------------------------------- @@ -93,8 +93,18 @@ l l l l l l l l l l l l l l l l +l l l l l l l l. T{ +auth\-retries +T}:T{ +int32 +T}:T{ +\-1 +T}:T{ +The number of retries for the authentication\&. Zero means to try indefinitely; \-1 means to use a global default\&. If the global default is not set, the authentication retries for 3 times before failing the connection\&. Currently this only applies to 802\-1x authentication\&. +T} +T{ autoconnect T}:T{ boolean @@ -119,7 +129,7 @@ int32 T}:T{ \-1 T}:T{ -The number of times a connection should be tried when autoctivating before giving up\&. Zero means forever, \-1 means the global default (4 times if not overridden)\&. +The number of times a connection should be tried when autoactivating before giving up\&. Zero means forever, \-1 means the global default (4 times if not overridden)\&. Setting this to 1 means to try activation only once before blocking autoconnect\&. Note that after a timeout, NetworkManager will try to autoconnect again\&. T} T{ autoconnect\-slaves @@ -236,7 +246,7 @@ string T}:T{ \ \& T}:T{ -Token to generate stable IDs for the connection\&. The stable\-id is used for generating IPv6 stable private addresses with ipv6\&.addr\-gen\-mode=stable\-privacy\&. It is also used to seed the generated cloned MAC address for ethernet\&.cloned\-mac\-address=stable and wifi\&.cloned\-mac\-address=stable\&. Note that also the interface name of the activating connection and a per\-host secret key is included into the address generation so that the same stable\-id on different hosts/devices yields different addresses\&. If the value is unset, an ID unique for the connection is used\&. Specifing a stable\-id allows multiple connections to generate the same addresses\&. Another use is to generate IDs at runtime via dynamic substitutions\&. The \*(Aq$\*(Aq character is treated special to perform dynamic substitutions at runtime\&. Currently supported are "${CONNECTION}", "${BOOT}", "${RANDOM}"\&. These effectively create unique IDs per\-connection, per\-boot, or every time\&. Any unrecognized patterns following \*(Aq$\*(Aq are treated verbatim, however are reserved for future use\&. You are thus advised to avoid \*(Aq$\*(Aq or escape it as "$$"\&. For example, set it to "${CONNECTION}/${BOOT}" to create a unique id for this connection that changes with every reboot\&. Note that two connections only use the same effective id if their stable\-id is also identical before performing dynamic substitutions\&. +Token to generate stable IDs for the connection\&. The stable\-id is used for generating IPv6 stable private addresses with ipv6\&.addr\-gen\-mode=stable\-privacy\&. It is also used to seed the generated cloned MAC address for ethernet\&.cloned\-mac\-address=stable and wifi\&.cloned\-mac\-address=stable\&. Note that also the interface name of the activating connection and a per\-host secret key is included into the address generation so that the same stable\-id on different hosts/devices yields different addresses\&. If the value is unset, an ID unique for the connection is used\&. Specifying a stable\-id allows multiple connections to generate the same addresses\&. Another use is to generate IDs at runtime via dynamic substitutions\&. The \*(Aq$\*(Aq character is treated special to perform dynamic substitutions at runtime\&. Currently supported are "${CONNECTION}", "${BOOT}", "${RANDOM}"\&. These effectively create unique IDs per\-connection, per\-boot, or every time\&. Any unrecognized patterns following \*(Aq$\*(Aq are treated verbatim, however are reserved for future use\&. You are thus advised to avoid \*(Aq$\*(Aq or escape it as "$$"\&. For example, set it to "${CONNECTION}/${BOOT}" to create a unique id for this connection that changes with every reboot\&. Note that two connections only use the same effective id if their stable\-id is also identical before performing dynamic substitutions\&. T} T{ timestamp @@ -515,7 +525,7 @@ uint32 T}:T{ 0 T}:T{ -Specifies authentication flags to use in "phase 1" outer authentication using NMSetting8021xAuthFlags options\&. The invidual TLS versions can be explicitly disabled\&. If a certain TLS disable flag is not set, it is up to the supplicant to allow or forbid it\&. The TLS options map to tls_disable_tlsv1_x settings\&. See the wpa_supplicant documentation for more details\&. +Specifies authentication flags to use in "phase 1" outer authentication using NMSetting8021xAuthFlags options\&. The individual TLS versions can be explicitly disabled\&. If a certain TLS disable flag is not set, it is up to the supplicant to allow or forbid it\&. The TLS options map to tls_disable_tlsv1_x settings\&. See the wpa_supplicant documentation for more details\&. T} T{ phase1\-fast\-provisioning @@ -963,6 +973,7 @@ l l l l l l l l l l l l l l l l +l l l l l l l l. T{ ageing\-time @@ -983,6 +994,15 @@ T}:T{ The Spanning Tree Protocol (STP) forwarding delay, in seconds\&. T} T{ +group\-forward\-mask +T}:T{ +uint32 +T}:T{ +0 +T}:T{ +A mask of group addresses to forward\&. Usually, group addresses in the range from 01:80:C2:00:00:00 to 01:80:C2:00:00:0F are not forwarded according to standards\&. This property is a mask of 16 bits, each corresponding to a group address in that range that must be forwarded\&. The mask can\*(Aqt have bits 0, 1 or 2 set because they are used for STP, MAC pause frames and LACP\&. +T} +T{ hello\-time T}:T{ uint32 @@ -1007,7 +1027,7 @@ byte array T}:T{ \ \& T}:T{ -If specified, the MAC address of bridge\&. When creating a new bridge, this MAC address will be set\&. When matching an existing (outside NetworkManager created) bridge, this MAC address must match\&. +If specified, the MAC address of bridge\&. When creating a new bridge, this MAC address will be set\&. If this field is left unspecified, the "ethernet\&.cloned\-mac\-address" is referred instead to generate the initial MAC address\&. Note that setting "ethernet\&.cloned\-mac\-address" anyway overwrites the MAC address of the bridge later while activating the bridge\&. Hence, this property is deprecated\&. T} T{ max\-age @@ -1083,7 +1103,7 @@ boolean T}:T{ FALSE T}:T{ -Enables or disabled "hairpin mode" for the port, which allows frames to be sent back out through the port the frame was received on\&. +Enables or disables "hairpin mode" for the port, which allows frames to be sent back out through the port the frame was received on\&. T} T{ name @@ -1303,7 +1323,7 @@ array of uint32 T}:T{ [0, 0, 0, 0, 0, 0, 0, 0] T}:T{ -An array of 8 uint values, where the array index corresponds to the User Priority (0 \- 7) and the value indicates the percentage of bandwidth of the priority\*(Aqs assigned group that the priority may use\&. The sum of all percentages for priorities which belong to the same group must total 100 percent\&. +An array of 8 uint values, where the array index corresponds to the User Priority (0 \- 7) and the value indicates the percentage of bandwidth of the priority\*(Aqs assigned group that the priority may use\&. The sum of all percentages for priorities which belong to the same group must total 100 percents\&. T} T{ priority\-flow\-control @@ -1330,7 +1350,7 @@ array of uint32 T}:T{ [0, 0, 0, 0, 0, 0, 0, 0] T}:T{ -An array of 8 uint values, where the array index corresponds to the Priority Group ID (0 \- 7) and the value indicates the percentage of link bandwidth allocated to that group\&. Allowed values are 0 \- 100, and the sum of all values must total 100 percent\&. +An array of 8 uint values, where the array index corresponds to the Priority Group ID (0 \- 7) and the value indicates the percentage of link bandwidth allocated to that group\&. Allowed values are 0 \- 100, and the sum of all values must total 100 percents\&. T} T{ priority\-group\-flags @@ -1571,7 +1591,7 @@ string T}:T{ \ \& T}:T{ -A MCC/MNC string like "310260" or "21601" identifying the specific mobile network operator which this connection applies to\&. If given, the connection will apply to any device also allowed by "device\-id" and "sim\-id" which contains a SIM card provisioined by the given operator\&. +A MCC/MNC string like "310260" or "21601" identifying the specific mobile network operator which this connection applies to\&. If given, the connection will apply to any device also allowed by "device\-id" and "sim\-id" which contains a SIM card provisioned by the given operator\&. T} T{ username @@ -1699,6 +1719,7 @@ l l l l l l l l l l l l l l l l +l l l l l l l l. T{ address\-data @@ -1887,7 +1908,16 @@ int64 T}:T{ \-1 T}:T{ -The default metric for routes that don\*(Aqt explicitly specify a metric\&. The default value \-1 means that the metric is choosen automatically based on the device type\&. The metric applies to dynamic routes, manual (static) routes that don\*(Aqt have an explicit metric setting, address prefix routes, and the default route\&. Note that for IPv6, the kernel accepts zero (0) but coerces it to 1024 (user default)\&. Hence, setting this property to zero effectively mean setting it to 1024\&. For IPv4, zero is a regular value for the metric\&. +The default metric for routes that don\*(Aqt explicitly specify a metric\&. The default value \-1 means that the metric is chosen automatically based on the device type\&. The metric applies to dynamic routes, manual (static) routes that don\*(Aqt have an explicit metric setting, address prefix routes, and the default route\&. Note that for IPv6, the kernel accepts zero (0) but coerces it to 1024 (user default)\&. Hence, setting this property to zero effectively mean setting it to 1024\&. For IPv4, zero is a regular value for the metric\&. +T} +T{ +route\-table +T}:T{ +uint32 +T}:T{ +0 +T}:T{ +Enable policy routing (source routing) and set the routing table used when adding routes\&. This affects all routes, including device\-routes, IPv4LL, DHCP, SLAAC, default\-routes and static routes\&. But note that static routes can individually overwrite the setting by explicitly specifying a non\-zero routing table\&. If the table setting is left at zero, it is eligible to be overwritten via global configuration\&. If the property is zero even after applying the global configuration value, policy routing is disabled for the address family of this connection\&. Policy routing disabled means that NetworkManager will add all routes to the main table (except static routes that explicitly configure a different table)\&. Additionally, NetworkManager will not delete any extraneous routes from tables except the main table\&. This is to preserve backward compatibility for users who manage routing tables outside of NetworkManager\&. T} T{ routes @@ -1938,6 +1968,7 @@ l l l l l l l l l l l l l l l l +l l l l l l l l. T{ addr\-gen\-mode @@ -1946,7 +1977,7 @@ int32 T}:T{ 1 T}:T{ -Configure method for creating the address for use with RFC4862 IPv6 Stateless Address Autoconfiguration\&. The permitted values are: "eui64", or "stable\-privacy"\&. If the property is set to "eui64", the addresses will be generated using the interface tokens derived from hardware address\&. This makes the host part of the address to stay constant, making it possible to track host\*(Aqs presence when it changes networks\&. The address changes when the interface hardware is replaced\&. The value of "stable\-privacy" enables use of cryptographically secure hash of a secret host\-specific key along with the connection\*(Aqs stable\-id and the network address as specified by RFC7217\&. This makes it impossible to use the address track host\*(Aqs presence, and makes the address stable when the network interface hardware is replaced\&. On D\-Bus, the absence of an addr\-gen\-mode setting equals enabling "stable\-privacy"\&. For keyfile plugin, the absence of the setting on disk means "eui64" so that the property doesn\*(Aqt change on upgrade from older versions\&. Note that this setting is distinct from the Privacy Extensions as configured by "ip6\-privacy" property and it does not affect the temporary addresses configured with this option\&. +Configure method for creating the address for use with RFC4862 IPv6 Stateless Address Autoconfiguration\&. The permitted values are: NM_SETTING_IP6_CONFIG_ADDR_GEN_MODE_EUI64 (0) or NM_SETTING_IP6_CONFIG_ADDR_GEN_MODE_STABLE_PRIVACY (1)\&. If the property is set to EUI64, the addresses will be generated using the interface tokens derived from hardware address\&. This makes the host part of the address to stay constant, making it possible to track host\*(Aqs presence when it changes networks\&. The address changes when the interface hardware is replaced\&. The value of stable\-privacy enables use of cryptographically secure hash of a secret host\-specific key along with the connection\*(Aqs stable\-id and the network address as specified by RFC7217\&. This makes it impossible to use the address track host\*(Aqs presence, and makes the address stable when the network interface hardware is replaced\&. On D\-Bus, the absence of an addr\-gen\-mode setting equals enabling stable\-privacy\&. For keyfile plugin, the absence of the setting on disk means EUI64 so that the property doesn\*(Aqt change on upgrade from older versions\&. Note that this setting is distinct from the Privacy Extensions as configured by "ip6\-privacy" property and it does not affect the temporary addresses configured with this option\&. T} T{ address\-data @@ -2126,7 +2157,16 @@ int64 T}:T{ \-1 T}:T{ -The default metric for routes that don\*(Aqt explicitly specify a metric\&. The default value \-1 means that the metric is choosen automatically based on the device type\&. The metric applies to dynamic routes, manual (static) routes that don\*(Aqt have an explicit metric setting, address prefix routes, and the default route\&. Note that for IPv6, the kernel accepts zero (0) but coerces it to 1024 (user default)\&. Hence, setting this property to zero effectively mean setting it to 1024\&. For IPv4, zero is a regular value for the metric\&. +The default metric for routes that don\*(Aqt explicitly specify a metric\&. The default value \-1 means that the metric is chosen automatically based on the device type\&. The metric applies to dynamic routes, manual (static) routes that don\*(Aqt have an explicit metric setting, address prefix routes, and the default route\&. Note that for IPv6, the kernel accepts zero (0) but coerces it to 1024 (user default)\&. Hence, setting this property to zero effectively mean setting it to 1024\&. For IPv4, zero is a regular value for the metric\&. +T} +T{ +route\-table +T}:T{ +uint32 +T}:T{ +0 +T}:T{ +Enable policy routing (source routing) and set the routing table used when adding routes\&. This affects all routes, including device\-routes, IPv4LL, DHCP, SLAAC, default\-routes and static routes\&. But note that static routes can individually overwrite the setting by explicitly specifying a non\-zero routing table\&. If the table setting is left at zero, it is eligible to be overwritten via global configuration\&. If the property is zero even after applying the global configuration value, policy routing is disabled for the address family of this connection\&. Policy routing disabled means that NetworkManager will add all routes to the main table (except static routes that explicitly configure a different table)\&. Additionally, NetworkManager will not delete any extraneous routes from tables except the main table\&. This is to preserve backward compatibility for users who manage routing tables outside of NetworkManager\&. T} T{ routes @@ -2229,7 +2269,7 @@ uint32 T}:T{ 0 T}:T{ -None +If non\-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple fragments\&. T} T{ name @@ -2530,6 +2570,238 @@ SSID of the mesh network to join\&. T} .TE .sp 1 +.SS "ovs\-bridge setting" +.PP +OvsBridge Link Settings\&. +.TS +allbox tab(:); +lB lB lB lB. +T{ +Key Name +T}:T{ +Value Type +T}:T{ +Default Value +T}:T{ +Value Description +T} +.T& +l l l l +l l l l +l l l l +l l l l +l l l l. +T{ +fail\-mode +T}:T{ +string +T}:T{ +\ \& +T}:T{ +The bridge failure mode\&. One of "secure", "standalone" or empty\&. +T} +T{ +mcast\-snooping\-enable +T}:T{ +boolean +T}:T{ +FALSE +T}:T{ +Enable or disable multicast snooping\&. +T} +T{ +name +T}:T{ +string +T}:T{ +ovs\-bridge +T}:T{ +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. +T} +T{ +rstp\-enable +T}:T{ +boolean +T}:T{ +FALSE +T}:T{ +Enable or disable RSTP\&. +T} +T{ +stp\-enable +T}:T{ +boolean +T}:T{ +FALSE +T}:T{ +Enable or disable STP\&. +T} +.TE +.sp 1 +.SS "ovs\-interface setting" +.PP +OpenVSwitch Interface Settings\&. +.TS +allbox tab(:); +lB lB lB lB. +T{ +Key Name +T}:T{ +Value Type +T}:T{ +Default Value +T}:T{ +Value Description +T} +.T& +l l l l +l l l l. +T{ +name +T}:T{ +string +T}:T{ +ovs\-interface +T}:T{ +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. +T} +T{ +type +T}:T{ +string +T}:T{ +\ \& +T}:T{ +The interface type\&. Either "internal", or empty\&. +T} +.TE +.sp 1 +.SS "ovs\-patch setting" +.PP +OvsPatch Link Settings\&. +.TS +allbox tab(:); +lB lB lB lB. +T{ +Key Name +T}:T{ +Value Type +T}:T{ +Default Value +T}:T{ +Value Description +T} +.T& +l l l l +l l l l. +T{ +name +T}:T{ +string +T}:T{ +ovs\-patch +T}:T{ +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. +T} +T{ +peer +T}:T{ +string +T}:T{ +\ \& +T}:T{ +Specifies the unicast destination IP address of a remote OpenVSwitch bridge port to connect to\&. +T} +.TE +.sp 1 +.SS "ovs\-port setting" +.PP +OvsPort Link Settings\&. +.TS +allbox tab(:); +lB lB lB lB. +T{ +Key Name +T}:T{ +Value Type +T}:T{ +Default Value +T}:T{ +Value Description +T} +.T& +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l. +T{ +bond\-downdelay +T}:T{ +uint32 +T}:T{ +0 +T}:T{ +The time port must be inactive in order to be considered down\&. +T} +T{ +bond\-mode +T}:T{ +string +T}:T{ +\ \& +T}:T{ +Bonding mode\&. One of "active\-backup", "balance\-slb", or "balance\-tcp"\&. +T} +T{ +bond\-updelay +T}:T{ +uint32 +T}:T{ +0 +T}:T{ +The time port must be active befor it starts forwarding traffic\&. +T} +T{ +lacp +T}:T{ +string +T}:T{ +\ \& +T}:T{ +LACP mode\&. One of "active", "off", or "passive"\&. +T} +T{ +name +T}:T{ +string +T}:T{ +ovs\-port +T}:T{ +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. +T} +T{ +tag +T}:T{ +uint32 +T}:T{ +0 +T}:T{ +The VLAN tag in the range 0\-4095\&. +T} +T{ +vlan\-mode +T}:T{ +string +T}:T{ +\ \& +T}:T{ +The VLAN mode\&. One of "access", "native\-tagged", "native\-untagged", "trunk" or unset\&. +T} +.TE +.sp 1 .SS "ppp setting" .PP Point\-to\-Point Protocol Settings\&. @@ -2725,7 +2997,7 @@ boolean T}:T{ FALSE T}:T{ -If TRUE, MPPE (Microsoft Point\-to\-Point Encrpytion) will be required for the PPP session\&. If either 64\-bit or 128\-bit MPPE is not available the session will fail\&. Note that MPPE is not used on mobile broadband connections\&. +If TRUE, MPPE (Microsoft Point\-to\-Point Encryption) will be required for the PPP session\&. If either 64\-bit or 128\-bit MPPE is not available the session will fail\&. Note that MPPE is not used on mobile broadband connections\&. T} T{ require\-mppe\-128 @@ -2734,7 +3006,7 @@ boolean T}:T{ FALSE T}:T{ -If TRUE, 128\-bit MPPE (Microsoft Point\-to\-Point Encrpytion) will be required for the PPP session, and the "require\-mppe" property must also be set to TRUE\&. If 128\-bit MPPE is not available the session will fail\&. +If TRUE, 128\-bit MPPE (Microsoft Point\-to\-Point Encryption) will be required for the PPP session, and the "require\-mppe" property must also be set to TRUE\&. If 128\-bit MPPE is not available the session will fail\&. T} .TE .sp 1 @@ -2758,6 +3030,7 @@ l l l l l l l l l l l l l l l l +l l l l l l l l. T{ name @@ -2769,6 +3042,15 @@ T}:T{ The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. T} T{ +parent +T}:T{ +string +T}:T{ +\ \& +T}:T{ +If given, specifies the parent interface name on which this PPPoE connection should be created\&. If this property is not specified, the connection is activated on the interface specified in "interface\-name" of NMSettingConnection\&. +T} +T{ password T}:T{ string @@ -3327,7 +3609,7 @@ uint32 T}:T{ 0 T}:T{ -Timeout for the VPN service to establish the connection\&. Some services may take quite a long time to connect\&. Value of 0 means a default timeout, which is 60 seconds (unless overriden by vpn\&.timeout in configuration file)\&. Values greater than zero mean timeout in seconds\&. +Timeout for the VPN service to establish the connection\&. Some services may take quite a long time to connect\&. Value of 0 means a default timeout, which is 60 seconds (unless overridden by vpn\&.timeout in configuration file)\&. Values greater than zero mean timeout in seconds\&. T} T{ user\-name @@ -3398,7 +3680,7 @@ uint32 T}:T{ 0 T}:T{ -Specifies the VXLAN Network Identifer (or VXLAN Segment Identifier) to use\&. +Specifies the VXLAN Network Identifier (or VXLAN Segment Identifier) to use\&. T} T{ l2\-miss @@ -3651,7 +3933,7 @@ string T}:T{ \ \& T}:T{ -With "cloned\-mac\-address" setting "random" or "stable", by default all bits of the MAC address are scrambled and a locally\-administered, unicast MAC address is created\&. This property allows to specify that certain bits are fixed\&. Note that the least significant bit of the first MAC address will always be unset to create a unicast MAC address\&. If the property is NULL, it is eligible to be overwritten by a default connection setting\&. If the value is still NULL or an empty string, the default is to create a locally\-administered, unicast MAC address\&. If the value contains one MAC address, this address is used as mask\&. The set bits of the mask are to be filled with the current MAC address of the device, while the unset bits are subject to randomization\&. Setting "FE:FF:FF:00:00:00" means to preserve the OUI of the current MAC address and only randomize the lower 3 bytes using the "random" or "stable" algorithm\&. If the value contains one additional MAC address after the mask, this address is used instead of the current MAC address to fill the bits that shall not be randomized\&. For example, a value of "FE:FF:FF:00:00:00 68:F7:28:00:00:00" will set the OUI of the MAC address to 68:F7:28, while the lower bits are randomized\&. A value of "02:00:00:00:00:00 00:00:00:00:00:00" will create a fully scrambled globally\-administered, burned\-in MAC address\&. If the value contains more then one additional MAC addresses, one of them is chosen randomly\&. For example, "02:00:00:00:00:00 00:00:00:00:00:00 02:00:00:00:00:00" will create a fully scrambled MAC address, randomly locally or globally administered\&. +With "cloned\-mac\-address" setting "random" or "stable", by default all bits of the MAC address are scrambled and a locally\-administered, unicast MAC address is created\&. This property allows to specify that certain bits are fixed\&. Note that the least significant bit of the first MAC address will always be unset to create a unicast MAC address\&. If the property is NULL, it is eligible to be overwritten by a default connection setting\&. If the value is still NULL or an empty string, the default is to create a locally\-administered, unicast MAC address\&. If the value contains one MAC address, this address is used as mask\&. The set bits of the mask are to be filled with the current MAC address of the device, while the unset bits are subject to randomization\&. Setting "FE:FF:FF:00:00:00" means to preserve the OUI of the current MAC address and only randomize the lower 3 bytes using the "random" or "stable" algorithm\&. If the value contains one additional MAC address after the mask, this address is used instead of the current MAC address to fill the bits that shall not be randomized\&. For example, a value of "FE:FF:FF:00:00:00 68:F7:28:00:00:00" will set the OUI of the MAC address to 68:F7:28, while the lower bits are randomized\&. A value of "02:00:00:00:00:00 00:00:00:00:00:00" will create a fully scrambled globally\-administered, burned\-in MAC address\&. If the value contains more than one additional MAC addresses, one of them is chosen randomly\&. For example, "02:00:00:00:00:00 00:00:00:00:00:00 02:00:00:00:00:00" will create a fully scrambled MAC address, randomly locally or globally administered\&. T} T{ mac\-address @@ -3696,7 +3978,7 @@ string T}:T{ \ \& T}:T{ -Specific port type to use if multiple the device supports multiple attachment methods\&. One of "tp" (Twisted Pair), "aui" (Attachment Unit Interface), "bnc" (Thin Ethernet) or "mii" (Media Independent Interface\&. If the device supports only one port type, this setting is ignored\&. +Specific port type to use if the device supports multiple attachment methods\&. One of "tp" (Twisted Pair), "aui" (Attachment Unit Interface), "bnc" (Thin Ethernet) or "mii" (Media Independent Interface)\&. If the device supports only one port type, this setting is ignored\&. T} T{ s390\-nettype @@ -3732,7 +4014,7 @@ uint32 T}:T{ 0 T}:T{ -Can be set to a value grater than zero only when "auto\-negotiate" is "off"\&. In that case, statically configures the device to use that specified speed\&. In Mbit/s, ie 100 == 100Mbit/s\&. Must be set together with the "duplex" property when non\-zero\&. Before specifying a speed value be sure your device supports it\&. +Can be set to a value greater than zero only when "auto\-negotiate" is "off"\&. In that case, statically configures the device to use that specified speed\&. In Mbit/s, ie 100 == 100Mbit/s\&. Must be set together with the "duplex" property when non\-zero\&. Before specifying a speed value be sure your device supports it\&. T} T{ wake\-on\-lan @@ -3841,7 +4123,7 @@ string T}:T{ \ \& T}:T{ -With "cloned\-mac\-address" setting "random" or "stable", by default all bits of the MAC address are scrambled and a locally\-administered, unicast MAC address is created\&. This property allows to specify that certain bits are fixed\&. Note that the least significant bit of the first MAC address will always be unset to create a unicast MAC address\&. If the property is NULL, it is eligible to be overwritten by a default connection setting\&. If the value is still NULL or an empty string, the default is to create a locally\-administered, unicast MAC address\&. If the value contains one MAC address, this address is used as mask\&. The set bits of the mask are to be filled with the current MAC address of the device, while the unset bits are subject to randomization\&. Setting "FE:FF:FF:00:00:00" means to preserve the OUI of the current MAC address and only randomize the lower 3 bytes using the "random" or "stable" algorithm\&. If the value contains one additional MAC address after the mask, this address is used instead of the current MAC address to fill the bits that shall not be randomized\&. For example, a value of "FE:FF:FF:00:00:00 68:F7:28:00:00:00" will set the OUI of the MAC address to 68:F7:28, while the lower bits are randomized\&. A value of "02:00:00:00:00:00 00:00:00:00:00:00" will create a fully scrambled globally\-administered, burned\-in MAC address\&. If the value contains more then one additional MAC addresses, one of them is chosen randomly\&. For example, "02:00:00:00:00:00 00:00:00:00:00:00 02:00:00:00:00:00" will create a fully scrambled MAC address, randomly locally or globally administered\&. +With "cloned\-mac\-address" setting "random" or "stable", by default all bits of the MAC address are scrambled and a locally\-administered, unicast MAC address is created\&. This property allows to specify that certain bits are fixed\&. Note that the least significant bit of the first MAC address will always be unset to create a unicast MAC address\&. If the property is NULL, it is eligible to be overwritten by a default connection setting\&. If the value is still NULL or an empty string, the default is to create a locally\-administered, unicast MAC address\&. If the value contains one MAC address, this address is used as mask\&. The set bits of the mask are to be filled with the current MAC address of the device, while the unset bits are subject to randomization\&. Setting "FE:FF:FF:00:00:00" means to preserve the OUI of the current MAC address and only randomize the lower 3 bytes using the "random" or "stable" algorithm\&. If the value contains one additional MAC address after the mask, this address is used instead of the current MAC address to fill the bits that shall not be randomized\&. For example, a value of "FE:FF:FF:00:00:00 68:F7:28:00:00:00" will set the OUI of the MAC address to 68:F7:28, while the lower bits are randomized\&. A value of "02:00:00:00:00:00 00:00:00:00:00:00" will create a fully scrambled globally\-administered, burned\-in MAC address\&. If the value contains more than one additional MAC addresses, one of them is chosen randomly\&. For example, "02:00:00:00:00:00 00:00:00:00:00:00 02:00:00:00:00:00" will create a fully scrambled MAC address, randomly locally or globally administered\&. T} T{ hidden @@ -3995,6 +4277,8 @@ l l l l l l l l l l l l l l l l +l l l l +l l l l l l l l. T{ auth\-alg @@ -4069,6 +4353,15 @@ T}:T{ A list of pairwise encryption algorithms which prevents connections to Wi\-Fi networks that do not utilize one of the algorithms in the list\&. For maximum compatibility leave this property empty\&. Each list element may be one of "tkip" or "ccmp"\&. T} T{ +pmf +T}:T{ +int32 +T}:T{ +0 +T}:T{ +Indicates whether Protected Management Frames (802\&.11w) must be enabled for the connection\&. One of NM_SETTING_WIRELESS_SECURITY_PMF_DEFAULT (0) (use global default value), NM_SETTING_WIRELESS_SECURITY_PMF_DISABLE (1) (disable PMF), NM_SETTING_WIRELESS_SECURITY_PMF_OPTIONAL (2) (enable PMF if the supplicant and the access point support it) or NM_SETTING_WIRELESS_SECURITY_PMF_REQUIRED (3) (enable PMF and fail if not supported)\&. When set to NM_SETTING_WIRELESS_SECURITY_PMF_DEFAULT (0) and no global default is set, PMF will be optionally enabled\&. +T} +T{ proto T}:T{ array of string @@ -4158,11 +4451,20 @@ T}:T{ T}:T{ When static WEP is used (ie, key\-mgmt = "none") and a non\-default WEP key index is used by the AP, put that WEP key index here\&. Valid values are 0 (default key) through 3\&. Note that some consumer access points (like the Linksys WRT54G) number the keys 1 \- 4\&. T} +T{ +wps\-method +T}:T{ +uint32 +T}:T{ +0 +T}:T{ +Flags indicating which mode of WPS is to be used if any\&. There\*(Aqs little point in changing the default setting as NetworkManager will automatically determine whether it\*(Aqs feasible to start WPS enrollment from the Access Point capabilities\&. WPS can be disabled by setting this property to a value of 1\&. +T} .TE .sp 1 .SS "Secret flag types:" .PP -Each secret property in a setting has an associated +Each password or secret property in a setting has an associated \fIflags\fR property that describes how to handle that secret\&. The \fIflags\fR @@ -4176,7 +4478,8 @@ property is a bitfield that contains zero or more of the following values logica .sp -1 .IP \(bu 2.3 .\} -0x0 (none) \- the system is responsible for providing and storing this secret\&. +0x0 (none) \- the system is responsible for providing and storing this secret\&. This may be required so that secrets are already available before the user logs in\&. It also commonly means that the secret will be stored in plain text on disk, accessible to root only\&. For example via the keyfile settings plugin as described in the "PLUGINS" section in +\fBNetworkManager.conf\fR(5)\&. .RE .sp .RS 4 |