diff options
Diffstat (limited to 'man')
| -rw-r--r-- | man/Makefile.am | 88 | ||||
| -rw-r--r-- | man/Makefile.in | 126 | ||||
| -rw-r--r-- | man/NetworkManager.8 | 17 | ||||
| -rw-r--r-- | man/NetworkManager.conf.5 | 46 | ||||
| -rw-r--r-- | man/NetworkManager.conf.xml.in | 560 | ||||
| -rw-r--r-- | man/nm-settings-ifcfg-rh.5 | 2325 | ||||
| -rw-r--r-- | man/nm-settings-ifcfg-rh.xml | 335 | ||||
| -rw-r--r-- | man/nm-settings-ifcfg-rh.xsl | 405 | ||||
| -rw-r--r-- | man/nm-settings-keyfile.5 | 698 | ||||
| -rw-r--r-- | man/nm-settings-keyfile.xml | 233 | ||||
| -rw-r--r-- | man/nm-settings-keyfile.xsl | 308 | ||||
| -rw-r--r-- | man/nm-settings.5 | 1631 | ||||
| -rw-r--r-- | man/nm-settings.xml | 343 | ||||
| -rw-r--r-- | man/nm-settings.xsl | 162 | ||||
| -rw-r--r-- | man/nmcli-examples.5 | 43 | ||||
| -rw-r--r-- | man/nmcli.1.in | 96 | ||||
| -rw-r--r-- | man/nmtui.1.in | 66 |
17 files changed, 6623 insertions, 859 deletions
diff --git a/man/Makefile.am b/man/Makefile.am index 64469685..4577cb41 100644 --- a/man/Makefile.am +++ b/man/Makefile.am @@ -4,16 +4,16 @@ EXTRA_DIST = XSLTPROC = xsltproc -XSLTPROC_FLAGS = \ - --xinclude \ - --nonet \ +XSLTPROC_FLAGS = --xinclude --nonet + +XSLTPROC_MAN_FLAGS = \ + $(XSLTPROC_FLAGS) \ --stringparam man.output.quietly 1 \ --stringparam funcsynopsis.style ansi \ --stringparam man.th.extra1.suppress 1 \ --stringparam man.authors.section.enabled 0 \ - --stringparam man.copyright.section.enabled 0 - -XSLTPROC_MAN_FLAGS = $(XSLTPROC_FLAGS) http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl + --stringparam man.copyright.section.enabled 0 \ + http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl if ENABLE_GTK_DOC @@ -23,14 +23,41 @@ if ENABLE_GTK_DOC %.5: %.xml $(AM_V_GEN) xsltproc $(XSLTPROC_MAN_FLAGS) $< -nm-settings.xml: $(top_builddir)/tools/generate-settings-spec $(top_builddir)/libnm-util/libnm-util.la - rm -f $(builddir)/$@ - $(top_builddir)/tools/generate-settings-spec refentry $(builddir)/$@ +endif + +if BUILD_SETTING_DOCS + +nm-settings.xml: nm-settings.xsl $(top_builddir)/libnm/nm-setting-docs.xml + $(AM_V_GEN) xsltproc \ + --output $@ \ + --stringparam version $(NM_VERSION) \ + --stringparam date "`date +'%d %B %Y'`" \ + $^ + +nm-settings-keyfile.xml: nm-settings-keyfile.xsl $(top_builddir)/libnm/nm-keyfile-docs.xml + $(AM_V_GEN) xsltproc \ + --output $@ \ + --stringparam version $(NM_VERSION) \ + --stringparam date "`date +'%d %B %Y'`" \ + $^ + +nm-settings-ifcfg-rh.xml: nm-settings-ifcfg-rh.xsl $(top_builddir)/libnm/nm-ifcfg-rh-docs.xml + $(AM_V_GEN) xsltproc \ + --output $@ \ + --stringparam version $(NM_VERSION) \ + --stringparam date "`date +'%d %B %Y'`" \ + $^ + +CLEANFILES += \ + nm-settings.xml \ + nm-settings-keyfile.xml \ + nm-settings-ifcfg-rh.xml endif configure_generated_man_pages = \ nmcli.1 \ + nmtui.1 \ nm-online.1 \ nm-system-settings.conf.5 @@ -40,29 +67,46 @@ docbook_generated_man_pages = \ nmcli-examples.5 docbook_autogenerated_man_pages = \ - nm-settings.5 - -generated_man_pages = \ - $(docbook_generated_man_pages) \ - $(docbook_autogenerated_man_pages) + nm-settings.5 \ + nm-settings-keyfile.5 \ + nm-settings-ifcfg-rh.5 EXTRA_DIST += \ + nm-settings.xml \ + nm-settings.xsl \ + nm-settings-keyfile.xml \ + nm-settings-keyfile.xsl \ + nm-settings-ifcfg-rh.xml \ + nm-settings-ifcfg-rh.xsl \ $(docbook_generated_man_pages:.%=.xml) \ $(docbook_autogenerated_man_pages) -CLEANFILES += \ - nm-settings.xml - man_MANS += $(configure_generated_man_pages) +links = nmtui-edit nmtui-connect nmtui-hostname + +install-data-hook: + for link in $(links); do \ + ln -f $(DESTDIR)$(mandir)/man1/nmtui.1 $(DESTDIR)$(mandir)/man1/$$link.1; \ + done + +uninstall-hook: + for link in $(links); do \ + rm -f $(DESTDIR)$(mandir)/man1/$$link.1; \ + done + if ENABLE_GTK_DOC -man_MANS += $(generated_man_pages) -CLEANFILES += \ - $(docbook_autogenerated_man_pages) \ - $(docbook_generated_man_pages) +man_MANS += $(docbook_generated_man_pages) +CLEANFILES += $(docbook_generated_man_pages) +if SETTING_DOCS_AVAILABLE +man_MANS += $(docbook_autogenerated_man_pages) +CLEANFILES += $(docbook_autogenerated_man_pages) +endif else if INSTALL_PREGEN_MANPAGES -man_MANS += $(generated_man_pages) +man_MANS += \ + $(docbook_generated_man_pages) \ + $(docbook_autogenerated_man_pages) endif endif diff --git a/man/Makefile.in b/man/Makefile.in index a48bf680..503b900c 100644 --- a/man/Makefile.in +++ b/man/Makefile.in @@ -77,16 +77,25 @@ PRE_UNINSTALL = : POST_UNINSTALL = : build_triplet = @build@ host_triplet = @host@ -@ENABLE_GTK_DOC_TRUE@am__append_1 = $(generated_man_pages) -@ENABLE_GTK_DOC_TRUE@am__append_2 = \ -@ENABLE_GTK_DOC_TRUE@ $(docbook_autogenerated_man_pages) \ -@ENABLE_GTK_DOC_TRUE@ $(docbook_generated_man_pages) +@BUILD_SETTING_DOCS_TRUE@am__append_1 = \ +@BUILD_SETTING_DOCS_TRUE@ nm-settings.xml \ +@BUILD_SETTING_DOCS_TRUE@ nm-settings-keyfile.xml \ +@BUILD_SETTING_DOCS_TRUE@ nm-settings-ifcfg-rh.xml + +@ENABLE_GTK_DOC_TRUE@am__append_2 = $(docbook_generated_man_pages) +@ENABLE_GTK_DOC_TRUE@am__append_3 = $(docbook_generated_man_pages) +@ENABLE_GTK_DOC_TRUE@@SETTING_DOCS_AVAILABLE_TRUE@am__append_4 = $(docbook_autogenerated_man_pages) +@ENABLE_GTK_DOC_TRUE@@SETTING_DOCS_AVAILABLE_TRUE@am__append_5 = $(docbook_autogenerated_man_pages) +@ENABLE_GTK_DOC_FALSE@@INSTALL_PREGEN_MANPAGES_TRUE@am__append_6 = \ +@ENABLE_GTK_DOC_FALSE@@INSTALL_PREGEN_MANPAGES_TRUE@ $(docbook_generated_man_pages) \ +@ENABLE_GTK_DOC_FALSE@@INSTALL_PREGEN_MANPAGES_TRUE@ $(docbook_autogenerated_man_pages) -@ENABLE_GTK_DOC_FALSE@@INSTALL_PREGEN_MANPAGES_TRUE@am__append_3 = $(generated_man_pages) subdir = man DIST_COMMON = $(srcdir)/Makefile.in $(srcdir)/Makefile.am \ + $(srcdir)/NetworkManager.conf.xml.in \ $(srcdir)/nm-system-settings.conf.5.in \ - $(srcdir)/nm-online.1.in $(srcdir)/nmcli.1.in + $(srcdir)/nm-online.1.in $(srcdir)/nmcli.1.in \ + $(srcdir)/nmtui.1.in ACLOCAL_M4 = $(top_srcdir)/aclocal.m4 am__aclocal_m4_deps = $(top_srcdir)/m4/ax_lib_readline.m4 \ $(top_srcdir)/m4/compiler_warnings.m4 \ @@ -105,7 +114,8 @@ am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ $(ACLOCAL_M4) mkinstalldirs = $(install_sh) -d CONFIG_HEADER = $(top_builddir)/config.h -CONFIG_CLEAN_FILES = nm-system-settings.conf.5 nm-online.1 nmcli.1 +CONFIG_CLEAN_FILES = NetworkManager.conf.xml nm-system-settings.conf.5 \ + nm-online.1 nmcli.1 nmtui.1 CONFIG_CLEAN_VPATH_FILES = AM_V_P = $(am__v_P_@AM_V@) am__v_P_ = $(am__v_P_@AM_DEFAULT_V@) @@ -171,6 +181,8 @@ AUTOCONF = @AUTOCONF@ AUTOHEADER = @AUTOHEADER@ AUTOMAKE = @AUTOMAKE@ AWK = @AWK@ +BLUEZ5_CFLAGS = @BLUEZ5_CFLAGS@ +BLUEZ5_LIBS = @BLUEZ5_LIBS@ CC = @CC@ CCDEPMODE = @CCDEPMODE@ CFLAGS = @CFLAGS@ @@ -294,6 +306,7 @@ NEWT_CFLAGS = @NEWT_CFLAGS@ NEWT_LIBS = @NEWT_LIBS@ NM = @NM@ NMEDIT = @NMEDIT@ +NM_CONFIG_DEFAULT_AUTH_POLKIT_TEXT = @NM_CONFIG_DEFAULT_AUTH_POLKIT_TEXT@ NM_MAJOR_VERSION = @NM_MAJOR_VERSION@ NM_MICRO_VERSION = @NM_MICRO_VERSION@ NM_MINOR_VERSION = @NM_MINOR_VERSION@ @@ -313,6 +326,7 @@ PACKAGE_TARNAME = @PACKAGE_TARNAME@ PACKAGE_URL = @PACKAGE_URL@ PACKAGE_VERSION = @PACKAGE_VERSION@ PATH_SEPARATOR = @PATH_SEPARATOR@ +PERL = @PERL@ PKG_CONFIG = @PKG_CONFIG@ PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@ PKG_CONFIG_PATH = @PKG_CONFIG_PATH@ @@ -339,7 +353,7 @@ SYSTEMD_INHIBIT_LIBS = @SYSTEMD_INHIBIT_LIBS@ SYSTEMD_LOGIN_CFLAGS = @SYSTEMD_LOGIN_CFLAGS@ SYSTEMD_LOGIN_LIBS = @SYSTEMD_LOGIN_LIBS@ SYSTEM_CA_PATH = @SYSTEM_CA_PATH@ -UDEV_BASE_DIR = @UDEV_BASE_DIR@ +UDEV_DIR = @UDEV_DIR@ USE_NLS = @USE_NLS@ UUID_CFLAGS = @UUID_CFLAGS@ UUID_LIBS = @UUID_LIBS@ @@ -418,24 +432,28 @@ with_dhcpcd = @with_dhcpcd@ with_netconfig = @with_netconfig@ with_resolvconf = @with_resolvconf@ with_valgrind = @with_valgrind@ -man_MANS = $(configure_generated_man_pages) $(am__append_1) \ - $(am__append_3) -CLEANFILES = nm-settings.xml $(am__append_2) -EXTRA_DIST = $(docbook_generated_man_pages:.%=.xml) \ +man_MANS = $(configure_generated_man_pages) $(am__append_2) \ + $(am__append_4) $(am__append_6) +CLEANFILES = $(am__append_1) $(am__append_3) $(am__append_5) +EXTRA_DIST = nm-settings.xml nm-settings.xsl nm-settings-keyfile.xml \ + nm-settings-keyfile.xsl nm-settings-ifcfg-rh.xml \ + nm-settings-ifcfg-rh.xsl \ + $(docbook_generated_man_pages:.%=.xml) \ $(docbook_autogenerated_man_pages) XSLTPROC = xsltproc -XSLTPROC_FLAGS = \ - --xinclude \ - --nonet \ +XSLTPROC_FLAGS = --xinclude --nonet +XSLTPROC_MAN_FLAGS = \ + $(XSLTPROC_FLAGS) \ --stringparam man.output.quietly 1 \ --stringparam funcsynopsis.style ansi \ --stringparam man.th.extra1.suppress 1 \ --stringparam man.authors.section.enabled 0 \ - --stringparam man.copyright.section.enabled 0 + --stringparam man.copyright.section.enabled 0 \ + http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl -XSLTPROC_MAN_FLAGS = $(XSLTPROC_FLAGS) http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl configure_generated_man_pages = \ nmcli.1 \ + nmtui.1 \ nm-online.1 \ nm-system-settings.conf.5 @@ -445,12 +463,11 @@ docbook_generated_man_pages = \ nmcli-examples.5 docbook_autogenerated_man_pages = \ - nm-settings.5 - -generated_man_pages = \ - $(docbook_generated_man_pages) \ - $(docbook_autogenerated_man_pages) + nm-settings.5 \ + nm-settings-keyfile.5 \ + nm-settings-ifcfg-rh.5 +links = nmtui-edit nmtui-connect nmtui-hostname all: all-am .SUFFIXES: @@ -484,12 +501,16 @@ $(top_srcdir)/configure: @MAINTAINER_MODE_TRUE@ $(am__configure_deps) $(ACLOCAL_M4): @MAINTAINER_MODE_TRUE@ $(am__aclocal_m4_deps) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(am__aclocal_m4_deps): +NetworkManager.conf.xml: $(top_builddir)/config.status $(srcdir)/NetworkManager.conf.xml.in + cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ nm-system-settings.conf.5: $(top_builddir)/config.status $(srcdir)/nm-system-settings.conf.5.in cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ nm-online.1: $(top_builddir)/config.status $(srcdir)/nm-online.1.in cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ nmcli.1: $(top_builddir)/config.status $(srcdir)/nmcli.1.in cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ +nmtui.1: $(top_builddir)/config.status $(srcdir)/nmtui.1.in + cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ mostlyclean-libtool: -rm -f *.lo @@ -721,7 +742,8 @@ info: info-am info-am: install-data-am: install-man - + @$(NORMAL_INSTALL) + $(MAKE) $(AM_MAKEFLAGS) install-data-hook install-dvi: install-dvi-am install-dvi-am: @@ -765,24 +787,25 @@ ps: ps-am ps-am: uninstall-am: uninstall-man - + @$(NORMAL_INSTALL) + $(MAKE) $(AM_MAKEFLAGS) uninstall-hook uninstall-man: uninstall-man1 uninstall-man5 uninstall-man8 -.MAKE: install-am install-strip +.MAKE: install-am install-data-am install-strip uninstall-am .PHONY: all all-am check check-am clean clean-generic clean-libtool \ cscopelist-am ctags-am distclean distclean-generic \ distclean-libtool distdir dvi dvi-am html html-am info info-am \ - install install-am install-data install-data-am install-dvi \ - install-dvi-am install-exec install-exec-am install-html \ - install-html-am install-info install-info-am install-man \ - install-man1 install-man5 install-man8 install-pdf \ - install-pdf-am install-ps install-ps-am install-strip \ - installcheck installcheck-am installdirs maintainer-clean \ - maintainer-clean-generic mostlyclean mostlyclean-generic \ - mostlyclean-libtool pdf pdf-am ps ps-am tags-am uninstall \ - uninstall-am uninstall-man uninstall-man1 uninstall-man5 \ - uninstall-man8 + install install-am install-data install-data-am \ + install-data-hook install-dvi install-dvi-am install-exec \ + install-exec-am install-html install-html-am install-info \ + install-info-am install-man install-man1 install-man5 \ + install-man8 install-pdf install-pdf-am install-ps \ + install-ps-am install-strip installcheck installcheck-am \ + installdirs maintainer-clean maintainer-clean-generic \ + mostlyclean mostlyclean-generic mostlyclean-libtool pdf pdf-am \ + ps ps-am tags-am uninstall uninstall-am uninstall-hook \ + uninstall-man uninstall-man1 uninstall-man5 uninstall-man8 @ENABLE_GTK_DOC_TRUE@%.8: %.xml @@ -791,9 +814,36 @@ uninstall-man: uninstall-man1 uninstall-man5 uninstall-man8 @ENABLE_GTK_DOC_TRUE@%.5: %.xml @ENABLE_GTK_DOC_TRUE@ $(AM_V_GEN) xsltproc $(XSLTPROC_MAN_FLAGS) $< -@ENABLE_GTK_DOC_TRUE@nm-settings.xml: $(top_builddir)/tools/generate-settings-spec $(top_builddir)/libnm-util/libnm-util.la -@ENABLE_GTK_DOC_TRUE@ rm -f $(builddir)/$@ -@ENABLE_GTK_DOC_TRUE@ $(top_builddir)/tools/generate-settings-spec refentry $(builddir)/$@ +@BUILD_SETTING_DOCS_TRUE@nm-settings.xml: nm-settings.xsl $(top_builddir)/libnm/nm-setting-docs.xml +@BUILD_SETTING_DOCS_TRUE@ $(AM_V_GEN) xsltproc \ +@BUILD_SETTING_DOCS_TRUE@ --output $@ \ +@BUILD_SETTING_DOCS_TRUE@ --stringparam version $(NM_VERSION) \ +@BUILD_SETTING_DOCS_TRUE@ --stringparam date "`date +'%d %B %Y'`" \ +@BUILD_SETTING_DOCS_TRUE@ $^ + +@BUILD_SETTING_DOCS_TRUE@nm-settings-keyfile.xml: nm-settings-keyfile.xsl $(top_builddir)/libnm/nm-keyfile-docs.xml +@BUILD_SETTING_DOCS_TRUE@ $(AM_V_GEN) xsltproc \ +@BUILD_SETTING_DOCS_TRUE@ --output $@ \ +@BUILD_SETTING_DOCS_TRUE@ --stringparam version $(NM_VERSION) \ +@BUILD_SETTING_DOCS_TRUE@ --stringparam date "`date +'%d %B %Y'`" \ +@BUILD_SETTING_DOCS_TRUE@ $^ + +@BUILD_SETTING_DOCS_TRUE@nm-settings-ifcfg-rh.xml: nm-settings-ifcfg-rh.xsl $(top_builddir)/libnm/nm-ifcfg-rh-docs.xml +@BUILD_SETTING_DOCS_TRUE@ $(AM_V_GEN) xsltproc \ +@BUILD_SETTING_DOCS_TRUE@ --output $@ \ +@BUILD_SETTING_DOCS_TRUE@ --stringparam version $(NM_VERSION) \ +@BUILD_SETTING_DOCS_TRUE@ --stringparam date "`date +'%d %B %Y'`" \ +@BUILD_SETTING_DOCS_TRUE@ $^ + +install-data-hook: + for link in $(links); do \ + ln -f $(DESTDIR)$(mandir)/man1/nmtui.1 $(DESTDIR)$(mandir)/man1/$$link.1; \ + done + +uninstall-hook: + for link in $(links); do \ + rm -f $(DESTDIR)$(mandir)/man1/$$link.1; \ + done # Tell versions [3.59,3.63) of GNU make to not export all variables. # Otherwise a system limit (for SysV at least) may be exceeded. diff --git a/man/NetworkManager.8 b/man/NetworkManager.8 index 5022eadb..483f61a4 100644 --- a/man/NetworkManager.8 +++ b/man/NetworkManager.8 @@ -2,12 +2,12 @@ .\" Title: NetworkManager .\" Author: .\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/> -.\" Date: 07/03/2014 +.\" Date: 12/19/2014 .\" Manual: Network management daemons -.\" Source: NetworkManager 0.9.10 +.\" Source: NetworkManager 1.0 .\" Language: English .\" -.TH "NETWORKMANAGER" "8" "" "NetworkManager 0\&.9\&.10" "Network management daemons" +.TH "NETWORKMANAGER" "8" "" "NetworkManager 1\&.0" "Network management daemons" .\" ----------------------------------------------------------------- .\" * Define some portability stuff .\" ----------------------------------------------------------------- @@ -122,7 +122,7 @@ The IP interface name of the device\&. .PP \fIIP4_ADDRESS_N\fR .RS 4 -The IPv4 address in the format "address/prefix gateway", where N is a number from 0 to (# IPv4 address \e\- 1)\&. +The IPv4 address in the format "address/prefix gateway", where N is a number from 0 to (# IPv4 addresses \- 1)\&. gateway item in this variable is deprecated, use IP4_GATEWAY instead\&. .RE .PP \fIIP4_NUM_ADDRESSES\fR @@ -130,9 +130,14 @@ The IPv4 address in the format "address/prefix gateway", where N is a number fro The variable contains the number of IPv4 addresses the script may expect\&. .RE .PP +\fIIP4_GATEWAY\fR +.RS 4 +The gateway IPv4 address in traditional numbers\-and\-dots notation\&. +.RE +.PP \fIIP4_ROUTE_N\fR .RS 4 -The IPv4 route in the format "address/prefix next\-hop metric", where N is a number from 0 to (# IPv4 routes \e\- 1)\&. +The IPv4 route in the format "address/prefix next\-hop metric", where N is a number from 0 to (# IPv4 routes \- 1)\&. .RE .PP \fIIP4_NUM_ROUTES\fR @@ -199,7 +204,7 @@ Specify file for storing state of the NetworkManager persistently\&. If not spec .PP \fB\-\-config\fR .RS 4 -Specify configuration file to set up various settings for NetworkManager\&. If not specified, the default value of /etc/NetworkManager/NetworkManager\&.conf is used with a fallback to the older \*(Aqnm\e\-system\e\-settings\&.conf\*(Aq if located in the same directory\&. See +Specify configuration file to set up various settings for NetworkManager\&. If not specified, the default value of /etc/NetworkManager/NetworkManager\&.conf is used with a fallback to the older \*(Aqnm\-system\-settings\&.conf\*(Aq if located in the same directory\&. See \fBNetworkManager.conf\fR(5) for more information on configuration file\&. .RE diff --git a/man/NetworkManager.conf.5 b/man/NetworkManager.conf.5 index ef7641bc..f34fa63a 100644 --- a/man/NetworkManager.conf.5 +++ b/man/NetworkManager.conf.5 @@ -2,12 +2,12 @@ .\" Title: NetworkManager.conf .\" Author: .\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/> -.\" Date: 07/03/2014 +.\" Date: 12/19/2014 .\" Manual: Configuration -.\" Source: NetworkManager 0.9.10 +.\" Source: NetworkManager 1.0 .\" Language: English .\" -.TH "NETWORKMANAGER\&.CON" "5" "" "NetworkManager 0\&.9\&.10" "Configuration" +.TH "NETWORKMANAGER\&.CON" "5" "" "NetworkManager 1\&.0" "Configuration" .\" ----------------------------------------------------------------- .\" * Define some portability stuff .\" ----------------------------------------------------------------- @@ -87,7 +87,7 @@ Lists system settings plugin names separated by \*(Aq,\*(Aq\&. These plugins are .sp If NetworkManager defines a distro\-specific network\-configuration plugin for your system, then that will normally be listed here\&. (See below for the available plugins\&.) Note that the keyfile -plugin is always appended to the end of this list (if it doesn\*(Aqt already appear earlier in the list), so if there is no distro\-specific plugin for your system then you can leave this key unset and NetworkManager will default to using +plugin is always appended to the end of this list (if it doesn\*(Aqt already appear earlier in the list), so if there is no distro\-specific plugin for your system then you can leave this key unset and NetworkManager will fall back to using keyfile\&. .RE .PP @@ -96,13 +96,31 @@ keyfile\&. Whether the configured settings plugin(s) should set up file monitors and immediately pick up changes made to connection files while NetworkManager is running\&. This is disabled by default; NetworkManager will only read the connection files at startup, and when explicitly requested via the ReloadConnections D\-Bus call\&. If this key is set to \*(Aqtrue\*(Aq, then NetworkManager will reload connection files any time they changed\&. .RE .PP +\fIauth\-polkit\fR +.RS 4 +Whether the system uses PolicyKit for authorization\&. If +false, all requests will be allowed\&. If +true, non\-root requests are authorized using PolicyKit\&. The default value is +true\&. +.RE +.PP \fIdhcp\fR .RS 4 -This key sets up what DHCP client NetworkManager will use\&. Presently +This key sets up what DHCP client NetworkManager will use\&. Allowed values are +dhclient, +dhcpcd, and +internal\&. The dhclient and dhcpcd -are supported\&. The client configured here should be available on your system too\&. If this key is missing, available DHCP clients are looked for in this order: dhclient, dhcpcd\&. +options require the indicated clients to be installed\&. The +internal +option uses a built\-in DHCP client which is not currently as featureful as the external clients (and in particular, does not yet support DHCPv6)\&. +.sp +If this key is missing, available DHCP clients are looked for in this order: +dhclient, +dhcpcd, +internal\&. .RE .PP \fIno\-auto\-default\fR @@ -143,6 +161,14 @@ to apply to all devices\&. Note that the "carrier" property of NMDevices and device D\-Bus interfaces will still reflect the actual device state; it\*(Aqs just that NetworkManager will not make use of that information\&. .RE .PP +\fIconfigure\-and\-quit\fR +.RS 4 +When set to +true, NetworkManager quits after performing initial network configuration but spawns small helpers to preserve DHCP leases and IPv6 addresses\&. This is useful in environments where network setup is more or less static or it is desirable to save process time but still handle some dynamic configurations\&. When this option is +true, network configuration for WiFi, WWAN, Bluetooth, ADSL, and PPPoE interfaces cannot be preserved due to their use of external services, and these devices will be deconfigured when NetworkManager quits even though other interface\*(Aqs configuration may be preserved\&. The default value is +false, meaning that NetworkManager will continue running after initial network configuration and continue responding to system and hardware events, D\-Bus requests, and user commands\&. +.RE +.PP \fIdns\fR .RS 4 Set the DNS (resolv\&.conf) processing mode\&. @@ -243,7 +269,8 @@ The default logging verbosity level\&. One of ERR, WARN, INFO, -DEBUG\&. The ERR level logs only critical errors\&. WARN logs warnings that may reflect operation\&. INFO logs various informational messages that are useful for tracking state and operations\&. DEBUG enables verbose logging for debugging purposes\&. Subsequent levels also log all messages from earlier levels; thus setting the log level to INFO also logs error and warning messages\&. +DEBUG, +TRACE\&. The ERR level logs only critical errors\&. WARN logs warnings that may reflect operation\&. INFO logs various informational messages that are useful for tracking state and operations\&. DEBUG enables verbose logging for debugging purposes\&. TRACE enables even more verbose logging then DEBUG level\&. Subsequent levels also log all messages from earlier levels; thus setting the log level to INFO also logs error and warning messages\&. .RE .PP \fIdomains\fR @@ -447,6 +474,11 @@ This plugin is read\-only; any connections (of any type) added from within Netwo keyfile plugin instead\&. .RE +.PP +\fIibft\fR +.RS 4 +This plugin allows to read iBFT configuration (iSCSI Boot Firmware Table)\&. The configuration is read using /sbin/iscsiadm\&. Users are expected to configure iBFT connections via the firmware interfaces\&. +.RE .SH "SEE ALSO" .PP \fBNetworkManager\fR(8), diff --git a/man/NetworkManager.conf.xml.in b/man/NetworkManager.conf.xml.in new file mode 100644 index 00000000..d9d51b84 --- /dev/null +++ b/man/NetworkManager.conf.xml.in @@ -0,0 +1,560 @@ +<?xml version='1.0'?> <!--*-nxml-*--> +<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN" +"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"> + +<!-- +Copyright 2010 - 2014 Red Hat, Inc. +--> + +<refentry id="NetworkManager.conf"> + <refentryinfo> + <title>NetworkManager.conf</title> + <author>NetworkManager developers</author> + </refentryinfo> + + <refmeta> + <refentrytitle>NetworkManager.conf</refentrytitle> + <manvolnum>5</manvolnum> + <refmiscinfo class="source">NetworkManager</refmiscinfo> + <refmiscinfo class="manual">Configuration</refmiscinfo> + <refmiscinfo class="version">1.0</refmiscinfo> + </refmeta> + + <refnamediv> + <refname>NetworkManager.conf</refname> + <refpurpose>NetworkManager configuration file</refpurpose> + </refnamediv> + + <refsynopsisdiv> + <para><filename>/etc/NetworkManager/NetworkManager.conf</filename>, + <filename>/etc/NetworkManager/conf.d/<replaceable>name</replaceable>.conf</filename> + </para> + </refsynopsisdiv> + + <refsect1> + <title>Description</title> + <para>This is a configuration file for NetworkManager. It is used + to set up various aspects of NetworkManager's behavior. The + location of the file may be changed through use of the + <option>--config</option> argument for NetworkManager. + </para> + <para>If a default <literal>NetworkManager.conf</literal> is + provided by your distribution's packages, you should not modify + it, since your changes may get overwritten by package + updates. Instead, you can add additional <literal>.conf</literal> + files to the <literal>conf.d</literal> directory. These will be read in order, + with later files overriding earlier ones. + </para> + + </refsect1> + + <refsect1> + <title>File Format</title> + <para> + The configuration file format is so-called key file (sort of + ini-style format). It consists of sections (groups) of + key-value pairs. Lines beginning with a '#' and blank lines are + considered comments. Sections are started by a header line + containing the section enclosed in '[' and ']', and ended + implicitly by the start of the next section or the end of the + file. Each key-value pair must be contained in a section. + </para> + <para> + For keys that take a list of devices as their value, you can + specify devices by their MAC addresses or interface names, or + "*" to specify all devices. + </para> + <para> + Minimal system settings configuration file looks like this: + <programlisting> + [main] + plugins=keyfile + </programlisting> + </para> + <para> + As an extension to the normal keyfile format, you can also + append a value to a previously-set list-valued key by doing: + <programlisting> + plugins+=another-plugin + </programlisting> + </para> + </refsect1> + + <refsect1> + <title><literal>main</literal> section</title> + <variablelist> + <varlistentry> + <term><varname>plugins</varname></term> + <listitem> + <para> + Lists system settings plugin names separated by ','. These + plugins are used to read and write system-wide + connections. When multiple plugins are specified, the + connections are read from all listed plugins. When writing + connections, the plugins will be asked to save the + connection in the order listed here; if the first plugin + cannot write out that connection type (or can't write out + any connections) the next plugin is tried, etc. If none of + the plugins can save the connection, an error is returned + to the user. + </para> + <para> + If NetworkManager defines a distro-specific + network-configuration plugin for your system, then that + will normally be listed here. (See below for the available + plugins.) Note that the <literal>keyfile</literal> plugin + is always appended to the end of this list (if it doesn't + already appear earlier in the list), so if there is no + distro-specific plugin for your system then you can leave + this key unset and NetworkManager will fall back to using + <literal>keyfile</literal>. + </para> + </listitem> + </varlistentry> + <varlistentry> + <term><varname>monitor-connection-files</varname></term> + <listitem><para>Whether the configured settings plugin(s) + should set up file monitors and immediately pick up changes + made to connection files while NetworkManager is running. This + is disabled by default; NetworkManager will only read + the connection files at startup, and when explicitly requested + via the ReloadConnections D-Bus call. If this key is set to + '<literal>true</literal>', then NetworkManager will reload + connection files any time they changed.</para></listitem> + </varlistentry> + <varlistentry> + <term><varname>auth-polkit</varname></term> + <listitem><para>Whether the system uses PolicyKit for authorization. + If <literal>false</literal>, all requests will be allowed. If + <literal>true</literal>, non-root requests are authorized using PolicyKit. + The default value is <literal>@NM_CONFIG_DEFAULT_AUTH_POLKIT_TEXT@</literal>. + </para></listitem> + </varlistentry> + <varlistentry> + <term><varname>dhcp</varname></term> + <listitem><para>This key sets up what DHCP client + NetworkManager will use. Allowed values are + <literal>dhclient</literal>, <literal>dhcpcd</literal>, and + <literal>internal</literal>. The <literal>dhclient</literal> + and <literal>dhcpcd</literal> options require the indicated + clients to be installed. The <literal>internal</literal> + option uses a built-in DHCP client which is not currently as + featureful as the external clients (and in particular, does + not yet support DHCPv6).</para> + <para>If this key is missing, available DHCP clients are + looked for in this order: <literal>dhclient</literal>, + <literal>dhcpcd</literal>, + <literal>internal</literal>.</para></listitem> + </varlistentry> + <varlistentry> + <term><varname>no-auto-default</varname></term> + <listitem><para>Comma-separated list of devices for which + NetworkManager shouldn't create default wired connection + (Auto eth0). By default, NetworkManager creates a temporary + wired connection for any Ethernet device that is managed and + doesn't have a connection configured. List a device in this + option to inhibit creating the default connection for the + device. May have the special value <literal>*</literal> to + apply to all devices.</para> + <para>When the default wired connection is deleted or saved + to a new persistent connection by a plugin, the device is + added to a list in the file + <filename>/var/run/NetworkManager/no-auto-default.state</filename> + to prevent creating the default connection for that device + again.</para> + <para> + <programlisting> + no-auto-default=00:22:68:5c:5d:c4,00:1e:65:ff:aa:ee + no-auto-default=eth0,eth1 + no-auto-default=* + </programlisting> + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term><varname>ignore-carrier</varname></term> + <listitem> + <para> + Comma-separated list of devices for which NetworkManager + will (partially) ignore the carrier state. Normally, for + device types that support carrier-detect, such as Ethernet + and InfiniBand, NetworkManager will only allow a + connection to be activated on the device if carrier is + present (ie, a cable is plugged in), and it will + deactivate the device if carrier drops for more than a few + seconds. + </para> + <para> + Listing a device here will allow activating connections on + that device even when it does not have carrier, provided + that the connection uses only statically-configured IP + addresses. Additionally, it will allow any active + connection (whether static or dynamic) to remain active on + the device when carrier is lost. + </para> + <para> + May have the special value <literal>*</literal> to apply + to all devices. + </para> + <para> + Note that the "carrier" property of NMDevices and device D-Bus + interfaces will still reflect the actual device state; it's just + that NetworkManager will not make use of that information. + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term><varname>configure-and-quit</varname></term> + <listitem> + <para> + When set to <literal>true</literal>, NetworkManager quits after + performing initial network configuration but spawns small helpers + to preserve DHCP leases and IPv6 addresses. This is useful in + environments where network setup is more or less static or it is + desirable to save process time but still handle some dynamic + configurations. When this option is <literal>true</literal>, + network configuration for WiFi, WWAN, Bluetooth, ADSL, and PPPoE + interfaces cannot be preserved due to their use of external + services, and these devices will be deconfigured when NetworkManager + quits even though other interface's configuration may be preserved. + The default value is <literal>false</literal>, meaning that + NetworkManager will continue running after initial network + configuration and continue responding to system and hardware events, + D-Bus requests, and user commands. + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term><varname>dns</varname></term> + <listitem><para>Set the DNS (<filename>resolv.conf</filename>) processing mode.</para> + <para><literal>default</literal>: The default if the key is + not specified. NetworkManager will update + <filename>resolv.conf</filename> to reflect the nameservers + provided by currently active connections.</para> + <para><literal>dnsmasq</literal>: NetworkManager will run + dnsmasq as a local caching nameserver, using a "split DNS" + configuration if you are connected to a VPN, and then update + <filename>resolv.conf</filename> to point to the local + nameserver.</para> + <para><literal>unbound</literal>: NetworkManager will talk + to unbound and dnssec-triggerd, providing a "split DNS" + configuration with DNSSEC support. The /etc/resolv.conf + will be managed by dnssec-trigger daemon.</para> + <para><literal>none</literal>: NetworkManager will not + modify resolv.conf.</para> + </listitem> + </varlistentry> + + <varlistentry> + <term><varname>debug</varname></term> + <listitem><para>Comma separated list of options to aid + debugging. This value will be combined with the environment + variable <literal>NM_DEBUG</literal>. Currently the following + values are supported:</para> + <para> + <literal>RLIMIT_CORE</literal>: set ulimit -c unlimited + to write out core dumps. + </para> + </listitem> + </varlistentry> + + </variablelist> + </refsect1> + + <refsect1> + <title><literal>keyfile</literal> section</title> + <para>This section contains keyfile-plugin-specific options, and + is normally only used when you are not using any other + distro-specific plugin.</para> + + <para> + <variablelist> + <varlistentry> + <term><varname>hostname</varname></term> + <listitem><para>Set a persistent hostname.</para></listitem> + </varlistentry> + <varlistentry> + <term><varname>unmanaged-devices</varname></term> + <listitem><para>Set devices that should be ignored by + NetworkManager when using the <literal>keyfile</literal> + plugin. Devices are specified in the following + format:</para> + <para><literal>mac:<hwaddr></literal> or + <literal>interface-name:<ifname></literal>. Here + <literal>hwaddr</literal> is the MAC address of the device + to be ignored, in hex-digits-and-colons notation. + <literal>ifname</literal> is the interface name of the + ignored device.</para> + <para>Multiple entries are separated with semicolons. No + spaces are allowed in the value.</para> + <para> + Example: + <programlisting> +unmanaged-devices=interface-name:em4 +unmanaged-devices=mac:00:22:68:1c:59:b1;mac:00:1E:65:30:D1:C4;interface-name:eth2 + </programlisting> + </para> + </listitem> + </varlistentry> + </variablelist> + </para> + </refsect1> + + <refsect1> + <title><literal>ifupdown</literal> section</title> + <para>This section contains ifupdown-specific options and thus only + has effect when using the <literal>ifupdown</literal> plugin.</para> + + <para> + <variablelist> + <varlistentry> + <term><varname>managed</varname></term> + <listitem><para>If set to <literal>true</literal>, then + interfaces listed in + <filename>/etc/network/interfaces</filename> are managed by + NetworkManager. If set to <literal>false</literal>, then + any interface listed in + <filename>/etc/network/interfaces</filename> will be ignored + by NetworkManager. Remember that NetworkManager controls the + default route, so because the interface is ignored, + NetworkManager may assign the default route to some other + interface.</para> + <para> + The default value is <literal>false</literal>. + </para> + </listitem> + </varlistentry> + </variablelist> + </para> + </refsect1> + + <refsect1> + <title><literal>logging</literal> section</title> + <para>This section controls NetworkManager's logging. Any + settings here are overridden by the <option>--log-level</option> + and <option>--log-domains</option> command-line options.</para> + + <para> + <variablelist> + <varlistentry> + <term><varname>level</varname></term> + <listitem><para>The default logging verbosity level. + One of <literal>ERR</literal>, + <literal>WARN</literal>, <literal>INFO</literal>, + <literal>DEBUG</literal>, <literal>TRACE</literal>. The ERR + level logs only critical errors. WARN logs warnings that may + reflect operation. INFO logs various informational messages that + are useful for tracking state and operations. DEBUG enables + verbose logging for debugging purposes. TRACE enables even more + verbose logging then DEBUG level. Subsequent levels also log + all messages from earlier levels; thus setting the log level + to INFO also logs error and warning messages.</para></listitem> + </varlistentry> + <varlistentry> + <term><varname>domains</varname></term> + <listitem><para>The following log domains are available: + PLATFORM, RFKILL, ETHER, WIFI, BT, MB, DHCP4, DHCP6, PPP, + WIFI_SCAN, IP4, IP6, AUTOIP4, DNS, VPN, SHARING, SUPPLICANT, + AGENTS, SETTINGS, SUSPEND, CORE, DEVICE, OLPC, WIMAX, + INFINIBAND, FIREWALL, ADSL, BOND, VLAN, BRIDGE, DBUS_PROPS, + TEAM, CONCHECK, DCB, DISPATCH.</para> + <para>In addition, these special domains can be used: NONE, + ALL, DEFAULT, DHCP, IP.</para> + <para>You can specify per-domain log level overrides by + adding a colon and a log level to any domain. E.g., + "<literal>WIFI:DEBUG</literal>".</para></listitem> + </varlistentry> + <varlistentry> + <para>Domain descriptions: + <simplelist type="horiz" columns="1"> + <member>PLATFORM : OS (platform) operations</member> + <member>RFKILL : RFKill subsystem operations</member> + <member>ETHER : Ethernet device operations</member> + <member>WIFI : Wi-Fi device operations</member> + <member>BT : Bluetooth operations</member> + <member>MB : Mobile broadband operations</member> + <member>DHCP4 : DHCP for IPv4</member> + <member>DHCP6 : DHCP for IPv6</member> + <member>PPP : Point-to-point protocol operations</member> + <member>WIFI_SCAN : Wi-Fi scanning operations</member> + <member>IP4 : IPv4-related operations</member> + <member>IP6 : IPv6-related operations</member> + <member>AUTOIP4 : AutoIP (avahi) operations</member> + <member>DNS : Domain Name System related operations</member> + <member>VPN : Virtual Private Network connections and operations</member> + <member>SHARING : Connection sharing</member> + <member>SUPPLICANT : WPA supplicant related operations</member> + <member>AGENTS : Secret agents operations and communication</member> + <member>SETTINGS : Settings/config service operations</member> + <member>SUSPEND : Suspend/resume</member> + <member>CORE : Core daemon and policy operations</member> + <member>DEVICE : Activation and general interface operations</member> + <member>OLPC : OLPC Mesh device operations</member> + <member>WIMAX : WiMAX device operations</member> + <member>INFINIBAND : InfiniBand device operations</member> + <member>FIREWALL : FirewallD related operations</member> + <member>ADSL : ADSL device operations</member> + <member>BOND : Bonding operations</member> + <member>VLAN : VLAN operations</member> + <member>BRIDGE : Bridging operations</member> + <member>DBUS_PROPS : D-Bus property changes</member> + <member>TEAM : Teaming operations</member> + <member>CONCHECK : Connectivity check</member> + <member>DCB : Data Center Bridging (DCB) operations</member> + <member>DISPATCH : Dispatcher scripts</member> + <member> </member> + <member>NONE : when given by itself logging is disabled</member> + <member>ALL : all log domains</member> + <member>DEFAULT : default log domains</member> + <member>DHCP : shortcut for "DHCP4,DHCP6"</member> + <member>IP : shortcut for "IP4,IP6"</member> + <member> </member> + <member>HW : deprecated alias for "PLATFORM"</member> + </simplelist> + </para> + </varlistentry> + </variablelist> + </para> + </refsect1> + + <refsect1> + <title><literal>connectivity</literal> section</title> + <para>This section controls NetworkManager's optional connectivity + checking functionality. This allows NetworkManager to detect + whether or not the system can actually access the internet or + whether it is behind a captive portal.</para> + + <para> + <variablelist> + <varlistentry> + <term><varname>uri</varname></term> + <listitem><para>The URI of a web page to periodically + request when connectivity is being checked. This page + should return the header "X-NetworkManager-Status" with a + value of "online". Alternatively, it's body content should + be set to "NetworkManager is online". The body content + check can be controlled by the <literal>response</literal> + option. If this option is blank or missing, connectivity + checking is disabled. + </para></listitem> + </varlistentry> + <varlistentry> + <term><varname>interval</varname></term> + <listitem><para>Specified in seconds; controls how often + connectivity is checked when a network connection exists. If + set to 0 connectivity checking is disabled. If missing, the + default is 300 seconds.</para></listitem> + </varlistentry> + <varlistentry> + <term><varname>response</varname></term> + <listitem><para>If set controls what body content + NetworkManager checks for when requesting the URI for + connectivity checking. If missing, defaults to + "NetworkManager is online" </para></listitem> + </varlistentry> + </variablelist> + </para> + </refsect1> + + <refsect1> + <title>Plugins</title> + + <variablelist> + <varlistentry> + <term><varname>keyfile</varname></term> + <listitem> + <para> + The <literal>keyfile</literal> plugin is the generic + plugin that supports all the connection types and + capabilities that NetworkManager has. It writes files out + in an .ini-style format in + /etc/NetworkManager/system-connections. + </para> + <para> + The stored connection file may contain passwords and + private keys, so it will be made readable only to root, + and the plugin will ignore files that are readable or + writeable by any user or group other than root. + </para> + <para> + This plugin is always active, and will automatically be + used to store any connections that aren't supported by any + other active plugin. + </para> + </listitem> + </varlistentry> + <varlistentry> + <term><varname>ifcfg-rh</varname></term> + <listitem> + <para> + This plugin is used on the Fedora and Red Hat Enterprise + Linux distributions to read and write configuration from + the standard + <filename>/etc/sysconfig/network-scripts/ifcfg-*</filename> + files. It currently supports reading Ethernet, Wi-Fi, + InfiniBand, VLAN, Bond, Bridge, and Team connections. + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term><varname>ifcfg-suse</varname></term> + <listitem> + <para> + This plugin is only provided for simple backward + compatibility with SUSE and OpenSUSE configuration. Most + setups should be using the <literal>keyfile</literal> + plugin instead. The <literal>ifcfg-suse</literal> plugin + supports reading Ethernet and Wi-Fi connections, but does + not support saving any connection types. + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term><varname>ifupdown</varname></term> + <listitem> + <para> + This plugin is used on the Debian and Ubuntu + distributions, and reads Ethernet and Wi-Fi connections + from <filename>/etc/network/interfaces</filename>. + </para> + <para> + This plugin is read-only; any connections (of any type) + added from within NetworkManager when you are using this + plugin will be saved using the <literal>keyfile</literal> + plugin instead. + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term><varname>ibft</varname></term> + <listitem> + <para> + This plugin allows to read iBFT configuration (iSCSI Boot Firmware Table). + The configuration is read using /sbin/iscsiadm. Users are expected to + configure iBFT connections via the firmware interfaces. + </para> + </listitem> + </varlistentry> + + </variablelist> + </refsect1> + + <refsect1> + <title>See Also</title> + <para> + <citerefentry><refentrytitle>NetworkManager</refentrytitle><manvolnum>8</manvolnum></citerefentry>, + <citerefentry><refentrytitle>nmcli</refentrytitle><manvolnum>1</manvolnum></citerefentry>, + <citerefentry><refentrytitle>nmcli-examples</refentrytitle><manvolnum>5</manvolnum></citerefentry>, + <citerefentry><refentrytitle>nm-online</refentrytitle><manvolnum>1</manvolnum></citerefentry>, + <citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum></citerefentry>, + <citerefentry><refentrytitle>nm-applet</refentrytitle><manvolnum>1</manvolnum></citerefentry>, + <citerefentry><refentrytitle>nm-connection-editor</refentrytitle><manvolnum>1</manvolnum></citerefentry> + </para> + </refsect1> +</refentry> diff --git a/man/nm-settings-ifcfg-rh.5 b/man/nm-settings-ifcfg-rh.5 new file mode 100644 index 00000000..6dea364c --- /dev/null +++ b/man/nm-settings-ifcfg-rh.5 @@ -0,0 +1,2325 @@ +'\" t +.\" Title: nm-settings-ifcfg-rh +.\" Author: [see the "AUTHOR" section] +.\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/> +.\" Date: 19 December 2014 +.\" Manual: Configuration +.\" Source: NetworkManager 1.0.0 +.\" Language: English +.\" +.TH "NM\-SETTINGS\-IFCFG\" "5" "" "NetworkManager 1\&.0\&.0" "Configuration" +.\" ----------------------------------------------------------------- +.\" * Define some portability stuff +.\" ----------------------------------------------------------------- +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" http://bugs.debian.org/507673 +.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- +.\" disable hyphenation +.nh +.\" disable justification (adjust text to left margin only) +.ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- +.SH "NAME" +nm-settings-ifcfg-rh \- Description of \fIifcfg\-rh\fR settings plugin +.SH "DESCRIPTION" +.PP +NetworkManager is based on the concept of connection profiles that contain network configuration (see +\fBnm-settings\fR(5) +for details)\&. The profiles can be stored in various formats\&. NetworkManager uses plugins for reading and writing the data\&. The plugins can be configured in +\fBNetworkManager.conf\fR(5)\&. +.PP +The +\fIifcfg\-rh\fR +plugin is used on the Fedora and Red Hat Enterprise Linux distributions to read/write configuration from/to the standard +/etc/sysconfig/network\-scripts/ifcfg\-* +files\&. Each NetworkManager connection maps to one +ifcfg\-* +file, with possible usage of +keys\-* +for passwords, +route\-* +for static IPv4 routes and +route6\-* +for static IPv6 routes\&. The plugin currently supports reading and writing Ethernet, Wi\-Fi, InfiniBand, VLAN, Bond, Bridge, and Team connections\&. Unsupported connection types (such as WWAN, PPPoE, VPN, or ADSL are handled by +\fIkeyfile\fR +plugin (\fBnm-settings-keyfile\fR(5))\&. The main reason for using +\fIifcfg\-rh\fR +plugin is the compatibility with legacy configurations for +\fIifup\fR +and +\fIifdown\fR +(initscripts)\&. +.SH "FILE FORMAT" +.PP +The +\fIifcfg\-rh\fR +config format is a simple text file containing VARIABLE="value" lines\&. The format is described in +sysconfig\&.txt +of +\fIinitscripts\fR +package\&. Note that the configuration files may be sourced by +\fIinitscripts\fR, so they must be valid shell scripts\&. That means, for instance, that +# +character can be used for comments, strings with spaces must be quoted, special characters must be escaped, etc\&. +.PP +Users can create or modify the +\fIifcfg\-rh\fR +connection files manually, even if that is not the recommended way of managing the profiles\&. However, if they choose to do that, they must inform NetworkManager about their changes (see +\fImonitor\-connection\-file\fR +in +\fBnm-settings\fR(5), and +\fInmcli con (re)load\fR)\&. +.PP +\fBSome ifcfg-rh configuration examples:\fR. +.sp +.if n \{\ +.RS 4 +.\} +.nf +\fBSimple DHCP ethernet configuration:\fR +NAME=ethernet +UUID=1c4ddf70\-01bf\-46d6\-b04f\-47e842bd98da +TYPE=Ethernet +BOOTPROTO=dhcp +DEFROUTE=yes +PEERDNS=yes +PEERROUTES=yes +IPV4_FAILURE_FATAL=no +ONBOOT=yes + +.fi +.if n \{\ +.RE +.\} + +.sp +.if n \{\ +.RS 4 +.\} +.nf +\fBSimple ethernet configuration with static IP:\fR +TYPE=Ethernet +BOOTPROTO=none +IPADDR=10\&.1\&.0\&.25 +PREFIX=24 +GATEWAY=10\&.1\&.0\&.1 +DEFROUTE=yes +IPV4_FAILURE_FATAL=no +IPV6INIT=yes +IPV6_AUTOCONF=yes +IPV6_DEFROUTE=yes +IPV6_PEERDNS=yes +IPV6_PEERROUTES=yes +IPV6_FAILURE_FATAL=no +NAME=ethernet\-em2 +UUID=51bb3904\-c0fc\-4dfe\-83b2\-0a71e7928c13 +DEVICE=em2 +ONBOOT=yes + +.fi +.if n \{\ +.RE +.\} + +.sp +.if n \{\ +.RS 4 +.\} +.nf +\fBWPA2 Enterprise WLAN (TTLS with inner MSCHAPV2 authentication):\fR +ESSID="CompanyWLAN" +MODE=Managed +KEY_MGMT=WPA\-EAP +TYPE=Wireless +IEEE_8021X_EAP_METHODS=TTLS +IEEE_8021X_IDENTITY=joe +IEEE_8021X_PASSWORD_FLAGS=ask +IEEE_8021X_INNER_AUTH_METHODS=MSCHAPV2 +IEEE_8021X_CA_CERT=/home/joe/\&.cert/company\&.crt +BOOTPROTO=dhcp +DEFROUTE=yes +PEERDNS=yes +PEERROUTES=yes +IPV4_FAILURE_FATAL=no +IPV6INIT=no +NAME=MyCompany +UUID=f79848ff\-11a6\-4810\-9e1a\-99039dea84c4 +ONBOOT=yes + +.fi +.if n \{\ +.RE +.\} + +.sp +.if n \{\ +.RS 4 +.\} +.nf +\fBBridge and bridge port configuration:\fR +ifcfg\-bridge: ifcfg\-bridge\-port: +NAME=bridge NAME=bridge007\-port\-eth0 +UUID=4be99ce0\-c5b2\-4764\-8b77\-ec226e440125 UUID=3ad56c4a\-47e1\-419b\-b0d4\-8ad86eb967a3 +DEVICE=bridge007 DEVICE=eth0 +STP=yes ONBOOT=yes +TYPE=Bridge TYPE=Ethernet +BRIDGING_OPTS=priority=32768 BRIDGE=bridge007 +ONBOOT=yes +BOOTPROTO=dhcp + + +.fi +.if n \{\ +.RE +.\} + +.sp +.if n \{\ +.RS 4 +.\} +.nf +\fBBonding configuration:\fR +ifcfg\-BOND: ifcfg\-BOND\-slave: +NAME=BOND NAME=BOND\-slave +UUID=b41888aa\-924c\-450c\-b0f8\-85a4f0a51b4a UUID=9bb048e4\-286a\-4cc3\-b104\-007dbd20decb +DEVICE=bond100 DEVICE=eth0 +BONDING_OPTS="mode=balance\-rr miimon=100" ONBOOT=yes +TYPE=Bond TYPE=Ethernet +BONDING_MASTER=yes MASTER=bond100 +ONBOOT=yes SLAVE=yes +BOOTPROTO=dhcp + + +.fi +.if n \{\ +.RE +.\} + +.sp +.if n \{\ +.RS 4 +.\} +.nf +\fBTeam and team port configuration:\fR +ifcfg\-my_team0: +DEVICE=team0 +TEAM_CONFIG="{ \e"device\e": \e"team0\e", \e"runner\e": {\e"name\e": \e"roundrobin\e"}, \e"ports\e": {\e"eth1\e": {}, \e"eth2\e": {}} }" +DEVICETYPE=Team +BOOTPROTO=dhcp +NAME=team0\-profile +UUID=1d3460a0\-7b37\-457f\-a300\-fe8d92da4807 +ONBOOT=yes + +ifcfg\-my_team0_slave1: +NAME=team0\-slave1 +UUID=d5aed298\-c567\-4cc1\-b808\-6d38ecef9e64 +DEVICE=eth1 +ONBOOT=yes +TEAM_MASTER=team0 +DEVICETYPE=TeamPort + +ifcfg\-my_team0_slave2: +NAME=team0\-slave2 +UUID=94e75f4e\-e5ad\-401c\-8962\-31e0ae5d2215 +DEVICE=eth2 +ONBOOT=yes +TEAM_MASTER=team0 +DEVICETYPE=TeamPort + +.fi +.if n \{\ +.RE +.\} + +The UUID values in the config files must be unique\&. You can use +\fIuuidgen\fR +command line tool to generate such values\&. Alternatively, you can leave out UUID entirely\&. In that case NetworkManager will generate a UUID based on the file name\&. +.SH "DIFFERENCES AGAINST INITSCRIPTS" +.PP +The main differences of NetworkManager ifcfg\-rh plugin and traditional initscripts are: +.PP +\fBNM_CONTROLLED=yes|no\fR +.RS 4 +NM_CONTROLLED is NetworkManager\-specific variable used by NetworkManager for determining whether the device of the +\fIifcfg\fR +file should be managed\&. NM_CONTROLLED=yes is supposed if the variable is not present in the file\&. Note that if you have more +\fIifcfg\fR +files for a single device, NM_CONTROLLED=no in one of the files will cause the device not to be managed\&. The profile may not even be the active one\&. +.RE +.PP +\fBNew variables\fR +.RS 4 +NetworkManager has introduced some new variable, not present in initscripts, to be able to store data for its new features\&. The variables are marked as extensions in the tables bellows\&. +.RE +.PP +\fBSemantic change of variables\fR +.RS 4 +NetworkManager had to slightly change the semantic for a few variables\&. +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} +PEERDNS +\- initscripts interpret PEERDNS=no to mean "never touch resolv\&.conf"\&. NetworkManager interprets it to say "never add automatic (DHCP, PPP, VPN, etc\&.) nameservers to resolv\&.conf"\&. +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} +ONBOOT +\- initscripts use ONBOOT=yes to mark the devices that are to be activated during boot\&. NetworkManager extents this to also mean that this profile can be used for auto\-connecting at any time\&. +.RE +.RE +.PP +See the next section for detailed mapping of NetworkManager properties and +\fIifcfg\-rh\fR +variables\&. Variable names, format and usage differences in NetworkManager and initscripts are documented in the tables bellow\&. +.SH "DETAILS" +.PP +\fIifcfg\-rh\fR +plugin variables marked with +\fI(+)\fR +are NetworkManager specific extensions not understood by traditional initscripts\&. +.sp +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.B Table\ \&1.\ \&802-1x setting +.TS +allbox tab(:); +lB lB lB lB. +T{ +Property +T}:T{ +Ifcfg\-rh Variable +T}:T{ +Default +T}:T{ +Description +T} +.T& +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l. +T{ +eap +T}:T{ +IEEE_8021X_EAP_METHODS\fI(+)\fR +T}:T{ +\ \& +T}:T{ +EAP method for 802\&.1X authentication\&.\fB + +Example: \fRIEEE_8021X_EAP_METHODS=PEAP\fB + +Allowed values: \fR"LEAP", "PWD", "TLS", "PEAP", "TTLS", "FAST" +T} +T{ +identity +T}:T{ +IEEE_8021X_IDENTITY\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Identity for EAP authentication methods\&.\fB + +Example: \fRIEEE_8021X_IDENTITY=itsme +T} +T{ +anonymous\-identity +T}:T{ +IEEE_8021X_ANON_IDENTITY\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Anonymous identity for EAP authentication methods\&. +T} +T{ +pac\-file +T}:T{ +IEEE_8021X_PAC_FILE\fI(+)\fR +T}:T{ +\ \& +T}:T{ +File with PAC (Protected Access Credential) for EAP\-FAST\&.\fB + +Example: \fRIEEE_8021X_PAC_FILE=/home/joe/my\-fast\&.pac +T} +T{ +ca\-cert +T}:T{ +IEEE_8021X_CA_CERT\fI(+)\fR +T}:T{ +\ \& +T}:T{ +CA certificate for EAP\&.\fB + +Example: \fRIEEE_8021X_CA_CERT=/home/joe/cacert\&.crt +T} +T{ +ca\-path +T}:T{ +(none) +T}:T{ +\ \& +T}:T{ +The property is not handled by ifcfg\-rh plugin\&. +T} +T{ +subject\-match +T}:T{ +IEEE_8021X_SUBJECT_MATCH\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Substring to match subject of server certificate against\&.\fB + +Example: \fRIEEE_8021X_SUBJECT_MATCH="Red Hat" +T} +T{ +altubject\-matches +T}:T{ +IEEE_8021X_AlTSUBJECT_MATCHES\fI(+)\fR +T}:T{ +\ \& +T}:T{ +List of strings to be matched against the altSubjectName\&.\fB + +Example: \fRIEEE_8021X_ALTSUBJECT_MATCHES="s1\&.domain\&.cc" +T} +T{ +client\-cert +T}:T{ +IEEE_8021X_CLIENT_CERT\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Client certificate for EAP\&.\fB + +Example: \fRIEEE_8021X_CLIENT_CERT=/home/joe/mycert\&.crt +T} +T{ +phase1\-peapver +T}:T{ +IEEE_8021X_PEAP_VERSION\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Use to force a specific PEAP version\&.\fB + +Allowed values: \fR0, 1 +T} +T{ +phase1\-peaplabel +T}:T{ +IEEE_8021X_PEAP_FORCE_NEW_LABEL\fI(+)\fR +T}:T{ +no +T}:T{ +Use to force the new PEAP label during key derivation\&.\fB + +Allowed values: \fRyes, no +T} +T{ +phase1\-fast\-provisioning +T}:T{ +IEEE_8021X_FAST_PROVISIONING\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Enable in\-line provisioning of EAP\-FAST credentials\&.\fB + +Example: \fRIEEE_8021X_FAST_PROVISIONING="allow\-auth allow\-unauth"\fB + +Allowed values: \fRspace\-separated list of these values [allow\-auth, allow\-unauth] +T} +T{ +phase2\-auth +T}:T{ +IEEE_8021X_INNER_AUTH_METHODS\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Inner non\-EAP authentication methods\&. IEEE_8021X_INNER_AUTH_METHODS can contain values both for \*(Aqphase2\-auth\*(Aq and \*(Aqphase2\-autheap\*(Aq properties\&.\fB + +Example: \fRIEEE_8021X_INNER_AUTH_METHODS=PAP\fB + +Allowed values: \fR"PAP", "CHAP", "MSCHAP", "MSCHAPV2", "GTC", "OTP", "MD5" and "TLS" +T} +T{ +phase2\-autheap +T}:T{ +IEEE_8021X_INNER_AUTH_METHODS\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Inner EAP\-based authentication methods\&. Note that IEEE_8021X_INNER_AUTH_METHODS is also used for \*(Aqphase2\-auth\*(Aq values\&.\fB + +Example: \fRIEEE_8021X_INNER_AUTH_METHODS="MSCHAPV2 EAP\-TLS"\fB + +Allowed values: \fR"EAP\-MD5", "EAP\-MSCHAPV2", "EAP\-GTC", "EAP\-OTP" and "EAP\-TLS" +T} +T{ +phase2\-subject\-match +T}:T{ +IEEE_8021X_PHASE2_SUBJECT_MATCH\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Substring to match subject of server certificate against\&.\fB + +Example: \fRIEEE_8021X_PHASE2_SUBJECT_MATCH="Red Hat" +T} +T{ +phase2\-altsubject\-matches +T}:T{ +IEEE_8021X_PHASE2_ALTSUBJECT_MATCHES\fI(+)\fR +T}:T{ +\ \& +T}:T{ +\ \& +T} +T{ +phase2\-client\-cert +T}:T{ +IEEE_8021X_INNER_CLIENT_CERT\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Client certificate for inner EAP method\&.\fB + +Example: \fRIEEE_8021X_INNER_CLIENT_CERT=/home/joe/mycert\&.crt +T} +T{ +password +T}:T{ +IEEE_8021X_PASSWORD\fI(+)\fR +T}:T{ +\ \& +T}:T{ +UTF\-8 encoded password used for EAP\&. It can also go to "key\-" lookaside file, or it can be owned by a secret agent\&. +T} +T{ +password\-flags +T}:T{ +IEEE_8021X_PASSWORD_FLAGS\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Password flags for IEEE_8021X_PASSWORD password\&. (see the section called \(lqSecret flags\(rq for _FLAGS values) +T} +T{ +password\-raw +T}:T{ +(none) +T}:T{ +\ \& +T}:T{ +The property is not handled by ifcfg\-rh plugin\&. +T} +T{ +password\-raw\-flags +T}:T{ +(none) +T}:T{ +\ \& +T}:T{ +The property is not handled by ifcfg\-rh plugin\&. +T} +T{ +private\-key +T}:T{ +IEEE_8021X_PRIVATE_KEY\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Private key for EAP\-TLS\&.\fB + +Example: \fRIEEE_8021X_PRIVATE_KEY=/home/joe/mykey\&.p12 +T} +T{ +private\-key\-password +T}:T{ +IEEE_8021X_PRIVATE_KEY_PASSWORD\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Password for IEEE_8021X_PRIVATE_KEY\&. It can also go to "key\-" lookaside file, or it can be owned by a secret agent\&. +T} +T{ +private\-key\-password\-flags +T}:T{ +IEEE_8021X_PRIVATE_KEY_PASSWORD_FLAGS\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Password flags for IEEE_8021X_PRIVATE_KEY_PASSWORD password\&. (see the section called \(lqSecret flags\(rq for _FLAGS values) +T} +T{ +phase2\-private\-key +T}:T{ +IEEE_8021X_INNER_PRIVATE_KEY\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Private key for inner authentication method for EAP\-TLS\&. +T} +T{ +phase2\-private\-key\-password +T}:T{ +IEEE_8021X_INNER_PRIVATE_KEY_PASSWORD\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Password for IEEE_8021X_INNER_PRIVATE_KEY\&. It can also go to "key\-" lookaside file, or it can be owned by a secret agent\&. +T} +T{ +phase2\-private\-key\-password\-flags +T}:T{ +IEEE_8021X_INNER_PRIVATE_KEY_PASSWORD_FLAGS\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Password flags for IEEE_8021X_INNER_PRIVATE_KEY_PASSWORD password\&. (see the section called \(lqSecret flags\(rq for _FLAGS values) +T} +T{ +pin +T}:T{ +(none) +T}:T{ +\ \& +T}:T{ +The property is not handled by ifcfg\-rh plugin\&. +T} +T{ +pin\-flags +T}:T{ +(none) +T}:T{ +\ \& +T}:T{ +The property is not handled by ifcfg\-rh plugin\&. +T} +T{ +system\-ca\-certs +T}:T{ +(none) +T}:T{ +\ \& +T}:T{ +The property is not handled by ifcfg\-rh plugin\&. +T} +.TE +.sp 1 +.sp +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.B Table\ \&2.\ \&bond setting +.TS +allbox tab(:); +lB lB lB lB. +T{ +Property +T}:T{ +Ifcfg\-rh Variable +T}:T{ +Default +T}:T{ +Description +T} +.T& +l l l l. +T{ +options +T}:T{ +BONDING_OPTS +T}:T{ +\ \& +T}:T{ +Bonding options\&.\fB + +Example: \fRBONDING_OPTS="miimon=100 mode=broadcast" +T} +.TE +.sp 1 +.sp +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.B Table\ \&3.\ \&bridge-port setting +.TS +allbox tab(:); +lB lB lB lB. +T{ +Property +T}:T{ +Ifcfg\-rh Variable +T}:T{ +Default +T}:T{ +Description +T} +.T& +l l l l +l l l l +l l l l. +T{ +priority +T}:T{ +BRIDGING_OPTS: priority= +T}:T{ +32 +T}:T{ +STP priority\&.\fB + +Allowed values: \fR0 \- 63 +T} +T{ +path\-cost +T}:T{ +BRIDGING_OPTS: path_cost= +T}:T{ +100 +T}:T{ +STP cost\&.\fB + +Allowed values: \fR1 \- 65535 +T} +T{ +hairpin\-mode +T}:T{ +BRIDGING_OPTS: hairpin_mode= +T}:T{ +yes +T}:T{ +Hairpin mode of the bridge port\&. +T} +.TE +.sp 1 +.sp +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.B Table\ \&4.\ \&bridge setting +.TS +allbox tab(:); +lB lB lB lB. +T{ +Property +T}:T{ +Ifcfg\-rh Variable +T}:T{ +Default +T}:T{ +Description +T} +.T& +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l. +T{ +mac\-address +T}:T{ +MACADDR\fI(+)\fR +T}:T{ +\ \& +T}:T{ +MAC address of the bridge\&. Note that this requires a recent kernel support, originally introduced in 3\&.15 upstream kernel) MACADDR for bridges is an NM extension\&. +T} +T{ +stp +T}:T{ +STP +T}:T{ +no +T}:T{ +Span tree protocol participation\&. +T} +T{ +priority +T}:T{ +BRIDGING_OPTS: priority= +T}:T{ +32768 +T}:T{ +STP priority\&.\fB + +Allowed values: \fR0 \- 32768 +T} +T{ +forward\-delay +T}:T{ +DELAY +T}:T{ +15 +T}:T{ +STP forwarding delay\&.\fB + +Allowed values: \fR2 \- 30 +T} +T{ +hello\-time +T}:T{ +BRIDGING_OPTS: hello_time= +T}:T{ +2 +T}:T{ +STP hello time\&.\fB + +Allowed values: \fR1 \- 10 +T} +T{ +max\-age +T}:T{ +BRIDGING_OPTS: max_age= +T}:T{ +20 +T}:T{ +STP maximum message age\&.\fB + +Allowed values: \fR6 \- 40 +T} +T{ +ageing\-time +T}:T{ +BRIDGING_OPTS: ageing_time= +T}:T{ +300 +T}:T{ +Ethernet MAC ageing time\&.\fB + +Allowed values: \fR0 \- 1000000 +T} +.TE +.sp 1 +.sp +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.B Table\ \&5.\ \&connection setting +.TS +allbox tab(:); +lB lB lB lB. +T{ +Property +T}:T{ +Ifcfg\-rh Variable +T}:T{ +Default +T}:T{ +Description +T} +.T& +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l. +T{ +id +T}:T{ +NAME\fI(+)\fR +T}:T{ +\ \& +T}:T{ +User friendly name for the connection profile\&. +T} +T{ +uuid +T}:T{ +UUID\fI(+)\fR +T}:T{ +\ \& +T}:T{ +UUID for the connection profile\&. When missing, NetworkManager creates the UUID itself (by hashing the file)\&. +T} +T{ +interface\-name +T}:T{ +DEVICE +T}:T{ +\ \& +T}:T{ +Interface name of the device this profile is bound to\&. The variable can be left out when the profile should apply for more devices\&. Note that DEVICE can be required for some connection types\&. +T} +T{ +type +T}:T{ +TYPE (DEVICETYPE, DEVICE) +T}:T{ +\ \& +T}:T{ +Base type of the connection\&. DEVICETYPE is used for teaming connections\&.\fB + +Example: \fRTYPE=Ethernet; TYPE=Bond; TYPE=Bridge; DEVICETYPE=TeamPort\fB + +Allowed values: \fREthernet, Wireless, InfiniBand, Bridge, Bond, Vlan, Team, TeamPort +T} +T{ +permissions +T}:T{ +USERS\fI(+)\fR +T}:T{ +\ \& +T}:T{ +USERS restrict the access for this conenction to certain users only\&.\fB + +Example: \fRUSERS="joe bob" +T} +T{ +autoconnect +T}:T{ +ONBOOT +T}:T{ +yes +T}:T{ +Whether the connection should be autoconnected (not only while booting)\&. +T} +T{ +autoconnect\-priority +T}:T{ +AUTOCONNECT_PRIORITY\fI(+)\fR +T}:T{ +0 +T}:T{ +Connection priority for automatic activation\&. Connections with higher numbers are preferred when selecting profiles for automatic activation\&.\fB + +Example: \fRAUTOCONNECT_PRIORITY=20\fB + +Allowed values: \fR\-999 to 999 +T} +T{ +zone +T}:T{ +ZONE\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Trust level of this connection\&. The string is usually used for a firewall\&.\fB + +Example: \fRZONE=Work +T} +T{ +master +T}:T{ +MASTER, TEAM_MASTER, BRIDGE +T}:T{ +\ \& +T}:T{ +Reference to master connection\&. The variable used depends on the connection type\&. +T} +T{ +slave\-type +T}:T{ +MASTER, TEAM_MASTER, DEVICETYPE, BRIDGE +T}:T{ +\ \& +T}:T{ +Slave type doesn\*(Aqt map directly to a variable, but it is recognized using different variables\&. MASTER for bonding, TEAM_MASTER and DEVICETYPE for teaming, BRIDGE for bridging\&. +T} +T{ +secondaries +T}:T{ +SECONDARY_UUIDS\fI(+)\fR +T}:T{ +\ \& +T}:T{ +UUID of VPN connections that should be activated together with this connection\&. +T} +T{ +gateway\-ping\-timeout +T}:T{ +GATEWAY_PING_TIMEOUT\fI(+)\fR +T}:T{ +0 +T}:T{ +If greater than zero, the IP connectivity will be checked by pinging the gateway and waiting for the specified timeout (in seconds)\&.\fB + +Example: \fRGATEWAY_PING_TIMEOUT=5 +T} +.TE +.sp 1 +.sp +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.B Table\ \&6.\ \&dcb setting +.TS +allbox tab(:); +lB lB lB lB. +T{ +Property +T}:T{ +Ifcfg\-rh Variable +T}:T{ +Default +T}:T{ +Description +T} +.T& +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l. +T{ +app\-fcoe\-flags +T}:T{ +DCB_APP_FCOE_ENABLE, DCB_APP_FCOE_ADVERTISE, DCB_APP_FCOE_WILLING +T}:T{ +no +T}:T{ +FCOE flags\&.\fB + +Example: \fRDCB_APP_FCOE_ENABLE=yes DCB_APP_FCOE_ADVERTISE=yes +T} +T{ +app\-fcoe\-priority +T}:T{ +DCB_APP_FCOE_PRIORITY +T}:T{ +\ \& +T}:T{ +Priority of FCoE frames\&.\fB + +Allowed values: \fR0 \- 7 +T} +T{ +app\-fcoe\-mode +T}:T{ +DCB_APP_FCOE_MODE +T}:T{ +fabric +T}:T{ +FCoE controller mode\&.\fB + +Allowed values: \fRfabric, vn2vn +T} +T{ +app\-iscsi\-flags +T}:T{ +DCB_APP_ISCSI_ENABLE, DCB_APP_ISCSI_ADVERTISE, DCB_APP_ISCSI_WILLING +T}:T{ +no +T}:T{ +iSCSI flags\&. +T} +T{ +app\-iscsi\-priority +T}:T{ +DCB_APP_ISCSI_PRIORITY +T}:T{ +\ \& +T}:T{ +Priority of iSCSI frames\&.\fB + +Allowed values: \fR0 \- 7 +T} +T{ +app\-fip\-flags +T}:T{ +DCB_APP_FIP_ENABLE, DCB_APP_FIP_ADVERTISE, DCB_APP_FIP_WILLING +T}:T{ +no +T}:T{ +FIP flags\&. +T} +T{ +app\-fip\-priority +T}:T{ +DCB_APP_FIP_PRIORITY +T}:T{ +\ \& +T}:T{ +Priority of FIP frames\&.\fB + +Allowed values: \fR0 \- 7 +T} +T{ +priority\-flow\-control\-flags +T}:T{ +DCB_PFC_ENABLE, DCB_PFC_ADVERTISE, DCB_PFC_WILLING +T}:T{ +no +T}:T{ +Priority flow control flags\&. +T} +T{ +priority\-flow\-control +T}:T{ +DCB_PFC_UP +T}:T{ +\ \& +T}:T{ +Priority flow control values\&. String of 8 "0" and "1", where "0"\&. means "do not transmit priority pause", "1" means "transmit pause"\&.\fB + +Example: \fRDCB_PFC_UP=01101110 +T} +T{ +priority\-group\-flags +T}:T{ +DCB_PG_ENABLE, DCB_PG_ADVERTISE, DCB_PG_WILLING +T}:T{ +no +T}:T{ +Priority groups flags\&. +T} +T{ +priority\-group\-id +T}:T{ +DCB_PG_ID +T}:T{ +\ \& +T}:T{ +Priority groups values\&. String of eight priorities (0 \- 7) or "f" (unrestricted)\&.\fB + +Example: \fRDCB_PG_ID=1205f173 +T} +T{ +priority\-group\-bandwidth +T}:T{ +DCB_PG_PCT +T}:T{ +\ \& +T}:T{ +Priority groups values\&. Eight bandwidths (in percent), separated with commas\&.\fB + +Example: \fRDCB_PG_PCT=10,5,10,15,10,10,10,30 +T} +T{ +priority\-bandwidth +T}:T{ +DCB_PG_UPPCT +T}:T{ +\ \& +T}:T{ +Priority values\&. Eight bandwidths (in percent), separated with commas\&. The sum of the numbers must be 100\&.\fB + +Example: \fRDCB_PG_UPPCT=7,13,10,10,15,15,10,20 +T} +T{ +priority\-strict\-bandwidth +T}:T{ +DCB_PG_STRICT +T}:T{ +\ \& +T}:T{ +Priority values\&. String of eight "0" or "1", where "0" means "may not utilize all bandwidth", "1" means "may utilize all bandwidth"\&.\fB + +Example: \fRDCB_PG_STRICT=01101110 +T} +T{ +priority\-traffic\-class +T}:T{ +DCB_PG_UP2TC +T}:T{ +\ \& +T}:T{ +Priority values\&. String of eight trafic class values (0 \- 7)\&.\fB + +Example: \fRDCB_PG_UP2TC=01623701 +T} +.TE +.sp 1 +.PP +All DCB related configuration is a NetworkManager extention\&. DCB=yes must be used explicitly to enable DCB so that the rest of the DCB_* variables can apply\&. +.sp +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.B Table\ \&7.\ \&infiniband setting +.TS +allbox tab(:); +lB lB lB lB. +T{ +Property +T}:T{ +Ifcfg\-rh Variable +T}:T{ +Default +T}:T{ +Description +T} +.T& +l l l l +l l l l +l l l l +l l l l +l l l l. +T{ +mac\-address +T}:T{ +HWADDR +T}:T{ +\ \& +T}:T{ +IBoIP 20\-byte hardware address of the device (in traditional hex\-digits\-and\-colons notation)\&.\fB + +Example: \fRHWADDR=01:02:03:04:05:06:07:08:09:0A:01:02:03:04:05:06:07:08:09:11 +T} +T{ +mtu +T}:T{ +MTU +T}:T{ +\ \& +T}:T{ +MTU of the interface\&. +T} +T{ +transport\-mode +T}:T{ +CONNECTED_MODE +T}:T{ +CONNECTED_MODE=no +T}:T{ +CONNECTED_MODE=yes for "connected" mode, CONNECTED_MODE=no for "datagram" mode +T} +T{ +p\-key +T}:T{ +PKEY_ID (and PKEY=yes) +T}:T{ +PKEY=no +T}:T{ +InfiniBand P_Key\&. The value can be a hex number prefixed with "0x" or a decimal number\&. When PKEY_ID is specified, PHYSDEV and DEVICE also must be specified\&.\fB + +Example: \fRPKEY=yes PKEY_ID=2 PHYSDEV=mlx4_ib0 DEVICE=mlx4_ib0\&.8002 +T} +T{ +parent +T}:T{ +PHYSDEV (PKEY=yes) +T}:T{ +PKEY=no +T}:T{ +InfiniBand parent device\&.\fB + +Example: \fRPHYSDEV=ib0 +T} +.TE +.sp 1 +.sp +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.B Table\ \&8.\ \&ipv4 setting +.TS +allbox tab(:); +lB lB lB lB. +T{ +Property +T}:T{ +Ifcfg\-rh Variable +T}:T{ +Default +T}:T{ +Description +T} +.T& +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l. +T{ +method +T}:T{ +BOOTPROTO +T}:T{ +none +T}:T{ +Method used for IPv4 protocol configuration\&.\fB + +Allowed values: \fRnone, dhcp (bootp), static, ibft, autoip, shared +T} +T{ +dns +T}:T{ +DNS1, DNS2, \&.\&.\&. +T}:T{ +\ \& +T}:T{ +List of DNS servers\&. Even if NetworkManager supports many DNS servers, initscripts and resolver only care about the first three, usually\&.\fB + +Example: \fRDNS1=1\&.2\&.3\&.4 DNS2=10\&.0\&.0\&.254 DNS3=8\&.8\&.8\&.8 +T} +T{ +dns\-search +T}:T{ +DOMAIN +T}:T{ +\ \& +T}:T{ +List of DNS search domains\&. +T} +T{ +addresses +T}:T{ +IPADDR, PREFIX, IPADDR1, PREFIX1, \&.\&.\&. +T}:T{ +\ \& +T}:T{ +List of static IP addresses\&.\fB + +Example: \fRIPADDR=10\&.5\&.5\&.23 PREFIX=24 IPADDR1=1\&.1\&.1\&.2 PREFIX1=16 +T} +T{ +gateway +T}:T{ +GATEWAY +T}:T{ +\ \& +T}:T{ +Gateway IP address\&.\fB + +Example: \fRGATEWAY=10\&.5\&.5\&.1 +T} +T{ +routes +T}:T{ +ADDRESS1, NETMASK1, GATEWAY1, METRIC1, \&.\&.\&. +T}:T{ +\ \& +T}:T{ +List of static routes\&. They are not stored in ifcfg\-* file, but in route\-* file instead\&. +T} +T{ +ignore\-auto\-routes +T}:T{ +PEERROUTES\fI(+)\fR +T}:T{ +yes +T}:T{ +PEERROUTES has the opposite meaning as \*(Aqignore\-auto\-routes\*(Aq property\&. +T} +T{ +ignore\-auto\-dns +T}:T{ +PEERDNS +T}:T{ +yes +T}:T{ +PEERDNS has the opposite meaning as \*(Aqignore\-auto\-dns\*(Aq property\&. +T} +T{ +dhcp\-send\-hostname +T}:T{ +DHCP_SEND_HOSTNAME\fI(+)\fR +T}:T{ +yes +T}:T{ +Whether DHCP_HOSTNAME should be sent to the DHCP server\&. +T} +T{ +dhcp\-hostname +T}:T{ +DHCP_HOSTNAME +T}:T{ +\ \& +T}:T{ +Hostname to send to the DHCP server\&. +T} +T{ +never\-default +T}:T{ +DEFROUTE (GATEWAYDEV in /etc/sysconfig/network) +T}:T{ +yes +T}:T{ +DEFROUTE=no tells NetworkManager that this connection should not be assigned the default route\&. DEFROUTE has the opposite meaning as \*(Aqnever\-default\*(Aq property\&. +T} +T{ +may\-fail +T}:T{ +IPV4_FAILURE_FATAL\fI(+)\fR +T}:T{ +no +T}:T{ +IPV4_FAILURE_FATAL has the opposite meaning as \*(Aqmay\-fail\*(Aq property\&. +T} +T{ +dhcp\-client\-id +T}:T{ +DHCP_CLIENT_ID\fI(+)\fR +T}:T{ +\ \& +T}:T{ +A string sent to the DHCP server to identify the local machine\&.\fB + +Example: \fRDHCP_CLIENT_ID=ax\-srv\-1 +T} +.TE +.sp 1 +.sp +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.B Table\ \&9.\ \&ipv6 setting +.TS +allbox tab(:); +lB lB lB lB. +T{ +Property +T}:T{ +Ifcfg\-rh Variable +T}:T{ +Default +T}:T{ +Description +T} +.T& +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l. +T{ +method +T}:T{ +IPV6INIT, IPV6FORWARDING, IPV6_AUTOCONF, DHCPV6C +T}:T{ +IPV6INIT=yes; IPV6FORWARDING=no; IPV6_AUTOCONF=!IPV6FORWARDING, DHCPV6=no +T}:T{ +Method used for IPv6 protocol configuration\&. ignore ~ IPV6INIT=no; auto ~ IPV6_AUTOCONF=yes; dhcp ~ IPV6_AUTOCONF=no and DHCPV6C=yes +T} +T{ +dns +T}:T{ +DNS1, DNS2, \&.\&.\&. +T}:T{ +\ \& +T}:T{ +List of DNS servers\&. NetworkManager uses the variables both for IPv4 and IPv6\&. +T} +T{ +dns\-search +T}:T{ +DOMAIN +T}:T{ +\ \& +T}:T{ +List of DNS search domains\&. +T} +T{ +addresses +T}:T{ +IPV6ADDR, IPV6ADDR_SECONDARIES +T}:T{ +\ \& +T}:T{ +List of static IP addresses\&.\fB + +Example: \fRIPV6ADDR=ab12:9876::1 IPV6ADDR_SECONDARIES="ab12:9876::2 ab12:9876::3" +T} +T{ +gateway +T}:T{ +IPV6_DEFAULTGW +T}:T{ +\ \& +T}:T{ +Gateway IP address\&.\fB + +Example: \fRIPV6_DEFAULTGW=abbe::1 +T} +T{ +routes +T}:T{ +(none) +T}:T{ +\ \& +T}:T{ +List of static routes\&. They are not stored in ifcfg\-* file, but in route6\-* file instead in the form of command line for \*(Aqip route add\*(Aq\&. +T} +T{ +ignore\-auto\-routes +T}:T{ +IPV6_PEERROUTES\fI(+)\fR +T}:T{ +yes +T}:T{ +IPV6_PEERROUTES has the opposite meaning as \*(Aqignore\-auto\-routes\*(Aq property\&. +T} +T{ +ignore\-auto\-dns +T}:T{ +IPV6_PEERDNS\fI(+)\fR +T}:T{ +yes +T}:T{ +IPV6_PEERDNS has the opposite meaning as \*(Aqignore\-auto\-dns\*(Aq property\&. +T} +T{ +dhcp\-hostname +T}:T{ +DHCP_HOSTNAME +T}:T{ +\ \& +T}:T{ +Hostname to send the DHCP server\&. +T} +T{ +never\-default +T}:T{ +IPV6_DEFROUTE\fI(+)\fR, (and IPV6_DEFAULTGW, IPV6_DEFAULTDEV in /etc/sysconfig/network) +T}:T{ +IPV6_DEFROUTE=yes (when no variable specified) +T}:T{ +IPV6_DEFROUTE=no tells NetworkManager that this connection should not be assigned the default IPv6 route\&. IPV6_DEFROUTE has the opposite meaning as \*(Aqnever\-default\*(Aq property\&. +T} +T{ +may\-fail +T}:T{ +IPV6_FAILURE_FATAL\fI(+)\fR +T}:T{ +no +T}:T{ +IPV6_FAILURE_FATAL has the opposite meaning as \*(Aqmay\-fail\*(Aq property\&. +T} +T{ +ip6\-privacy +T}:T{ +IPV6_PRIVACY, IPV6_PRIVACY_PREFER_PUBLIC_IP\fI(+)\fR +T}:T{ +no +T}:T{ +Configure IPv6 Privacy Extensions for SLAAC (RFC4941)\&.\fB + +Example: \fRIPV6_PRIVACY=rfc3041 IPV6_PRIVACY_PREFER_PUBLIC_IP=yes\fB + +Allowed values: \fRIPV6_PRIVACY: no, yes (rfc3041 or rfc4941); IPV6_PRIVACY_PREFER_PUBLIC_IP: yes, no +T} +.TE +.sp 1 +.sp +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.B Table\ \&10.\ \&team-port setting +.TS +allbox tab(:); +lB lB lB lB. +T{ +Property +T}:T{ +Ifcfg\-rh Variable +T}:T{ +Default +T}:T{ +Description +T} +.T& +l l l l. +T{ +config +T}:T{ +TEAM_PORT_CONFIG +T}:T{ +\ \& +T}:T{ +Team port configuration in JSON\&. See man teamd\&.conf for details\&. +T} +.TE +.sp 1 +.sp +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.B Table\ \&11.\ \&team setting +.TS +allbox tab(:); +lB lB lB lB. +T{ +Property +T}:T{ +Ifcfg\-rh Variable +T}:T{ +Default +T}:T{ +Description +T} +.T& +l l l l. +T{ +config +T}:T{ +TEAM_CONFIG +T}:T{ +\ \& +T}:T{ +Team configuration in JSON\&. See man teamd\&.conf for details\&. +T} +.TE +.sp 1 +.sp +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.B Table\ \&12.\ \&vlan setting +.TS +allbox tab(:); +lB lB lB lB. +T{ +Property +T}:T{ +Ifcfg\-rh Variable +T}:T{ +Default +T}:T{ +Description +T} +.T& +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l. +T{ +parent +T}:T{ +DEVICE or PHYSDEV +T}:T{ +\ \& +T}:T{ +Parent interface of the VLAN\&. +T} +T{ +id +T}:T{ +VLAN_ID or DEVICE +T}:T{ +\ \& +T}:T{ +VLAN identifier\&. +T} +T{ +flags +T}:T{ +VLAN_FLAGS, REORDER_HDR +T}:T{ +\ \& +T}:T{ +Parent interface of the VLAN\&.\fB + +Allowed values: \fR"GVRP", "LOOSE_BINDING" for VLAN_FLAGS; 0 or 1 for REORDER_HDR +T} +T{ +ingress\-property\-map +T}:T{ +VLAN_INGRESS_PRIORITY_MAP +T}:T{ +\ \& +T}:T{ +Ingress priority mapping\&.\fB + +Example: \fRVLAN_INGRESS_PRIORITY_MAP=4:2,3:5 +T} +T{ +egress\-property\-map +T}:T{ +VLAN_EGRESS_PRIORITY_MAP +T}:T{ +\ \& +T}:T{ +Egress priority mapping\&.\fB + +Example: \fRVLAN_EGRESS_PRIORITY_MAP=5:4,4:1,3:7 +T} +T{ +interface\-name +T}:T{ +PHYSDEV and VLAN_ID, or DEVICE +T}:T{ +\ \& +T}:T{ +VLAN interface name\&. If all variables are set, parent device from PHYSDEV takes precedence over DEVICE, but VLAN id from DEVICE takes precedence over VLAN_ID\&.\fB + +Example: \fRPHYSDEV=eth0, VLAN_ID=12; or DEVICE=eth0\&.12 +T} +.TE +.sp 1 +.sp +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.B Table\ \&13.\ \&802-3-ethernet setting +.TS +allbox tab(:); +lB lB lB lB. +T{ +Property +T}:T{ +Ifcfg\-rh Variable +T}:T{ +Default +T}:T{ +Description +T} +.T& +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l. +T{ +port +T}:T{ +(none) +T}:T{ +\ \& +T}:T{ +The property is not saved by the plugin\&. +T} +T{ +speed +T}:T{ +(none) +T}:T{ +\ \& +T}:T{ +The property is not saved by the plugin\&. +T} +T{ +duplex +T}:T{ +(none) +T}:T{ +\ \& +T}:T{ +The property is not saved by the plugin\&. +T} +T{ +auto\-negotiate +T}:T{ +(none) +T}:T{ +\ \& +T}:T{ +The property is not saved by the plugin\&. +T} +T{ +mac\-address +T}:T{ +HWADDR +T}:T{ +\ \& +T}:T{ +Hardware address of the device in traditional hex\-digits\-and\-colons notation (e\&.g\&. 00:22:68:14:5A:05)\&. +T} +T{ +cloned\-mac\-address +T}:T{ +MACADDR +T}:T{ +\ \& +T}:T{ +Cloned (spoofed) MAC address in traditional hex\-digits\-and\-colons notation (e\&.g\&. 00:22:68:14:5A:99)\&. +T} +T{ +mac\-address\-blacklist +T}:T{ +HWADDR_BLACKLIST\fI(+)\fR +T}:T{ +\ \& +T}:T{ +It denies usage of the connection for any device whose address is listed\&.\fB + +Example: \fRHWADDR_BLACKLIST="00:22:68:11:69:08 00:11:22:11:44:55" +T} +T{ +mtu +T}:T{ +MTU +T}:T{ +\ \& +T}:T{ +MTU of the interface\&. +T} +T{ +s390\-subchannels +T}:T{ +SUBCHANNELS +T}:T{ +\ \& +T}:T{ +Subchannels for IBM S390 hosts\&.\fB + +Example: \fRSUBCHANNELS=0\&.0\&.b00a,0\&.0\&.b00b,0\&.0\&.b00c +T} +T{ +s390\-nettype +T}:T{ +NETTYPE +T}:T{ +\ \& +T}:T{ +Network type of the S390 host\&.\fB + +Example: \fRNETTYPE=qeth\fB + +Allowed values: \fR"qeth", "lcs" or "ctc" +T} +T{ +s390\-options +T}:T{ +OPTIONS and PORTNAME, CTCPROTO, +T}:T{ +\ \& +T}:T{ +S390 device options\&. All options go to OPTIONS, except for "portname" and "ctcprot" that have their own variables\&. +T} +.TE +.sp 1 +.sp +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.B Table\ \&14.\ \&802-11-wireless-security setting +.TS +allbox tab(:); +lB lB lB lB. +T{ +Property +T}:T{ +Ifcfg\-rh Variable +T}:T{ +Default +T}:T{ +Description +T} +.T& +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l. +T{ +key\-mgmt +T}:T{ +KEY_MGMT\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Key management menthod\&.\fB + +Allowed values: \fRIEEE8021X, WPA\-PSK, WPA\-EAP +T} +T{ +wep\-tx\-keyidx +T}:T{ +DEFAULTKEY +T}:T{ +1 +T}:T{ +Index of active WEP key\&.\fB + +Allowed values: \fR1, 2, 3, 4 +T} +T{ +auth\-alg +T}:T{ +SECURITYMODE\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Authentication algorithm for WEP\&.\fB + +Allowed values: \fRrestricted, open, leap +T} +T{ +proto +T}:T{ +WPA_ALLOW_WPA\fI(+)\fR, WPA_ALLOW_WPA2\fI(+)\fR +T}:T{ +no +T}:T{ +Allowed WPA protocols, WPA and WPA2 (RSN)\&.\fB + +Allowed values: \fRyes, no +T} +T{ +pairwise +T}:T{ +CIPHER_PAIRWISE\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Restrict pairwise encryption algorithms, specified as a space separated list\&.\fB + +Allowed values: \fRCCMP, TKIP +T} +T{ +group +T}:T{ +CIPHER_GROUP\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Restrict group/broadcast encryption algorithms, specified as a space separated list\&.\fB + +Allowed values: \fRCCMP, TKIP, WEP40, WEP104 +T} +T{ +leap\-username +T}:T{ +IEEE_8021X_IDENTITY\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Login name for LEAP\&. +T} +T{ +wep\-key0 +T}:T{ +KEY1, KEY_PASSPHRASE1\fI(+)\fR +T}:T{ +\ \& +T}:T{ +The first WEP key (used in most networks)\&. See also DEFAULTKEY for key index\&. +T} +T{ +wep\-key1 +T}:T{ +KEY2, KEY_PASSPHRASE2\fI(+)\fR +T}:T{ +\ \& +T}:T{ +WEP key with index 1\&. See also DEFAULTKEY for key index\&. +T} +T{ +wep\-key2 +T}:T{ +KEY3, KEY_PASSPHRASE3\fI(+)\fR +T}:T{ +\ \& +T}:T{ +WEP key with index 2\&. See also DEFAULTKEY for key index\&. +T} +T{ +wep\-key3 +T}:T{ +KEY4, KEY_PASSPHRASE4\fI(+)\fR +T}:T{ +\ \& +T}:T{ +WEP key with index 3\&. See also DEFAULTKEY for key index\&. +T} +T{ +wep\-key\-flags +T}:T{ +WEP_KEY_FLAGS\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Password flags for KEY<i>, KEY_PASSPHRASE<i> password\&. (see the section called \(lqSecret flags\(rq for _FLAGS values) +T} +T{ +psk +T}:T{ +WPA_PSK +T}:T{ +\ \& +T}:T{ +Pre\-Shared\-Key for WPA networks\&. +T} +T{ +psk\-flags +T}:T{ +WPA_PSK_FLAGS\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Password flags for WPA_PSK_FLAGS\&. (see the section called \(lqSecret flags\(rq for _FLAGS values)\fB + +Example: \fRWPA_PSK_FLAGS=user +T} +T{ +leap\-password +T}:T{ +IEEE_8021X_PASSWORD\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Password for LEAP\&. It can also go to "key\-" lookaside file, or it can be owned by a secret agent\&. +T} +T{ +leap\-password\-flags +T}:T{ +IEEE_8021X_PASSWORD_FLAGS\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Password flags for IEEE_8021X_PASSWORD_FLAGS\&. (see the section called \(lqSecret flags\(rq for _FLAGS values) +T} +T{ +wep\-key\-type +T}:T{ +KEY<i> or KEY_PASSPHRASE<i>\fI(+)\fR +T}:T{ +\ \& +T}:T{ +KEY is used for "key" type (10 or 26 hexadecimal characters, or 5 or 13 character string prefixed with "s:")\&. KEY_PASSPHRASE is used for WEP passphrases\&.\fB + +Example: \fRKEY1=s:ahoj, KEY1=0a1c45bc02, KEY_PASSPHRASE1=mysupersecretkey +T} +.TE +.sp 1 +.sp +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.B Table\ \&15.\ \&802-11-wireless setting +.TS +allbox tab(:); +lB lB lB lB. +T{ +Property +T}:T{ +Ifcfg\-rh Variable +T}:T{ +Default +T}:T{ +Description +T} +.T& +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l +l l l l. +T{ +ssid +T}:T{ +ESSID +T}:T{ +\ \& +T}:T{ +SSID of Wi\-Fi network\&.\fB + +Example: \fRESSID="Quick Net" +T} +T{ +mode +T}:T{ +MODE +T}:T{ +\ \& +T}:T{ +Wi\-Fi network mode\&.\fB + +Allowed values: \fRAd\-Hoc, Managed (Auto) [case insensitive] +T} +T{ +band +T}:T{ +BAND\fI(+)\fR +T}:T{ +\ \& +T}:T{ +BAND alone is honored, but CHANNEL overrides BAND since it implies a band\&.\fB + +Example: \fRBAND=bg\fB + +Allowed values: \fRa, bg +T} +T{ +channel +T}:T{ +CHANNEL +T}:T{ +\ \& +T}:T{ +Channel used for the Wi\-Fi communication\&. Channels greater than 14 mean "a" band, otherwise the band is "bg"\&.\fB + +Example: \fRCHANNEL=6 +T} +T{ +bssid +T}:T{ +BSSID\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Restricts association only to a single AP\&.\fB + +Example: \fRBSSID=00:1E:BD:64:83:21 +T} +T{ +rate +T}:T{ +(none) +T}:T{ +\ \& +T}:T{ +This property is not handled by ifcfg\-rh plugin\&. +T} +T{ +tx\-power +T}:T{ +(none) +T}:T{ +\ \& +T}:T{ +This property is not handled by ifcfg\-rh plugin\&. +T} +T{ +mac\-address +T}:T{ +HWADDR +T}:T{ +\ \& +T}:T{ +Hardware address of the device in traditional hex\-digits\-and\-colons notation (e\&.g\&. 00:22:68:14:5A:05)\&. +T} +T{ +cloned\-mac\-address +T}:T{ +MACADDR +T}:T{ +\ \& +T}:T{ +Cloned (spoofed) MAC address in traditional hex\-digits\-and\-colons notation (e\&.g\&. 00:22:68:14:5A:99)\&. +T} +T{ +mac\-address\-blacklist +T}:T{ +HWADDR_BLACKLIST\fI(+)\fR +T}:T{ +\ \& +T}:T{ +It denies usage of the connection for any device whose address is listed\&. +T} +T{ +seen\-bssids +T}:T{ +(none) +T}:T{ +\ \& +T}:T{ +This property is not handled by ifcfg\-rh plugin\&. +T} +T{ +mtu +T}:T{ +MTU +T}:T{ +\ \& +T}:T{ +MTU of the wireless interface\&. +T} +T{ +hidden +T}:T{ +SSID_HIDDEN\fI(+)\fR +T}:T{ +\ \& +T}:T{ +Whether the network hides the SSID\&. +T} +T{ +security +T}:T{ +(none) +T}:T{ +\ \& +T}:T{ +This property is deprecated and not handled by ifcfg\-rh\-plugin\&. +T} +.TE +.sp 1 +.PP +The following settings are not supported by +\fIifcfg\-rh\fR +plugin: +.PP +adsl, bluetooth, ppp, pppoe, serial, generic, gsm, cdma, 802\-11\-olpc\-mesh, wimax, vpn +.SS "Secret flags" +.PP +Each secret property in a NetworkManager setting has an associated +\fIflags\fR +property that describes how to handle that secret\&. In the +\fIfcfg\-rh\fR +plugin variables for secret flags have a +\fI_FLAGS\fR +suffix\&. The variables contain one or more of the folowing values (space separated)\&. Missing (or empty) *_FLAGS variable means that the password is owned by NetworkManager\&. +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} +user +\- a user\-session secret agent is responsible for providing and storing this secret; when it is required, agents will be asked to provide it\&. +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} +ask +\- the associated password is not saved but it will be requested from the user each time it is required\&. +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} +unused +\- in some situations it cannot be automatically determined that a secret is required or not\&. This flag hints that the secret is not required and should not be requested from the user\&. +.RE +.SH "AUTHOR" +.PP +NetworkManager developers +.SH "FILES" +.PP +/etc/sysconfig/network\-scripts/ifcfg\-* +.PP +/etc/sysconfig/network\-scripts/keys\-* +.PP +/etc/sysconfig/network\-scripts/route\-* +.PP +/etc/sysconfig/network\-scripts/route6\-* +.PP +/usr/share/doc/initscripts/sysconfig\&.txt +.SH "SEE ALSO" +.PP +https://developer\&.gnome\&.org/NetworkManager/unstable/ref\-settings\&.html +.PP +nm\-settings(5), nm\-settings\-keyfile(5), NetworkManager(8), NetworkManager\&.conf(5), nmcli(1), nmcli\-examples(5) diff --git a/man/nm-settings-ifcfg-rh.xml b/man/nm-settings-ifcfg-rh.xml new file mode 100644 index 00000000..e578442a --- /dev/null +++ b/man/nm-settings-ifcfg-rh.xml @@ -0,0 +1,335 @@ +<?xml version="1.0"?> +<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.3//EN" "http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd"> +<refentry id="nm-settings-ifcfg-rh"><refentryinfo><date>19 December 2014</date></refentryinfo><refmeta><refentrytitle>nm-settings-ifcfg-rh</refentrytitle><manvolnum>5</manvolnum><refmiscinfo class="source">NetworkManager</refmiscinfo><refmiscinfo class="manual">Configuration</refmiscinfo><refmiscinfo class="version">1.0.0</refmiscinfo></refmeta><refnamediv><refname>nm-settings-ifcfg-rh</refname><refpurpose>Description of <emphasis>ifcfg-rh</emphasis> settings plugin</refpurpose></refnamediv><refsect1><title>DESCRIPTION</title><para> + NetworkManager is based on the concept of connection profiles that contain + network configuration (see <citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum></citerefentry> for details). The profiles can be + stored in various formats. NetworkManager uses plugins for reading and writing + the data. The plugins can be configured in <citerefentry><refentrytitle>NetworkManager.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>. + </para><para> + The <emphasis>ifcfg-rh</emphasis> plugin is used on the Fedora and Red Hat + Enterprise Linux distributions to read/write configuration from/to + the standard <filename>/etc/sysconfig/network-scripts/ifcfg-*</filename> files. + Each NetworkManager connection maps to one <filename>ifcfg-*</filename> file, with + possible usage of <filename>keys-*</filename> for passwords, <filename>route-*</filename> + for static IPv4 routes and <filename>route6-*</filename> for static IPv6 routes. + The plugin currently supports reading and writing Ethernet, Wi-Fi, InfiniBand, + VLAN, Bond, Bridge, and Team connections. Unsupported connection types (such as + WWAN, PPPoE, VPN, or ADSL are handled by <emphasis>keyfile</emphasis> plugin + (<citerefentry><refentrytitle>nm-settings-keyfile</refentrytitle><manvolnum>5</manvolnum></citerefentry>). + The main reason for using <emphasis>ifcfg-rh</emphasis> plugin is the compatibility + with legacy configurations for <emphasis>ifup</emphasis> and <emphasis>ifdown</emphasis> + (initscripts). + </para></refsect1><refsect1><title>File Format</title><para> + The <emphasis>ifcfg-rh</emphasis> config format is a simple text file containing + VARIABLE="value" lines. The format is described in <filename>sysconfig.txt</filename> + of <emphasis>initscripts</emphasis> package. Note that the configuration files + may be sourced by <emphasis>initscripts</emphasis>, so they must be valid shell + scripts. That means, for instance, that <literal>#</literal> character can be used + for comments, strings with spaces must be quoted, special characters must be escaped, + etc. + </para><para> + Users can create or modify the <emphasis>ifcfg-rh</emphasis> connection files + manually, even if that is not the recommended way of managing the profiles. + However, if they choose to do that, they must inform NetworkManager about + their changes (see <emphasis>monitor-connection-file</emphasis> in + <citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum></citerefentry>, and <emphasis>nmcli con (re)load</emphasis>). + </para><formalpara><title>Some <emphasis>ifcfg-rh</emphasis> configuration examples:</title><para><programlisting><emphasis role="bold">Simple DHCP ethernet configuration:</emphasis> +NAME=ethernet +UUID=1c4ddf70-01bf-46d6-b04f-47e842bd98da +TYPE=Ethernet +BOOTPROTO=dhcp +DEFROUTE=yes +PEERDNS=yes +PEERROUTES=yes +IPV4_FAILURE_FATAL=no +ONBOOT=yes + </programlisting></para><para><programlisting><emphasis role="bold">Simple ethernet configuration with static IP:</emphasis> +TYPE=Ethernet +BOOTPROTO=none +IPADDR=10.1.0.25 +PREFIX=24 +GATEWAY=10.1.0.1 +DEFROUTE=yes +IPV4_FAILURE_FATAL=no +IPV6INIT=yes +IPV6_AUTOCONF=yes +IPV6_DEFROUTE=yes +IPV6_PEERDNS=yes +IPV6_PEERROUTES=yes +IPV6_FAILURE_FATAL=no +NAME=ethernet-em2 +UUID=51bb3904-c0fc-4dfe-83b2-0a71e7928c13 +DEVICE=em2 +ONBOOT=yes + </programlisting></para><para><programlisting><emphasis role="bold">WPA2 Enterprise WLAN (TTLS with inner MSCHAPV2 authentication):</emphasis> +ESSID="CompanyWLAN" +MODE=Managed +KEY_MGMT=WPA-EAP +TYPE=Wireless +IEEE_8021X_EAP_METHODS=TTLS +IEEE_8021X_IDENTITY=joe +IEEE_8021X_PASSWORD_FLAGS=ask +IEEE_8021X_INNER_AUTH_METHODS=MSCHAPV2 +IEEE_8021X_CA_CERT=/home/joe/.cert/company.crt +BOOTPROTO=dhcp +DEFROUTE=yes +PEERDNS=yes +PEERROUTES=yes +IPV4_FAILURE_FATAL=no +IPV6INIT=no +NAME=MyCompany +UUID=f79848ff-11a6-4810-9e1a-99039dea84c4 +ONBOOT=yes + </programlisting></para><para><programlisting><emphasis role="bold">Bridge and bridge port configuration:</emphasis> +ifcfg-bridge: ifcfg-bridge-port: +NAME=bridge NAME=bridge007-port-eth0 +UUID=4be99ce0-c5b2-4764-8b77-ec226e440125 UUID=3ad56c4a-47e1-419b-b0d4-8ad86eb967a3 +DEVICE=bridge007 DEVICE=eth0 +STP=yes ONBOOT=yes +TYPE=Bridge TYPE=Ethernet +BRIDGING_OPTS=priority=32768 BRIDGE=bridge007 +ONBOOT=yes +BOOTPROTO=dhcp + + </programlisting></para><para><programlisting><emphasis role="bold">Bonding configuration:</emphasis> +ifcfg-BOND: ifcfg-BOND-slave: +NAME=BOND NAME=BOND-slave +UUID=b41888aa-924c-450c-b0f8-85a4f0a51b4a UUID=9bb048e4-286a-4cc3-b104-007dbd20decb +DEVICE=bond100 DEVICE=eth0 +BONDING_OPTS="mode=balance-rr miimon=100" ONBOOT=yes +TYPE=Bond TYPE=Ethernet +BONDING_MASTER=yes MASTER=bond100 +ONBOOT=yes SLAVE=yes +BOOTPROTO=dhcp + + </programlisting></para><para><programlisting><emphasis role="bold">Team and team port configuration:</emphasis> +ifcfg-my_team0: +DEVICE=team0 +TEAM_CONFIG="{ \"device\": \"team0\", \"runner\": {\"name\": \"roundrobin\"}, \"ports\": {\"eth1\": {}, \"eth2\": {}} }" +DEVICETYPE=Team +BOOTPROTO=dhcp +NAME=team0-profile +UUID=1d3460a0-7b37-457f-a300-fe8d92da4807 +ONBOOT=yes + +ifcfg-my_team0_slave1: +NAME=team0-slave1 +UUID=d5aed298-c567-4cc1-b808-6d38ecef9e64 +DEVICE=eth1 +ONBOOT=yes +TEAM_MASTER=team0 +DEVICETYPE=TeamPort + +ifcfg-my_team0_slave2: +NAME=team0-slave2 +UUID=94e75f4e-e5ad-401c-8962-31e0ae5d2215 +DEVICE=eth2 +ONBOOT=yes +TEAM_MASTER=team0 +DEVICETYPE=TeamPort + </programlisting></para><para> + The UUID values in the config files must be unique. You can use <emphasis>uuidgen</emphasis> + command line tool to generate such values. Alternatively, you can leave out UUID + entirely. In that case NetworkManager will generate a UUID based on the file name. + </para></formalpara></refsect1><refsect1><title>Differences against initscripts</title><para> + The main differences of NetworkManager ifcfg-rh plugin and traditional + initscripts are: + <variablelist class="NM-initscripts-differences"><varlistentry><term><emphasis role="bold">NM_CONTROLLED=yes|no</emphasis></term><listitem><para> + NM_CONTROLLED is NetworkManager-specific variable used by NetworkManager + for determining whether the device of the <emphasis>ifcfg</emphasis> file + should be managed. NM_CONTROLLED=yes is supposed if the variable is not + present in the file. + Note that if you have more <emphasis>ifcfg</emphasis> files for a single + device, NM_CONTROLLED=no in one of the files will cause the device not + to be managed. The profile may not even be the active one. + </para></listitem></varlistentry><varlistentry><term><emphasis role="bold">New variables</emphasis></term><listitem><para> + NetworkManager has introduced some new variable, not present in initscripts, + to be able to store data for its new features. The variables are marked + as extensions in the tables bellows. + </para></listitem></varlistentry><varlistentry><term><emphasis role="bold">Semantic change of variables</emphasis></term><listitem><para> + NetworkManager had to slightly change the semantic for a few variables. + <itemizedlist><listitem><para><literal>PEERDNS</literal> - + initscripts interpret PEERDNS=no to mean "never touch resolv.conf". + NetworkManager interprets it to say "never add automatic (DHCP, PPP, VPN, etc.) + nameservers to resolv.conf".</para></listitem><listitem><para><literal>ONBOOT</literal> - + initscripts use ONBOOT=yes to mark the devices that are to be activated + during boot. NetworkManager extents this to also mean that this profile + can be used for auto-connecting at any time.</para></listitem></itemizedlist></para></listitem></varlistentry></variablelist></para><para> + See the next section for detailed mapping of NetworkManager properties and + <emphasis>ifcfg-rh</emphasis> variables. Variable names, format and usage + differences in NetworkManager and initscripts are documented in the tables bellow. + </para></refsect1><refsect1><title>DETAILS</title><para><emphasis>ifcfg-rh</emphasis> plugin variables marked with <emphasis>(+)</emphasis> + are NetworkManager specific extensions not understood by traditional initscripts. + </para><table><title>802-1x setting</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Ifcfg-rh Variable</entry><entry>Default</entry><entry>Description</entry></row></thead><tbody><row><entry align="left">eap</entry><entry align="left">IEEE_8021X_EAP_METHODS<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">EAP method for 802.1X authentication.<emphasis role="bold"> + +Example: </emphasis>IEEE_8021X_EAP_METHODS=PEAP<emphasis role="bold"> + +Allowed values: </emphasis>"LEAP", "PWD", "TLS", "PEAP", "TTLS", "FAST"</entry></row><row><entry align="left">identity</entry><entry align="left">IEEE_8021X_IDENTITY<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Identity for EAP authentication methods.<emphasis role="bold"> + +Example: </emphasis>IEEE_8021X_IDENTITY=itsme</entry></row><row><entry align="left">anonymous-identity</entry><entry align="left">IEEE_8021X_ANON_IDENTITY<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Anonymous identity for EAP authentication methods.</entry></row><row><entry align="left">pac-file</entry><entry align="left">IEEE_8021X_PAC_FILE<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">File with PAC (Protected Access Credential) for EAP-FAST.<emphasis role="bold"> + +Example: </emphasis>IEEE_8021X_PAC_FILE=/home/joe/my-fast.pac</entry></row><row><entry align="left">ca-cert</entry><entry align="left">IEEE_8021X_CA_CERT<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">CA certificate for EAP.<emphasis role="bold"> + +Example: </emphasis>IEEE_8021X_CA_CERT=/home/joe/cacert.crt</entry></row><row><entry align="left">ca-path</entry><entry align="left">(none)</entry><entry align="left"/><entry align="left">The property is not handled by ifcfg-rh plugin.</entry></row><row><entry align="left">subject-match</entry><entry align="left">IEEE_8021X_SUBJECT_MATCH<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Substring to match subject of server certificate against.<emphasis role="bold"> + +Example: </emphasis>IEEE_8021X_SUBJECT_MATCH="Red Hat"</entry></row><row><entry align="left">altubject-matches</entry><entry align="left">IEEE_8021X_AlTSUBJECT_MATCHES<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">List of strings to be matched against the altSubjectName.<emphasis role="bold"> + +Example: </emphasis>IEEE_8021X_ALTSUBJECT_MATCHES="s1.domain.cc"</entry></row><row><entry align="left">client-cert</entry><entry align="left">IEEE_8021X_CLIENT_CERT<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Client certificate for EAP.<emphasis role="bold"> + +Example: </emphasis>IEEE_8021X_CLIENT_CERT=/home/joe/mycert.crt</entry></row><row><entry align="left">phase1-peapver</entry><entry align="left">IEEE_8021X_PEAP_VERSION<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Use to force a specific PEAP version.<emphasis role="bold"> + +Allowed values: </emphasis>0, 1</entry></row><row><entry align="left">phase1-peaplabel</entry><entry align="left">IEEE_8021X_PEAP_FORCE_NEW_LABEL<emphasis>(+)</emphasis></entry><entry align="left">no</entry><entry align="left">Use to force the new PEAP label during key derivation.<emphasis role="bold"> + +Allowed values: </emphasis>yes, no</entry></row><row><entry align="left">phase1-fast-provisioning</entry><entry align="left">IEEE_8021X_FAST_PROVISIONING<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Enable in-line provisioning of EAP-FAST credentials.<emphasis role="bold"> + +Example: </emphasis>IEEE_8021X_FAST_PROVISIONING="allow-auth allow-unauth"<emphasis role="bold"> + +Allowed values: </emphasis>space-separated list of these values [allow-auth, allow-unauth]</entry></row><row><entry align="left">phase2-auth</entry><entry align="left">IEEE_8021X_INNER_AUTH_METHODS<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Inner non-EAP authentication methods. IEEE_8021X_INNER_AUTH_METHODS can contain values both for 'phase2-auth' and 'phase2-autheap' properties.<emphasis role="bold"> + +Example: </emphasis>IEEE_8021X_INNER_AUTH_METHODS=PAP<emphasis role="bold"> + +Allowed values: </emphasis>"PAP", "CHAP", "MSCHAP", "MSCHAPV2", "GTC", "OTP", "MD5" and "TLS"</entry></row><row><entry align="left">phase2-autheap</entry><entry align="left">IEEE_8021X_INNER_AUTH_METHODS<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Inner EAP-based authentication methods. Note that IEEE_8021X_INNER_AUTH_METHODS is also used for 'phase2-auth' values.<emphasis role="bold"> + +Example: </emphasis>IEEE_8021X_INNER_AUTH_METHODS="MSCHAPV2 EAP-TLS"<emphasis role="bold"> + +Allowed values: </emphasis>"EAP-MD5", "EAP-MSCHAPV2", "EAP-GTC", "EAP-OTP" and "EAP-TLS"</entry></row><row><entry align="left">phase2-subject-match</entry><entry align="left">IEEE_8021X_PHASE2_SUBJECT_MATCH<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Substring to match subject of server certificate against.<emphasis role="bold"> + +Example: </emphasis>IEEE_8021X_PHASE2_SUBJECT_MATCH="Red Hat"</entry></row><row><entry align="left">phase2-altsubject-matches</entry><entry align="left">IEEE_8021X_PHASE2_ALTSUBJECT_MATCHES<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left"/></row><row><entry align="left">phase2-client-cert</entry><entry align="left">IEEE_8021X_INNER_CLIENT_CERT<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Client certificate for inner EAP method.<emphasis role="bold"> + +Example: </emphasis>IEEE_8021X_INNER_CLIENT_CERT=/home/joe/mycert.crt</entry></row><row><entry align="left">password</entry><entry align="left">IEEE_8021X_PASSWORD<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">UTF-8 encoded password used for EAP. It can also go to "key-" lookaside file, or it can be owned by a secret agent.</entry></row><row><entry align="left">password-flags</entry><entry align="left">IEEE_8021X_PASSWORD_FLAGS<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Password flags for IEEE_8021X_PASSWORD password. (see <xref linkend="secrets-flags"/> for _FLAGS values)</entry></row><row><entry align="left">password-raw</entry><entry align="left">(none)</entry><entry align="left"/><entry align="left">The property is not handled by ifcfg-rh plugin.</entry></row><row><entry align="left">password-raw-flags</entry><entry align="left">(none)</entry><entry align="left"/><entry align="left">The property is not handled by ifcfg-rh plugin.</entry></row><row><entry align="left">private-key</entry><entry align="left">IEEE_8021X_PRIVATE_KEY<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Private key for EAP-TLS.<emphasis role="bold"> + +Example: </emphasis>IEEE_8021X_PRIVATE_KEY=/home/joe/mykey.p12</entry></row><row><entry align="left">private-key-password</entry><entry align="left">IEEE_8021X_PRIVATE_KEY_PASSWORD<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Password for IEEE_8021X_PRIVATE_KEY. It can also go to "key-" lookaside file, or it can be owned by a secret agent.</entry></row><row><entry align="left">private-key-password-flags</entry><entry align="left">IEEE_8021X_PRIVATE_KEY_PASSWORD_FLAGS<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Password flags for IEEE_8021X_PRIVATE_KEY_PASSWORD password. (see <xref linkend="secrets-flags"/> for _FLAGS values)</entry></row><row><entry align="left">phase2-private-key</entry><entry align="left">IEEE_8021X_INNER_PRIVATE_KEY<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Private key for inner authentication method for EAP-TLS.</entry></row><row><entry align="left">phase2-private-key-password</entry><entry align="left">IEEE_8021X_INNER_PRIVATE_KEY_PASSWORD<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Password for IEEE_8021X_INNER_PRIVATE_KEY. It can also go to "key-" lookaside file, or it can be owned by a secret agent.</entry></row><row><entry align="left">phase2-private-key-password-flags</entry><entry align="left">IEEE_8021X_INNER_PRIVATE_KEY_PASSWORD_FLAGS<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Password flags for IEEE_8021X_INNER_PRIVATE_KEY_PASSWORD password. (see <xref linkend="secrets-flags"/> for _FLAGS values)</entry></row><row><entry align="left">pin</entry><entry align="left">(none)</entry><entry align="left"/><entry align="left">The property is not handled by ifcfg-rh plugin.</entry></row><row><entry align="left">pin-flags</entry><entry align="left">(none)</entry><entry align="left"/><entry align="left">The property is not handled by ifcfg-rh plugin.</entry></row><row><entry align="left">system-ca-certs</entry><entry align="left">(none)</entry><entry align="left"/><entry align="left">The property is not handled by ifcfg-rh plugin.</entry></row></tbody></tgroup></table><table><title>bond setting</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Ifcfg-rh Variable</entry><entry>Default</entry><entry>Description</entry></row></thead><tbody><row><entry align="left">options</entry><entry align="left">BONDING_OPTS</entry><entry align="left"/><entry align="left">Bonding options.<emphasis role="bold"> + +Example: </emphasis>BONDING_OPTS="miimon=100 mode=broadcast"</entry></row></tbody></tgroup></table><table><title>bridge-port setting</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Ifcfg-rh Variable</entry><entry>Default</entry><entry>Description</entry></row></thead><tbody><row><entry align="left">priority</entry><entry align="left">BRIDGING_OPTS: priority=</entry><entry align="left">32</entry><entry align="left">STP priority.<emphasis role="bold"> + +Allowed values: </emphasis>0 - 63</entry></row><row><entry align="left">path-cost</entry><entry align="left">BRIDGING_OPTS: path_cost=</entry><entry align="left">100</entry><entry align="left">STP cost.<emphasis role="bold"> + +Allowed values: </emphasis>1 - 65535</entry></row><row><entry align="left">hairpin-mode</entry><entry align="left">BRIDGING_OPTS: hairpin_mode=</entry><entry align="left">yes</entry><entry align="left">Hairpin mode of the bridge port.</entry></row></tbody></tgroup></table><table><title>bridge setting</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Ifcfg-rh Variable</entry><entry>Default</entry><entry>Description</entry></row></thead><tbody><row><entry align="left">mac-address</entry><entry align="left">MACADDR<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">MAC address of the bridge. Note that this requires a recent kernel support, originally introduced in 3.15 upstream kernel) MACADDR for bridges is an NM extension.</entry></row><row><entry align="left">stp</entry><entry align="left">STP</entry><entry align="left">no</entry><entry align="left">Span tree protocol participation.</entry></row><row><entry align="left">priority</entry><entry align="left">BRIDGING_OPTS: priority=</entry><entry align="left">32768</entry><entry align="left">STP priority.<emphasis role="bold"> + +Allowed values: </emphasis>0 - 32768</entry></row><row><entry align="left">forward-delay</entry><entry align="left">DELAY</entry><entry align="left">15</entry><entry align="left">STP forwarding delay.<emphasis role="bold"> + +Allowed values: </emphasis>2 - 30</entry></row><row><entry align="left">hello-time</entry><entry align="left">BRIDGING_OPTS: hello_time=</entry><entry align="left">2</entry><entry align="left">STP hello time.<emphasis role="bold"> + +Allowed values: </emphasis>1 - 10</entry></row><row><entry align="left">max-age</entry><entry align="left">BRIDGING_OPTS: max_age=</entry><entry align="left">20</entry><entry align="left">STP maximum message age.<emphasis role="bold"> + +Allowed values: </emphasis>6 - 40</entry></row><row><entry align="left">ageing-time</entry><entry align="left">BRIDGING_OPTS: ageing_time=</entry><entry align="left">300</entry><entry align="left">Ethernet MAC ageing time.<emphasis role="bold"> + +Allowed values: </emphasis>0 - 1000000</entry></row></tbody></tgroup></table><table><title>connection setting</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Ifcfg-rh Variable</entry><entry>Default</entry><entry>Description</entry></row></thead><tbody><row><entry align="left">id</entry><entry align="left">NAME<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">User friendly name for the connection profile.</entry></row><row><entry align="left">uuid</entry><entry align="left">UUID<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">UUID for the connection profile. When missing, NetworkManager creates the UUID itself (by hashing the file).</entry></row><row><entry align="left">interface-name</entry><entry align="left">DEVICE</entry><entry align="left"/><entry align="left">Interface name of the device this profile is bound to. The variable can be left out when the profile should apply for more devices. Note that DEVICE can be required for some connection types.</entry></row><row><entry align="left">type</entry><entry align="left">TYPE (DEVICETYPE, DEVICE)</entry><entry align="left"/><entry align="left">Base type of the connection. DEVICETYPE is used for teaming connections.<emphasis role="bold"> + +Example: </emphasis>TYPE=Ethernet; TYPE=Bond; TYPE=Bridge; DEVICETYPE=TeamPort<emphasis role="bold"> + +Allowed values: </emphasis>Ethernet, Wireless, InfiniBand, Bridge, Bond, Vlan, Team, TeamPort</entry></row><row><entry align="left">permissions</entry><entry align="left">USERS<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">USERS restrict the access for this conenction to certain users only.<emphasis role="bold"> + +Example: </emphasis>USERS="joe bob"</entry></row><row><entry align="left">autoconnect</entry><entry align="left">ONBOOT</entry><entry align="left">yes</entry><entry align="left">Whether the connection should be autoconnected (not only while booting).</entry></row><row><entry align="left">autoconnect-priority</entry><entry align="left">AUTOCONNECT_PRIORITY<emphasis>(+)</emphasis></entry><entry align="left">0</entry><entry align="left">Connection priority for automatic activation. Connections with higher numbers are preferred when selecting profiles for automatic activation.<emphasis role="bold"> + +Example: </emphasis>AUTOCONNECT_PRIORITY=20<emphasis role="bold"> + +Allowed values: </emphasis>-999 to 999</entry></row><row><entry align="left">zone</entry><entry align="left">ZONE<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Trust level of this connection. The string is usually used for a firewall.<emphasis role="bold"> + +Example: </emphasis>ZONE=Work</entry></row><row><entry align="left">master</entry><entry align="left">MASTER, TEAM_MASTER, BRIDGE</entry><entry align="left"/><entry align="left">Reference to master connection. The variable used depends on the connection type.</entry></row><row><entry align="left">slave-type</entry><entry align="left">MASTER, TEAM_MASTER, DEVICETYPE, BRIDGE</entry><entry align="left"/><entry align="left">Slave type doesn't map directly to a variable, but it is recognized using different variables. MASTER for bonding, TEAM_MASTER and DEVICETYPE for teaming, BRIDGE for bridging.</entry></row><row><entry align="left">secondaries</entry><entry align="left">SECONDARY_UUIDS<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">UUID of VPN connections that should be activated together with this connection.</entry></row><row><entry align="left">gateway-ping-timeout</entry><entry align="left">GATEWAY_PING_TIMEOUT<emphasis>(+)</emphasis></entry><entry align="left">0</entry><entry align="left">If greater than zero, the IP connectivity will be checked by pinging the gateway and waiting for the specified timeout (in seconds).<emphasis role="bold"> + +Example: </emphasis>GATEWAY_PING_TIMEOUT=5</entry></row></tbody></tgroup></table><table><title>dcb setting</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Ifcfg-rh Variable</entry><entry>Default</entry><entry>Description</entry></row></thead><tbody><row><entry align="left">app-fcoe-flags</entry><entry align="left">DCB_APP_FCOE_ENABLE, DCB_APP_FCOE_ADVERTISE, DCB_APP_FCOE_WILLING</entry><entry align="left">no</entry><entry align="left">FCOE flags.<emphasis role="bold"> + +Example: </emphasis>DCB_APP_FCOE_ENABLE=yes DCB_APP_FCOE_ADVERTISE=yes</entry></row><row><entry align="left">app-fcoe-priority</entry><entry align="left">DCB_APP_FCOE_PRIORITY</entry><entry align="left"/><entry align="left">Priority of FCoE frames.<emphasis role="bold"> + +Allowed values: </emphasis>0 - 7</entry></row><row><entry align="left">app-fcoe-mode</entry><entry align="left">DCB_APP_FCOE_MODE</entry><entry align="left">fabric</entry><entry align="left">FCoE controller mode.<emphasis role="bold"> + +Allowed values: </emphasis>fabric, vn2vn</entry></row><row><entry align="left">app-iscsi-flags</entry><entry align="left">DCB_APP_ISCSI_ENABLE, DCB_APP_ISCSI_ADVERTISE, DCB_APP_ISCSI_WILLING</entry><entry align="left">no</entry><entry align="left">iSCSI flags.</entry></row><row><entry align="left">app-iscsi-priority</entry><entry align="left">DCB_APP_ISCSI_PRIORITY</entry><entry align="left"/><entry align="left">Priority of iSCSI frames.<emphasis role="bold"> + +Allowed values: </emphasis>0 - 7</entry></row><row><entry align="left">app-fip-flags</entry><entry align="left">DCB_APP_FIP_ENABLE, DCB_APP_FIP_ADVERTISE, DCB_APP_FIP_WILLING</entry><entry align="left">no</entry><entry align="left">FIP flags.</entry></row><row><entry align="left">app-fip-priority</entry><entry align="left">DCB_APP_FIP_PRIORITY</entry><entry align="left"/><entry align="left">Priority of FIP frames.<emphasis role="bold"> + +Allowed values: </emphasis>0 - 7</entry></row><row><entry align="left">priority-flow-control-flags</entry><entry align="left">DCB_PFC_ENABLE, DCB_PFC_ADVERTISE, DCB_PFC_WILLING</entry><entry align="left">no</entry><entry align="left">Priority flow control flags.</entry></row><row><entry align="left">priority-flow-control</entry><entry align="left">DCB_PFC_UP</entry><entry align="left"/><entry align="left">Priority flow control values. String of 8 "0" and "1", where "0". means "do not transmit priority pause", "1" means "transmit pause".<emphasis role="bold"> + +Example: </emphasis>DCB_PFC_UP=01101110</entry></row><row><entry align="left">priority-group-flags</entry><entry align="left">DCB_PG_ENABLE, DCB_PG_ADVERTISE, DCB_PG_WILLING</entry><entry align="left">no</entry><entry align="left">Priority groups flags.</entry></row><row><entry align="left">priority-group-id</entry><entry align="left">DCB_PG_ID</entry><entry align="left"/><entry align="left">Priority groups values. String of eight priorities (0 - 7) or "f" (unrestricted).<emphasis role="bold"> + +Example: </emphasis>DCB_PG_ID=1205f173</entry></row><row><entry align="left">priority-group-bandwidth</entry><entry align="left">DCB_PG_PCT</entry><entry align="left"/><entry align="left">Priority groups values. Eight bandwidths (in percent), separated with commas.<emphasis role="bold"> + +Example: </emphasis>DCB_PG_PCT=10,5,10,15,10,10,10,30</entry></row><row><entry align="left">priority-bandwidth</entry><entry align="left">DCB_PG_UPPCT</entry><entry align="left"/><entry align="left">Priority values. Eight bandwidths (in percent), separated with commas. The sum of the numbers must be 100.<emphasis role="bold"> + +Example: </emphasis>DCB_PG_UPPCT=7,13,10,10,15,15,10,20</entry></row><row><entry align="left">priority-strict-bandwidth</entry><entry align="left">DCB_PG_STRICT</entry><entry align="left"/><entry align="left">Priority values. String of eight "0" or "1", where "0" means "may not utilize all bandwidth", "1" means "may utilize all bandwidth".<emphasis role="bold"> + +Example: </emphasis>DCB_PG_STRICT=01101110</entry></row><row><entry align="left">priority-traffic-class</entry><entry align="left">DCB_PG_UP2TC</entry><entry align="left"/><entry align="left">Priority values. String of eight trafic class values (0 - 7).<emphasis role="bold"> + +Example: </emphasis>DCB_PG_UP2TC=01623701</entry></row></tbody></tgroup></table><para> + All DCB related configuration is a NetworkManager extention. DCB=yes must be + used explicitly to enable DCB so that the rest of the DCB_* variables can apply. + </para><table><title>infiniband setting</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Ifcfg-rh Variable</entry><entry>Default</entry><entry>Description</entry></row></thead><tbody><row><entry align="left">mac-address</entry><entry align="left">HWADDR</entry><entry align="left"/><entry align="left">IBoIP 20-byte hardware address of the device (in traditional hex-digits-and-colons notation).<emphasis role="bold"> + +Example: </emphasis>HWADDR=01:02:03:04:05:06:07:08:09:0A:01:02:03:04:05:06:07:08:09:11</entry></row><row><entry align="left">mtu</entry><entry align="left">MTU</entry><entry align="left"/><entry align="left">MTU of the interface.</entry></row><row><entry align="left">transport-mode</entry><entry align="left">CONNECTED_MODE</entry><entry align="left">CONNECTED_MODE=no</entry><entry align="left">CONNECTED_MODE=yes for "connected" mode, CONNECTED_MODE=no for "datagram" mode</entry></row><row><entry align="left">p-key</entry><entry align="left">PKEY_ID (and PKEY=yes)</entry><entry align="left">PKEY=no</entry><entry align="left">InfiniBand P_Key. The value can be a hex number prefixed with "0x" or a decimal number. When PKEY_ID is specified, PHYSDEV and DEVICE also must be specified.<emphasis role="bold"> + +Example: </emphasis>PKEY=yes PKEY_ID=2 PHYSDEV=mlx4_ib0 DEVICE=mlx4_ib0.8002</entry></row><row><entry align="left">parent</entry><entry align="left">PHYSDEV (PKEY=yes)</entry><entry align="left">PKEY=no</entry><entry align="left">InfiniBand parent device.<emphasis role="bold"> + +Example: </emphasis>PHYSDEV=ib0</entry></row></tbody></tgroup></table><table><title>ipv4 setting</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Ifcfg-rh Variable</entry><entry>Default</entry><entry>Description</entry></row></thead><tbody><row><entry align="left">method</entry><entry align="left">BOOTPROTO</entry><entry align="left">none</entry><entry align="left">Method used for IPv4 protocol configuration.<emphasis role="bold"> + +Allowed values: </emphasis>none, dhcp (bootp), static, ibft, autoip, shared</entry></row><row><entry align="left">dns</entry><entry align="left">DNS1, DNS2, ...</entry><entry align="left"/><entry align="left">List of DNS servers. Even if NetworkManager supports many DNS servers, initscripts and resolver only care about the first three, usually.<emphasis role="bold"> + +Example: </emphasis>DNS1=1.2.3.4 DNS2=10.0.0.254 DNS3=8.8.8.8</entry></row><row><entry align="left">dns-search</entry><entry align="left">DOMAIN</entry><entry align="left"/><entry align="left">List of DNS search domains.</entry></row><row><entry align="left">addresses</entry><entry align="left">IPADDR, PREFIX, IPADDR1, PREFIX1, ...</entry><entry align="left"/><entry align="left">List of static IP addresses.<emphasis role="bold"> + +Example: </emphasis>IPADDR=10.5.5.23 PREFIX=24 IPADDR1=1.1.1.2 PREFIX1=16</entry></row><row><entry align="left">gateway</entry><entry align="left">GATEWAY</entry><entry align="left"/><entry align="left">Gateway IP address.<emphasis role="bold"> + +Example: </emphasis>GATEWAY=10.5.5.1</entry></row><row><entry align="left">routes</entry><entry align="left">ADDRESS1, NETMASK1, GATEWAY1, METRIC1, ...</entry><entry align="left"/><entry align="left">List of static routes. They are not stored in ifcfg-* file, but in route-* file instead.</entry></row><row><entry align="left">ignore-auto-routes</entry><entry align="left">PEERROUTES<emphasis>(+)</emphasis></entry><entry align="left">yes</entry><entry align="left">PEERROUTES has the opposite meaning as 'ignore-auto-routes' property.</entry></row><row><entry align="left">ignore-auto-dns</entry><entry align="left">PEERDNS</entry><entry align="left">yes</entry><entry align="left">PEERDNS has the opposite meaning as 'ignore-auto-dns' property.</entry></row><row><entry align="left">dhcp-send-hostname</entry><entry align="left">DHCP_SEND_HOSTNAME<emphasis>(+)</emphasis></entry><entry align="left">yes</entry><entry align="left">Whether DHCP_HOSTNAME should be sent to the DHCP server.</entry></row><row><entry align="left">dhcp-hostname</entry><entry align="left">DHCP_HOSTNAME</entry><entry align="left"/><entry align="left">Hostname to send to the DHCP server.</entry></row><row><entry align="left">never-default</entry><entry align="left">DEFROUTE (GATEWAYDEV in /etc/sysconfig/network)</entry><entry align="left">yes</entry><entry align="left">DEFROUTE=no tells NetworkManager that this connection should not be assigned the default route. DEFROUTE has the opposite meaning as 'never-default' property.</entry></row><row><entry align="left">may-fail</entry><entry align="left">IPV4_FAILURE_FATAL<emphasis>(+)</emphasis></entry><entry align="left">no</entry><entry align="left">IPV4_FAILURE_FATAL has the opposite meaning as 'may-fail' property.</entry></row><row><entry align="left">dhcp-client-id</entry><entry align="left">DHCP_CLIENT_ID<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">A string sent to the DHCP server to identify the local machine.<emphasis role="bold"> + +Example: </emphasis>DHCP_CLIENT_ID=ax-srv-1</entry></row></tbody></tgroup></table><table><title>ipv6 setting</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Ifcfg-rh Variable</entry><entry>Default</entry><entry>Description</entry></row></thead><tbody><row><entry align="left">method</entry><entry align="left">IPV6INIT, IPV6FORWARDING, IPV6_AUTOCONF, DHCPV6C</entry><entry align="left">IPV6INIT=yes; IPV6FORWARDING=no; IPV6_AUTOCONF=!IPV6FORWARDING, DHCPV6=no</entry><entry align="left">Method used for IPv6 protocol configuration. ignore ~ IPV6INIT=no; auto ~ IPV6_AUTOCONF=yes; dhcp ~ IPV6_AUTOCONF=no and DHCPV6C=yes</entry></row><row><entry align="left">dns</entry><entry align="left">DNS1, DNS2, ...</entry><entry align="left"/><entry align="left">List of DNS servers. NetworkManager uses the variables both for IPv4 and IPv6.</entry></row><row><entry align="left">dns-search</entry><entry align="left">DOMAIN</entry><entry align="left"/><entry align="left">List of DNS search domains.</entry></row><row><entry align="left">addresses</entry><entry align="left">IPV6ADDR, IPV6ADDR_SECONDARIES</entry><entry align="left"/><entry align="left">List of static IP addresses.<emphasis role="bold"> + +Example: </emphasis>IPV6ADDR=ab12:9876::1 IPV6ADDR_SECONDARIES="ab12:9876::2 ab12:9876::3"</entry></row><row><entry align="left">gateway</entry><entry align="left">IPV6_DEFAULTGW</entry><entry align="left"/><entry align="left">Gateway IP address.<emphasis role="bold"> + +Example: </emphasis>IPV6_DEFAULTGW=abbe::1</entry></row><row><entry align="left">routes</entry><entry align="left">(none)</entry><entry align="left"/><entry align="left">List of static routes. They are not stored in ifcfg-* file, but in route6-* file instead in the form of command line for 'ip route add'.</entry></row><row><entry align="left">ignore-auto-routes</entry><entry align="left">IPV6_PEERROUTES<emphasis>(+)</emphasis></entry><entry align="left">yes</entry><entry align="left">IPV6_PEERROUTES has the opposite meaning as 'ignore-auto-routes' property.</entry></row><row><entry align="left">ignore-auto-dns</entry><entry align="left">IPV6_PEERDNS<emphasis>(+)</emphasis></entry><entry align="left">yes</entry><entry align="left">IPV6_PEERDNS has the opposite meaning as 'ignore-auto-dns' property.</entry></row><row><entry align="left">dhcp-hostname</entry><entry align="left">DHCP_HOSTNAME</entry><entry align="left"/><entry align="left">Hostname to send the DHCP server.</entry></row><row><entry align="left">never-default</entry><entry align="left">IPV6_DEFROUTE<emphasis>(+)</emphasis>, (and IPV6_DEFAULTGW, IPV6_DEFAULTDEV in /etc/sysconfig/network)</entry><entry align="left">IPV6_DEFROUTE=yes (when no variable specified)</entry><entry align="left">IPV6_DEFROUTE=no tells NetworkManager that this connection should not be assigned the default IPv6 route. IPV6_DEFROUTE has the opposite meaning as 'never-default' property.</entry></row><row><entry align="left">may-fail</entry><entry align="left">IPV6_FAILURE_FATAL<emphasis>(+)</emphasis></entry><entry align="left">no</entry><entry align="left">IPV6_FAILURE_FATAL has the opposite meaning as 'may-fail' property.</entry></row><row><entry align="left">ip6-privacy</entry><entry align="left">IPV6_PRIVACY, IPV6_PRIVACY_PREFER_PUBLIC_IP<emphasis>(+)</emphasis></entry><entry align="left">no</entry><entry align="left">Configure IPv6 Privacy Extensions for SLAAC (RFC4941).<emphasis role="bold"> + +Example: </emphasis>IPV6_PRIVACY=rfc3041 IPV6_PRIVACY_PREFER_PUBLIC_IP=yes<emphasis role="bold"> + +Allowed values: </emphasis>IPV6_PRIVACY: no, yes (rfc3041 or rfc4941); IPV6_PRIVACY_PREFER_PUBLIC_IP: yes, no</entry></row></tbody></tgroup></table><table><title>team-port setting</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Ifcfg-rh Variable</entry><entry>Default</entry><entry>Description</entry></row></thead><tbody><row><entry align="left">config</entry><entry align="left">TEAM_PORT_CONFIG</entry><entry align="left"/><entry align="left">Team port configuration in JSON. See man teamd.conf for details.</entry></row></tbody></tgroup></table><table><title>team setting</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Ifcfg-rh Variable</entry><entry>Default</entry><entry>Description</entry></row></thead><tbody><row><entry align="left">config</entry><entry align="left">TEAM_CONFIG</entry><entry align="left"/><entry align="left">Team configuration in JSON. See man teamd.conf for details.</entry></row></tbody></tgroup></table><table><title>vlan setting</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Ifcfg-rh Variable</entry><entry>Default</entry><entry>Description</entry></row></thead><tbody><row><entry align="left">parent</entry><entry align="left">DEVICE or PHYSDEV</entry><entry align="left"/><entry align="left">Parent interface of the VLAN.</entry></row><row><entry align="left">id</entry><entry align="left">VLAN_ID or DEVICE</entry><entry align="left"/><entry align="left">VLAN identifier.</entry></row><row><entry align="left">flags</entry><entry align="left">VLAN_FLAGS, REORDER_HDR</entry><entry align="left"/><entry align="left">Parent interface of the VLAN.<emphasis role="bold"> + +Allowed values: </emphasis>"GVRP", "LOOSE_BINDING" for VLAN_FLAGS; 0 or 1 for REORDER_HDR</entry></row><row><entry align="left">ingress-property-map</entry><entry align="left">VLAN_INGRESS_PRIORITY_MAP</entry><entry align="left"/><entry align="left">Ingress priority mapping.<emphasis role="bold"> + +Example: </emphasis>VLAN_INGRESS_PRIORITY_MAP=4:2,3:5</entry></row><row><entry align="left">egress-property-map</entry><entry align="left">VLAN_EGRESS_PRIORITY_MAP</entry><entry align="left"/><entry align="left">Egress priority mapping.<emphasis role="bold"> + +Example: </emphasis>VLAN_EGRESS_PRIORITY_MAP=5:4,4:1,3:7</entry></row><row><entry align="left">interface-name</entry><entry align="left">PHYSDEV and VLAN_ID, or DEVICE</entry><entry align="left"/><entry align="left">VLAN interface name. If all variables are set, parent device from PHYSDEV takes precedence over DEVICE, but VLAN id from DEVICE takes precedence over VLAN_ID.<emphasis role="bold"> + +Example: </emphasis>PHYSDEV=eth0, VLAN_ID=12; or DEVICE=eth0.12</entry></row></tbody></tgroup></table><table><title>802-3-ethernet setting</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Ifcfg-rh Variable</entry><entry>Default</entry><entry>Description</entry></row></thead><tbody><row><entry align="left">port</entry><entry align="left">(none)</entry><entry align="left"/><entry align="left">The property is not saved by the plugin.</entry></row><row><entry align="left">speed</entry><entry align="left">(none)</entry><entry align="left"/><entry align="left">The property is not saved by the plugin.</entry></row><row><entry align="left">duplex</entry><entry align="left">(none)</entry><entry align="left"/><entry align="left">The property is not saved by the plugin.</entry></row><row><entry align="left">auto-negotiate</entry><entry align="left">(none)</entry><entry align="left"/><entry align="left">The property is not saved by the plugin.</entry></row><row><entry align="left">mac-address</entry><entry align="left">HWADDR</entry><entry align="left"/><entry align="left">Hardware address of the device in traditional hex-digits-and-colons notation (e.g. 00:22:68:14:5A:05).</entry></row><row><entry align="left">cloned-mac-address</entry><entry align="left">MACADDR</entry><entry align="left"/><entry align="left">Cloned (spoofed) MAC address in traditional hex-digits-and-colons notation (e.g. 00:22:68:14:5A:99).</entry></row><row><entry align="left">mac-address-blacklist</entry><entry align="left">HWADDR_BLACKLIST<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">It denies usage of the connection for any device whose address is listed.<emphasis role="bold"> + +Example: </emphasis>HWADDR_BLACKLIST="00:22:68:11:69:08 00:11:22:11:44:55"</entry></row><row><entry align="left">mtu</entry><entry align="left">MTU</entry><entry align="left"/><entry align="left">MTU of the interface.</entry></row><row><entry align="left">s390-subchannels</entry><entry align="left">SUBCHANNELS</entry><entry align="left"/><entry align="left">Subchannels for IBM S390 hosts.<emphasis role="bold"> + +Example: </emphasis>SUBCHANNELS=0.0.b00a,0.0.b00b,0.0.b00c</entry></row><row><entry align="left">s390-nettype</entry><entry align="left">NETTYPE</entry><entry align="left"/><entry align="left">Network type of the S390 host.<emphasis role="bold"> + +Example: </emphasis>NETTYPE=qeth<emphasis role="bold"> + +Allowed values: </emphasis>"qeth", "lcs" or "ctc"</entry></row><row><entry align="left">s390-options</entry><entry align="left">OPTIONS and PORTNAME, CTCPROTO,</entry><entry align="left"/><entry align="left">S390 device options. All options go to OPTIONS, except for "portname" and "ctcprot" that have their own variables.</entry></row></tbody></tgroup></table><table><title>802-11-wireless-security setting</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Ifcfg-rh Variable</entry><entry>Default</entry><entry>Description</entry></row></thead><tbody><row><entry align="left">key-mgmt</entry><entry align="left">KEY_MGMT<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Key management menthod.<emphasis role="bold"> + +Allowed values: </emphasis>IEEE8021X, WPA-PSK, WPA-EAP</entry></row><row><entry align="left">wep-tx-keyidx</entry><entry align="left">DEFAULTKEY</entry><entry align="left">1</entry><entry align="left">Index of active WEP key.<emphasis role="bold"> + +Allowed values: </emphasis>1, 2, 3, 4</entry></row><row><entry align="left">auth-alg</entry><entry align="left">SECURITYMODE<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Authentication algorithm for WEP.<emphasis role="bold"> + +Allowed values: </emphasis>restricted, open, leap</entry></row><row><entry align="left">proto</entry><entry align="left">WPA_ALLOW_WPA<emphasis>(+)</emphasis>, WPA_ALLOW_WPA2<emphasis>(+)</emphasis></entry><entry align="left">no</entry><entry align="left">Allowed WPA protocols, WPA and WPA2 (RSN).<emphasis role="bold"> + +Allowed values: </emphasis>yes, no</entry></row><row><entry align="left">pairwise</entry><entry align="left">CIPHER_PAIRWISE<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Restrict pairwise encryption algorithms, specified as a space separated list.<emphasis role="bold"> + +Allowed values: </emphasis>CCMP, TKIP</entry></row><row><entry align="left">group</entry><entry align="left">CIPHER_GROUP<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Restrict group/broadcast encryption algorithms, specified as a space separated list.<emphasis role="bold"> + +Allowed values: </emphasis>CCMP, TKIP, WEP40, WEP104</entry></row><row><entry align="left">leap-username</entry><entry align="left">IEEE_8021X_IDENTITY<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Login name for LEAP.</entry></row><row><entry align="left">wep-key0</entry><entry align="left">KEY1, KEY_PASSPHRASE1<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">The first WEP key (used in most networks). See also DEFAULTKEY for key index.</entry></row><row><entry align="left">wep-key1</entry><entry align="left">KEY2, KEY_PASSPHRASE2<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">WEP key with index 1. See also DEFAULTKEY for key index.</entry></row><row><entry align="left">wep-key2</entry><entry align="left">KEY3, KEY_PASSPHRASE3<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">WEP key with index 2. See also DEFAULTKEY for key index.</entry></row><row><entry align="left">wep-key3</entry><entry align="left">KEY4, KEY_PASSPHRASE4<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">WEP key with index 3. See also DEFAULTKEY for key index.</entry></row><row><entry align="left">wep-key-flags</entry><entry align="left">WEP_KEY_FLAGS<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Password flags for KEY<i>, KEY_PASSPHRASE<i> password. (see <xref linkend="secrets-flags"/> for _FLAGS values)</entry></row><row><entry align="left">psk</entry><entry align="left">WPA_PSK</entry><entry align="left"/><entry align="left">Pre-Shared-Key for WPA networks.</entry></row><row><entry align="left">psk-flags</entry><entry align="left">WPA_PSK_FLAGS<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Password flags for WPA_PSK_FLAGS. (see <xref linkend="secrets-flags"/> for _FLAGS values)<emphasis role="bold"> + +Example: </emphasis>WPA_PSK_FLAGS=user</entry></row><row><entry align="left">leap-password</entry><entry align="left">IEEE_8021X_PASSWORD<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Password for LEAP. It can also go to "key-" lookaside file, or it can be owned by a secret agent.</entry></row><row><entry align="left">leap-password-flags</entry><entry align="left">IEEE_8021X_PASSWORD_FLAGS<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Password flags for IEEE_8021X_PASSWORD_FLAGS. (see <xref linkend="secrets-flags"/> for _FLAGS values)</entry></row><row><entry align="left">wep-key-type</entry><entry align="left">KEY<i> or KEY_PASSPHRASE<i><emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">KEY is used for "key" type (10 or 26 hexadecimal characters, or 5 or 13 character string prefixed with "s:"). KEY_PASSPHRASE is used for WEP passphrases.<emphasis role="bold"> + +Example: </emphasis>KEY1=s:ahoj, KEY1=0a1c45bc02, KEY_PASSPHRASE1=mysupersecretkey</entry></row></tbody></tgroup></table><table><title>802-11-wireless setting</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Ifcfg-rh Variable</entry><entry>Default</entry><entry>Description</entry></row></thead><tbody><row><entry align="left">ssid</entry><entry align="left">ESSID</entry><entry align="left"/><entry align="left">SSID of Wi-Fi network.<emphasis role="bold"> + +Example: </emphasis>ESSID="Quick Net"</entry></row><row><entry align="left">mode</entry><entry align="left">MODE</entry><entry align="left"/><entry align="left">Wi-Fi network mode.<emphasis role="bold"> + +Allowed values: </emphasis>Ad-Hoc, Managed (Auto) [case insensitive]</entry></row><row><entry align="left">band</entry><entry align="left">BAND<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">BAND alone is honored, but CHANNEL overrides BAND since it implies a band.<emphasis role="bold"> + +Example: </emphasis>BAND=bg<emphasis role="bold"> + +Allowed values: </emphasis>a, bg</entry></row><row><entry align="left">channel</entry><entry align="left">CHANNEL</entry><entry align="left"/><entry align="left">Channel used for the Wi-Fi communication. Channels greater than 14 mean "a" band, otherwise the band is "bg".<emphasis role="bold"> + +Example: </emphasis>CHANNEL=6</entry></row><row><entry align="left">bssid</entry><entry align="left">BSSID<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Restricts association only to a single AP.<emphasis role="bold"> + +Example: </emphasis>BSSID=00:1E:BD:64:83:21</entry></row><row><entry align="left">rate</entry><entry align="left">(none)</entry><entry align="left"/><entry align="left">This property is not handled by ifcfg-rh plugin.</entry></row><row><entry align="left">tx-power</entry><entry align="left">(none)</entry><entry align="left"/><entry align="left">This property is not handled by ifcfg-rh plugin.</entry></row><row><entry align="left">mac-address</entry><entry align="left">HWADDR</entry><entry align="left"/><entry align="left">Hardware address of the device in traditional hex-digits-and-colons notation (e.g. 00:22:68:14:5A:05).</entry></row><row><entry align="left">cloned-mac-address</entry><entry align="left">MACADDR</entry><entry align="left"/><entry align="left">Cloned (spoofed) MAC address in traditional hex-digits-and-colons notation (e.g. 00:22:68:14:5A:99).</entry></row><row><entry align="left">mac-address-blacklist</entry><entry align="left">HWADDR_BLACKLIST<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">It denies usage of the connection for any device whose address is listed.</entry></row><row><entry align="left">seen-bssids</entry><entry align="left">(none)</entry><entry align="left"/><entry align="left">This property is not handled by ifcfg-rh plugin.</entry></row><row><entry align="left">mtu</entry><entry align="left">MTU</entry><entry align="left"/><entry align="left">MTU of the wireless interface.</entry></row><row><entry align="left">hidden</entry><entry align="left">SSID_HIDDEN<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Whether the network hides the SSID.</entry></row><row><entry align="left">security</entry><entry align="left">(none)</entry><entry align="left"/><entry align="left">This property is deprecated and not handled by ifcfg-rh-plugin.</entry></row></tbody></tgroup></table><para>The following settings are not supported by <emphasis>ifcfg-rh</emphasis> plugin:</para><para>adsl, bluetooth, ppp, pppoe, serial, generic, gsm, cdma, 802-11-olpc-mesh, wimax, vpn</para><refsect2 id="secrets-flags"><title>Secret flags</title><para> + Each secret property in a NetworkManager setting has an associated + <emphasis>flags</emphasis> property that describes how to handle that secret. + In the <emphasis>fcfg-rh</emphasis> plugin variables for secret flags have a + <emphasis>_FLAGS</emphasis> suffix. The variables contain one or more of the + folowing values (space separated). Missing (or empty) *_FLAGS variable means + that the password is owned by NetworkManager. + </para><itemizedlist><listitem><para><literal>user</literal> - a user-session secret agent is responsible for providing + and storing this secret; when it is required, agents will be asked to provide it.</para></listitem><listitem><para><literal>ask</literal> - the associated password is not saved but it will be + requested from the user each time it is required.</para></listitem><listitem><para><literal>unused</literal> - in some situations it cannot be automatically determined + that a secret is required or not. This flag hints that the secret is not required and should + not be requested from the user.</para></listitem></itemizedlist></refsect2></refsect1><refsect1><title>AUTHOR</title><para><author><firstname>NetworkManager developers</firstname></author></para></refsect1><refsect1><title>FILES</title><para><filename>/etc/sysconfig/network-scripts/ifcfg-*</filename></para><para><filename>/etc/sysconfig/network-scripts/keys-*</filename></para><para><filename>/etc/sysconfig/network-scripts/route-*</filename></para><para><filename>/etc/sysconfig/network-scripts/route6-*</filename></para><para><filename>/usr/share/doc/initscripts/sysconfig.txt</filename></para></refsect1><refsect1><title>SEE ALSO</title><para>https://developer.gnome.org/NetworkManager/unstable/ref-settings.html</para><para>nm-settings(5), nm-settings-keyfile(5), NetworkManager(8), NetworkManager.conf(5), nmcli(1), nmcli-examples(5)</para></refsect1></refentry> diff --git a/man/nm-settings-ifcfg-rh.xsl b/man/nm-settings-ifcfg-rh.xsl new file mode 100644 index 00000000..f76dee75 --- /dev/null +++ b/man/nm-settings-ifcfg-rh.xsl @@ -0,0 +1,405 @@ +<?xml version="1.0" encoding="UTF-8"?> +<xsl:stylesheet version="1.0" + xmlns:xsl="http://www.w3.org/1999/XSL/Transform"> + + <!-- We need to strip whitespaces so that position() function counts correctly. + http://www.oxygenxml.com/archives/xsl-list/200305/msg00430.html --> + <xsl:strip-space elements="nm-ifcfg-rh-docs setting" /> + + <xsl:output + method="xml" + doctype-public="-//OASIS//DTD DocBook XML V4.3//EN" + doctype-system="http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd" + /> + + <xsl:param name="date"/> + <xsl:param name="version"/> + + <xsl:template match="nm-ifcfg-rh-docs"> + <xsl:variable name="unsupported" select="'adsl, bluetooth, ppp, pppoe, serial, generic, gsm, cdma, 802-11-olpc-mesh, wimax, vpn'"/> + <refentry id="nm-settings-ifcfg-rh"> + <refentryinfo> + <date><xsl:value-of select="$date"/></date> + </refentryinfo> + <refmeta> + <refentrytitle>nm-settings-ifcfg-rh</refentrytitle> + <manvolnum>5</manvolnum> + <refmiscinfo class="source">NetworkManager</refmiscinfo> + <refmiscinfo class="manual">Configuration</refmiscinfo> + <refmiscinfo class="version"><xsl:value-of select="$version"/></refmiscinfo> + </refmeta> + <refnamediv> + <refname>nm-settings-ifcfg-rh</refname> + <refpurpose>Description of <emphasis>ifcfg-rh</emphasis> settings plugin</refpurpose> + </refnamediv> + <refsect1> + <title>DESCRIPTION</title> + <para> + NetworkManager is based on the concept of connection profiles that contain + network configuration (see <citerefentry><refentrytitle>nm-settings</refentrytitle> + <manvolnum>5</manvolnum></citerefentry> for details). The profiles can be + stored in various formats. NetworkManager uses plugins for reading and writing + the data. The plugins can be configured in <citerefentry> + <refentrytitle>NetworkManager.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>. + </para> + <para> + The <emphasis>ifcfg-rh</emphasis> plugin is used on the Fedora and Red Hat + Enterprise Linux distributions to read/write configuration from/to + the standard <filename>/etc/sysconfig/network-scripts/ifcfg-*</filename> files. + Each NetworkManager connection maps to one <filename>ifcfg-*</filename> file, with + possible usage of <filename>keys-*</filename> for passwords, <filename>route-*</filename> + for static IPv4 routes and <filename>route6-*</filename> for static IPv6 routes. + The plugin currently supports reading and writing Ethernet, Wi-Fi, InfiniBand, + VLAN, Bond, Bridge, and Team connections. Unsupported connection types (such as + WWAN, PPPoE, VPN, or ADSL are handled by <emphasis>keyfile</emphasis> plugin + (<citerefentry><refentrytitle>nm-settings-keyfile</refentrytitle><manvolnum>5</manvolnum></citerefentry>). + The main reason for using <emphasis>ifcfg-rh</emphasis> plugin is the compatibility + with legacy configurations for <emphasis>ifup</emphasis> and <emphasis>ifdown</emphasis> + (initscripts). + </para> + </refsect1> + <refsect1> + <title>File Format</title> + <para> + The <emphasis>ifcfg-rh</emphasis> config format is a simple text file containing + VARIABLE="value" lines. The format is described in <filename>sysconfig.txt</filename> + of <emphasis>initscripts</emphasis> package. Note that the configuration files + may be sourced by <emphasis>initscripts</emphasis>, so they must be valid shell + scripts. That means, for instance, that <literal>#</literal> character can be used + for comments, strings with spaces must be quoted, special characters must be escaped, + etc. + </para> + <para> + Users can create or modify the <emphasis>ifcfg-rh</emphasis> connection files + manually, even if that is not the recommended way of managing the profiles. + However, if they choose to do that, they must inform NetworkManager about + their changes (see <emphasis>monitor-connection-file</emphasis> in + <citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum> + </citerefentry>, and <emphasis>nmcli con (re)load</emphasis>). + </para> + <formalpara> + <title>Some <emphasis>ifcfg-rh</emphasis> configuration examples:</title> + <para> + <programlisting> + <emphasis role="bold">Simple DHCP ethernet configuration:</emphasis> +NAME=ethernet +UUID=1c4ddf70-01bf-46d6-b04f-47e842bd98da +TYPE=Ethernet +BOOTPROTO=dhcp +DEFROUTE=yes +PEERDNS=yes +PEERROUTES=yes +IPV4_FAILURE_FATAL=no +ONBOOT=yes + </programlisting> + </para> + <para> + <programlisting> + <emphasis role="bold">Simple ethernet configuration with static IP:</emphasis> +TYPE=Ethernet +BOOTPROTO=none +IPADDR=10.1.0.25 +PREFIX=24 +GATEWAY=10.1.0.1 +DEFROUTE=yes +IPV4_FAILURE_FATAL=no +IPV6INIT=yes +IPV6_AUTOCONF=yes +IPV6_DEFROUTE=yes +IPV6_PEERDNS=yes +IPV6_PEERROUTES=yes +IPV6_FAILURE_FATAL=no +NAME=ethernet-em2 +UUID=51bb3904-c0fc-4dfe-83b2-0a71e7928c13 +DEVICE=em2 +ONBOOT=yes + </programlisting> + </para> + <para> + <programlisting> + <emphasis role="bold">WPA2 Enterprise WLAN (TTLS with inner MSCHAPV2 authentication):</emphasis> +ESSID="CompanyWLAN" +MODE=Managed +KEY_MGMT=WPA-EAP +TYPE=Wireless +IEEE_8021X_EAP_METHODS=TTLS +IEEE_8021X_IDENTITY=joe +IEEE_8021X_PASSWORD_FLAGS=ask +IEEE_8021X_INNER_AUTH_METHODS=MSCHAPV2 +IEEE_8021X_CA_CERT=/home/joe/.cert/company.crt +BOOTPROTO=dhcp +DEFROUTE=yes +PEERDNS=yes +PEERROUTES=yes +IPV4_FAILURE_FATAL=no +IPV6INIT=no +NAME=MyCompany +UUID=f79848ff-11a6-4810-9e1a-99039dea84c4 +ONBOOT=yes + </programlisting> + </para> + <para> + <programlisting> + <emphasis role="bold">Bridge and bridge port configuration:</emphasis> +ifcfg-bridge: ifcfg-bridge-port: +NAME=bridge NAME=bridge007-port-eth0 +UUID=4be99ce0-c5b2-4764-8b77-ec226e440125 UUID=3ad56c4a-47e1-419b-b0d4-8ad86eb967a3 +DEVICE=bridge007 DEVICE=eth0 +STP=yes ONBOOT=yes +TYPE=Bridge TYPE=Ethernet +BRIDGING_OPTS=priority=32768 BRIDGE=bridge007 +ONBOOT=yes +BOOTPROTO=dhcp + + </programlisting> + </para> + <para> + <programlisting> + <emphasis role="bold">Bonding configuration:</emphasis> +ifcfg-BOND: ifcfg-BOND-slave: +NAME=BOND NAME=BOND-slave +UUID=b41888aa-924c-450c-b0f8-85a4f0a51b4a UUID=9bb048e4-286a-4cc3-b104-007dbd20decb +DEVICE=bond100 DEVICE=eth0 +BONDING_OPTS="mode=balance-rr miimon=100" ONBOOT=yes +TYPE=Bond TYPE=Ethernet +BONDING_MASTER=yes MASTER=bond100 +ONBOOT=yes SLAVE=yes +BOOTPROTO=dhcp + + </programlisting> + </para> + <para> + <programlisting> + <emphasis role="bold">Team and team port configuration:</emphasis> +ifcfg-my_team0: +DEVICE=team0 +TEAM_CONFIG="{ \"device\": \"team0\", \"runner\": {\"name\": \"roundrobin\"}, \"ports\": {\"eth1\": {}, \"eth2\": {}} }" +DEVICETYPE=Team +BOOTPROTO=dhcp +NAME=team0-profile +UUID=1d3460a0-7b37-457f-a300-fe8d92da4807 +ONBOOT=yes + +ifcfg-my_team0_slave1: +NAME=team0-slave1 +UUID=d5aed298-c567-4cc1-b808-6d38ecef9e64 +DEVICE=eth1 +ONBOOT=yes +TEAM_MASTER=team0 +DEVICETYPE=TeamPort + +ifcfg-my_team0_slave2: +NAME=team0-slave2 +UUID=94e75f4e-e5ad-401c-8962-31e0ae5d2215 +DEVICE=eth2 +ONBOOT=yes +TEAM_MASTER=team0 +DEVICETYPE=TeamPort + </programlisting> + </para> + <para> + The UUID values in the config files must be unique. You can use <emphasis>uuidgen</emphasis> + command line tool to generate such values. Alternatively, you can leave out UUID + entirely. In that case NetworkManager will generate a UUID based on the file name. + </para> + </formalpara> + </refsect1> + + <refsect1> + <title>Differences against initscripts</title> + <para> + The main differences of NetworkManager ifcfg-rh plugin and traditional + initscripts are: + <variablelist class="NM-initscripts-differences"> + <varlistentry> + <term><emphasis role="bold">NM_CONTROLLED=yes|no</emphasis></term> + <listitem><para> + NM_CONTROLLED is NetworkManager-specific variable used by NetworkManager + for determining whether the device of the <emphasis>ifcfg</emphasis> file + should be managed. NM_CONTROLLED=yes is supposed if the variable is not + present in the file. + Note that if you have more <emphasis>ifcfg</emphasis> files for a single + device, NM_CONTROLLED=no in one of the files will cause the device not + to be managed. The profile may not even be the active one. + </para></listitem> + </varlistentry> + <varlistentry> + <term><emphasis role="bold">New variables</emphasis></term> + <listitem><para> + NetworkManager has introduced some new variable, not present in initscripts, + to be able to store data for its new features. The variables are marked + as extensions in the tables bellows. + </para></listitem> + </varlistentry> + <varlistentry> + <term><emphasis role="bold">Semantic change of variables</emphasis></term> + <listitem><para> + NetworkManager had to slightly change the semantic for a few variables. + <itemizedlist> + <listitem> + <para><literal>PEERDNS</literal> - + initscripts interpret PEERDNS=no to mean "never touch resolv.conf". + NetworkManager interprets it to say "never add automatic (DHCP, PPP, VPN, etc.) + nameservers to resolv.conf".</para> + </listitem> + <listitem> + <para><literal>ONBOOT</literal> - + initscripts use ONBOOT=yes to mark the devices that are to be activated + during boot. NetworkManager extents this to also mean that this profile + can be used for auto-connecting at any time.</para> + </listitem> + </itemizedlist> + </para></listitem> + </varlistentry> + </variablelist> + </para> + <para> + See the next section for detailed mapping of NetworkManager properties and + <emphasis>ifcfg-rh</emphasis> variables. Variable names, format and usage + differences in NetworkManager and initscripts are documented in the tables bellow. + </para> + </refsect1> + + <refsect1> + <title>DETAILS</title> + <para> + <emphasis>ifcfg-rh</emphasis> plugin variables marked with <emphasis>(+)</emphasis> + are NetworkManager specific extensions not understood by traditional initscripts. + </para> + <xsl:apply-templates /> + <refsect2 id="secrets-flags"> + <title>Secret flags</title> + <para> + Each secret property in a NetworkManager setting has an associated + <emphasis>flags</emphasis> property that describes how to handle that secret. + In the <emphasis>fcfg-rh</emphasis> plugin variables for secret flags have a + <emphasis>_FLAGS</emphasis> suffix. The variables contain one or more of the + folowing values (space separated). Missing (or empty) *_FLAGS variable means + that the password is owned by NetworkManager. + </para> + <itemizedlist> + <listitem> + <para><literal>user</literal> - a user-session secret agent is responsible for providing + and storing this secret; when it is required, agents will be asked to provide it.</para> + </listitem> + <listitem> + <para><literal>ask</literal> - the associated password is not saved but it will be + requested from the user each time it is required.</para> + </listitem> + <listitem> + <para><literal>unused</literal> - in some situations it cannot be automatically determined + that a secret is required or not. This flag hints that the secret is not required and should + not be requested from the user.</para> + </listitem> + </itemizedlist> + </refsect2> + </refsect1> + + <refsect1> + <title>AUTHOR</title> + <para> + <author> + <firstname>NetworkManager developers</firstname> + </author> + </para> + </refsect1> + <refsect1> + <title>FILES</title> + <para><filename>/etc/sysconfig/network-scripts/ifcfg-*</filename></para> + <para><filename>/etc/sysconfig/network-scripts/keys-*</filename></para> + <para><filename>/etc/sysconfig/network-scripts/route-*</filename></para> + <para><filename>/etc/sysconfig/network-scripts/route6-*</filename></para> + <para><filename>/usr/share/doc/initscripts/sysconfig.txt</filename></para> + </refsect1> + <refsect1> + <title>SEE ALSO</title> + <para>https://developer.gnome.org/NetworkManager/unstable/ref-settings.html</para> + <para>nm-settings(5), nm-settings-keyfile(5), NetworkManager(8), NetworkManager.conf(5), nmcli(1), nmcli-examples(5)</para> + </refsect1> + </refentry> + </xsl:template> + + <xsl:template match="setting"> + <xsl:variable name="setting_name" select="../@name"/> + <xsl:variable name="unsupported" select="'adsl, bluetooth, ppp, pppoe, serial, generic, gsm, cdma, 802-11-olpc-mesh, wimax, vpn'"/> + <xsl:if test="not (contains($unsupported, @name))"> + <table> + <title><xsl:value-of select="@name"/> setting</title> + <tgroup cols="4"> + <thead> + <row> + <entry>Property</entry> + <entry>Ifcfg-rh Variable</entry> + <entry>Default</entry> + <entry>Description</entry> + </row> + </thead> + <tbody> + <xsl:apply-templates/> + </tbody> + </tgroup> + </table> + </xsl:if> + + <xsl:if test="@name = 'dcb'"> + <para> + All DCB related configuration is a NetworkManager extention. DCB=yes must be + used explicitly to enable DCB so that the rest of the DCB_* variables can apply. + </para> + </xsl:if> + + <xsl:if test="position() = last()"> + <para>The following settings are not supported by <emphasis>ifcfg-rh</emphasis> plugin:</para> + <para><xsl:value-of select="$unsupported"/></para> + </xsl:if> + </xsl:template> + + <xsl:template match="property"> + <xsl:variable name="setting_name" select="../@name"/> + + + <row> + <entry align="left"><xsl:value-of select="@name"/></entry> + <entry align="left"> + <xsl:call-template name="string-emphasize-all"> + <xsl:with-param name="text" select="@variable"/> + <xsl:with-param name="emphasize" select="'(+)'"/> + </xsl:call-template> + </entry> + <entry align="left"><xsl:value-of select="@default"/></entry> + <entry align="left"> + <xsl:value-of select="@description"/><xsl:if test="@format = 'NMSettingSecretFlags'"> (see <xref linkend="secrets-flags"/> for _FLAGS values)</xsl:if> + + <xsl:if test="string-length(@example)"> + <emphasis role="bold"> + +Example: </emphasis><xsl:value-of select="@example"/> + </xsl:if> + <xsl:if test="string-length(@values)"> + <emphasis role="bold"> + +Allowed values: </emphasis><xsl:value-of select="@values"/> + </xsl:if> + </entry> + </row> + </xsl:template> + + <xsl:template name="string-emphasize-all"> + <xsl:param name="text"/> + <xsl:param name="emphasize"/> + <xsl:choose> + <xsl:when test="contains($text, $emphasize)"> + <xsl:value-of select="substring-before($text,$emphasize)"/> + <emphasis><xsl:value-of select="$emphasize"/></emphasis> + <xsl:call-template name="string-emphasize-all"> + <xsl:with-param name="text" select="substring-after($text,$emphasize)"/> + <xsl:with-param name="emphasize" select="$emphasize"/> + </xsl:call-template> + </xsl:when> + <xsl:otherwise> + <xsl:value-of select="$text"/> + </xsl:otherwise> + </xsl:choose> + </xsl:template> + +</xsl:stylesheet> diff --git a/man/nm-settings-keyfile.5 b/man/nm-settings-keyfile.5 new file mode 100644 index 00000000..53e9165f --- /dev/null +++ b/man/nm-settings-keyfile.5 @@ -0,0 +1,698 @@ +'\" t +.\" Title: nm-settings-keyfile +.\" Author: [see the "AUTHOR" section] +.\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/> +.\" Date: 19 December 2014 +.\" Manual: Configuration +.\" Source: NetworkManager 1.0.0 +.\" Language: English +.\" +.TH "NM\-SETTINGS\-KEYFIL" "5" "" "NetworkManager 1\&.0\&.0" "Configuration" +.\" ----------------------------------------------------------------- +.\" * Define some portability stuff +.\" ----------------------------------------------------------------- +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" http://bugs.debian.org/507673 +.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- +.\" disable hyphenation +.nh +.\" disable justification (adjust text to left margin only) +.ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- +.SH "NAME" +nm-settings-keyfile \- Description of \fIkeyfile\fR settings plugin +.SH "DESCRIPTION" +.PP +NetworkManager is based on the concept of connection profiles that contain network configuration (see +\fBnm-settings\fR(5) +for details)\&. The profiles can be stored in various formats\&. NetworkManager uses plugins for reading and writing the data\&. The plugins can be configured in +\fBNetworkManager.conf\fR(5)\&. +.PP +The +\fIkeyfile\fR +plugin is the generic plugin that supports all the connection types and capabilities that NetworkManager has\&. It writes files out in a \&.ini\-style format in +/etc/NetworkManager/system\-connections/\&. This plugin is always enabled and will automatically be used to store any connections that are not supported by any other active plugin\&. For security, it will ignore files that are readable or writeable by any user or group other than \*(Aqroot\*(Aq since private keys and passphrases may be stored in plaintext inside the file\&. +.SH "FILE FORMAT" +.PP +The +\fIkeyfile\fR +config format is a simple \&.ini\-style format\&. It consists of sections (groups) of key\-value pairs\&. Each section corresponds to a setting name as described in the settings specification (\fBnm-settings\fR(5))\&. Each configuration key/value pair in the section is one of the properties listed in the settings specification\&. The majority of properties of the specification is written in the same format into the +\fIkeyfile\fR +too\&. However some values are inconvenient for people to use\&. These are stored in the files in more readable ways\&. These properties are described bellow\&. An example could be IP addresses that are not written as integer arrays, but more reasonably as "1\&.2\&.3\&.4/12 1\&.2\&.3\&.254"\&. More information of the generic key file format can be found at +\m[blue]\fBGLib key file format\fR\m[]\&\s-2\u[1]\d\s+2 +(Lines beginning with a \*(Aq#\*(Aq are comments, lists are separated by character +; +etc\&.)\&. +.PP +Users can create or modify the +\fIkeyfile\fR +connection files manually, even if that is not the recommended way of managing the profiles\&. However, if they choose to do that, they must inform NetworkManager about their changes (see +\fImonitor\-connection\-file\fR +in +\fBnm-settings\fR(5) +and +\fInmcli con (re)load\fR)\&. +.PP +\fBExamples of keyfile configuration\fR. +.sp +.if n \{\ +.RS 4 +.\} +.nf +\fBA sample configuration for an ethernet network:\fR +[connection] +id=Main eth0 +uuid=27afa607\-ee36\-43f0\-b8c3\-9d245cdc4bb3 +type=802\-3\-ethernet +autoconnect=true + +[ipv4] +method=auto + +[802\-3\-ethernet] +mac\-address=00:23:5a:47:1f:71 + +.fi +.if n \{\ +.RE +.\} + +.sp +.if n \{\ +.RS 4 +.\} +.nf +\fBA sample configuration for WPA\-EAP (PEAP with MSCHAPv2) and always\-ask secret:\fR +[connection] +id=CompanyWIFI +uuid=cdac6154\-a33b\-4b15\-9904\-666772cfa5ee +type=wifi +autoconnect=false + +[wifi] +ssid=CorpWLAN +mode=infrastructure +security=802\-11\-wireless\-security + +[wifi\-security] +key\-mgmt=wpa\-eap + +[ipv4] +method=auto + +[ipv6] +method=auto + +[802\-1x] +eap=peap; +identity=joe +ca\-cert=/home/joe/\&.cert/corp\&.crt +phase1\-peapver=1 +phase2\-auth=mschapv2 +password\-flags=2 + +.fi +.if n \{\ +.RE +.\} + +.sp +.if n \{\ +.RS 4 +.\} +.nf +\fBA sample configuration for openvpn:\fR +[connection] +id=RedHat\-openvpn +uuid=7f9b3356\-b210\-4c0e\-8123\-bd116c9c280f +type=vpn +timestamp=1385401165 + +[vpn] +service\-type=org\&.freedesktop\&.NetworkManager\&.openvpn +connection\-type=password +password\-flags=3 +remote=ovpn\&.my\-company\&.com +cipher=AES\-256\-CBC +reneg\-seconds=0 +port=443 +username=joe +ca=/etc/openvpn/ISCA\&.pem +tls\-remote=ovpn\&.my\-company\&.com + +[ipv6] +method=auto + +[ipv4] +method=auto +ignore\-auto\-dns=true +never\-default=true + +.fi +.if n \{\ +.RE +.\} + +.sp +.if n \{\ +.RS 4 +.\} +.nf +\fBA sample configuration for a bridge and a bridge port:\fR +[connection] [connection] +id=MainBridge id=br\-port\-1 +uuid=171ae855\-a0ab\-42b6\-bd0c\-60f5812eea9d uuid=d6e8ae98\-71f8\-4b3d\-9d2d\-2e26048fe794 +interface\-name=MainBridge interface\-name=em1 +type=bridge type=ethernet + master=MainBridge +[bridge] slave\-type=bridge +interface\-name=MainBridge + +.fi +.if n \{\ +.RE +.\} + +.sp +.if n \{\ +.RS 4 +.\} +.nf +\fBA sample configuration for a VLAN:\fR +[connection] +id=VLAN for building 4A +uuid=8ce1c9e0\-ce7a\-4d2c\-aa28\-077dda09dd7e +interface\-name=VLAN\-4A +type=vlan + +[vlan] +interface\-name=VLAN\-4A +parent=eth0 +id=4 + +.fi +.if n \{\ +.RE +.\} +.SH "DETAILS" +.PP +\fIkeyfile\fR +plugin variables for the majority of NetworkManager properties have one\-to\-one mapping\&. It means a NetworkManager property is stored in the keyfile as a variable of the same name and in the same format\&. There are several exceptions to this rule, mainly for making keyfile syntax easier for humans\&. The exceptions handled specially by +\fIkeyfile\fR +plugin are listed bellow\&. Refer to +\fBnm-settings\fR(5) +for all available settings and properties and their description\&. +.PP +\fBName aliases\fR. Some of the NetworkManager setting names are somewhat hard to type or remember\&. Therefore +\fIkeyfile\fR +introduces aliases that can be used instead of the names\&. +.RS 4 +\fIsetting name keyfile alias\fR +.RE +.RS 4 +802\-3\-ethernet = ethernet +.RE +.RS 4 +802\-11\-wireless = wifi +.RE +.RS 4 +802\-11\-wireless\-security = wifi\-security +.RE +.sp +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.B Table\ \&1.\ \&bridge setting (section) +.TS +allbox tab(:); +lB lB lB lB. +T{ +Property +T}:T{ +Keyfile Variable +T}:T{ +Format +T}:T{ +Description +T} +.T& +l l l l. +T{ +mac\-address +T}:T{ +mac\-address +T}:T{ +ususal hex\-digits\-and\-colons notation +T}:T{ +MAC address in traditional hex\-digits\-and\-colons notation, or semicolon separated list of 6 decimal bytes (obsolete)\fB + +Example: \fRmac\-address=00:22:68:12:79:A2 mac\-address=0;34;104;18;121;162; +T} +.TE +.sp 1 +.sp +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.B Table\ \&2.\ \&infiniband setting (section) +.TS +allbox tab(:); +lB lB lB lB. +T{ +Property +T}:T{ +Keyfile Variable +T}:T{ +Format +T}:T{ +Description +T} +.T& +l l l l. +T{ +mac\-address +T}:T{ +mac\-address +T}:T{ +ususal hex\-digits\-and\-colons notation +T}:T{ +MAC address in traditional hex\-digits\-and\-colons notation, or or semicolon separated list of 20 decimal bytes (obsolete)\fB + +Example: \fRmac\-address= 80:00:00:6d:fe:80:00:00:00:00:00:00:00:02:55:00:70:33:cf:01 +T} +.TE +.sp 1 +.sp +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.B Table\ \&3.\ \&ipv4 setting (section) +.TS +allbox tab(:); +lB lB lB lB. +T{ +Property +T}:T{ +Keyfile Variable +T}:T{ +Format +T}:T{ +Description +T} +.T& +l l l l +l l l l +l l l l +l l l l. +T{ +dns +T}:T{ +dns +T}:T{ +list of DNS IP addresses +T}:T{ +List of DNS servers\&.\fB + +Example: \fRdns=1\&.2\&.3\&.4;8\&.8\&.8\&.8;8\&.8\&.4\&.4; +T} +T{ +addresses +T}:T{ +address1, address2, \&.\&.\&. +T}:T{ +address/plen +T}:T{ +List of static IP addresses\&.\fB + +Example: \fRaddress1=192\&.168\&.100\&.100/24 address2=10\&.1\&.1\&.5/24 +T} +T{ +gateway +T}:T{ +gateway +T}:T{ +string +T}:T{ +Gateway IP addresses as a string\&.\fB + +Example: \fRgateway=192\&.168\&.100\&.1 +T} +T{ +routes +T}:T{ +route1, route2, \&.\&.\&. +T}:T{ +route/plen[,gateway,metric] +T}:T{ +List of IP routes\&.\fB + +Example: \fRroute1=8\&.8\&.8\&.0/24,10\&.1\&.1\&.1,77 route2=7\&.7\&.0\&.0/16 +T} +.TE +.sp 1 +.sp +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.B Table\ \&4.\ \&ipv6 setting (section) +.TS +allbox tab(:); +lB lB lB lB. +T{ +Property +T}:T{ +Keyfile Variable +T}:T{ +Format +T}:T{ +Description +T} +.T& +l l l l +l l l l +l l l l +l l l l. +T{ +dns +T}:T{ +dns +T}:T{ +list of DNS IP addresses +T}:T{ +List of DNS servers\&.\fB + +Example: \fRdns=2001:4860:4860::8888;2001:4860:4860::8844; +T} +T{ +addresses +T}:T{ +address1, address2, \&.\&.\&. +T}:T{ +address/plen +T}:T{ +List of static IP addresses\&.\fB + +Example: \fRaddress1=abbe::cafe/96 address2=2001::1234 +T} +T{ +gateway +T}:T{ +gateway +T}:T{ +string +T}:T{ +Gateway IP addresses as a string\&.\fB + +Example: \fRgateway=abbe::1 +T} +T{ +routes +T}:T{ +route1, route2, \&.\&.\&. +T}:T{ +route/plen[,gateway,metric] +T}:T{ +List of IP routes\&.\fB + +Example: \fRroute1=2001:4860:4860::/64,2620:52:0:2219:222:68ff:fe11:5403 +T} +.TE +.sp 1 +.sp +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.B Table\ \&5.\ \&serial setting (section) +.TS +allbox tab(:); +lB lB lB lB. +T{ +Property +T}:T{ +Keyfile Variable +T}:T{ +Format +T}:T{ +Description +T} +.T& +l l l l. +T{ +parity +T}:T{ +parity +T}:T{ +\*(Aqe\*(Aq, \*(Aqo\*(Aq, or \*(Aqn\*(Aq +T}:T{ +The connection parity; even, odd, or none\&. Note that older versions of NetworkManager stored this as an integer: 69 (\*(AqE\*(Aq) for even, 111 (\*(Aqo\*(Aq) for odd, or 110 (\*(Aqn\*(Aq) for none\&.\fB + +Example: \fRparity=n +T} +.TE +.sp 1 +.sp +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.B Table\ \&6.\ \&vpn setting (section) +.TS +allbox tab(:); +lB lB lB lB. +T{ +Property +T}:T{ +Keyfile Variable +T}:T{ +Format +T}:T{ +Description +T} +.T& +l l l l +l l l l. +T{ +data +T}:T{ +separate variables named after keys of the dictionary +T}:T{ +\ \& +T}:T{ +The keys of the data dictionary are used as variable names directly under [vpn] section\&.\fB + +Example: \fRremote=ovpn\&.corp\&.com cipher=AES\-256\-CBC username=joe +T} +T{ +secrets +T}:T{ +separate variables named after keys of the dictionary +T}:T{ +\ \& +T}:T{ +The keys of the secrets dictionary are used as variable names directly under [vpn\-secrets] section\&.\fB + +Example: \fRpassword=Popocatepetl +T} +.TE +.sp 1 +.sp +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.B Table\ \&7.\ \&802-3-ethernet setting (section) +.TS +allbox tab(:); +lB lB lB lB. +T{ +Property +T}:T{ +Keyfile Variable +T}:T{ +Format +T}:T{ +Description +T} +.T& +l l l l +l l l l +l l l l. +T{ +mac\-address +T}:T{ +mac\-address +T}:T{ +ususal hex\-digits\-and\-colons notation +T}:T{ +MAC address in traditional hex\-digits\-and\-colons notation (e\&.g\&. 00:22:68:12:79:A2), or semicolon separated list of 6 bytes (obsolete) (e\&.g\&. 0;34;104;18;121;162) +T} +T{ +cloned\-mac\-address +T}:T{ +cloned\-mac\-address +T}:T{ +ususal hex\-digits\-and\-colons notation +T}:T{ +Cloned MAC address in traditional hex\-digits\-and\-colons notation (e\&.g\&. 00:22:68:12:79:B2), or semicolon separated list of 6 bytes (obsolete) (e\&.g\&. 0;34;104;18;121;178)\&. +T} +T{ +mac\-address\-blacklist +T}:T{ +mac\-address\-blacklist +T}:T{ +list of MACs (separated with semicolons) +T}:T{ +MAC address blacklist\&.\fB + +Example: \fRmac\-address\-blacklist= 00:22:68:12:79:A6;00:22:68:12:79:78 +T} +.TE +.sp 1 +.sp +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.B Table\ \&8.\ \&802-11-wireless setting (section) +.TS +allbox tab(:); +lB lB lB lB. +T{ +Property +T}:T{ +Keyfile Variable +T}:T{ +Format +T}:T{ +Description +T} +.T& +l l l l +l l l l +l l l l +l l l l. +T{ +ssid +T}:T{ +ssid +T}:T{ +string (or decimal\-byte list \- obsolete) +T}:T{ +SSID of Wi\-Fi network\&.\fB + +Example: \fRssid=Quick Net +T} +T{ +mac\-address +T}:T{ +mac\-address +T}:T{ +ususal hex\-digits\-and\-colons notation +T}:T{ +MAC address in traditional hex\-digits\-and\-colons notation (e\&.g\&. 00:22:68:12:79:A2), or semicolon separated list of 6 bytes (obsolete) (e\&.g\&. 0;34;104;18;121;162)\&. +T} +T{ +cloned\-mac\-address +T}:T{ +cloned\-mac\-address +T}:T{ +ususal hex\-digits\-and\-colons notation +T}:T{ +Cloned MAC address in traditional hex\-digits\-and\-colons notation (e\&.g\&. 00:22:68:12:79:B2), or semicolon separated list of 6 bytes (obsolete) (e\&.g\&. 0;34;104;18;121;178)\&. +T} +T{ +mac\-address\-blacklist +T}:T{ +mac\-address\-blacklist +T}:T{ +list of MACs (separated with semicolons) +T}:T{ +MAC address blacklist\&.\fB + +Example: \fRmac\-address\-blacklist= 00:22:68:12:79:A6;00:22:68:12:79:78 +T} +.TE +.sp 1 +.SS "Secret flags" +.PP +Each secret property in a NetworkManager setting has an associated +\fIflags\fR +property that describes how to handle that secret\&. In the +\fIkeyfile\fR +plugin, the value of +\fI\-flags\fR +variable is a decimal number (0 \- 7) defined as a sum of the following values: +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} +0 \- (NM owned) \- the system is responsible for providing and storing this secret\&. +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} +1 \- (agent\-owned) \- a user\-session secret agent is responsible for providing and storing this secret; when it is required, agents will be asked to provide it\&. +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} +2 \- (not\-saved) \- this secret should not be saved but should be requested from the user each time it is required\&. +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} +4 \- (not\-required) \- in some situations it cannot be automatically determined that a secret is required or not\&. This flag hints that the secret is not required and should not be requested from the user\&. +.RE +.SH "AUTHOR" +.PP +NetworkManager developers +.SH "FILES" +.PP +/etc/NetworkManager/system\-connections/* +.SH "SEE ALSO" +.PP +https://developer\&.gnome\&.org/NetworkManager/unstable/ref\-settings\&.html +.PP +nm\-settings(5), nm\-settings\-ifcfg\-rh(5), NetworkManager(8), NetworkManager\&.conf(5), nmcli(1), nmcli\-examples(5) +.SH "NOTES" +.IP " 1." 4 +GLib key file format +.RS 4 +\%https://developer.gnome.org/glib/stable/glib-Key-value-file-parser.html#glib-Key-value-file-parser.description +.RE diff --git a/man/nm-settings-keyfile.xml b/man/nm-settings-keyfile.xml new file mode 100644 index 00000000..45bc472b --- /dev/null +++ b/man/nm-settings-keyfile.xml @@ -0,0 +1,233 @@ +<?xml version="1.0"?> +<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.3//EN" "http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd"> +<refentry id="nm-settings-keyfile"><refentryinfo><date>19 December 2014</date></refentryinfo><refmeta><refentrytitle>nm-settings-keyfile</refentrytitle><manvolnum>5</manvolnum><refmiscinfo class="source">NetworkManager</refmiscinfo><refmiscinfo class="manual">Configuration</refmiscinfo><refmiscinfo class="version">1.0.0</refmiscinfo></refmeta><refnamediv><refname>nm-settings-keyfile</refname><refpurpose>Description of <emphasis>keyfile</emphasis> settings plugin</refpurpose></refnamediv><refsect1><title>DESCRIPTION</title><para> + NetworkManager is based on the concept of connection profiles that contain + network configuration (see <citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum></citerefentry> for details). The profiles can be + stored in various formats. NetworkManager uses plugins for reading and writing + the data. The plugins can be configured in <citerefentry><refentrytitle>NetworkManager.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>. + </para><para> + The <emphasis>keyfile</emphasis> plugin is the generic plugin that supports all + the connection types and capabilities that NetworkManager has. It writes files + out in a .ini-style format in <filename>/etc/NetworkManager/system-connections/</filename>. + This plugin is always enabled and will automatically be used to store + any connections that are not supported by any other active plugin. + For security, it will ignore files that are readable or writeable by any user + or group other than 'root' since private keys and passphrases may be stored + in plaintext inside the file. + </para></refsect1><refsect1><title>File Format</title><para> + The <emphasis>keyfile</emphasis> config format is a simple .ini-style + format. It consists of sections (groups) of key-value pairs. Each section + corresponds to a setting name as described in the settings specification + (<citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum></citerefentry>). Each configuration key/value + pair in the section is one of the properties listed in the settings + specification. The majority of properties of the specification is written + in the same format into the <emphasis>keyfile</emphasis> too. However + some values are inconvenient for people to use. These are stored in the + files in more readable ways. These properties are described bellow. + An example could be IP addresses that are not written as integer arrays, + but more reasonably as "1.2.3.4/12 1.2.3.254". + More information of the generic key file format can be found at + <ulink url="https://developer.gnome.org/glib/stable/glib-Key-value-file-parser.html#glib-Key-value-file-parser.description"> + GLib key file format</ulink> (Lines beginning with a '#' are comments, + lists are separated by character <literal>;</literal> etc.). + </para><para> + Users can create or modify the <emphasis>keyfile</emphasis> connection files + manually, even if that is not the recommended way of managing the profiles. + However, if they choose to do that, they must inform NetworkManager about + their changes (see <emphasis>monitor-connection-file</emphasis> in + <citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum></citerefentry> and <emphasis>nmcli con (re)load</emphasis>). + </para><formalpara><title>Examples of <emphasis>keyfile</emphasis> configuration</title><para><programlisting><emphasis role="bold">A sample configuration for an ethernet network:</emphasis> +[connection] +id=Main eth0 +uuid=27afa607-ee36-43f0-b8c3-9d245cdc4bb3 +type=802-3-ethernet +autoconnect=true + +[ipv4] +method=auto + +[802-3-ethernet] +mac-address=00:23:5a:47:1f:71 + </programlisting></para><para><programlisting><emphasis role="bold">A sample configuration for WPA-EAP (PEAP with MSCHAPv2) and always-ask secret:</emphasis> +[connection] +id=CompanyWIFI +uuid=cdac6154-a33b-4b15-9904-666772cfa5ee +type=wifi +autoconnect=false + +[wifi] +ssid=CorpWLAN +mode=infrastructure +security=802-11-wireless-security + +[wifi-security] +key-mgmt=wpa-eap + +[ipv4] +method=auto + +[ipv6] +method=auto + +[802-1x] +eap=peap; +identity=joe +ca-cert=/home/joe/.cert/corp.crt +phase1-peapver=1 +phase2-auth=mschapv2 +password-flags=2 + </programlisting></para><para><programlisting><emphasis role="bold">A sample configuration for openvpn:</emphasis> +[connection] +id=RedHat-openvpn +uuid=7f9b3356-b210-4c0e-8123-bd116c9c280f +type=vpn +timestamp=1385401165 + +[vpn] +service-type=org.freedesktop.NetworkManager.openvpn +connection-type=password +password-flags=3 +remote=ovpn.my-company.com +cipher=AES-256-CBC +reneg-seconds=0 +port=443 +username=joe +ca=/etc/openvpn/ISCA.pem +tls-remote=ovpn.my-company.com + +[ipv6] +method=auto + +[ipv4] +method=auto +ignore-auto-dns=true +never-default=true + </programlisting></para><para><programlisting><emphasis role="bold">A sample configuration for a bridge and a bridge port:</emphasis> +[connection] [connection] +id=MainBridge id=br-port-1 +uuid=171ae855-a0ab-42b6-bd0c-60f5812eea9d uuid=d6e8ae98-71f8-4b3d-9d2d-2e26048fe794 +interface-name=MainBridge interface-name=em1 +type=bridge type=ethernet + master=MainBridge +[bridge] slave-type=bridge +interface-name=MainBridge + </programlisting></para><para><programlisting><emphasis role="bold">A sample configuration for a VLAN:</emphasis> +[connection] +id=VLAN for building 4A +uuid=8ce1c9e0-ce7a-4d2c-aa28-077dda09dd7e +interface-name=VLAN-4A +type=vlan + +[vlan] +interface-name=VLAN-4A +parent=eth0 +id=4 + </programlisting></para></formalpara></refsect1><refsect1><title>DETAILS</title><para><emphasis>keyfile</emphasis> plugin variables for the majority of NetworkManager + properties have one-to-one mapping. It means a NetworkManager property is stored + in the keyfile as a variable of the same name and in the same format. + There are several exceptions to this rule, mainly for making keyfile syntax easier + for humans. The exceptions handled specially by <emphasis>keyfile</emphasis> + plugin are listed bellow. Refer to + <citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum></citerefentry> + for all available settings and properties and their description. + </para><formalpara><title>Name aliases</title><para> + Some of the NetworkManager setting names are somewhat hard to type or remember. Therefore + <emphasis>keyfile</emphasis> introduces aliases that can be used instead of the names. + <simplelist type="horiz" columns="1"><member><emphasis>setting name keyfile alias</emphasis></member><member>802-3-ethernet = ethernet</member><member>802-11-wireless = wifi</member><member>802-11-wireless-security = wifi-security</member></simplelist></para></formalpara> + + + + + +<table><title>bridge setting (section)</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Keyfile Variable</entry><entry>Format</entry><entry>Description</entry></row></thead><tbody> +<row><entry align="left">mac-address</entry><entry align="left">mac-address</entry><entry align="left">ususal hex-digits-and-colons notation</entry><entry align="left">MAC address in traditional hex-digits-and-colons notation, or semicolon separated list of 6 decimal bytes (obsolete)<emphasis role="bold"> + +Example: </emphasis>mac-address=00:22:68:12:79:A2 mac-address=0;34;104;18;121;162;</entry></row> +</tbody></tgroup></table> + + + + + +<table><title>infiniband setting (section)</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Keyfile Variable</entry><entry>Format</entry><entry>Description</entry></row></thead><tbody> +<row><entry align="left">mac-address</entry><entry align="left">mac-address</entry><entry align="left">ususal hex-digits-and-colons notation</entry><entry align="left">MAC address in traditional hex-digits-and-colons notation, or or semicolon separated list of 20 decimal bytes (obsolete)<emphasis role="bold"> + +Example: </emphasis>mac-address= 80:00:00:6d:fe:80:00:00:00:00:00:00:00:02:55:00:70:33:cf:01</entry></row> +</tbody></tgroup></table> + +<table><title>ipv4 setting (section)</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Keyfile Variable</entry><entry>Format</entry><entry>Description</entry></row></thead><tbody> +<row><entry align="left">dns</entry><entry align="left">dns</entry><entry align="left">list of DNS IP addresses</entry><entry align="left">List of DNS servers.<emphasis role="bold"> + +Example: </emphasis>dns=1.2.3.4;8.8.8.8;8.8.4.4;</entry></row> +<row><entry align="left">addresses</entry><entry align="left">address1, address2, ...</entry><entry align="left">address/plen</entry><entry align="left">List of static IP addresses.<emphasis role="bold"> + +Example: </emphasis>address1=192.168.100.100/24 address2=10.1.1.5/24</entry></row> +<row><entry align="left">gateway</entry><entry align="left">gateway</entry><entry align="left">string</entry><entry align="left">Gateway IP addresses as a string.<emphasis role="bold"> + +Example: </emphasis>gateway=192.168.100.1</entry></row> +<row><entry align="left">routes</entry><entry align="left">route1, route2, ...</entry><entry align="left">route/plen[,gateway,metric]</entry><entry align="left">List of IP routes.<emphasis role="bold"> + +Example: </emphasis>route1=8.8.8.0/24,10.1.1.1,77 route2=7.7.0.0/16</entry></row> +</tbody></tgroup></table> +<table><title>ipv6 setting (section)</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Keyfile Variable</entry><entry>Format</entry><entry>Description</entry></row></thead><tbody> +<row><entry align="left">dns</entry><entry align="left">dns</entry><entry align="left">list of DNS IP addresses</entry><entry align="left">List of DNS servers.<emphasis role="bold"> + +Example: </emphasis>dns=2001:4860:4860::8888;2001:4860:4860::8844;</entry></row> +<row><entry align="left">addresses</entry><entry align="left">address1, address2, ...</entry><entry align="left">address/plen</entry><entry align="left">List of static IP addresses.<emphasis role="bold"> + +Example: </emphasis>address1=abbe::cafe/96 address2=2001::1234</entry></row> +<row><entry align="left">gateway</entry><entry align="left">gateway</entry><entry align="left">string</entry><entry align="left">Gateway IP addresses as a string.<emphasis role="bold"> + +Example: </emphasis>gateway=abbe::1</entry></row> +<row><entry align="left">routes</entry><entry align="left">route1, route2, ...</entry><entry align="left">route/plen[,gateway,metric]</entry><entry align="left">List of IP routes.<emphasis role="bold"> + +Example: </emphasis>route1=2001:4860:4860::/64,2620:52:0:2219:222:68ff:fe11:5403</entry></row> +</tbody></tgroup></table> + + + +<table><title>serial setting (section)</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Keyfile Variable</entry><entry>Format</entry><entry>Description</entry></row></thead><tbody> +<row><entry align="left">parity</entry><entry align="left">parity</entry><entry align="left">'e', 'o', or 'n'</entry><entry align="left">The connection parity; even, odd, or none. Note that older versions of NetworkManager stored this as an integer: 69 ('E') for even, 111 ('o') for odd, or 110 ('n') for none.<emphasis role="bold"> + +Example: </emphasis>parity=n</entry></row> +</tbody></tgroup></table> + + + +<table><title>vpn setting (section)</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Keyfile Variable</entry><entry>Format</entry><entry>Description</entry></row></thead><tbody> +<row><entry align="left">data</entry><entry align="left">separate variables named after keys of the dictionary</entry><entry align="left"/><entry align="left">The keys of the data dictionary are used as variable names directly under [vpn] section.<emphasis role="bold"> + +Example: </emphasis>remote=ovpn.corp.com cipher=AES-256-CBC username=joe</entry></row> +<row><entry align="left">secrets</entry><entry align="left">separate variables named after keys of the dictionary</entry><entry align="left"/><entry align="left">The keys of the secrets dictionary are used as variable names directly under [vpn-secrets] section.<emphasis role="bold"> + +Example: </emphasis>password=Popocatepetl</entry></row> +</tbody></tgroup></table> + +<table><title>802-3-ethernet setting (section)</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Keyfile Variable</entry><entry>Format</entry><entry>Description</entry></row></thead><tbody> +<row><entry align="left">mac-address</entry><entry align="left">mac-address</entry><entry align="left">ususal hex-digits-and-colons notation</entry><entry align="left">MAC address in traditional hex-digits-and-colons notation (e.g. 00:22:68:12:79:A2), or semicolon separated list of 6 bytes (obsolete) (e.g. 0;34;104;18;121;162)</entry></row> +<row><entry align="left">cloned-mac-address</entry><entry align="left">cloned-mac-address</entry><entry align="left">ususal hex-digits-and-colons notation</entry><entry align="left">Cloned MAC address in traditional hex-digits-and-colons notation (e.g. 00:22:68:12:79:B2), or semicolon separated list of 6 bytes (obsolete) (e.g. 0;34;104;18;121;178).</entry></row> +<row><entry align="left">mac-address-blacklist</entry><entry align="left">mac-address-blacklist</entry><entry align="left">list of MACs (separated with semicolons)</entry><entry align="left">MAC address blacklist.<emphasis role="bold"> + +Example: </emphasis>mac-address-blacklist= 00:22:68:12:79:A6;00:22:68:12:79:78</entry></row> +</tbody></tgroup></table> + +<table><title>802-11-wireless setting (section)</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Keyfile Variable</entry><entry>Format</entry><entry>Description</entry></row></thead><tbody> +<row><entry align="left">ssid</entry><entry align="left">ssid</entry><entry align="left">string (or decimal-byte list - obsolete)</entry><entry align="left">SSID of Wi-Fi network.<emphasis role="bold"> + +Example: </emphasis>ssid=Quick Net</entry></row> +<row><entry align="left">mac-address</entry><entry align="left">mac-address</entry><entry align="left">ususal hex-digits-and-colons notation</entry><entry align="left">MAC address in traditional hex-digits-and-colons notation (e.g. 00:22:68:12:79:A2), or semicolon separated list of 6 bytes (obsolete) (e.g. 0;34;104;18;121;162).</entry></row> +<row><entry align="left">cloned-mac-address</entry><entry align="left">cloned-mac-address</entry><entry align="left">ususal hex-digits-and-colons notation</entry><entry align="left">Cloned MAC address in traditional hex-digits-and-colons notation (e.g. 00:22:68:12:79:B2), or semicolon separated list of 6 bytes (obsolete) (e.g. 0;34;104;18;121;178).</entry></row> +<row><entry align="left">mac-address-blacklist</entry><entry align="left">mac-address-blacklist</entry><entry align="left">list of MACs (separated with semicolons)</entry><entry align="left">MAC address blacklist.<emphasis role="bold"> + +Example: </emphasis>mac-address-blacklist= 00:22:68:12:79:A6;00:22:68:12:79:78</entry></row> +</tbody></tgroup></table> +<refsect2 id="secrets-flags"><title>Secret flags</title><para> + Each secret property in a NetworkManager setting has an associated <emphasis>flags</emphasis> + property that describes how to handle that secret. In the <emphasis>keyfile</emphasis> plugin, + the value of <emphasis>-flags</emphasis> variable is a decimal number (0 - 7) defined as a sum + of the following values: + </para><itemizedlist><listitem><para>0 - (NM owned) - the system is responsible for providing and storing this secret.</para></listitem><listitem><para>1 - (agent-owned) - a user-session secret agent is responsible for providing + and storing this secret; when it is required, agents will be asked to provide it.</para></listitem><listitem><para>2 - (not-saved) - this secret should not be saved but should be requested + from the user each time it is required.</para></listitem><listitem><para>4 - (not-required) - in some situations it cannot be automatically determined + that a secret is required or not. This flag hints that the secret is not required + and should not be requested from the user.</para></listitem></itemizedlist></refsect2></refsect1><refsect1><title>AUTHOR</title><para><author><firstname>NetworkManager developers</firstname></author></para></refsect1><refsect1><title>FILES</title><para><filename>/etc/NetworkManager/system-connections/*</filename></para></refsect1><refsect1><title>SEE ALSO</title><para>https://developer.gnome.org/NetworkManager/unstable/ref-settings.html</para><para>nm-settings(5), nm-settings-ifcfg-rh(5), NetworkManager(8), NetworkManager.conf(5), nmcli(1), nmcli-examples(5)</para></refsect1></refentry> diff --git a/man/nm-settings-keyfile.xsl b/man/nm-settings-keyfile.xsl new file mode 100644 index 00000000..b6e01a23 --- /dev/null +++ b/man/nm-settings-keyfile.xsl @@ -0,0 +1,308 @@ +<?xml version="1.0" encoding="UTF-8"?> +<xsl:stylesheet version="1.0" + xmlns:xsl="http://www.w3.org/1999/XSL/Transform"> + + <xsl:output + method="xml" + doctype-public="-//OASIS//DTD DocBook XML V4.3//EN" + doctype-system="http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd" + /> + + <xsl:param name="date"/> + <xsl:param name="version"/> + + <xsl:template match="nm-keyfile-docs"> + <refentry id="nm-settings-keyfile"> + <refentryinfo> + <date><xsl:value-of select="$date"/></date> + </refentryinfo> + <refmeta> + <refentrytitle>nm-settings-keyfile</refentrytitle> + <manvolnum>5</manvolnum> + <refmiscinfo class="source">NetworkManager</refmiscinfo> + <refmiscinfo class="manual">Configuration</refmiscinfo> + <refmiscinfo class="version"><xsl:value-of select="$version"/></refmiscinfo> + </refmeta> + <refnamediv> + <refname>nm-settings-keyfile</refname> + <refpurpose>Description of <emphasis>keyfile</emphasis> settings plugin</refpurpose> + </refnamediv> + <refsect1> + <title>DESCRIPTION</title> + <para> + NetworkManager is based on the concept of connection profiles that contain + network configuration (see <citerefentry><refentrytitle>nm-settings</refentrytitle> + <manvolnum>5</manvolnum></citerefentry> for details). The profiles can be + stored in various formats. NetworkManager uses plugins for reading and writing + the data. The plugins can be configured in <citerefentry> + <refentrytitle>NetworkManager.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>. + </para> + <para> + The <emphasis>keyfile</emphasis> plugin is the generic plugin that supports all + the connection types and capabilities that NetworkManager has. It writes files + out in a .ini-style format in <filename>/etc/NetworkManager/system-connections/</filename>. + This plugin is always enabled and will automatically be used to store + any connections that are not supported by any other active plugin. + For security, it will ignore files that are readable or writeable by any user + or group other than 'root' since private keys and passphrases may be stored + in plaintext inside the file. + </para> + </refsect1> + <refsect1> + <title>File Format</title> + <para> + The <emphasis>keyfile</emphasis> config format is a simple .ini-style + format. It consists of sections (groups) of key-value pairs. Each section + corresponds to a setting name as described in the settings specification + (<citerefentry><refentrytitle>nm-settings</refentrytitle> + <manvolnum>5</manvolnum></citerefentry>). Each configuration key/value + pair in the section is one of the properties listed in the settings + specification. The majority of properties of the specification is written + in the same format into the <emphasis>keyfile</emphasis> too. However + some values are inconvenient for people to use. These are stored in the + files in more readable ways. These properties are described bellow. + An example could be IP addresses that are not written as integer arrays, + but more reasonably as "1.2.3.4/12 1.2.3.254". + More information of the generic key file format can be found at + <ulink url="https://developer.gnome.org/glib/stable/glib-Key-value-file-parser.html#glib-Key-value-file-parser.description"> + GLib key file format</ulink> (Lines beginning with a '#' are comments, + lists are separated by character <literal>;</literal> etc.). + </para> + <para> + Users can create or modify the <emphasis>keyfile</emphasis> connection files + manually, even if that is not the recommended way of managing the profiles. + However, if they choose to do that, they must inform NetworkManager about + their changes (see <emphasis>monitor-connection-file</emphasis> in + <citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum> + </citerefentry> and <emphasis>nmcli con (re)load</emphasis>). + </para> + <formalpara> + <title>Examples of <emphasis>keyfile</emphasis> configuration</title> + <para> + <programlisting> + <emphasis role="bold">A sample configuration for an ethernet network:</emphasis> +[connection] +id=Main eth0 +uuid=27afa607-ee36-43f0-b8c3-9d245cdc4bb3 +type=802-3-ethernet +autoconnect=true + +[ipv4] +method=auto + +[802-3-ethernet] +mac-address=00:23:5a:47:1f:71 + </programlisting> + </para> + <para> + <programlisting> + <emphasis role="bold">A sample configuration for WPA-EAP (PEAP with MSCHAPv2) and always-ask secret:</emphasis> +[connection] +id=CompanyWIFI +uuid=cdac6154-a33b-4b15-9904-666772cfa5ee +type=wifi +autoconnect=false + +[wifi] +ssid=CorpWLAN +mode=infrastructure +security=802-11-wireless-security + +[wifi-security] +key-mgmt=wpa-eap + +[ipv4] +method=auto + +[ipv6] +method=auto + +[802-1x] +eap=peap; +identity=joe +ca-cert=/home/joe/.cert/corp.crt +phase1-peapver=1 +phase2-auth=mschapv2 +password-flags=2 + </programlisting> + </para> + <para> + <programlisting> + <emphasis role="bold">A sample configuration for openvpn:</emphasis> +[connection] +id=RedHat-openvpn +uuid=7f9b3356-b210-4c0e-8123-bd116c9c280f +type=vpn +timestamp=1385401165 + +[vpn] +service-type=org.freedesktop.NetworkManager.openvpn +connection-type=password +password-flags=3 +remote=ovpn.my-company.com +cipher=AES-256-CBC +reneg-seconds=0 +port=443 +username=joe +ca=/etc/openvpn/ISCA.pem +tls-remote=ovpn.my-company.com + +[ipv6] +method=auto + +[ipv4] +method=auto +ignore-auto-dns=true +never-default=true + </programlisting> + </para> + <para> + <programlisting> + <emphasis role="bold">A sample configuration for a bridge and a bridge port:</emphasis> +[connection] [connection] +id=MainBridge id=br-port-1 +uuid=171ae855-a0ab-42b6-bd0c-60f5812eea9d uuid=d6e8ae98-71f8-4b3d-9d2d-2e26048fe794 +interface-name=MainBridge interface-name=em1 +type=bridge type=ethernet + master=MainBridge +[bridge] slave-type=bridge +interface-name=MainBridge + </programlisting> + </para> + <para> + <programlisting> + <emphasis role="bold">A sample configuration for a VLAN:</emphasis> +[connection] +id=VLAN for building 4A +uuid=8ce1c9e0-ce7a-4d2c-aa28-077dda09dd7e +interface-name=VLAN-4A +type=vlan + +[vlan] +interface-name=VLAN-4A +parent=eth0 +id=4 + </programlisting> + </para> + </formalpara> + </refsect1> + + <refsect1> + <title>DETAILS</title> + <para> + <emphasis>keyfile</emphasis> plugin variables for the majority of NetworkManager + properties have one-to-one mapping. It means a NetworkManager property is stored + in the keyfile as a variable of the same name and in the same format. + There are several exceptions to this rule, mainly for making keyfile syntax easier + for humans. The exceptions handled specially by <emphasis>keyfile</emphasis> + plugin are listed bellow. Refer to + <citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum></citerefentry> + for all available settings and properties and their description. + </para> + <formalpara><title>Name aliases</title> + <para> + Some of the NetworkManager setting names are somewhat hard to type or remember. Therefore + <emphasis>keyfile</emphasis> introduces aliases that can be used instead of the names. + <!-- Hmm, why doesn't <simplelist type='horiz' columns='2'> create two columns? --> + <simplelist type='horiz' columns='1'> + <member><emphasis>setting name keyfile alias</emphasis></member> + <member>802-3-ethernet = ethernet</member> + <member>802-11-wireless = wifi</member> + <member>802-11-wireless-security = wifi-security</member> + </simplelist> + </para> + </formalpara> + <xsl:apply-templates/> + <refsect2 id="secrets-flags"> + <title>Secret flags</title> + <para> + Each secret property in a NetworkManager setting has an associated <emphasis>flags</emphasis> + property that describes how to handle that secret. In the <emphasis>keyfile</emphasis> plugin, + the value of <emphasis>-flags</emphasis> variable is a decimal number (0 - 7) defined as a sum + of the following values: + </para> + <itemizedlist> + <listitem> + <para>0 - (NM owned) - the system is responsible for providing and storing this secret.</para> + </listitem> + <listitem> + <para>1 - (agent-owned) - a user-session secret agent is responsible for providing + and storing this secret; when it is required, agents will be asked to provide it.</para> + </listitem> + <listitem> + <para>2 - (not-saved) - this secret should not be saved but should be requested + from the user each time it is required.</para> + </listitem> + <listitem> + <para>4 - (not-required) - in some situations it cannot be automatically determined + that a secret is required or not. This flag hints that the secret is not required + and should not be requested from the user.</para> + </listitem> + </itemizedlist> + </refsect2> + </refsect1> + + <refsect1> + <title>AUTHOR</title> + <para> + <author> + <firstname>NetworkManager developers</firstname> + </author> + </para> + </refsect1> + <refsect1> + <title>FILES</title> + <para><filename>/etc/NetworkManager/system-connections/*</filename></para> + </refsect1> + <refsect1> + <title>SEE ALSO</title> + <para>https://developer.gnome.org/NetworkManager/unstable/ref-settings.html</para> + <para>nm-settings(5), nm-settings-ifcfg-rh(5), NetworkManager(8), NetworkManager.conf(5), nmcli(1), nmcli-examples(5)</para> + </refsect1> + </refentry> + </xsl:template> + + <xsl:template match="setting"> + <xsl:variable name="setting_name" select="../@name"/> + <xsl:if test="property/@name != ''"> + <table> + <title><xsl:value-of select="@name"/> setting (section)</title> + <tgroup cols="4"> + <thead> + <row> + <entry>Property</entry> + <entry>Keyfile Variable</entry> + <entry>Format</entry> + <entry>Description</entry> + </row> + </thead> + <tbody> + <xsl:apply-templates/> + </tbody> + </tgroup> + </table> + </xsl:if> + </xsl:template> + + <xsl:template match="property"> + <row> + <entry align="left"><xsl:value-of select="@name"/></entry> + <entry align="left"><xsl:value-of select="@variable"/></entry> + <entry align="left"><xsl:value-of select="@format"/></entry> + <entry align="left"> + <xsl:value-of select="@description"/> + <xsl:if test="string-length(@example)"> + <emphasis role="bold"> + +Example: </emphasis><xsl:value-of select="@example"/> + </xsl:if> + <xsl:if test="string-length(@values)"> + <emphasis role="bold"> + +Allowed values: </emphasis><xsl:value-of select="@values"/> + </xsl:if> + </entry> + </row> + </xsl:template> + +</xsl:stylesheet> diff --git a/man/nm-settings.5 b/man/nm-settings.5 index 6f6aaf8e..0a90098a 100644 --- a/man/nm-settings.5 +++ b/man/nm-settings.5 @@ -2,12 +2,12 @@ .\" Title: nm-settings .\" Author: [see the "AUTHOR" section] .\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/> -.\" Date: 03 July 2014 +.\" Date: 19 December 2014 .\" Manual: Configuration -.\" Source: NetworkManager 0.9.10.0 +.\" Source: NetworkManager 1.0.0 .\" Language: English .\" -.TH "NM\-SETTINGS" "5" "" "NetworkManager 0\&.9\&.10\&.0" "Configuration" +.TH "NM\-SETTINGS" "5" "" "NetworkManager 1\&.0\&.0" "Configuration" .\" ----------------------------------------------------------------- .\" * Define some portability stuff .\" ----------------------------------------------------------------- @@ -111,112 +111,121 @@ l l l l l l l l l l l l. T{ -name +altsubject\-matches T}:T{ -string +array of string T}:T{ -802\-1x +[] T}:T{ -The setting\*(Aqs name; these names are defined by the specification and cannot be changed after the object has been created\&. Each setting class has a name, and all objects of that class share the same name\&. +List of strings to be matched against the altSubjectName of the certificate presented by the authentication server\&. If the list is empty, no verification of the server certificate\*(Aqs altSubjectName is performed\&. T} T{ -eap +anonymous\-identity T}:T{ -array of string +string T}:T{ \ \& T}:T{ -The allowed EAP method to be used when authenticating to the network with 802\&.1x\&. Valid methods are: \*(Aqleap\*(Aq, \*(Aqmd5\*(Aq, \*(Aqtls\*(Aq, \*(Aqpeap\*(Aq, \*(Aqttls\*(Aq, \*(Aqpwd\*(Aq, and \*(Aqfast\*(Aq\&. Each method requires different configuration using the properties of this setting; refer to wpa_supplicant documentation for the allowed combinations\&. +Anonymous identity string for EAP authentication methods\&. Used as the unencrypted identity with EAP types that support different tunneled identity like EAP\-TTLS\&. T} T{ -identity +ca\-cert T}:T{ -string +byte array T}:T{ \ \& T}:T{ -Identity string for EAP authentication methods\&. Often the user\*(Aqs user or login name\&. +Contains the CA certificate if used by the EAP method specified in the "eap" property\&. Certificate data is specified using a "scheme"; two are currently supported: blob and path\&. When using the blob scheme (which is backwards compatible with NM 0\&.7\&.x) this property should be set to the certificate\*(Aqs DER encoded data\&. When using the path scheme, this property should be set to the full UTF\-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte\&. This property can be unset even if the EAP method supports CA certificates, but this allows man\-in\-the\-middle attacks and is NOT recommended\&. T} T{ -anonymous\-identity +ca\-path T}:T{ string T}:T{ \ \& T}:T{ -Anonymous identity string for EAP authentication methods\&. Used as the unencrypted identity with EAP types that support different tunneled identity like EAP\-TTLS\&. +UTF\-8 encoded path to a directory containing PEM or DER formatted certificates to be added to the verification chain in addition to the certificate specified in the "ca\-cert" property\&. T} T{ -pac\-file +client\-cert T}:T{ -string +byte array T}:T{ \ \& T}:T{ -UTF\-8 encoded file path containing PAC for EAP\-FAST\&. +Contains the client certificate if used by the EAP method specified in the "eap" property\&. Certificate data is specified using a "scheme"; two are currently supported: blob and path\&. When using the blob scheme (which is backwards compatible with NM 0\&.7\&.x) this property should be set to the certificate\*(Aqs DER encoded data\&. When using the path scheme, this property should be set to the full UTF\-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte\&. T} T{ -ca\-cert +eap T}:T{ -byte array +array of string T}:T{ [] T}:T{ -Contains the CA certificate if used by the EAP method specified in the \*(Aqeap\*(Aq property\&. Certificate data is specified using a \*(Aqscheme\*(Aq; two are currently supported: blob and path\&. When using the blob scheme (which is backwards compatible with NM 0\&.7\&.x) this property should be set to the certificate\*(Aqs DER encoded data\&. When using the path scheme, this property should be set to the full UTF\-8 encoded path of the certificate, prefixed with the string \*(Aqfile://\*(Aq and ending with a terminating NULL byte\&. This property can be unset even if the EAP method supports CA certificates, but this allows man\-in\-the\-middle attacks and is NOT recommended\&. +The allowed EAP method to be used when authenticating to the network with 802\&.1x\&. Valid methods are: "leap", "md5", "tls", "peap", "ttls", "pwd", and "fast"\&. Each method requires different configuration using the properties of this setting; refer to wpa_supplicant documentation for the allowed combinations\&. T} T{ -ca\-path +identity T}:T{ string T}:T{ \ \& T}:T{ -UTF\-8 encoded path to a directory containing PEM or DER formatted certificates to be added to the verification chain in addition to the certificate specified in the \*(Aqca\-cert\*(Aq property\&. +Identity string for EAP authentication methods\&. Often the user\*(Aqs user or login name\&. T} T{ -subject\-match +name +T}:T{ +string +T}:T{ +802\-1x +T}:T{ +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. +T} +T{ +pac\-file T}:T{ string T}:T{ \ \& T}:T{ -Substring to be matched against the subject of the certificate presented by the authentication server\&. When unset, no verification of the authentication server certificate\*(Aqs subject is performed\&. +UTF\-8 encoded file path containing PAC for EAP\-FAST\&. T} T{ -altsubject\-matches +password T}:T{ -array of string +string T}:T{ \ \& T}:T{ -List of strings to be matched against the altSubjectName of the certificate presented by the authentication server\&. If the list is empty, no verification of the server certificate\*(Aqs altSubjectName is performed\&. +UTF\-8 encoded password used for EAP authentication methods\&. If both the "password" property and the "password\-raw" property are specified, "password" is preferred\&. T} T{ -client\-cert +password\-flags T}:T{ -byte array +NMSettingSecretFlags (uint32) T}:T{ -[] +\ \& T}:T{ -Contains the client certificate if used by the EAP method specified in the \*(Aqeap\*(Aq property\&. Certificate data is specified using a \*(Aqscheme\*(Aq; two are currently supported: blob and path\&. When using the blob scheme (which is backwards compatible with NM 0\&.7\&.x) this property should be set to the certificate\*(Aqs DER encoded data\&. When using the path scheme, this property should be set to the full UTF\-8 encoded path of the certificate, prefixed with the string \*(Aqfile://\*(Aq and ending with a terminating NULL byte\&. +Flags indicating how to handle the "password" property\&. (see the section called \(lqSecret flag types:\(rq for flag values) T} T{ -phase1\-peapver +password\-raw T}:T{ -string +byte array T}:T{ \ \& T}:T{ -Forces which PEAP version is used when PEAP is set as the EAP method in \*(Aqeap\*(Aq property\&. When unset, the version reported by the server will be used\&. Sometimes when using older RADIUS servers, it is necessary to force the client to use a particular PEAP version\&. To do so, this property may be set to \*(Aq0\*(Aq or \*(Aq1\*(Aq to force that specific PEAP version\&. +Password used for EAP authentication methods, given as a byte array to allow passwords in other encodings than UTF\-8 to be used\&. If both the "password" property and the "password\-raw" property are specified, "password" is preferred\&. T} T{ -phase1\-peaplabel +password\-raw\-flags T}:T{ -string +NMSettingSecretFlags (uint32) T}:T{ \ \& T}:T{ -Forces use of the new PEAP label during key derivation\&. Some RADIUS servers may require forcing the new PEAP label to interoperate with PEAPv1\&. Set to \*(Aq1\*(Aq to force use of the new PEAP label\&. See the wpa_supplicant documentation for more details\&. +Flags indicating how to handle the "password\-raw" property\&. (see the section called \(lqSecret flag types:\(rq for flag values) T} T{ phase1\-fast\-provisioning @@ -225,178 +234,169 @@ string T}:T{ \ \& T}:T{ -Enables or disables in\-line provisioning of EAP\-FAST credentials when FAST is specified as the EAP method in the #NMSetting8021x:eap property\&. Allowed values are \*(Aq0\*(Aq (disabled), \*(Aq1\*(Aq (allow unauthenticated provisioning), \*(Aq2\*(Aq (allow authenticated provisioning), and \*(Aq3\*(Aq (allow both authenticated and unauthenticated provisioning)\&. See the wpa_supplicant documentation for more details\&. +Enables or disables in\-line provisioning of EAP\-FAST credentials when FAST is specified as the EAP method in the "eap" property\&. Recognized values are "0" (disabled), "1" (allow unauthenticated provisioning), "2" (allow authenticated provisioning), and "3" (allow both authenticated and unauthenticated provisioning)\&. See the wpa_supplicant documentation for more details\&. T} T{ -phase2\-auth +phase1\-peaplabel T}:T{ string T}:T{ \ \& T}:T{ -Specifies the allowed \*(Aqphase 2\*(Aq inner non\-EAP authentication methods when an EAP method that uses an inner TLS tunnel is specified in the \*(Aqeap\*(Aq property\&. Recognized non\-EAP phase2 methods are \*(Aqpap\*(Aq, \*(Aqchap\*(Aq, \*(Aqmschap\*(Aq, \*(Aqmschapv2\*(Aq, \*(Aqgtc\*(Aq, \*(Aqotp\*(Aq, \*(Aqmd5\*(Aq, and \*(Aqtls\*(Aq\&. Each \*(Aqphase 2\*(Aq inner method requires specific parameters for successful authentication; see the wpa_supplicant documentation for more details\&. +Forces use of the new PEAP label during key derivation\&. Some RADIUS servers may require forcing the new PEAP label to interoperate with PEAPv1\&. Set to "1" to force use of the new PEAP label\&. See the wpa_supplicant documentation for more details\&. T} T{ -phase2\-autheap +phase1\-peapver T}:T{ string T}:T{ \ \& T}:T{ -Specifies the allowed \*(Aqphase 2\*(Aq inner EAP\-based authentication methods when an EAP method that uses an inner TLS tunnel is specified in the \*(Aqeap\*(Aq property\&. Recognized EAP\-based \*(Aqphase 2\*(Aq methods are \*(Aqmd5\*(Aq, \*(Aqmschapv2\*(Aq, \*(Aqotp\*(Aq, \*(Aqgtc\*(Aq, and \*(Aqtls\*(Aq\&. Each \*(Aqphase 2\*(Aq inner method requires specific parameters for successful authentication; see the wpa_supplicant documentation for more details\&. +Forces which PEAP version is used when PEAP is set as the EAP method in the "eap" property\&. When unset, the version reported by the server will be used\&. Sometimes when using older RADIUS servers, it is necessary to force the client to use a particular PEAP version\&. To do so, this property may be set to "0" or "1" to force that specific PEAP version\&. T} T{ -phase2\-ca\-cert +phase2\-altsubject\-matches T}:T{ -byte array +array of string T}:T{ [] T}:T{ -Contains the \*(Aqphase 2\*(Aq CA certificate if used by the EAP method specified in the \*(Aqphase2\-auth\*(Aq or \*(Aqphase2\-autheap\*(Aq properties\&. Certificate data is specified using a \*(Aqscheme\*(Aq; two are currentlysupported: blob and path\&. When using the blob scheme (which is backwards compatible with NM 0\&.7\&.x) this property should be set to the certificate\*(Aqs DER encoded data\&. When using the path scheme, this property should be set to the full UTF\-8 encoded path of the certificate, prefixed with the string \*(Aqfile://\*(Aq and ending with a terminating NULL byte\&. This property can be unset even if the EAP method supports CA certificates, but this allows man\-in\-the\-middle attacks and is NOT recommended\&. +List of strings to be matched against the altSubjectName of the certificate presented by the authentication server during the inner "phase 2" authentication\&. If the list is empty, no verification of the server certificate\*(Aqs altSubjectName is performed\&. T} T{ -phase2\-ca\-path +phase2\-auth T}:T{ string T}:T{ \ \& T}:T{ -UTF\-8 encoded path to a directory containing PEM or DER formatted certificates to be added to the verification chain in addition to the certificate specified in the \*(Aqphase2\-ca\-cert\*(Aq property\&. +Specifies the allowed "phase 2" inner non\-EAP authentication methods when an EAP method that uses an inner TLS tunnel is specified in the "eap" property\&. Recognized non\-EAP "phase 2" methods are "pap", "chap", "mschap", "mschapv2", "gtc", "otp", "md5", and "tls"\&. Each "phase 2" inner method requires specific parameters for successful authentication; see the wpa_supplicant documentation for more details\&. T} T{ -phase2\-subject\-match +phase2\-autheap T}:T{ string T}:T{ \ \& T}:T{ -Substring to be matched against the subject of the certificate presented by the authentication server during the inner \*(Aqphase2\*(Aq authentication\&. When unset, no verification of the authentication server certificate\*(Aqs subject is performed\&. +Specifies the allowed "phase 2" inner EAP\-based authentication methods when an EAP method that uses an inner TLS tunnel is specified in the "eap" property\&. Recognized EAP\-based "phase 2" methods are "md5", "mschapv2", "otp", "gtc", and "tls"\&. Each "phase 2" inner method requires specific parameters for successful authentication; see the wpa_supplicant documentation for more details\&. T} T{ -phase2\-altsubject\-matches +phase2\-ca\-cert T}:T{ -array of string +byte array T}:T{ \ \& T}:T{ -List of strings to be matched against List of strings to be matched against the altSubjectName of the certificate presented by the authentication server during the inner \*(Aqphase 2\*(Aq authentication\&. If the list is empty, no verification of the server certificate\*(Aqs altSubjectName is performed\&. +Contains the "phase 2" CA certificate if used by the EAP method specified in the "phase2\-auth" or "phase2\-autheap" properties\&. Certificate data is specified using a "scheme"; two are currently supported: blob and path\&. When using the blob scheme (which is backwards compatible with NM 0\&.7\&.x) this property should be set to the certificate\*(Aqs DER encoded data\&. When using the path scheme, this property should be set to the full UTF\-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte\&. This property can be unset even if the EAP method supports CA certificates, but this allows man\-in\-the\-middle attacks and is NOT recommended\&. T} T{ -phase2\-client\-cert +phase2\-ca\-path T}:T{ -byte array +string T}:T{ -[] +\ \& T}:T{ -Contains the \*(Aqphase 2\*(Aq client certificate if used by the EAP method specified in the \*(Aqphase2\-auth\*(Aq or \*(Aqphase2\-autheap\*(Aq properties\&. Certificate data is specified using a \*(Aqscheme\*(Aq; two are currently supported: blob and path\&. When using the blob scheme (which is backwards compatible with NM 0\&.7\&.x) this property should be set to the certificate\*(Aqs DER encoded data\&. When using the path scheme, this property should be set to the full UTF\-8 encoded path of the certificate, prefixed with the string \*(Aqfile://\*(Aq and ending with a terminating NULL byte\&. +UTF\-8 encoded path to a directory containing PEM or DER formatted certificates to be added to the verification chain in addition to the certificate specified in the "phase2\-ca\-cert" property\&. T} T{ -password +phase2\-client\-cert T}:T{ -string +byte array T}:T{ \ \& T}:T{ -UTF\-8 encoded password used for EAP authentication methods\&. +Contains the "phase 2" client certificate if used by the EAP method specified in the "phase2\-auth" or "phase2\-autheap" properties\&. Certificate data is specified using a "scheme"; two are currently supported: blob and path\&. When using the blob scheme (which is backwards compatible with NM 0\&.7\&.x) this property should be set to the certificate\*(Aqs DER encoded data\&. When using the path scheme, this property should be set to the full UTF\-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte\&. This property can be unset even if the EAP method supports CA certificates, but this allows man\-in\-the\-middle attacks and is NOT recommended\&. T} T{ -password\-flags +phase2\-private\-key T}:T{ -uint32 +byte array T}:T{ -0 +\ \& T}:T{ -Flags indicating how to handle the 802\&.1x password\&. (see the section called \(lqSecret flag types:\(rq for flag values) +Contains the "phase 2" inner private key when the "phase2\-auth" or "phase2\-autheap" property is set to "tls"\&. Key data is specified using a "scheme"; two are currently supported: blob and path\&. When using the blob scheme and private keys, this property should be set to the key\*(Aqs encrypted PEM encoded data\&. When using private keys with the path scheme, this property should be set to the full UTF\-8 encoded path of the key, prefixed with the string "file://" and ending with a terminating NUL byte\&. When using PKCS#12 format private keys and the blob scheme, this property should be set to the PKCS#12 data and the "phase2\-private\-key\-password" property must be set to password used to decrypt the PKCS#12 certificate and key\&. When using PKCS#12 files and the path scheme, this property should be set to the full UTF\-8 encoded path of the key, prefixed with the string "file://" and and ending with a terminating NUL byte, and as with the blob scheme the "phase2\-private\-key\-password" property must be set to the password used to decode the PKCS#12 private key and certificate\&. T} T{ -password\-raw +phase2\-private\-key\-password T}:T{ -byte array +string T}:T{ -[] +\ \& T}:T{ -Password used for EAP authentication methods, given as a byte array to allow passwords in other encodings than UTF\-8 to be used\&. If both \*(Aqpassword\*(Aq and \*(Aqpassword\-raw\*(Aq are given, \*(Aqpassword\*(Aq is preferred\&. +The password used to decrypt the "phase 2" private key specified in the "phase2\-private\-key" property when the private key either uses the path scheme, or is a PKCS#12 format key\&. T} T{ -password\-raw\-flags +phase2\-private\-key\-password\-flags T}:T{ -uint32 +NMSettingSecretFlags (uint32) T}:T{ -0 +\ \& T}:T{ -Flags indicating how to handle the 802\&.1x password byte array\&. (see the section called \(lqSecret flag types:\(rq for flag values) +Flags indicating how to handle the "phase2\-private\-key\-password" property\&. (see the section called \(lqSecret flag types:\(rq for flag values) T} T{ -private\-key +phase2\-subject\-match T}:T{ -byte array +string T}:T{ -[] +\ \& T}:T{ -Contains the private key when the \*(Aqeap\*(Aq property is set to \*(Aqtls\*(Aq\&. Key data is specified using a \*(Aqscheme\*(Aq; two are currently supported: blob and path\&. When using the blob scheme and private keys, this property should be set to the key\*(Aqs encrypted PEM encoded data\&. When using private keys with the path scheme, this property should be set to the full UTF\-8 encoded path of the key, prefixed with the string \*(Aqfile://\*(Aq and ending with a terminating NULL byte\&. When using PKCS#12 format private keys and the blob scheme, this property should be set to the PKCS#12 data and the \*(Aqprivate\-key\-password\*(Aq property must be set to password used to decrypt the PKCS#12 certificate and key\&. When using PKCS#12 files and the path scheme, this property should be set to the full UTF\-8 encoded path of the key, prefixed with the string \*(Aqfile://\*(Aq and and ending with a terminating NULL byte, and as with the blob scheme the \*(Aqprivate\-key\-password\*(Aq property must be set to the password used to decode the PKCS#12 private key and certificate\&. +Substring to be matched against the subject of the certificate presented by the authentication server during the inner "phase 2" authentication\&. When unset, no verification of the authentication server certificate\*(Aqs subject is performed\&. T} T{ -private\-key\-password +pin T}:T{ string T}:T{ \ \& T}:T{ -The password used to decrypt the private key specified in the \*(Aqprivate\-key\*(Aq property when the private key either uses the path scheme, or if the private key is a PKCS#12 format key\&. +PIN used for EAP authentication methods\&. T} T{ -private\-key\-password\-flags +pin\-flags T}:T{ -uint32 +NMSettingSecretFlags (uint32) T}:T{ -0 +\ \& T}:T{ -Flags indicating how to handle the 802\&.1x private key password\&. (see the section called \(lqSecret flag types:\(rq for flag values) +Flags indicating how to handle the "pin" property\&. (see the section called \(lqSecret flag types:\(rq for flag values) T} T{ -phase2\-private\-key +private\-key T}:T{ byte array T}:T{ -[] +\ \& T}:T{ -Contains the \*(Aqphase 2\*(Aq inner private key when the \*(Aqphase2\-auth\*(Aq or \*(Aqphase2\-autheap\*(Aq property is set to \*(Aqtls\*(Aq\&. Key data is specified using a \*(Aqscheme\*(Aq; two are currently supported: blob and path\&. When using the blob scheme and private keys, this property should be set to the key\*(Aqs encrypted PEM encoded data\&. When using private keys with the path scheme, this property should be set to the full UTF\-8 encoded path of the key, prefixed with the string \*(Aqfile://\*(Aq and ending with a terminating NULL byte\&. When using PKCS#12 format private keys and the blob scheme, this property should be set to the PKCS#12 data and the \*(Aqphase2\-private\-key\-password\*(Aq property must be set to password used to decrypt the PKCS#12 certificate and key\&. When using PKCS#12 files and the path scheme, this property should be set to the full UTF\-8 encoded path of the key, prefixed with the string \*(Aqfile://\*(Aq and and ending with a terminating NULL byte, and as with the blob scheme the \*(Aqphase2\-private\-key\-password\*(Aq property must be set to the password used to decode the PKCS#12 private key and certificate\&. +Contains the private key when the "eap" property is set to "tls"\&. Key data is specified using a "scheme"; two are currently supported: blob and path\&. When using the blob scheme and private keys, this property should be set to the key\*(Aqs encrypted PEM encoded data\&. When using private keys with the path scheme, this property should be set to the full UTF\-8 encoded path of the key, prefixed with the string "file://" and ending with a terminating NUL byte\&. When using PKCS#12 format private keys and the blob scheme, this property should be set to the PKCS#12 data and the "private\-key\-password" property must be set to password used to decrypt the PKCS#12 certificate and key\&. When using PKCS#12 files and the path scheme, this property should be set to the full UTF\-8 encoded path of the key, prefixed with the string "file://" and and ending with a terminating NUL byte, and as with the blob scheme the "private\-key\-password" property must be set to the password used to decode the PKCS#12 private key and certificate\&. WARNING: "private\-key" is not a "secret" property, and thus unencrypted private key data using the BLOB scheme may be readable by unprivileged users\&. Private keys should always be encrypted with a private key password to prevent unauthorized access to unencrypted private key data\&. T} T{ -phase2\-private\-key\-password +private\-key\-password T}:T{ string T}:T{ \ \& T}:T{ -The password used to decrypt the \*(Aqphase 2\*(Aq private key specified in the \*(Aqprivate\-key\*(Aq property when the phase2 private key either uses the path scheme, or if the phase2 private key is a PKCS#12 format key\&. +The password used to decrypt the private key specified in the "private\-key" property when the private key either uses the path scheme, or if the private key is a PKCS#12 format key\&. T} T{ -phase2\-private\-key\-password\-flags +private\-key\-password\-flags T}:T{ -uint32 +NMSettingSecretFlags (uint32) T}:T{ -0 +\ \& T}:T{ -Flags indicating how to handle the 802\&.1x phase2 private key password\&. (see the section called \(lqSecret flag types:\(rq for flag values) +Flags indicating how to handle the "private\-key\-password" property\&. (see the section called \(lqSecret flag types:\(rq for flag values) T} T{ -pin +subject\-match T}:T{ string T}:T{ \ \& T}:T{ -PIN used for EAP authentication methods\&. -T} -T{ -pin\-flags -T}:T{ -uint32 -T}:T{ -0 -T}:T{ -Flags indicating how to handle the 802\&.1x PIN\&. (see the section called \(lqSecret flag types:\(rq for flag values) +Substring to be matched against the subject of the certificate presented by the authentication server\&. When unset, no verification of the authentication server certificate\*(Aqs subject is performed\&. T} T{ system\-ca\-certs @@ -405,7 +405,7 @@ boolean T}:T{ FALSE T}:T{ -When TRUE, overrides \*(Aqca\-path\*(Aq and \*(Aqphase2\-ca\-path\*(Aq properties using the system CA directory specified at configure time with the \-\-system\-ca\-path switch\&. The certificates in this directory are added to the verification chain in addition to any certificates specified by the \*(Aqca\-cert\*(Aq and \*(Aqphase2\-ca\-cert\*(Aq properties\&. +When TRUE, overrides the "ca\-path" and "phase2\-ca\-path" properties using the system CA directory specified at configure time with the \-\-system\-ca\-path switch\&. The certificates in this directory are added to the verification chain in addition to any certificates specified by the "ca\-cert" and "phase2\-ca\-cert" properties\&. T} .TE .sp 1 @@ -437,22 +437,22 @@ l l l l l l l l l l l l. T{ -name +encapsulation T}:T{ string T}:T{ -adsl +\ \& T}:T{ -The setting\*(Aqs name; these names are defined by the specification and cannot be changed after the object has been created\&. Each setting class has a name, and all objects of that class share the same name\&. +Encapsulation of ADSL connection\&. Can be "vcmux" or "llc"\&. T} T{ -username +name T}:T{ string T}:T{ -\ \& +adsl T}:T{ -Username used to authenticate with the pppoa service\&. +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. T} T{ password @@ -461,16 +461,16 @@ string T}:T{ \ \& T}:T{ -Password used to authenticate with the pppoa service\&. +Password used to authenticate with the ADSL service\&. T} T{ password\-flags T}:T{ -uint32 +NMSettingSecretFlags (uint32) T}:T{ -0 +\ \& T}:T{ -Flags indicating how to handle the ADSL password\&. (see the section called \(lqSecret flag types:\(rq for flag values) +Flags indicating how to handle the "password" property\&. (see the section called \(lqSecret flag types:\(rq for flag values) T} T{ protocol @@ -479,34 +479,34 @@ string T}:T{ \ \& T}:T{ -ADSL connection protocol\&. +ADSL connection protocol\&. Can be "pppoa", "pppoe" or "ipoatm"\&. T} T{ -encapsulation +username T}:T{ string T}:T{ \ \& T}:T{ -Encapsulation of ADSL connection +Username used to authenticate with the ADSL service\&. T} T{ -vpi +vci T}:T{ uint32 T}:T{ 0 T}:T{ -VPI of ADSL connection +VCI of ADSL connection T} T{ -vci +vpi T}:T{ uint32 T}:T{ 0 T}:T{ -VCI of ADSL connection +VPI of ADSL connection T} .TE .sp 1 @@ -533,22 +533,22 @@ l l l l l l l l l l l l. T{ -name +bdaddr T}:T{ -string +byte array T}:T{ -bluetooth +\ \& T}:T{ -The setting\*(Aqs name; these names are defined by the specification and cannot be changed after the object has been created\&. Each setting class has a name, and all objects of that class share the same name\&. +The Bluetooth address of the device\&. T} T{ -bdaddr +name T}:T{ -byte array +string T}:T{ -[] +bluetooth T}:T{ -The Bluetooth address of the device +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. T} T{ type @@ -557,7 +557,7 @@ string T}:T{ \ \& T}:T{ -Either \*(Aqdun\*(Aq for Dial\-Up Networking connections or \*(Aqpanu\*(Aq for Personal Area Networking connections\&. +Either "dun" for Dial\-Up Networking connections or "panu" for Personal Area Networking connections to devices supporting the NAP profile\&. T} .TE .sp 1 @@ -584,31 +584,31 @@ l l l l l l l l l l l l. T{ -name +interface\-name T}:T{ string T}:T{ -bond +\ \& T}:T{ -The setting\*(Aqs name; these names are defined by the specification and cannot be changed after the object has been created\&. Each setting class has a name, and all objects of that class share the same name\&. +Deprecated in favor of connection\&.interface\-name, but can be used for backward\-compatibility with older daemons, to set the bond\*(Aqs interface name\&. T} T{ -interface\-name +name T}:T{ string T}:T{ -\ \& +bond T}:T{ -The name of the virtual in\-kernel bonding network interface +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. T} T{ options T}:T{ -dict of (string::string) +dict of string to string T}:T{ \ \& T}:T{ -Dictionary of key/value pairs of bonding options\&. Both keys and values must be strings\&. Option names must contain only alphanumeric characters (ie, [a\-zA\-Z0\-9])\&. +Dictionary of key/value pairs of bonding options\&. Both keys and values must be strings\&. Option names must contain only alphanumeric characters (ie, [a\-zA\-Z0\-9])\&. T} .TE .sp 1 @@ -641,85 +641,85 @@ l l l l l l l l l l l l. T{ -name +ageing\-time T}:T{ -string +uint32 T}:T{ -bridge +300 T}:T{ -The setting\*(Aqs name; these names are defined by the specification and cannot be changed after the object has been created\&. Each setting class has a name, and all objects of that class share the same name\&. +The Ethernet MAC address aging time, in seconds\&. T} T{ -interface\-name +forward\-delay T}:T{ -string +uint32 T}:T{ -\ \& +15 T}:T{ -The name of the virtual in\-kernel bridging network interface +The Spanning Tree Protocol (STP) forwarding delay, in seconds\&. T} T{ -mac\-address +hello\-time T}:T{ -byte array +uint32 T}:T{ -[] +2 T}:T{ -The MAC address of the bridge +The Spanning Tree Protocol (STP) hello time, in seconds\&. T} T{ -stp +interface\-name T}:T{ -boolean +string T}:T{ -TRUE +\ \& T}:T{ -Controls whether Spanning Tree Protocol (STP) is enabled for this bridge\&. +Deprecated in favor of connection\&.interface\-name, but can be used for backward\-compatibility with older daemons, to set the bridge\*(Aqs interface name\&. T} T{ -priority +mac\-address T}:T{ -uint32 +byte array T}:T{ -32768 +\ \& T}:T{ -Sets the Spanning Tree Protocol (STP) priority for this bridge\&. Lower values are \*(Aqbetter\*(Aq; the lowest priority bridge will be elected the root bridge\&. +If specified, the MAC address of bridge\&. When creating a new bridge, this MAC address will be set\&. When matching an existing (outside NetworkManager created) bridge, this MAC address must match\&. T} T{ -forward\-delay +max\-age T}:T{ uint32 T}:T{ -15 +20 T}:T{ -The Spanning Tree Protocol (STP) forwarding delay, in seconds\&. +The Spanning Tree Protocol (STP) maximum message age, in seconds\&. T} T{ -hello\-time +name T}:T{ -uint32 +string T}:T{ -2 +bridge T}:T{ -The Spanning Tree Protocol (STP) hello time, in seconds\&. +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. T} T{ -max\-age +priority T}:T{ uint32 T}:T{ -20 +32768 T}:T{ -The Spanning Tree Protocol (STP) maximum message age, in seconds\&. +Sets the Spanning Tree Protocol (STP) priority for this bridge\&. Lower values are "better"; the lowest priority bridge will be elected the root bridge\&. T} T{ -ageing\-time +stp T}:T{ -uint32 +boolean T}:T{ -300 +TRUE T}:T{ -The Ethernet MAC address aging time, in seconds\&. +Controls whether Spanning Tree Protocol (STP) is enabled for this bridge\&. T} .TE .sp 1 @@ -747,22 +747,22 @@ l l l l l l l l l l l l. T{ -name +hairpin\-mode T}:T{ -string +boolean T}:T{ -bridge\-port +FALSE T}:T{ -The setting\*(Aqs name; these names are defined by the specification and cannot be changed after the object has been created\&. Each setting class has a name, and all objects of that class share the same name\&. +Enables or disabled "hairpin mode" for the port, which allows frames to be sent back out through the port the frame was received on\&. T} T{ -priority +name T}:T{ -uint32 +string T}:T{ -32 +bridge\-port T}:T{ -The Spanning Tree Protocol (STP) priority of this bridge port +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. T} T{ path\-cost @@ -774,13 +774,13 @@ T}:T{ The Spanning Tree Protocol (STP) port cost for destinations via this port\&. T} T{ -hairpin\-mode +priority T}:T{ -boolean +uint32 T}:T{ -FALSE +32 T}:T{ -Enables or disabled \*(Aqhairpin mode\*(Aq for the port, which allows frames to be sent back out through the port the frame was received on\&. +The Spanning Tree Protocol (STP) priority of this bridge port\&. T} .TE .sp 1 @@ -815,7 +815,7 @@ string T}:T{ cdma T}:T{ -The setting\*(Aqs name; these names are defined by the specification and cannot be changed after the object has been created\&. Each setting class has a name, and all objects of that class share the same name\&. +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. T} T{ number @@ -824,34 +824,34 @@ string T}:T{ \ \& T}:T{ -Number to dial when establishing a PPP data session with the CDMA\-based mobile broadband network\&. If not specified, the default number (#777) is used when required\&. +The number to dial to establish the connection to the CDMA\-based mobile broadband network, if any\&. If not specified, the default number (#777) is used when required\&. T} T{ -username +password T}:T{ string T}:T{ \ \& T}:T{ -Username used to authenticate with the network, if required\&. Note that many providers do not require a username or accept any username\&. +The password used to authenticate with the network, if required\&. Many providers do not require a password, or accept any password\&. But if a password is required, it is specified here\&. T} T{ -password +password\-flags T}:T{ -string +NMSettingSecretFlags (uint32) T}:T{ \ \& T}:T{ -Password used to authenticate with the network, if required\&. Note that many providers do not require a password or accept any password\&. +Flags indicating how to handle the "password" property\&. (see the section called \(lqSecret flag types:\(rq for flag values) T} T{ -password\-flags +username T}:T{ -uint32 +string T}:T{ -0 +\ \& T}:T{ -Flags indicating how to handle the CDMA password\&. (see the section called \(lqSecret flag types:\(rq for flag values) +The username used to authenticate with the network, if required\&. Many providers do not require a username, or accept any username\&. But if a username is required, it is specified here\&. T} .TE .sp 1 @@ -887,78 +887,79 @@ l l l l l l l l l l l l l l l l +l l l l l l l l. T{ -name +autoconnect T}:T{ -string +boolean T}:T{ -connection +TRUE T}:T{ -The setting\*(Aqs name; these names are defined by the specification and cannot be changed after the object has been created\&. Each setting class has a name, and all objects of that class share the same name\&. +Whether or not the connection should be automatically connected by NetworkManager when the resources for the connection are available\&. TRUE to automatically activate the connection, FALSE to require manual intervention to activate the connection\&. T} T{ -id +autoconnect\-priority T}:T{ -string +int32 T}:T{ -\ \& +0 T}:T{ -User\-readable connection identifier/name\&. Must be one or more characters and may change over the lifetime of the connection if the user decides to rename it\&. +The autoconnect priority\&. If the connection is set to autoconnect, connections with higher priority will be preferred\&. Defaults to 0\&. The higher number means higher priority\&. T} T{ -uuid +gateway\-ping\-timeout T}:T{ -string +uint32 T}:T{ -\ \& +0 T}:T{ -Universally unique connection identifier\&. Must be in the format \*(Aq2815492f\-7e56\-435e\-b2e9\-246bd7cdc664\*(Aq (ie, contains only hexadecimal characters and \*(Aq\-\*(Aq)\&. The UUID should be assigned when the connection is created and never changed as long as the connection still applies to the same network\&. For example, it should not be changed when the user changes the connection\*(Aqs \*(Aqid\*(Aq, but should be recreated when the Wi\-Fi SSID, mobile broadband network provider, or the connection type changes\&. +If greater than zero, delay success of IP addressing until either the timeout is reached, or an IP gateway replies to a ping\&. T} T{ -interface\-name +id T}:T{ string T}:T{ \ \& T}:T{ -Interface name this connection is bound to\&. If not set, then the connection can be attached to any interface of the appropriate type (subject to restrictions imposed by other settings)\&. For connection types where interface names cannot easily be made persistent (e\&.g\&. mobile broadband or USB Ethernet), this property should not be used\&. Setting this property restricts the interfaces a connection can be used with, and if interface names change or are reordered the connection may be applied to the wrong interface\&. +A human readable unique identifier for the connection, like "Work Wi\-Fi" or "T\-Mobile 3G"\&. T} T{ -type +interface\-name T}:T{ string T}:T{ \ \& T}:T{ -Base type of the connection\&. For hardware\-dependent connections, should contain the setting name of the hardware\-type specific setting (ie, \*(Aq802\-3\-ethernet\*(Aq or \*(Aq802\-11\-wireless\*(Aq or \*(Aqbluetooth\*(Aq, etc), and for non\-hardware dependent connections like VPN or otherwise, should contain the setting name of that setting type (ie, \*(Aqvpn\*(Aq or \*(Aqbridge\*(Aq, etc)\&. +The name of the network interface this connection is bound to\&. If not set, then the connection can be attached to any interface of the appropriate type (subject to restrictions imposed by other settings)\&. For software devices this specifies the name of the created device\&. For connection types where interface names cannot easily be made persistent (e\&.g\&. mobile broadband or USB Ethernet), this property should not be used\&. Setting this property restricts the interfaces a connection can be used with, and if interface names change or are reordered the connection may be applied to the wrong interface\&. T} T{ -permissions +master T}:T{ -array of string +string T}:T{ \ \& T}:T{ -An array of strings defining what access a given user has to this connection\&. If this is NULL or empty, all users are allowed to access this connection\&. Otherwise a user is allowed to access this connection if and only if they are in this array\&. Each entry is of the form "[type]:[id]:[reserved]", for example: "user:dcbw:blah" At this time only the \*(Aquser\*(Aq [type] is allowed\&. Any other values are ignored and reserved for future use\&. [id] is the username that this permission refers to, which may not contain the \*(Aq:\*(Aq character\&. Any [reserved] information (if present) must be ignored and is reserved for future use\&. All of [type], [id], and [reserved] must be valid UTF\-8\&. +Interface name of the master device or UUID of the master connection\&. T} T{ -autoconnect +name T}:T{ -boolean +string T}:T{ -TRUE +connection T}:T{ -If TRUE, NetworkManager will activate this connection when its network resources are available\&. If FALSE, the connection must be manually activated by the user or some other mechanism\&. +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. T} T{ -timestamp +permissions T}:T{ -uint64 +array of string T}:T{ -0 +[] T}:T{ -Timestamp (in seconds since the Unix Epoch) that the connection was last successfully activated\&. NetworkManager updates the connection timestamp periodically when the connection is active to ensure that an active connection has the latest timestamp\&. The property is only meant for reading (changes to this property will not be preserved)\&. +An array of strings defining what access a given user has to this connection\&. If this is NULL or empty, all users are allowed to access this connection\&. Otherwise a user is allowed to access this connection if and only if they are in this list\&. Each entry is of the form "[type]:[id]:[reserved]"; for example, "user:dcbw:blah"\&. At this time only the "user" [type] is allowed\&. Any other values are ignored and reserved for future use\&. [id] is the username that this permission refers to, which may not contain the ":" character\&. Any [reserved] information present must be ignored and is reserved for future use\&. All of [type], [id], and [reserved] must be valid UTF\-8\&. T} T{ read\-only @@ -967,52 +968,61 @@ boolean T}:T{ FALSE T}:T{ -If TRUE, the connection is read\-only and cannot be changed by the user or any other mechanism\&. This is normally set for system connections whose plugin cannot yet write updated connections back out\&. +FALSE if the connection can be modified using the provided settings service\*(Aqs D\-Bus interface with the right privileges, or TRUE if the connection is read\-only and cannot be modified\&. T} T{ -zone +secondaries T}:T{ -string +array of string T}:T{ -\ \& +[] T}:T{ -The trust level of a the connection\&.Free form case\-insensitive string (for example "Home", "Work", "Public")\&. NULL or unspecified zone means the connection will be placed in the default zone as defined by the firewall\&. +List of connection UUIDs that should be activated when the base connection itself is activated\&. Currently only VPN connections are supported\&. T} T{ -master +slave\-type T}:T{ string T}:T{ \ \& T}:T{ -Interface name of the master device or UUID of the master connection +Setting name of the device type of this slave\*(Aqs master connection (eg, "bond"), or NULL if this connection is not a slave\&. T} T{ -slave\-type +timestamp +T}:T{ +uint64 +T}:T{ +0 +T}:T{ +The time, in seconds since the Unix Epoch, that the connection was last _successfully_ fully activated\&. NetworkManager updates the connection timestamp periodically when the connection is active to ensure that an active connection has the latest timestamp\&. The property is only meant for reading (changes to this property will not be preserved)\&. +T} +T{ +type T}:T{ string T}:T{ \ \& T}:T{ -Setting name describing the type of slave this connection is (ie, \*(Aqbond\*(Aq) or NULL if this connection is not a slave\&. +Base type of the connection\&. For hardware\-dependent connections, should contain the setting name of the hardware\-type specific setting (ie, "802\-3\-ethernet" or "802\-11\-wireless" or "bluetooth", etc), and for non\-hardware dependent connections like VPN or otherwise, should contain the setting name of that setting type (ie, "vpn" or "bridge", etc)\&. T} T{ -secondaries +uuid T}:T{ -array of string +string T}:T{ \ \& T}:T{ -List of connection UUIDs that should be activated when the base connection itself is activated\&. Currently only VPN connections are supported\&. +A universally unique identifier for the connection, for example generated with libuuid\&. It should be assigned when the connection is created, and never changed as long as the connection still applies to the same network\&. For example, it should not be changed when the "id" property or NMSettingIP4Config changes, but might need to be re\-created when the Wi\-Fi SSID, mobile broadband network provider, or "type" property changes\&. The UUID must be in the format "2815492f\-7e56\-435e\-b2e9\-246bd7cdc664" (ie, contains only hexadecimal characters and "\-")\&. T} T{ -gateway\-ping\-timeout +zone T}:T{ -uint32 +string T}:T{ -0 +\ \& T}:T{ -If greater than zero, delay success of IP addressing until either the timeout is reached, or an IP gateway replies to a ping\&. +The trust level of a the connection\&. Free form case\-insensitive string (for example "Home", "Work", "Public")\&. NULL or unspecified zone means the connection will be placed in the default zone as defined by the firewall\&. T} .TE .sp 1 @@ -1052,22 +1062,22 @@ l l l l l l l l l l l l. T{ -name +app\-fcoe\-flags T}:T{ -string +NMSettingDcbFlags (uint32) T}:T{ -dcb +\ \& T}:T{ -The setting\*(Aqs name; these names are defined by the specification and cannot be changed after the object has been created\&. Each setting class has a name, and all objects of that class share the same name\&. +Specifies the NMSettingDcbFlags for the DCB FCoE application\&. Flags may be any combination of NM_SETTING_DCB_FLAG_ENABLE (0x1), NM_SETTING_DCB_FLAG_ADVERTISE (0x2), and NM_SETTING_DCB_FLAG_WILLING (0x4)\&. T} T{ -app\-fcoe\-flags +app\-fcoe\-mode T}:T{ -uint32 +string T}:T{ -0 +"fabric" T}:T{ -Specifies the flags for the DCB FCoE application\&. Flags may be any combination of 0x1 (enable), 0x2 (advertise), and 0x4 (willing)\&. (see the section called \(lqSecret flag types:\(rq for flag values) +The FCoE controller mode; either "fabric" (default) or "vn2vn"\&. T} T{ app\-fcoe\-priority @@ -1076,88 +1086,79 @@ int32 T}:T{ \-1 T}:T{ -The highest User Priority (0 \- 7) which FCoE frames should use, or \-1 for default priority\&. Only used when the \*(Aqapp\-fcoe\-flags\*(Aq property includes the \*(Aqenabled\*(Aq flag\&. -T} -T{ -app\-fcoe\-mode -T}:T{ -string -T}:T{ -"fabric" -T}:T{ -The FCoe controller mode; either \*(Aqfabric\*(Aq (default) or \*(Aqvn2vn\*(Aq\&. +The highest User Priority (0 \- 7) which FCoE frames should use, or \-1 for default priority\&. Only used when the "app\-fcoe\-flags" property includes the NM_SETTING_DCB_FLAG_ENABLE (0x1) flag\&. T} T{ -app\-iscsi\-flags +app\-fip\-flags T}:T{ -uint32 +NMSettingDcbFlags (uint32) T}:T{ -0 +\ \& T}:T{ -Specifies the flags for the DCB iSCSI application\&. Flags may be any combination of 0x1 (enable), 0x2 (advertise), and 0x4 (willing)\&. (see the section called \(lqSecret flag types:\(rq for flag values) +Specifies the NMSettingDcbFlags for the DCB FIP application\&. Flags may be any combination of NM_SETTING_DCB_FLAG_ENABLE (0x1), NM_SETTING_DCB_FLAG_ADVERTISE (0x2), and NM_SETTING_DCB_FLAG_WILLING (0x4)\&. T} T{ -app\-iscsi\-priority +app\-fip\-priority T}:T{ int32 T}:T{ \-1 T}:T{ -The highest User Priority (0 \- 7) which iSCSI frames should use, or \-1 for default priority\&. Only used when the \*(Aqapp\-iscsi\-flags\*(Aq property includes the \*(Aqenabled\*(Aq flag\&. +The highest User Priority (0 \- 7) which FIP frames should use, or \-1 for default priority\&. Only used when the "app\-fip\-flags" property includes the NM_SETTING_DCB_FLAG_ENABLE (0x1) flag\&. T} T{ -app\-fip\-flags +app\-iscsi\-flags T}:T{ -uint32 +NMSettingDcbFlags (uint32) T}:T{ -0 +\ \& T}:T{ -Specifies the flags for the DCB FIP application\&. Flags may be any combination of 0x1 (enable), 0x2 (advertise), and 0x4 (willing)\&. (see the section called \(lqSecret flag types:\(rq for flag values) +Specifies the NMSettingDcbFlags for the DCB iSCSI application\&. Flags may be any combination of NM_SETTING_DCB_FLAG_ENABLE (0x1), NM_SETTING_DCB_FLAG_ADVERTISE (0x2), and NM_SETTING_DCB_FLAG_WILLING (0x4)\&. T} T{ -app\-fip\-priority +app\-iscsi\-priority T}:T{ int32 T}:T{ \-1 T}:T{ -The highest User Priority (0 \- 7) which FIP frames should use, or \-1 for default priority\&. Only used when the \*(Aqapp\-fip\-flags\*(Aq property includes the \*(Aqenabled\*(Aq flag\&. +The highest User Priority (0 \- 7) which iSCSI frames should use, or \-1 for default priority\&. Only used when the "app\-iscsi\-flags" property includes the NM_SETTING_DCB_FLAG_ENABLE (0x1) flag\&. T} T{ -priority\-flow\-control\-flags +name T}:T{ -uint32 +string T}:T{ -0 +dcb T}:T{ -Specifies the flags for DCB Priority Flow Control\&. Flags may be any combination of 0x1 (enable), 0x2 (advertise), and 0x4 (willing)\&. (see the section called \(lqSecret flag types:\(rq for flag values) +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. T} T{ -priority\-flow\-control +priority\-bandwidth T}:T{ array of uint32 T}:T{ \ \& T}:T{ -An array of 8 uint values, where the array index corresponds to the User Priority (0 \- 7) and the value indicates whether or not the corresponding priority should transmit priority pause\&. Allowed values are 0 (do not transmit pause) and 1 (transmit pause)\&. +An array of 8 uint values, where the array index corresponds to the User Priority (0 \- 7) and the value indicates the percentage of bandwidth of the priority\*(Aqs assigned group that the priority may use\&. The sum of all percentages for priorities which belong to the same group must total 100 percent\&. T} T{ -priority\-group\-flags +priority\-flow\-control T}:T{ -uint32 +array of uint32 T}:T{ -0 +\ \& T}:T{ -Specifies the flags for DCB Priority Groups\&. Flags may be any combination of 0x1 (enable), 0x2 (advertise), and 0x4 (willing)\&. (see the section called \(lqSecret flag types:\(rq for flag values) +An array of 8 boolean values, where the array index corresponds to the User Priority (0 \- 7) and the value indicates whether or not the corresponding priority should transmit priority pause\&. T} T{ -priority\-group\-id +priority\-flow\-control\-flags T}:T{ -array of uint32 +NMSettingDcbFlags (uint32) T}:T{ \ \& T}:T{ -An array of 8 uint values, where the array index corresponds to the User Priority (0 \- 7) and the value indicates the Priority Group ID\&. Allowed Priority Group ID values are 0 \- 7 or 15 for the unrestricted group\&. +Specifies the NMSettingDcbFlags for DCB Priority Flow Control (PFC)\&. Flags may be any combination of NM_SETTING_DCB_FLAG_ENABLE (0x1), NM_SETTING_DCB_FLAG_ADVERTISE (0x2), and NM_SETTING_DCB_FLAG_WILLING (0x4)\&. T} T{ priority\-group\-bandwidth @@ -1169,13 +1170,22 @@ T}:T{ An array of 8 uint values, where the array index corresponds to the Priority Group ID (0 \- 7) and the value indicates the percentage of link bandwidth allocated to that group\&. Allowed values are 0 \- 100, and the sum of all values must total 100 percent\&. T} T{ -priority\-bandwidth +priority\-group\-flags +T}:T{ +NMSettingDcbFlags (uint32) +T}:T{ +\ \& +T}:T{ +Specifies the NMSettingDcbFlags for DCB Priority Groups\&. Flags may be any combination of NM_SETTING_DCB_FLAG_ENABLE (0x1), NM_SETTING_DCB_FLAG_ADVERTISE (0x2), and NM_SETTING_DCB_FLAG_WILLING (0x4)\&. +T} +T{ +priority\-group\-id T}:T{ array of uint32 T}:T{ \ \& T}:T{ -An array of 8 uint values, where the array index corresponds to the User Priority (0 \- 7) and the value indicates the percentage of bandwidth of the priority\*(Aqs assigned group that the priority may use\&. The sum of all percentages for priorities which belong to the same group must total 100 percent\&. +An array of 8 uint values, where the array index corresponds to the User Priority (0 \- 7) and the value indicates the Priority Group ID\&. Allowed Priority Group ID values are 0 \- 7 or 15 for the unrestricted group\&. T} T{ priority\-strict\-bandwidth @@ -1184,7 +1194,7 @@ array of uint32 T}:T{ \ \& T}:T{ -An array of 8 uint values, where the array index corresponds to the User Priority (0 \- 7) and the value indicates whether or not the priority may use all of the bandwidth allocated to its assigned group\&. Allowed values are 0 (the priority may not utilize all bandwidth) or 1 (the priority may utilize all bandwidth)\&. +An array of 8 boolean values, where the array index corresponds to the User Priority (0 \- 7) and the value indicates whether or not the priority may use all of the bandwidth allocated to its assigned group\&. T} T{ priority\-traffic\-class @@ -1202,7 +1212,38 @@ T} .nr an-no-space-flag 1 .nr an-break-flag 1 .br -.B Table\ \&10.\ \&gsm setting +.B Table\ \&10.\ \&generic setting +.TS +allbox tab(:); +lB lB lB lB. +T{ +Key Name +T}:T{ +Value Type +T}:T{ +Default Value +T}:T{ +Value Description +T} +.T& +l l l l. +T{ +name +T}:T{ +string +T}:T{ +generic +T}:T{ +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. +T} +.TE +.sp 1 +.sp +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.B Table\ \&11.\ \&gsm setting .TS allbox tab(:); lB lB lB lB. @@ -1216,8 +1257,6 @@ T}:T{ Value Description T} .T& -l l l l -l l l l l l l l l l l l l l l l @@ -1229,76 +1268,67 @@ l l l l l l l l l l l l. T{ -name +apn T}:T{ string T}:T{ -gsm +\ \& T}:T{ -The setting\*(Aqs name; these names are defined by the specification and cannot be changed after the object has been created\&. Each setting class has a name, and all objects of that class share the same name\&. +The GPRS Access Point Name specifying the APN used when establishing a data session with the GSM\-based network\&. The APN often determines how the user will be billed for their network usage and whether the user has access to the Internet or just a provider\-specific walled\-garden, so it is important to use the correct APN for the user\*(Aqs mobile broadband plan\&. The APN may only be composed of the characters a\-z, 0\-9, \&., and \- per GSM 03\&.60 Section 14\&.9\&. T} T{ -number +home\-only T}:T{ -string +boolean T}:T{ -\ \& +FALSE T}:T{ -Number to dial when establishing a PPP data session with the GSM\-based mobile broadband network\&. Many modems do not require PPP for connections to the mobile network and thus this property should be left blank, which allows NetworkManager to select the appropriate settings automatically\&. +When TRUE, only connections to the home network will be allowed\&. Connections to roaming networks will not be made\&. T} T{ -username +name T}:T{ string T}:T{ -\ \& +gsm T}:T{ -Username used to authenticate with the network, if required\&. Note that many providers do not require a username or accept any username\&. +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. T} T{ -password +network\-id T}:T{ string T}:T{ \ \& T}:T{ -Password used to authenticate with the network, if required\&. Note that many providers do not require a password or accept any password\&. +The Network ID (GSM LAI format, ie MCC\-MNC) to force specific network registration\&. If the Network ID is specified, NetworkManager will attempt to force the device to register only on the specified network\&. This can be used to ensure that the device does not roam when direct roaming control of the device is not otherwise possible\&. T} T{ -password\-flags -T}:T{ -uint32 -T}:T{ -0 -T}:T{ -Flags indicating how to handle the GSM password\&. (see the section called \(lqSecret flag types:\(rq for flag values) -T} -T{ -apn +number T}:T{ string T}:T{ \ \& T}:T{ -The GPRS Access Point Name specifying the APN used when establishing a data session with the GSM\-based network\&. The APN often determines how the user will be billed for their network usage and whether the user has access to the Internet or just a provider\-specific walled\-garden, so it is important to use the correct APN for the user\*(Aqs mobile broadband plan\&. The APN may only be composed of the characters a\-z, 0\-9, \&., and \- per GSM 03\&.60 Section 14\&.9\&. +Number to dial when establishing a PPP data session with the GSM\-based mobile broadband network\&. Many modems do not require PPP for connections to the mobile network and thus this property should be left blank, which allows NetworkManager to select the appropriate settings automatically\&. T} T{ -network\-id +password T}:T{ string T}:T{ \ \& T}:T{ -The Network ID (GSM LAI format, ie MCC\-MNC) to force specific network registration\&. If the Network ID is specified, NetworkManager will attempt to force the device to register only on the specified network\&. This can be used to ensure that the device does not roam when direct roaming control of the device is not otherwise possible\&. +The password used to authenticate with the network, if required\&. Many providers do not require a password, or accept any password\&. But if a password is required, it is specified here\&. T} T{ -network\-type +password\-flags T}:T{ -int32 +NMSettingSecretFlags (uint32) T}:T{ -\-1 +\ \& T}:T{ -Network preference to force the device to only use specific network technologies\&. The permitted values are: \-1: any, 0: 3G only, 1: GPRS/EDGE only, 2: prefer 3G, 3: prefer 2G, 4: prefer 4G/LTE, 5: 4G/LTE only\&. Notes: This property is deprecated and NetworkManager from 0\&.9\&.10 onwards doesn\*(Aqt use this property when talking to ModemManager\&.Also, not all devices allow network preference control\&. +Flags indicating how to handle the "password" property\&. (see the section called \(lqSecret flag types:\(rq for flag values) T} T{ pin @@ -1312,29 +1342,20 @@ T} T{ pin\-flags T}:T{ -uint32 -T}:T{ -0 +NMSettingSecretFlags (uint32) T}:T{ -Flags indicating how to handle the GSM SIM PIN\&. (see the section called \(lqSecret flag types:\(rq for flag values) -T} -T{ -allowed\-bands -T}:T{ -uint32 -T}:T{ -1 +\ \& T}:T{ -Bitfield of allowed frequency bands\&.Notes: This property is deprecated and NetworkManager from 0\&.9\&.10 onwards doesn\*(Aqt use this property when talking to ModemManager\&.Also, not all devices allow frequency band control\&. +Flags indicating how to handle the "pin" property\&. (see the section called \(lqSecret flag types:\(rq for flag values) T} T{ -home\-only +username T}:T{ -boolean +string T}:T{ -FALSE +\ \& T}:T{ -When TRUE, only connections to the home network will be allowed\&. Connections to roaming networks will not be made\&. +The username used to authenticate with the network, if required\&. Many providers do not require a username, or accept any username\&. But if a username is required, it is specified here\&. T} .TE .sp 1 @@ -1343,7 +1364,7 @@ T} .nr an-no-space-flag 1 .nr an-break-flag 1 .br -.B Table\ \&11.\ \&infiniband setting +.B Table\ \&12.\ \&infiniband setting .TS allbox tab(:); lB lB lB lB. @@ -1364,22 +1385,13 @@ l l l l l l l l l l l l. T{ -name -T}:T{ -string -T}:T{ -infiniband -T}:T{ -The setting\*(Aqs name; these names are defined by the specification and cannot be changed after the object has been created\&. Each setting class has a name, and all objects of that class share the same name\&. -T} -T{ mac\-address T}:T{ byte array T}:T{ -[] +\ \& T}:T{ -If specified, this connection will only apply to the IPoIB device whose permanent MAC address matches\&. This property does not change the MAC address of the device (i\&.e\&. MAC spoofing)\&. +If specified, this connection will only apply to the IPoIB device whose permanent MAC address matches\&. This property does not change the MAC address of the device (i\&.e\&. MAC spoofing)\&. T} T{ mtu @@ -1391,13 +1403,13 @@ T}:T{ If non\-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple frames\&. T} T{ -transport\-mode +name T}:T{ string T}:T{ -\ \& +infiniband T}:T{ -The IPoIB transport mode\&. Either \*(Aqdatagram\*(Aq or \*(Aqconnected\*(Aq\&. +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. T} T{ p\-key @@ -1406,7 +1418,7 @@ int32 T}:T{ \-1 T}:T{ -The InfiniBand P_Key\&. Either \-1 for the default, or a 16\-bit unsigned integer\&. +The InfiniBand P_Key to use for this device\&. A value of \-1 means to use the default P_Key (aka "the P_Key at index 0")\&. Otherwise it is a 16\-bit unsigned integer, whose high bit is set if it is a "full membership" P_Key\&. T} T{ parent @@ -1415,7 +1427,16 @@ string T}:T{ \ \& T}:T{ -The interface name of the parent device, or NULL +The interface name of the parent device of this device\&. Normally NULL, but if the "p_key" property is set, then you must specify the base device by setting either this property or "mac\-address"\&. +T} +T{ +transport\-mode +T}:T{ +string +T}:T{ +\ \& +T}:T{ +The IP\-over\-InfiniBand transport mode\&. Either "datagram" or "connected"\&. T} .TE .sp 1 @@ -1424,7 +1445,7 @@ T} .nr an-no-space-flag 1 .nr an-break-flag 1 .br -.B Table\ \&12.\ \&ipv4 setting +.B Table\ \&13.\ \&ipv4 setting .TS allbox tab(:); lB lB lB lB. @@ -1451,78 +1472,81 @@ l l l l l l l l l l l l l l l l +l l l l +l l l l +l l l l l l l l. T{ -name +address\-data T}:T{ -string +array of vardict T}:T{ -ipv4 +\ \& T}:T{ -The setting\*(Aqs name; these names are defined by the specification and cannot be changed after the object has been created\&. Each setting class has a name, and all objects of that class share the same name\&. +Array of IPv4 addresses\&. Each address dictionary contains at least \*(Aqaddress\*(Aq and \*(Aqprefix\*(Aq entries, containing the IP address as a string, and the prefix length as a uint32\&. Additional attributes may also exist on some addresses\&. T} T{ -method +addresses T}:T{ -string +array of array of uint32 T}:T{ \ \& T}:T{ -IPv4 configuration method\&. If \*(Aqauto\*(Aq is specified then the appropriate automatic method (DHCP, PPP, etc) is used for the interface and most other properties can be left unset\&. If \*(Aqlink\-local\*(Aq is specified, then a link\-local address in the 169\&.254/16 range will be assigned to the interface\&. If \*(Aqmanual\*(Aq is specified, static IP addressing is used and at least one IP address must be given in the \*(Aqaddresses\*(Aq property\&. If \*(Aqshared\*(Aq is specified (indicating that this connection will provide network access to other computers) then the interface is assigned an address in the 10\&.42\&.x\&.1/24 range and a DHCP and forwarding DNS server are started, and the interface is NAT\-ed to the current default network connection\&. \*(Aqdisabled\*(Aq means IPv4 will not be used on this connection\&. This property must be set\&. +Deprecated in favor of the \*(Aqaddress\-data\*(Aq and \*(Aqgateway\*(Aq properties, but this can be used for backward\-compatibility with older daemons\&. Note that if you send this property the daemon will ignore \*(Aqaddress\-data\*(Aq and \*(Aqgateway\*(Aq\&. Array of IPv4 address structures\&. Each IPv4 address structure is composed of 3 32\-bit values; the first being the IPv4 address (network byte order), the second the prefix (1 \- 32), and last the IPv4 gateway (network byte order)\&. The gateway may be left as 0 if no gateway exists for that subnet\&. T} T{ -dns +dhcp\-client\-id T}:T{ -array of uint32 +string T}:T{ \ \& T}:T{ -List of DNS servers (network byte order)\&. For the \*(Aqauto\*(Aq method, these DNS servers are appended to those (if any) returned by automatic configuration\&. DNS servers cannot be used with the \*(Aqshared\*(Aq, \*(Aqlink\-local\*(Aq, or \*(Aqdisabled\*(Aq methods as there is no upstream network\&. In all other methods, these DNS servers are used as the only DNS servers for this connection\&. +A string sent to the DHCP server to identify the local machine which the DHCP server may use to customize the DHCP lease and options\&. T} T{ -dns\-search +dhcp\-hostname T}:T{ -array of string +string T}:T{ \ \& T}:T{ -List of DNS search domains\&. For the \*(Aqauto\*(Aq method, these search domains are appended to those returned by automatic configuration\&. Search domains cannot be used with the \*(Aqshared\*(Aq, \*(Aqlink\-local\*(Aq, or \*(Aqdisabled\*(Aq methods as there is no upstream network\&. In all other methods, these search domains are used as the only search domains for this connection\&. +If the "dhcp\-send\-hostname" property is TRUE, then the specified name will be sent to the DHCP server when acquiring a lease\&. T} T{ -addresses +dhcp\-send\-hostname T}:T{ -array of array of uint32 +boolean T}:T{ -\ \& +TRUE T}:T{ -Array of IPv4 address structures\&. Each IPv4 address structure is composed of 3 32\-bit values; the first being the IPv4 address (network byte order), the second the prefix (1 \- 32), and last the IPv4 gateway (network byte order)\&. The gateway may be left as 0 if no gateway exists for that subnet\&. For the \*(Aqauto\*(Aq method, given IP addresses are appended to those returned by automatic configuration\&. Addresses cannot be used with the \*(Aqshared\*(Aq, \*(Aqlink\-local\*(Aq, or \*(Aqdisabled\*(Aq methods as addressing is either automatic or disabled with these methods\&. +If TRUE, a hostname is sent to the DHCP server when acquiring a lease\&. Some DHCP servers use this hostname to update DNS databases, essentially providing a static hostname for the computer\&. If the "dhcp\-hostname" property is NULL and this property is TRUE, the current persistent hostname of the computer is sent\&. T} T{ -address\-labels +dns T}:T{ -array of string +array of uint32 T}:T{ -\ \& +[] T}:T{ -Internal use only +Array of IP addresses of DNS servers (as network\-byte\-order integers) T} T{ -routes +dns\-search T}:T{ -array of array of uint32 +array of string T}:T{ -\ \& +[] T}:T{ -Array of IPv4 route structures\&. Each IPv4 route structure is composed of 4 32\-bit values; the first being the destination IPv4 network or address (network byte order), the second the destination network or address prefix (1 \- 32), the third being the next\-hop (network byte order) if any, and the fourth being the route metric\&. For the \*(Aqauto\*(Aq method, given IP routes are appended to those returned by automatic configuration\&. Routes cannot be used with the \*(Aqshared\*(Aq, \*(Aqlink\-local\*(Aq, or \*(Aqdisabled\*(Aq, methods as there is no upstream network\&. +Array of DNS search domains\&. T} T{ -ignore\-auto\-routes +gateway T}:T{ -boolean +string T}:T{ -FALSE +\ \& T}:T{ -When the method is set to \*(Aqauto\*(Aq and this property to TRUE, automatically configured routes are ignored and only routes specified in the \*(Aqroutes\*(Aq property, if any, are used\&. +The gateway associated with this configuration\&. This is only meaningful if "addresses" is also set\&. T} T{ ignore\-auto\-dns @@ -1531,34 +1555,43 @@ boolean T}:T{ FALSE T}:T{ -When the method is set to \*(Aqauto\*(Aq and this property to TRUE, automatically configured nameservers and search domains are ignored and only nameservers and search domains specified in the \*(Aqdns\*(Aq and \*(Aqdns\-search\*(Aq properties, if any, are used\&. +When "method" is set to "auto" and this property to TRUE, automatically configured nameservers and search domains are ignored and only nameservers and search domains specified in the "dns" and "dns\-search" properties, if any, are used\&. T} T{ -dhcp\-client\-id +ignore\-auto\-routes T}:T{ -string +boolean T}:T{ -\ \& +FALSE T}:T{ -A string sent to the DHCP server to identify the local machine which the DHCP server may use to customize the DHCP lease and options\&. +When "method" is set to "auto" and this property to TRUE, automatically configured routes are ignored and only routes specified in the "routes" property, if any, are used\&. T} T{ -dhcp\-send\-hostname +may\-fail T}:T{ boolean T}:T{ TRUE T}:T{ -If TRUE, a hostname is sent to the DHCP server when acquiring a lease\&. Some DHCP servers use this hostname to update DNS databases, essentially providing a static hostname for the computer\&. If the \*(Aqdhcp\-hostname\*(Aq property is empty and this property is TRUE, the current persistent hostname of the computer is sent\&. +If TRUE, allow overall network configuration to proceed even if the configuration specified by this property times out\&. Note that at least one IP configuration must succeed or overall network configuration will still fail\&. For example, in IPv6\-only networks, setting this property to TRUE on the NMSettingIP4Config allows the overall network configuration to succeed if IPv4 configuration fails but IPv6 configuration completes successfully\&. T} T{ -dhcp\-hostname +method T}:T{ string T}:T{ \ \& T}:T{ -If the \*(Aqdhcp\-send\-hostname\*(Aq property is TRUE, then the specified name will be sent to the DHCP server when acquiring a lease\&. +IP configuration method\&. NMSettingIP4Config and NMSettingIP6Config both support "auto", "manual", and "link\-local"\&. See the subclass\-specific documentation for other values\&. In general, for the "auto" method, properties such as "dns" and "routes" specify information that is added on to the information returned from automatic configuration\&. The "ignore\-auto\-routes" and "ignore\-auto\-dns" properties modify this behavior\&. For methods that imply no upstream network, such as "shared" or "link\-local", these properties must be empty\&. +T} +T{ +name +T}:T{ +string +T}:T{ +ipv4 +T}:T{ +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. T} T{ never\-default @@ -1567,16 +1600,34 @@ boolean T}:T{ FALSE T}:T{ -If TRUE, this connection will never be the default IPv4 connection, meaning it will never be assigned the default route by NetworkManager\&. +If TRUE, this connection will never be the default connection for this IP type, meaning it will never be assigned the default route by NetworkManager\&. T} T{ -may\-fail +route\-data T}:T{ -boolean +array of vardict T}:T{ -TRUE +\ \& +T}:T{ +Array of IPv4 routes\&. Each route dictionary contains at least \*(Aqdest\*(Aq and \*(Aqprefix\*(Aq entries, containing the destination IP address as a string, and the prefix length as a uint32\&. Most routes will also have a \*(Aqgateway\*(Aq entry, containing the gateway IP address as a string\&. If the route has a \*(Aqmetric\*(Aq entry (containing a uint32), that will be used as the metric for the route (otherwise NM will pick a default value appropriate to the device)\&. Additional attributes may also exist on some routes\&. +T} +T{ +route\-metric +T}:T{ +int64 +T}:T{ +\-1 +T}:T{ +The default metric for routes that don\*(Aqt explicitly specify a metric\&. The default value \-1 means that the metric is choosen automatically based on the device type\&. The metric applies to dynamic routes, manual (static) routes that don\*(Aqt have an explicit metric setting, address prefix routes, and the default route\&. Note that for IPv6, the kernel accepts zero (0) but coerces it to 1024 (user default)\&. Hence, setting this property to zero effectively mean setting it to 1024\&. For IPv4, zero is a regular value for the metric\&. +T} +T{ +routes T}:T{ -If TRUE, allow overall network configuration to proceed even if IPv4 configuration times out\&. Note that at least one IP configuration must succeed or overall network configuration will still fail\&. For example, in IPv6\-only networks, setting this property to TRUE allows the overall network configuration to succeed if IPv4 configuration fails but IPv6 configuration completes successfully\&. +array of array of uint32 +T}:T{ +\ \& +T}:T{ +Deprecated in favor of the \*(Aqroute\-data\*(Aq property, but this can be used for backward\-compatibility with older daemons\&. Note that if you send this property the daemon will ignore \*(Aqroute\-data\*(Aq\&. Array of IPv4 route structures\&. Each IPv4 route structure is composed of 4 32\-bit values; the first being the destination IPv4 network or address (network byte order), the second the destination network or address prefix (1 \- 32), the third being the next\-hop (network byte order) if any, and the fourth being the route metric\&. If the metric is 0, NM will choose an appropriate default metric for the device\&. (There is no way to explicitly specify an actual metric of 0 with this property\&.) T} .TE .sp 1 @@ -1585,7 +1636,7 @@ T} .nr an-no-space-flag 1 .nr an-break-flag 1 .br -.B Table\ \&13.\ \&ipv6 setting +.B Table\ \&14.\ \&ipv6 setting .TS allbox tab(:); lB lB lB lB. @@ -1610,24 +1661,29 @@ l l l l l l l l l l l l l l l l +l l l l +l l l l +l l l l +l l l l +l l l l l l l l. T{ -name +address\-data T}:T{ -string +array of vardict T}:T{ -ipv6 +\ \& T}:T{ -The setting\*(Aqs name; these names are defined by the specification and cannot be changed after the object has been created\&. Each setting class has a name, and all objects of that class share the same name\&. +Array of IPv6 addresses\&. Each address dictionary contains at least \*(Aqaddress\*(Aq and \*(Aqprefix\*(Aq entries, containing the IP address as a string, and the prefix length as a uint32\&. Additional attributes may also exist on some addresses\&. T} T{ -method +addresses T}:T{ -string +array of legacy IPv6 address struct (a(ayuay)) T}:T{ \ \& T}:T{ -IPv6 configuration method\&. If \*(Aqauto\*(Aq is specified then the appropriate automatic method (PPP, router advertisement, etc) is used for the device and most other properties can be left unset\&. To force the use of DHCP only, specify \*(Aqdhcp\*(Aq; this method is only valid for Ethernet\-based hardware\&. If \*(Aqlink\-local\*(Aq is specified, then an IPv6 link\-local address will be assigned to the interface\&. If \*(Aqmanual\*(Aq is specified, static IP addressing is used and at least one IP address must be given in the \*(Aqaddresses\*(Aq property\&. If \*(Aqignore\*(Aq is specified, IPv6 configuration is not done\&. This property must be set\&. Note: the \*(Aqshared\*(Aq method is not yet supported\&. +Deprecated in favor of the \*(Aqaddress\-data\*(Aq and \*(Aqgateway\*(Aq properties, but this can be used for backward\-compatibility with older daemons\&. Note that if you send this property the daemon will ignore \*(Aqaddress\-data\*(Aq and \*(Aqgateway\*(Aq\&. Array of IPv6 address structures\&. Each IPv6 address structure is composed of an IPv6 address, a prefix length (1 \- 128), and an IPv6 gateway address\&. The gateway may be zeroed out if no gateway exists for that subnet\&. T} T{ dhcp\-hostname @@ -1636,43 +1692,52 @@ string T}:T{ \ \& T}:T{ -The specified name will be sent to the DHCP server when acquiring a lease\&. +If the "dhcp\-send\-hostname" property is TRUE, then the specified name will be sent to the DHCP server when acquiring a lease\&. +T} +T{ +dhcp\-send\-hostname +T}:T{ +boolean +T}:T{ +TRUE +T}:T{ +If TRUE, a hostname is sent to the DHCP server when acquiring a lease\&. Some DHCP servers use this hostname to update DNS databases, essentially providing a static hostname for the computer\&. If the "dhcp\-hostname" property is NULL and this property is TRUE, the current persistent hostname of the computer is sent\&. T} T{ dns T}:T{ array of byte array T}:T{ -\ \& +[] T}:T{ -Array of DNS servers, where each member of the array is a byte array containing the IPv6 address of the DNS server (in network byte order)\&. For the \*(Aqauto\*(Aq method, these DNS servers are appended to those (if any) returned by automatic configuration\&. DNS servers cannot be used with the \*(Aqshared\*(Aq or \*(Aqlink\-local\*(Aq methods as there is no usptream network\&. In all other methods, these DNS servers are used as the only DNS servers for this connection\&. +Array of IP addresses of DNS servers (in network byte order) T} T{ dns\-search T}:T{ array of string T}:T{ -\ \& +[] T}:T{ -List of DNS search domains\&. For the \*(Aqauto\*(Aq method, these search domains are appended to those returned by automatic configuration\&. Search domains cannot be used with the \*(Aqshared\*(Aq or \*(Aqlink\-local\*(Aq methods as there is no upstream network\&. In all other methods, these search domains are used as the only search domains for this connection\&. +Array of DNS search domains\&. T} T{ -addresses +gateway T}:T{ -array of (byte array, uint32, byte array) +string T}:T{ \ \& T}:T{ -Array of IPv6 address structures\&. Each IPv6 address structure is composed of 3 members, the first being a byte array containing the IPv6 address (network byte order), the second a 32\-bit integer containing the IPv6 address prefix, and the third a byte array containing the IPv6 address (network byte order) of the gateway associated with this address, if any\&. If no gateway is given, the third element should be given as all zeros\&. For the \*(Aqauto\*(Aq method, given IP addresses are appended to those returned by automatic configuration\&. Addresses cannot be used with the \*(Aqshared\*(Aq or \*(Aqlink\-local\*(Aq methods as the interface is automatically assigned an address with these methods\&. +The gateway associated with this configuration\&. This is only meaningful if "addresses" is also set\&. T} T{ -routes +ignore\-auto\-dns T}:T{ -array of (byte array, uint32, byte array, uint32) +boolean T}:T{ -\ \& +FALSE T}:T{ -Array of IPv6 route structures\&. Each IPv6 route structure is composed of 4 members; the first being the destination IPv6 network or address (network byte order) as a byte array, the second the destination network or address IPv6 prefix, the third being the next\-hop IPv6 address (network byte order) if any, and the fourth being the route metric\&. For the \*(Aqauto\*(Aq method, given IP routes are appended to those returned by automatic configuration\&. Routes cannot be used with the \*(Aqshared\*(Aq or \*(Aqlink\-local\*(Aq methods because there is no upstream network\&. +When "method" is set to "auto" and this property to TRUE, automatically configured nameservers and search domains are ignored and only nameservers and search domains specified in the "dns" and "dns\-search" properties, if any, are used\&. T} T{ ignore\-auto\-routes @@ -1681,16 +1746,43 @@ boolean T}:T{ FALSE T}:T{ -When the method is set to \*(Aqauto\*(Aq or \*(Aqdhcp\*(Aq and this property is set to TRUE, automatically configured routes are ignored and only routes specified in the \*(Aqroutes\*(Aq property, if any, are used\&. +When "method" is set to "auto" and this property to TRUE, automatically configured routes are ignored and only routes specified in the "routes" property, if any, are used\&. T} T{ -ignore\-auto\-dns +ip6\-privacy +T}:T{ +NMSettingIP6ConfigPrivacy (int32) +T}:T{ +\ \& +T}:T{ +Configure IPv6 Privacy Extensions for SLAAC, described in RFC4941\&. If enabled, it makes the kernel generate a temporary IPv6 address in addition to the public one generated from MAC address via modified EUI\-64\&. This enhances privacy, but could cause problems in some applications, on the other hand\&. The permitted values are: 0: disabled, 1: enabled (prefer public address), 2: enabled (prefer temporary addresses)\&. +T} +T{ +may\-fail T}:T{ boolean T}:T{ -FALSE +TRUE +T}:T{ +If TRUE, allow overall network configuration to proceed even if the configuration specified by this property times out\&. Note that at least one IP configuration must succeed or overall network configuration will still fail\&. For example, in IPv6\-only networks, setting this property to TRUE on the NMSettingIP4Config allows the overall network configuration to succeed if IPv4 configuration fails but IPv6 configuration completes successfully\&. +T} +T{ +method +T}:T{ +string +T}:T{ +\ \& +T}:T{ +IP configuration method\&. NMSettingIP4Config and NMSettingIP6Config both support "auto", "manual", and "link\-local"\&. See the subclass\-specific documentation for other values\&. In general, for the "auto" method, properties such as "dns" and "routes" specify information that is added on to the information returned from automatic configuration\&. The "ignore\-auto\-routes" and "ignore\-auto\-dns" properties modify this behavior\&. For methods that imply no upstream network, such as "shared" or "link\-local", these properties must be empty\&. +T} +T{ +name +T}:T{ +string +T}:T{ +ipv6 T}:T{ -When the method is set to \*(Aqauto\*(Aq or \*(Aqdhcp\*(Aq and this property is set to TRUE, automatically configured nameservers and search domains are ignored and only nameservers and search domains specified in the \*(Aqdns\*(Aq and \*(Aqdns\-search\*(Aq properties, if any, are used\&. +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. T} T{ never\-default @@ -1699,25 +1791,34 @@ boolean T}:T{ FALSE T}:T{ -If TRUE, this connection will never be the default IPv6 connection, meaning it will never be assigned the default IPv6 route by NetworkManager\&. +If TRUE, this connection will never be the default connection for this IP type, meaning it will never be assigned the default route by NetworkManager\&. T} T{ -may\-fail +route\-data T}:T{ -boolean +array of vardict T}:T{ -TRUE +\ \& T}:T{ -If TRUE, allow overall network configuration to proceed even if IPv6 configuration times out\&. Note that at least one IP configuration must succeed or overall network configuration will still fail\&. For example, in IPv4\-only networks, setting this property to TRUE allows the overall network configuration to succeed if IPv6 configuration fails but IPv4 configuration completes successfully\&. +Array of IPv6 routes\&. Each route dictionary contains at least \*(Aqdest\*(Aq and \*(Aqprefix\*(Aq entries, containing the destination IP address as a string, and the prefix length as a uint32\&. Most routes will also have a \*(Aqnext\-hop\*(Aq entry, containing the next hop IP address as a string\&. If the route has a \*(Aqmetric\*(Aq entry (containing a uint32), that will be used as the metric for the route (otherwise NM will pick a default value appropriate to the device)\&. Additional attributes may also exist on some routes\&. T} T{ -ip6\-privacy +route\-metric T}:T{ -int32 +int64 T}:T{ \-1 T}:T{ -Configure IPv6 Privacy Extensions for SLAAC, described in RFC4941\&. If enabled, it makes the kernel generate a temporary IPv6 address in addition to the public one generated from MAC address via modified EUI\-64\&. This enhances privacy, but could cause problems in some applications, on the other hand\&. The permitted values are: 0: disabled, 1: enabled (prefer public address), 2: enabled (prefer temporary addresses)\&. +The default metric for routes that don\*(Aqt explicitly specify a metric\&. The default value \-1 means that the metric is choosen automatically based on the device type\&. The metric applies to dynamic routes, manual (static) routes that don\*(Aqt have an explicit metric setting, address prefix routes, and the default route\&. Note that for IPv6, the kernel accepts zero (0) but coerces it to 1024 (user default)\&. Hence, setting this property to zero effectively mean setting it to 1024\&. For IPv4, zero is a regular value for the metric\&. +T} +T{ +routes +T}:T{ +array of legacy IPv6 route struct (a(ayuayu)) +T}:T{ +\ \& +T}:T{ +Deprecated in favor of the \*(Aqroute\-data\*(Aq property, but this can be used for backward\-compatibility with older daemons\&. Note that if you send this property the daemon will ignore \*(Aqroute\-data\*(Aq\&. Array of IPv6 route structures\&. Each IPv6 route structure is composed of an IPv6 address, a prefix length (1 \- 128), an IPv6 next hop address (which may be zeroed out if there is no next hop), and a metric\&. If the metric is 0, NM will choose an appropriate default metric for the device\&. T} .TE .sp 1 @@ -1726,7 +1827,7 @@ T} .nr an-no-space-flag 1 .nr an-break-flag 1 .br -.B Table\ \&14.\ \&802-11-olpc-mesh setting +.B Table\ \&15.\ \&802-11-olpc-mesh setting .TS allbox tab(:); lB lB lB lB. @@ -1745,40 +1846,40 @@ l l l l l l l l l l l l. T{ -name +channel T}:T{ -string +uint32 T}:T{ -802\-11\-olpc\-mesh +0 T}:T{ -The setting\*(Aqs name; these names are defined by the specification and cannot be changed after the object has been created\&. Each setting class has a name, and all objects of that class share the same name\&. +Channel on which the mesh network to join is located\&. T} T{ -ssid +dhcp\-anycast\-address T}:T{ byte array T}:T{ -[] +\ \& T}:T{ -SSID of the mesh network to join\&. +Anycast DHCP MAC address used when requesting an IP address via DHCP\&. The specific anycast address used determines which DHCP server class answers the request\&. T} T{ -channel +name T}:T{ -uint32 +string T}:T{ -0 +802\-11\-olpc\-mesh T}:T{ -Channel on which the mesh network to join is located\&. +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. T} T{ -dhcp\-anycast\-address +ssid T}:T{ byte array T}:T{ -[] +\ \& T}:T{ -Anycast DHCP MAC address used when requesting an IP address via DHCP\&. The specific anycast address used determines which DHCP server class answers the the request\&. +SSID of the mesh network to join\&. T} .TE .sp 1 @@ -1787,7 +1888,7 @@ T} .nr an-no-space-flag 1 .nr an-break-flag 1 .br -.B Table\ \&15.\ \&ppp setting +.B Table\ \&16.\ \&ppp setting .TS allbox tab(:); lB lB lB lB. @@ -1821,175 +1922,175 @@ l l l l l l l l l l l l. T{ -name +baud T}:T{ -string +uint32 T}:T{ -ppp +0 T}:T{ -The setting\*(Aqs name; these names are defined by the specification and cannot be changed after the object has been created\&. Each setting class has a name, and all objects of that class share the same name\&. +If non\-zero, instruct pppd to set the serial port to the specified baudrate\&. This value should normally be left as 0 to automatically choose the speed\&. T} T{ -noauth +crtscts T}:T{ boolean T}:T{ -TRUE +FALSE T}:T{ -If TRUE, do not require the other side (usually the PPP server) to authenticate itself to the client\&. If FALSE, require authentication from the remote side\&. In almost all cases, this should be TRUE\&. +If TRUE, specify that pppd should set the serial port to use hardware flow control with RTS and CTS signals\&. This value should normally be set to FALSE\&. T} T{ -refuse\-eap +lcp\-echo\-failure T}:T{ -boolean +uint32 T}:T{ -FALSE +0 T}:T{ -If TRUE, the EAP authentication method will not be used\&. +If non\-zero, instruct pppd to presume the connection to the peer has failed if the specified number of LCP echo\-requests go unanswered by the peer\&. The "lcp\-echo\-interval" property must also be set to a non\-zero value if this property is used\&. T} T{ -refuse\-pap +lcp\-echo\-interval T}:T{ -boolean +uint32 T}:T{ -FALSE +0 T}:T{ -If TRUE, the PAP authentication method will not be used\&. +If non\-zero, instruct pppd to send an LCP echo\-request frame to the peer every n seconds (where n is the specified value)\&. Note that some PPP peers will respond to echo requests and some will not, and it is not possible to autodetect this\&. T} T{ -refuse\-chap +mppe\-stateful T}:T{ boolean T}:T{ FALSE T}:T{ -If TRUE, the CHAP authentication method will not be used\&. +If TRUE, stateful MPPE is used\&. See pppd documentation for more information on stateful MPPE\&. T} T{ -refuse\-mschap +mru T}:T{ -boolean +uint32 T}:T{ -FALSE +0 T}:T{ -If TRUE, the MSCHAP authentication method will not be used\&. +If non\-zero, instruct pppd to request that the peer send packets no larger than the specified size\&. If non\-zero, the MRU should be between 128 and 16384\&. T} T{ -refuse\-mschapv2 +mtu T}:T{ -boolean +uint32 T}:T{ -FALSE +0 T}:T{ -If TRUE, the MSCHAPv2 authentication method will not be used\&. +If non\-zero, instruct pppd to send packets no larger than the specified size\&. T} T{ -nobsdcomp +name T}:T{ -boolean +string T}:T{ -FALSE +ppp T}:T{ -If TRUE, BSD compression will not be requested\&. +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. T} T{ -nodeflate +no\-vj\-comp T}:T{ boolean T}:T{ FALSE T}:T{ -If TRUE, \*(Aqdeflate\*(Aq compression will not be requested\&. +If TRUE, Van Jacobsen TCP header compression will not be requested\&. T} T{ -no\-vj\-comp +noauth T}:T{ boolean T}:T{ -FALSE +TRUE T}:T{ -If TRUE, Van Jacobsen TCP header compression will not be requested\&. +If TRUE, do not require the other side (usually the PPP server) to authenticate itself to the client\&. If FALSE, require authentication from the remote side\&. In almost all cases, this should be TRUE\&. T} T{ -require\-mppe +nobsdcomp T}:T{ boolean T}:T{ FALSE T}:T{ -If TRUE, MPPE (Microsoft Point\-to\-Point Encrpytion) will be required for the PPP session\&. If either 64\-bit or 128\-bit MPPE is not available the session will fail\&. Note that MPPE is not used on mobile broadband connections\&. +If TRUE, BSD compression will not be requested\&. T} T{ -require\-mppe\-128 +nodeflate T}:T{ boolean T}:T{ FALSE T}:T{ -If TRUE, 128\-bit MPPE (Microsoft Point\-to\-Point Encrpytion) will be required for the PPP session, and the \*(Aqrequire\-mppe\*(Aq property must also be set to TRUE\&. If 128\-bit MPPE is not available the session will fail\&. +If TRUE, "deflate" compression will not be requested\&. T} T{ -mppe\-stateful +refuse\-chap T}:T{ boolean T}:T{ FALSE T}:T{ -If TRUE, stateful MPPE is used\&. See pppd documentation for more information on stateful MPPE\&. +If TRUE, the CHAP authentication method will not be used\&. T} T{ -crtscts +refuse\-eap T}:T{ boolean T}:T{ FALSE T}:T{ -If TRUE, specify that pppd should set the serial port to use hardware flow control with RTS and CTS signals\&. This value should normally be set to FALSE\&. +If TRUE, the EAP authentication method will not be used\&. T} T{ -baud +refuse\-mschap T}:T{ -uint32 +boolean T}:T{ -0 +FALSE T}:T{ -If non\-zero, instruct pppd to set the serial port to the specified baudrate\&. This value should normally be left as 0 to automatically choose the speed\&. +If TRUE, the MSCHAP authentication method will not be used\&. T} T{ -mru +refuse\-mschapv2 T}:T{ -uint32 +boolean T}:T{ -0 +FALSE T}:T{ -If non\-zero, instruct pppd to request that the peer send packets no larger than the specified size\&. If non\-zero, the MRU should be between 128 and 16384\&. +If TRUE, the MSCHAPv2 authentication method will not be used\&. T} T{ -mtu +refuse\-pap T}:T{ -uint32 +boolean T}:T{ -0 +FALSE T}:T{ -If non\-zero, instruct pppd to send packets no larger than the specified size\&. +If TRUE, the PAP authentication method will not be used\&. T} T{ -lcp\-echo\-failure +require\-mppe T}:T{ -uint32 +boolean T}:T{ -0 +FALSE T}:T{ -If non\-zero, instruct pppd to presume the connection to the peer has failed if the specified number of LCP echo\-requests go unanswered by the peer\&. The \*(Aqlcp\-echo\-interval\*(Aq property must also be set to a non\-zero value if this property is used\&. +If TRUE, MPPE (Microsoft Point\-to\-Point Encrpytion) will be required for the PPP session\&. If either 64\-bit or 128\-bit MPPE is not available the session will fail\&. Note that MPPE is not used on mobile broadband connections\&. T} T{ -lcp\-echo\-interval +require\-mppe\-128 T}:T{ -uint32 +boolean T}:T{ -0 +FALSE T}:T{ -If non\-zero, instruct pppd to send an LCP echo\-request frame to the peer every n seconds (where n is the specified value)\&. Note that some PPP peers will respond to echo requests and some will not, and it is not possible to autodetect this\&. +If TRUE, 128\-bit MPPE (Microsoft Point\-to\-Point Encrpytion) will be required for the PPP session, and the "require\-mppe" property must also be set to TRUE\&. If 128\-bit MPPE is not available the session will fail\&. T} .TE .sp 1 @@ -1998,7 +2099,7 @@ T} .nr an-no-space-flag 1 .nr an-break-flag 1 .br -.B Table\ \&16.\ \&pppoe setting +.B Table\ \&17.\ \&pppoe setting .TS allbox tab(:); lB lB lB lB. @@ -2024,43 +2125,43 @@ string T}:T{ pppoe T}:T{ -The setting\*(Aqs name; these names are defined by the specification and cannot be changed after the object has been created\&. Each setting class has a name, and all objects of that class share the same name\&. +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. T} T{ -service +password T}:T{ string T}:T{ \ \& T}:T{ -If specified, instruct PPPoE to only initiate sessions with access concentrators that provide the specified service\&. For most providers, this should be left blank\&. It is only required if there are multiple access concentrators or a specific service is known to be required\&. +Password used to authenticate with the PPPoE service\&. T} T{ -username +password\-flags T}:T{ -string +NMSettingSecretFlags (uint32) T}:T{ \ \& T}:T{ -Username used to authenticate with the PPPoE service\&. +Flags indicating how to handle the "password" property\&. (see the section called \(lqSecret flag types:\(rq for flag values) T} T{ -password +service T}:T{ string T}:T{ \ \& T}:T{ -Password used to authenticate with the PPPoE service\&. +If specified, instruct PPPoE to only initiate sessions with access concentrators that provide the specified service\&. For most providers, this should be left blank\&. It is only required if there are multiple access concentrators or a specific service is known to be required\&. T} T{ -password\-flags +username T}:T{ -uint32 +string T}:T{ -0 +\ \& T}:T{ -Flags indicating how to handle the PPPoE password\&. (see the section called \(lqSecret flag types:\(rq for flag values) +Username used to authenticate with the PPPoE service\&. T} .TE .sp 1 @@ -2069,7 +2170,7 @@ T} .nr an-no-space-flag 1 .nr an-break-flag 1 .br -.B Table\ \&17.\ \&serial setting +.B Table\ \&18.\ \&serial setting .TS allbox tab(:); lB lB lB lB. @@ -2090,15 +2191,6 @@ l l l l l l l l l l l l. T{ -name -T}:T{ -string -T}:T{ -serial -T}:T{ -The setting\*(Aqs name; these names are defined by the specification and cannot be changed after the object has been created\&. Each setting class has a name, and all objects of that class share the same name\&. -T} -T{ baud T}:T{ uint32 @@ -2114,25 +2206,25 @@ uint32 T}:T{ 8 T}:T{ -Byte\-width of the serial communication\&. The 8 in \*(Aq8n1\*(Aq for example\&. +Byte\-width of the serial communication\&. The 8 in "8n1" for example\&. T} T{ -parity +name T}:T{ -gchar +string T}:T{ -110 +serial T}:T{ -Parity setting of the serial port\&. Either \*(AqE\*(Aq for even parity, \*(Aqo\*(Aq for odd parity, or \*(Aqn\*(Aq for no parity\&. +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. T} T{ -stopbits +parity T}:T{ -uint32 +byte T}:T{ -1 +\ \& T}:T{ -Number of stop bits for communication on the serial port\&. Either 1 or 2\&. The 1 in \*(Aq8n1\*(Aq for example\&. +The connection parity: 69 (ASCII \*(AqE\*(Aq) for even parity, 111 (ASCII \*(Aqo\*(Aq) for odd, 110 (ASCII \*(Aqn\*(Aq) for none\&. T} T{ send\-delay @@ -2143,6 +2235,15 @@ T}:T{ T}:T{ Time to delay between each byte sent to the modem, in microseconds\&. T} +T{ +stopbits +T}:T{ +uint32 +T}:T{ +1 +T}:T{ +Number of stop bits for communication on the serial port\&. Either 1 or 2\&. The 1 in "8n1" for example\&. +T} .TE .sp 1 .sp @@ -2150,7 +2251,7 @@ T} .nr an-no-space-flag 1 .nr an-break-flag 1 .br -.B Table\ \&18.\ \&team setting +.B Table\ \&19.\ \&team setting .TS allbox tab(:); lB lB lB lB. @@ -2168,13 +2269,13 @@ l l l l l l l l l l l l. T{ -name +config T}:T{ string T}:T{ -team +\ \& T}:T{ -The setting\*(Aqs name; these names are defined by the specification and cannot be changed after the object has been created\&. Each setting class has a name, and all objects of that class share the same name\&. +The JSON configuration for the team network interface\&. The property should contain raw JSON configuration data suitable for teamd, because the value is passed directly to teamd\&. If not specified, the default configuration is used\&. See man teamd\&.conf for the format details\&. T} T{ interface\-name @@ -2183,16 +2284,16 @@ string T}:T{ \ \& T}:T{ -The name of the virtual in\-kernel team network interface +Deprecated in favor of connection\&.interface\-name, but can be used for backward\-compatibility with older daemons, to set the team\*(Aqs interface name\&. T} T{ -config +name T}:T{ string T}:T{ -\ \& +team T}:T{ -JSON configuration for the team network interface\&. The property should contain raw JSON configuration data suitable for teamd, because the value is passed directly to teamd\&. If not specified, the default configuration is used\&. See man teamd\&.conf for the format details\&. +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. T} .TE .sp 1 @@ -2201,7 +2302,7 @@ T} .nr an-no-space-flag 1 .nr an-break-flag 1 .br -.B Table\ \&19.\ \&team-port setting +.B Table\ \&20.\ \&team-port setting .TS allbox tab(:); lB lB lB lB. @@ -2218,22 +2319,22 @@ T} l l l l l l l l. T{ -name +config T}:T{ string T}:T{ -team\-port +\ \& T}:T{ -The setting\*(Aqs name; these names are defined by the specification and cannot be changed after the object has been created\&. Each setting class has a name, and all objects of that class share the same name\&. +The JSON configuration for the team port\&. The property should contain raw JSON configuration data suitable for teamd, because the value is passed directly to teamd\&. If not specified, the default configuration is used\&. See man teamd\&.conf for the format details\&. T} T{ -config +name T}:T{ string T}:T{ -\ \& +team\-port T}:T{ -JSON configuration for the team port\&. The property should contain raw JSON configuration data suitable for teamd, because the value is passed directly to teamd\&. If not specified, the dafault configuration is used\&. See man teamd\&.conf for the format details\&. +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. T} .TE .sp 1 @@ -2242,7 +2343,7 @@ T} .nr an-no-space-flag 1 .nr an-break-flag 1 .br -.B Table\ \&20.\ \&vlan setting +.B Table\ \&21.\ \&vlan setting .TS allbox tab(:); lB lB lB lB. @@ -2264,67 +2365,67 @@ l l l l l l l l l l l l. T{ -name +egress\-priority\-map T}:T{ -string +array of string T}:T{ -vlan +[] T}:T{ -The setting\*(Aqs name; these names are defined by the specification and cannot be changed after the object has been created\&. Each setting class has a name, and all objects of that class share the same name\&. +For outgoing packets, a list of mappings from Linux SKB priorities to 802\&.1p priorities\&. The mapping is given in the format "from:to" where both "from" and "to" are unsigned integers, ie "7:3"\&. T} T{ -interface\-name +flags T}:T{ -string +NMVlanFlags (uint32) T}:T{ \ \& T}:T{ -If given, specifies the kernel name of the VLAN interface\&. If not given, a default name will be constructed from the interface described by the parent interface and the \*(Aqid\*(Aq property, ex \*(Aqeth2\&.1\*(Aq\&. The parent interface may be given by the \*(Aqparent\*(Aq property or by the \*(Aqmac\-address\*(Aq property of a \*(Aqwired\*(Aq setting\&. +One or more flags which control the behavior and features of the VLAN interface\&. Flags include NM_VLAN_FLAG_REORDER_HEADERS (0x1) (reordering of output packet headers), NM_VLAN_FLAG_GVRP (0x2) (use of the GVRP protocol), and NM_VLAN_FLAG_LOOSE_BINDING (0x4) (loose binding of the interface to its master device\*(Aqs operating state)\&. T} T{ -parent +id T}:T{ -string +uint32 T}:T{ -\ \& +0 T}:T{ -If given, specifies the parent interface name or parent connection UUID from which this VLAN interface should be created\&. If this property is not specified, the connection must contain a \*(Aqwired\*(Aq setting with a \*(Aqmac\-address\*(Aq property\&. +The VLAN identifier that the interface created by this connection should be assigned\&. T} T{ -id +ingress\-priority\-map T}:T{ -uint32 +array of string T}:T{ -0 +[] T}:T{ -The VLAN indentifier the interface created by this connection should be assigned\&. +For incoming packets, a list of mappings from 802\&.1p priorities to Linux SKB priorities\&. The mapping is given in the format "from:to" where both "from" and "to" are unsigned integers, ie "7:3"\&. T} T{ -flags +interface\-name T}:T{ -uint32 +string T}:T{ -0 +\ \& T}:T{ -One or more flags which control the behavior and features of the VLAN interface\&. Flags include reordering of output packet headers (0x01), use of the GVRP protocol (0x02), and loose binding of the interface to its master device\*(Aqs operating state (0x04)\&. +Deprecated in favor of connection\&.interface\-name, but can be used for backward\-compatibility with older daemons, to set the vlan\*(Aqs interface name\&. T} T{ -ingress\-priority\-map +name T}:T{ -array of string +string T}:T{ -\ \& +vlan T}:T{ -For incoming packets, a list of mappings from 802\&.1p priorities to Linux SKB priorities\&. The mapping is given in the format \*(Aqfrom:to\*(Aq where both \*(Aqfrom\*(Aq and \*(Aqto\*(Aq are unsigned integers, ie \*(Aq7:3\*(Aq\&. +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. T} T{ -egress\-priority\-map +parent T}:T{ -array of string +string T}:T{ \ \& T}:T{ -For outgoing packets, a list of mappings from Linux SKB priorities to 802\&.1p priorities\&. The mapping is given in the format \*(Aqfrom:to\*(Aq where both \*(Aqfrom\*(Aq and \*(Aqto\*(Aq are unsigned integers, ie \*(Aq7:3\*(Aq\&. +If given, specifies the parent interface name or parent connection UUID from which this VLAN interface should be created\&. If this property is not specified, the connection must contain an "802\-3\-ethernet" setting with a "mac\-address" property\&. T} .TE .sp 1 @@ -2333,7 +2434,7 @@ T} .nr an-no-space-flag 1 .nr an-break-flag 1 .br -.B Table\ \&21.\ \&vpn setting +.B Table\ \&22.\ \&vpn setting .TS allbox tab(:); lB lB lB lB. @@ -2351,51 +2452,61 @@ l l l l l l l l l l l l l l l l +l l l l l l l l. T{ +data +T}:T{ +dict of string to string +T}:T{ +\ \& +T}:T{ +Dictionary of key/value pairs of VPN plugin specific data\&. Both keys and values must be strings\&. +T} +T{ name T}:T{ string T}:T{ vpn T}:T{ -The setting\*(Aqs name; these names are defined by the specification and cannot be changed after the object has been created\&. Each setting class has a name, and all objects of that class share the same name\&. +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. T} T{ -service\-type +persistent T}:T{ -string +boolean T}:T{ -\ \& +FALSE T}:T{ -D\-Bus service name of the VPN plugin that this setting uses to connect to its network\&. i\&.e\&. org\&.freedesktop\&.NetworkManager\&.vpnc for the vpnc plugin\&. +If the VPN service supports persistence, and this property is TRUE, the VPN will attempt to stay connected across link changes and outages, until explicitly disconnected\&. T} T{ -user\-name +secrets T}:T{ -string +dict of string to string T}:T{ \ \& T}:T{ -If the VPN connection requires a user name for authentication, that name should be provided here\&. If the connection is available to more than one user, and the VPN requires each user to supply a different name, then leave this property empty\&. If this property is empty, NetworkManager will automatically supply the username of the user which requested the VPN connection\&. +Dictionary of key/value pairs of VPN plugin specific secrets like passwords or private keys\&. Both keys and values must be strings\&. T} T{ -data +service\-type T}:T{ -dict of (string::string) +string T}:T{ \ \& T}:T{ -Dictionary of key/value pairs of VPN plugin specific data\&. Both keys and values must be strings\&. +D\-Bus service name of the VPN plugin that this setting uses to connect to its network\&. i\&.e\&. org\&.freedesktop\&.NetworkManager\&.vpnc for the vpnc plugin\&. T} T{ -secrets +user\-name T}:T{ -dict of (string::string) +string T}:T{ \ \& T}:T{ -Dictionary of key/value pairs of VPN plugin specific secrets like passwords or private keys\&. Both keys and values must be strings\&. +If the VPN connection requires a user name for authentication, that name should be provided here\&. If the connection is available to more than one user, and the VPN requires each user to supply a different name, then leave this property empty\&. If this property is empty, NetworkManager will automatically supply the username of the user which requested the VPN connection\&. T} .TE .sp 1 @@ -2404,7 +2515,7 @@ T} .nr an-no-space-flag 1 .nr an-break-flag 1 .br -.B Table\ \&22.\ \&wimax setting +.B Table\ \&23.\ \&wimax setting .TS allbox tab(:); lB lB lB lB. @@ -2422,13 +2533,22 @@ l l l l l l l l l l l l. T{ +mac\-address +T}:T{ +byte array +T}:T{ +\ \& +T}:T{ +If specified, this connection will only apply to the WiMAX device whose MAC address matches\&. This property does not change the MAC address of the device (known as MAC spoofing)\&. +T} +T{ name T}:T{ string T}:T{ wimax T}:T{ -The setting\*(Aqs name; these names are defined by the specification and cannot be changed after the object has been created\&. Each setting class has a name, and all objects of that class share the same name\&. +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. T} T{ network\-name @@ -2439,15 +2559,6 @@ T}:T{ T}:T{ Network Service Provider (NSP) name of the WiMAX network this connection should use\&. T} -T{ -mac\-address -T}:T{ -byte array -T}:T{ -[] -T}:T{ -If specified, this connection will only apply to the WiMAX device whose MAC address matches\&. This property does not change the MAC address of the device (known as MAC spoofing)\&. -T} .TE .sp 1 .sp @@ -2455,7 +2566,7 @@ T} .nr an-no-space-flag 1 .nr an-break-flag 1 .br -.B Table\ \&23.\ \&802-3-ethernet setting +.B Table\ \&24.\ \&802-3-ethernet setting .TS allbox tab(:); lB lB lB lB. @@ -2482,31 +2593,22 @@ l l l l l l l l l l l l. T{ -name +auto\-negotiate T}:T{ -string +boolean T}:T{ -802\-3\-ethernet +TRUE T}:T{ -The setting\*(Aqs name; these names are defined by the specification and cannot be changed after the object has been created\&. Each setting class has a name, and all objects of that class share the same name\&. +If TRUE, allow auto\-negotiation of port speed and duplex mode\&. If FALSE, do not allow auto\-negotiation, in which case the "speed" and "duplex" properties should be set\&. T} T{ -port +cloned\-mac\-address T}:T{ -string +byte array T}:T{ \ \& T}:T{ -Specific port type to use if multiple the device supports multiple attachment methods\&. One of \*(Aqtp\*(Aq (Twisted Pair), \*(Aqaui\*(Aq (Attachment Unit Interface), \*(Aqbnc\*(Aq (Thin Ethernet) or \*(Aqmii\*(Aq (Media Independent Interface\&. If the device supports only one port type, this setting is ignored\&. -T} -T{ -speed -T}:T{ -uint32 -T}:T{ -0 -T}:T{ -If non\-zero, request that the device use only the specified speed\&. In Mbit/s, ie 100 == 100Mbit/s\&. +If specified, request that the device use this MAC address instead of its permanent MAC address\&. This is known as MAC cloning or spoofing\&. T} T{ duplex @@ -2515,41 +2617,23 @@ string T}:T{ \ \& T}:T{ -If specified, request that the device only use the specified duplex mode\&. Either \*(Aqhalf\*(Aq or \*(Aqfull\*(Aq\&. -T} -T{ -auto\-negotiate -T}:T{ -boolean -T}:T{ -TRUE -T}:T{ -If TRUE, allow auto\-negotiation of port speed and duplex mode\&. If FALSE, do not allow auto\-negotiation,in which case the \*(Aqspeed\*(Aq and \*(Aqduplex\*(Aq properties should be set\&. +If specified, request that the device only use the specified duplex mode\&. Either "half" or "full"\&. T} T{ mac\-address T}:T{ byte array T}:T{ -[] -T}:T{ -If specified, this connection will only apply to the Ethernet device whose permanent MAC address matches\&. This property does not change the MAC address of the device (i\&.e\&. MAC spoofing)\&. -T} -T{ -cloned\-mac\-address -T}:T{ -byte array -T}:T{ -[] +\ \& T}:T{ -If specified, request that the device use this MAC address instead of its permanent MAC address\&. This is known as MAC cloning or spoofing\&. +If specified, this connection will only apply to the Ethernet device whose permanent MAC address matches\&. This property does not change the MAC address of the device (i\&.e\&. MAC spoofing)\&. T} T{ mac\-address\-blacklist T}:T{ array of string T}:T{ -\ \& +[] T}:T{ If specified, this connection will never apply to the Ethernet device whose permanent MAC address matches an address in the list\&. Each MAC address is in the standard hex\-digits\-and\-colons notation (00:11:22:33:44:55)\&. T} @@ -2563,13 +2647,22 @@ T}:T{ If non\-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple Ethernet frames\&. T} T{ -s390\-subchannels +name T}:T{ -array of string +string +T}:T{ +802\-3\-ethernet +T}:T{ +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. +T} +T{ +port +T}:T{ +string T}:T{ \ \& T}:T{ -Identifies specific subchannels that this network device uses for communcation with z/VM or s390 host\&. Like the \*(Aqmac\-address\*(Aq property for non\-z/VM devices, this property can be used to ensure this connection only applies to the network device that uses these subchannels\&. The list should contain exactly 3 strings, and each string may only be composed of hexadecimal characters and the period (\&.) character\&. +Specific port type to use if multiple the device supports multiple attachment methods\&. One of "tp" (Twisted Pair), "aui" (Attachment Unit Interface), "bnc" (Thin Ethernet) or "mii" (Media Independent Interface\&. If the device supports only one port type, this setting is ignored\&. T} T{ s390\-nettype @@ -2578,16 +2671,34 @@ string T}:T{ \ \& T}:T{ -s390 network device type; one of \*(Aqqeth\*(Aq, \*(Aqlcs\*(Aq, or \*(Aqctc\*(Aq, representing the different types of virtual network devices available on s390 systems\&. +s390 network device type; one of "qeth", "lcs", or "ctc", representing the different types of virtual network devices available on s390 systems\&. T} T{ s390\-options T}:T{ -dict of (string::string) +dict of string to string T}:T{ \ \& T}:T{ -Dictionary of key/value pairs of s390\-specific device options\&. Both keys and values must be strings\&. Allowed keys include \*(Aqportno\*(Aq, \*(Aqlayer2\*(Aq, \*(Aqportname\*(Aq, \*(Aqprotocol\*(Aq, among others\&. +Dictionary of key/value pairs of s390\-specific device options\&. Both keys and values must be strings\&. Allowed keys include "portno", "layer2", "portname", "protocol", among others\&. Key names must contain only alphanumeric characters (ie, [a\-zA\-Z0\-9])\&. +T} +T{ +s390\-subchannels +T}:T{ +array of string +T}:T{ +[] +T}:T{ +Identifies specific subchannels that this network device uses for communication with z/VM or s390 host\&. Like the "mac\-address" property for non\-z/VM devices, this property can be used to ensure this connection only applies to the network device that uses these subchannels\&. The list should contain exactly 3 strings, and each string may only be composed of hexadecimal characters and the period (\&.) character\&. +T} +T{ +speed +T}:T{ +uint32 +T}:T{ +0 +T}:T{ +If non\-zero, request that the device use only the specified speed\&. In Mbit/s, ie 100 == 100Mbit/s\&. T} .TE .sp 1 @@ -2596,7 +2707,7 @@ T} .nr an-no-space-flag 1 .nr an-break-flag 1 .br -.B Table\ \&24.\ \&802-11-wireless setting +.B Table\ \&25.\ \&802-11-wireless setting .TS allbox tab(:); lB lB lB lB. @@ -2626,139 +2737,139 @@ l l l l l l l l l l l l. T{ -name +band T}:T{ string T}:T{ -802\-11\-wireless +\ \& T}:T{ -The setting\*(Aqs name; these names are defined by the specification and cannot be changed after the object has been created\&. Each setting class has a name, and all objects of that class share the same name\&. +802\&.11 frequency band of the network\&. One of "a" for 5GHz 802\&.11a or "bg" for 2\&.4GHz 802\&.11\&. This will lock associations to the Wi\-Fi network to the specific band, i\&.e\&. if "a" is specified, the device will not associate with the same network in the 2\&.4GHz band even if the network\*(Aqs settings are compatible\&. This setting depends on specific driver capability and may not work with all drivers\&. T} T{ -ssid +bssid T}:T{ byte array T}:T{ -[] +\ \& T}:T{ -SSID of the Wi\-Fi network\&. Must be specified\&. +If specified, directs the device to only associate with the given access point\&. This capability is highly driver dependent and not supported by all devices\&. Note: this property does not control the BSSID used when creating an Ad\-Hoc network and is unlikely to in the future\&. T} T{ -mode +channel T}:T{ -string +uint32 T}:T{ -\ \& +0 T}:T{ -Wi\-Fi network mode; one of \*(Aqinfrastructure\*(Aq, \*(Aqadhoc\*(Aq or \*(Aqap\*(Aq\&. If blank, infrastructure is assumed\&. +Wireless channel to use for the Wi\-Fi connection\&. The device will only join (or create for Ad\-Hoc networks) a Wi\-Fi network on the specified channel\&. Because channel numbers overlap between bands, this property also requires the "band" property to be set\&. T} T{ -band +cloned\-mac\-address T}:T{ -string +byte array T}:T{ \ \& T}:T{ -802\&.11 frequency band of the network\&. One of \*(Aqa\*(Aq for 5GHz 802\&.11a or \*(Aqbg\*(Aq for 2\&.4GHz 802\&.11\&. This will lock associations to the Wi\-Fi network to the specific band, i\&.e\&. if \*(Aqa\*(Aq is specified, the device will not associate with the same network in the 2\&.4GHz band even if the network\*(Aqs settings are compatible\&. This setting depends on specific driver capability and may not work with all drivers\&. +If specified, request that the Wi\-Fi device use this MAC address instead of its permanent MAC address\&. This is known as MAC cloning or spoofing\&. T} T{ -channel +hidden T}:T{ -uint32 +boolean T}:T{ -0 +FALSE T}:T{ -Wireless channel to use for the Wi\-Fi connection\&. The device will only join (or create for Ad\-Hoc networks) a Wi\-Fi network on the specified channel\&. Because channel numbers overlap between bands, this property also requires the \*(Aqband\*(Aq property to be set\&. +If TRUE, indicates this network is a non\-broadcasting network that hides its SSID\&. In this case various workarounds may take place, such as probe\-scanning the SSID for more reliable network discovery\&. However, these workarounds expose inherent insecurities with hidden SSID networks, and thus hidden SSID networks should be used with caution\&. T} T{ -bssid +mac\-address T}:T{ byte array T}:T{ -[] +\ \& T}:T{ -If specified, directs the device to only associate with the given access point\&. This capability is highly driver dependent and not supported by all devices\&. Note: this property does not control the BSSID used when creating an Ad\-Hoc network and is unlikely to in the future\&. +If specified, this connection will only apply to the Wi\-Fi device whose permanent MAC address matches\&. This property does not change the MAC address of the device (i\&.e\&. MAC spoofing)\&. T} T{ -rate +mac\-address\-blacklist T}:T{ -uint32 +array of string T}:T{ -0 +[] T}:T{ -If non\-zero, directs the device to only use the specified bitrate for communication with the access point\&. Units are in Kb/s, ie 5500 = 5\&.5 Mbit/s\&. This property is highly driver dependent and not all devices support setting a static bitrate\&. +A list of permanent MAC addresses of Wi\-Fi devices to which this connection should never apply\&. Each MAC address should be given in the standard hex\-digits\-and\-colons notation (eg "00:11:22:33:44:55")\&. T} T{ -tx\-power +mode T}:T{ -uint32 +string T}:T{ -0 +\ \& T}:T{ -If non\-zero, directs the device to use the specified transmit power\&. Units are dBm\&. This property is highly driver dependent and not all devices support setting a static transmit power\&. +Wi\-Fi network mode; one of "infrastructure", "adhoc" or "ap"\&. If blank, infrastructure is assumed\&. T} T{ -mac\-address +mtu T}:T{ -byte array +uint32 T}:T{ -[] +0 T}:T{ -If specified, this connection will only apply to the Wi\-Fi device whose permanent MAC address matches\&. This property does not change the MAC address of the device (i\&.e\&. MAC spoofing)\&. +If non\-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple Ethernet frames\&. T} T{ -cloned\-mac\-address +name T}:T{ -byte array +string T}:T{ -[] +802\-11\-wireless T}:T{ -If specified, request that the Wi\-Fi device use this MAC address instead of its permanent MAC address\&. This is known as MAC cloning or spoofing\&. +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. T} T{ -mac\-address\-blacklist +rate T}:T{ -array of string +uint32 T}:T{ -\ \& +0 T}:T{ -A list of permanent MAC addresses of Wi\-Fi devices to which this connection should never apply\&. Each MAC address should be given in the standard hex\-digits\-and\-colons notation (eg \*(Aq00:11:22:33:44:55\*(Aq)\&. +If non\-zero, directs the device to only use the specified bitrate for communication with the access point\&. Units are in Kb/s, ie 5500 = 5\&.5 Mbit/s\&. This property is highly driver dependent and not all devices support setting a static bitrate\&. T} T{ -mtu +security T}:T{ -uint32 +None T}:T{ -0 +\ \& T}:T{ -If non\-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple Ethernet frames\&. +This property is deprecated, but can be set to the value \*(Aq802\-11\-wireless\-security\*(Aq when a wireless security setting is also present in the connection dictionary, for compatibility with very old NetworkManager daemons\&. T} T{ seen\-bssids T}:T{ array of string T}:T{ -\ \& +[] T}:T{ -A list of BSSIDs (each BSSID formatted as a MAC address like 00:11:22:33:44:55\*(Aq) that have been detected as part of the Wi\-Fi network\&. NetworkManager internally tracks previously seen BSSIDs\&. The property is only meant for reading and reflects the BSSID list of NetworkManager\&. The changes you make to this property will not be preserved\&. +A list of BSSIDs (each BSSID formatted as a MAC address like "00:11:22:33:44:55") that have been detected as part of the Wi\-Fi network\&. NetworkManager internally tracks previously seen BSSIDs\&. The property is only meant for reading and reflects the BSSID list of NetworkManager\&. The changes you make to this property will not be preserved\&. T} T{ -security +ssid T}:T{ -string +byte array T}:T{ \ \& T}:T{ -If the wireless connection has any security restrictions, like 802\&.1x, WEP, or WPA, set this property to \*(Aq802\-11\-wireless\-security\*(Aq and ensure the connection contains a valid 802\-11\-wireless\-security setting\&. +SSID of the Wi\-Fi network\&. Must be specified\&. T} T{ -hidden +tx\-power T}:T{ -boolean +uint32 T}:T{ -FALSE +0 T}:T{ -If TRUE, indicates this network is a non\-broadcasting network that hides its SSID\&. In this case various workarounds may take place, such as probe\-scanning the SSID for more reliable network discovery\&. However, these workarounds expose inherent insecurities with hidden SSID networks, and thus hidden SSID networks should be used with caution\&. +If non\-zero, directs the device to use the specified transmit power\&. Units are dBm\&. This property is highly driver dependent and not all devices support setting a static transmit power\&. T} .TE .sp 1 @@ -2767,7 +2878,7 @@ T} .nr an-no-space-flag 1 .nr an-break-flag 1 .br -.B Table\ \&25.\ \&802-11-wireless-security setting +.B Table\ \&26.\ \&802-11-wireless-security setting .TS allbox tab(:); lB lB lB lB. @@ -2800,166 +2911,166 @@ l l l l l l l l l l l l. T{ -name +auth\-alg T}:T{ string T}:T{ -802\-11\-wireless\-security +\ \& T}:T{ -The setting\*(Aqs name; these names are defined by the specification and cannot be changed after the object has been created\&. Each setting class has a name, and all objects of that class share the same name\&. +When WEP is used (ie, key\-mgmt = "none" or "ieee8021x") indicate the 802\&.11 authentication algorithm required by the AP here\&. One of "open" for Open System, "shared" for Shared Key, or "leap" for Cisco LEAP\&. When using Cisco LEAP (ie, key\-mgmt = "ieee8021x" and auth\-alg = "leap") the "leap\-username" and "leap\-password" properties must be specified\&. T} T{ -key\-mgmt +group T}:T{ -string +array of string T}:T{ -\ \& +[] T}:T{ -Key management used for the connection\&. One of \*(Aqnone\*(Aq (WEP), \*(Aqieee8021x\*(Aq (Dynamic WEP), \*(Aqwpa\-none\*(Aq (WPA\-PSK Ad\-Hoc), \*(Aqwpa\-psk\*(Aq (infrastructure WPA\-PSK), or \*(Aqwpa\-eap\*(Aq (WPA\-Enterprise)\&. This property must be set for any Wi\-Fi connection that uses security\&. +A list of group/broadcast encryption algorithms which prevents connections to Wi\-Fi networks that do not utilize one of the algorithms in the list\&. For maximum compatibility leave this property empty\&. Each list element may be one of "wep40", "wep104", "tkip", or "ccmp"\&. T} T{ -wep\-tx\-keyidx +key\-mgmt T}:T{ -uint32 +string T}:T{ -0 +\ \& T}:T{ -When static WEP is used (ie, key\-mgmt = \*(Aqnone\*(Aq) and a non\-default WEP key index is used by the AP, put that WEP key index here\&. Valid values are 0 (default key) through 3\&. Note that some consumer access points (like the Linksys WRT54G) number the keys 1 \- 4\&. +Key management used for the connection\&. One of "none" (WEP), "ieee8021x" (Dynamic WEP), "wpa\-none" (Ad\-Hoc WPA\-PSK), "wpa\-psk" (infrastructure WPA\-PSK), or "wpa\-eap" (WPA\-Enterprise)\&. This property must be set for any Wi\-Fi connection that uses security\&. T} T{ -auth\-alg +leap\-password T}:T{ string T}:T{ \ \& T}:T{ -When WEP is used (ie, key\-mgmt = \*(Aqnone\*(Aq or \*(Aqieee8021x\*(Aq) indicate the 802\&.11 authentication algorithm required by the AP here\&. One of \*(Aqopen\*(Aq for Open System, \*(Aqshared\*(Aq for Shared Key, or \*(Aqleap\*(Aq for Cisco LEAP\&. When using Cisco LEAP (ie, key\-mgmt = \*(Aqieee8021x\*(Aq and auth\-alg = \*(Aqleap\*(Aq) the \*(Aqleap\-username\*(Aq and \*(Aqleap\-password\*(Aq properties must be specified\&. +The login password for legacy LEAP connections (ie, key\-mgmt = "ieee8021x" and auth\-alg = "leap")\&. T} T{ -proto +leap\-password\-flags T}:T{ -array of string +NMSettingSecretFlags (uint32) T}:T{ \ \& T}:T{ -List of strings specifying the allowed WPA protocol versions to use\&. Each element may be one \*(Aqwpa\*(Aq (allow WPA) or \*(Aqrsn\*(Aq (allow WPA2/RSN)\&. If not specified, both WPA and RSN connections are allowed\&. +Flags indicating how to handle the "leap\-password" property\&. (see the section called \(lqSecret flag types:\(rq for flag values) T} T{ -pairwise +leap\-username T}:T{ -array of string +string T}:T{ \ \& T}:T{ -A list of pairwise encryption algorithms which prevents connections to Wi\-Fi networks that do not utilize one of the algorithms in the list\&. For maximum compatibility leave this property empty\&. Each list element may be one of \*(Aqtkip\*(Aq or \*(Aqccmp\*(Aq\&. +The login username for legacy LEAP connections (ie, key\-mgmt = "ieee8021x" and auth\-alg = "leap")\&. T} T{ -group +name T}:T{ -array of string +string T}:T{ -\ \& +802\-11\-wireless\-security T}:T{ -A list of group/broadcast encryption algorithms which prevents connections to Wi\-Fi networks that do not utilize one of the algorithms in the list\&. For maximum compatibility leave this property empty\&. Each list element may be one of \*(Aqwep40\*(Aq, \*(Aqwep104\*(Aq, \*(Aqtkip\*(Aq, or \*(Aqccmp\*(Aq\&. +The setting\*(Aqs name, which uniquely identifies the setting within the connection\&. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired"\&. T} T{ -leap\-username +pairwise T}:T{ -string +array of string T}:T{ -\ \& +[] T}:T{ -The login username for legacy LEAP connections (ie, key\-mgmt = \*(Aqieee8021x\*(Aq and auth\-alg = \*(Aqleap\*(Aq)\&. +A list of pairwise encryption algorithms which prevents connections to Wi\-Fi networks that do not utilize one of the algorithms in the list\&. For maximum compatibility leave this property empty\&. Each list element may be one of "tkip" or "ccmp"\&. T} T{ -wep\-key0 +proto T}:T{ -string +array of string T}:T{ -\ \& +[] T}:T{ -Index 0 WEP key\&. This is the WEP key used in most networks\&. See the \*(Aqwep\-key\-type\*(Aq property for a description of how this key is interpreted\&. +List of strings specifying the allowed WPA protocol versions to use\&. Each element may be one "wpa" (allow WPA) or "rsn" (allow WPA2/RSN)\&. If not specified, both WPA and RSN connections are allowed\&. T} T{ -wep\-key1 +psk T}:T{ string T}:T{ \ \& T}:T{ -Index 1 WEP key\&. This WEP index is not used by most networks\&. See the \*(Aqwep\-key\-type\*(Aq property for a description of how this key is interpreted\&. +Pre\-Shared\-Key for WPA networks\&. If the key is 64\-characters long, it must contain only hexadecimal characters and is interpreted as a hexadecimal WPA key\&. Otherwise, the key must be between 8 and 63 ASCII characters (as specified in the 802\&.11i standard) and is interpreted as a WPA passphrase, and is hashed to derive the actual WPA\-PSK used when connecting to the Wi\-Fi network\&. T} T{ -wep\-key2 +psk\-flags T}:T{ -string +NMSettingSecretFlags (uint32) T}:T{ \ \& T}:T{ -Index 2 WEP key\&. This WEP index is not used by most networks\&. See the \*(Aqwep\-key\-type\*(Aq property for a description of how this key is interpreted\&. +Flags indicating how to handle the "psk" property\&. (see the section called \(lqSecret flag types:\(rq for flag values) T} T{ -wep\-key3 +wep\-key\-flags T}:T{ -string +NMSettingSecretFlags (uint32) T}:T{ \ \& T}:T{ -Index 3 WEP key\&. This WEP index is not used by most networks\&. See the \*(Aqwep\-key\-type\*(Aq property for a description of how this key is interpreted\&. +Flags indicating how to handle the "wep\-key0", "wep\-key1", "wep\-key2", and "wep\-key3" properties\&. (see the section called \(lqSecret flag types:\(rq for flag values) T} T{ -wep\-key\-flags +wep\-key\-type T}:T{ -uint32 +NMWepKeyType (uint32) T}:T{ -0 +\ \& T}:T{ -Flags indicating how to handle the WEP keys\&. (see the section called \(lqSecret flag types:\(rq for flag values) +Controls the interpretation of WEP keys\&. Allowed values are NM_WEP_KEY_TYPE_KEY (1), in which case the key is either a 10\- or 26\-character hexadecimal string, or a 5\- or 13\-character ASCII password; or NM_WEP_KEY_TYPE_PASSPHRASE (2), in which case the passphrase is provided as a string and will be hashed using the de\-facto MD5 method to derive the actual WEP key\&. T} T{ -wep\-key\-type +wep\-key0 T}:T{ -uint32 +string T}:T{ -0 +\ \& T}:T{ -Controls the interpretation of WEP keys\&. Allowed values are 1 (interpret WEP keys as hexadecimal or ASCII keys) or 2 (interpret WEP keys as WEP Passphrases)\&. If set to 1 and the keys are hexadecimal, they must be either 10 or 26 characters in length\&. If set to 1 and the keys are ASCII keys, they must be either 5 or 13 characters in length\&. If set to 2, the passphrase is hashed using the de\-facto MD5 method to derive the actual WEP key\&. +Index 0 WEP key\&. This is the WEP key used in most networks\&. See the "wep\-key\-type" property for a description of how this key is interpreted\&. T} T{ -psk +wep\-key1 T}:T{ string T}:T{ \ \& T}:T{ -Pre\-Shared\-Key for WPA networks\&. If the key is 64\-characters long, it must contain only hexadecimal characters and is interpreted as a hexadecimal WPA key\&. Otherwise, the key must be between 8 and 63 ASCII characters (as specified in the 802\&.11i standard) and is interpreted as a WPA passphrase, and is hashed to derive the actual WPA\-PSK used when connecting to the Wi\-Fi network\&. +Index 1 WEP key\&. This WEP index is not used by most networks\&. See the "wep\-key\-type" property for a description of how this key is interpreted\&. T} T{ -psk\-flags +wep\-key2 T}:T{ -uint32 +string T}:T{ -0 +\ \& T}:T{ -Flags indicating how to handle the WPA PSK key\&. (see the section called \(lqSecret flag types:\(rq for flag values) +Index 2 WEP key\&. This WEP index is not used by most networks\&. See the "wep\-key\-type" property for a description of how this key is interpreted\&. T} T{ -leap\-password +wep\-key3 T}:T{ string T}:T{ \ \& T}:T{ -The login password for legacy LEAP connections (ie, key\-mgmt = \*(Aqieee8021x\*(Aq and auth\-alg = \*(Aqleap\*(Aq)\&. +Index 3 WEP key\&. This WEP index is not used by most networks\&. See the "wep\-key\-type" property for a description of how this key is interpreted\&. T} T{ -leap\-password\-flags +wep\-tx\-keyidx T}:T{ uint32 T}:T{ 0 T}:T{ -Flags indicating how to handle the LEAP password\&. (see the section called \(lqSecret flag types:\(rq for flag values) +When static WEP is used (ie, key\-mgmt = "none") and a non\-default WEP key index is used by the AP, put that WEP key index here\&. Valid values are 0 (default key) through 3\&. Note that some consumer access points (like the Linksys WRT54G) number the keys 1 \- 4\&. T} .TE .sp 1 @@ -3024,6 +3135,6 @@ NetworkManager developers or distro plugin\-specific location .SH "SEE ALSO" .PP -https://live\&.gnome\&.org/NetworkManagerConfiguration +https://wiki\&.gnome\&.org/Projects/NetworkManager/ConfigurationSpecification .PP NetworkManager(8), nmcli(1), nmcli\-examples(5), NetworkManager\&.conf(5) diff --git a/man/nm-settings.xml b/man/nm-settings.xml new file mode 100644 index 00000000..7c3dd96a --- /dev/null +++ b/man/nm-settings.xml @@ -0,0 +1,343 @@ +<?xml version="1.0"?> +<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.3//EN" "http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd"> +<refentry id="nm-settings"><refentryinfo><date>19 December 2014</date></refentryinfo><refmeta><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum><refmiscinfo class="source">NetworkManager</refmiscinfo><refmiscinfo class="manual">Configuration</refmiscinfo><refmiscinfo class="version">1.0.0</refmiscinfo></refmeta><refnamediv><refname>nm-settings</refname><refpurpose>Description of settings and properties of NetworkManager connection profiles</refpurpose></refnamediv><refsect1><title>DESCRIPTION</title><para> + NetworkManager is based on a concept of connection profiles, sometimes referred to as + connections only. These connection profiles contain a network configuration. When + NetworkManager activates a connection profile on a network device the configuration will + be applied and an active network connection will be established. Users are free to create + as many connection profiles as they see fit. Thus they are flexible in having various network + configurations for different networking needs. The connection profiles are handled by + NetworkManager via <emphasis>settings service</emphasis> and are exported on D-Bus + (<emphasis>/org/freedesktop/NetworkManager/Settings/<num></emphasis> objects). + The conceptual objects can be described as follows: + <variablelist><varlistentry><term>Connection (profile)</term><listitem><para> + A specific, encapsulated, independent group of settings describing + all the configuration required to connect to a specific network. + It is referred to by a unique identifier called the UUID. A connection + is tied to a one specific device type, but not necessarily a specific + hardware device. It is composed of one or more <emphasis>Settings</emphasis> + objects. + </para></listitem></varlistentry></variablelist><variablelist><varlistentry><term>Setting</term><listitem><para> + A group of related key/value pairs describing a specific piece of a + <emphasis>Connection (profile)</emphasis>. Settings keys and allowed values are + described in the tables below. Keys are also reffered to as properties. + Developers can find the setting objects and their properties in the libnm-util + sources. Look for the <function>class_init</function> functions near the bottom of + each setting source file. + </para></listitem></varlistentry></variablelist><variablelist><para> + The settings and properties shown in tables below list all available connection + configuration options. However, note that not all settings are applicable to all + connection types. NetworkManager provides a command-line tool <emphasis>nmcli</emphasis> + that allows direct configuration of the settings and properties according to a connection + profile type. <emphasis>nmcli</emphasis> connection editor has also a built-in + <emphasis>describe</emphasis> command that can display description of particular settings + and properties of this page. + </para></variablelist></para> + <table><title>802-1x setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody> + <row><entry align="left">altsubject-matches</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>List of strings to be matched against the altSubjectName of the certificate presented by the authentication server. If the list is empty, no verification of the server certificate's altSubjectName is performed.</entry></row> + <row><entry align="left">anonymous-identity</entry><entry align="left">string</entry><entry align="left"/><entry>Anonymous identity string for EAP authentication methods. Used as the unencrypted identity with EAP types that support different tunneled identity like EAP-TTLS.</entry></row> + <row><entry align="left">ca-cert</entry><entry align="left">byte array</entry><entry align="left"/><entry>Contains the CA certificate if used by the EAP method specified in the "eap" property. Certificate data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended.</entry></row> + <row><entry align="left">ca-path</entry><entry align="left">string</entry><entry align="left"/><entry>UTF-8 encoded path to a directory containing PEM or DER formatted certificates to be added to the verification chain in addition to the certificate specified in the "ca-cert" property.</entry></row> + <row><entry align="left">client-cert</entry><entry align="left">byte array</entry><entry align="left"/><entry>Contains the client certificate if used by the EAP method specified in the "eap" property. Certificate data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte.</entry></row> + <row><entry align="left">eap</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>The allowed EAP method to be used when authenticating to the network with 802.1x. Valid methods are: "leap", "md5", "tls", "peap", "ttls", "pwd", and "fast". Each method requires different configuration using the properties of this setting; refer to wpa_supplicant documentation for the allowed combinations.</entry></row> + <row><entry align="left">identity</entry><entry align="left">string</entry><entry align="left"/><entry>Identity string for EAP authentication methods. Often the user's user or login name.</entry></row> + <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">802-1x</entry><entry>The setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row> + <row><entry align="left">pac-file</entry><entry align="left">string</entry><entry align="left"/><entry>UTF-8 encoded file path containing PAC for EAP-FAST.</entry></row> + <row><entry align="left">password</entry><entry align="left">string</entry><entry align="left"/><entry>UTF-8 encoded password used for EAP authentication methods. If both the "password" property and the "password-raw" property are specified, "password" is preferred.</entry></row> + <row><entry align="left">password-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "password" property. (see <xref linkend="secrets-flags"/> for flag values)</entry></row> + <row><entry align="left">password-raw</entry><entry align="left">byte array</entry><entry align="left"/><entry>Password used for EAP authentication methods, given as a byte array to allow passwords in other encodings than UTF-8 to be used. If both the "password" property and the "password-raw" property are specified, "password" is preferred.</entry></row> + <row><entry align="left">password-raw-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "password-raw" property. (see <xref linkend="secrets-flags"/> for flag values)</entry></row> + <row><entry align="left">phase1-fast-provisioning</entry><entry align="left">string</entry><entry align="left"/><entry>Enables or disables in-line provisioning of EAP-FAST credentials when FAST is specified as the EAP method in the "eap" property. Recognized values are "0" (disabled), "1" (allow unauthenticated provisioning), "2" (allow authenticated provisioning), and "3" (allow both authenticated and unauthenticated provisioning). See the wpa_supplicant documentation for more details.</entry></row> + <row><entry align="left">phase1-peaplabel</entry><entry align="left">string</entry><entry align="left"/><entry>Forces use of the new PEAP label during key derivation. Some RADIUS servers may require forcing the new PEAP label to interoperate with PEAPv1. Set to "1" to force use of the new PEAP label. See the wpa_supplicant documentation for more details.</entry></row> + <row><entry align="left">phase1-peapver</entry><entry align="left">string</entry><entry align="left"/><entry>Forces which PEAP version is used when PEAP is set as the EAP method in the "eap" property. When unset, the version reported by the server will be used. Sometimes when using older RADIUS servers, it is necessary to force the client to use a particular PEAP version. To do so, this property may be set to "0" or "1" to force that specific PEAP version.</entry></row> + <row><entry align="left">phase2-altsubject-matches</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>List of strings to be matched against the altSubjectName of the certificate presented by the authentication server during the inner "phase 2" authentication. If the list is empty, no verification of the server certificate's altSubjectName is performed.</entry></row> + <row><entry align="left">phase2-auth</entry><entry align="left">string</entry><entry align="left"/><entry>Specifies the allowed "phase 2" inner non-EAP authentication methods when an EAP method that uses an inner TLS tunnel is specified in the "eap" property. Recognized non-EAP "phase 2" methods are "pap", "chap", "mschap", "mschapv2", "gtc", "otp", "md5", and "tls". Each "phase 2" inner method requires specific parameters for successful authentication; see the wpa_supplicant documentation for more details.</entry></row> + <row><entry align="left">phase2-autheap</entry><entry align="left">string</entry><entry align="left"/><entry>Specifies the allowed "phase 2" inner EAP-based authentication methods when an EAP method that uses an inner TLS tunnel is specified in the "eap" property. Recognized EAP-based "phase 2" methods are "md5", "mschapv2", "otp", "gtc", and "tls". Each "phase 2" inner method requires specific parameters for successful authentication; see the wpa_supplicant documentation for more details.</entry></row> + <row><entry align="left">phase2-ca-cert</entry><entry align="left">byte array</entry><entry align="left"/><entry>Contains the "phase 2" CA certificate if used by the EAP method specified in the "phase2-auth" or "phase2-autheap" properties. Certificate data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended.</entry></row> + <row><entry align="left">phase2-ca-path</entry><entry align="left">string</entry><entry align="left"/><entry>UTF-8 encoded path to a directory containing PEM or DER formatted certificates to be added to the verification chain in addition to the certificate specified in the "phase2-ca-cert" property.</entry></row> + <row><entry align="left">phase2-client-cert</entry><entry align="left">byte array</entry><entry align="left"/><entry>Contains the "phase 2" client certificate if used by the EAP method specified in the "phase2-auth" or "phase2-autheap" properties. Certificate data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended.</entry></row> + <row><entry align="left">phase2-private-key</entry><entry align="left">byte array</entry><entry align="left"/><entry>Contains the "phase 2" inner private key when the "phase2-auth" or "phase2-autheap" property is set to "tls". Key data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme and private keys, this property should be set to the key's encrypted PEM encoded data. When using private keys with the path scheme, this property should be set to the full UTF-8 encoded path of the key, prefixed with the string "file://" and ending with a terminating NUL byte. When using PKCS#12 format private keys and the blob scheme, this property should be set to the PKCS#12 data and the "phase2-private-key-password" property must be set to password used to decrypt the PKCS#12 certificate and key. When using PKCS#12 files and the path scheme, this property should be set to the full UTF-8 encoded path of the key, prefixed with the string "file://" and and ending with a terminating NUL byte, and as with the blob scheme the "phase2-private-key-password" property must be set to the password used to decode the PKCS#12 private key and certificate.</entry></row> + <row><entry align="left">phase2-private-key-password</entry><entry align="left">string</entry><entry align="left"/><entry>The password used to decrypt the "phase 2" private key specified in the "phase2-private-key" property when the private key either uses the path scheme, or is a PKCS#12 format key.</entry></row> + <row><entry align="left">phase2-private-key-password-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "phase2-private-key-password" property. (see <xref linkend="secrets-flags"/> for flag values)</entry></row> + <row><entry align="left">phase2-subject-match</entry><entry align="left">string</entry><entry align="left"/><entry>Substring to be matched against the subject of the certificate presented by the authentication server during the inner "phase 2" authentication. When unset, no verification of the authentication server certificate's subject is performed.</entry></row> + <row><entry align="left">pin</entry><entry align="left">string</entry><entry align="left"/><entry>PIN used for EAP authentication methods.</entry></row> + <row><entry align="left">pin-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "pin" property. (see <xref linkend="secrets-flags"/> for flag values)</entry></row> + <row><entry align="left">private-key</entry><entry align="left">byte array</entry><entry align="left"/><entry>Contains the private key when the "eap" property is set to "tls". Key data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme and private keys, this property should be set to the key's encrypted PEM encoded data. When using private keys with the path scheme, this property should be set to the full UTF-8 encoded path of the key, prefixed with the string "file://" and ending with a terminating NUL byte. When using PKCS#12 format private keys and the blob scheme, this property should be set to the PKCS#12 data and the "private-key-password" property must be set to password used to decrypt the PKCS#12 certificate and key. When using PKCS#12 files and the path scheme, this property should be set to the full UTF-8 encoded path of the key, prefixed with the string "file://" and and ending with a terminating NUL byte, and as with the blob scheme the "private-key-password" property must be set to the password used to decode the PKCS#12 private key and certificate. WARNING: "private-key" is not a "secret" property, and thus unencrypted private key data using the BLOB scheme may be readable by unprivileged users. Private keys should always be encrypted with a private key password to prevent unauthorized access to unencrypted private key data.</entry></row> + <row><entry align="left">private-key-password</entry><entry align="left">string</entry><entry align="left"/><entry>The password used to decrypt the private key specified in the "private-key" property when the private key either uses the path scheme, or if the private key is a PKCS#12 format key.</entry></row> + <row><entry align="left">private-key-password-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "private-key-password" property. (see <xref linkend="secrets-flags"/> for flag values)</entry></row> + <row><entry align="left">subject-match</entry><entry align="left">string</entry><entry align="left"/><entry>Substring to be matched against the subject of the certificate presented by the authentication server. When unset, no verification of the authentication server certificate's subject is performed.</entry></row> + <row><entry align="left">system-ca-certs</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>When TRUE, overrides the "ca-path" and "phase2-ca-path" properties using the system CA directory specified at configure time with the --system-ca-path switch. The certificates in this directory are added to the verification chain in addition to any certificates specified by the "ca-cert" and "phase2-ca-cert" properties.</entry></row> + </tbody></tgroup></table> + <table><title>adsl setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody> + <row><entry align="left">encapsulation</entry><entry align="left">string</entry><entry align="left"/><entry>Encapsulation of ADSL connection. Can be "vcmux" or "llc".</entry></row> + <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">adsl</entry><entry>The setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row> + <row><entry align="left">password</entry><entry align="left">string</entry><entry align="left"/><entry>Password used to authenticate with the ADSL service.</entry></row> + <row><entry align="left">password-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "password" property. (see <xref linkend="secrets-flags"/> for flag values)</entry></row> + <row><entry align="left">protocol</entry><entry align="left">string</entry><entry align="left"/><entry>ADSL connection protocol. Can be "pppoa", "pppoe" or "ipoatm".</entry></row> + <row><entry align="left">username</entry><entry align="left">string</entry><entry align="left"/><entry>Username used to authenticate with the ADSL service.</entry></row> + <row><entry align="left">vci</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>VCI of ADSL connection</entry></row> + <row><entry align="left">vpi</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>VPI of ADSL connection</entry></row> + </tbody></tgroup></table> + <table><title>bluetooth setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody> + <row><entry align="left">bdaddr</entry><entry align="left">byte array</entry><entry align="left"/><entry>The Bluetooth address of the device.</entry></row> + <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">bluetooth</entry><entry>The setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row> + <row><entry align="left">type</entry><entry align="left">string</entry><entry align="left"/><entry>Either "dun" for Dial-Up Networking connections or "panu" for Personal Area Networking connections to devices supporting the NAP profile.</entry></row> + </tbody></tgroup></table> + <table><title>bond setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody> + <row><entry align="left">interface-name</entry><entry align="left">string</entry><entry align="left"/><entry>Deprecated in favor of connection.interface-name, but can be used for backward-compatibility with older daemons, to set the bond's interface name.</entry></row> + <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">bond</entry><entry>The setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row> + <row><entry align="left">options</entry><entry align="left">dict of string to string</entry><entry align="left"/><entry>Dictionary of key/value pairs of bonding options. Both keys and values must be strings. Option names must contain only alphanumeric characters (ie, [a-zA-Z0-9]).</entry></row> + </tbody></tgroup></table> + <table><title>bridge setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody> + <row><entry align="left">ageing-time</entry><entry align="left">uint32</entry><entry align="left">300</entry><entry>The Ethernet MAC address aging time, in seconds.</entry></row> + <row><entry align="left">forward-delay</entry><entry align="left">uint32</entry><entry align="left">15</entry><entry>The Spanning Tree Protocol (STP) forwarding delay, in seconds.</entry></row> + <row><entry align="left">hello-time</entry><entry align="left">uint32</entry><entry align="left">2</entry><entry>The Spanning Tree Protocol (STP) hello time, in seconds.</entry></row> + <row><entry align="left">interface-name</entry><entry align="left">string</entry><entry align="left"/><entry>Deprecated in favor of connection.interface-name, but can be used for backward-compatibility with older daemons, to set the bridge's interface name.</entry></row> + <row><entry align="left">mac-address</entry><entry align="left">byte array</entry><entry align="left"/><entry>If specified, the MAC address of bridge. When creating a new bridge, this MAC address will be set. When matching an existing (outside NetworkManager created) bridge, this MAC address must match.</entry></row> + <row><entry align="left">max-age</entry><entry align="left">uint32</entry><entry align="left">20</entry><entry>The Spanning Tree Protocol (STP) maximum message age, in seconds.</entry></row> + <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">bridge</entry><entry>The setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row> + <row><entry align="left">priority</entry><entry align="left">uint32</entry><entry align="left">32768</entry><entry>Sets the Spanning Tree Protocol (STP) priority for this bridge. Lower values are "better"; the lowest priority bridge will be elected the root bridge.</entry></row> + <row><entry align="left">stp</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>Controls whether Spanning Tree Protocol (STP) is enabled for this bridge.</entry></row> + </tbody></tgroup></table> + <table><title>bridge-port setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody> + <row><entry align="left">hairpin-mode</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>Enables or disabled "hairpin mode" for the port, which allows frames to be sent back out through the port the frame was received on.</entry></row> + <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">bridge-port</entry><entry>The setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row> + <row><entry align="left">path-cost</entry><entry align="left">uint32</entry><entry align="left">100</entry><entry>The Spanning Tree Protocol (STP) port cost for destinations via this port.</entry></row> + <row><entry align="left">priority</entry><entry align="left">uint32</entry><entry align="left">32</entry><entry>The Spanning Tree Protocol (STP) priority of this bridge port.</entry></row> + </tbody></tgroup></table> + <table><title>cdma setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody> + <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">cdma</entry><entry>The setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row> + <row><entry align="left">number</entry><entry align="left">string</entry><entry align="left"/><entry>The number to dial to establish the connection to the CDMA-based mobile broadband network, if any. If not specified, the default number (#777) is used when required.</entry></row> + <row><entry align="left">password</entry><entry align="left">string</entry><entry align="left"/><entry>The password used to authenticate with the network, if required. Many providers do not require a password, or accept any password. But if a password is required, it is specified here.</entry></row> + <row><entry align="left">password-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "password" property. (see <xref linkend="secrets-flags"/> for flag values)</entry></row> + <row><entry align="left">username</entry><entry align="left">string</entry><entry align="left"/><entry>The username used to authenticate with the network, if required. Many providers do not require a username, or accept any username. But if a username is required, it is specified here.</entry></row> + </tbody></tgroup></table> + <table><title>connection setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody> + <row><entry align="left">autoconnect</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>Whether or not the connection should be automatically connected by NetworkManager when the resources for the connection are available. TRUE to automatically activate the connection, FALSE to require manual intervention to activate the connection.</entry></row> + <row><entry align="left">autoconnect-priority</entry><entry align="left">int32</entry><entry align="left">0</entry><entry>The autoconnect priority. If the connection is set to autoconnect, connections with higher priority will be preferred. Defaults to 0. The higher number means higher priority.</entry></row> + <row><entry align="left">gateway-ping-timeout</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>If greater than zero, delay success of IP addressing until either the timeout is reached, or an IP gateway replies to a ping.</entry></row> + <row><entry align="left">id</entry><entry align="left">string</entry><entry align="left"/><entry>A human readable unique identifier for the connection, like "Work Wi-Fi" or "T-Mobile 3G".</entry></row> + <row><entry align="left">interface-name</entry><entry align="left">string</entry><entry align="left"/><entry>The name of the network interface this connection is bound to. If not set, then the connection can be attached to any interface of the appropriate type (subject to restrictions imposed by other settings). For software devices this specifies the name of the created device. For connection types where interface names cannot easily be made persistent (e.g. mobile broadband or USB Ethernet), this property should not be used. Setting this property restricts the interfaces a connection can be used with, and if interface names change or are reordered the connection may be applied to the wrong interface.</entry></row> + <row><entry align="left">master</entry><entry align="left">string</entry><entry align="left"/><entry>Interface name of the master device or UUID of the master connection.</entry></row> + <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">connection</entry><entry>The setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row> + <row><entry align="left">permissions</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>An array of strings defining what access a given user has to this connection. If this is NULL or empty, all users are allowed to access this connection. Otherwise a user is allowed to access this connection if and only if they are in this list. Each entry is of the form "[type]:[id]:[reserved]"; for example, "user:dcbw:blah". At this time only the "user" [type] is allowed. Any other values are ignored and reserved for future use. [id] is the username that this permission refers to, which may not contain the ":" character. Any [reserved] information present must be ignored and is reserved for future use. All of [type], [id], and [reserved] must be valid UTF-8.</entry></row> + <row><entry align="left">read-only</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>FALSE if the connection can be modified using the provided settings service's D-Bus interface with the right privileges, or TRUE if the connection is read-only and cannot be modified.</entry></row> + <row><entry align="left">secondaries</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>List of connection UUIDs that should be activated when the base connection itself is activated. Currently only VPN connections are supported.</entry></row> + <row><entry align="left">slave-type</entry><entry align="left">string</entry><entry align="left"/><entry>Setting name of the device type of this slave's master connection (eg, "bond"), or NULL if this connection is not a slave.</entry></row> + <row><entry align="left">timestamp</entry><entry align="left">uint64</entry><entry align="left">0</entry><entry>The time, in seconds since the Unix Epoch, that the connection was last _successfully_ fully activated. NetworkManager updates the connection timestamp periodically when the connection is active to ensure that an active connection has the latest timestamp. The property is only meant for reading (changes to this property will not be preserved).</entry></row> + <row><entry align="left">type</entry><entry align="left">string</entry><entry align="left"/><entry>Base type of the connection. For hardware-dependent connections, should contain the setting name of the hardware-type specific setting (ie, "802-3-ethernet" or "802-11-wireless" or "bluetooth", etc), and for non-hardware dependent connections like VPN or otherwise, should contain the setting name of that setting type (ie, "vpn" or "bridge", etc).</entry></row> + <row><entry align="left">uuid</entry><entry align="left">string</entry><entry align="left"/><entry>A universally unique identifier for the connection, for example generated with libuuid. It should be assigned when the connection is created, and never changed as long as the connection still applies to the same network. For example, it should not be changed when the "id" property or NMSettingIP4Config changes, but might need to be re-created when the Wi-Fi SSID, mobile broadband network provider, or "type" property changes. The UUID must be in the format "2815492f-7e56-435e-b2e9-246bd7cdc664" (ie, contains only hexadecimal characters and "-").</entry></row> + <row><entry align="left">zone</entry><entry align="left">string</entry><entry align="left"/><entry>The trust level of a the connection. Free form case-insensitive string (for example "Home", "Work", "Public"). NULL or unspecified zone means the connection will be placed in the default zone as defined by the firewall.</entry></row> + </tbody></tgroup></table> + <table><title>dcb setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody> + <row><entry align="left">app-fcoe-flags</entry><entry align="left">NMSettingDcbFlags (uint32)</entry><entry align="left"/><entry>Specifies the NMSettingDcbFlags for the DCB FCoE application. Flags may be any combination of NM_SETTING_DCB_FLAG_ENABLE (0x1), NM_SETTING_DCB_FLAG_ADVERTISE (0x2), and NM_SETTING_DCB_FLAG_WILLING (0x4).</entry></row> + <row><entry align="left">app-fcoe-mode</entry><entry align="left">string</entry><entry align="left">"fabric"</entry><entry>The FCoE controller mode; either "fabric" (default) or "vn2vn".</entry></row> + <row><entry align="left">app-fcoe-priority</entry><entry align="left">int32</entry><entry align="left">-1</entry><entry>The highest User Priority (0 - 7) which FCoE frames should use, or -1 for default priority. Only used when the "app-fcoe-flags" property includes the NM_SETTING_DCB_FLAG_ENABLE (0x1) flag.</entry></row> + <row><entry align="left">app-fip-flags</entry><entry align="left">NMSettingDcbFlags (uint32)</entry><entry align="left"/><entry>Specifies the NMSettingDcbFlags for the DCB FIP application. Flags may be any combination of NM_SETTING_DCB_FLAG_ENABLE (0x1), NM_SETTING_DCB_FLAG_ADVERTISE (0x2), and NM_SETTING_DCB_FLAG_WILLING (0x4).</entry></row> + <row><entry align="left">app-fip-priority</entry><entry align="left">int32</entry><entry align="left">-1</entry><entry>The highest User Priority (0 - 7) which FIP frames should use, or -1 for default priority. Only used when the "app-fip-flags" property includes the NM_SETTING_DCB_FLAG_ENABLE (0x1) flag.</entry></row> + <row><entry align="left">app-iscsi-flags</entry><entry align="left">NMSettingDcbFlags (uint32)</entry><entry align="left"/><entry>Specifies the NMSettingDcbFlags for the DCB iSCSI application. Flags may be any combination of NM_SETTING_DCB_FLAG_ENABLE (0x1), NM_SETTING_DCB_FLAG_ADVERTISE (0x2), and NM_SETTING_DCB_FLAG_WILLING (0x4).</entry></row> + <row><entry align="left">app-iscsi-priority</entry><entry align="left">int32</entry><entry align="left">-1</entry><entry>The highest User Priority (0 - 7) which iSCSI frames should use, or -1 for default priority. Only used when the "app-iscsi-flags" property includes the NM_SETTING_DCB_FLAG_ENABLE (0x1) flag.</entry></row> + <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">dcb</entry><entry>The setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row> + <row><entry align="left">priority-bandwidth</entry><entry align="left">array of uint32</entry><entry align="left"/><entry>An array of 8 uint values, where the array index corresponds to the User Priority (0 - 7) and the value indicates the percentage of bandwidth of the priority's assigned group that the priority may use. The sum of all percentages for priorities which belong to the same group must total 100 percent.</entry></row> + <row><entry align="left">priority-flow-control</entry><entry align="left">array of uint32</entry><entry align="left"/><entry>An array of 8 boolean values, where the array index corresponds to the User Priority (0 - 7) and the value indicates whether or not the corresponding priority should transmit priority pause.</entry></row> + <row><entry align="left">priority-flow-control-flags</entry><entry align="left">NMSettingDcbFlags (uint32)</entry><entry align="left"/><entry>Specifies the NMSettingDcbFlags for DCB Priority Flow Control (PFC). Flags may be any combination of NM_SETTING_DCB_FLAG_ENABLE (0x1), NM_SETTING_DCB_FLAG_ADVERTISE (0x2), and NM_SETTING_DCB_FLAG_WILLING (0x4).</entry></row> + <row><entry align="left">priority-group-bandwidth</entry><entry align="left">array of uint32</entry><entry align="left"/><entry>An array of 8 uint values, where the array index corresponds to the Priority Group ID (0 - 7) and the value indicates the percentage of link bandwidth allocated to that group. Allowed values are 0 - 100, and the sum of all values must total 100 percent.</entry></row> + <row><entry align="left">priority-group-flags</entry><entry align="left">NMSettingDcbFlags (uint32)</entry><entry align="left"/><entry>Specifies the NMSettingDcbFlags for DCB Priority Groups. Flags may be any combination of NM_SETTING_DCB_FLAG_ENABLE (0x1), NM_SETTING_DCB_FLAG_ADVERTISE (0x2), and NM_SETTING_DCB_FLAG_WILLING (0x4).</entry></row> + <row><entry align="left">priority-group-id</entry><entry align="left">array of uint32</entry><entry align="left"/><entry>An array of 8 uint values, where the array index corresponds to the User Priority (0 - 7) and the value indicates the Priority Group ID. Allowed Priority Group ID values are 0 - 7 or 15 for the unrestricted group.</entry></row> + <row><entry align="left">priority-strict-bandwidth</entry><entry align="left">array of uint32</entry><entry align="left"/><entry>An array of 8 boolean values, where the array index corresponds to the User Priority (0 - 7) and the value indicates whether or not the priority may use all of the bandwidth allocated to its assigned group.</entry></row> + <row><entry align="left">priority-traffic-class</entry><entry align="left">array of uint32</entry><entry align="left"/><entry>An array of 8 uint values, where the array index corresponds to the User Priority (0 - 7) and the value indicates the traffic class (0 - 7) to which the priority is mapped.</entry></row> + </tbody></tgroup></table> + <table><title>generic setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody> + <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">generic</entry><entry>The setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row> + </tbody></tgroup></table> + <table><title>gsm setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody> + <row><entry align="left">apn</entry><entry align="left">string</entry><entry align="left"/><entry>The GPRS Access Point Name specifying the APN used when establishing a data session with the GSM-based network. The APN often determines how the user will be billed for their network usage and whether the user has access to the Internet or just a provider-specific walled-garden, so it is important to use the correct APN for the user's mobile broadband plan. The APN may only be composed of the characters a-z, 0-9, ., and - per GSM 03.60 Section 14.9.</entry></row> + <row><entry align="left">home-only</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>When TRUE, only connections to the home network will be allowed. Connections to roaming networks will not be made.</entry></row> + <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">gsm</entry><entry>The setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row> + <row><entry align="left">network-id</entry><entry align="left">string</entry><entry align="left"/><entry>The Network ID (GSM LAI format, ie MCC-MNC) to force specific network registration. If the Network ID is specified, NetworkManager will attempt to force the device to register only on the specified network. This can be used to ensure that the device does not roam when direct roaming control of the device is not otherwise possible.</entry></row> + <row><entry align="left">number</entry><entry align="left">string</entry><entry align="left"/><entry>Number to dial when establishing a PPP data session with the GSM-based mobile broadband network. Many modems do not require PPP for connections to the mobile network and thus this property should be left blank, which allows NetworkManager to select the appropriate settings automatically.</entry></row> + <row><entry align="left">password</entry><entry align="left">string</entry><entry align="left"/><entry>The password used to authenticate with the network, if required. Many providers do not require a password, or accept any password. But if a password is required, it is specified here.</entry></row> + <row><entry align="left">password-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "password" property. (see <xref linkend="secrets-flags"/> for flag values)</entry></row> + <row><entry align="left">pin</entry><entry align="left">string</entry><entry align="left"/><entry>If the SIM is locked with a PIN it must be unlocked before any other operations are requested. Specify the PIN here to allow operation of the device.</entry></row> + <row><entry align="left">pin-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "pin" property. (see <xref linkend="secrets-flags"/> for flag values)</entry></row> + <row><entry align="left">username</entry><entry align="left">string</entry><entry align="left"/><entry>The username used to authenticate with the network, if required. Many providers do not require a username, or accept any username. But if a username is required, it is specified here.</entry></row> + </tbody></tgroup></table> + <table><title>infiniband setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody> + <row><entry align="left">mac-address</entry><entry align="left">byte array</entry><entry align="left"/><entry>If specified, this connection will only apply to the IPoIB device whose permanent MAC address matches. This property does not change the MAC address of the device (i.e. MAC spoofing).</entry></row> + <row><entry align="left">mtu</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>If non-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple frames.</entry></row> + <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">infiniband</entry><entry>The setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row> + <row><entry align="left">p-key</entry><entry align="left">int32</entry><entry align="left">-1</entry><entry>The InfiniBand P_Key to use for this device. A value of -1 means to use the default P_Key (aka "the P_Key at index 0"). Otherwise it is a 16-bit unsigned integer, whose high bit is set if it is a "full membership" P_Key.</entry></row> + <row><entry align="left">parent</entry><entry align="left">string</entry><entry align="left"/><entry>The interface name of the parent device of this device. Normally NULL, but if the "p_key" property is set, then you must specify the base device by setting either this property or "mac-address".</entry></row> + <row><entry align="left">transport-mode</entry><entry align="left">string</entry><entry align="left"/><entry>The IP-over-InfiniBand transport mode. Either "datagram" or "connected".</entry></row> + </tbody></tgroup></table> + <table><title>ipv4 setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody> + <row><entry align="left">address-data</entry><entry align="left">array of vardict</entry><entry align="left"/><entry>Array of IPv4 addresses. Each address dictionary contains at least 'address' and 'prefix' entries, containing the IP address as a string, and the prefix length as a uint32. Additional attributes may also exist on some addresses.</entry></row> + <row><entry align="left">addresses</entry><entry align="left">array of array of uint32</entry><entry align="left"/><entry>Deprecated in favor of the 'address-data' and 'gateway' properties, but this can be used for backward-compatibility with older daemons. Note that if you send this property the daemon will ignore 'address-data' and 'gateway'. Array of IPv4 address structures. Each IPv4 address structure is composed of 3 32-bit values; the first being the IPv4 address (network byte order), the second the prefix (1 - 32), and last the IPv4 gateway (network byte order). The gateway may be left as 0 if no gateway exists for that subnet.</entry></row> + <row><entry align="left">dhcp-client-id</entry><entry align="left">string</entry><entry align="left"/><entry>A string sent to the DHCP server to identify the local machine which the DHCP server may use to customize the DHCP lease and options.</entry></row> + <row><entry align="left">dhcp-hostname</entry><entry align="left">string</entry><entry align="left"/><entry>If the "dhcp-send-hostname" property is TRUE, then the specified name will be sent to the DHCP server when acquiring a lease.</entry></row> + <row><entry align="left">dhcp-send-hostname</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>If TRUE, a hostname is sent to the DHCP server when acquiring a lease. Some DHCP servers use this hostname to update DNS databases, essentially providing a static hostname for the computer. If the "dhcp-hostname" property is NULL and this property is TRUE, the current persistent hostname of the computer is sent.</entry></row> + <row><entry align="left">dns</entry><entry align="left">array of uint32</entry><entry align="left">[]</entry><entry>Array of IP addresses of DNS servers (as network-byte-order integers)</entry></row> + <row><entry align="left">dns-search</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>Array of DNS search domains.</entry></row> + <row><entry align="left">gateway</entry><entry align="left">string</entry><entry align="left"/><entry>The gateway associated with this configuration. This is only meaningful if "addresses" is also set.</entry></row> + <row><entry align="left">ignore-auto-dns</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>When "method" is set to "auto" and this property to TRUE, automatically configured nameservers and search domains are ignored and only nameservers and search domains specified in the "dns" and "dns-search" properties, if any, are used.</entry></row> + <row><entry align="left">ignore-auto-routes</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>When "method" is set to "auto" and this property to TRUE, automatically configured routes are ignored and only routes specified in the "routes" property, if any, are used.</entry></row> + <row><entry align="left">may-fail</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>If TRUE, allow overall network configuration to proceed even if the configuration specified by this property times out. Note that at least one IP configuration must succeed or overall network configuration will still fail. For example, in IPv6-only networks, setting this property to TRUE on the NMSettingIP4Config allows the overall network configuration to succeed if IPv4 configuration fails but IPv6 configuration completes successfully.</entry></row> + <row><entry align="left">method</entry><entry align="left">string</entry><entry align="left"/><entry>IP configuration method. NMSettingIP4Config and NMSettingIP6Config both support "auto", "manual", and "link-local". See the subclass-specific documentation for other values. In general, for the "auto" method, properties such as "dns" and "routes" specify information that is added on to the information returned from automatic configuration. The "ignore-auto-routes" and "ignore-auto-dns" properties modify this behavior. For methods that imply no upstream network, such as "shared" or "link-local", these properties must be empty.</entry></row> + <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">ipv4</entry><entry>The setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row> + <row><entry align="left">never-default</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If TRUE, this connection will never be the default connection for this IP type, meaning it will never be assigned the default route by NetworkManager.</entry></row> + <row><entry align="left">route-data</entry><entry align="left">array of vardict</entry><entry align="left"/><entry>Array of IPv4 routes. Each route dictionary contains at least 'dest' and 'prefix' entries, containing the destination IP address as a string, and the prefix length as a uint32. Most routes will also have a 'gateway' entry, containing the gateway IP address as a string. If the route has a 'metric' entry (containing a uint32), that will be used as the metric for the route (otherwise NM will pick a default value appropriate to the device). Additional attributes may also exist on some routes.</entry></row> + <row><entry align="left">route-metric</entry><entry align="left">int64</entry><entry align="left">-1</entry><entry>The default metric for routes that don't explicitly specify a metric. The default value -1 means that the metric is choosen automatically based on the device type. The metric applies to dynamic routes, manual (static) routes that don't have an explicit metric setting, address prefix routes, and the default route. Note that for IPv6, the kernel accepts zero (0) but coerces it to 1024 (user default). Hence, setting this property to zero effectively mean setting it to 1024. For IPv4, zero is a regular value for the metric.</entry></row> + <row><entry align="left">routes</entry><entry align="left">array of array of uint32</entry><entry align="left"/><entry>Deprecated in favor of the 'route-data' property, but this can be used for backward-compatibility with older daemons. Note that if you send this property the daemon will ignore 'route-data'. Array of IPv4 route structures. Each IPv4 route structure is composed of 4 32-bit values; the first being the destination IPv4 network or address (network byte order), the second the destination network or address prefix (1 - 32), the third being the next-hop (network byte order) if any, and the fourth being the route metric. If the metric is 0, NM will choose an appropriate default metric for the device. (There is no way to explicitly specify an actual metric of 0 with this property.)</entry></row> + </tbody></tgroup></table> + <table><title>ipv6 setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody> + <row><entry align="left">address-data</entry><entry align="left">array of vardict</entry><entry align="left"/><entry>Array of IPv6 addresses. Each address dictionary contains at least 'address' and 'prefix' entries, containing the IP address as a string, and the prefix length as a uint32. Additional attributes may also exist on some addresses.</entry></row> + <row><entry align="left">addresses</entry><entry align="left">array of legacy IPv6 address struct (a(ayuay))</entry><entry align="left"/><entry>Deprecated in favor of the 'address-data' and 'gateway' properties, but this can be used for backward-compatibility with older daemons. Note that if you send this property the daemon will ignore 'address-data' and 'gateway'. Array of IPv6 address structures. Each IPv6 address structure is composed of an IPv6 address, a prefix length (1 - 128), and an IPv6 gateway address. The gateway may be zeroed out if no gateway exists for that subnet.</entry></row> + <row><entry align="left">dhcp-hostname</entry><entry align="left">string</entry><entry align="left"/><entry>If the "dhcp-send-hostname" property is TRUE, then the specified name will be sent to the DHCP server when acquiring a lease.</entry></row> + <row><entry align="left">dhcp-send-hostname</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>If TRUE, a hostname is sent to the DHCP server when acquiring a lease. Some DHCP servers use this hostname to update DNS databases, essentially providing a static hostname for the computer. If the "dhcp-hostname" property is NULL and this property is TRUE, the current persistent hostname of the computer is sent.</entry></row> + <row><entry align="left">dns</entry><entry align="left">array of byte array</entry><entry align="left">[]</entry><entry>Array of IP addresses of DNS servers (in network byte order)</entry></row> + <row><entry align="left">dns-search</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>Array of DNS search domains.</entry></row> + <row><entry align="left">gateway</entry><entry align="left">string</entry><entry align="left"/><entry>The gateway associated with this configuration. This is only meaningful if "addresses" is also set.</entry></row> + <row><entry align="left">ignore-auto-dns</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>When "method" is set to "auto" and this property to TRUE, automatically configured nameservers and search domains are ignored and only nameservers and search domains specified in the "dns" and "dns-search" properties, if any, are used.</entry></row> + <row><entry align="left">ignore-auto-routes</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>When "method" is set to "auto" and this property to TRUE, automatically configured routes are ignored and only routes specified in the "routes" property, if any, are used.</entry></row> + <row><entry align="left">ip6-privacy</entry><entry align="left">NMSettingIP6ConfigPrivacy (int32)</entry><entry align="left"/><entry>Configure IPv6 Privacy Extensions for SLAAC, described in RFC4941. If enabled, it makes the kernel generate a temporary IPv6 address in addition to the public one generated from MAC address via modified EUI-64. This enhances privacy, but could cause problems in some applications, on the other hand. The permitted values are: 0: disabled, 1: enabled (prefer public address), 2: enabled (prefer temporary addresses).</entry></row> + <row><entry align="left">may-fail</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>If TRUE, allow overall network configuration to proceed even if the configuration specified by this property times out. Note that at least one IP configuration must succeed or overall network configuration will still fail. For example, in IPv6-only networks, setting this property to TRUE on the NMSettingIP4Config allows the overall network configuration to succeed if IPv4 configuration fails but IPv6 configuration completes successfully.</entry></row> + <row><entry align="left">method</entry><entry align="left">string</entry><entry align="left"/><entry>IP configuration method. NMSettingIP4Config and NMSettingIP6Config both support "auto", "manual", and "link-local". See the subclass-specific documentation for other values. In general, for the "auto" method, properties such as "dns" and "routes" specify information that is added on to the information returned from automatic configuration. The "ignore-auto-routes" and "ignore-auto-dns" properties modify this behavior. For methods that imply no upstream network, such as "shared" or "link-local", these properties must be empty.</entry></row> + <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">ipv6</entry><entry>The setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row> + <row><entry align="left">never-default</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If TRUE, this connection will never be the default connection for this IP type, meaning it will never be assigned the default route by NetworkManager.</entry></row> + <row><entry align="left">route-data</entry><entry align="left">array of vardict</entry><entry align="left"/><entry>Array of IPv6 routes. Each route dictionary contains at least 'dest' and 'prefix' entries, containing the destination IP address as a string, and the prefix length as a uint32. Most routes will also have a 'next-hop' entry, containing the next hop IP address as a string. If the route has a 'metric' entry (containing a uint32), that will be used as the metric for the route (otherwise NM will pick a default value appropriate to the device). Additional attributes may also exist on some routes.</entry></row> + <row><entry align="left">route-metric</entry><entry align="left">int64</entry><entry align="left">-1</entry><entry>The default metric for routes that don't explicitly specify a metric. The default value -1 means that the metric is choosen automatically based on the device type. The metric applies to dynamic routes, manual (static) routes that don't have an explicit metric setting, address prefix routes, and the default route. Note that for IPv6, the kernel accepts zero (0) but coerces it to 1024 (user default). Hence, setting this property to zero effectively mean setting it to 1024. For IPv4, zero is a regular value for the metric.</entry></row> + <row><entry align="left">routes</entry><entry align="left">array of legacy IPv6 route struct (a(ayuayu))</entry><entry align="left"/><entry>Deprecated in favor of the 'route-data' property, but this can be used for backward-compatibility with older daemons. Note that if you send this property the daemon will ignore 'route-data'. Array of IPv6 route structures. Each IPv6 route structure is composed of an IPv6 address, a prefix length (1 - 128), an IPv6 next hop address (which may be zeroed out if there is no next hop), and a metric. If the metric is 0, NM will choose an appropriate default metric for the device.</entry></row> + </tbody></tgroup></table> + <table><title>802-11-olpc-mesh setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody> + <row><entry align="left">channel</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>Channel on which the mesh network to join is located.</entry></row> + <row><entry align="left">dhcp-anycast-address</entry><entry align="left">byte array</entry><entry align="left"/><entry>Anycast DHCP MAC address used when requesting an IP address via DHCP. The specific anycast address used determines which DHCP server class answers the request.</entry></row> + <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">802-11-olpc-mesh</entry><entry>The setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row> + <row><entry align="left">ssid</entry><entry align="left">byte array</entry><entry align="left"/><entry>SSID of the mesh network to join.</entry></row> + </tbody></tgroup></table> + <table><title>ppp setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody> + <row><entry align="left">baud</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>If non-zero, instruct pppd to set the serial port to the specified baudrate. This value should normally be left as 0 to automatically choose the speed.</entry></row> + <row><entry align="left">crtscts</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If TRUE, specify that pppd should set the serial port to use hardware flow control with RTS and CTS signals. This value should normally be set to FALSE.</entry></row> + <row><entry align="left">lcp-echo-failure</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>If non-zero, instruct pppd to presume the connection to the peer has failed if the specified number of LCP echo-requests go unanswered by the peer. The "lcp-echo-interval" property must also be set to a non-zero value if this property is used.</entry></row> + <row><entry align="left">lcp-echo-interval</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>If non-zero, instruct pppd to send an LCP echo-request frame to the peer every n seconds (where n is the specified value). Note that some PPP peers will respond to echo requests and some will not, and it is not possible to autodetect this.</entry></row> + <row><entry align="left">mppe-stateful</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If TRUE, stateful MPPE is used. See pppd documentation for more information on stateful MPPE.</entry></row> + <row><entry align="left">mru</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>If non-zero, instruct pppd to request that the peer send packets no larger than the specified size. If non-zero, the MRU should be between 128 and 16384.</entry></row> + <row><entry align="left">mtu</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>If non-zero, instruct pppd to send packets no larger than the specified size.</entry></row> + <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">ppp</entry><entry>The setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row> + <row><entry align="left">no-vj-comp</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If TRUE, Van Jacobsen TCP header compression will not be requested.</entry></row> + <row><entry align="left">noauth</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>If TRUE, do not require the other side (usually the PPP server) to authenticate itself to the client. If FALSE, require authentication from the remote side. In almost all cases, this should be TRUE.</entry></row> + <row><entry align="left">nobsdcomp</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If TRUE, BSD compression will not be requested.</entry></row> + <row><entry align="left">nodeflate</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If TRUE, "deflate" compression will not be requested.</entry></row> + <row><entry align="left">refuse-chap</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If TRUE, the CHAP authentication method will not be used.</entry></row> + <row><entry align="left">refuse-eap</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If TRUE, the EAP authentication method will not be used.</entry></row> + <row><entry align="left">refuse-mschap</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If TRUE, the MSCHAP authentication method will not be used.</entry></row> + <row><entry align="left">refuse-mschapv2</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If TRUE, the MSCHAPv2 authentication method will not be used.</entry></row> + <row><entry align="left">refuse-pap</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If TRUE, the PAP authentication method will not be used.</entry></row> + <row><entry align="left">require-mppe</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If TRUE, MPPE (Microsoft Point-to-Point Encrpytion) will be required for the PPP session. If either 64-bit or 128-bit MPPE is not available the session will fail. Note that MPPE is not used on mobile broadband connections.</entry></row> + <row><entry align="left">require-mppe-128</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If TRUE, 128-bit MPPE (Microsoft Point-to-Point Encrpytion) will be required for the PPP session, and the "require-mppe" property must also be set to TRUE. If 128-bit MPPE is not available the session will fail.</entry></row> + </tbody></tgroup></table> + <table><title>pppoe setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody> + <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">pppoe</entry><entry>The setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row> + <row><entry align="left">password</entry><entry align="left">string</entry><entry align="left"/><entry>Password used to authenticate with the PPPoE service.</entry></row> + <row><entry align="left">password-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "password" property. (see <xref linkend="secrets-flags"/> for flag values)</entry></row> + <row><entry align="left">service</entry><entry align="left">string</entry><entry align="left"/><entry>If specified, instruct PPPoE to only initiate sessions with access concentrators that provide the specified service. For most providers, this should be left blank. It is only required if there are multiple access concentrators or a specific service is known to be required.</entry></row> + <row><entry align="left">username</entry><entry align="left">string</entry><entry align="left"/><entry>Username used to authenticate with the PPPoE service.</entry></row> + </tbody></tgroup></table> + <table><title>serial setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody> + <row><entry align="left">baud</entry><entry align="left">uint32</entry><entry align="left">57600</entry><entry>Speed to use for communication over the serial port. Note that this value usually has no effect for mobile broadband modems as they generally ignore speed settings and use the highest available speed.</entry></row> + <row><entry align="left">bits</entry><entry align="left">uint32</entry><entry align="left">8</entry><entry>Byte-width of the serial communication. The 8 in "8n1" for example.</entry></row> + <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">serial</entry><entry>The setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row> + <row><entry align="left">parity</entry><entry align="left">byte</entry><entry align="left"/><entry>The connection parity: 69 (ASCII 'E') for even parity, 111 (ASCII 'o') for odd, 110 (ASCII 'n') for none.</entry></row> + <row><entry align="left">send-delay</entry><entry align="left">uint64</entry><entry align="left">0</entry><entry>Time to delay between each byte sent to the modem, in microseconds.</entry></row> + <row><entry align="left">stopbits</entry><entry align="left">uint32</entry><entry align="left">1</entry><entry>Number of stop bits for communication on the serial port. Either 1 or 2. The 1 in "8n1" for example.</entry></row> + </tbody></tgroup></table> + <table><title>team setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody> + <row><entry align="left">config</entry><entry align="left">string</entry><entry align="left"/><entry>The JSON configuration for the team network interface. The property should contain raw JSON configuration data suitable for teamd, because the value is passed directly to teamd. If not specified, the default configuration is used. See man teamd.conf for the format details.</entry></row> + <row><entry align="left">interface-name</entry><entry align="left">string</entry><entry align="left"/><entry>Deprecated in favor of connection.interface-name, but can be used for backward-compatibility with older daemons, to set the team's interface name.</entry></row> + <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">team</entry><entry>The setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row> + </tbody></tgroup></table> + <table><title>team-port setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody> + <row><entry align="left">config</entry><entry align="left">string</entry><entry align="left"/><entry>The JSON configuration for the team port. The property should contain raw JSON configuration data suitable for teamd, because the value is passed directly to teamd. If not specified, the default configuration is used. See man teamd.conf for the format details.</entry></row> + <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">team-port</entry><entry>The setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row> + </tbody></tgroup></table> + <table><title>vlan setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody> + <row><entry align="left">egress-priority-map</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>For outgoing packets, a list of mappings from Linux SKB priorities to 802.1p priorities. The mapping is given in the format "from:to" where both "from" and "to" are unsigned integers, ie "7:3".</entry></row> + <row><entry align="left">flags</entry><entry align="left">NMVlanFlags (uint32)</entry><entry align="left"/><entry>One or more flags which control the behavior and features of the VLAN interface. Flags include NM_VLAN_FLAG_REORDER_HEADERS (0x1) (reordering of output packet headers), NM_VLAN_FLAG_GVRP (0x2) (use of the GVRP protocol), and NM_VLAN_FLAG_LOOSE_BINDING (0x4) (loose binding of the interface to its master device's operating state).</entry></row> + <row><entry align="left">id</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>The VLAN identifier that the interface created by this connection should be assigned.</entry></row> + <row><entry align="left">ingress-priority-map</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>For incoming packets, a list of mappings from 802.1p priorities to Linux SKB priorities. The mapping is given in the format "from:to" where both "from" and "to" are unsigned integers, ie "7:3".</entry></row> + <row><entry align="left">interface-name</entry><entry align="left">string</entry><entry align="left"/><entry>Deprecated in favor of connection.interface-name, but can be used for backward-compatibility with older daemons, to set the vlan's interface name.</entry></row> + <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">vlan</entry><entry>The setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row> + <row><entry align="left">parent</entry><entry align="left">string</entry><entry align="left"/><entry>If given, specifies the parent interface name or parent connection UUID from which this VLAN interface should be created. If this property is not specified, the connection must contain an "802-3-ethernet" setting with a "mac-address" property.</entry></row> + </tbody></tgroup></table> + <table><title>vpn setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody> + <row><entry align="left">data</entry><entry align="left">dict of string to string</entry><entry align="left"/><entry>Dictionary of key/value pairs of VPN plugin specific data. Both keys and values must be strings.</entry></row> + <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">vpn</entry><entry>The setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row> + <row><entry align="left">persistent</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If the VPN service supports persistence, and this property is TRUE, the VPN will attempt to stay connected across link changes and outages, until explicitly disconnected.</entry></row> + <row><entry align="left">secrets</entry><entry align="left">dict of string to string</entry><entry align="left"/><entry>Dictionary of key/value pairs of VPN plugin specific secrets like passwords or private keys. Both keys and values must be strings.</entry></row> + <row><entry align="left">service-type</entry><entry align="left">string</entry><entry align="left"/><entry>D-Bus service name of the VPN plugin that this setting uses to connect to its network. i.e. org.freedesktop.NetworkManager.vpnc for the vpnc plugin.</entry></row> + <row><entry align="left">user-name</entry><entry align="left">string</entry><entry align="left"/><entry>If the VPN connection requires a user name for authentication, that name should be provided here. If the connection is available to more than one user, and the VPN requires each user to supply a different name, then leave this property empty. If this property is empty, NetworkManager will automatically supply the username of the user which requested the VPN connection.</entry></row> + </tbody></tgroup></table> + <table><title>wimax setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody> + <row><entry align="left">mac-address</entry><entry align="left">byte array</entry><entry align="left"/><entry>If specified, this connection will only apply to the WiMAX device whose MAC address matches. This property does not change the MAC address of the device (known as MAC spoofing).</entry></row> + <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">wimax</entry><entry>The setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row> + <row><entry align="left">network-name</entry><entry align="left">string</entry><entry align="left"/><entry>Network Service Provider (NSP) name of the WiMAX network this connection should use.</entry></row> + </tbody></tgroup></table> + <table><title>802-3-ethernet setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody> + <row><entry align="left">auto-negotiate</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>If TRUE, allow auto-negotiation of port speed and duplex mode. If FALSE, do not allow auto-negotiation, in which case the "speed" and "duplex" properties should be set.</entry></row> + <row><entry align="left">cloned-mac-address</entry><entry align="left">byte array</entry><entry align="left"/><entry>If specified, request that the device use this MAC address instead of its permanent MAC address. This is known as MAC cloning or spoofing.</entry></row> + <row><entry align="left">duplex</entry><entry align="left">string</entry><entry align="left"/><entry>If specified, request that the device only use the specified duplex mode. Either "half" or "full".</entry></row> + <row><entry align="left">mac-address</entry><entry align="left">byte array</entry><entry align="left"/><entry>If specified, this connection will only apply to the Ethernet device whose permanent MAC address matches. This property does not change the MAC address of the device (i.e. MAC spoofing).</entry></row> + <row><entry align="left">mac-address-blacklist</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>If specified, this connection will never apply to the Ethernet device whose permanent MAC address matches an address in the list. Each MAC address is in the standard hex-digits-and-colons notation (00:11:22:33:44:55).</entry></row> + <row><entry align="left">mtu</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>If non-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple Ethernet frames.</entry></row> + <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">802-3-ethernet</entry><entry>The setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row> + <row><entry align="left">port</entry><entry align="left">string</entry><entry align="left"/><entry>Specific port type to use if multiple the device supports multiple attachment methods. One of "tp" (Twisted Pair), "aui" (Attachment Unit Interface), "bnc" (Thin Ethernet) or "mii" (Media Independent Interface. If the device supports only one port type, this setting is ignored.</entry></row> + <row><entry align="left">s390-nettype</entry><entry align="left">string</entry><entry align="left"/><entry>s390 network device type; one of "qeth", "lcs", or "ctc", representing the different types of virtual network devices available on s390 systems.</entry></row> + <row><entry align="left">s390-options</entry><entry align="left">dict of string to string</entry><entry align="left"/><entry>Dictionary of key/value pairs of s390-specific device options. Both keys and values must be strings. Allowed keys include "portno", "layer2", "portname", "protocol", among others. Key names must contain only alphanumeric characters (ie, [a-zA-Z0-9]).</entry></row> + <row><entry align="left">s390-subchannels</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>Identifies specific subchannels that this network device uses for communication with z/VM or s390 host. Like the "mac-address" property for non-z/VM devices, this property can be used to ensure this connection only applies to the network device that uses these subchannels. The list should contain exactly 3 strings, and each string may only be composed of hexadecimal characters and the period (.) character.</entry></row> + <row><entry align="left">speed</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>If non-zero, request that the device use only the specified speed. In Mbit/s, ie 100 == 100Mbit/s.</entry></row> + </tbody></tgroup></table> + <table><title>802-11-wireless setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody> + <row><entry align="left">band</entry><entry align="left">string</entry><entry align="left"/><entry>802.11 frequency band of the network. One of "a" for 5GHz 802.11a or "bg" for 2.4GHz 802.11. This will lock associations to the Wi-Fi network to the specific band, i.e. if "a" is specified, the device will not associate with the same network in the 2.4GHz band even if the network's settings are compatible. This setting depends on specific driver capability and may not work with all drivers.</entry></row> + <row><entry align="left">bssid</entry><entry align="left">byte array</entry><entry align="left"/><entry>If specified, directs the device to only associate with the given access point. This capability is highly driver dependent and not supported by all devices. Note: this property does not control the BSSID used when creating an Ad-Hoc network and is unlikely to in the future.</entry></row> + <row><entry align="left">channel</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>Wireless channel to use for the Wi-Fi connection. The device will only join (or create for Ad-Hoc networks) a Wi-Fi network on the specified channel. Because channel numbers overlap between bands, this property also requires the "band" property to be set.</entry></row> + <row><entry align="left">cloned-mac-address</entry><entry align="left">byte array</entry><entry align="left"/><entry>If specified, request that the Wi-Fi device use this MAC address instead of its permanent MAC address. This is known as MAC cloning or spoofing.</entry></row> + <row><entry align="left">hidden</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If TRUE, indicates this network is a non-broadcasting network that hides its SSID. In this case various workarounds may take place, such as probe-scanning the SSID for more reliable network discovery. However, these workarounds expose inherent insecurities with hidden SSID networks, and thus hidden SSID networks should be used with caution.</entry></row> + <row><entry align="left">mac-address</entry><entry align="left">byte array</entry><entry align="left"/><entry>If specified, this connection will only apply to the Wi-Fi device whose permanent MAC address matches. This property does not change the MAC address of the device (i.e. MAC spoofing).</entry></row> + <row><entry align="left">mac-address-blacklist</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>A list of permanent MAC addresses of Wi-Fi devices to which this connection should never apply. Each MAC address should be given in the standard hex-digits-and-colons notation (eg "00:11:22:33:44:55").</entry></row> + <row><entry align="left">mode</entry><entry align="left">string</entry><entry align="left"/><entry>Wi-Fi network mode; one of "infrastructure", "adhoc" or "ap". If blank, infrastructure is assumed.</entry></row> + <row><entry align="left">mtu</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>If non-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple Ethernet frames.</entry></row> + <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">802-11-wireless</entry><entry>The setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row> + <row><entry align="left">rate</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>If non-zero, directs the device to only use the specified bitrate for communication with the access point. Units are in Kb/s, ie 5500 = 5.5 Mbit/s. This property is highly driver dependent and not all devices support setting a static bitrate.</entry></row> + <row><entry align="left">security</entry><entry align="left">None</entry><entry align="left"/><entry>This property is deprecated, but can be set to the value '802-11-wireless-security' when a wireless security setting is also present in the connection dictionary, for compatibility with very old NetworkManager daemons.</entry></row> + <row><entry align="left">seen-bssids</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>A list of BSSIDs (each BSSID formatted as a MAC address like "00:11:22:33:44:55") that have been detected as part of the Wi-Fi network. NetworkManager internally tracks previously seen BSSIDs. The property is only meant for reading and reflects the BSSID list of NetworkManager. The changes you make to this property will not be preserved.</entry></row> + <row><entry align="left">ssid</entry><entry align="left">byte array</entry><entry align="left"/><entry>SSID of the Wi-Fi network. Must be specified.</entry></row> + <row><entry align="left">tx-power</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>If non-zero, directs the device to use the specified transmit power. Units are dBm. This property is highly driver dependent and not all devices support setting a static transmit power.</entry></row> + </tbody></tgroup></table> + <table><title>802-11-wireless-security setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody> + <row><entry align="left">auth-alg</entry><entry align="left">string</entry><entry align="left"/><entry>When WEP is used (ie, key-mgmt = "none" or "ieee8021x") indicate the 802.11 authentication algorithm required by the AP here. One of "open" for Open System, "shared" for Shared Key, or "leap" for Cisco LEAP. When using Cisco LEAP (ie, key-mgmt = "ieee8021x" and auth-alg = "leap") the "leap-username" and "leap-password" properties must be specified.</entry></row> + <row><entry align="left">group</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>A list of group/broadcast encryption algorithms which prevents connections to Wi-Fi networks that do not utilize one of the algorithms in the list. For maximum compatibility leave this property empty. Each list element may be one of "wep40", "wep104", "tkip", or "ccmp".</entry></row> + <row><entry align="left">key-mgmt</entry><entry align="left">string</entry><entry align="left"/><entry>Key management used for the connection. One of "none" (WEP), "ieee8021x" (Dynamic WEP), "wpa-none" (Ad-Hoc WPA-PSK), "wpa-psk" (infrastructure WPA-PSK), or "wpa-eap" (WPA-Enterprise). This property must be set for any Wi-Fi connection that uses security.</entry></row> + <row><entry align="left">leap-password</entry><entry align="left">string</entry><entry align="left"/><entry>The login password for legacy LEAP connections (ie, key-mgmt = "ieee8021x" and auth-alg = "leap").</entry></row> + <row><entry align="left">leap-password-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "leap-password" property. (see <xref linkend="secrets-flags"/> for flag values)</entry></row> + <row><entry align="left">leap-username</entry><entry align="left">string</entry><entry align="left"/><entry>The login username for legacy LEAP connections (ie, key-mgmt = "ieee8021x" and auth-alg = "leap").</entry></row> + <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">802-11-wireless-security</entry><entry>The setting's name, which uniquely identifies the setting within the connection. Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row> + <row><entry align="left">pairwise</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>A list of pairwise encryption algorithms which prevents connections to Wi-Fi networks that do not utilize one of the algorithms in the list. For maximum compatibility leave this property empty. Each list element may be one of "tkip" or "ccmp".</entry></row> + <row><entry align="left">proto</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>List of strings specifying the allowed WPA protocol versions to use. Each element may be one "wpa" (allow WPA) or "rsn" (allow WPA2/RSN). If not specified, both WPA and RSN connections are allowed.</entry></row> + <row><entry align="left">psk</entry><entry align="left">string</entry><entry align="left"/><entry>Pre-Shared-Key for WPA networks. If the key is 64-characters long, it must contain only hexadecimal characters and is interpreted as a hexadecimal WPA key. Otherwise, the key must be between 8 and 63 ASCII characters (as specified in the 802.11i standard) and is interpreted as a WPA passphrase, and is hashed to derive the actual WPA-PSK used when connecting to the Wi-Fi network.</entry></row> + <row><entry align="left">psk-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "psk" property. (see <xref linkend="secrets-flags"/> for flag values)</entry></row> + <row><entry align="left">wep-key-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "wep-key0", "wep-key1", "wep-key2", and "wep-key3" properties. (see <xref linkend="secrets-flags"/> for flag values)</entry></row> + <row><entry align="left">wep-key-type</entry><entry align="left">NMWepKeyType (uint32)</entry><entry align="left"/><entry>Controls the interpretation of WEP keys. Allowed values are NM_WEP_KEY_TYPE_KEY (1), in which case the key is either a 10- or 26-character hexadecimal string, or a 5- or 13-character ASCII password; or NM_WEP_KEY_TYPE_PASSPHRASE (2), in which case the passphrase is provided as a string and will be hashed using the de-facto MD5 method to derive the actual WEP key.</entry></row> + <row><entry align="left">wep-key0</entry><entry align="left">string</entry><entry align="left"/><entry>Index 0 WEP key. This is the WEP key used in most networks. See the "wep-key-type" property for a description of how this key is interpreted.</entry></row> + <row><entry align="left">wep-key1</entry><entry align="left">string</entry><entry align="left"/><entry>Index 1 WEP key. This WEP index is not used by most networks. See the "wep-key-type" property for a description of how this key is interpreted.</entry></row> + <row><entry align="left">wep-key2</entry><entry align="left">string</entry><entry align="left"/><entry>Index 2 WEP key. This WEP index is not used by most networks. See the "wep-key-type" property for a description of how this key is interpreted.</entry></row> + <row><entry align="left">wep-key3</entry><entry align="left">string</entry><entry align="left"/><entry>Index 3 WEP key. This WEP index is not used by most networks. See the "wep-key-type" property for a description of how this key is interpreted.</entry></row> + <row><entry align="left">wep-tx-keyidx</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>When static WEP is used (ie, key-mgmt = "none") and a non-default WEP key index is used by the AP, put that WEP key index here. Valid values are 0 (default key) through 3. Note that some consumer access points (like the Linksys WRT54G) number the keys 1 - 4.</entry></row> + </tbody></tgroup></table> +<refsect2 id="secrets-flags"><title>Secret flag types:</title><para> + Each secret property in a setting has an associated <emphasis>flags</emphasis> property + that describes how to handle that secret. The <emphasis>flags</emphasis> property is a bitfield + that contains zero or more of the following values logically OR-ed together. + </para><itemizedlist><listitem><para>0x0 (none) - the system is responsible for providing and storing this secret.</para></listitem><listitem><para>0x1 (agent-owned) - a user-session secret agent is responsible for providing and storing + this secret; when it is required, agents will be asked to provide it.</para></listitem><listitem><para>0x2 (not-saved) - this secret should not be saved but should be requested from the user + each time it is required. This flag should be used for One-Time-Pad secrets, PIN codes from hardware tokens, + or if the user simply does not want to save the secret.</para></listitem><listitem><para>0x4 (not-required) - in some situations it cannot be automatically determined that a secret + is required or not. This flag hints that the secret is not required and should not be requested from the user.</para></listitem></itemizedlist></refsect2></refsect1><refsect1><title>AUTHOR</title><para><author><firstname>NetworkManager developers</firstname></author></para></refsect1><refsect1><title>FILES</title><para>/etc/NetworkManager/system-connections</para><para>or distro plugin-specific location</para></refsect1><refsect1><title>SEE ALSO</title><para>https://wiki.gnome.org/Projects/NetworkManager/ConfigurationSpecification</para><para>NetworkManager(8), nmcli(1), nmcli-examples(5), NetworkManager.conf(5)</para></refsect1></refentry> diff --git a/man/nm-settings.xsl b/man/nm-settings.xsl new file mode 100644 index 00000000..24e41535 --- /dev/null +++ b/man/nm-settings.xsl @@ -0,0 +1,162 @@ +<?xml version="1.0" encoding="UTF-8"?> +<xsl:stylesheet version="1.0" + xmlns:xsl="http://www.w3.org/1999/XSL/Transform"> + + <xsl:output + method="xml" + doctype-public="-//OASIS//DTD DocBook XML V4.3//EN" + doctype-system="http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd" + /> + + <xsl:param name="date"/> + <xsl:param name="version"/> + + <xsl:template match="nm-setting-docs"> + <refentry id="nm-settings"> + <refentryinfo> + <date><xsl:value-of select="$date"/></date> + </refentryinfo> + <refmeta> + <refentrytitle>nm-settings</refentrytitle> + <manvolnum>5</manvolnum> + <refmiscinfo class="source">NetworkManager</refmiscinfo> + <refmiscinfo class="manual">Configuration</refmiscinfo> + <refmiscinfo class="version"><xsl:value-of select="$version"/></refmiscinfo> + </refmeta> + <refnamediv> + <refname>nm-settings</refname> + <refpurpose>Description of settings and properties of NetworkManager connection profiles</refpurpose> + </refnamediv> + <refsect1> + <title>DESCRIPTION</title> + <para> + NetworkManager is based on a concept of connection profiles, sometimes referred to as + connections only. These connection profiles contain a network configuration. When + NetworkManager activates a connection profile on a network device the configuration will + be applied and an active network connection will be established. Users are free to create + as many connection profiles as they see fit. Thus they are flexible in having various network + configurations for different networking needs. The connection profiles are handled by + NetworkManager via <emphasis>settings service</emphasis> and are exported on D-Bus + (<emphasis>/org/freedesktop/NetworkManager/Settings/<num></emphasis> objects). + The conceptual objects can be described as follows: + <variablelist> + <varlistentry> + <term>Connection (profile)</term> + <listitem> + <para> + A specific, encapsulated, independent group of settings describing + all the configuration required to connect to a specific network. + It is referred to by a unique identifier called the UUID. A connection + is tied to a one specific device type, but not necessarily a specific + hardware device. It is composed of one or more <emphasis>Settings</emphasis> + objects. + </para> + </listitem> + </varlistentry> + </variablelist> + <variablelist> + <varlistentry> + <term>Setting</term> + <listitem> + <para> + A group of related key/value pairs describing a specific piece of a + <emphasis>Connection (profile)</emphasis>. Settings keys and allowed values are + described in the tables below. Keys are also reffered to as properties. + Developers can find the setting objects and their properties in the libnm-util + sources. Look for the <function>class_init</function> functions near the bottom of + each setting source file. + </para> + </listitem> + </varlistentry> + </variablelist> + <variablelist> + <para> + The settings and properties shown in tables below list all available connection + configuration options. However, note that not all settings are applicable to all + connection types. NetworkManager provides a command-line tool <emphasis>nmcli</emphasis> + that allows direct configuration of the settings and properties according to a connection + profile type. <emphasis>nmcli</emphasis> connection editor has also a built-in + <emphasis>describe</emphasis> command that can display description of particular settings + and properties of this page. + </para> + </variablelist> + </para> + <xsl:apply-templates/> + <refsect2 id="secrets-flags"> + <title>Secret flag types:</title> + <para> + Each secret property in a setting has an associated <emphasis>flags</emphasis> property + that describes how to handle that secret. The <emphasis>flags</emphasis> property is a bitfield + that contains zero or more of the following values logically OR-ed together. + </para> + <itemizedlist> + <listitem> + <para>0x0 (none) - the system is responsible for providing and storing this secret.</para> + </listitem> + <listitem> + <para>0x1 (agent-owned) - a user-session secret agent is responsible for providing and storing + this secret; when it is required, agents will be asked to provide it.</para> + </listitem> + <listitem> + <para>0x2 (not-saved) - this secret should not be saved but should be requested from the user + each time it is required. This flag should be used for One-Time-Pad secrets, PIN codes from hardware tokens, + or if the user simply does not want to save the secret.</para> + </listitem> + <listitem> + <para>0x4 (not-required) - in some situations it cannot be automatically determined that a secret + is required or not. This flag hints that the secret is not required and should not be requested from the user.</para> + </listitem> + </itemizedlist> + </refsect2> + </refsect1> + <refsect1> + <title>AUTHOR</title> + <para> + <author> + <firstname>NetworkManager developers</firstname> + </author> + </para> + </refsect1> + <refsect1> + <title>FILES</title> + <para>/etc/NetworkManager/system-connections</para> + <para>or distro plugin-specific location</para> + </refsect1> + <refsect1> + <title>SEE ALSO</title> + <para>https://wiki.gnome.org/Projects/NetworkManager/ConfigurationSpecification</para> + <para>NetworkManager(8), nmcli(1), nmcli-examples(5), NetworkManager.conf(5)</para> + </refsect1> + </refentry> + </xsl:template> + + <xsl:template match="setting"> + <table> + <title><xsl:value-of select="@name"/> setting</title> + <tgroup cols="4"> + <thead> + <row> + <entry>Key Name</entry> + <entry>Value Type</entry> + <entry>Default Value</entry> + <entry>Value Description</entry> + </row> + </thead> + <tbody> + <xsl:apply-templates/> + </tbody> + </tgroup> + </table> + </xsl:template> + + <xsl:template match="property"> + <xsl:variable name="setting_name" select="../@name"/> + <row> + <entry align="left"><xsl:value-of select="@name"/></entry> + <entry align="left"><xsl:value-of select="@type"/></entry> + <entry align="left"><xsl:value-of select="@default"/></entry> + <entry><xsl:value-of select="@description"/><xsl:if test="@type = 'NMSettingSecretFlags (uint32)'"> (see <xref linkend="secrets-flags"/> for flag values)</xsl:if></entry> + </row> + </xsl:template> + +</xsl:stylesheet> diff --git a/man/nmcli-examples.5 b/man/nmcli-examples.5 index 7145d682..23045ecd 100644 --- a/man/nmcli-examples.5 +++ b/man/nmcli-examples.5 @@ -2,12 +2,12 @@ .\" Title: nmcli-examples .\" Author: .\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/> -.\" Date: 16 June 2014 +.\" Date: 19 November 2014 .\" Manual: Examples -.\" Source: NetworkManager 0.9.10 +.\" Source: NetworkManager 1.0 .\" Language: English .\" -.TH "NMCLI\-EXAMPLES" "5" "" "NetworkManager 0\&.9\&.10" "Examples" +.TH "NMCLI\-EXAMPLES" "5" "" "NetworkManager 1\&.0" "Examples" .\" ----------------------------------------------------------------- .\" * Define some portability stuff .\" ----------------------------------------------------------------- @@ -121,6 +121,7 @@ GENERAL\&.STATE: 100 (connected) GENERAL\&.REASON: 0 (No reason given) GENERAL\&.UDI: /sys/devices/pci0000:00/0000:00:1c\&.1/0000:03:00\&.0/net/wlan0 GENERAL\&.IP\-IFACE: wlan0 +GENERAL\&.IS\-SOFTWARE: no GENERAL\&.NM\-MANAGED: yes GENERAL\&.AUTOCONNECT: yes GENERAL\&.FIRMWARE\-MISSING: no @@ -350,6 +351,7 @@ interface, the second to \fB $ nmcli con add con\-name my\-con\-em1 ifname em1 type ethernet ip4 192\&.168\&.100\&.100/24 gw4 192\&.168\&.100\&.1 ip4 1\&.2\&.3\&.4 ip6 abbe::cafe $ nmcli con mod my\-con\-em1 ipv4\&.dns "8\&.8\&.8\&.8 8\&.8\&.4\&.4" +$ nmcli con mod my\-con\-em1 +ipv4\&.dns 1\&.2\&.3\&.4 $ nmcli con mod my\-con\-em1 ipv6\&.dns "2001:4860:4860::8888 2001:4860:4860::8844" $ nmcli \-p con show my\-con\-em1 \fR @@ -362,7 +364,7 @@ $ nmcli \-p con show my\-con\-em1 The first command adds an Ethernet connection profile named \fImy\-con\-em1\fR that is bound to interface name -\fIem1\fR\&. The profile is configured with static IP addresses\&. Three addresses are added, two IPv4 addresses and one IPv6\&. The first IP 192\&.168\&.100\&.100 has a prefix of 24 (netmask equivalent of 255\&.255\&.255\&.0)\&. Gateway entry for the first IP address will become the default route if this profile is activated on em1 interface (and there is no connection with higher priority)\&. The second two addresses don\*(Aqt specify a prefix, so a default prefix will be used, i\&.e\&. 32 for IPv4 and 128 for IPv6\&. The second and third commands modify DNS parameters of the new connection profile\&. The last +\fIem1\fR\&. The profile is configured with static IP addresses\&. Three addresses are added, two IPv4 addresses and one IPv6\&. The first IP 192\&.168\&.100\&.100 has a prefix of 24 (netmask equivalent of 255\&.255\&.255\&.0)\&. Gateway entry will become the default route if this profile is activated on em1 interface (and there is no connection with higher priority)\&. The next two addresses do not specify a prefix, so a default prefix will be used, i\&.e\&. 32 for IPv4 and 128 for IPv6\&. The second, third and fourth commands modify DNS parameters of the new connection profile\&. The last \fIcon show\fR command displays the profile so that all parameters can be reviewed\&. .PP @@ -469,6 +471,7 @@ connection\&.uuid: de89cdeb\-a3e1\-4d53\-8fa0\-c22546c775 connection\&.interface\-name: \-\- connection\&.type: 802\-3\-ethernet connection\&.autoconnect: yes +connection\&.autoconnect\-priority: 0 connection\&.timestamp: 0 connection\&.read\-only: no connection\&.permissions: @@ -494,7 +497,9 @@ ipv4\&.method: auto ipv4\&.dns: ipv4\&.dns\-search: ipv4\&.addresses: +ipv4\&.gateway: \-\- ipv4\&.routes: +ipv4\&.route\-metric: \-1 ipv4\&.ignore\-auto\-routes: no ipv4\&.ignore\-auto\-dns: no ipv4\&.dhcp\-client\-id: \-\- @@ -507,7 +512,9 @@ ipv6\&.method: auto ipv6\&.dns: ipv6\&.dns\-search: ipv6\&.addresses: +ipv6\&.gateway: \-\- ipv6\&.routes: +ipv6\&.route\-metric: \-1 ipv6\&.ignore\-auto\-routes: no ipv6\&.ignore\-auto\-dns: no ipv6\&.never\-default: no @@ -524,22 +531,23 @@ nmcli ipv4\&.addresses> desc === [addresses] === [NM property description] -Array of IPv4 address structures\&. Each IPv4 address structure is composed of 3 32\-bit values; the first being the IPv4 address (network byte order), the second the prefix (1 \- 32), and last the IPv4 gateway (network byte order)\&. The gateway may be left as 0 if no gateway exists for that subnet\&. For the \*(Aqauto\*(Aq method, given IP addresses are appended to those returned by automatic configuration\&. Addresses cannot be used with the \*(Aqshared\*(Aq, \*(Aqlink\-local\*(Aq, or \*(Aqdisabled\*(Aq methods as addressing is either automatic or disabled with these methods\&. +Array of IP addresses\&. [nmcli specific description] Enter a list of IPv4 addresses formatted as: - ip[/prefix] [gateway], ip[/prefix] [gateway],\&.\&.\&. + ip[/prefix], ip[/prefix],\&.\&.\&. Missing prefix is regarded as prefix of 32\&. -Example: 192\&.168\&.1\&.5/24 192\&.168\&.1\&.1, 10\&.0\&.0\&.11/24 +Example: 192\&.168\&.1\&.5/24, 10\&.0\&.0\&.11/24 -nmcli ipv4\&.addresses> set 192\&.168\&.1\&.100/24 192\&.168\&.1\&.1 +nmcli ipv4\&.addresses> set 192\&.168\&.1\&.100/24 Do you also want to set \*(Aqipv4\&.method\*(Aq to \*(Aqmanual\*(Aq? [yes]: yes nmcli ipv4\&.addresses> nmcli ipv4\&.addresses> print -addresses: { ip = 192\&.168\&.1\&.100/24, gw = 192\&.168\&.1\&.1 } +addresses: 192\&.168\&.1\&.100/24 nmcli ipv4\&.addresses> back nmcli ipv4> b +nmcli> set ipv4\&.gateway 192\&.168\&.1\&.1 nmcli> verify Verify connection: OK nmcli> print @@ -551,6 +559,7 @@ connection\&.uuid: de89cdeb\-a3e1\-4d53\-8fa0\-c22546c775 connection\&.interface\-name: \-\- connection\&.type: 802\-3\-ethernet connection\&.autoconnect: yes +connection\&.autoconnect\-priority: 0 connection\&.timestamp: 0 connection\&.read\-only: no connection\&.permissions: @@ -575,8 +584,10 @@ connection\&.gateway\-ping\-timeout: 0 ipv4\&.method: manual ipv4\&.dns: ipv4\&.dns\-search: -ipv4\&.addresses: { ip = 192\&.168\&.1\&.100/24, gw = 192\&.168\&.1\&.1 } +ipv4\&.addresses: 192\&.168\&.1\&.100/24 +ipv4\&.gateway: 192\&.168\&.1\&.1 ipv4\&.routes: +ipv4\&.route\-metric: \-1 ipv4\&.ignore\-auto\-routes: no ipv4\&.ignore\-auto\-dns: no ipv4\&.dhcp\-client\-id: \-\- @@ -590,6 +601,7 @@ ipv6\&.dns: ipv6\&.dns\-search: ipv6\&.addresses: ipv6\&.routes: +ipv6\&.route\-metric: \-1 ipv6\&.ignore\-auto\-routes: no ipv6\&.ignore\-auto\-dns: no ipv6\&.never\-default: no @@ -607,6 +619,7 @@ connection\&.uuid: de89cdeb\-a3e1\-4d53\-8fa0\-c22546c775 connection\&.interface\-name: \-\- connection\&.type: 802\-3\-ethernet connection\&.autoconnect: yes +connection\&.autoconnect\-priority: 0 connection\&.timestamp: 0 connection\&.read\-only: no connection\&.permissions: @@ -629,10 +642,12 @@ connection\&.gateway\-ping\-timeout: 0 802\-3\-ethernet\&.s390\-options: \-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\- ipv4\&.method: manual -ipv4\&.dns: 8\&.8\&.8\&.8, 8\&.8\&.4\&.4 +ipv4\&.dns: 8\&.8\&.8\&.8,8\&.8\&.4\&.4 ipv4\&.dns\-search: -ipv4\&.addresses: { ip = 192\&.168\&.1\&.100/24, gw = 192\&.168\&.1\&.1 } +ipv4\&.addresses: 192\&.168\&.1\&.100/24 +ipv4\&.gateway: 192\&.168\&.1\&.1 ipv4\&.routes: +ipv4\&.route\-metric: \-1 ipv4\&.ignore\-auto\-routes: no ipv4\&.ignore\-auto\-dns: no ipv4\&.dhcp\-client\-id: \-\- @@ -645,7 +660,9 @@ ipv6\&.method: auto ipv6\&.dns: ipv6\&.dns\-search: ipv6\&.addresses: +ipv6\&.gateway: \-\- ipv6\&.routes: +ipv6\&.route\-metric: \-1 ipv6\&.ignore\-auto\-routes: no ipv6\&.ignore\-auto\-dns: no ipv6\&.never\-default: no @@ -664,7 +681,7 @@ nmcli> quit .RE .\} .PP -Example session in the nmcli interactive connection editor\&. The scenario creates an Ethernet connection (configuration) with static addressing (IPs and DNS)\&. +Example session in the nmcli interactive connection editor\&. The scenario creates an Ethernet connection profile with static addressing (IPs and DNS)\&. .SH "SEE ALSO" .PP \fBnmcli\fR(1), diff --git a/man/nmcli.1.in b/man/nmcli.1.in index 08f07b4a..c9a69cb9 100644 --- a/man/nmcli.1.in +++ b/man/nmcli.1.in @@ -19,9 +19,9 @@ .\" with this manual; if not, write to the Free Software Foundation, Inc., .\" 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. .\" -.\" Copyright (C) 2010 - 2014 Red Hat, Inc. +.\" Copyright 2010 - 2014 Red Hat, Inc. .\" -.TH NMCLI "1" "28 February 2014" +.TH NMCLI "1" "3 December 2014" .SH NAME nmcli \- command\(hyline tool for controlling NetworkManager @@ -33,7 +33,7 @@ nmcli \- command\(hyline tool for controlling NetworkManager .sp .IR OBJECT " := { " -.BR general " | " networking " | " radio " | " connection " | " device +.BR general " | " networking " | " radio " | " connection " | " device " | " agent .RI " }" .sp @@ -131,6 +131,8 @@ incompatible versions may produce incorrect results. .B \-a, \-\-ask When using this option \fInmcli\fP will stop and ask for any missing required arguments, so do not use this option for non-interactive purposes like scripts. +This option controls, for example, whether you will be prompted for a password +if it is required for connecting to a network. .TP .B \-w, \-\-wait <seconds> This option sets a timeout period for which \fInmcli\fP will wait for \fINetworkManager\fP @@ -287,12 +289,12 @@ active if a device is using that connection profile. Without a parameter, all profiles are listed. When --active option is specified, only the active profiles are shown. .TP -.B show [--active] [ id | uuid | path | apath ] <ID> ... +.B show [--active] [--show-secrets] [ id | uuid | path | apath ] <ID> ... .br Show details for specified connections. By default, both static configuration and active connection data are displayed. When --active option is specified, -only the active profiles are taken into -account. +only the active profiles are taken into account. When --show-secrets option is +specified, secrets associated with the profile will be revealed too. \fIid\fP, \fIuuid\fP, \fIpath\fP and \fIapath\fP keywords can be used if \fI<ID>\fP is ambiguous. .RS @@ -327,10 +329,10 @@ When no command is given to the \fIconnection\fP object, the default action is 'nmcli connection show'. .RE .TP -.B up [ id | uuid | path ] <ID> [ifname <ifname>] [ap <BSSID>] [nsp <name>] +.B up [ id | uuid | path ] <ID> [ifname <ifname>] [ap <BSSID>] [nsp <name>] [passwd <file with passwords>] .RE .RS -.B up ifname <ifname> [ap <BSSID>] [nsp <name>] +.B up ifname <ifname> [ap <BSSID>] [nsp <name>] [passwd <file with passwords>] .RS .br Activate a connection. The connection is identified by its name, UUID or D-Bus @@ -355,18 +357,38 @@ Available options are: \(en BSSID of the AP which the command should connect to (for Wi\(hyFi connections) .IP \fInsp\fP 13 \(en NSP (Network Service Provider) which the command should connect to (for WiMAX connections) +.IP \fIpasswd-file\fP 13 +\(en some networks may require credentials during activation. You can give these +credentials using this option. +Each line of the file should contain one password in the form of +.br +\fBsetting_name.property_name:the password\fP +.br +For example, for WPA Wi-Fi with PSK, the line would be +.br +\fI802-11-wireless-security.psk:secret12345\fP +.br +For 802.1X password, the line would be +.br +\fI802-1x.password:my 1X password\fP +.br +nmcli also accepts "wifi-sec" and "wifi" strings instead of "802-11-wireless-security". +When NetworkManager requires a password and it is not given, nmcli will ask for it +when run with --ask. If --ask was not passed, NetworkManager can ask another secret +agent that may be running (typically a GUI secret agent, such as nm-applet or +gnome-shell). .RE .RE .TP -.B down [ id | uuid | path | apath ] <ID> +.B down [ id | uuid | path | apath ] <ID> ... .br Deactivate a connection from a device without preventing the device from -further auto-activation. +further auto-activation. Multiple connections can be passed to the command. .sp -Be aware that this command deactivates the specified active connection. The device +Be aware that this command deactivates the specified active connection, but the device on which the connection was active, is still ready to connect and will perform auto-activation by looking for a suitable connection that has the 'autoconnect' -flag set. This includes the just deactivated connection, so if the connection is set +flag set. This includes the just deactivated connection. So if the connection is set to auto-connect, it will be automatically started on the disconnected device again. .br In most cases you may want to use \fIdevice disconnect\fP command instead. @@ -418,6 +440,8 @@ Note: use quotes around \fB*\fP to suppress shell expansion. \(en MAC address of the device this connection is locked to .IP "\fI[cloned-mac <cloned MAC address>]\fP" 42 \(en cloned MAC +.IP "\fI[mode infrastructure|ap|adhoc]\fP" 42 +\(en Wi-Fi network mode. If blank, \fIinfrastructure\fP is assumed. .IP "\fI[mtu <MTU>]\fP" 42 \(en MTU .RE @@ -683,7 +707,7 @@ of its latest state. .B device - show and manage network interfaces .br .TP -.SS \fICOMMAND\fP := { status | show | connect | disconnect | wifi | wimax } +.SS \fICOMMAND\fP := { status | show | connect | disconnect | delete | wifi | wimax } .sp .RS .TP @@ -713,6 +737,14 @@ connections without user/manual intervention. .br If '--wait' option is not specified, the default timeout will be 10 seconds. .TP +.B delete <ifname> +.br +Delete a device. The command removes the interface from the system. Note that +this only works for software devices like bonds, bridges, teams, etc. +Hardware devices (like Ethernet) cannot be deleted by the command. +.br +If '--wait' option is not specified, the default timeout will be 10 seconds. +.TP .B wifi [list [ifname <ifname>] [bssid <BSSID>]] .br List available Wi\(hyFi access points. The \fIifname\fP and \fIbssid\fP options @@ -761,6 +793,39 @@ This command does not show the APs, use 'nmcli device wifi list' for that. List available WiMAX NSP. The \fIifname\fP and \fInsp\fP options can be used to list networks for a particular interface or with a specific NSP, respectively. +.RE + +.TP +.B agent \- run nmcli as a NetworkManager secret agent, or polkit agent +.br +.TP +.SS \fICOMMAND\fP := { secret | polkit | all } +.sp +.RS +.TP +.B secret +.br +Register nmcli as a NetworkManager secret agent and listen for secret requests. +You do usually not need this command, because nmcli can handle secrets when +connecting to networks. However, you may find the command useful when you use +another tool for activating connections and you do not have a secret agent +available (like nm-applet). +.TP +.B polkit +.br +Register nmcli as a polkit agent for the user session and listen for +authorization requests. You do not usually need this command, because nmcli can +handle polkit actions related to NetworkManager operations (when run with +--ask). However, you may find the command useful when you want to run a simple +text based polkit agent and you do not have an agent of a desktop environment. +Note that running this command makes nmcli handle all polkit requests, not only +NetworkManager related ones, because only one polkit agent can run for the +session. +.TP +.B all +.br +Runs nmcli as both NetworkManager secret and a polkit agent. +.RE .SH ENVIRONMENT VARIABLES \fInmcli\fP's behavior is affected by the following environment variables. @@ -851,6 +916,11 @@ shows all connection profile names and their auto-connect property. .IP shows details for "My default em1" connection profile. +.IP "\fB\f(CWnmcli connection show --show-secrets \(dq\&My Home WiFi\(dq\&\fP\fP" +.IP +shows details for "My Home WiFi" connection profile with all passwords. +Without \fI--show-secrets\fP option, secrets would not be displayed. + .IP "\fB\f(CWnmcli \-f active connection show \(dq\&My default em1\(dq\&\fP\fP" .IP shows details for "My default em1" active connection, like IP, DHCP diff --git a/man/nmtui.1.in b/man/nmtui.1.in new file mode 100644 index 00000000..32b76954 --- /dev/null +++ b/man/nmtui.1.in @@ -0,0 +1,66 @@ +.\" nmtui (1) manual page +.\" +.\" This is free documentation; you can redistribute it and/or +.\" modify it under the terms of the GNU General Public License as +.\" published by the Free Software Foundation; either version 2 of +.\" the License, or (at your option) any later version. +.\" +.\" The GNU General Public License's references to "object code" +.\" and "executables" are to be interpreted as the output of any +.\" document formatting or typesetting system, including +.\" intermediate and printed output. +.\" +.\" This manual is distributed in the hope that it will be useful, +.\" but WITHOUT ANY WARRANTY; without even the implied warranty of +.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +.\" GNU General Public License for more details. +.\" +.\" You should have received a copy of the GNU General Public Licence along +.\" with this manual; if not, write to the Free Software Foundation, Inc., +.\" 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +.\" +.\" Copyright 2014 Red Hat, Inc. +.\" +.TH NMTUI "1" "6 November 2014" + +.SH NAME +nmtui \- Text User Interface for controlling NetworkManager +.SH SYNOPSIS +.B nmtui +.RI " [ " edit " | " connect " | " hostname " ] [ ... ] " +.P +.B nmtui\-edit +.RI " [ " connection-id " | " connection-name " ] " +.P +.B nmtui\-connect +.RI " [ " connection-name " | " connection-uuid " | " device-name " | " Wi-Fi-SSID " ] " +.P +.B nmtui\-hostname + +.SH DESCRIPTION +.B nmtui +is a curses\(hybased TUI application for interacting with \fINetworkManager\fP. +.P +When starting \fInmtui\fP, the user is prompted to choose the activity to perform +unless it was specified as the first argument. +.P +The supported activities are: +.IP \(em 4 +\fIedit\fP: show a connection editor that supports adding, modifying, viewing and deleting +connections. It provides similar functionality as \fInm\-connection\-editor\fP. +.IP \(em 4 +\fIconnect\fP: show a list of available connections, with the option to activate or deactivate +them. It provides similar functionality as \fInm\-applet\fP. +.IP \(em 4 +\fIhostname\fP: set the system hostname. + +.P +Corresponding to above activities, \fInmtui\fP also comes with binaries named +\fInmtui\-edit\fP, \fInmtui\-connect\fP, and \fInmtui-hostname\fP to skip the selection +of the activities. + +.SH SEE ALSO +.BR NetworkManager(8), +.BR nmcli(1). +.BR nm\-applet(1). +.BR nm\-connection\-editor(1). |