summary refs log tree commit diff
path: root/src/libnm-core-impl/nm-setting-8021x.c
diff options
context:
space:
mode:
Diffstat (limited to 'src/libnm-core-impl/nm-setting-8021x.c')
-rw-r--r--src/libnm-core-impl/nm-setting-8021x.c1077
1 files changed, 389 insertions, 688 deletions
diff --git a/src/libnm-core-impl/nm-setting-8021x.c b/src/libnm-core-impl/nm-setting-8021x.c
index 6ddbd680..103443ba 100644
--- a/src/libnm-core-impl/nm-setting-8021x.c
+++ b/src/libnm-core-impl/nm-setting-8021x.c
@@ -131,53 +131,53 @@ NM_GOBJECT_PROPERTIES_DEFINE(NMSetting8021x,
                              PROP_AUTH_TIMEOUT, );
 
 typedef struct {
-    GSList *                eap; /* GSList of strings */
-    char *                  identity;
-    char *                  anonymous_identity;
-    char *                  pac_file;
-    GBytes *                ca_cert;
-    char *                  ca_cert_password;
-    char *                  ca_path;
-    char *                  subject_match;
-    GSList *                altsubject_matches;
-    char *                  domain_suffix_match;
-    char *                  domain_match;
-    GBytes *                client_cert;
-    char *                  client_cert_password;
-    char *                  phase1_peapver;
-    char *                  phase1_peaplabel;
-    char *                  phase1_fast_provisioning;
-    char *                  phase2_auth;
-    char *                  phase2_autheap;
-    GBytes *                phase2_ca_cert;
-    char *                  phase2_ca_cert_password;
-    char *                  phase2_ca_path;
-    char *                  phase2_subject_match;
-    GSList *                phase2_altsubject_matches;
-    char *                  phase2_domain_suffix_match;
-    char *                  phase2_domain_match;
-    GBytes *                phase2_client_cert;
-    char *                  phase2_client_cert_password;
-    char *                  password;
-    GBytes *                password_raw;
-    char *                  pin;
-    GBytes *                private_key;
-    char *                  private_key_password;
-    GBytes *                phase2_private_key;
-    char *                  phase2_private_key_password;
-    int                     auth_timeout;
-    NMSetting8021xAuthFlags phase1_auth_flags;
-    NMSettingSecretFlags    ca_cert_password_flags;
-    NMSettingSecretFlags    client_cert_password_flags;
-    NMSettingSecretFlags    phase2_ca_cert_password_flags;
-    NMSettingSecretFlags    phase2_client_cert_password_flags;
-    NMSettingSecretFlags    password_flags;
-    NMSettingSecretFlags    password_raw_flags;
-    NMSettingSecretFlags    pin_flags;
-    NMSettingSecretFlags    private_key_password_flags;
-    NMSettingSecretFlags    phase2_private_key_password_flags;
-    bool                    optional : 1;
-    bool                    system_ca_certs : 1;
+    GSList *eap; /* GSList of strings */
+    char *  identity;
+    char *  anonymous_identity;
+    char *  pac_file;
+    GBytes *ca_cert;
+    char *  ca_cert_password;
+    char *  ca_path;
+    char *  subject_match;
+    GSList *altsubject_matches;
+    char *  domain_suffix_match;
+    char *  domain_match;
+    GBytes *client_cert;
+    char *  client_cert_password;
+    char *  phase1_peapver;
+    char *  phase1_peaplabel;
+    char *  phase1_fast_provisioning;
+    char *  phase2_auth;
+    char *  phase2_autheap;
+    GBytes *phase2_ca_cert;
+    char *  phase2_ca_cert_password;
+    char *  phase2_ca_path;
+    char *  phase2_subject_match;
+    GSList *phase2_altsubject_matches;
+    char *  phase2_domain_suffix_match;
+    char *  phase2_domain_match;
+    GBytes *phase2_client_cert;
+    char *  phase2_client_cert_password;
+    char *  password;
+    GBytes *password_raw;
+    char *  pin;
+    GBytes *private_key;
+    char *  private_key_password;
+    GBytes *phase2_private_key;
+    char *  phase2_private_key_password;
+    guint   ca_cert_password_flags;
+    guint   client_cert_password_flags;
+    guint   phase2_ca_cert_password_flags;
+    guint   phase2_client_cert_password_flags;
+    guint   password_flags;
+    guint   password_raw_flags;
+    guint   pin_flags;
+    guint   private_key_password_flags;
+    guint   phase2_private_key_password_flags;
+    guint32 phase1_auth_flags;
+    gint32  auth_timeout;
+    bool    optional;
+    bool    system_ca_certs;
 } NMSetting8021xPrivate;
 
 /**
@@ -594,13 +594,13 @@ _cert_impl_set(NMSetting8021x *        setting,
      * property to the same PKCS#12 data.
      */
     if (cert && p_client_cert && format == NM_CRYPTO_FILE_FORMAT_PKCS12
-        && !nm_gbytes_equal0(cert, *p_client_cert)) {
+        && !nm_g_bytes_equal0(cert, *p_client_cert)) {
         g_bytes_unref(*p_client_cert);
         *p_client_cert = g_bytes_ref(cert);
     } else
         notify_client_cert = PROP_0;
 
-    if (p_cert && !nm_gbytes_equal0(cert, *p_cert)) {
+    if (p_cert && !nm_g_bytes_equal0(cert, *p_cert)) {
         g_bytes_unref(*p_cert);
         *p_cert = g_steal_pointer(&cert);
     } else
@@ -2516,7 +2516,7 @@ need_secrets_sim(NMSetting8021x *self, GPtrArray *secrets, gboolean phase2)
 {
     NMSetting8021xPrivate *priv = NM_SETTING_802_1X_GET_PRIVATE(self);
 
-    if (!priv->pin || !strlen(priv->pin))
+    if (nm_str_is_empty(priv->pin))
         g_ptr_array_add(secrets, NM_SETTING_802_1X_PIN);
 }
 
@@ -2532,9 +2532,6 @@ need_private_key_password(GBytes *               blob,
     if (flags & NM_SETTING_SECRET_FLAG_NOT_REQUIRED)
         return FALSE;
 
-    if (scheme == NM_SETTING_802_1X_CK_SCHEME_PKCS11 && flags == NM_SETTING_SECRET_FLAG_NONE)
-        return FALSE;
-
     /* Private key password is required */
     if (password) {
         if (path)
@@ -2578,15 +2575,13 @@ need_secrets_tls(NMSetting8021x *self, GPtrArray *secrets, gboolean phase2)
 
         scheme = nm_setting_802_1x_get_phase2_ca_cert_scheme(self);
         if (scheme == NM_SETTING_802_1X_CK_SCHEME_PKCS11
-            && !(priv->phase2_ca_cert_password_flags == NM_SETTING_SECRET_FLAG_NONE
-                 || priv->phase2_ca_cert_password_flags & NM_SETTING_SECRET_FLAG_NOT_REQUIRED)
+            && !(priv->phase2_ca_cert_password_flags & NM_SETTING_SECRET_FLAG_NOT_REQUIRED)
             && !priv->phase2_ca_cert_password)
             g_ptr_array_add(secrets, NM_SETTING_802_1X_PHASE2_CA_CERT_PASSWORD);
 
         scheme = nm_setting_802_1x_get_phase2_client_cert_scheme(self);
         if (scheme == NM_SETTING_802_1X_CK_SCHEME_PKCS11
-            && !(priv->phase2_client_cert_password_flags & NM_SETTING_SECRET_FLAG_NOT_REQUIRED
-                 || priv->phase2_client_cert_password_flags == NM_SETTING_SECRET_FLAG_NONE)
+            && !(priv->phase2_client_cert_password_flags & NM_SETTING_SECRET_FLAG_NOT_REQUIRED)
             && !priv->phase2_client_cert_password)
             g_ptr_array_add(secrets, NM_SETTING_802_1X_PHASE2_CLIENT_CERT_PASSWORD);
     } else {
@@ -2607,15 +2602,13 @@ need_secrets_tls(NMSetting8021x *self, GPtrArray *secrets, gboolean phase2)
 
         scheme = nm_setting_802_1x_get_ca_cert_scheme(self);
         if (scheme == NM_SETTING_802_1X_CK_SCHEME_PKCS11
-            && !(priv->ca_cert_password_flags & NM_SETTING_SECRET_FLAG_NOT_REQUIRED
-                 || priv->ca_cert_password_flags == NM_SETTING_SECRET_FLAG_NONE)
+            && !(priv->ca_cert_password_flags & NM_SETTING_SECRET_FLAG_NOT_REQUIRED)
             && !priv->ca_cert_password)
             g_ptr_array_add(secrets, NM_SETTING_802_1X_CA_CERT_PASSWORD);
 
         scheme = nm_setting_802_1x_get_client_cert_scheme(self);
         if (scheme == NM_SETTING_802_1X_CK_SCHEME_PKCS11
-            && !(priv->client_cert_password_flags == NM_SETTING_SECRET_FLAG_NONE
-                 || priv->client_cert_password_flags & NM_SETTING_SECRET_FLAG_NOT_REQUIRED)
+            && !(priv->client_cert_password_flags & NM_SETTING_SECRET_FLAG_NOT_REQUIRED)
             && !priv->client_cert_password)
             g_ptr_array_add(secrets, NM_SETTING_802_1X_CLIENT_CERT_PASSWORD);
     }
@@ -2762,7 +2755,7 @@ verify_ttls(NMSetting8021x *self, gboolean phase2, GError **error)
 {
     NMSetting8021xPrivate *priv = NM_SETTING_802_1X_GET_PRIVATE(self);
 
-    if (!priv->identity || !strlen(priv->identity)) {
+    if (nm_str_is_empty(priv->identity)) {
         if (!priv->identity) {
             g_set_error_literal(error,
                                 NM_CONNECTION_ERROR,
@@ -2804,21 +2797,18 @@ verify_identity(NMSetting8021x *self, gboolean phase2, GError **error)
 {
     NMSetting8021xPrivate *priv = NM_SETTING_802_1X_GET_PRIVATE(self);
 
-    if (!priv->identity) {
-        g_set_error_literal(error,
-                            NM_CONNECTION_ERROR,
-                            NM_CONNECTION_ERROR_MISSING_PROPERTY,
-                            _("property is missing"));
-        g_prefix_error(error,
-                       "%s.%s: ",
-                       NM_SETTING_802_1X_SETTING_NAME,
-                       NM_SETTING_802_1X_IDENTITY);
-        return FALSE;
-    } else if (!strlen(priv->identity)) {
-        g_set_error_literal(error,
-                            NM_CONNECTION_ERROR,
-                            NM_CONNECTION_ERROR_INVALID_PROPERTY,
-                            _("property is empty"));
+    if (nm_str_is_empty(priv->identity)) {
+        if (!priv->identity) {
+            g_set_error_literal(error,
+                                NM_CONNECTION_ERROR,
+                                NM_CONNECTION_ERROR_MISSING_PROPERTY,
+                                _("property is missing"));
+        } else {
+            g_set_error_literal(error,
+                                NM_CONNECTION_ERROR,
+                                NM_CONNECTION_ERROR_INVALID_PROPERTY,
+                                _("property is empty"));
+        }
         g_prefix_error(error,
                        "%s.%s: ",
                        NM_SETTING_802_1X_SETTING_NAME,
@@ -2840,7 +2830,7 @@ need_secrets_phase2(NMSetting8021x *self, GPtrArray *secrets, gboolean phase2)
 
     /* Check phase2_auth and phase2_autheap */
     method = priv->phase2_auth;
-    if (!method && priv->phase2_autheap)
+    if (!method)
         method = priv->phase2_autheap;
 
     if (!method) {
@@ -2931,7 +2921,7 @@ verify(NMSetting *setting, NMConnection *connection, GError **error)
             if (eap_methods_table[i].v_func == NULL)
                 continue;
             if (!strcmp(eap_methods_table[i].method, method)) {
-                if (!(*eap_methods_table[i].v_func) (self, FALSE, error))
+                if (!(*eap_methods_table[i].v_func)(self, FALSE, error))
                     return FALSE;
                 break;
             }
@@ -2977,7 +2967,7 @@ verify(NMSetting *setting, NMConnection *connection, GError **error)
         return FALSE;
     }
 
-    if (NM_FLAGS_ANY(priv->phase1_auth_flags, ~NM_SETTING_802_1X_AUTH_FLAGS_ALL)) {
+    if (NM_FLAGS_ANY(priv->phase1_auth_flags, ~((guint32) NM_SETTING_802_1X_AUTH_FLAGS_ALL))) {
         g_set_error_literal(error,
                             NM_CONNECTION_ERROR,
                             NM_CONNECTION_ERROR_INVALID_PROPERTY,
@@ -3116,146 +3106,14 @@ get_property(GObject *object, guint prop_id, GValue *value, GParamSpec *pspec)
     case PROP_EAP:
         g_value_take_boxed(value, _nm_utils_slist_to_strv(priv->eap, TRUE));
         break;
-    case PROP_IDENTITY:
-        g_value_set_string(value, priv->identity);
-        break;
-    case PROP_ANONYMOUS_IDENTITY:
-        g_value_set_string(value, priv->anonymous_identity);
-        break;
-    case PROP_PAC_FILE:
-        g_value_set_string(value, priv->pac_file);
-        break;
-    case PROP_CA_CERT:
-        g_value_set_boxed(value, priv->ca_cert);
-        break;
-    case PROP_CA_CERT_PASSWORD:
-        g_value_set_string(value, priv->ca_cert_password);
-        break;
-    case PROP_CA_CERT_PASSWORD_FLAGS:
-        g_value_set_flags(value, priv->ca_cert_password_flags);
-        break;
-    case PROP_CA_PATH:
-        g_value_set_string(value, priv->ca_path);
-        break;
-    case PROP_SUBJECT_MATCH:
-        g_value_set_string(value, priv->subject_match);
-        break;
     case PROP_ALTSUBJECT_MATCHES:
         g_value_take_boxed(value, _nm_utils_slist_to_strv(priv->altsubject_matches, TRUE));
         break;
-    case PROP_DOMAIN_SUFFIX_MATCH:
-        g_value_set_string(value, priv->domain_suffix_match);
-        break;
-    case PROP_DOMAIN_MATCH:
-        g_value_set_string(value, priv->domain_match);
-        break;
-    case PROP_CLIENT_CERT:
-        g_value_set_boxed(value, priv->client_cert);
-        break;
-    case PROP_CLIENT_CERT_PASSWORD:
-        g_value_set_string(value, priv->client_cert_password);
-        break;
-    case PROP_CLIENT_CERT_PASSWORD_FLAGS:
-        g_value_set_flags(value, priv->client_cert_password_flags);
-        break;
-    case PROP_PHASE1_PEAPVER:
-        g_value_set_string(value, priv->phase1_peapver);
-        break;
-    case PROP_PHASE1_PEAPLABEL:
-        g_value_set_string(value, priv->phase1_peaplabel);
-        break;
-    case PROP_PHASE1_FAST_PROVISIONING:
-        g_value_set_string(value, priv->phase1_fast_provisioning);
-        break;
-    case PROP_PHASE1_AUTH_FLAGS:
-        g_value_set_uint(value, priv->phase1_auth_flags);
-        break;
-    case PROP_PHASE2_AUTH:
-        g_value_set_string(value, priv->phase2_auth);
-        break;
-    case PROP_PHASE2_AUTHEAP:
-        g_value_set_string(value, priv->phase2_autheap);
-        break;
-    case PROP_PHASE2_CA_CERT:
-        g_value_set_boxed(value, priv->phase2_ca_cert);
-        break;
-    case PROP_PHASE2_CA_CERT_PASSWORD:
-        g_value_set_string(value, priv->phase2_ca_cert_password);
-        break;
-    case PROP_PHASE2_CA_CERT_PASSWORD_FLAGS:
-        g_value_set_flags(value, priv->phase2_ca_cert_password_flags);
-        break;
-    case PROP_PHASE2_CA_PATH:
-        g_value_set_string(value, priv->phase2_ca_path);
-        break;
-    case PROP_PHASE2_SUBJECT_MATCH:
-        g_value_set_string(value, priv->phase2_subject_match);
-        break;
     case PROP_PHASE2_ALTSUBJECT_MATCHES:
         g_value_take_boxed(value, _nm_utils_slist_to_strv(priv->phase2_altsubject_matches, TRUE));
         break;
-    case PROP_PHASE2_DOMAIN_SUFFIX_MATCH:
-        g_value_set_string(value, priv->phase2_domain_suffix_match);
-        break;
-    case PROP_PHASE2_DOMAIN_MATCH:
-        g_value_set_string(value, priv->phase2_domain_match);
-        break;
-    case PROP_PHASE2_CLIENT_CERT:
-        g_value_set_boxed(value, priv->phase2_client_cert);
-        break;
-    case PROP_PHASE2_CLIENT_CERT_PASSWORD:
-        g_value_set_string(value, priv->phase2_client_cert_password);
-        break;
-    case PROP_PHASE2_CLIENT_CERT_PASSWORD_FLAGS:
-        g_value_set_flags(value, priv->phase2_client_cert_password_flags);
-        break;
-    case PROP_PASSWORD:
-        g_value_set_string(value, priv->password);
-        break;
-    case PROP_PASSWORD_FLAGS:
-        g_value_set_flags(value, priv->password_flags);
-        break;
-    case PROP_PASSWORD_RAW:
-        g_value_set_boxed(value, priv->password_raw);
-        break;
-    case PROP_PASSWORD_RAW_FLAGS:
-        g_value_set_flags(value, priv->password_raw_flags);
-        break;
-    case PROP_PRIVATE_KEY:
-        g_value_set_boxed(value, priv->private_key);
-        break;
-    case PROP_PRIVATE_KEY_PASSWORD:
-        g_value_set_string(value, priv->private_key_password);
-        break;
-    case PROP_PRIVATE_KEY_PASSWORD_FLAGS:
-        g_value_set_flags(value, priv->private_key_password_flags);
-        break;
-    case PROP_PHASE2_PRIVATE_KEY:
-        g_value_set_boxed(value, priv->phase2_private_key);
-        break;
-    case PROP_PHASE2_PRIVATE_KEY_PASSWORD:
-        g_value_set_string(value, priv->phase2_private_key_password);
-        break;
-    case PROP_PHASE2_PRIVATE_KEY_PASSWORD_FLAGS:
-        g_value_set_flags(value, priv->phase2_private_key_password_flags);
-        break;
-    case PROP_PIN:
-        g_value_set_string(value, priv->pin);
-        break;
-    case PROP_PIN_FLAGS:
-        g_value_set_flags(value, priv->pin_flags);
-        break;
-    case PROP_SYSTEM_CA_CERTS:
-        g_value_set_boolean(value, priv->system_ca_certs);
-        break;
-    case PROP_AUTH_TIMEOUT:
-        g_value_set_int(value, priv->auth_timeout);
-        break;
-    case PROP_OPTIONAL:
-        g_value_set_boolean(value, priv->optional);
-        break;
     default:
-        G_OBJECT_WARN_INVALID_PROPERTY_ID(object, prop_id, pspec);
+        _nm_setting_property_get_property_direct(object, prop_id, value, pspec);
         break;
     }
 }
@@ -3269,181 +3127,18 @@ set_property(GObject *object, guint prop_id, const GValue *value, GParamSpec *ps
     switch (prop_id) {
     case PROP_EAP:
         g_slist_free_full(priv->eap, g_free);
-        priv->eap = _nm_utils_strv_to_slist(g_value_get_boxed(value), TRUE);
-        break;
-    case PROP_IDENTITY:
-        g_free(priv->identity);
-        priv->identity = g_value_dup_string(value);
-        break;
-    case PROP_ANONYMOUS_IDENTITY:
-        g_free(priv->anonymous_identity);
-        priv->anonymous_identity = g_value_dup_string(value);
-        break;
-    case PROP_PAC_FILE:
-        g_free(priv->pac_file);
-        priv->pac_file = g_value_dup_string(value);
-        break;
-    case PROP_CA_CERT:
-        g_bytes_unref(priv->ca_cert);
-        priv->ca_cert = g_value_dup_boxed(value);
-        break;
-    case PROP_CA_CERT_PASSWORD:
-        g_free(priv->ca_cert_password);
-        priv->ca_cert_password = g_value_dup_string(value);
-        break;
-    case PROP_CA_CERT_PASSWORD_FLAGS:
-        priv->ca_cert_password_flags = g_value_get_flags(value);
-        break;
-    case PROP_CA_PATH:
-        g_free(priv->ca_path);
-        priv->ca_path = g_value_dup_string(value);
-        break;
-    case PROP_SUBJECT_MATCH:
-        g_free(priv->subject_match);
-        priv->subject_match = nm_strdup_not_empty(g_value_get_string(value));
+        priv->eap = nm_strv_to_gslist(g_value_get_boxed(value), TRUE);
         break;
     case PROP_ALTSUBJECT_MATCHES:
         g_slist_free_full(priv->altsubject_matches, g_free);
-        priv->altsubject_matches = _nm_utils_strv_to_slist(g_value_get_boxed(value), TRUE);
-        break;
-    case PROP_DOMAIN_SUFFIX_MATCH:
-        g_free(priv->domain_suffix_match);
-        priv->domain_suffix_match = nm_strdup_not_empty(g_value_get_string(value));
-        break;
-    case PROP_DOMAIN_MATCH:
-        g_free(priv->domain_match);
-        priv->domain_match = nm_strdup_not_empty(g_value_get_string(value));
-        break;
-    case PROP_CLIENT_CERT:
-        g_bytes_unref(priv->client_cert);
-        priv->client_cert = g_value_dup_boxed(value);
-        break;
-    case PROP_CLIENT_CERT_PASSWORD:
-        g_free(priv->client_cert_password);
-        priv->client_cert_password = g_value_dup_string(value);
-        break;
-    case PROP_CLIENT_CERT_PASSWORD_FLAGS:
-        priv->client_cert_password_flags = g_value_get_flags(value);
-        break;
-    case PROP_PHASE1_PEAPVER:
-        g_free(priv->phase1_peapver);
-        priv->phase1_peapver = g_value_dup_string(value);
-        break;
-    case PROP_PHASE1_PEAPLABEL:
-        g_free(priv->phase1_peaplabel);
-        priv->phase1_peaplabel = g_value_dup_string(value);
-        break;
-    case PROP_PHASE1_FAST_PROVISIONING:
-        g_free(priv->phase1_fast_provisioning);
-        priv->phase1_fast_provisioning = g_value_dup_string(value);
-        break;
-    case PROP_PHASE1_AUTH_FLAGS:
-        priv->phase1_auth_flags = g_value_get_uint(value);
-        break;
-    case PROP_PHASE2_AUTH:
-        g_free(priv->phase2_auth);
-        priv->phase2_auth = g_value_dup_string(value);
-        break;
-    case PROP_PHASE2_AUTHEAP:
-        g_free(priv->phase2_autheap);
-        priv->phase2_autheap = g_value_dup_string(value);
-        break;
-    case PROP_PHASE2_CA_CERT:
-        g_bytes_unref(priv->phase2_ca_cert);
-        priv->phase2_ca_cert = g_value_dup_boxed(value);
-        break;
-    case PROP_PHASE2_CA_CERT_PASSWORD:
-        g_free(priv->phase2_ca_cert_password);
-        priv->phase2_ca_cert_password = g_value_dup_string(value);
-        break;
-    case PROP_PHASE2_CA_CERT_PASSWORD_FLAGS:
-        priv->phase2_ca_cert_password_flags = g_value_get_flags(value);
-        break;
-    case PROP_PHASE2_CA_PATH:
-        g_free(priv->phase2_ca_path);
-        priv->phase2_ca_path = g_value_dup_string(value);
-        break;
-    case PROP_PHASE2_SUBJECT_MATCH:
-        g_free(priv->phase2_subject_match);
-        priv->phase2_subject_match = nm_strdup_not_empty(g_value_get_string(value));
+        priv->altsubject_matches = nm_strv_to_gslist(g_value_get_boxed(value), TRUE);
         break;
     case PROP_PHASE2_ALTSUBJECT_MATCHES:
         g_slist_free_full(priv->phase2_altsubject_matches, g_free);
-        priv->phase2_altsubject_matches = _nm_utils_strv_to_slist(g_value_get_boxed(value), TRUE);
-        break;
-    case PROP_PHASE2_DOMAIN_SUFFIX_MATCH:
-        g_free(priv->phase2_domain_suffix_match);
-        priv->phase2_domain_suffix_match = nm_strdup_not_empty(g_value_get_string(value));
-        break;
-    case PROP_PHASE2_DOMAIN_MATCH:
-        g_free(priv->phase2_domain_match);
-        priv->phase2_domain_match = nm_strdup_not_empty(g_value_get_string(value));
-        break;
-    case PROP_PHASE2_CLIENT_CERT:
-        g_bytes_unref(priv->phase2_client_cert);
-        priv->phase2_client_cert = g_value_dup_boxed(value);
-        break;
-    case PROP_PHASE2_CLIENT_CERT_PASSWORD:
-        g_free(priv->phase2_client_cert_password);
-        priv->phase2_client_cert_password = g_value_dup_string(value);
-        break;
-    case PROP_PHASE2_CLIENT_CERT_PASSWORD_FLAGS:
-        priv->phase2_client_cert_password_flags = g_value_get_flags(value);
-        break;
-    case PROP_PASSWORD:
-        g_free(priv->password);
-        priv->password = g_value_dup_string(value);
-        break;
-    case PROP_PASSWORD_FLAGS:
-        priv->password_flags = g_value_get_flags(value);
-        break;
-    case PROP_PASSWORD_RAW:
-        g_bytes_unref(priv->password_raw);
-        priv->password_raw = g_value_dup_boxed(value);
-        break;
-    case PROP_PASSWORD_RAW_FLAGS:
-        priv->password_raw_flags = g_value_get_flags(value);
-        break;
-    case PROP_PRIVATE_KEY:
-        g_bytes_unref(priv->private_key);
-        priv->private_key = g_value_dup_boxed(value);
-        break;
-    case PROP_PRIVATE_KEY_PASSWORD:
-        nm_free_secret(priv->private_key_password);
-        priv->private_key_password = g_value_dup_string(value);
-        break;
-    case PROP_PRIVATE_KEY_PASSWORD_FLAGS:
-        priv->private_key_password_flags = g_value_get_flags(value);
-        break;
-    case PROP_PHASE2_PRIVATE_KEY:
-        g_bytes_unref(priv->phase2_private_key);
-        priv->phase2_private_key = g_value_dup_boxed(value);
-        break;
-    case PROP_PHASE2_PRIVATE_KEY_PASSWORD:
-        nm_free_secret(priv->phase2_private_key_password);
-        priv->phase2_private_key_password = g_value_dup_string(value);
-        break;
-    case PROP_PHASE2_PRIVATE_KEY_PASSWORD_FLAGS:
-        priv->phase2_private_key_password_flags = g_value_get_flags(value);
-        break;
-    case PROP_PIN:
-        g_free(priv->pin);
-        priv->pin = g_value_dup_string(value);
-        break;
-    case PROP_PIN_FLAGS:
-        priv->pin_flags = g_value_get_flags(value);
-        break;
-    case PROP_SYSTEM_CA_CERTS:
-        priv->system_ca_certs = g_value_get_boolean(value);
-        break;
-    case PROP_AUTH_TIMEOUT:
-        priv->auth_timeout = g_value_get_int(value);
-        break;
-    case PROP_OPTIONAL:
-        priv->optional = g_value_get_boolean(value);
+        priv->phase2_altsubject_matches = nm_strv_to_gslist(g_value_get_boxed(value), TRUE);
         break;
     default:
-        G_OBJECT_WARN_INVALID_PROPERTY_ID(object, prop_id, pspec);
+        _nm_setting_property_set_property_direct(object, prop_id, value, pspec);
         break;
     }
 }
@@ -3473,40 +3168,10 @@ finalize(GObject *object)
     NMSetting8021x *       self = NM_SETTING_802_1X(object);
     NMSetting8021xPrivate *priv = NM_SETTING_802_1X_GET_PRIVATE(self);
 
-    g_free(priv->identity);
-    g_free(priv->anonymous_identity);
-    g_free(priv->ca_path);
-    g_free(priv->subject_match);
-    g_free(priv->domain_suffix_match);
-    g_free(priv->phase1_peapver);
-    g_free(priv->phase1_peaplabel);
-    g_free(priv->phase1_fast_provisioning);
-    g_free(priv->phase2_auth);
-    g_free(priv->phase2_autheap);
-    g_free(priv->phase2_ca_path);
-    g_free(priv->phase2_subject_match);
-    g_free(priv->phase2_domain_suffix_match);
-    g_free(priv->password);
-    g_bytes_unref(priv->password_raw);
-    g_free(priv->pin);
-
     g_slist_free_full(priv->eap, g_free);
     g_slist_free_full(priv->altsubject_matches, g_free);
     g_slist_free_full(priv->phase2_altsubject_matches, g_free);
 
-    g_bytes_unref(priv->ca_cert);
-    g_free(priv->ca_cert_password);
-    g_bytes_unref(priv->client_cert);
-    g_free(priv->client_cert_password);
-    g_bytes_unref(priv->private_key);
-    nm_free_secret(priv->private_key_password);
-    g_bytes_unref(priv->phase2_ca_cert);
-    g_free(priv->phase2_ca_cert_password);
-    g_bytes_unref(priv->phase2_client_cert);
-    g_free(priv->phase2_client_cert_password);
-    g_bytes_unref(priv->phase2_private_key);
-    nm_free_secret(priv->phase2_private_key_password);
-
     G_OBJECT_CLASS(nm_setting_802_1x_parent_class)->finalize(object);
 }
 
@@ -3562,11 +3227,13 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
      * example: IEEE_8021X_IDENTITY=itsme
      * ---end---
      */
-    obj_properties[PROP_IDENTITY] = g_param_spec_string(NM_SETTING_802_1X_IDENTITY,
-                                                        "",
-                                                        "",
-                                                        NULL,
-                                                        G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
+    _nm_setting_property_define_direct_string(properties_override,
+                                              obj_properties,
+                                              NM_SETTING_802_1X_IDENTITY,
+                                              PROP_IDENTITY,
+                                              NM_SETTING_PARAM_NONE,
+                                              NMSetting8021xPrivate,
+                                              identity);
 
     /**
      * NMSetting8021x:anonymous-identity:
@@ -3581,12 +3248,13 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
      * description: Anonymous identity for EAP authentication methods.
      * ---end---
      */
-    obj_properties[PROP_ANONYMOUS_IDENTITY] =
-        g_param_spec_string(NM_SETTING_802_1X_ANONYMOUS_IDENTITY,
-                            "",
-                            "",
-                            NULL,
-                            G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
+    _nm_setting_property_define_direct_string(properties_override,
+                                              obj_properties,
+                                              NM_SETTING_802_1X_ANONYMOUS_IDENTITY,
+                                              PROP_ANONYMOUS_IDENTITY,
+                                              NM_SETTING_PARAM_NONE,
+                                              NMSetting8021xPrivate,
+                                              anonymous_identity);
 
     /**
      * NMSetting8021x:pac-file:
@@ -3600,11 +3268,13 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
      * example: IEEE_8021X_PAC_FILE=/home/joe/my-fast.pac
      * ---end---
      */
-    obj_properties[PROP_PAC_FILE] = g_param_spec_string(NM_SETTING_802_1X_PAC_FILE,
-                                                        "",
-                                                        "",
-                                                        NULL,
-                                                        G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
+    _nm_setting_property_define_direct_string(properties_override,
+                                              obj_properties,
+                                              NM_SETTING_802_1X_PAC_FILE,
+                                              PROP_PAC_FILE,
+                                              NM_SETTING_PARAM_NONE,
+                                              NMSetting8021xPrivate,
+                                              pac_file);
 
     /**
      * NMSetting8021x:ca-cert:
@@ -3634,11 +3304,13 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
      * example: IEEE_8021X_CA_CERT=/home/joe/cacert.crt
      * ---end---
      */
-    obj_properties[PROP_CA_CERT] = g_param_spec_boxed(NM_SETTING_802_1X_CA_CERT,
-                                                      "",
-                                                      "",
-                                                      G_TYPE_BYTES,
-                                                      G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
+    _nm_setting_property_define_direct_bytes(properties_override,
+                                             obj_properties,
+                                             NM_SETTING_802_1X_CA_CERT,
+                                             PROP_CA_CERT,
+                                             NM_SETTING_PARAM_NONE,
+                                             NMSetting8021xPrivate,
+                                             ca_cert);
 
     /**
      * NMSetting8021x:ca-cert-password:
@@ -3652,12 +3324,13 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
     /* ---ifcfg-rh---
      * ---end---
      */
-    obj_properties[PROP_CA_CERT_PASSWORD] =
-        g_param_spec_string(NM_SETTING_802_1X_CA_CERT_PASSWORD,
-                            "",
-                            "",
-                            NULL,
-                            G_PARAM_READWRITE | NM_SETTING_PARAM_SECRET | G_PARAM_STATIC_STRINGS);
+    _nm_setting_property_define_direct_string(properties_override,
+                                              obj_properties,
+                                              NM_SETTING_802_1X_CA_CERT_PASSWORD,
+                                              PROP_CA_CERT_PASSWORD,
+                                              NM_SETTING_PARAM_SECRET,
+                                              NMSetting8021xPrivate,
+                                              ca_cert_password);
 
     /**
      * NMSetting8021x:ca-cert-password-flags:
@@ -3669,13 +3342,12 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
     /* ---ifcfg-rh---
      * ---end---
      */
-    obj_properties[PROP_CA_CERT_PASSWORD_FLAGS] =
-        g_param_spec_flags(NM_SETTING_802_1X_CA_CERT_PASSWORD_FLAGS,
-                           "",
-                           "",
-                           NM_TYPE_SETTING_SECRET_FLAGS,
-                           NM_SETTING_SECRET_FLAG_NONE,
-                           G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
+    _nm_setting_property_define_direct_secret_flags(properties_override,
+                                                    obj_properties,
+                                                    NM_SETTING_802_1X_CA_CERT_PASSWORD_FLAGS,
+                                                    PROP_CA_CERT_PASSWORD_FLAGS,
+                                                    NMSetting8021xPrivate,
+                                                    ca_cert_password_flags);
 
     /**
      * NMSetting8021x:ca-path:
@@ -3693,11 +3365,13 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
      * description: The search path for the certificate.
      * ---end---
      */
-    obj_properties[PROP_CA_PATH] = g_param_spec_string(NM_SETTING_802_1X_CA_PATH,
-                                                       "",
-                                                       "",
-                                                       NULL,
-                                                       G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
+    _nm_setting_property_define_direct_string(properties_override,
+                                              obj_properties,
+                                              NM_SETTING_802_1X_CA_PATH,
+                                              PROP_CA_PATH,
+                                              NM_SETTING_PARAM_NONE,
+                                              NMSetting8021xPrivate,
+                                              ca_path);
 
     /**
      * NMSetting8021x:subject-match:
@@ -3715,12 +3389,13 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
      * example: IEEE_8021X_SUBJECT_MATCH="Red Hat"
      * ---end---
      */
-    obj_properties[PROP_SUBJECT_MATCH] =
-        g_param_spec_string(NM_SETTING_802_1X_SUBJECT_MATCH,
-                            "",
-                            "",
-                            NULL,
-                            G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
+    _nm_setting_property_define_direct_string(properties_override,
+                                              obj_properties,
+                                              NM_SETTING_802_1X_SUBJECT_MATCH,
+                                              PROP_SUBJECT_MATCH,
+                                              NM_SETTING_PARAM_NONE,
+                                              NMSetting8021xPrivate,
+                                              subject_match);
 
     /**
      * NMSetting8021x:altsubject-matches:
@@ -3762,12 +3437,13 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
      * variable: IEEE_8021X_DOMAIN_SUFFIX_MATCH(+)
      * ---end---
      */
-    obj_properties[PROP_DOMAIN_SUFFIX_MATCH] =
-        g_param_spec_string(NM_SETTING_802_1X_DOMAIN_SUFFIX_MATCH,
-                            "",
-                            "",
-                            NULL,
-                            G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
+    _nm_setting_property_define_direct_string(properties_override,
+                                              obj_properties,
+                                              NM_SETTING_802_1X_DOMAIN_SUFFIX_MATCH,
+                                              PROP_DOMAIN_SUFFIX_MATCH,
+                                              NM_SETTING_PARAM_NONE,
+                                              NMSetting8021xPrivate,
+                                              domain_suffix_match);
 
     /**
      * NMSetting8021x:domain-match:
@@ -3787,12 +3463,13 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
      * variable: IEEE_8021X_DOMAIN_MATCH(+)
      * ---end---
      */
-    obj_properties[PROP_DOMAIN_MATCH] =
-        g_param_spec_string(NM_SETTING_802_1X_DOMAIN_MATCH,
-                            "",
-                            "",
-                            NULL,
-                            G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
+    _nm_setting_property_define_direct_string(properties_override,
+                                              obj_properties,
+                                              NM_SETTING_802_1X_DOMAIN_MATCH,
+                                              PROP_DOMAIN_MATCH,
+                                              NM_SETTING_PARAM_NONE,
+                                              NMSetting8021xPrivate,
+                                              domain_match);
 
     /**
      * NMSetting8021x:client-cert:
@@ -3817,12 +3494,13 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
      * example: IEEE_8021X_CLIENT_CERT=/home/joe/mycert.crt
      * ---end---
      */
-    obj_properties[PROP_CLIENT_CERT] =
-        g_param_spec_boxed(NM_SETTING_802_1X_CLIENT_CERT,
-                           "",
-                           "",
-                           G_TYPE_BYTES,
-                           G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
+    _nm_setting_property_define_direct_bytes(properties_override,
+                                             obj_properties,
+                                             NM_SETTING_802_1X_CLIENT_CERT,
+                                             PROP_CLIENT_CERT,
+                                             NM_SETTING_PARAM_NONE,
+                                             NMSetting8021xPrivate,
+                                             client_cert);
 
     /**
      * NMSetting8021x:client-cert-password:
@@ -3836,12 +3514,13 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
     /* ---ifcfg-rh---
      * ---end---
      */
-    obj_properties[PROP_CLIENT_CERT_PASSWORD] =
-        g_param_spec_string(NM_SETTING_802_1X_CLIENT_CERT_PASSWORD,
-                            "",
-                            "",
-                            NULL,
-                            G_PARAM_READWRITE | NM_SETTING_PARAM_SECRET | G_PARAM_STATIC_STRINGS);
+    _nm_setting_property_define_direct_string(properties_override,
+                                              obj_properties,
+                                              NM_SETTING_802_1X_CLIENT_CERT_PASSWORD,
+                                              PROP_CLIENT_CERT_PASSWORD,
+                                              NM_SETTING_PARAM_SECRET,
+                                              NMSetting8021xPrivate,
+                                              client_cert_password);
 
     /**
      * NMSetting8021x:client-cert-password-flags:
@@ -3853,13 +3532,12 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
     /* ---ifcfg-rh---
      * ---end---
      */
-    obj_properties[PROP_CLIENT_CERT_PASSWORD_FLAGS] =
-        g_param_spec_flags(NM_SETTING_802_1X_CLIENT_CERT_PASSWORD_FLAGS,
-                           "",
-                           "",
-                           NM_TYPE_SETTING_SECRET_FLAGS,
-                           NM_SETTING_SECRET_FLAG_NONE,
-                           G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
+    _nm_setting_property_define_direct_secret_flags(properties_override,
+                                                    obj_properties,
+                                                    NM_SETTING_802_1X_CLIENT_CERT_PASSWORD_FLAGS,
+                                                    PROP_CLIENT_CERT_PASSWORD_FLAGS,
+                                                    NMSetting8021xPrivate,
+                                                    client_cert_password_flags);
 
     /**
      * NMSetting8021x:phase1-peapver:
@@ -3878,12 +3556,13 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
      * description: Use to force a specific PEAP version.
      * ---end---
      */
-    obj_properties[PROP_PHASE1_PEAPVER] =
-        g_param_spec_string(NM_SETTING_802_1X_PHASE1_PEAPVER,
-                            "",
-                            "",
-                            NULL,
-                            G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
+    _nm_setting_property_define_direct_string(properties_override,
+                                              obj_properties,
+                                              NM_SETTING_802_1X_PHASE1_PEAPVER,
+                                              PROP_PHASE1_PEAPVER,
+                                              NM_SETTING_PARAM_NONE,
+                                              NMSetting8021xPrivate,
+                                              phase1_peapver);
 
     /**
      * NMSetting8021x:phase1-peaplabel:
@@ -3901,12 +3580,13 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
      * description: Use to force the new PEAP label during key derivation.
      * ---end---
      */
-    obj_properties[PROP_PHASE1_PEAPLABEL] =
-        g_param_spec_string(NM_SETTING_802_1X_PHASE1_PEAPLABEL,
-                            "",
-                            "",
-                            NULL,
-                            G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
+    _nm_setting_property_define_direct_string(properties_override,
+                                              obj_properties,
+                                              NM_SETTING_802_1X_PHASE1_PEAPLABEL,
+                                              PROP_PHASE1_PEAPLABEL,
+                                              NM_SETTING_PARAM_NONE,
+                                              NMSetting8021xPrivate,
+                                              phase1_peaplabel);
 
     /**
      * NMSetting8021x:phase1-fast-provisioning:
@@ -3926,12 +3606,13 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
      * example: IEEE_8021X_FAST_PROVISIONING="allow-auth allow-unauth"
      * ---end---
      */
-    obj_properties[PROP_PHASE1_FAST_PROVISIONING] =
-        g_param_spec_string(NM_SETTING_802_1X_PHASE1_FAST_PROVISIONING,
-                            "",
-                            "",
-                            NULL,
-                            G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
+    _nm_setting_property_define_direct_string(properties_override,
+                                              obj_properties,
+                                              NM_SETTING_802_1X_PHASE1_FAST_PROVISIONING,
+                                              PROP_PHASE1_FAST_PROVISIONING,
+                                              NM_SETTING_PARAM_NONE,
+                                              NMSetting8021xPrivate,
+                                              phase1_fast_provisioning);
 
     /**
      * NMSetting8021x:phase1-auth-flags:
@@ -3953,14 +3634,16 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
      * example: IEEE_8021X_PHASE1_AUTH_FLAGS="tls-1-0-disable tls-1-1-disable"
      * ---end---
      */
-    obj_properties[PROP_PHASE1_AUTH_FLAGS] =
-        g_param_spec_uint(NM_SETTING_802_1X_PHASE1_AUTH_FLAGS,
-                          "",
-                          "",
-                          0,
-                          G_MAXUINT32,
-                          NM_SETTING_802_1X_AUTH_FLAGS_NONE,
-                          G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
+    _nm_setting_property_define_direct_uint32(properties_override,
+                                              obj_properties,
+                                              NM_SETTING_802_1X_PHASE1_AUTH_FLAGS,
+                                              PROP_PHASE1_AUTH_FLAGS,
+                                              0,
+                                              G_MAXUINT32,
+                                              NM_SETTING_802_1X_AUTH_FLAGS_NONE,
+                                              NM_SETTING_PARAM_NONE,
+                                              NMSetting8021xPrivate,
+                                              phase1_auth_flags);
 
     /**
      * NMSetting8021x:phase2-auth:
@@ -3986,12 +3669,13 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
      * example: IEEE_8021X_INNER_AUTH_METHODS=PAP
      * ---end---
      */
-    obj_properties[PROP_PHASE2_AUTH] =
-        g_param_spec_string(NM_SETTING_802_1X_PHASE2_AUTH,
-                            "",
-                            "",
-                            NULL,
-                            G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
+    _nm_setting_property_define_direct_string(properties_override,
+                                              obj_properties,
+                                              NM_SETTING_802_1X_PHASE2_AUTH,
+                                              PROP_PHASE2_AUTH,
+                                              NM_SETTING_PARAM_NONE,
+                                              NMSetting8021xPrivate,
+                                              phase2_auth);
 
     /**
      * NMSetting8021x:phase2-autheap:
@@ -4012,12 +3696,13 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
      * example: IEEE_8021X_INNER_AUTH_METHODS="MSCHAPV2 EAP-TLS"
      * ---end---
      */
-    obj_properties[PROP_PHASE2_AUTHEAP] =
-        g_param_spec_string(NM_SETTING_802_1X_PHASE2_AUTHEAP,
-                            "",
-                            "",
-                            NULL,
-                            G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
+    _nm_setting_property_define_direct_string(properties_override,
+                                              obj_properties,
+                                              NM_SETTING_802_1X_PHASE2_AUTHEAP,
+                                              PROP_PHASE2_AUTHEAP,
+                                              NM_SETTING_PARAM_NONE,
+                                              NMSetting8021xPrivate,
+                                              phase2_autheap);
 
     /**
      * NMSetting8021x:phase2-ca-cert:
@@ -4041,12 +3726,13 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
      * Setting this property directly is discouraged; use the
      * nm_setting_802_1x_set_phase2_ca_cert() function instead.
      **/
-    obj_properties[PROP_PHASE2_CA_CERT] =
-        g_param_spec_boxed(NM_SETTING_802_1X_PHASE2_CA_CERT,
-                           "",
-                           "",
-                           G_TYPE_BYTES,
-                           G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
+    _nm_setting_property_define_direct_bytes(properties_override,
+                                             obj_properties,
+                                             NM_SETTING_802_1X_PHASE2_CA_CERT,
+                                             PROP_PHASE2_CA_CERT,
+                                             NM_SETTING_PARAM_NONE,
+                                             NMSetting8021xPrivate,
+                                             phase2_ca_cert);
 
     /**
      * NMSetting8021x:phase2-ca-cert-password:
@@ -4060,12 +3746,13 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
     /* ---ifcfg-rh---
      * ---end---
      */
-    obj_properties[PROP_PHASE2_CA_CERT_PASSWORD] =
-        g_param_spec_string(NM_SETTING_802_1X_PHASE2_CA_CERT_PASSWORD,
-                            "",
-                            "",
-                            NULL,
-                            G_PARAM_READWRITE | NM_SETTING_PARAM_SECRET | G_PARAM_STATIC_STRINGS);
+    _nm_setting_property_define_direct_string(properties_override,
+                                              obj_properties,
+                                              NM_SETTING_802_1X_PHASE2_CA_CERT_PASSWORD,
+                                              PROP_PHASE2_CA_CERT_PASSWORD,
+                                              NM_SETTING_PARAM_SECRET,
+                                              NMSetting8021xPrivate,
+                                              phase2_ca_cert_password);
 
     /**
      * NMSetting8021x:phase2-ca-cert-password-flags:
@@ -4077,13 +3764,12 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
     /* ---ifcfg-rh---
      * ---end---
      */
-    obj_properties[PROP_PHASE2_CA_CERT_PASSWORD_FLAGS] =
-        g_param_spec_flags(NM_SETTING_802_1X_PHASE2_CA_CERT_PASSWORD_FLAGS,
-                           "",
-                           "",
-                           NM_TYPE_SETTING_SECRET_FLAGS,
-                           NM_SETTING_SECRET_FLAG_NONE,
-                           G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
+    _nm_setting_property_define_direct_secret_flags(properties_override,
+                                                    obj_properties,
+                                                    NM_SETTING_802_1X_PHASE2_CA_CERT_PASSWORD_FLAGS,
+                                                    PROP_PHASE2_CA_CERT_PASSWORD_FLAGS,
+                                                    NMSetting8021xPrivate,
+                                                    phase2_ca_cert_password_flags);
 
     /**
      * NMSetting8021x:phase2-ca-path:
@@ -4101,12 +3787,13 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
      * description: The search path for the certificate.
      * ---end---
      */
-    obj_properties[PROP_PHASE2_CA_PATH] =
-        g_param_spec_string(NM_SETTING_802_1X_PHASE2_CA_PATH,
-                            "",
-                            "",
-                            NULL,
-                            G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
+    _nm_setting_property_define_direct_string(properties_override,
+                                              obj_properties,
+                                              NM_SETTING_802_1X_PHASE2_CA_PATH,
+                                              PROP_PHASE2_CA_PATH,
+                                              NM_SETTING_PARAM_NONE,
+                                              NMSetting8021xPrivate,
+                                              phase2_ca_path);
 
     /**
      * NMSetting8021x:phase2-subject-match:
@@ -4125,12 +3812,13 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
      * example: IEEE_8021X_PHASE2_SUBJECT_MATCH="Red Hat"
      * ---end---
      */
-    obj_properties[PROP_PHASE2_SUBJECT_MATCH] =
-        g_param_spec_string(NM_SETTING_802_1X_PHASE2_SUBJECT_MATCH,
-                            "",
-                            "",
-                            NULL,
-                            G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
+    _nm_setting_property_define_direct_string(properties_override,
+                                              obj_properties,
+                                              NM_SETTING_802_1X_PHASE2_SUBJECT_MATCH,
+                                              PROP_PHASE2_SUBJECT_MATCH,
+                                              NM_SETTING_PARAM_NONE,
+                                              NMSetting8021xPrivate,
+                                              phase2_subject_match);
 
     /**
      * NMSetting8021x:phase2-altsubject-matches:
@@ -4172,12 +3860,13 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
      * variable: IEEE_8021X_PHASE2_DOMAIN_SUFFIX_MATCH(+)
      * ---end---
      */
-    obj_properties[PROP_PHASE2_DOMAIN_SUFFIX_MATCH] =
-        g_param_spec_string(NM_SETTING_802_1X_PHASE2_DOMAIN_SUFFIX_MATCH,
-                            "",
-                            "",
-                            NULL,
-                            G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
+    _nm_setting_property_define_direct_string(properties_override,
+                                              obj_properties,
+                                              NM_SETTING_802_1X_PHASE2_DOMAIN_SUFFIX_MATCH,
+                                              PROP_PHASE2_DOMAIN_SUFFIX_MATCH,
+                                              NM_SETTING_PARAM_NONE,
+                                              NMSetting8021xPrivate,
+                                              phase2_domain_suffix_match);
 
     /**
      * NMSetting8021x:phase2-domain-match:
@@ -4198,12 +3887,13 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
      * variable: IEEE_8021X_PHASE2_DOMAIN_MATCH(+)
      * ---end---
      */
-    obj_properties[PROP_PHASE2_DOMAIN_MATCH] =
-        g_param_spec_string(NM_SETTING_802_1X_PHASE2_DOMAIN_MATCH,
-                            "",
-                            "",
-                            NULL,
-                            G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
+    _nm_setting_property_define_direct_string(properties_override,
+                                              obj_properties,
+                                              NM_SETTING_802_1X_PHASE2_DOMAIN_MATCH,
+                                              PROP_PHASE2_DOMAIN_MATCH,
+                                              NM_SETTING_PARAM_NONE,
+                                              NMSetting8021xPrivate,
+                                              phase2_domain_match);
 
     /**
      * NMSetting8021x:phase2-client-cert:
@@ -4231,12 +3921,13 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
      * example: IEEE_8021X_INNER_CLIENT_CERT=/home/joe/mycert.crt
      * ---end---
      */
-    obj_properties[PROP_PHASE2_CLIENT_CERT] =
-        g_param_spec_boxed(NM_SETTING_802_1X_PHASE2_CLIENT_CERT,
-                           "",
-                           "",
-                           G_TYPE_BYTES,
-                           G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
+    _nm_setting_property_define_direct_bytes(properties_override,
+                                             obj_properties,
+                                             NM_SETTING_802_1X_PHASE2_CLIENT_CERT,
+                                             PROP_PHASE2_CLIENT_CERT,
+                                             NM_SETTING_PARAM_NONE,
+                                             NMSetting8021xPrivate,
+                                             phase2_client_cert);
 
     /**
      * NMSetting8021x:phase2-client-cert-password:
@@ -4250,12 +3941,13 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
     /* ---ifcfg-rh---
      * ---end---
      */
-    obj_properties[PROP_PHASE2_CLIENT_CERT_PASSWORD] =
-        g_param_spec_string(NM_SETTING_802_1X_PHASE2_CLIENT_CERT_PASSWORD,
-                            "",
-                            "",
-                            NULL,
-                            G_PARAM_READWRITE | NM_SETTING_PARAM_SECRET | G_PARAM_STATIC_STRINGS);
+    _nm_setting_property_define_direct_string(properties_override,
+                                              obj_properties,
+                                              NM_SETTING_802_1X_PHASE2_CLIENT_CERT_PASSWORD,
+                                              PROP_PHASE2_CLIENT_CERT_PASSWORD,
+                                              NM_SETTING_PARAM_SECRET,
+                                              NMSetting8021xPrivate,
+                                              phase2_client_cert_password);
 
     /**
      * NMSetting8021x:phase2-client-cert-password-flags:
@@ -4267,13 +3959,13 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
     /* ---ifcfg-rh---
      * ---end---
      */
-    obj_properties[PROP_PHASE2_CLIENT_CERT_PASSWORD_FLAGS] =
-        g_param_spec_flags(NM_SETTING_802_1X_PHASE2_CLIENT_CERT_PASSWORD_FLAGS,
-                           "",
-                           "",
-                           NM_TYPE_SETTING_SECRET_FLAGS,
-                           NM_SETTING_SECRET_FLAG_NONE,
-                           G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
+    _nm_setting_property_define_direct_secret_flags(
+        properties_override,
+        obj_properties,
+        NM_SETTING_802_1X_PHASE2_CLIENT_CERT_PASSWORD_FLAGS,
+        PROP_PHASE2_CLIENT_CERT_PASSWORD_FLAGS,
+        NMSetting8021xPrivate,
+        phase2_client_cert_password_flags);
 
     /**
      * NMSetting8021x:password:
@@ -4289,12 +3981,13 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
      *   lookaside file, or it can be owned by a secret agent.
      * ---end---
      */
-    obj_properties[PROP_PASSWORD] =
-        g_param_spec_string(NM_SETTING_802_1X_PASSWORD,
-                            "",
-                            "",
-                            NULL,
-                            G_PARAM_READWRITE | NM_SETTING_PARAM_SECRET | G_PARAM_STATIC_STRINGS);
+    _nm_setting_property_define_direct_string(properties_override,
+                                              obj_properties,
+                                              NM_SETTING_802_1X_PASSWORD,
+                                              PROP_PASSWORD,
+                                              NM_SETTING_PARAM_SECRET,
+                                              NMSetting8021xPrivate,
+                                              password);
 
     /**
      * NMSetting8021x:password-flags:
@@ -4308,13 +4001,12 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
      * description: Password flags for IEEE_8021X_PASSWORD password.
      * ---end---
      */
-    obj_properties[PROP_PASSWORD_FLAGS] =
-        g_param_spec_flags(NM_SETTING_802_1X_PASSWORD_FLAGS,
-                           "",
-                           "",
-                           NM_TYPE_SETTING_SECRET_FLAGS,
-                           NM_SETTING_SECRET_FLAG_NONE,
-                           G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
+    _nm_setting_property_define_direct_secret_flags(properties_override,
+                                                    obj_properties,
+                                                    NM_SETTING_802_1X_PASSWORD_FLAGS,
+                                                    PROP_PASSWORD_FLAGS,
+                                                    NMSetting8021xPrivate,
+                                                    password_flags);
 
     /**
      * NMSetting8021x:password-raw:
@@ -4332,12 +4024,13 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
      * example: IEEE_8021X_PASSWORD_RAW=041c8320083aa4bf
      * ---end---
      */
-    obj_properties[PROP_PASSWORD_RAW] =
-        g_param_spec_boxed(NM_SETTING_802_1X_PASSWORD_RAW,
-                           "",
-                           "",
-                           G_TYPE_BYTES,
-                           G_PARAM_READWRITE | NM_SETTING_PARAM_SECRET | G_PARAM_STATIC_STRINGS);
+    _nm_setting_property_define_direct_bytes(properties_override,
+                                             obj_properties,
+                                             NM_SETTING_802_1X_PASSWORD_RAW,
+                                             PROP_PASSWORD_RAW,
+                                             NM_SETTING_PARAM_SECRET,
+                                             NMSetting8021xPrivate,
+                                             password_raw);
 
     /**
      * NMSetting8021x:password-raw-flags:
@@ -4350,13 +4043,12 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
      * description: The secret flags for password-raw.
      * ---end---
      */
-    obj_properties[PROP_PASSWORD_RAW_FLAGS] =
-        g_param_spec_flags(NM_SETTING_802_1X_PASSWORD_RAW_FLAGS,
-                           "",
-                           "",
-                           NM_TYPE_SETTING_SECRET_FLAGS,
-                           NM_SETTING_SECRET_FLAG_NONE,
-                           G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
+    _nm_setting_property_define_direct_secret_flags(properties_override,
+                                                    obj_properties,
+                                                    NM_SETTING_802_1X_PASSWORD_RAW_FLAGS,
+                                                    PROP_PASSWORD_RAW_FLAGS,
+                                                    NMSetting8021xPrivate,
+                                                    password_raw_flags);
 
     /**
      * NMSetting8021x:private-key:
@@ -4396,12 +4088,13 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
      * example: IEEE_8021X_PRIVATE_KEY=/home/joe/mykey.p12
      * ---end---
      */
-    obj_properties[PROP_PRIVATE_KEY] =
-        g_param_spec_boxed(NM_SETTING_802_1X_PRIVATE_KEY,
-                           "",
-                           "",
-                           G_TYPE_BYTES,
-                           G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
+    _nm_setting_property_define_direct_bytes(properties_override,
+                                             obj_properties,
+                                             NM_SETTING_802_1X_PRIVATE_KEY,
+                                             PROP_PRIVATE_KEY,
+                                             NM_SETTING_PARAM_NONE,
+                                             NMSetting8021xPrivate,
+                                             private_key);
 
     /**
      * NMSetting8021x:private-key-password:
@@ -4420,12 +4113,13 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
      *   lookaside file, or it can be owned by a secret agent.
      * ---end---
      */
-    obj_properties[PROP_PRIVATE_KEY_PASSWORD] =
-        g_param_spec_string(NM_SETTING_802_1X_PRIVATE_KEY_PASSWORD,
-                            "",
-                            "",
-                            NULL,
-                            G_PARAM_READWRITE | NM_SETTING_PARAM_SECRET | G_PARAM_STATIC_STRINGS);
+    _nm_setting_property_define_direct_string(properties_override,
+                                              obj_properties,
+                                              NM_SETTING_802_1X_PRIVATE_KEY_PASSWORD,
+                                              PROP_PRIVATE_KEY_PASSWORD,
+                                              NM_SETTING_PARAM_SECRET,
+                                              NMSetting8021xPrivate,
+                                              private_key_password);
 
     /**
      * NMSetting8021x:private-key-password-flags:
@@ -4440,13 +4134,12 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
      * description: Password flags for IEEE_8021X_PRIVATE_KEY_PASSWORD password.
      * ---end---
      */
-    obj_properties[PROP_PRIVATE_KEY_PASSWORD_FLAGS] =
-        g_param_spec_flags(NM_SETTING_802_1X_PRIVATE_KEY_PASSWORD_FLAGS,
-                           "",
-                           "",
-                           NM_TYPE_SETTING_SECRET_FLAGS,
-                           NM_SETTING_SECRET_FLAG_NONE,
-                           G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
+    _nm_setting_property_define_direct_secret_flags(properties_override,
+                                                    obj_properties,
+                                                    NM_SETTING_802_1X_PRIVATE_KEY_PASSWORD_FLAGS,
+                                                    PROP_PRIVATE_KEY_PASSWORD_FLAGS,
+                                                    NMSetting8021xPrivate,
+                                                    private_key_password_flags);
 
     /**
      * NMSetting8021x:phase2-private-key:
@@ -4480,12 +4173,13 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
      * description: Private key for inner authentication method for EAP-TLS.
      * ---end---
      */
-    obj_properties[PROP_PHASE2_PRIVATE_KEY] =
-        g_param_spec_boxed(NM_SETTING_802_1X_PHASE2_PRIVATE_KEY,
-                           "",
-                           "",
-                           G_TYPE_BYTES,
-                           G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
+    _nm_setting_property_define_direct_bytes(properties_override,
+                                             obj_properties,
+                                             NM_SETTING_802_1X_PHASE2_PRIVATE_KEY,
+                                             PROP_PHASE2_PRIVATE_KEY,
+                                             NM_SETTING_PARAM_NONE,
+                                             NMSetting8021xPrivate,
+                                             phase2_private_key);
 
     /**
      * NMSetting8021x:phase2-private-key-password:
@@ -4505,12 +4199,13 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
      *   lookaside file, or it can be owned by a secret agent.
      * ---end---
      */
-    obj_properties[PROP_PHASE2_PRIVATE_KEY_PASSWORD] =
-        g_param_spec_string(NM_SETTING_802_1X_PHASE2_PRIVATE_KEY_PASSWORD,
-                            "",
-                            "",
-                            NULL,
-                            G_PARAM_READWRITE | NM_SETTING_PARAM_SECRET | G_PARAM_STATIC_STRINGS);
+    _nm_setting_property_define_direct_string(properties_override,
+                                              obj_properties,
+                                              NM_SETTING_802_1X_PHASE2_PRIVATE_KEY_PASSWORD,
+                                              PROP_PHASE2_PRIVATE_KEY_PASSWORD,
+                                              NM_SETTING_PARAM_SECRET,
+                                              NMSetting8021xPrivate,
+                                              phase2_private_key_password);
 
     /**
      * NMSetting8021x:phase2-private-key-password-flags:
@@ -4525,13 +4220,13 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
      * description: Password flags for IEEE_8021X_INNER_PRIVATE_KEY_PASSWORD password.
      * ---end---
      */
-    obj_properties[PROP_PHASE2_PRIVATE_KEY_PASSWORD_FLAGS] =
-        g_param_spec_flags(NM_SETTING_802_1X_PHASE2_PRIVATE_KEY_PASSWORD_FLAGS,
-                           "",
-                           "",
-                           NM_TYPE_SETTING_SECRET_FLAGS,
-                           NM_SETTING_SECRET_FLAG_NONE,
-                           G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
+    _nm_setting_property_define_direct_secret_flags(
+        properties_override,
+        obj_properties,
+        NM_SETTING_802_1X_PHASE2_PRIVATE_KEY_PASSWORD_FLAGS,
+        PROP_PHASE2_PRIVATE_KEY_PASSWORD_FLAGS,
+        NMSetting8021xPrivate,
+        phase2_private_key_password_flags);
 
     /**
      * NMSetting8021x:pin:
@@ -4544,12 +4239,13 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
      * description: The pin secret used for EAP authentication methods.
      * ---end---
      */
-    obj_properties[PROP_PIN] =
-        g_param_spec_string(NM_SETTING_802_1X_PIN,
-                            "",
-                            "",
-                            NULL,
-                            G_PARAM_READWRITE | NM_SETTING_PARAM_SECRET | G_PARAM_STATIC_STRINGS);
+    _nm_setting_property_define_direct_string(properties_override,
+                                              obj_properties,
+                                              NM_SETTING_802_1X_PIN,
+                                              PROP_PIN,
+                                              NM_SETTING_PARAM_SECRET,
+                                              NMSetting8021xPrivate,
+                                              pin);
 
     /**
      * NMSetting8021x:pin-flags:
@@ -4562,12 +4258,12 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
      * description: The secret flags for the pin property.
      * ---end---
      */
-    obj_properties[PROP_PIN_FLAGS] = g_param_spec_flags(NM_SETTING_802_1X_PIN_FLAGS,
-                                                        "",
-                                                        "",
-                                                        NM_TYPE_SETTING_SECRET_FLAGS,
-                                                        NM_SETTING_SECRET_FLAG_NONE,
-                                                        G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
+    _nm_setting_property_define_direct_secret_flags(properties_override,
+                                                    obj_properties,
+                                                    NM_SETTING_802_1X_PIN_FLAGS,
+                                                    PROP_PIN_FLAGS,
+                                                    NMSetting8021xPrivate,
+                                                    pin_flags);
 
     /**
      * NMSetting8021x:system-ca-certs:
@@ -4588,13 +4284,14 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
      * description: a boolean value.
      * ---end---
      */
-    _nm_setting_property_define_boolean(properties_override,
-                                        obj_properties,
-                                        NM_SETTING_802_1X_SYSTEM_CA_CERTS,
-                                        PROP_SYSTEM_CA_CERTS,
-                                        FALSE,
-                                        NM_SETTING_PARAM_NONE,
-                                        nm_setting_802_1x_get_system_ca_certs);
+    _nm_setting_property_define_direct_boolean(properties_override,
+                                               obj_properties,
+                                               NM_SETTING_802_1X_SYSTEM_CA_CERTS,
+                                               PROP_SYSTEM_CA_CERTS,
+                                               FALSE,
+                                               NM_SETTING_PARAM_NONE,
+                                               NMSetting8021xPrivate,
+                                               system_ca_certs);
 
     /**
      * NMSetting8021x:auth-timeout:
@@ -4611,14 +4308,16 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
      * description: Timeout in seconds for the 802.1X authentication. Zero means the global default or 25.
      * ---end---
      */
-    obj_properties[PROP_AUTH_TIMEOUT] = g_param_spec_int(
-        NM_SETTING_802_1X_AUTH_TIMEOUT,
-        "",
-        "",
-        0,
-        G_MAXINT32,
-        0,
-        G_PARAM_READWRITE | NM_SETTING_PARAM_FUZZY_IGNORE | G_PARAM_STATIC_STRINGS);
+    _nm_setting_property_define_direct_int32(properties_override,
+                                             obj_properties,
+                                             NM_SETTING_802_1X_AUTH_TIMEOUT,
+                                             PROP_AUTH_TIMEOUT,
+                                             0,
+                                             G_MAXINT32,
+                                             0,
+                                             NM_SETTING_PARAM_FUZZY_IGNORE,
+                                             NMSetting8021xPrivate,
+                                             auth_timeout);
 
     /**
      * NMSetting8021x:optional:
@@ -4638,18 +4337,20 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
      * description: whether the 802.1X authentication is optional
      * ---end---
      */
-    _nm_setting_property_define_boolean(properties_override,
-                                        obj_properties,
-                                        NM_SETTING_802_1X_OPTIONAL,
-                                        PROP_OPTIONAL,
-                                        FALSE,
-                                        NM_SETTING_PARAM_NONE,
-                                        nm_setting_802_1x_get_optional);
+    _nm_setting_property_define_direct_boolean(properties_override,
+                                               obj_properties,
+                                               NM_SETTING_802_1X_OPTIONAL,
+                                               PROP_OPTIONAL,
+                                               FALSE,
+                                               NM_SETTING_PARAM_NONE,
+                                               NMSetting8021xPrivate,
+                                               optional);
 
     g_object_class_install_properties(object_class, _PROPERTY_ENUMS_LAST, obj_properties);
 
-    _nm_setting_class_commit_full(setting_class,
-                                  NM_META_SETTING_TYPE_802_1X,
-                                  NULL,
-                                  properties_override);
+    _nm_setting_class_commit(setting_class,
+                             NM_META_SETTING_TYPE_802_1X,
+                             NULL,
+                             properties_override,
+                             NM_SETT_INFO_PRIVATE_OFFSET_FROM_CLASS);
 }