From 34bb501be08aa2b313d88e67d6e0a7e0a3f9cfa6 Mon Sep 17 00:00:00 2001 From: Michael Biebl Date: Sun, 5 May 2024 00:07:30 +0200 Subject: New upstream version 1.47.90 --- docs/api/html/nm-settings-nmcli.html | 137 ++++++++++++++++++++++++++--------- 1 file changed, 104 insertions(+), 33 deletions(-) (limited to 'docs/api/html/nm-settings-nmcli.html') diff --git a/docs/api/html/nm-settings-nmcli.html b/docs/api/html/nm-settings-nmcli.html index 9d266d92..d91c80e3 100644 --- a/docs/api/html/nm-settings-nmcli.html +++ b/docs/api/html/nm-settings-nmcli.html @@ -141,6 +141,7 @@

connection.autoconnect-slaves

Whether or not slaves of this connection should be automatically brought up when NetworkManager activates this connection. This only has a real effect for master connections. The properties "autoconnect", "autoconnect-priority" and "autoconnect-retries" are unrelated to this setting. The permitted values are: 0: leave slave connections untouched, 1: activate all the slave connections with this connection, -1: default. If -1 (default) is set, global connection.autoconnect-slaves is read to determine the real value. If it is default as well, this fallbacks to 0.

+

Deprecated 1.46. Use "autoconnect-ports" instead, this is just an alias.

Format: choice (NMSettingConnectionAutoconnectSlaves)

@@ -170,6 +171,16 @@ +

connection.down-on-poweroff

+ +

Whether the connection will be brought down before the system is powered off. The default value is "default" (-1). When the default value is specified, then the global value from NetworkManager configuration is looked up, if not set, it is considered as "no" (0).

+

+ Format: ternary

+

+ Valid values: true/yes/on, false/no/off, default/unknown

+ + +

connection.gateway-ping-timeout

If greater than zero, delay success of IP addressing until either the timeout is reached, or an IP gateway replies to a ping.

@@ -238,8 +249,8 @@

connection.mdns

Whether mDNS is enabled for the connection.

-

The permitted values are: "yes" (2) register hostname and resolving for the connection, "no" (0) disable mDNS for the interface, "resolve" (1) do not register hostname but allow resolving of mDNS host names and "default" (-1) to allow lookup of a global default in NetworkManager.conf. If unspecified, "default" ultimately depends on the DNS plugin (which for systemd-resolved currently means "no").

-

This feature requires a plugin which supports mDNS. Otherwise, the setting has no effect. One such plugin is dns-systemd-resolved.

+

The permitted values are: "yes" (2) register hostname and resolving for the connection, "no" (0) disable mDNS for the interface, "resolve" (1) do not register hostname but allow resolving of mDNS host names and "default" (-1) to allow lookup of a global default in NetworkManager.conf. If unspecified, "default" ultimately depends on the DNS plugin.

+

This feature requires a plugin which supports mDNS. Otherwise, the setting has no effect. Currently the only supported DNS plugin is systemd-resolved. For systemd-resolved, the default is configurable via MulticastDNS= setting in resolved.conf.

Format: choice (NMSettingConnectionMdns)

@@ -376,7 +387,7 @@

The connection.uuid is the real identifier of a profile. It cannot change and it must be unique. It is therefore often best to refer to a profile by UUID, for example with `nmcli connection up uuid $UUID`.

The UUID cannot be changed, except in offline mode. In that case, the special values "new", "generate" and "" are allowed to generate a new random UUID.

- Format: string

+ Format: a valid RFC4122 universally unique identifier (UUID).

@@ -479,9 +490,9 @@

802-1x.ca-cert

-

Contains the CA certificate if used by the EAP method specified in the "eap" property.

-

Certificate data is specified using a "scheme"; three are currently supported: blob, path and pkcs#11 URL. When using the blob scheme this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended.

-

Note that enabling NMSetting8021x:system-ca-certs will override this setting to use the built-in path, if the built-in path is not a directory.

+

Contains the path to the CA certificate if used by the EAP method specified in the 802-1x.eap property.

+

This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended.

+

Note that enabling 802-1x.system-ca-certs will override this setting to use the built-in path, if the built-in path is not a directory.

Format: filesystem path

@@ -516,8 +527,7 @@

802-1x.client-cert

-

Contains the client certificate if used by the EAP method specified in the "eap" property.

-

Certificate data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte.

+

Contains the path to the client certificate if used by the EAP method specified in the 802-1x.eap property.

Format: filesystem path

@@ -575,6 +585,14 @@ +

802-1x.openssl-ciphers

+ +

Define openssl_ciphers for wpa_supplicant. Openssl sometimes moves ciphers among SECLEVELs, thus compiled-in default value in wpa_supplicant (as modified by some linux distributions) sometimes prevents to connect to old servers that do not support new protocols.

+

+ Format: string

+ + +

802-1x.optional

Whether the 802.1X authentication is optional. If TRUE, the activation will continue even after a timeout or an authentication failure. Setting the property to TRUE is currently allowed only for Ethernet connections. If set to FALSE, the activation can continue only after a successful authentication.

@@ -699,9 +717,9 @@

802-1x.phase2-ca-cert

-

Contains the "phase 2" CA certificate if used by the EAP method specified in the "phase2-auth" or "phase2-autheap" properties.

-

Certificate data is specified using a "scheme"; three are currently supported: blob, path and pkcs#11 URL. When using the blob scheme this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended.

-

Note that enabling NMSetting8021x:system-ca-certs will override this setting to use the built-in path, if the built-in path is not a directory.

+

Contains the path to the "phase 2" CA certificate if used by the EAP method specified in the 802-1x.phase2-auth or 802-1x.phase2-autheap properties.

+

This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended.

+

Note that enabling 802-1x.system-ca-certs will override this setting to use the built-in path, if the built-in path is not a directory.

Format: filesystem path

@@ -736,8 +754,7 @@

802-1x.phase2-client-cert

-

Contains the "phase 2" client certificate if used by the EAP method specified in the "phase2-auth" or "phase2-autheap" properties.

-

Certificate data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended.

+

Contains the path to the "phase 2" client certificate if used by the EAP method specified in the 802-1x.phase2-auth or 802-1x.phase2-autheap properties.

Format: filesystem path

@@ -779,8 +796,7 @@

802-1x.phase2-private-key

-

Contains the "phase 2" inner private key when the "phase2-auth" or "phase2-autheap" property is set to "tls".

-

Key data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme and private keys, this property should be set to the key's encrypted PEM encoded data. When using private keys with the path scheme, this property should be set to the full UTF-8 encoded path of the key, prefixed with the string "file://" and ending with a terminating NUL byte. When using PKCS#12 format private keys and the blob scheme, this property should be set to the PKCS#12 data and the "phase2-private-key-password" property must be set to password used to decrypt the PKCS#12 certificate and key. When using PKCS#12 files and the path scheme, this property should be set to the full UTF-8 encoded path of the key, prefixed with the string "file://" and ending with a terminating NUL byte, and as with the blob scheme the "phase2-private-key-password" property must be set to the password used to decode the PKCS#12 private key and certificate.

+

The path to the "phase 2" inner private key when the 802-1x.phase2-auth or 802-1x.phase2-autheap property is set to "tls".

Format: filesystem path

@@ -788,7 +804,7 @@

802-1x.phase2-private-key-password

-

The password used to decrypt the "phase 2" private key specified in the "phase2-private-key" property when the private key either uses the path scheme, or is a PKCS#12 format key.

+

The password used to decrypt the "phase 2" private key specified in the 802-1x.phase2-private-key property. This is normally used by secret agents, not directly by users.

Format: string

@@ -835,9 +851,7 @@

802-1x.private-key

-

Contains the private key when the "eap" property is set to "tls".

-

Key data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme and private keys, this property should be set to the key's encrypted PEM encoded data. When using private keys with the path scheme, this property should be set to the full UTF-8 encoded path of the key, prefixed with the string "file://" and ending with a terminating NUL byte. When using PKCS#12 format private keys and the blob scheme, this property should be set to the PKCS#12 data and the "private-key-password" property must be set to password used to decrypt the PKCS#12 certificate and key. When using PKCS#12 files and the path scheme, this property should be set to the full UTF-8 encoded path of the key, prefixed with the string "file://" and ending with a terminating NUL byte, and as with the blob scheme the "private-key-password" property must be set to the password used to decode the PKCS#12 private key and certificate.

-

WARNING: "private-key" is not a "secret" property, and thus unencrypted private key data using the BLOB scheme may be readable by unprivileged users. Private keys should always be encrypted with a private key password to prevent unauthorized access to unencrypted private key data.

+

The path to the private key when the 802-1.eap property is set to "tls".

Format: filesystem path

@@ -845,7 +859,7 @@

802-1x.private-key-password

-

The password used to decrypt the private key specified in the "private-key" property when the private key either uses the path scheme, or if the private key is a PKCS#12 format key.

+

The password used to decrypt the private key specified in the 802-1x.private-key property. This is normally used by secret agents, not directly by users.

Format: string

@@ -2772,7 +2786,7 @@ Alias: ip4

A list of IPv4 addresses and their prefix length. Multiple addresses can be separated by comma. For example "192.168.1.5/24, 10.1.0.5/24". The addresses are listed in decreasing priority, meaning the first address will be the primary address.

- Format: list of ipv4.addresses objects

+ Format: a comma separated list of addresses

@@ -2886,6 +2900,16 @@ +

ipv4.dhcp-send-release

+ +

Whether the DHCP client will send RELEASE message when bringing the connection down. The default value is "default" (-1). When the default value is specified, then the global value from NetworkManager configuration is looked up, if not set, it is considered as FALSE.

+

+ Format: ternary

+

+ Valid values: true/yes/on, false/no/off, default/unknown

+ + +

ipv4.dhcp-timeout

A timeout for a DHCP transaction in seconds. If zero (the default), a globally configured default is used. If still unspecified, a device specific timeout is used (usually 45 seconds).

@@ -2925,7 +2949,7 @@

When using a caching DNS plugin (dnsmasq or systemd-resolved in NetworkManager.conf) then "edns0" and "trust-ad" are automatically added.

The valid "ipv4.dns-options" and "ipv6.dns-options" get merged together.

- Format: list of strings

+ Format: a comma separated list of DNS options

@@ -3150,7 +3174,7 @@ For details see also `man ip-route`.

- Format: list of ipv4.routes objects

+ Format: a comma separated list of routes

@@ -3166,7 +3190,7 @@ fixed priority. Example: priority 5 from 192.167.4.0/24 table 45

- Format: list of ipv4.routing-rules objects

+ Format: a comma separated list of routing rules

@@ -3196,7 +3220,7 @@ Example: priority 5 from 192.167.4.0/24 table 45

If not specified, when creating a new profile the default is "default".

Note that this setting is distinct from the Privacy Extensions as configured by "ip6-privacy" property and it does not affect the temporary addresses configured with this option.

- Format: choice (NMSettingIP6ConfigAddrGenMode)

+ Format: one of "eui64" (0), "stable-privacy" (1), "default" (3) or "default-or-eui64" (2)

Valid values: eui64 (0), stable-privacy (1), default-or-eui64 (2), default (3)

@@ -3208,7 +3232,7 @@ Example: priority 5 from 192.167.4.0/24 table 45 Alias: ip6

A list of IPv6 addresses and their prefix length. Multiple addresses can be separated by comma. For example "2001:db8:85a3::8a2e:370:7334/64, 2001:db8:85a3::5/64". The addresses are listed in decreasing priority, meaning the first address will be the primary address. This can make a difference with IPv6 source address selection (RFC 6724, section 5).

- Format: list of ipv6.addresses objects

+ Format: a comma separated list of addresses

@@ -3284,6 +3308,16 @@ Example: priority 5 from 192.167.4.0/24 table 45 +

ipv6.dhcp-send-release

+ +

Whether the DHCP client will send RELEASE message when bringing the connection down. The default value is "default" (-1). When the default value is specified, then the global value from NetworkManager configuration is looked up, if not set, it is considered as FALSE.

+

+ Format: ternary

+

+ Valid values: true/yes/on, false/no/off, default/unknown

+ + +

ipv6.dhcp-timeout

A timeout for a DHCP transaction in seconds. If zero (the default), a globally configured default is used. If still unspecified, a device specific timeout is used (usually 45 seconds).

@@ -3315,7 +3349,7 @@ Example: priority 5 from 192.167.4.0/24 table 45

When using a caching DNS plugin (dnsmasq or systemd-resolved in NetworkManager.conf) then "edns0" and "trust-ad" are automatically added.

The valid "ipv4.dns-options" and "ipv6.dns-options" get merged together.

- Format: list of strings

+ Format: a comma separated list of DNS options

@@ -3381,8 +3415,7 @@ Example: priority 5 from 192.167.4.0/24 table 45

ipv6.ip6-privacy

Configure IPv6 Privacy Extensions for SLAAC, described in RFC4941. If enabled, it makes the kernel generate a temporary IPv6 address in addition to the public one generated from MAC address via modified EUI-64. This enhances privacy, but could cause problems in some applications, on the other hand. The permitted values are: -1: unknown, 0: disabled, 1: enabled (prefer public address), 2: enabled (prefer temporary addresses).

-

Having a per-connection setting set to "-1" (unknown) means fallback to global configuration "ipv6.ip6-privacy".

-

If also global configuration is unspecified or set to "-1", fallback to read "/proc/sys/net/ipv6/conf/default/use_tempaddr".

+

If set to "-1" (unknown) for a connection, the value is taken from the global "ipv6.ip6-privacy" setting. If the global setting is unspecified or also set to "-1", the value is set from the original value of "/proc/sys/net/ipv6/conf/<iface>/use_tempaddr" from before NetworkManager started.

Note that this setting is distinct from the Stable Privacy addresses that can be enabled with the "addr-gen-mode" property's "stable-privacy" setting as another way of avoiding host tracking with IPv6 addresses.

Format: choice (NMSettingIP6ConfigPrivacy)

@@ -3554,7 +3587,7 @@ Example: priority 5 from 192.167.4.0/24 table 45 For details see also `man ip-route`.

- Format: list of ipv6.routes objects

+ Format: a comma separated list of routes

@@ -3570,7 +3603,29 @@ fixed priority. Example: priority 5 from 1:2:3::5/128 table 45

- Format: list of ipv6.routing-rules objects

+ Format: a comma separated list of routing rules

+ + + +

ipv6.temp-preferred-lifetime

+ +

The preferred lifetime of autogenerated temporary addresses, in seconds.

+

If set to "0" (unknown) for a connection, the value is taken from the global "ipv6.temp-preferred-lifetime" setting. If the global setting is unspecified or also set to "0", the value is set from the original value of "/proc/sys/net/ipv6/conf/<iface>/temp_prefered_lft" from before NetworkManager started.

+

+ Format: integer

+

+ Valid values: 0 - 2147483647

+ + + +

ipv6.temp-valid-lifetime

+ +

The valid lifetime of autogenerated temporary addresses, in seconds.

+

If set to "0" (unknown) for a connection, the value is taken from the global "ipv6.temp-valid-lifetime" setting. If the global setting is unspecified or also set to "0", the value is set from the original value of "/proc/sys/net/ipv6/conf/<iface>/temp_valid_lft" from before NetworkManager started.

+

+ Format: integer

+

+ Valid values: 0 - 2147483647

@@ -5042,7 +5097,7 @@ Linux traffic control subsystem

- Format: list of tc.qdiscs objects

+ Format: GPtrArray(NMTCQdisc)

@@ -5144,7 +5199,7 @@ Linux traffic control subsystem

- Format: list of tc.tfilters objects

+ Format: GPtrArray(NMTCTfilter)

@@ -6057,6 +6112,14 @@ Linux traffic control subsystem +

802-3-ethernet.mac-address-denylist

+ +

If specified, this connection will never apply to the Ethernet device whose permanent MAC address matches an address in the list. Each MAC address is in the standard hex-digits-and-colons notation (00:11:22:33:44:55).

+

+ Format: list of MAC addresses

+ + +

802-3-ethernet.mtu

@@ -6349,6 +6412,14 @@ Linux traffic control subsystem +

802-11-wireless.mac-address-denylist

+ +

A list of permanent MAC addresses of Wi-Fi devices to which this connection should never apply. Each MAC address should be given in the standard hex-digits-and-colons notation (eg "00:11:22:33:44:55").

+

+ Format: list of MAC addresses

+ + +

802-11-wireless.mac-address-randomization

One of "default" (0) (never randomize unless the user has set a global default to randomize and the supplicant supports randomization), "never" (1) (never randomize the MAC address), or "always" (2) (always randomize the MAC address).

-- cgit 1.3.0-6-gf8a5