From 45e8e1149027529194982212c804c0468aa01d98 Mon Sep 17 00:00:00 2001 From: Michael Biebl Date: Sat, 30 May 2020 00:23:54 +0200 Subject: New upstream version 1.24.2 --- docs/api/settings-spec.xml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'docs/api/settings-spec.xml') diff --git a/docs/api/settings-spec.xml b/docs/api/settings-spec.xml index 9564e7ae..20dd0a26 100644 --- a/docs/api/settings-spec.xml +++ b/docs/api/settings-spec.xml @@ -40,10 +40,10 @@ altsubject-matchesaltsubject-matchesarray of stringList of strings to be matched against the altSubjectName of the certificate presented by the authentication server. If the list is empty, no verification of the server certificate's altSubjectName is performed. anonymous-identityanonymous-identitystringAnonymous identity string for EAP authentication methods. Used as the unencrypted identity with EAP types that support different tunneled identity like EAP-TTLS. auth-timeoutauth-timeoutint320A timeout for the authentication. Zero means the global default; if the global default is not set, the authentication timeout is 25 seconds. - ca-certca-certbyte arrayContains the CA certificate if used by the EAP method specified in the "eap" property. Certificate data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended. + ca-certca-certbyte arrayContains the CA certificate if used by the EAP method specified in the "eap" property. Certificate data is specified using a "scheme"; three are currently supported: blob, path and pkcs#11 URL. When using the blob scheme this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended. Note that enabling NMSetting8021x:system-ca-certs will override this setting to use the built-in path, if the built-in path is not a directory. ca-cert-passwordca-cert-passwordstringThe password used to access the CA certificate stored in "ca-cert" property. Only makes sense if the certificate is stored on a PKCS#11 token that requires a login. ca-cert-password-flagsca-cert-password-flagsNMSettingSecretFlags (uint32)Flags indicating how to handle the "ca-cert-password" property. - ca-pathca-pathstringUTF-8 encoded path to a directory containing PEM or DER formatted certificates to be added to the verification chain in addition to the certificate specified in the "ca-cert" property. + ca-pathca-pathstringUTF-8 encoded path to a directory containing PEM or DER formatted certificates to be added to the verification chain in addition to the certificate specified in the "ca-cert" property. If NMSetting8021x:system-ca-certs is enabled and the built-in CA path is an existing directory, then this setting is ignored. client-certclient-certbyte arrayContains the client certificate if used by the EAP method specified in the "eap" property. Certificate data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte. client-cert-passwordclient-cert-passwordstringThe password used to access the client certificate stored in "client-cert" property. Only makes sense if the certificate is stored on a PKCS#11 token that requires a login. client-cert-password-flagsclient-cert-password-flagsNMSettingSecretFlags (uint32)Flags indicating how to handle the "client-cert-password" property. @@ -64,10 +64,10 @@ phase2-altsubject-matchesphase2-altsubject-matchesarray of stringList of strings to be matched against the altSubjectName of the certificate presented by the authentication server during the inner "phase 2" authentication. If the list is empty, no verification of the server certificate's altSubjectName is performed. phase2-authphase2-authstringSpecifies the allowed "phase 2" inner non-EAP authentication method when an EAP method that uses an inner TLS tunnel is specified in the "eap" property. Recognized non-EAP "phase 2" methods are "pap", "chap", "mschap", "mschapv2", "gtc", "otp", "md5", and "tls". Each "phase 2" inner method requires specific parameters for successful authentication; see the wpa_supplicant documentation for more details. phase2-autheapphase2-autheapstringSpecifies the allowed "phase 2" inner EAP-based authentication method when an EAP method that uses an inner TLS tunnel is specified in the "eap" property. Recognized EAP-based "phase 2" methods are "md5", "mschapv2", "otp", "gtc", and "tls". Each "phase 2" inner method requires specific parameters for successful authentication; see the wpa_supplicant documentation for more details. - phase2-ca-certphase2-ca-certbyte arrayContains the "phase 2" CA certificate if used by the EAP method specified in the "phase2-auth" or "phase2-autheap" properties. Certificate data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended. + phase2-ca-certphase2-ca-certbyte arrayContains the "phase 2" CA certificate if used by the EAP method specified in the "phase2-auth" or "phase2-autheap" properties. Certificate data is specified using a "scheme"; three are currently supported: blob, path and pkcs#11 URL. When using the blob scheme this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended. Note that enabling NMSetting8021x:system-ca-certs will override this setting to use the built-in path, if the built-in path is not a directory. phase2-ca-cert-passwordphase2-ca-cert-passwordstringThe password used to access the "phase2" CA certificate stored in "phase2-ca-cert" property. Only makes sense if the certificate is stored on a PKCS#11 token that requires a login. phase2-ca-cert-password-flagsphase2-ca-cert-password-flagsNMSettingSecretFlags (uint32)Flags indicating how to handle the "phase2-ca-cert-password" property. - phase2-ca-pathphase2-ca-pathstringUTF-8 encoded path to a directory containing PEM or DER formatted certificates to be added to the verification chain in addition to the certificate specified in the "phase2-ca-cert" property. + phase2-ca-pathphase2-ca-pathstringUTF-8 encoded path to a directory containing PEM or DER formatted certificates to be added to the verification chain in addition to the certificate specified in the "phase2-ca-cert" property. If NMSetting8021x:system-ca-certs is enabled and the built-in CA path is an existing directory, then this setting is ignored. phase2-client-certphase2-client-certbyte arrayContains the "phase 2" client certificate if used by the EAP method specified in the "phase2-auth" or "phase2-autheap" properties. Certificate data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended. phase2-client-cert-passwordphase2-client-cert-passwordstringThe password used to access the "phase2" client certificate stored in "phase2-client-cert" property. Only makes sense if the certificate is stored on a PKCS#11 token that requires a login. phase2-client-cert-password-flagsphase2-client-cert-password-flagsNMSettingSecretFlags (uint32)Flags indicating how to handle the "phase2-client-cert-password" property. -- cgit 1.3.0-6-gf8a5