libnm Reference Manual: NMSetting8021x

the data format of the private key data stored in the “private-key” property

Returns

the data format of the "phase 2" private key data stored in the “phase2-private-key” property

Types and Values

NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PATH

#define NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PATH "file://"
+

enum NMSetting8021xCKFormat

NMSetting8021xCKFormat values indicate the general type of a certificate or private key

Members

@@ -3309,7 +3264,7 @@ and private key

stored in the setting properties, either as a blob of the item's data, or as a path to a certificate or private key file on the filesystem

Members

@@ -3350,264 +3305,198 @@ to a file containing the certificate or key data

NM_SETTING_802_1X_SETTING_NAME

#define NM_SETTING_802_1X_SETTING_NAME "802-1x"

NM_SETTING_802_1X_EAP

#define NM_SETTING_802_1X_EAP "eap"

NM_SETTING_802_1X_IDENTITY

#define NM_SETTING_802_1X_IDENTITY "identity"

NM_SETTING_802_1X_ANONYMOUS_IDENTITY

#define NM_SETTING_802_1X_ANONYMOUS_IDENTITY "anonymous-identity"

NM_SETTING_802_1X_PAC_FILE

#define NM_SETTING_802_1X_PAC_FILE "pac-file"

NM_SETTING_802_1X_CA_CERT

#define NM_SETTING_802_1X_CA_CERT "ca-cert"

NM_SETTING_802_1X_CA_PATH

#define NM_SETTING_802_1X_CA_PATH "ca-path"

NM_SETTING_802_1X_SUBJECT_MATCH

#define NM_SETTING_802_1X_SUBJECT_MATCH "subject-match"

NM_SETTING_802_1X_ALTSUBJECT_MATCHES

#define NM_SETTING_802_1X_ALTSUBJECT_MATCHES "altsubject-matches"

NM_SETTING_802_1X_CLIENT_CERT

#define NM_SETTING_802_1X_CLIENT_CERT "client-cert"

NM_SETTING_802_1X_PHASE1_PEAPVER

#define NM_SETTING_802_1X_PHASE1_PEAPVER "phase1-peapver"

NM_SETTING_802_1X_PHASE1_PEAPLABEL

#define NM_SETTING_802_1X_PHASE1_PEAPLABEL "phase1-peaplabel"

NM_SETTING_802_1X_PHASE1_FAST_PROVISIONING

#define NM_SETTING_802_1X_PHASE1_FAST_PROVISIONING "phase1-fast-provisioning"

NM_SETTING_802_1X_PHASE2_AUTH

#define NM_SETTING_802_1X_PHASE2_AUTH "phase2-auth"

NM_SETTING_802_1X_PHASE2_AUTHEAP

#define NM_SETTING_802_1X_PHASE2_AUTHEAP "phase2-autheap"

NM_SETTING_802_1X_PHASE2_CA_CERT

#define NM_SETTING_802_1X_PHASE2_CA_CERT "phase2-ca-cert"

NM_SETTING_802_1X_PHASE2_CA_PATH

#define NM_SETTING_802_1X_PHASE2_CA_PATH "phase2-ca-path"

NM_SETTING_802_1X_PHASE2_SUBJECT_MATCH

#define NM_SETTING_802_1X_PHASE2_SUBJECT_MATCH "phase2-subject-match"

NM_SETTING_802_1X_PHASE2_ALTSUBJECT_MATCHES

#define NM_SETTING_802_1X_PHASE2_ALTSUBJECT_MATCHES "phase2-altsubject-matches"

NM_SETTING_802_1X_PHASE2_CLIENT_CERT

#define NM_SETTING_802_1X_PHASE2_CLIENT_CERT "phase2-client-cert"

NM_SETTING_802_1X_PASSWORD

#define NM_SETTING_802_1X_PASSWORD "password"

NM_SETTING_802_1X_PASSWORD_FLAGS

#define NM_SETTING_802_1X_PASSWORD_FLAGS "password-flags"

NM_SETTING_802_1X_PASSWORD_RAW

#define NM_SETTING_802_1X_PASSWORD_RAW "password-raw"

NM_SETTING_802_1X_PASSWORD_RAW_FLAGS

#define NM_SETTING_802_1X_PASSWORD_RAW_FLAGS "password-raw-flags"

NM_SETTING_802_1X_PRIVATE_KEY

#define NM_SETTING_802_1X_PRIVATE_KEY "private-key"

NM_SETTING_802_1X_PRIVATE_KEY_PASSWORD

#define NM_SETTING_802_1X_PRIVATE_KEY_PASSWORD "private-key-password"

NM_SETTING_802_1X_PRIVATE_KEY_PASSWORD_FLAGS

#define NM_SETTING_802_1X_PRIVATE_KEY_PASSWORD_FLAGS "private-key-password-flags"

NM_SETTING_802_1X_PHASE2_PRIVATE_KEY

#define NM_SETTING_802_1X_PHASE2_PRIVATE_KEY "phase2-private-key"

NM_SETTING_802_1X_PHASE2_PRIVATE_KEY_PASSWORD

#define NM_SETTING_802_1X_PHASE2_PRIVATE_KEY_PASSWORD "phase2-private-key-password"

NM_SETTING_802_1X_PHASE2_PRIVATE_KEY_PASSWORD_FLAGS

#define NM_SETTING_802_1X_PHASE2_PRIVATE_KEY_PASSWORD_FLAGS "phase2-private-key-password-flags"

NM_SETTING_802_1X_PIN

#define NM_SETTING_802_1X_PIN "pin"

NM_SETTING_802_1X_PIN_FLAGS

#define NM_SETTING_802_1X_PIN_FLAGS "pin-flags"

NM_SETTING_802_1X_SYSTEM_CA_CERTS

#define NM_SETTING_802_1X_SYSTEM_CA_CERTS "system-ca-certs"

@@ -3615,14 +3504,18 @@ to a file containing the certificate or key data

The `“altsubject-matches”` property

  “altsubject-matches”       GStrv

List of strings to be matched against the altSubjectName of the +certificate presented by the authentication server. If the list is empty, +no verification of the server certificate's altSubjectName is performed.

Flags: Read / Write

The `“anonymous-identity”` property

  “anonymous-identity”       gchar *

Anonymous identity string for EAP authentication methods. Used as the +unencrypted identity with EAP types that support different tunneled +identity like EAP-TTLS.

Flags: Read / Write

Default value: NULL

@@ -3630,14 +3523,27 @@ to a file containing the certificate or key data

The `“ca-cert”` property

  “ca-cert”                  GBytes *

Contains the CA certificate if used by the EAP method specified in the +“eap” property.

Certificate data is specified using a "scheme"; two are currently +supported: blob and path. When using the blob scheme (which is backwards +compatible with NM 0.7.x) this property should be set to the +certificate's DER encoded data. When using the path scheme, this property +should be set to the full UTF-8 encoded path of the certificate, prefixed +with the string "file://" and ending with a terminating NUL byte. This +property can be unset even if the EAP method supports CA certificates, +but this allows man-in-the-middle attacks and is NOT recommended.

Setting this property directly is discouraged; use the +nm_setting_802_1x_set_ca_cert() function instead.

Flags: Read / Write

The `“ca-path”` property

  “ca-path”                  gchar *

UTF-8 encoded path to a directory containing PEM or DER formatted +certificates to be added to the verification chain in addition to the +certificate specified in the “ca-cert” property.

Flags: Read / Write

Default value: NULL

@@ -3645,21 +3551,35 @@ to a file containing the certificate or key data

The `“client-cert”` property

  “client-cert”              GBytes *

Contains the client certificate if used by the EAP method specified in +the “eap” property.

Setting this property directly is discouraged; use the +nm_setting_802_1x_set_client_cert() function instead.

Flags: Read / Write

The `“eap”` property

  “eap”                      GStrv

The allowed EAP method to be used when authenticating to the network with +802.1x. Valid methods are: "leap", "md5", "tls", "peap", "ttls", "pwd", +and "fast". Each method requires different configuration using the +properties of this setting; refer to wpa_supplicant documentation for the +allowed combinations.

Flags: Read / Write

The `“identity”` property

  “identity”                 gchar *

Identity string for EAP authentication methods. Often the user's user or +login name.

Flags: Read / Write

Default value: NULL

@@ -3667,7 +3587,7 @@ to a file containing the certificate or key data

The `“pac-file”` property

  “pac-file”                 gchar *

UTF-8 encoded file path containing PAC for EAP-FAST.

Flags: Read / Write

Default value: NULL

@@ -3675,7 +3595,9 @@ to a file containing the certificate or key data

The `“password”` property

  “password”                 gchar *

UTF-8 encoded password used for EAP authentication methods. If both the +“password” property and the “password-raw” +property are specified, “password” is preferred.

Flags: Read / Write

Default value: NULL

@@ -3683,28 +3605,36 @@ to a file containing the certificate or key data

The `“password-flags”` property

  “password-flags”           NMSettingSecretFlags

Flags indicating how to handle the “password” property.

Flags: Read / Write

The `“password-raw”` property

  “password-raw”             GBytes *

Password used for EAP authentication methods, given as a byte array to +allow passwords in other encodings than UTF-8 to be used. If both the +“password” property and the “password-raw” +property are specified, “password” is preferred.

Flags: Read / Write

The `“password-raw-flags”` property

  “password-raw-flags”       NMSettingSecretFlags

Flags indicating how to handle the “password-raw” property.

Flags: Read / Write

The `“phase1-fast-provisioning”` property

  “phase1-fast-provisioning” gchar *

Enables or disables in-line provisioning of EAP-FAST credentials when +FAST is specified as the EAP method in the “eap” property. +Recognized values are "0" (disabled), "1" (allow unauthenticated +provisioning), "2" (allow authenticated provisioning), and "3" (allow +both authenticated and unauthenticated provisioning). See the +wpa_supplicant documentation for more details.

Flags: Read / Write

Default value: NULL

@@ -3712,7 +3642,10 @@ to a file containing the certificate or key data

The `“phase1-peaplabel”` property

  “phase1-peaplabel”         gchar *

Forces use of the new PEAP label during key derivation. Some RADIUS +servers may require forcing the new PEAP label to interoperate with +PEAPv1. Set to "1" to force use of the new PEAP label. See the +wpa_supplicant documentation for more details.

Flags: Read / Write

Default value: NULL

@@ -3720,7 +3653,12 @@ to a file containing the certificate or key data

The `“phase1-peapver”` property

  “phase1-peapver”           gchar *

Forces which PEAP version is used when PEAP is set as the EAP method in +the “eap” property. When unset, the version reported by +the server will be used. Sometimes when using older RADIUS servers, it +is necessary to force the client to use a particular PEAP version. To do +so, this property may be set to "0" or "1" to force that specific PEAP +version.

Flags: Read / Write

Default value: NULL

@@ -3728,14 +3666,22 @@ to a file containing the certificate or key data

The `“phase2-altsubject-matches”` property

  “phase2-altsubject-matches” GStrv

List of strings to be matched against the altSubjectName of the +certificate presented by the authentication server during the inner +"phase 2" authentication. If the list is empty, no verification of the +server certificate's altSubjectName is performed.

Flags: Read / Write

The `“phase2-auth”` property

  “phase2-auth”              gchar *

Specifies the allowed "phase 2" inner non-EAP authentication methods when +an EAP method that uses an inner TLS tunnel is specified in the +“eap” property. Recognized non-EAP "phase 2" methods are +"pap", "chap", "mschap", "mschapv2", "gtc", "otp", "md5", and "tls". +Each "phase 2" inner method requires specific parameters for successful +authentication; see the wpa_supplicant documentation for more details.

Flags: Read / Write

Default value: NULL

@@ -3743,7 +3689,12 @@ to a file containing the certificate or key data

The `“phase2-autheap”` property

  “phase2-autheap”           gchar *

Specifies the allowed "phase 2" inner EAP-based authentication methods +when an EAP method that uses an inner TLS tunnel is specified in the +“eap” property. Recognized EAP-based "phase 2" methods are +"md5", "mschapv2", "otp", "gtc", and "tls". Each "phase 2" inner method +requires specific parameters for successful authentication; see the +wpa_supplicant documentation for more details.

Flags: Read / Write

Default value: NULL

@@ -3751,14 +3702,28 @@ to a file containing the certificate or key data

The `“phase2-ca-cert”` property

  “phase2-ca-cert”           GBytes *

Contains the "phase 2" CA certificate if used by the EAP method specified +in the “phase2-auth” or “phase2-autheap” +properties.

Setting this property directly is discouraged; use the +nm_setting_802_1x_set_phase2_ca_cert() function instead.

Flags: Read / Write

The `“phase2-ca-path”` property

  “phase2-ca-path”           gchar *

UTF-8 encoded path to a directory containing PEM or DER formatted +certificates to be added to the verification chain in addition to the +certificate specified in the “phase2-ca-cert” property.

Flags: Read / Write

Default value: NULL

@@ -3766,21 +3731,58 @@ to a file containing the certificate or key data

The `“phase2-client-cert”` property

  “phase2-client-cert”       GBytes *

Contains the "phase 2" client certificate if used by the EAP method +specified in the “phase2-auth” or +“phase2-autheap” properties.

Setting this property directly is discouraged; use the +nm_setting_802_1x_set_phase2_client_cert() function instead.

Flags: Read / Write

The `“phase2-private-key”` property

  “phase2-private-key”       GBytes *

Contains the "phase 2" inner private key when the +“phase2-auth” or “phase2-autheap” property is +set to "tls".

Key data is specified using a "scheme"; two are currently supported: blob +and path. When using the blob scheme and private keys, this property +should be set to the key's encrypted PEM encoded data. When using private +keys with the path scheme, this property should be set to the full UTF-8 +encoded path of the key, prefixed with the string "file://" and ending +with a terminating NUL byte. When using PKCS#12 format private +keys and the blob scheme, this property should be set to the +PKCS#12 data and the “phase2-private-key-password” +property must be set to password used to decrypt the PKCS#12 +certificate and key. When using PKCS#12 files and the path +scheme, this property should be set to the full UTF-8 encoded path of the +key, prefixed with the string "file://" and and ending with a terminating +NUL byte, and as with the blob scheme the +“phase2-private-key-password” property must be set to the +password used to decode the PKCS#12 private key and certificate.

Setting this property directly is discouraged; use the +nm_setting_802_1x_set_phase2_private_key() function instead.

Flags: Read / Write

The `“phase2-private-key-password”` property

  “phase2-private-key-password” gchar *

The password used to decrypt the "phase 2" private key specified in the +“phase2-private-key” property when the private key either +uses the path scheme, or is a PKCS#12 format key. Setting this +property directly is not generally necessary except when returning +secrets to NetworkManager; it is generally set automatically when setting +the private key by the nm_setting_802_1x_set_phase2_private_key() +function.

Flags: Read / Write

Default value: NULL

@@ -3788,14 +3790,18 @@ to a file containing the certificate or key data

The `“phase2-private-key-password-flags”` property

  “phase2-private-key-password-flags” NMSettingSecretFlags

Flags indicating how to handle the +“phase2-private-key-password” property.

Flags: Read / Write

The `“phase2-subject-match”` property

  “phase2-subject-match”     gchar *

Substring to be matched against the subject of the certificate presented +by the authentication server during the inner "phase 2" +authentication. When unset, no verification of the authentication server +certificate's subject is performed.

Flags: Read / Write

Default value: NULL

@@ -3803,7 +3809,7 @@ to a file containing the certificate or key data

The `“pin”` property

  “pin”                      gchar *

PIN used for EAP authentication methods.

Flags: Read / Write

Default value: NULL

@@ -3811,21 +3817,49 @@ to a file containing the certificate or key data

The `“pin-flags”` property

  “pin-flags”                NMSettingSecretFlags

Flags indicating how to handle the “pin” property.

Flags: Read / Write

The `“private-key”` property

  “private-key”              GBytes *

Contains the private key when the “eap” property is set to +"tls".

Key data is specified using a "scheme"; two are currently supported: blob +and path. When using the blob scheme and private keys, this property +should be set to the key's encrypted PEM encoded data. When using private +keys with the path scheme, this property should be set to the full UTF-8 +encoded path of the key, prefixed with the string "file://" and ending +with a terminating NUL byte. When using PKCS#12 format private +keys and the blob scheme, this property should be set to the +PKCS#12 data and the “private-key-password” +property must be set to password used to decrypt the PKCS#12 +certificate and key. When using PKCS#12 files and the path +scheme, this property should be set to the full UTF-8 encoded path of the +key, prefixed with the string "file://" and and ending with a terminating +NUL byte, and as with the blob scheme the "private-key-password" property +must be set to the password used to decode the PKCS#12 private +key and certificate.

Setting this property directly is discouraged; use the +nm_setting_802_1x_set_private_key() function instead.

WARNING: “private-key” is not a "secret" property, and thus +unencrypted private key data using the BLOB scheme may be readable by +unprivileged users. Private keys should always be encrypted with a +private key password to prevent unauthorized access to unencrypted +private key data.

Flags: Read / Write

The `“private-key-password”` property

  “private-key-password”     gchar *

The password used to decrypt the private key specified in the +“private-key” property when the private key either uses the +path scheme, or if the private key is a PKCS#12 format key. Setting this +property directly is not generally necessary except when returning +secrets to NetworkManager; it is generally set automatically when setting +the private key by the nm_setting_802_1x_set_private_key() function.

Flags: Read / Write

Default value: NULL

@@ -3833,14 +3867,17 @@ to a file containing the certificate or key data

The `“private-key-password-flags”` property

  “private-key-password-flags” NMSettingSecretFlags

Flags indicating how to handle the “private-key-password” +property.

Flags: Read / Write

The `“subject-match”` property

  “subject-match”            gchar *

Substring to be matched against the subject of the certificate presented +by the authentication server. When unset, no verification of the +authentication server certificate's subject is performed.

Flags: Read / Write

Default value: NULL

@@ -3848,14 +3885,21 @@ to a file containing the certificate or key data

The `“system-ca-certs”` property

  “system-ca-certs”          gboolean

When TRUE, overrides the “ca-path” and +“phase2-ca-path” properties using the system CA directory +specified at configure time with the --system-ca-path switch. The +certificates in this directory are added to the verification chain in +addition to any certificates specified by the “ca-cert” and +“phase2-ca-cert” properties. If the path provided with +--system-ca-path is rather a file name (bundle of trusted CA certificates), +it overrides “ca-cert” and “phase2-ca-cert” +properties instead (sets ca_cert/ca_cert2 options for wpa_supplicant).

Flags: Read / Write / Construct

Default value: FALSE

Generated by GTK-Doc V1.24 \ No newline at end of file -- cgit 1.3.0-6-gf8a5