From d9c99a29a0d3384c9c3d2adce430f5cb1134ab6a Mon Sep 17 00:00:00 2001
From: Michael Biebl <biebl@debian.org>
Date: Wed, 30 Mar 2016 00:56:30 +0200
Subject: Imported Upstream version 1.1.92

---
 libnm/nm-setting-docs.xml | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

(limited to 'libnm/nm-setting-docs.xml')

diff --git a/libnm/nm-setting-docs.xml b/libnm/nm-setting-docs.xml
index 7e08b114..323709b0 100644
--- a/libnm/nm-setting-docs.xml
+++ b/libnm/nm-setting-docs.xml
@@ -9,6 +9,7 @@
     <property name="ca-cert" type="byte array" description="Contains the CA certificate if used by the EAP method specified in the &quot;eap&quot; property. Certificate data is specified using a &quot;scheme&quot;; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string &quot;file://&quot; and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended." />
     <property name="ca-path" type="string" description="UTF-8 encoded path to a directory containing PEM or DER formatted certificates to be added to the verification chain in addition to the certificate specified in the &quot;ca-cert&quot; property." />
     <property name="client-cert" type="byte array" description="Contains the client certificate if used by the EAP method specified in the &quot;eap&quot; property. Certificate data is specified using a &quot;scheme&quot;; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string &quot;file://&quot; and ending with a terminating NUL byte." />
+    <property name="domain-suffix-match" type="string" description="Constraint for server domain name. If set, this FQDN is used as a suffix match requirement for dNSName element(s) of the certificate presented by the authentication server.  If a matching dNSName is found, this constraint is met.  If no dNSName values are present, this constraint is matched against SubjectName CN using same suffix match comparison." />
     <property name="eap" type="array of string" default="[]" description="The allowed EAP method to be used when authenticating to the network with 802.1x.  Valid methods are: &quot;leap&quot;, &quot;md5&quot;, &quot;tls&quot;, &quot;peap&quot;, &quot;ttls&quot;, &quot;pwd&quot;, and &quot;fast&quot;.  Each method requires different configuration using the properties of this setting; refer to wpa_supplicant documentation for the allowed combinations." />
     <property name="identity" type="string" description="Identity string for EAP authentication methods.  Often the user's user or login name." />
     <property name="name" type="string" default="802-1x" description="The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example &quot;ppp&quot; or &quot;wireless&quot; or &quot;wired&quot;." />
@@ -26,16 +27,17 @@
     <property name="phase2-ca-cert" type="byte array" description="Contains the &quot;phase 2&quot; CA certificate if used by the EAP method specified in the &quot;phase2-auth&quot; or &quot;phase2-autheap&quot; properties. Certificate data is specified using a &quot;scheme&quot;; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string &quot;file://&quot; and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended." />
     <property name="phase2-ca-path" type="string" description="UTF-8 encoded path to a directory containing PEM or DER formatted certificates to be added to the verification chain in addition to the certificate specified in the &quot;phase2-ca-cert&quot; property." />
     <property name="phase2-client-cert" type="byte array" description="Contains the &quot;phase 2&quot; client certificate if used by the EAP method specified in the &quot;phase2-auth&quot; or &quot;phase2-autheap&quot; properties. Certificate data is specified using a &quot;scheme&quot;; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string &quot;file://&quot; and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended." />
+    <property name="phase2-domain-suffix-match" type="string" description="Constraint for server domain name. If set, this FQDN is used as a suffix match requirement for dNSName element(s) of the certificate presented by the authentication server during the inner &quot;phase 2&quot; authentication.  If a matching dNSName is found, this constraint is met.  If no dNSName values are present, this constraint is matched against SubjectName CN using same suffix match comparison." />
     <property name="phase2-private-key" type="byte array" description="Contains the &quot;phase 2&quot; inner private key when the &quot;phase2-auth&quot; or &quot;phase2-autheap&quot; property is set to &quot;tls&quot;. Key data is specified using a &quot;scheme&quot;; two are currently supported: blob and path. When using the blob scheme and private keys, this property should be set to the key's encrypted PEM encoded data. When using private keys with the path scheme, this property should be set to the full UTF-8 encoded path of the key, prefixed with the string &quot;file://&quot; and ending with a terminating NUL byte. When using PKCS#12 format private keys and the blob scheme, this property should be set to the PKCS#12 data and the &quot;phase2-private-key-password&quot; property must be set to password used to decrypt the PKCS#12 certificate and key. When using PKCS#12 files and the path scheme, this property should be set to the full UTF-8 encoded path of the key, prefixed with the string &quot;file://&quot; and and ending with a terminating NUL byte, and as with the blob scheme the &quot;phase2-private-key-password&quot; property must be set to the password used to decode the PKCS#12 private key and certificate." />
     <property name="phase2-private-key-password" type="string" description="The password used to decrypt the &quot;phase 2&quot; private key specified in the &quot;phase2-private-key&quot; property when the private key either uses the path scheme, or is a PKCS#12 format key." />
     <property name="phase2-private-key-password-flags" type="NMSettingSecretFlags (uint32)" description="Flags indicating how to handle the &quot;phase2-private-key-password&quot; property." />
-    <property name="phase2-subject-match" type="string" description="Substring to be matched against the subject of the certificate presented by the authentication server during the inner &quot;phase 2&quot; authentication. When unset, no verification of the authentication server certificate's subject is performed." />
+    <property name="phase2-subject-match" type="string" description="Substring to be matched against the subject of the certificate presented by the authentication server during the inner &quot;phase 2&quot; authentication. When unset, no verification of the authentication server certificate's subject is performed.  This property provides little security, if any, and its use is deprecated in favor of NMSetting8021x:phase2-domain-suffix-match." />
     <property name="pin" type="string" description="PIN used for EAP authentication methods." />
     <property name="pin-flags" type="NMSettingSecretFlags (uint32)" description="Flags indicating how to handle the &quot;pin&quot; property." />
     <property name="private-key" type="byte array" description="Contains the private key when the &quot;eap&quot; property is set to &quot;tls&quot;. Key data is specified using a &quot;scheme&quot;; two are currently supported: blob and path. When using the blob scheme and private keys, this property should be set to the key's encrypted PEM encoded data. When using private keys with the path scheme, this property should be set to the full UTF-8 encoded path of the key, prefixed with the string &quot;file://&quot; and ending with a terminating NUL byte. When using PKCS#12 format private keys and the blob scheme, this property should be set to the PKCS#12 data and the &quot;private-key-password&quot; property must be set to password used to decrypt the PKCS#12 certificate and key. When using PKCS#12 files and the path scheme, this property should be set to the full UTF-8 encoded path of the key, prefixed with the string &quot;file://&quot; and and ending with a terminating NUL byte, and as with the blob scheme the &quot;private-key-password&quot; property must be set to the password used to decode the PKCS#12 private key and certificate. WARNING: &quot;private-key&quot; is not a &quot;secret&quot; property, and thus unencrypted private key data using the BLOB scheme may be readable by unprivileged users.  Private keys should always be encrypted with a private key password to prevent unauthorized access to unencrypted private key data." />
     <property name="private-key-password" type="string" description="The password used to decrypt the private key specified in the &quot;private-key&quot; property when the private key either uses the path scheme, or if the private key is a PKCS#12 format key." />
     <property name="private-key-password-flags" type="NMSettingSecretFlags (uint32)" description="Flags indicating how to handle the &quot;private-key-password&quot; property." />
-    <property name="subject-match" type="string" description="Substring to be matched against the subject of the certificate presented by the authentication server. When unset, no verification of the authentication server certificate's subject is performed." />
+    <property name="subject-match" type="string" description="Substring to be matched against the subject of the certificate presented by the authentication server. When unset, no verification of the authentication server certificate's subject is performed.  This property provides little security, if any, and its use is deprecated in favor of NMSetting8021x:domain-suffix-match." />
     <property name="system-ca-certs" type="boolean" default="FALSE" description="When TRUE, overrides the &quot;ca-path&quot; and &quot;phase2-ca-path&quot; properties using the system CA directory specified at configure time with the --system-ca-path switch.  The certificates in this directory are added to the verification chain in addition to any certificates specified by the &quot;ca-cert&quot; and &quot;phase2-ca-cert&quot; properties. If the path provided with --system-ca-path is rather a file name (bundle of trusted CA certificates), it overrides &quot;ca-cert&quot; and &quot;phase2-ca-cert&quot; properties instead (sets ca_cert/ca_cert2 options for wpa_supplicant)." />
   </setting>
   <setting name="adsl">
@@ -163,7 +165,7 @@
     <property name="ignore-auto-dns" type="boolean" default="FALSE" description="When &quot;method&quot; is set to &quot;auto&quot; and this property to TRUE, automatically configured nameservers and search domains are ignored and only nameservers and search domains specified in the &quot;dns&quot; and &quot;dns-search&quot; properties, if any, are used." />
     <property name="ignore-auto-routes" type="boolean" default="FALSE" description="When &quot;method&quot; is set to &quot;auto&quot; and this property to TRUE, automatically configured routes are ignored and only routes specified in the &quot;routes&quot; property, if any, are used." />
     <property name="may-fail" type="boolean" default="TRUE" description="If TRUE, allow overall network configuration to proceed even if the configuration specified by this property times out.  Note that at least one IP configuration must succeed or overall network configuration will still fail.  For example, in IPv6-only networks, setting this property to TRUE on the NMSettingIP4Config allows the overall network configuration to succeed if IPv4 configuration fails but IPv6 configuration completes successfully." />
-    <property name="method" type="string" description="IP configuration method. NMSettingIP4Config and NMSettingIP6Config both support &quot;auto&quot;, &quot;manual&quot;, and &quot;link-local&quot;. See the subclass-specific documentation for other values. In general, for the &quot;auto&quot; method, properties such as &quot;dns&quot; and &quot;routes&quot; specify information that is added on to the information returned from automatic configuration.  The &quot;ignore-auto-routes&quot; and &quot;ignore-auto-dns&quot; properties modify this behavior. For methods that imply no upstream network, such as &quot;shared&quot; or &quot;link-local&quot;, these properties must be empty." />
+    <property name="method" type="string" description="IP configuration method. NMSettingIP4Config and NMSettingIP6Config both support &quot;auto&quot;, &quot;manual&quot;, and &quot;link-local&quot;. See the subclass-specific documentation for other values. In general, for the &quot;auto&quot; method, properties such as &quot;dns&quot; and &quot;routes&quot; specify information that is added on to the information returned from automatic configuration.  The &quot;ignore-auto-routes&quot; and &quot;ignore-auto-dns&quot; properties modify this behavior. For methods that imply no upstream network, such as &quot;shared&quot; or &quot;link-local&quot;, these properties must be empty. For IPv4 method &quot;shared&quot;, the IP subnet can be configured by adding one manual IPv4 address or otherwise 10.42.x.0/24 is chosen." />
     <property name="name" type="string" default="ipv4" description="The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example &quot;ppp&quot; or &quot;wireless&quot; or &quot;wired&quot;." />
     <property name="never-default" type="boolean" default="FALSE" description="If TRUE, this connection will never be the default connection for this IP type, meaning it will never be assigned the default route by NetworkManager." />
     <property name="route-data" type="array of vardict" description="Array of IPv4 routes. Each route dictionary contains at least 'dest' and 'prefix' entries, containing the destination IP address as a string, and the prefix length as a uint32. Most routes will also have a 'gateway' entry, containing the gateway IP address as a string. If the route has a 'metric' entry (containing a uint32), that will be used as the metric for the route (otherwise NM will pick a default value appropriate to the device). Additional attributes may also exist on some routes." />
@@ -186,7 +188,7 @@
     <property name="ignore-auto-routes" type="boolean" default="FALSE" description="When &quot;method&quot; is set to &quot;auto&quot; and this property to TRUE, automatically configured routes are ignored and only routes specified in the &quot;routes&quot; property, if any, are used." />
     <property name="ip6-privacy" type="NMSettingIP6ConfigPrivacy (int32)" description="Configure IPv6 Privacy Extensions for SLAAC, described in RFC4941.  If enabled, it makes the kernel generate a temporary IPv6 address in addition to the public one generated from MAC address via modified EUI-64.  This enhances privacy, but could cause problems in some applications, on the other hand.  The permitted values are: -1: unknown, 0: disabled, 1: enabled (prefer public address), 2: enabled (prefer temporary addresses). Having a per-connection setting set to &quot;-1&quot; (unknown) means fallback to global configuration &quot;ipv6.ip6-privacy&quot;. If also global configuration is unspecified or set to &quot;-1&quot;, fallback to read &quot;/proc/sys/net/ipv6/conf/default/use_tempaddr&quot;. Note that this setting is distinct from the Stable Privacy addresses that can be enabled with the &quot;addr-gen-mode&quot; property's &quot;stable-privacy&quot; setting as another way of avoiding host tracking with IPv6 addresses." />
     <property name="may-fail" type="boolean" default="TRUE" description="If TRUE, allow overall network configuration to proceed even if the configuration specified by this property times out.  Note that at least one IP configuration must succeed or overall network configuration will still fail.  For example, in IPv6-only networks, setting this property to TRUE on the NMSettingIP4Config allows the overall network configuration to succeed if IPv4 configuration fails but IPv6 configuration completes successfully." />
-    <property name="method" type="string" description="IP configuration method. NMSettingIP4Config and NMSettingIP6Config both support &quot;auto&quot;, &quot;manual&quot;, and &quot;link-local&quot;. See the subclass-specific documentation for other values. In general, for the &quot;auto&quot; method, properties such as &quot;dns&quot; and &quot;routes&quot; specify information that is added on to the information returned from automatic configuration.  The &quot;ignore-auto-routes&quot; and &quot;ignore-auto-dns&quot; properties modify this behavior. For methods that imply no upstream network, such as &quot;shared&quot; or &quot;link-local&quot;, these properties must be empty." />
+    <property name="method" type="string" description="IP configuration method. NMSettingIP4Config and NMSettingIP6Config both support &quot;auto&quot;, &quot;manual&quot;, and &quot;link-local&quot;. See the subclass-specific documentation for other values. In general, for the &quot;auto&quot; method, properties such as &quot;dns&quot; and &quot;routes&quot; specify information that is added on to the information returned from automatic configuration.  The &quot;ignore-auto-routes&quot; and &quot;ignore-auto-dns&quot; properties modify this behavior. For methods that imply no upstream network, such as &quot;shared&quot; or &quot;link-local&quot;, these properties must be empty. For IPv4 method &quot;shared&quot;, the IP subnet can be configured by adding one manual IPv4 address or otherwise 10.42.x.0/24 is chosen." />
     <property name="name" type="string" default="ipv6" description="The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example &quot;ppp&quot; or &quot;wireless&quot; or &quot;wired&quot;." />
     <property name="never-default" type="boolean" default="FALSE" description="If TRUE, this connection will never be the default connection for this IP type, meaning it will never be assigned the default route by NetworkManager." />
     <property name="route-data" type="array of vardict" description="Array of IPv6 routes. Each route dictionary contains at least 'dest' and 'prefix' entries, containing the destination IP address as a string, and the prefix length as a uint32. Most routes will also have a 'next-hop' entry, containing the next hop IP address as a string. If the route has a 'metric' entry (containing a uint32), that will be used as the metric for the route (otherwise NM will pick a default value appropriate to the device). Additional attributes may also exist on some routes." />
-- 
cgit 1.3.0-6-gf8a5