From 1e5977b62f896e844b548c3007ace9e1dfa7f9ed Mon Sep 17 00:00:00 2001
From: Michael Biebl <biebl@debian.org>
Date: Sat, 11 Apr 2020 21:28:04 +0200
Subject: New upstream version 1.23.90

---
 libnm/nm-settings-docs.xml | 29 ++++++++++++++++++++---------
 1 file changed, 20 insertions(+), 9 deletions(-)

(limited to 'libnm/nm-settings-docs.xml')

diff --git a/libnm/nm-settings-docs.xml b/libnm/nm-settings-docs.xml
index 68f09cdb..9a139a16 100644
--- a/libnm/nm-settings-docs.xml
+++ b/libnm/nm-settings-docs.xml
@@ -43,7 +43,8 @@
     <property name="client-cert" name_upper="CLIENT_CERT" type="byte array" description="Contains the client certificate if used by the EAP method specified in the &quot;eap&quot; property. Certificate data is specified using a &quot;scheme&quot;; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string &quot;file://&quot; and ending with a terminating NUL byte." />
     <property name="client-cert-password" name_upper="CLIENT_CERT_PASSWORD" type="string" description="The password used to access the client certificate stored in &quot;client-cert&quot; property. Only makes sense if the certificate is stored on a PKCS#11 token that requires a login." />
     <property name="client-cert-password-flags" name_upper="CLIENT_CERT_PASSWORD_FLAGS" type="NMSettingSecretFlags (uint32)" description="Flags indicating how to handle the &quot;client-cert-password&quot; property." />
-    <property name="domain-suffix-match" name_upper="DOMAIN_SUFFIX_MATCH" type="string" description="Constraint for server domain name. If set, this FQDN is used as a suffix match requirement for dNSName element(s) of the certificate presented by the authentication server.  If a matching dNSName is found, this constraint is met.  If no dNSName values are present, this constraint is matched against SubjectName CN using same suffix match comparison." />
+    <property name="domain-match" name_upper="DOMAIN_MATCH" type="string" description="Constraint for server domain name. If set, this list of FQDNs is used as a match requirement for dNSName element(s) of the certificate presented by the authentication server.  If a matching dNSName is found, this constraint is met.  If no dNSName values are present, this constraint is matched against SubjectName CN using the same comparison. Multiple valid FQDNs can be passed as a &quot;;&quot; delimited list." />
+    <property name="domain-suffix-match" name_upper="DOMAIN_SUFFIX_MATCH" type="string" description="Constraint for server domain name. If set, this FQDN is used as a suffix match requirement for dNSName element(s) of the certificate presented by the authentication server.  If a matching dNSName is found, this constraint is met.  If no dNSName values are present, this constraint is matched against SubjectName CN using same suffix match comparison. Since version 1.24, multiple valid FQDNs can be passed as a &quot;;&quot; delimited list." />
     <property name="eap" name_upper="EAP" type="array of string" description="The allowed EAP method to be used when authenticating to the network with 802.1x.  Valid methods are: &quot;leap&quot;, &quot;md5&quot;, &quot;tls&quot;, &quot;peap&quot;, &quot;ttls&quot;, &quot;pwd&quot;, and &quot;fast&quot;.  Each method requires different configuration using the properties of this setting; refer to wpa_supplicant documentation for the allowed combinations." />
     <property name="identity" name_upper="IDENTITY" type="string" description="Identity string for EAP authentication methods.  Often the user's user or login name." />
     <property name="optional" name_upper="OPTIONAL" type="boolean" default="FALSE" description="Whether the 802.1X authentication is optional. If TRUE, the activation will continue even after a timeout or an authentication failure. Setting the property to TRUE is currently allowed only for Ethernet connections. If set to FALSE, the activation can continue only after a successful authentication." />
@@ -66,7 +67,8 @@
     <property name="phase2-client-cert" name_upper="PHASE2_CLIENT_CERT" type="byte array" description="Contains the &quot;phase 2&quot; client certificate if used by the EAP method specified in the &quot;phase2-auth&quot; or &quot;phase2-autheap&quot; properties. Certificate data is specified using a &quot;scheme&quot;; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string &quot;file://&quot; and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended." />
     <property name="phase2-client-cert-password" name_upper="PHASE2_CLIENT_CERT_PASSWORD" type="string" description="The password used to access the &quot;phase2&quot; client certificate stored in &quot;phase2-client-cert&quot; property. Only makes sense if the certificate is stored on a PKCS#11 token that requires a login." />
     <property name="phase2-client-cert-password-flags" name_upper="PHASE2_CLIENT_CERT_PASSWORD_FLAGS" type="NMSettingSecretFlags (uint32)" description="Flags indicating how to handle the &quot;phase2-client-cert-password&quot; property." />
-    <property name="phase2-domain-suffix-match" name_upper="PHASE2_DOMAIN_SUFFIX_MATCH" type="string" description="Constraint for server domain name. If set, this FQDN is used as a suffix match requirement for dNSName element(s) of the certificate presented by the authentication server during the inner &quot;phase 2&quot; authentication.  If a matching dNSName is found, this constraint is met.  If no dNSName values are present, this constraint is matched against SubjectName CN using same suffix match comparison." />
+    <property name="phase2-domain-match" name_upper="PHASE2_DOMAIN_MATCH" type="string" description="Constraint for server domain name. If set, this list of FQDNs is used as a match requirement for dNSName element(s) of the certificate presented by the authentication server during the inner &quot;phase 2&quot; authentication. If a matching dNSName is found, this constraint is met.  If no dNSName values are present, this constraint is matched against SubjectName CN using the same comparison. Multiple valid FQDNs can be passed as a &quot;;&quot; delimited list." />
+    <property name="phase2-domain-suffix-match" name_upper="PHASE2_DOMAIN_SUFFIX_MATCH" type="string" description="Constraint for server domain name. If set, this FQDN is used as a suffix match requirement for dNSName element(s) of the certificate presented by the authentication server during the inner &quot;phase 2&quot; authentication.  If a matching dNSName is found, this constraint is met.  If no dNSName values are present, this constraint is matched against SubjectName CN using same suffix match comparison. Since version 1.24, multiple valid FQDNs can be passed as a &quot;;&quot; delimited list." />
     <property name="phase2-private-key" name_upper="PHASE2_PRIVATE_KEY" type="byte array" description="Contains the &quot;phase 2&quot; inner private key when the &quot;phase2-auth&quot; or &quot;phase2-autheap&quot; property is set to &quot;tls&quot;. Key data is specified using a &quot;scheme&quot;; two are currently supported: blob and path. When using the blob scheme and private keys, this property should be set to the key's encrypted PEM encoded data. When using private keys with the path scheme, this property should be set to the full UTF-8 encoded path of the key, prefixed with the string &quot;file://&quot; and ending with a terminating NUL byte. When using PKCS#12 format private keys and the blob scheme, this property should be set to the PKCS#12 data and the &quot;phase2-private-key-password&quot; property must be set to password used to decrypt the PKCS#12 certificate and key. When using PKCS#12 files and the path scheme, this property should be set to the full UTF-8 encoded path of the key, prefixed with the string &quot;file://&quot; and ending with a terminating NUL byte, and as with the blob scheme the &quot;phase2-private-key-password&quot; property must be set to the password used to decode the PKCS#12 private key and certificate." />
     <property name="phase2-private-key-password" name_upper="PHASE2_PRIVATE_KEY_PASSWORD" type="string" description="The password used to decrypt the &quot;phase 2&quot; private key specified in the &quot;phase2-private-key&quot; property when the private key either uses the path scheme, or is a PKCS#12 format key." />
     <property name="phase2-private-key-password-flags" name_upper="PHASE2_PRIVATE_KEY_PASSWORD_FLAGS" type="NMSettingSecretFlags (uint32)" description="Flags indicating how to handle the &quot;phase2-private-key-password&quot; property." />
@@ -99,16 +101,22 @@
   <setting name="bridge" description="Bridging Settings" name_upper="BRIDGE" >
     <property name="ageing-time" name_upper="AGEING_TIME" type="uint32" default="300" description="The Ethernet MAC address aging time, in seconds." />
     <property name="forward-delay" name_upper="FORWARD_DELAY" type="uint32" default="15" description="The Spanning Tree Protocol (STP) forwarding delay, in seconds." />
+    <property name="group-address" name_upper="GROUP_ADDRESS" type="byte array" description="If specified, The MAC address of the multicast group this bridge uses for STP. The address must be a link-local address in standard Ethernet MAC address format, ie an address of the form 01:80:C2:00:00:0X, with X in [0, 4..F]. If not specified the default value is 01:80:C2:00:00:00." />
     <property name="group-forward-mask" name_upper="GROUP_FORWARD_MASK" type="uint32" default="0" description="A mask of group addresses to forward. Usually, group addresses in the range from 01:80:C2:00:00:00 to 01:80:C2:00:00:0F are not forwarded according to standards. This property is a mask of 16 bits, each corresponding to a group address in that range that must be forwarded. The mask can't have bits 0, 1 or 2 set because they are used for STP, MAC pause frames and LACP." />
     <property name="hello-time" name_upper="HELLO_TIME" type="uint32" default="2" description="The Spanning Tree Protocol (STP) hello time, in seconds." />
     <property name="interface-name" name_upper="INTERFACE_NAME" type="string" description="Deprecated in favor of connection.interface-name, but can be used for backward-compatibility with older daemons, to set the bridge's interface name." />
     <property name="mac-address" name_upper="MAC_ADDRESS" type="byte array" description="If specified, the MAC address of bridge. When creating a new bridge, this MAC address will be set. If this field is left unspecified, the &quot;ethernet.cloned-mac-address&quot; is referred instead to generate the initial MAC address. Note that setting &quot;ethernet.cloned-mac-address&quot; anyway overwrites the MAC address of the bridge later while activating the bridge. Hence, this property is deprecated. Deprecated: 1" />
     <property name="max-age" name_upper="MAX_AGE" type="uint32" default="20" description="The Spanning Tree Protocol (STP) maximum message age, in seconds." />
+    <property name="multicast-querier" name_upper="MULTICAST_QUERIER" type="boolean" default="FALSE" description="Enable or disable sending of multicast queries by the bridge. If not specified the option is disabled." />
+    <property name="multicast-query-use-ifaddr" name_upper="MULTICAST_QUERY_USE_IFADDR" type="boolean" default="FALSE" description="If enabled the bridge's own IP address is used as the source address for IGMP queries otherwise the default of 0.0.0.0 is used." />
+    <property name="multicast-router" name_upper="MULTICAST_ROUTER" type="string" description="Sets bridge's multicast router. multicast-snooping must be enabled for this option to work. Supported values are: 'auto', 'disabled', 'enabled'. If not specified the default value is 'auto'." />
     <property name="multicast-snooping" name_upper="MULTICAST_SNOOPING" type="boolean" default="TRUE" description="Controls whether IGMP snooping is enabled for this bridge. Note that if snooping was automatically disabled due to hash collisions, the system may refuse to enable the feature until the collisions are resolved." />
     <property name="priority" name_upper="PRIORITY" type="uint32" default="32768" description="Sets the Spanning Tree Protocol (STP) priority for this bridge.  Lower values are &quot;better&quot;; the lowest priority bridge will be elected the root bridge." />
     <property name="stp" name_upper="STP" type="boolean" default="TRUE" description="Controls whether Spanning Tree Protocol (STP) is enabled for this bridge." />
     <property name="vlan-default-pvid" name_upper="VLAN_DEFAULT_PVID" type="uint32" default="1" description="The default PVID for the ports of the bridge, that is the VLAN id assigned to incoming untagged frames." />
     <property name="vlan-filtering" name_upper="VLAN_FILTERING" type="boolean" default="FALSE" description="Control whether VLAN filtering is enabled on the bridge." />
+    <property name="vlan-protocol" name_upper="VLAN_PROTOCOL" type="string" description="If specified, the protocol used for VLAN filtering. Supported values are: '802.1Q', '802.1ad'. If not specified the default value is '802.1Q'." />
+    <property name="vlan-stats-enabled" name_upper="VLAN_STATS_ENABLED" type="boolean" default="FALSE" description="Controls whether per-VLAN stats accounting is enabled." />
     <property name="vlans" name_upper="VLANS" type="array of vardict" description="Array of bridge VLAN objects. In addition to the VLANs specified here, the bridge will also have the default-pvid VLAN configured  by the bridge.vlan-default-pvid property. In nmcli the VLAN list can be specified with the following syntax: $vid [pvid] [untagged] [, $vid [pvid] [untagged]]... where $vid is either a single id between 1 and 4094 or a range, represented as a couple of ids separated by a dash." />
   </setting>
   <setting name="bridge-port" description="Bridge Port Settings" name_upper="BRIDGE_PORT" >
@@ -183,7 +191,7 @@
     <property name="dhcp-timeout" name_upper="DHCP_TIMEOUT" type="int32" default="0" description="A timeout for a DHCP transaction in seconds. If zero (the default), a globally configured default is used. If still unspecified, a device specific timeout is used (usually 45 seconds). Set to 2147483647 (MAXINT32) for infinity." />
     <property name="dns" name_upper="DNS" type="array of uint32" description="Array of IP addresses of DNS servers (as network-byte-order integers)" />
     <property name="dns-options" name_upper="DNS_OPTIONS" type="array of string" description="Array of DNS options as described in man 5 resolv.conf. NULL means that the options are unset and left at the default. In this case NetworkManager will use default options. This is distinct from an empty list of properties." />
-    <property name="dns-priority" name_upper="DNS_PRIORITY" type="int32" default="0" description="DNS servers priority. The relative priority for DNS servers specified by this setting.  A lower value is better (higher priority). Zero selects a globally configured default value. If the latter is missing or zero too, it defaults to 50 for VPNs and 100 for other connections. Note that the priority is to order DNS settings for multiple active connections.  It does not disambiguate multiple DNS servers within the same connection profile. When using dns=default, servers with higher priority will be on top of resolv.conf.  To prioritize a given server over another one within the same connection, just specify them in the desired order.  When multiple devices have configurations with the same priority, VPNs will be considered first, then devices with the best (lowest metric) default route and then all other devices.  Negative values have the special effect of excluding other configurations with a greater priority value; so in presence of at least one negative priority, only DNS servers from connections with the lowest priority value will be used. When using a DNS resolver that supports Conditional Forwarding as dns=dnsmasq or dns=systemd-resolved, each connection is used to query domains in its search list.  Queries for domains not present in any search list are routed through connections having the '~.' special wildcard domain, which is added automatically to connections with the default route (or can be added manually).  When multiple connections specify the same domain, the one with the highest priority (lowest numerical value) wins.  If a connection specifies a domain which is subdomain of another domain with a negative DNS priority value, the subdomain is ignored." />
+    <property name="dns-priority" name_upper="DNS_PRIORITY" type="int32" default="0" description="DNS servers priority. The relative priority for DNS servers specified by this setting.  A lower value is better (higher priority). Zero selects a globally configured default value. If the latter is missing or zero too, it defaults to 50 for VPNs (including WireGuard) and 100 for other connections. Note that the priority is to order DNS settings for multiple active connections.  It does not disambiguate multiple DNS servers within the same connection profile. When using dns=default, servers with higher priority will be on top of resolv.conf.  To prioritize a given server over another one within the same connection, just specify them in the desired order.  When multiple devices have configurations with the same priority, VPNs will be considered first, then devices with the best (lowest metric) default route and then all other devices.  Negative values have the special effect of excluding other configurations with a greater priority value; so in presence of at least one negative priority, only DNS servers from connections with the lowest priority value will be used. When using a DNS resolver that supports Conditional Forwarding as dns=dnsmasq or dns=systemd-resolved, each connection is used to query domains in its search list.  Queries for domains not present in any search list are routed through connections having the '~.' special wildcard domain, which is added automatically to connections with the default route (or can be added manually).  When multiple connections specify the same domain, the one with the highest priority (lowest numerical value) wins.  If a connection specifies a domain which is subdomain of another domain with a negative DNS priority value, the subdomain is ignored." />
     <property name="dns-search" name_upper="DNS_SEARCH" type="array of string" description="Array of DNS search domains. Domains starting with a tilde ('~') are considered 'routing' domains and are used only to decide the interface over which a query must be forwarded; they are not used to complete unqualified host names." />
     <property name="gateway" name_upper="GATEWAY" type="string" description="The gateway associated with this configuration. This is only meaningful if &quot;addresses&quot; is also set." />
     <property name="ignore-auto-dns" name_upper="IGNORE_AUTO_DNS" type="boolean" default="FALSE" description="When &quot;method&quot; is set to &quot;auto&quot; and this property to TRUE, automatically configured nameservers and search domains are ignored and only nameservers and search domains specified in the &quot;dns&quot; and &quot;dns-search&quot; properties, if any, are used." />
@@ -209,7 +217,7 @@
     <property name="dhcp-timeout" name_upper="DHCP_TIMEOUT" type="int32" default="0" description="A timeout for a DHCP transaction in seconds. If zero (the default), a globally configured default is used. If still unspecified, a device specific timeout is used (usually 45 seconds). Set to 2147483647 (MAXINT32) for infinity." />
     <property name="dns" name_upper="DNS" type="array of byte array" description="Array of IP addresses of DNS servers (in network byte order)" />
     <property name="dns-options" name_upper="DNS_OPTIONS" type="array of string" description="Array of DNS options as described in man 5 resolv.conf. NULL means that the options are unset and left at the default. In this case NetworkManager will use default options. This is distinct from an empty list of properties." />
-    <property name="dns-priority" name_upper="DNS_PRIORITY" type="int32" default="0" description="DNS servers priority. The relative priority for DNS servers specified by this setting.  A lower value is better (higher priority). Zero selects a globally configured default value. If the latter is missing or zero too, it defaults to 50 for VPNs and 100 for other connections. Note that the priority is to order DNS settings for multiple active connections.  It does not disambiguate multiple DNS servers within the same connection profile. When using dns=default, servers with higher priority will be on top of resolv.conf.  To prioritize a given server over another one within the same connection, just specify them in the desired order.  When multiple devices have configurations with the same priority, VPNs will be considered first, then devices with the best (lowest metric) default route and then all other devices.  Negative values have the special effect of excluding other configurations with a greater priority value; so in presence of at least one negative priority, only DNS servers from connections with the lowest priority value will be used. When using a DNS resolver that supports Conditional Forwarding as dns=dnsmasq or dns=systemd-resolved, each connection is used to query domains in its search list.  Queries for domains not present in any search list are routed through connections having the '~.' special wildcard domain, which is added automatically to connections with the default route (or can be added manually).  When multiple connections specify the same domain, the one with the highest priority (lowest numerical value) wins.  If a connection specifies a domain which is subdomain of another domain with a negative DNS priority value, the subdomain is ignored." />
+    <property name="dns-priority" name_upper="DNS_PRIORITY" type="int32" default="0" description="DNS servers priority. The relative priority for DNS servers specified by this setting.  A lower value is better (higher priority). Zero selects a globally configured default value. If the latter is missing or zero too, it defaults to 50 for VPNs (including WireGuard) and 100 for other connections. Note that the priority is to order DNS settings for multiple active connections.  It does not disambiguate multiple DNS servers within the same connection profile. When using dns=default, servers with higher priority will be on top of resolv.conf.  To prioritize a given server over another one within the same connection, just specify them in the desired order.  When multiple devices have configurations with the same priority, VPNs will be considered first, then devices with the best (lowest metric) default route and then all other devices.  Negative values have the special effect of excluding other configurations with a greater priority value; so in presence of at least one negative priority, only DNS servers from connections with the lowest priority value will be used. When using a DNS resolver that supports Conditional Forwarding as dns=dnsmasq or dns=systemd-resolved, each connection is used to query domains in its search list.  Queries for domains not present in any search list are routed through connections having the '~.' special wildcard domain, which is added automatically to connections with the default route (or can be added manually).  When multiple connections specify the same domain, the one with the highest priority (lowest numerical value) wins.  If a connection specifies a domain which is subdomain of another domain with a negative DNS priority value, the subdomain is ignored." />
     <property name="dns-search" name_upper="DNS_SEARCH" type="array of string" description="Array of DNS search domains. Domains starting with a tilde ('~') are considered 'routing' domains and are used only to decide the interface over which a query must be forwarded; they are not used to complete unqualified host names." />
     <property name="gateway" name_upper="GATEWAY" type="string" description="The gateway associated with this configuration. This is only meaningful if &quot;addresses&quot; is also set." />
     <property name="ignore-auto-dns" name_upper="IGNORE_AUTO_DNS" type="boolean" default="FALSE" description="When &quot;method&quot; is set to &quot;auto&quot; and this property to TRUE, automatically configured nameservers and search domains are ignored and only nameservers and search domains specified in the &quot;dns&quot; and &quot;dns-search&quot; properties, if any, are used." />
@@ -257,7 +265,7 @@
     <property name="promiscuous" name_upper="PROMISCUOUS" type="boolean" default="TRUE" description="Whether the interface should be put in promiscuous mode." />
     <property name="tap" name_upper="TAP" type="boolean" default="FALSE" description="Whether the interface should be a MACVTAP." />
   </setting>
-  <setting name="match" description="Match settings." name_upper="MATCH" >
+  <setting name="match" description="Match settings" name_upper="MATCH" >
     <property name="interface-name" name_upper="INTERFACE_NAME" type="array of string" description="A list of interface names to match. Each element is a shell wildcard pattern.  When an element is prefixed with exclamation mark (!) the condition is inverted. A candidate interface name is considered matching when both these conditions are satisfied: (a) any of the elements not prefixed with '!' matches or there aren't such elements; (b) none of the elements prefixed with '!' match." />
   </setting>
   <setting name="802-11-olpc-mesh" description="OLPC Wireless Mesh Settings" name_upper="OLPC_MESH" >
@@ -329,12 +337,12 @@
     <property name="send-delay" name_upper="SEND_DELAY" type="uint64" default="0" description="Time to delay between each byte sent to the modem, in microseconds." />
     <property name="stopbits" name_upper="STOPBITS" type="uint32" default="1" description="Number of stop bits for communication on the serial port.  Either 1 or 2. The 1 in &quot;8n1&quot; for example." />
   </setting>
-  <setting name="sriov" description="SR-IOV settings." name_upper="SRIOV" >
+  <setting name="sriov" description="SR-IOV settings" name_upper="SRIOV" >
     <property name="autoprobe-drivers" name_upper="AUTOPROBE_DRIVERS" type="NMTernary (int32)" description="Whether to autoprobe virtual functions by a compatible driver. If set to NM_TERNARY_TRUE (1), the kernel will try to bind VFs to a compatible driver and if this succeeds a new network interface will be instantiated for each VF. If set to NM_TERNARY_FALSE (0), VFs will not be claimed and no network interfaces will be created for them. When set to NM_TERNARY_DEFAULT (-1), the global default is used; in case the global default is unspecified it is assumed to be NM_TERNARY_TRUE (1)." />
-    <property name="total-vfs" name_upper="TOTAL_VFS" type="uint32" default="0" description="The total number of virtual functions to create. Note that when the sriov setting is present NetworkManager enforces the number of virtual functions on the interface also when it is zero. To prevent any changes to SR-IOV parameters don't add a sriov setting to the connection." />
+    <property name="total-vfs" name_upper="TOTAL_VFS" type="uint32" default="0" description="The total number of virtual functions to create. Note that when the sriov setting is present NetworkManager enforces the number of virtual functions on the interface (also when it is zero) during activation and resets it upon deactivation. To prevent any changes to SR-IOV parameters don't add a sriov setting to the connection." />
     <property name="vfs" name_upper="VFS" type="array of vardict" description="Array of virtual function descriptors. Each VF descriptor is a dictionary mapping attribute names to GVariant values. The 'index' entry is mandatory for each VF. When represented as string a VF is in the form: &quot;INDEX [ATTR=VALUE[ ATTR=VALUE]...]&quot;. for example: &quot;2 mac=00:11:22:33:44:55 spoof-check=true&quot;. Multiple VFs can be specified using a comma as separator. Currently the following attributes are supported: mac, spoof-check, trust, min-tx-rate, max-tx-rate, vlans. The &quot;vlans&quot; attribute is represented as a semicolon-separated list of VLAN descriptors, where each descriptor has the form &quot;ID[.PRIORITY[.PROTO]]&quot;. PROTO can be either 'q' for 802.1Q (the default) or 'ad' for 802.1ad." />
   </setting>
-  <setting name="tc" description="Linux Traffic Control Settings." name_upper="TC_CONFIG" >
+  <setting name="tc" description="Linux Traffic Control Settings" name_upper="TC_CONFIG" >
     <property name="qdiscs" name_upper="QDISCS" type="array of vardict" description="Array of TC queueing disciplines." />
     <property name="tfilters" name_upper="TFILTERS" type="array of vardict" description="Array of TC traffic filters." />
   </setting>
@@ -393,6 +401,9 @@
     <property name="timeout" name_upper="TIMEOUT" type="uint32" default="0" description="Timeout for the VPN service to establish the connection. Some services may take quite a long time to connect. Value of 0 means a default timeout, which is 60 seconds (unless overridden by vpn.timeout in configuration file). Values greater than zero mean timeout in seconds." />
     <property name="user-name" name_upper="USER_NAME" type="string" description="If the VPN connection requires a user name for authentication, that name should be provided here.  If the connection is available to more than one user, and the VPN requires each user to supply a different name, then leave this property empty.  If this property is empty, NetworkManager will automatically supply the username of the user which requested the VPN connection." />
   </setting>
+  <setting name="vrf" description="VRF settings" name_upper="VRF" >
+    <property name="table" name_upper="TABLE" type="uint32" default="0" description="The routing table for this VRF." />
+  </setting>
   <setting name="vxlan" description="VXLAN Settings" name_upper="VXLAN" >
     <property name="ageing" name_upper="AGEING" type="uint32" default="300" description="Specifies the lifetime in seconds of FDB entries learnt by the kernel." />
     <property name="destination-port" name_upper="DESTINATION_PORT" type="uint32" default="8472" description="Specifies the UDP destination port to communicate to the remote VXLAN tunnel endpoint." />
@@ -473,7 +484,7 @@
     <property name="auth-alg" name_upper="AUTH_ALG" type="string" description="When WEP is used (ie, key-mgmt = &quot;none&quot; or &quot;ieee8021x&quot;) indicate the 802.11 authentication algorithm required by the AP here.  One of &quot;open&quot; for Open System, &quot;shared&quot; for Shared Key, or &quot;leap&quot; for Cisco LEAP.  When using Cisco LEAP (ie, key-mgmt = &quot;ieee8021x&quot; and auth-alg = &quot;leap&quot;) the &quot;leap-username&quot; and &quot;leap-password&quot; properties must be specified." />
     <property name="fils" name_upper="FILS" type="int32" default="0" description="Indicates whether Fast Initial Link Setup (802.11ai) must be enabled for the connection.  One of NM_SETTING_WIRELESS_SECURITY_FILS_DEFAULT (0) (use global default value), NM_SETTING_WIRELESS_SECURITY_FILS_DISABLE (1) (disable FILS), NM_SETTING_WIRELESS_SECURITY_FILS_OPTIONAL (2) (enable FILS if the supplicant and the access point support it) or NM_SETTING_WIRELESS_SECURITY_FILS_REQUIRED (3) (enable FILS and fail if not supported).  When set to NM_SETTING_WIRELESS_SECURITY_FILS_DEFAULT (0) and no global default is set, FILS will be optionally enabled." />
     <property name="group" name_upper="GROUP" type="array of string" description="A list of group/broadcast encryption algorithms which prevents connections to Wi-Fi networks that do not utilize one of the algorithms in the list.  For maximum compatibility leave this property empty.  Each list element may be one of &quot;wep40&quot;, &quot;wep104&quot;, &quot;tkip&quot;, or &quot;ccmp&quot;." />
-    <property name="key-mgmt" name_upper="KEY_MGMT" type="string" description="Key management used for the connection.  One of &quot;none&quot; (WEP), &quot;ieee8021x&quot; (Dynamic WEP), &quot;wpa-psk&quot; (infrastructure WPA-PSK), &quot;sae&quot; (SAE) or &quot;wpa-eap&quot; (WPA-Enterprise).  This property must be set for any Wi-Fi connection that uses security." />
+    <property name="key-mgmt" name_upper="KEY_MGMT" type="string" description="Key management used for the connection.  One of &quot;none&quot; (WEP), &quot;ieee8021x&quot; (Dynamic WEP), &quot;wpa-psk&quot; (infrastructure WPA-PSK), &quot;sae&quot; (SAE), &quot;owe&quot; (Opportunistic Wireless Encryption) or &quot;wpa-eap&quot; (WPA-Enterprise).  This property must be set for any Wi-Fi connection that uses security." />
     <property name="leap-password" name_upper="LEAP_PASSWORD" type="string" description="The login password for legacy LEAP connections (ie, key-mgmt = &quot;ieee8021x&quot; and auth-alg = &quot;leap&quot;)." />
     <property name="leap-password-flags" name_upper="LEAP_PASSWORD_FLAGS" type="NMSettingSecretFlags (uint32)" description="Flags indicating how to handle the &quot;leap-password&quot; property." />
     <property name="leap-username" name_upper="LEAP_USERNAME" type="string" description="The login username for legacy LEAP connections (ie, key-mgmt = &quot;ieee8021x&quot; and auth-alg = &quot;leap&quot;)." />
-- 
cgit 1.3.0-6-gf8a5


From d460892bbfece74fb6d3cd846bf6ef548290be41 Mon Sep 17 00:00:00 2001
From: Michael Biebl <biebl@debian.org>
Date: Fri, 8 May 2020 21:40:53 +0200
Subject: New upstream version 1.24.0

---
 libnm/nm-settings-docs.xml | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

(limited to 'libnm/nm-settings-docs.xml')

diff --git a/libnm/nm-settings-docs.xml b/libnm/nm-settings-docs.xml
index 9a139a16..df9ef110 100644
--- a/libnm/nm-settings-docs.xml
+++ b/libnm/nm-settings-docs.xml
@@ -190,10 +190,10 @@
     <property name="dhcp-send-hostname" name_upper="DHCP_SEND_HOSTNAME" type="boolean" default="TRUE" description="If TRUE, a hostname is sent to the DHCP server when acquiring a lease. Some DHCP servers use this hostname to update DNS databases, essentially providing a static hostname for the computer.  If the &quot;dhcp-hostname&quot; property is NULL and this property is TRUE, the current persistent hostname of the computer is sent." />
     <property name="dhcp-timeout" name_upper="DHCP_TIMEOUT" type="int32" default="0" description="A timeout for a DHCP transaction in seconds. If zero (the default), a globally configured default is used. If still unspecified, a device specific timeout is used (usually 45 seconds). Set to 2147483647 (MAXINT32) for infinity." />
     <property name="dns" name_upper="DNS" type="array of uint32" description="Array of IP addresses of DNS servers (as network-byte-order integers)" />
-    <property name="dns-options" name_upper="DNS_OPTIONS" type="array of string" description="Array of DNS options as described in man 5 resolv.conf. NULL means that the options are unset and left at the default. In this case NetworkManager will use default options. This is distinct from an empty list of properties." />
+    <property name="dns-options" name_upper="DNS_OPTIONS" type="array of string" description="Array of DNS options as described in man 5 resolv.conf. NULL means that the options are unset and left at the default. In this case NetworkManager will use default options. This is distinct from an empty list of properties. The currently supported options are &quot;attempts&quot;, &quot;debug&quot;, &quot;edns0&quot;, &quot;inet6&quot;, &quot;ip6-bytestring&quot;, &quot;ip6-dotint&quot;, &quot;ndots&quot;, &quot;no-check-names&quot;, &quot;no-ip6-dotint&quot;, &quot;no-reload&quot;, &quot;no-tld-query&quot;, &quot;rotate&quot;, &quot;single-request&quot;, &quot;single-request-reopen&quot;, &quot;timeout&quot;, &quot;trust-ad&quot;, &quot;use-vc&quot;. The &quot;trust-ad&quot; setting is only honored if the profile contributes name servers to resolv.conf, and if all contributing profiles have &quot;trust-ad&quot; enabled." />
     <property name="dns-priority" name_upper="DNS_PRIORITY" type="int32" default="0" description="DNS servers priority. The relative priority for DNS servers specified by this setting.  A lower value is better (higher priority). Zero selects a globally configured default value. If the latter is missing or zero too, it defaults to 50 for VPNs (including WireGuard) and 100 for other connections. Note that the priority is to order DNS settings for multiple active connections.  It does not disambiguate multiple DNS servers within the same connection profile. When using dns=default, servers with higher priority will be on top of resolv.conf.  To prioritize a given server over another one within the same connection, just specify them in the desired order.  When multiple devices have configurations with the same priority, VPNs will be considered first, then devices with the best (lowest metric) default route and then all other devices.  Negative values have the special effect of excluding other configurations with a greater priority value; so in presence of at least one negative priority, only DNS servers from connections with the lowest priority value will be used. When using a DNS resolver that supports Conditional Forwarding as dns=dnsmasq or dns=systemd-resolved, each connection is used to query domains in its search list.  Queries for domains not present in any search list are routed through connections having the '~.' special wildcard domain, which is added automatically to connections with the default route (or can be added manually).  When multiple connections specify the same domain, the one with the highest priority (lowest numerical value) wins.  If a connection specifies a domain which is subdomain of another domain with a negative DNS priority value, the subdomain is ignored." />
     <property name="dns-search" name_upper="DNS_SEARCH" type="array of string" description="Array of DNS search domains. Domains starting with a tilde ('~') are considered 'routing' domains and are used only to decide the interface over which a query must be forwarded; they are not used to complete unqualified host names." />
-    <property name="gateway" name_upper="GATEWAY" type="string" description="The gateway associated with this configuration. This is only meaningful if &quot;addresses&quot; is also set." />
+    <property name="gateway" name_upper="GATEWAY" type="string" description="The gateway associated with this configuration. This is only meaningful if &quot;addresses&quot; is also set. The gateway's main purpose is to control the next hop of the standard default route on the device. Hence, the gateway property conflicts with &quot;never-default&quot; and will be automatically dropped if the IP configuration is set to never-default. As an alternative to set the gateway, configure a static default route with /0 as prefix length." />
     <property name="ignore-auto-dns" name_upper="IGNORE_AUTO_DNS" type="boolean" default="FALSE" description="When &quot;method&quot; is set to &quot;auto&quot; and this property to TRUE, automatically configured nameservers and search domains are ignored and only nameservers and search domains specified in the &quot;dns&quot; and &quot;dns-search&quot; properties, if any, are used." />
     <property name="ignore-auto-routes" name_upper="IGNORE_AUTO_ROUTES" type="boolean" default="FALSE" description="When &quot;method&quot; is set to &quot;auto&quot; and this property to TRUE, automatically configured routes are ignored and only routes specified in the &quot;routes&quot; property, if any, are used." />
     <property name="may-fail" name_upper="MAY_FAIL" type="boolean" default="TRUE" description="If TRUE, allow overall network configuration to proceed even if the configuration specified by this property times out.  Note that at least one IP configuration must succeed or overall network configuration will still fail.  For example, in IPv6-only networks, setting this property to TRUE on the NMSettingIP4Config allows the overall network configuration to succeed if IPv4 configuration fails but IPv6 configuration completes successfully." />
@@ -216,10 +216,10 @@
     <property name="dhcp-send-hostname" name_upper="DHCP_SEND_HOSTNAME" type="boolean" default="TRUE" description="If TRUE, a hostname is sent to the DHCP server when acquiring a lease. Some DHCP servers use this hostname to update DNS databases, essentially providing a static hostname for the computer.  If the &quot;dhcp-hostname&quot; property is NULL and this property is TRUE, the current persistent hostname of the computer is sent." />
     <property name="dhcp-timeout" name_upper="DHCP_TIMEOUT" type="int32" default="0" description="A timeout for a DHCP transaction in seconds. If zero (the default), a globally configured default is used. If still unspecified, a device specific timeout is used (usually 45 seconds). Set to 2147483647 (MAXINT32) for infinity." />
     <property name="dns" name_upper="DNS" type="array of byte array" description="Array of IP addresses of DNS servers (in network byte order)" />
-    <property name="dns-options" name_upper="DNS_OPTIONS" type="array of string" description="Array of DNS options as described in man 5 resolv.conf. NULL means that the options are unset and left at the default. In this case NetworkManager will use default options. This is distinct from an empty list of properties." />
+    <property name="dns-options" name_upper="DNS_OPTIONS" type="array of string" description="Array of DNS options as described in man 5 resolv.conf. NULL means that the options are unset and left at the default. In this case NetworkManager will use default options. This is distinct from an empty list of properties. The currently supported options are &quot;attempts&quot;, &quot;debug&quot;, &quot;edns0&quot;, &quot;inet6&quot;, &quot;ip6-bytestring&quot;, &quot;ip6-dotint&quot;, &quot;ndots&quot;, &quot;no-check-names&quot;, &quot;no-ip6-dotint&quot;, &quot;no-reload&quot;, &quot;no-tld-query&quot;, &quot;rotate&quot;, &quot;single-request&quot;, &quot;single-request-reopen&quot;, &quot;timeout&quot;, &quot;trust-ad&quot;, &quot;use-vc&quot;. The &quot;trust-ad&quot; setting is only honored if the profile contributes name servers to resolv.conf, and if all contributing profiles have &quot;trust-ad&quot; enabled." />
     <property name="dns-priority" name_upper="DNS_PRIORITY" type="int32" default="0" description="DNS servers priority. The relative priority for DNS servers specified by this setting.  A lower value is better (higher priority). Zero selects a globally configured default value. If the latter is missing or zero too, it defaults to 50 for VPNs (including WireGuard) and 100 for other connections. Note that the priority is to order DNS settings for multiple active connections.  It does not disambiguate multiple DNS servers within the same connection profile. When using dns=default, servers with higher priority will be on top of resolv.conf.  To prioritize a given server over another one within the same connection, just specify them in the desired order.  When multiple devices have configurations with the same priority, VPNs will be considered first, then devices with the best (lowest metric) default route and then all other devices.  Negative values have the special effect of excluding other configurations with a greater priority value; so in presence of at least one negative priority, only DNS servers from connections with the lowest priority value will be used. When using a DNS resolver that supports Conditional Forwarding as dns=dnsmasq or dns=systemd-resolved, each connection is used to query domains in its search list.  Queries for domains not present in any search list are routed through connections having the '~.' special wildcard domain, which is added automatically to connections with the default route (or can be added manually).  When multiple connections specify the same domain, the one with the highest priority (lowest numerical value) wins.  If a connection specifies a domain which is subdomain of another domain with a negative DNS priority value, the subdomain is ignored." />
     <property name="dns-search" name_upper="DNS_SEARCH" type="array of string" description="Array of DNS search domains. Domains starting with a tilde ('~') are considered 'routing' domains and are used only to decide the interface over which a query must be forwarded; they are not used to complete unqualified host names." />
-    <property name="gateway" name_upper="GATEWAY" type="string" description="The gateway associated with this configuration. This is only meaningful if &quot;addresses&quot; is also set." />
+    <property name="gateway" name_upper="GATEWAY" type="string" description="The gateway associated with this configuration. This is only meaningful if &quot;addresses&quot; is also set. The gateway's main purpose is to control the next hop of the standard default route on the device. Hence, the gateway property conflicts with &quot;never-default&quot; and will be automatically dropped if the IP configuration is set to never-default. As an alternative to set the gateway, configure a static default route with /0 as prefix length." />
     <property name="ignore-auto-dns" name_upper="IGNORE_AUTO_DNS" type="boolean" default="FALSE" description="When &quot;method&quot; is set to &quot;auto&quot; and this property to TRUE, automatically configured nameservers and search domains are ignored and only nameservers and search domains specified in the &quot;dns&quot; and &quot;dns-search&quot; properties, if any, are used." />
     <property name="ignore-auto-routes" name_upper="IGNORE_AUTO_ROUTES" type="boolean" default="FALSE" description="When &quot;method&quot; is set to &quot;auto&quot; and this property to TRUE, automatically configured routes are ignored and only routes specified in the &quot;routes&quot; property, if any, are used." />
     <property name="ip6-privacy" name_upper="IP6_PRIVACY" type="NMSettingIP6ConfigPrivacy (int32)" description="Configure IPv6 Privacy Extensions for SLAAC, described in RFC4941.  If enabled, it makes the kernel generate a temporary IPv6 address in addition to the public one generated from MAC address via modified EUI-64.  This enhances privacy, but could cause problems in some applications, on the other hand.  The permitted values are: -1: unknown, 0: disabled, 1: enabled (prefer public address), 2: enabled (prefer temporary addresses). Having a per-connection setting set to &quot;-1&quot; (unknown) means fallback to global configuration &quot;ipv6.ip6-privacy&quot;. If also global configuration is unspecified or set to &quot;-1&quot;, fallback to read &quot;/proc/sys/net/ipv6/conf/default/use_tempaddr&quot;. Note that this setting is distinct from the Stable Privacy addresses that can be enabled with the &quot;addr-gen-mode&quot; property's &quot;stable-privacy&quot; setting as another way of avoiding host tracking with IPv6 addresses." />
@@ -450,11 +450,11 @@
   </setting>
   <setting name="wireguard" description="WireGuard Settings" name_upper="WIREGUARD" >
     <property name="fwmark" name_upper="FWMARK" type="uint32" default="0" description="The use of fwmark is optional and is by default off. Setting it to 0 disables it. Otherwise it is a 32-bit fwmark for outgoing packets. Note that &quot;ip4-auto-default-route&quot; or &quot;ip6-auto-default-route&quot; enabled, implies to automatically choose a fwmark." />
-    <property name="ip4-auto-default-route" name_upper="IP4_AUTO_DEFAULT_ROUTE" type="NMTernary (int32)" description="Whether to enable special handling of the IPv4 default route. If enabled, the IPv4 default route will be placed to a dedicated routing-table and two policy routing rules will be added. The fwmark number is also used as routing-table for the default-route, and if fwmark is zero, a unused fwmark/table is chosen automatically. This corresponds to what wg-quick does with Table=auto. Leaving this at the default will enable this option automatically if ipv4.never-default is not set and there are any peers that use a default-route as allowed-ips." />
+    <property name="ip4-auto-default-route" name_upper="IP4_AUTO_DEFAULT_ROUTE" type="NMTernary (int32)" description="Whether to enable special handling of the IPv4 default route. If enabled, the IPv4 default route from wireguard.peer-routes will be placed to a dedicated routing-table and two policy routing rules will be added. The fwmark number is also used as routing-table for the default-route, and if fwmark is zero, an unused fwmark/table is chosen automatically. This corresponds to what wg-quick does with Table=auto and what WireGuard calls &quot;Improved Rule-based Routing&quot;. Note that for this automatism to work, you usually don't want to set ipv4.gateway, because that will result in a conflicting default route. Leaving this at the default will enable this option automatically if ipv4.never-default is not set and there are any peers that use a default-route as allowed-ips." />
     <property name="ip6-auto-default-route" name_upper="IP6_AUTO_DEFAULT_ROUTE" type="NMTernary (int32)" description="Like ip4-auto-default-route, but for the IPv6 default route." />
     <property name="listen-port" name_upper="LISTEN_PORT" type="uint32" default="0" description="The listen-port. If listen-port is not specified, the port will be chosen randomly when the interface comes up." />
     <property name="mtu" name_upper="MTU" type="uint32" default="0" description="If non-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple fragments. If zero a default MTU is used. Note that contrary to wg-quick's MTU setting, this does not take into account the current routes at the time of activation." />
-    <property name="peer-routes" name_upper="PEER_ROUTES" type="boolean" default="TRUE" description="Whether to automatically add routes for the AllowedIPs ranges of the peers. If TRUE (the default), NetworkManager will automatically add routes in the routing tables according to ipv4.route-table and ipv6.route-table. If FALSE, no such routes are added automatically. In this case, the user may want to configure static routes in ipv4.routes and ipv6.routes, respectively." />
+    <property name="peer-routes" name_upper="PEER_ROUTES" type="boolean" default="TRUE" description="Whether to automatically add routes for the AllowedIPs ranges of the peers. If TRUE (the default), NetworkManager will automatically add routes in the routing tables according to ipv4.route-table and ipv6.route-table. Usually you want this automatism enabled. If FALSE, no such routes are added automatically. In this case, the user may want to configure static routes in ipv4.routes and ipv6.routes, respectively. Note that if the peer's AllowedIPs is &quot;0.0.0.0/0&quot; or &quot;::/0&quot; and the profile's ipv4.never-default or ipv6.never-default setting is enabled, the peer route for this peer won't be added automatically." />
     <property name="peers" name_upper="PEERS" type="array of 'a{sv}'" description="Array of dictionaries for the WireGuard peers." />
     <property name="private-key" name_upper="PRIVATE_KEY" type="string" description="The 256 bit private-key in base64 encoding." />
     <property name="private-key-flags" name_upper="PRIVATE_KEY_FLAGS" type="NMSettingSecretFlags (uint32)" description="Flags indicating how to handle the &quot;private-key&quot; property." />
-- 
cgit 1.3.0-6-gf8a5