From 45e8e1149027529194982212c804c0468aa01d98 Mon Sep 17 00:00:00 2001
From: Michael Biebl <biebl@debian.org>
Date: Sat, 30 May 2020 00:23:54 +0200
Subject: New upstream version 1.24.2

---
 libnm/nm-property-docs.xml          |  8 ++++----
 libnm/nm-settings-docs.xml          |  8 ++++----
 libnm/nm-settings-ifcfg-rh-docs.xml | 11 ++++++-----
 3 files changed, 14 insertions(+), 13 deletions(-)

(limited to 'libnm')

diff --git a/libnm/nm-property-docs.xml b/libnm/nm-property-docs.xml
index a74cd22b..a7b663ce 100644
--- a/libnm/nm-property-docs.xml
+++ b/libnm/nm-property-docs.xml
@@ -36,10 +36,10 @@
     <property name="altsubject-matches" name_upper="ALTSUBJECT_MATCHES" type="array of string" description="List of strings to be matched against the altSubjectName of the certificate presented by the authentication server. If the list is empty, no verification of the server certificate's altSubjectName is performed." />
     <property name="anonymous-identity" name_upper="ANONYMOUS_IDENTITY" type="string" description="Anonymous identity string for EAP authentication methods.  Used as the unencrypted identity with EAP types that support different tunneled identity like EAP-TTLS." />
     <property name="auth-timeout" name_upper="AUTH_TIMEOUT" type="int32" default="0" description="A timeout for the authentication. Zero means the global default; if the global default is not set, the authentication timeout is 25 seconds." />
-    <property name="ca-cert" name_upper="CA_CERT" type="byte array" description="Contains the CA certificate if used by the EAP method specified in the &quot;eap&quot; property. Certificate data is specified using a &quot;scheme&quot;; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string &quot;file://&quot; and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended." />
+    <property name="ca-cert" name_upper="CA_CERT" type="byte array" description="Contains the CA certificate if used by the EAP method specified in the &quot;eap&quot; property. Certificate data is specified using a &quot;scheme&quot;; three are currently supported: blob, path and pkcs#11 URL. When using the blob scheme this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string &quot;file://&quot; and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended. Note that enabling NMSetting8021x:system-ca-certs will override this setting to use the built-in path, if the built-in path is not a directory." />
     <property name="ca-cert-password" name_upper="CA_CERT_PASSWORD" type="string" description="The password used to access the CA certificate stored in &quot;ca-cert&quot; property. Only makes sense if the certificate is stored on a PKCS#11 token that requires a login." />
     <property name="ca-cert-password-flags" name_upper="CA_CERT_PASSWORD_FLAGS" type="NMSettingSecretFlags (uint32)" description="Flags indicating how to handle the &quot;ca-cert-password&quot; property." />
-    <property name="ca-path" name_upper="CA_PATH" type="string" description="UTF-8 encoded path to a directory containing PEM or DER formatted certificates to be added to the verification chain in addition to the certificate specified in the &quot;ca-cert&quot; property." />
+    <property name="ca-path" name_upper="CA_PATH" type="string" description="UTF-8 encoded path to a directory containing PEM or DER formatted certificates to be added to the verification chain in addition to the certificate specified in the &quot;ca-cert&quot; property. If NMSetting8021x:system-ca-certs is enabled and the built-in CA path is an existing directory, then this setting is ignored." />
     <property name="client-cert" name_upper="CLIENT_CERT" type="byte array" description="Contains the client certificate if used by the EAP method specified in the &quot;eap&quot; property. Certificate data is specified using a &quot;scheme&quot;; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string &quot;file://&quot; and ending with a terminating NUL byte." />
     <property name="client-cert-password" name_upper="CLIENT_CERT_PASSWORD" type="string" description="The password used to access the client certificate stored in &quot;client-cert&quot; property. Only makes sense if the certificate is stored on a PKCS#11 token that requires a login." />
     <property name="client-cert-password-flags" name_upper="CLIENT_CERT_PASSWORD_FLAGS" type="NMSettingSecretFlags (uint32)" description="Flags indicating how to handle the &quot;client-cert-password&quot; property." />
@@ -60,10 +60,10 @@
     <property name="phase2-altsubject-matches" name_upper="PHASE2_ALTSUBJECT_MATCHES" type="array of string" description="List of strings to be matched against the altSubjectName of the certificate presented by the authentication server during the inner &quot;phase 2&quot; authentication. If the list is empty, no verification of the server certificate's altSubjectName is performed." />
     <property name="phase2-auth" name_upper="PHASE2_AUTH" type="string" description="Specifies the allowed &quot;phase 2&quot; inner non-EAP authentication method when an EAP method that uses an inner TLS tunnel is specified in the &quot;eap&quot; property.  Recognized non-EAP &quot;phase 2&quot; methods are &quot;pap&quot;, &quot;chap&quot;, &quot;mschap&quot;, &quot;mschapv2&quot;, &quot;gtc&quot;, &quot;otp&quot;, &quot;md5&quot;, and &quot;tls&quot;. Each &quot;phase 2&quot; inner method requires specific parameters for successful authentication; see the wpa_supplicant documentation for more details." />
     <property name="phase2-autheap" name_upper="PHASE2_AUTHEAP" type="string" description="Specifies the allowed &quot;phase 2&quot; inner EAP-based authentication method when an EAP method that uses an inner TLS tunnel is specified in the &quot;eap&quot; property.  Recognized EAP-based &quot;phase 2&quot; methods are &quot;md5&quot;, &quot;mschapv2&quot;, &quot;otp&quot;, &quot;gtc&quot;, and &quot;tls&quot;. Each &quot;phase 2&quot; inner method requires specific parameters for successful authentication; see the wpa_supplicant documentation for more details." />
-    <property name="phase2-ca-cert" name_upper="PHASE2_CA_CERT" type="byte array" description="Contains the &quot;phase 2&quot; CA certificate if used by the EAP method specified in the &quot;phase2-auth&quot; or &quot;phase2-autheap&quot; properties. Certificate data is specified using a &quot;scheme&quot;; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string &quot;file://&quot; and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended." />
+    <property name="phase2-ca-cert" name_upper="PHASE2_CA_CERT" type="byte array" description="Contains the &quot;phase 2&quot; CA certificate if used by the EAP method specified in the &quot;phase2-auth&quot; or &quot;phase2-autheap&quot; properties. Certificate data is specified using a &quot;scheme&quot;; three are currently supported: blob, path and pkcs#11 URL. When using the blob scheme this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string &quot;file://&quot; and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended. Note that enabling NMSetting8021x:system-ca-certs will override this setting to use the built-in path, if the built-in path is not a directory." />
     <property name="phase2-ca-cert-password" name_upper="PHASE2_CA_CERT_PASSWORD" type="string" description="The password used to access the &quot;phase2&quot; CA certificate stored in &quot;phase2-ca-cert&quot; property. Only makes sense if the certificate is stored on a PKCS#11 token that requires a login." />
     <property name="phase2-ca-cert-password-flags" name_upper="PHASE2_CA_CERT_PASSWORD_FLAGS" type="NMSettingSecretFlags (uint32)" description="Flags indicating how to handle the &quot;phase2-ca-cert-password&quot; property." />
-    <property name="phase2-ca-path" name_upper="PHASE2_CA_PATH" type="string" description="UTF-8 encoded path to a directory containing PEM or DER formatted certificates to be added to the verification chain in addition to the certificate specified in the &quot;phase2-ca-cert&quot; property." />
+    <property name="phase2-ca-path" name_upper="PHASE2_CA_PATH" type="string" description="UTF-8 encoded path to a directory containing PEM or DER formatted certificates to be added to the verification chain in addition to the certificate specified in the &quot;phase2-ca-cert&quot; property. If NMSetting8021x:system-ca-certs is enabled and the built-in CA path is an existing directory, then this setting is ignored." />
     <property name="phase2-client-cert" name_upper="PHASE2_CLIENT_CERT" type="byte array" description="Contains the &quot;phase 2&quot; client certificate if used by the EAP method specified in the &quot;phase2-auth&quot; or &quot;phase2-autheap&quot; properties. Certificate data is specified using a &quot;scheme&quot;; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string &quot;file://&quot; and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended." />
     <property name="phase2-client-cert-password" name_upper="PHASE2_CLIENT_CERT_PASSWORD" type="string" description="The password used to access the &quot;phase2&quot; client certificate stored in &quot;phase2-client-cert&quot; property. Only makes sense if the certificate is stored on a PKCS#11 token that requires a login." />
     <property name="phase2-client-cert-password-flags" name_upper="PHASE2_CLIENT_CERT_PASSWORD_FLAGS" type="NMSettingSecretFlags (uint32)" description="Flags indicating how to handle the &quot;phase2-client-cert-password&quot; property." />
diff --git a/libnm/nm-settings-docs.xml b/libnm/nm-settings-docs.xml
index df9ef110..20298684 100644
--- a/libnm/nm-settings-docs.xml
+++ b/libnm/nm-settings-docs.xml
@@ -36,10 +36,10 @@
     <property name="altsubject-matches" name_upper="ALTSUBJECT_MATCHES" type="array of string" description="List of strings to be matched against the altSubjectName of the certificate presented by the authentication server. If the list is empty, no verification of the server certificate's altSubjectName is performed." />
     <property name="anonymous-identity" name_upper="ANONYMOUS_IDENTITY" type="string" description="Anonymous identity string for EAP authentication methods.  Used as the unencrypted identity with EAP types that support different tunneled identity like EAP-TTLS." />
     <property name="auth-timeout" name_upper="AUTH_TIMEOUT" type="int32" default="0" description="A timeout for the authentication. Zero means the global default; if the global default is not set, the authentication timeout is 25 seconds." />
-    <property name="ca-cert" name_upper="CA_CERT" type="byte array" description="Contains the CA certificate if used by the EAP method specified in the &quot;eap&quot; property. Certificate data is specified using a &quot;scheme&quot;; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string &quot;file://&quot; and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended." />
+    <property name="ca-cert" name_upper="CA_CERT" type="byte array" description="Contains the CA certificate if used by the EAP method specified in the &quot;eap&quot; property. Certificate data is specified using a &quot;scheme&quot;; three are currently supported: blob, path and pkcs#11 URL. When using the blob scheme this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string &quot;file://&quot; and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended. Note that enabling NMSetting8021x:system-ca-certs will override this setting to use the built-in path, if the built-in path is not a directory." />
     <property name="ca-cert-password" name_upper="CA_CERT_PASSWORD" type="string" description="The password used to access the CA certificate stored in &quot;ca-cert&quot; property. Only makes sense if the certificate is stored on a PKCS#11 token that requires a login." />
     <property name="ca-cert-password-flags" name_upper="CA_CERT_PASSWORD_FLAGS" type="NMSettingSecretFlags (uint32)" description="Flags indicating how to handle the &quot;ca-cert-password&quot; property." />
-    <property name="ca-path" name_upper="CA_PATH" type="string" description="UTF-8 encoded path to a directory containing PEM or DER formatted certificates to be added to the verification chain in addition to the certificate specified in the &quot;ca-cert&quot; property." />
+    <property name="ca-path" name_upper="CA_PATH" type="string" description="UTF-8 encoded path to a directory containing PEM or DER formatted certificates to be added to the verification chain in addition to the certificate specified in the &quot;ca-cert&quot; property. If NMSetting8021x:system-ca-certs is enabled and the built-in CA path is an existing directory, then this setting is ignored." />
     <property name="client-cert" name_upper="CLIENT_CERT" type="byte array" description="Contains the client certificate if used by the EAP method specified in the &quot;eap&quot; property. Certificate data is specified using a &quot;scheme&quot;; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string &quot;file://&quot; and ending with a terminating NUL byte." />
     <property name="client-cert-password" name_upper="CLIENT_CERT_PASSWORD" type="string" description="The password used to access the client certificate stored in &quot;client-cert&quot; property. Only makes sense if the certificate is stored on a PKCS#11 token that requires a login." />
     <property name="client-cert-password-flags" name_upper="CLIENT_CERT_PASSWORD_FLAGS" type="NMSettingSecretFlags (uint32)" description="Flags indicating how to handle the &quot;client-cert-password&quot; property." />
@@ -60,10 +60,10 @@
     <property name="phase2-altsubject-matches" name_upper="PHASE2_ALTSUBJECT_MATCHES" type="array of string" description="List of strings to be matched against the altSubjectName of the certificate presented by the authentication server during the inner &quot;phase 2&quot; authentication. If the list is empty, no verification of the server certificate's altSubjectName is performed." />
     <property name="phase2-auth" name_upper="PHASE2_AUTH" type="string" description="Specifies the allowed &quot;phase 2&quot; inner non-EAP authentication method when an EAP method that uses an inner TLS tunnel is specified in the &quot;eap&quot; property.  Recognized non-EAP &quot;phase 2&quot; methods are &quot;pap&quot;, &quot;chap&quot;, &quot;mschap&quot;, &quot;mschapv2&quot;, &quot;gtc&quot;, &quot;otp&quot;, &quot;md5&quot;, and &quot;tls&quot;. Each &quot;phase 2&quot; inner method requires specific parameters for successful authentication; see the wpa_supplicant documentation for more details." />
     <property name="phase2-autheap" name_upper="PHASE2_AUTHEAP" type="string" description="Specifies the allowed &quot;phase 2&quot; inner EAP-based authentication method when an EAP method that uses an inner TLS tunnel is specified in the &quot;eap&quot; property.  Recognized EAP-based &quot;phase 2&quot; methods are &quot;md5&quot;, &quot;mschapv2&quot;, &quot;otp&quot;, &quot;gtc&quot;, and &quot;tls&quot;. Each &quot;phase 2&quot; inner method requires specific parameters for successful authentication; see the wpa_supplicant documentation for more details." />
-    <property name="phase2-ca-cert" name_upper="PHASE2_CA_CERT" type="byte array" description="Contains the &quot;phase 2&quot; CA certificate if used by the EAP method specified in the &quot;phase2-auth&quot; or &quot;phase2-autheap&quot; properties. Certificate data is specified using a &quot;scheme&quot;; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string &quot;file://&quot; and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended." />
+    <property name="phase2-ca-cert" name_upper="PHASE2_CA_CERT" type="byte array" description="Contains the &quot;phase 2&quot; CA certificate if used by the EAP method specified in the &quot;phase2-auth&quot; or &quot;phase2-autheap&quot; properties. Certificate data is specified using a &quot;scheme&quot;; three are currently supported: blob, path and pkcs#11 URL. When using the blob scheme this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string &quot;file://&quot; and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended. Note that enabling NMSetting8021x:system-ca-certs will override this setting to use the built-in path, if the built-in path is not a directory." />
     <property name="phase2-ca-cert-password" name_upper="PHASE2_CA_CERT_PASSWORD" type="string" description="The password used to access the &quot;phase2&quot; CA certificate stored in &quot;phase2-ca-cert&quot; property. Only makes sense if the certificate is stored on a PKCS#11 token that requires a login." />
     <property name="phase2-ca-cert-password-flags" name_upper="PHASE2_CA_CERT_PASSWORD_FLAGS" type="NMSettingSecretFlags (uint32)" description="Flags indicating how to handle the &quot;phase2-ca-cert-password&quot; property." />
-    <property name="phase2-ca-path" name_upper="PHASE2_CA_PATH" type="string" description="UTF-8 encoded path to a directory containing PEM or DER formatted certificates to be added to the verification chain in addition to the certificate specified in the &quot;phase2-ca-cert&quot; property." />
+    <property name="phase2-ca-path" name_upper="PHASE2_CA_PATH" type="string" description="UTF-8 encoded path to a directory containing PEM or DER formatted certificates to be added to the verification chain in addition to the certificate specified in the &quot;phase2-ca-cert&quot; property. If NMSetting8021x:system-ca-certs is enabled and the built-in CA path is an existing directory, then this setting is ignored." />
     <property name="phase2-client-cert" name_upper="PHASE2_CLIENT_CERT" type="byte array" description="Contains the &quot;phase 2&quot; client certificate if used by the EAP method specified in the &quot;phase2-auth&quot; or &quot;phase2-autheap&quot; properties. Certificate data is specified using a &quot;scheme&quot;; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string &quot;file://&quot; and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended." />
     <property name="phase2-client-cert-password" name_upper="PHASE2_CLIENT_CERT_PASSWORD" type="string" description="The password used to access the &quot;phase2&quot; client certificate stored in &quot;phase2-client-cert&quot; property. Only makes sense if the certificate is stored on a PKCS#11 token that requires a login." />
     <property name="phase2-client-cert-password-flags" name_upper="PHASE2_CLIENT_CERT_PASSWORD_FLAGS" type="NMSettingSecretFlags (uint32)" description="Flags indicating how to handle the &quot;phase2-client-cert-password&quot; property." />
diff --git a/libnm/nm-settings-ifcfg-rh-docs.xml b/libnm/nm-settings-ifcfg-rh-docs.xml
index fcc91bc3..c03738dd 100644
--- a/libnm/nm-settings-ifcfg-rh-docs.xml
+++ b/libnm/nm-settings-ifcfg-rh-docs.xml
@@ -11,7 +11,7 @@
 <property name="anonymous-identity" variable="IEEE_8021X_ANON_IDENTITY(+)" format="" values="" default="" example="" description="Anonymous identity for EAP authentication methods."/>
 <property name="pac-file" variable="IEEE_8021X_PAC_FILE(+)" format="" values="" default="" example="IEEE_8021X_PAC_FILE=/home/joe/my-fast.pac" description="File with PAC (Protected Access Credential) for EAP-FAST."/>
 <property name="ca-cert" variable="IEEE_8021X_CA_CERT(+)" format="" values="" default="" example="IEEE_8021X_CA_CERT=/home/joe/cacert.crt" description="CA certificate for EAP."/>
-<property name="ca-path" variable="(none)" format="" values="" default="" example="" description="The property is not handled by ifcfg-rh plugin."/>
+<property name="ca-path" variable="IEEE_8021X_CA_PATH(+)" format="" values="" default="" example="" description="The search path for the certificate."/>
 <property name="subject-match" variable="IEEE_8021X_SUBJECT_MATCH(+)" format="" values="" default="" example="IEEE_8021X_SUBJECT_MATCH=&quot;Red Hat&quot;" description="Substring to match subject of server certificate against."/>
 <property name="altsubject-matches" variable="IEEE_8021X_ALTSUBJECT_MATCHES(+)" format="" values="" default="" example="IEEE_8021X_ALTSUBJECT_MATCHES=&quot;s1.domain.cc&quot;" description="List of strings to be matched against the altSubjectName."/>
 <property name="domain-suffix-match" variable="IEEE_8021X_DOMAIN_SUFFIX_MATCH(+)" format="" values="" default="" example="" description="Suffix to match domain of server certificate against."/>
@@ -25,6 +25,7 @@
 can contain values both for &apos;phase2-auth&apos; and &apos;phase2-autheap&apos; properties."/>
 <property name="phase2-autheap" variable="IEEE_8021X_INNER_AUTH_METHODS(+)" format="" values="&quot;EAP-MD5&quot;, &quot;EAP-MSCHAPV2&quot;, &quot;EAP-GTC&quot;, &quot;EAP-OTP&quot; and &quot;EAP-TLS&quot;" default="" example="IEEE_8021X_INNER_AUTH_METHODS=&quot;MSCHAPV2 EAP-TLS&quot;" description="Inner EAP-based authentication methods. Note that
 IEEE_8021X_INNER_AUTH_METHODS is also used for &apos;phase2-auth&apos; values."/>
+<property name="phase2-ca-path" variable="IEEE_8021X_PHASE2_CA_PATH(+)" format="" values="" default="" example="" description="The search path for the certificate."/>
 <property name="phase2-subject-match" variable="IEEE_8021X_PHASE2_SUBJECT_MATCH(+)" format="" values="" default="" example="IEEE_8021X_PHASE2_SUBJECT_MATCH=&quot;Red Hat&quot;" description="Substring to match subject of server certificate against."/>
 <property name="phase2-altsubject-matches" variable="IEEE_8021X_PHASE2_ALTSUBJECT_MATCHES(+)" format="" values="" default="" example="" description=""/>
 <property name="phase2-domain-suffix-match" variable="IEEE_8021X_PHASE2_DOMAIN_SUFFIX_MATCH(+)" format="" values="" default="" example="" description="Suffix to match domain of server certificate for phase 2 against."/>
@@ -35,7 +36,7 @@ lookaside file, or it can be owned by a secret agent."/>
 <property name="password-flags" variable="IEEE_8021X_PASSWORD_FLAGS(+)" format="NMSettingSecretFlags" values="" default="" example="" description="Password flags for IEEE_8021X_PASSWORD password."/>
 <property name="password-raw" variable="IEEE_8021X_PASSWORD_RAW(+)" format="" values="" default="" example="IEEE_8021X_PASSWORD_RAW=041c8320083aa4bf" description="password used for EAP, encoded as a hexadecimal string. It
 can also go to &quot;key-&quot; lookaside file."/>
-<property name="password-raw-flags" variable="(none)" format="" values="" default="" example="" description="The property is not handled by ifcfg-rh plugin."/>
+<property name="password-raw-flags" variable="IEEE_8021X_PASSWORD_RAW_FLAGS(+)" format="" values="" default="" example="" description="The secret flags for password-raw."/>
 <property name="private-key" variable="IEEE_8021X_PRIVATE_KEY(+)" format="" values="" default="" example="IEEE_8021X_PRIVATE_KEY=/home/joe/mykey.p12" description="Private key for EAP-TLS."/>
 <property name="private-key-password" variable="IEEE_8021X_PRIVATE_KEY_PASSWORD(+)" format="" values="" default="" example="" description="Password for IEEE_8021X_PRIVATE_KEY. It can also go to &quot;key-&quot;
 lookaside file, or it can be owned by a secret agent."/>
@@ -44,9 +45,9 @@ lookaside file, or it can be owned by a secret agent."/>
 <property name="phase2-private-key-password" variable="IEEE_8021X_INNER_PRIVATE_KEY_PASSWORD(+)" format="" values="" default="" example="" description="Password for IEEE_8021X_INNER_PRIVATE_KEY. It can also go to &quot;key-&quot;
 lookaside file, or it can be owned by a secret agent."/>
 <property name="phase2-private-key-password-flags" variable="IEEE_8021X_INNER_PRIVATE_KEY_PASSWORD_FLAGS(+)" format="NMSettingSecretFlags" values="" default="" example="" description="Password flags for IEEE_8021X_INNER_PRIVATE_KEY_PASSWORD password."/>
-<property name="pin" variable="(none)" format="" values="" default="" example="" description="The property is not handled by ifcfg-rh plugin."/>
-<property name="pin-flags" variable="(none)" format="" values="" default="" example="" description="The property is not handled by ifcfg-rh plugin."/>
-<property name="system-ca-certs" variable="(none)" format="" values="" default="" example="" description="The property is not handled by ifcfg-rh plugin."/>
+<property name="pin" variable="IEEE_8021X_PIN(+)" format="" values="" default="" example="" description="The pin secret used for EAP authentication methods."/>
+<property name="pin-flags" variable="IEEE_8021X_PIN_FLAGS(+)" format="" values="" default="" example="" description="The secret flags for the pin property."/>
+<property name="system-ca-certs" variable="IEEE_8021X_SYSTEM_CA_CERTS(+)" format="" values="" default="" example="" description="a boolean value."/>
 <property name="auth-timeout" variable="IEEE_8021X_AUTH_TIMEOUT(+)" format="" values="" default="0" example="" description="Timeout in seconds for the 802.1X authentication. Zero means the global default or 25."/>
 <property name="optional" variable="IEEE_8021X_OPTIONAL(+)
 default=no" format="" values="" default="" example="" description="whether the 802.1X authentication is optional"/>
-- 
cgit 1.3.0-6-gf8a5