From 34bb501be08aa2b313d88e67d6e0a7e0a3f9cfa6 Mon Sep 17 00:00:00 2001
From: Michael Biebl <biebl@debian.org>
Date: Sun, 5 May 2024 00:07:30 +0200
Subject: New upstream version 1.47.90

---
 src/nmcli/README.md                             | 13 +++++++
 src/nmcli/common.h                              |  1 -
 src/nmcli/gen-metadata-nm-settings-nmcli.xml.in | 51 +++++++++++++++++++------
 src/nmcli/general.c                             | 11 +++++-
 src/nmcli/settings.c                            |  2 +-
 src/nmcli/utils.h                               |  1 +
 6 files changed, 64 insertions(+), 15 deletions(-)
 create mode 100644 src/nmcli/README.md

(limited to 'src/nmcli')

diff --git a/src/nmcli/README.md b/src/nmcli/README.md
new file mode 100644
index 00000000..a828a762
--- /dev/null
+++ b/src/nmcli/README.md
@@ -0,0 +1,13 @@
+nmcli
+=====
+
+The command line user interface of NetworkManager.
+It uses the D-Bus API of NetworkManager (via libnm).
+
+See:
+
+- `man 1 nmcli` ([[www]](https://networkmanager.dev/docs/api/latest/nmcli.html))
+- `man 7 nmcli-examples` ([[www]](https://networkmanager.dev/docs/api/latest/nmcli-examples.html))
+- `man 5 nm-settings-nmcli` ([[www]](https://networkmanager.dev/docs/api/latest/nm-settings-nmcli.html))
+
+Try also with bash-completion!
diff --git a/src/nmcli/common.h b/src/nmcli/common.h
index 1572c534..3784da35 100644
--- a/src/nmcli/common.h
+++ b/src/nmcli/common.h
@@ -81,5 +81,4 @@ extern const NmcMetaGenericInfo *const metagen_ip6_config[];
 extern const NmcMetaGenericInfo *const metagen_dhcp_config[];
 
 const char *nm_connectivity_to_string(NMConnectivityState connectivity);
-
 #endif /* NMC_COMMON_H */
diff --git a/src/nmcli/gen-metadata-nm-settings-nmcli.xml.in b/src/nmcli/gen-metadata-nm-settings-nmcli.xml.in
index 160ae32f..9008214d 100644
--- a/src/nmcli/gen-metadata-nm-settings-nmcli.xml.in
+++ b/src/nmcli/gen-metadata-nm-settings-nmcli.xml.in
@@ -58,6 +58,9 @@
         <property name="mac-address-blacklist"
                   nmcli-description="A list of permanent MAC addresses of Wi-Fi devices to which this connection should never apply.  Each MAC address should be given in the standard hex-digits-and-colons notation (eg &quot;00:11:22:33:44:55&quot;)."
                   format="list of MAC addresses" />
+        <property name="mac-address-denylist"
+                  nmcli-description="A list of permanent MAC addresses of Wi-Fi devices to which this connection should never apply.  Each MAC address should be given in the standard hex-digits-and-colons notation (eg &quot;00:11:22:33:44:55&quot;)."
+                  format="list of MAC addresses" />
         <property name="mac-address-randomization"
                   nmcli-description="One of &quot;default&quot; (0) (never randomize unless the user has set a global default to randomize and the supplicant supports randomization),  &quot;never&quot; (1) (never randomize the MAC address), or &quot;always&quot; (2) (always randomize the MAC address)."
                   format="choice (NMSettingMacRandomization)"
@@ -182,7 +185,7 @@
                   nmcli-description="UTF-8 encoded file path containing PAC for EAP-FAST."
                   format="string" />
         <property name="ca-cert"
-                  nmcli-description="Contains the CA certificate if used by the EAP method specified in the &quot;eap&quot; property. Certificate data is specified using a &quot;scheme&quot;; three are currently supported: blob, path and pkcs#11 URL. When using the blob scheme this property should be set to the certificate&apos;s DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string &quot;file://&quot; and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended. Note that enabling NMSetting8021x:system-ca-certs will override this setting to use the built-in path, if the built-in path is not a directory."
+                  nmcli-description="Contains the path to the CA certificate if used by the EAP method specified in the 802-1x.eap property. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended. Note that enabling 802-1x.system-ca-certs will override this setting to use the built-in path, if the built-in path is not a directory."
                   format="filesystem path" />
         <property name="ca-cert-password"
                   nmcli-description="The password used to access the CA certificate stored in &quot;ca-cert&quot; property. Only makes sense if the certificate is stored on a PKCS#11 token that requires a login."
@@ -207,7 +210,7 @@
                   nmcli-description="Constraint for server domain name. If set, this list of FQDNs is used as a match requirement for dNSName element(s) of the certificate presented by the authentication server.  If a matching dNSName is found, this constraint is met.  If no dNSName values are present, this constraint is matched against SubjectName CN using the same comparison. Multiple valid FQDNs can be passed as a &quot;;&quot; delimited list."
                   format="string" />
         <property name="client-cert"
-                  nmcli-description="Contains the client certificate if used by the EAP method specified in the &quot;eap&quot; property. Certificate data is specified using a &quot;scheme&quot;; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate&apos;s DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string &quot;file://&quot; and ending with a terminating NUL byte."
+                  nmcli-description="Contains the path to the client certificate if used by the EAP method specified in the 802-1x.eap property."
                   format="filesystem path" />
         <property name="client-cert-password"
                   nmcli-description="The password used to access the client certificate stored in &quot;client-cert&quot; property. Only makes sense if the certificate is stored on a PKCS#11 token that requires a login."
@@ -241,7 +244,7 @@
                   format="string"
                   values="md5, mschapv2, otp, gtc, tls" />
         <property name="phase2-ca-cert"
-                  nmcli-description="Contains the &quot;phase 2&quot; CA certificate if used by the EAP method specified in the &quot;phase2-auth&quot; or &quot;phase2-autheap&quot; properties. Certificate data is specified using a &quot;scheme&quot;; three are currently supported: blob, path and pkcs#11 URL. When using the blob scheme this property should be set to the certificate&apos;s DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string &quot;file://&quot; and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended. Note that enabling NMSetting8021x:system-ca-certs will override this setting to use the built-in path, if the built-in path is not a directory."
+                  nmcli-description="Contains the path to the &quot;phase 2&quot; CA certificate if used by the EAP method specified in the 802-1x.phase2-auth or 802-1x.phase2-autheap properties. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended. Note that enabling 802-1x.system-ca-certs will override this setting to use the built-in path, if the built-in path is not a directory."
                   format="filesystem path" />
         <property name="phase2-ca-cert-password"
                   nmcli-description="The password used to access the &quot;phase2&quot; CA certificate stored in &quot;phase2-ca-cert&quot; property. Only makes sense if the certificate is stored on a PKCS#11 token that requires a login."
@@ -266,7 +269,7 @@
                   nmcli-description="Constraint for server domain name. If set, this list of FQDNs is used as a match requirement for dNSName element(s) of the certificate presented by the authentication server during the inner &quot;phase 2&quot; authentication. If a matching dNSName is found, this constraint is met.  If no dNSName values are present, this constraint is matched against SubjectName CN using the same comparison. Multiple valid FQDNs can be passed as a &quot;;&quot; delimited list."
                   format="string" />
         <property name="phase2-client-cert"
-                  nmcli-description="Contains the &quot;phase 2&quot; client certificate if used by the EAP method specified in the &quot;phase2-auth&quot; or &quot;phase2-autheap&quot; properties. Certificate data is specified using a &quot;scheme&quot;; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate&apos;s DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string &quot;file://&quot; and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended."
+                  nmcli-description="Contains the path to the &quot;phase 2&quot; client certificate if used by the EAP method specified in the 802-1x.phase2-auth or 802-1x.phase2-autheap properties."
                   format="filesystem path" />
         <property name="phase2-client-cert-password"
                   nmcli-description="The password used to access the &quot;phase2&quot; client certificate stored in &quot;phase2-client-cert&quot; property. Only makes sense if the certificate is stored on a PKCS#11 token that requires a login."
@@ -290,20 +293,20 @@
                   format="flags (NMSettingSecretFlags)"
                   values="none (0x0), agent-owned (0x1), not-saved (0x2), not-required (0x4)" />
         <property name="private-key"
-                  nmcli-description="Contains the private key when the &quot;eap&quot; property is set to &quot;tls&quot;. Key data is specified using a &quot;scheme&quot;; two are currently supported: blob and path. When using the blob scheme and private keys, this property should be set to the key&apos;s encrypted PEM encoded data. When using private keys with the path scheme, this property should be set to the full UTF-8 encoded path of the key, prefixed with the string &quot;file://&quot; and ending with a terminating NUL byte. When using PKCS#12 format private keys and the blob scheme, this property should be set to the PKCS#12 data and the &quot;private-key-password&quot; property must be set to password used to decrypt the PKCS#12 certificate and key. When using PKCS#12 files and the path scheme, this property should be set to the full UTF-8 encoded path of the key, prefixed with the string &quot;file://&quot; and ending with a terminating NUL byte, and as with the blob scheme the &quot;private-key-password&quot; property must be set to the password used to decode the PKCS#12 private key and certificate. WARNING: &quot;private-key&quot; is not a &quot;secret&quot; property, and thus unencrypted private key data using the BLOB scheme may be readable by unprivileged users.  Private keys should always be encrypted with a private key password to prevent unauthorized access to unencrypted private key data."
+                  nmcli-description="The path to the private key when the 802-1.eap property is set to &quot;tls&quot;."
                   format="filesystem path" />
         <property name="private-key-password"
-                  nmcli-description="The password used to decrypt the private key specified in the &quot;private-key&quot; property when the private key either uses the path scheme, or if the private key is a PKCS#12 format key."
+                  nmcli-description="The password used to decrypt the private key specified in the 802-1x.private-key property. This is normally used by secret agents, not directly by users."
                   format="string" />
         <property name="private-key-password-flags"
                   nmcli-description="Flags indicating how to handle the &quot;private-key-password&quot; property."
                   format="flags (NMSettingSecretFlags)"
                   values="none (0x0), agent-owned (0x1), not-saved (0x2), not-required (0x4)" />
         <property name="phase2-private-key"
-                  nmcli-description="Contains the &quot;phase 2&quot; inner private key when the &quot;phase2-auth&quot; or &quot;phase2-autheap&quot; property is set to &quot;tls&quot;. Key data is specified using a &quot;scheme&quot;; two are currently supported: blob and path. When using the blob scheme and private keys, this property should be set to the key&apos;s encrypted PEM encoded data. When using private keys with the path scheme, this property should be set to the full UTF-8 encoded path of the key, prefixed with the string &quot;file://&quot; and ending with a terminating NUL byte. When using PKCS#12 format private keys and the blob scheme, this property should be set to the PKCS#12 data and the &quot;phase2-private-key-password&quot; property must be set to password used to decrypt the PKCS#12 certificate and key. When using PKCS#12 files and the path scheme, this property should be set to the full UTF-8 encoded path of the key, prefixed with the string &quot;file://&quot; and ending with a terminating NUL byte, and as with the blob scheme the &quot;phase2-private-key-password&quot; property must be set to the password used to decode the PKCS#12 private key and certificate."
+                  nmcli-description="The path to the &quot;phase 2&quot; inner private key when the 802-1x.phase2-auth or 802-1x.phase2-autheap property is set to &quot;tls&quot;."
                   format="filesystem path" />
         <property name="phase2-private-key-password"
-                  nmcli-description="The password used to decrypt the &quot;phase 2&quot; private key specified in the &quot;phase2-private-key&quot; property when the private key either uses the path scheme, or is a PKCS#12 format key."
+                  nmcli-description="The password used to decrypt the &quot;phase 2&quot; private key specified in the 802-1x.phase2-private-key property. This is normally used by secret agents, not directly by users."
                   format="string" />
         <property name="phase2-private-key-password-flags"
                   nmcli-description="Flags indicating how to handle the &quot;phase2-private-key-password&quot; property."
@@ -324,6 +327,9 @@
                   nmcli-description="A timeout for the authentication. Zero means the global default; if the global default is not set, the authentication timeout is 25 seconds."
                   format="integer"
                   values="0 - 2147483647" />
+        <property name="openssl-ciphers"
+                  nmcli-description="Define openssl_ciphers for wpa_supplicant. Openssl sometimes moves ciphers among SECLEVELs, thus compiled-in default value in wpa_supplicant (as modified by some linux distributions) sometimes prevents to connect to old servers that do not support new protocols."
+                  format="string" />
     </setting>
     <setting name="802-3-ethernet"
              alias="ethernet" >
@@ -357,6 +363,9 @@
         <property name="mac-address-blacklist"
                   nmcli-description="If specified, this connection will never apply to the Ethernet device whose permanent MAC address matches an address in the list.  Each MAC address is in the standard hex-digits-and-colons notation (00:11:22:33:44:55)."
                   format="list of MAC addresses" />
+        <property name="mac-address-denylist"
+                  nmcli-description="If specified, this connection will never apply to the Ethernet device whose permanent MAC address matches an address in the list.  Each MAC address is in the standard hex-digits-and-colons notation (00:11:22:33:44:55)."
+                  format="list of MAC addresses" />
         <property name="mtu"
                   alias="mtu"
                   nmcli-description="If non-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple Ethernet frames."
@@ -671,13 +680,17 @@
                   format="string"
                   values="bond, bridge, ovs-bridge, ovs-port, team, vrf" />
         <property name="autoconnect-slaves"
-                  nmcli-description="Whether or not slaves of this connection should be automatically brought up when NetworkManager activates this connection. This only has a real effect for master connections. The properties &quot;autoconnect&quot;, &quot;autoconnect-priority&quot; and &quot;autoconnect-retries&quot; are unrelated to this setting. The permitted values are: 0: leave slave connections untouched, 1: activate all the slave connections with this connection, -1: default. If -1 (default) is set, global connection.autoconnect-slaves is read to determine the real value. If it is default as well, this fallbacks to 0."
+                  nmcli-description="Whether or not slaves of this connection should be automatically brought up when NetworkManager activates this connection. This only has a real effect for master connections. The properties &quot;autoconnect&quot;, &quot;autoconnect-priority&quot; and &quot;autoconnect-retries&quot; are unrelated to this setting. The permitted values are: 0: leave slave connections untouched, 1: activate all the slave connections with this connection, -1: default. If -1 (default) is set, global connection.autoconnect-slaves is read to determine the real value. If it is default as well, this fallbacks to 0. Deprecated 1.46. Use &quot;autoconnect-ports&quot; instead, this is just an alias."
                   format="choice (NMSettingConnectionAutoconnectSlaves)"
                   values="default (-1), no (0), yes (1)" />
         <property name="autoconnect-ports"
                   nmcli-description="Whether or not ports of this connection should be automatically brought up when NetworkManager activates this connection. This only has a real effect for controller connections. The properties &quot;autoconnect&quot;, &quot;autoconnect-priority&quot; and &quot;autoconnect-retries&quot; are unrelated to this setting. The permitted values are: 0: leave port connections untouched, 1: activate all the port connections with this connection, -1: default. If -1 (default) is set, global connection.autoconnect-ports is read to determine the real value. If it is default as well, this fallbacks to 0."
                   format="choice (NMTernary)"
                   values="default (-1), false (0), true (1)" />
+        <property name="down-on-poweroff"
+                  nmcli-description="Whether the connection will be brought down before the system is powered off.  The default value is &quot;default&quot; (-1). When the default value is specified, then the global value from NetworkManager configuration is looked up, if not set, it is considered as &quot;no&quot; (0)."
+                  format="ternary"
+                  values="true/yes/on, false/no/off, default/unknown" />
         <property name="secondaries"
                   nmcli-description="List of connection UUIDs that should be activated when the base connection itself is activated. Currently, only VPN connections are supported."
                   format="list of strings" />
@@ -694,7 +707,7 @@
                   format="choice (NMSettingConnectionLldp)"
                   values="default (-1), disable (0), enable-rx/enable (1)" />
         <property name="mdns"
-                  nmcli-description="Whether mDNS is enabled for the connection. The permitted values are: &quot;yes&quot; (2) register hostname and resolving for the connection, &quot;no&quot; (0) disable mDNS for the interface, &quot;resolve&quot; (1) do not register hostname but allow resolving of mDNS host names and &quot;default&quot; (-1) to allow lookup of a global default in NetworkManager.conf. If unspecified, &quot;default&quot; ultimately depends on the DNS plugin (which for systemd-resolved currently means &quot;no&quot;). This feature requires a plugin which supports mDNS. Otherwise, the setting has no effect. One such plugin is dns-systemd-resolved."
+                  nmcli-description="Whether mDNS is enabled for the connection. The permitted values are: &quot;yes&quot; (2) register hostname and resolving for the connection, &quot;no&quot; (0) disable mDNS for the interface, &quot;resolve&quot; (1) do not register hostname but allow resolving of mDNS host names and &quot;default&quot; (-1) to allow lookup of a global default in NetworkManager.conf. If unspecified, &quot;default&quot; ultimately depends on the DNS plugin. This feature requires a plugin which supports mDNS. Otherwise, the setting has no effect. Currently the only supported DNS plugin is systemd-resolved. For systemd-resolved, the default is configurable via MulticastDNS= setting in resolved.conf."
                   format="choice (NMSettingConnectionMdns)"
                   values="default (-1), no (0), resolve (1), yes (2)" />
         <property name="llmnr"
@@ -1297,6 +1310,10 @@
                   nmcli-description="Connections will default to keep the autogenerated priority 0 local rule unless this setting is set to TRUE."
                   format="ternary"
                   values="true/yes/on, false/no/off, default/unknown" />
+        <property name="dhcp-send-release"
+                  nmcli-description="Whether the DHCP client will send RELEASE message when bringing the connection down. The default value is &quot;default&quot; (-1). When the default value is specified, then the global value from NetworkManager configuration is looked up, if not set, it is considered as FALSE."
+                  format="ternary"
+                  values="true/yes/on, false/no/off, default/unknown" />
         <property name="ignore-auto-routes"
                   nmcli-description="When &quot;method&quot; is set to &quot;auto&quot; and this property to TRUE, automatically configured routes are ignored and only routes specified in the &quot;routes&quot; property, if any, are used."
                   format="boolean"
@@ -1411,6 +1428,10 @@
                   nmcli-description="Connections will default to keep the autogenerated priority 0 local rule unless this setting is set to TRUE."
                   format="ternary"
                   values="true/yes/on, false/no/off, default/unknown" />
+        <property name="dhcp-send-release"
+                  nmcli-description="Whether the DHCP client will send RELEASE message when bringing the connection down. The default value is &quot;default&quot; (-1). When the default value is specified, then the global value from NetworkManager configuration is looked up, if not set, it is considered as FALSE."
+                  format="ternary"
+                  values="true/yes/on, false/no/off, default/unknown" />
         <property name="ignore-auto-routes"
                   nmcli-description="When &quot;method&quot; is set to &quot;auto&quot; and this property to TRUE, automatically configured routes are ignored and only routes specified in the &quot;routes&quot; property, if any, are used."
                   format="boolean"
@@ -1433,9 +1454,17 @@
                   values="-1 - 2147483647"
                   special-values="default (-1), infinity (2147483647)" />
         <property name="ip6-privacy"
-                  nmcli-description="Configure IPv6 Privacy Extensions for SLAAC, described in RFC4941.  If enabled, it makes the kernel generate a temporary IPv6 address in addition to the public one generated from MAC address via modified EUI-64.  This enhances privacy, but could cause problems in some applications, on the other hand.  The permitted values are: -1: unknown, 0: disabled, 1: enabled (prefer public address), 2: enabled (prefer temporary addresses). Having a per-connection setting set to &quot;-1&quot; (unknown) means fallback to global configuration &quot;ipv6.ip6-privacy&quot;. If also global configuration is unspecified or set to &quot;-1&quot;, fallback to read &quot;/proc/sys/net/ipv6/conf/default/use_tempaddr&quot;. Note that this setting is distinct from the Stable Privacy addresses that can be enabled with the &quot;addr-gen-mode&quot; property&apos;s &quot;stable-privacy&quot; setting as another way of avoiding host tracking with IPv6 addresses."
+                  nmcli-description="Configure IPv6 Privacy Extensions for SLAAC, described in RFC4941.  If enabled, it makes the kernel generate a temporary IPv6 address in addition to the public one generated from MAC address via modified EUI-64.  This enhances privacy, but could cause problems in some applications, on the other hand.  The permitted values are: -1: unknown, 0: disabled, 1: enabled (prefer public address), 2: enabled (prefer temporary addresses). If set to &quot;-1&quot; (unknown) for a connection, the value is taken from the global &quot;ipv6.ip6-privacy&quot; setting. If the global setting is unspecified or also set to &quot;-1&quot;, the value is set from the original value of &quot;/proc/sys/net/ipv6/conf/&lt;iface&gt;/use_tempaddr&quot; from before NetworkManager started. Note that this setting is distinct from the Stable Privacy addresses that can be enabled with the &quot;addr-gen-mode&quot; property&apos;s &quot;stable-privacy&quot; setting as another way of avoiding host tracking with IPv6 addresses."
                   format="choice (NMSettingIP6ConfigPrivacy)"
                   values="unknown (-1), disabled (0), prefer-public-addr (1), prefer-temp-addr (2)" />
+        <property name="temp-valid-lifetime"
+                  nmcli-description="The valid lifetime of autogenerated temporary addresses, in seconds. If set to &quot;0&quot; (unknown) for a connection, the value is taken from the global &quot;ipv6.temp-valid-lifetime&quot; setting. If the global setting is unspecified or also set to &quot;0&quot;, the value is set from the original value of &quot;/proc/sys/net/ipv6/conf/&lt;iface&gt;/temp_valid_lft&quot; from before NetworkManager started."
+                  format="integer"
+                  values="0 - 2147483647" />
+        <property name="temp-preferred-lifetime"
+                  nmcli-description="The preferred lifetime of autogenerated temporary addresses, in seconds. If set to &quot;0&quot; (unknown) for a connection, the value is taken from the global &quot;ipv6.temp-preferred-lifetime&quot; setting. If the global setting is unspecified or also set to &quot;0&quot;, the value is set from the original value of &quot;/proc/sys/net/ipv6/conf/&lt;iface&gt;/temp_prefered_lft&quot; from before NetworkManager started."
+                  format="integer"
+                  values="0 - 2147483647" />
         <property name="addr-gen-mode"
                   nmcli-description="Configure method for creating the IPv6 interface identifer of addresses with RFC4862 IPv6 Stateless Address Autoconfiguration and Link Local addresses. The permitted values are: &quot;eui64&quot; (0), &quot;stable-privacy&quot; (1), &quot;default&quot; (3) or &quot;default-or-eui64&quot; (2). If the property is set to &quot;eui64&quot;, the addresses will be generated using the interface token derived from hardware address. This makes the host part of the address to stay constant, making it possible to track the host&apos;s presence when it changes networks. The address changes when the interface hardware is replaced. If a duplicate address is detected, there is also no fallback to generate another address. When configured, the &quot;ipv6.token&quot; is used instead of the MAC address to generate addresses for stateless autoconfiguration. If the property is set to &quot;stable-privacy&quot;, the interface identifier is generated as specified by RFC7217. This works by hashing a host specific key (see NetworkManager(8) manual), the interface name, the connection&apos;s &quot;connection.stable-id&quot; property and the address prefix.  This improves privacy by making it harder to use the address to track the host&apos;s presence and the address is stable when the network interface hardware is replaced. The special values &quot;default&quot; and &quot;default-or-eui64&quot; will fallback to the global connection default as documented in the NetworkManager.conf(5) manual. If the global default is not specified, the fallback value is &quot;stable-privacy&quot; or &quot;eui64&quot;, respectively. If not specified, when creating a new profile the default is &quot;default&quot;. Note that this setting is distinct from the Privacy Extensions as configured by &quot;ip6-privacy&quot; property and it does not affect the temporary addresses configured with this option."
                   format="choice (NMSettingIP6ConfigAddrGenMode)"
diff --git a/src/nmcli/general.c b/src/nmcli/general.c
index 6fc8184c..adb3e745 100644
--- a/src/nmcli/general.c
+++ b/src/nmcli/general.c
@@ -116,6 +116,7 @@ _metagen_general_status_get_fcn(NMC_META_GENERIC_INFO_GET_FCN_ARGS)
     gboolean            v_bool;
     NMState             state;
     NMConnectivityState connectivity;
+    NMMetered           metered;
 
     switch (info->info_type) {
     case NMC_GENERIC_INFO_TYPE_GENERAL_STATUS_RUNNING:
@@ -170,6 +171,11 @@ _metagen_general_status_get_fcn(NMC_META_GENERIC_INFO_GET_FCN_ARGS)
     case NMC_GENERIC_INFO_TYPE_GENERAL_STATUS_WIMAX:
         /* deprecated fields. Don't return anything. */
         return NULL;
+    case NMC_GENERIC_INFO_TYPE_GENERAL_STATUS_METERED:
+        metered = nm_client_get_metered(nmc->client);
+        NMC_HANDLE_COLOR(NM_META_COLOR_NONE);
+        value = nmc_device_metered_to_string(metered);
+        goto translate_and_out;
     default:
         break;
     }
@@ -206,12 +212,13 @@ static const NmcMetaGenericInfo
         _METAGEN_GENERAL_STATUS(NMC_GENERIC_INFO_TYPE_GENERAL_STATUS_WWAN, "WWAN"),
         _METAGEN_GENERAL_STATUS(NMC_GENERIC_INFO_TYPE_GENERAL_STATUS_WIMAX_HW, "WIMAX-HW"),
         _METAGEN_GENERAL_STATUS(NMC_GENERIC_INFO_TYPE_GENERAL_STATUS_WIMAX, "WIMAX"),
+        _METAGEN_GENERAL_STATUS(NMC_GENERIC_INFO_TYPE_GENERAL_STATUS_METERED, "METERED"),
 };
 #define NMC_FIELDS_NM_STATUS_ALL \
-    "RUNNING,VERSION,STATE,STARTUP,CONNECTIVITY,NETWORKING,WIFI-HW,WIFI,WWAN-HW,WWAN"
+    "RUNNING,VERSION,STATE,STARTUP,CONNECTIVITY,NETWORKING,WIFI-HW,WIFI,WWAN-HW,WWAN,METERED"
 #define NMC_FIELDS_NM_STATUS_SWITCH "NETWORKING,WIFI-HW,WIFI,WWAN-HW,WWAN"
 #define NMC_FIELDS_NM_STATUS_RADIO  "WIFI-HW,WIFI,WWAN-HW,WWAN"
-#define NMC_FIELDS_NM_STATUS_COMMON "STATE,CONNECTIVITY,WIFI-HW,WIFI,WWAN-HW,WWAN"
+#define NMC_FIELDS_NM_STATUS_COMMON "STATE,CONNECTIVITY,WIFI-HW,WIFI,WWAN-HW,WWAN,METERED"
 #define NMC_FIELDS_NM_NETWORKING    "NETWORKING"
 #define NMC_FIELDS_NM_WIFI          "WIFI"
 #define NMC_FIELDS_NM_WWAN          "WWAN"
diff --git a/src/nmcli/settings.c b/src/nmcli/settings.c
index d6691125..636df466 100644
--- a/src/nmcli/settings.c
+++ b/src/nmcli/settings.c
@@ -261,7 +261,7 @@ connection_controller_changed_cb(GObject *object, GParamSpec *pspec, gpointer us
     NMSetting           *s_ipv4, *s_ipv6;
     const char          *value, *tmp_str;
 
-    value = nm_setting_connection_get_master(s_con);
+    value = nm_setting_connection_get_controller(s_con);
     if (value) {
         s_ipv4 = nm_connection_get_setting_by_name(connection, NM_SETTING_IP4_CONFIG_SETTING_NAME);
         s_ipv6 = nm_connection_get_setting_by_name(connection, NM_SETTING_IP6_CONFIG_SETTING_NAME);
diff --git a/src/nmcli/utils.h b/src/nmcli/utils.h
index 2f7617b9..b68a3803 100644
--- a/src/nmcli/utils.h
+++ b/src/nmcli/utils.h
@@ -93,6 +93,7 @@ typedef enum {
     NMC_GENERIC_INFO_TYPE_GENERAL_STATUS_WWAN,
     NMC_GENERIC_INFO_TYPE_GENERAL_STATUS_WIMAX_HW,
     NMC_GENERIC_INFO_TYPE_GENERAL_STATUS_WIMAX,
+    NMC_GENERIC_INFO_TYPE_GENERAL_STATUS_METERED,
     _NMC_GENERIC_INFO_TYPE_GENERAL_STATUS_NUM,
 
     NMC_GENERIC_INFO_TYPE_GENERAL_PERMISSIONS_PERMISSION = 0,
-- 
cgit 1.3.0-6-gf8a5