NMSetting8021x

typedef struct _NMSetting8021x NMSetting8021x;

enum NMSetting8021xCKFormat

typedef enum {
	NM_SETTING_802_1X_CK_FORMAT_UNKNOWN = 0,
	NM_SETTING_802_1X_CK_FORMAT_X509,
	NM_SETTING_802_1X_CK_FORMAT_RAW_KEY,
	NM_SETTING_802_1X_CK_FORMAT_PKCS12
} NMSetting8021xCKFormat;

NMSetting8021xCKFormat values indicate the general type of a certificate or private key

enum NMSetting8021xCKScheme

typedef enum {
	NM_SETTING_802_1X_CK_SCHEME_UNKNOWN = 0,
	NM_SETTING_802_1X_CK_SCHEME_BLOB,
	NM_SETTING_802_1X_CK_SCHEME_PATH
} NMSetting8021xCKScheme;

NMSetting8021xCKScheme values indicate how a certificate or private key is stored in the setting properties, either as a blob of the item's data, or as a path to a certificate or private key file on the filesystem

NMSetting8021xClass

typedef struct {
	NMSettingClass parent;

	/* Padding for future expansion */
	void (*_reserved1) (void);
	void (*_reserved2) (void);
	void (*_reserved3) (void);
	void (*_reserved4) (void);
} NMSetting8021xClass;

enum NMSetting8021xError

typedef enum {
	NM_SETTING_802_1X_ERROR_UNKNOWN = 0,
	NM_SETTING_802_1X_ERROR_INVALID_PROPERTY,
	NM_SETTING_802_1X_ERROR_MISSING_PROPERTY
} NMSetting8021xError;

NM_SETTING_802_1X_ALTSUBJECT_MATCHES

#define NM_SETTING_802_1X_ALTSUBJECT_MATCHES "altsubject-matches"

NM_SETTING_802_1X_ANONYMOUS_IDENTITY

#define NM_SETTING_802_1X_ANONYMOUS_IDENTITY "anonymous-identity"

NM_SETTING_802_1X_CA_CERT

#define NM_SETTING_802_1X_CA_CERT "ca-cert"

NM_SETTING_802_1X_CA_PATH

#define NM_SETTING_802_1X_CA_PATH "ca-path"

NM_SETTING_802_1X_CLIENT_CERT

#define NM_SETTING_802_1X_CLIENT_CERT "client-cert"

NM_SETTING_802_1X_EAP

#define NM_SETTING_802_1X_EAP "eap"

NM_SETTING_802_1X_IDENTITY

#define NM_SETTING_802_1X_IDENTITY "identity"

NM_SETTING_802_1X_PASSWORD

#define NM_SETTING_802_1X_PASSWORD "password"

NM_SETTING_802_1X_PASSWORD_FLAGS

#define NM_SETTING_802_1X_PASSWORD_FLAGS "password-flags"

NM_SETTING_802_1X_PHASE1_FAST_PROVISIONING

#define NM_SETTING_802_1X_PHASE1_FAST_PROVISIONING "phase1-fast-provisioning"

NM_SETTING_802_1X_PHASE1_PEAPLABEL

#define NM_SETTING_802_1X_PHASE1_PEAPLABEL "phase1-peaplabel"

NM_SETTING_802_1X_PHASE1_PEAPVER

#define NM_SETTING_802_1X_PHASE1_PEAPVER "phase1-peapver"

NM_SETTING_802_1X_PHASE2_ALTSUBJECT_MATCHES

#define NM_SETTING_802_1X_PHASE2_ALTSUBJECT_MATCHES "phase2-altsubject-matches"

NM_SETTING_802_1X_PHASE2_AUTH

#define NM_SETTING_802_1X_PHASE2_AUTH "phase2-auth"

NM_SETTING_802_1X_PHASE2_AUTHEAP

#define NM_SETTING_802_1X_PHASE2_AUTHEAP "phase2-autheap"

NM_SETTING_802_1X_PHASE2_CA_CERT

#define NM_SETTING_802_1X_PHASE2_CA_CERT "phase2-ca-cert"

NM_SETTING_802_1X_PHASE2_CA_PATH

#define NM_SETTING_802_1X_PHASE2_CA_PATH "phase2-ca-path"

NM_SETTING_802_1X_PHASE2_CLIENT_CERT

#define NM_SETTING_802_1X_PHASE2_CLIENT_CERT "phase2-client-cert"

NM_SETTING_802_1X_PHASE2_PRIVATE_KEY

#define NM_SETTING_802_1X_PHASE2_PRIVATE_KEY "phase2-private-key"

NM_SETTING_802_1X_PHASE2_PRIVATE_KEY_PASSWORD

#define NM_SETTING_802_1X_PHASE2_PRIVATE_KEY_PASSWORD "phase2-private-key-password"

NM_SETTING_802_1X_PHASE2_PRIVATE_KEY_PASSWORD_FLAGS

#define NM_SETTING_802_1X_PHASE2_PRIVATE_KEY_PASSWORD_FLAGS "phase2-private-key-password-flags"

NM_SETTING_802_1X_PHASE2_SUBJECT_MATCH

#define NM_SETTING_802_1X_PHASE2_SUBJECT_MATCH "phase2-subject-match"

NM_SETTING_802_1X_PIN

#define NM_SETTING_802_1X_PIN "pin"

NM_SETTING_802_1X_PIN_FLAGS

#define NM_SETTING_802_1X_PIN_FLAGS "pin-flags"

NM_SETTING_802_1X_PRIVATE_KEY

#define NM_SETTING_802_1X_PRIVATE_KEY "private-key"

NM_SETTING_802_1X_PRIVATE_KEY_PASSWORD

#define NM_SETTING_802_1X_PRIVATE_KEY_PASSWORD "private-key-password"

NM_SETTING_802_1X_PRIVATE_KEY_PASSWORD_FLAGS

#define NM_SETTING_802_1X_PRIVATE_KEY_PASSWORD_FLAGS "private-key-password-flags"

NM_SETTING_802_1X_SETTING_NAME

#define NM_SETTING_802_1X_SETTING_NAME "802-1x"

NM_SETTING_802_1X_SUBJECT_MATCH

#define NM_SETTING_802_1X_SUBJECT_MATCH "subject-match"

NM_SETTING_802_1X_SYSTEM_CA_CERTS

#define NM_SETTING_802_1X_SYSTEM_CA_CERTS "system-ca-certs"

nm_setting_802_1x_add_altsubject_match ()

gboolean            nm_setting_802_1x_add_altsubject_match
                                                        (NMSetting8021x *setting,
                                                         const char *altsubject_match);

Adds an allowed alternate subject name match. Until at least one match is added, the altSubjectName of the remote authentication server is not verified.

nm_setting_802_1x_add_eap_method ()

gboolean            nm_setting_802_1x_add_eap_method    (NMSetting8021x *setting,
                                                         const char *eap);

Adds an allowed EAP method. The setting is not valid until at least one EAP method has been added. See "eap" property for a list of allowed EAP methods.

nm_setting_802_1x_add_phase2_altsubject_match ()

gboolean            nm_setting_802_1x_add_phase2_altsubject_match
                                                        (NMSetting8021x *setting,
                                                         const char *phase2_altsubject_match);

Adds an allowed alternate subject name match for "phase 2". Until at least one match is added, the altSubjectName of the "phase 2" remote authentication server is not verified.

nm_setting_802_1x_clear_altsubject_matches ()

void                nm_setting_802_1x_clear_altsubject_matches
                                                        (NMSetting8021x *setting);

Clears all altSubjectName matches.

nm_setting_802_1x_clear_eap_methods ()

void                nm_setting_802_1x_clear_eap_methods (NMSetting8021x *setting);

Clears all allowed EAP methods.

nm_setting_802_1x_clear_phase2_altsubject_matches ()

void                nm_setting_802_1x_clear_phase2_altsubject_matches
                                                        (NMSetting8021x *setting);

Clears all "phase 2" altSubjectName matches.

nm_setting_802_1x_error_quark ()

GQuark              nm_setting_802_1x_error_quark       (void);

Registers an error quark for NMSetting8021x if necessary.

nm_setting_802_1x_get_altsubject_match ()

const char *        nm_setting_802_1x_get_altsubject_match
                                                        (NMSetting8021x *setting,
                                                         guint32 i);

Returns the altSubjectName match at index i.

nm_setting_802_1x_get_anonymous_identity ()

const char *        nm_setting_802_1x_get_anonymous_identity
                                                        (NMSetting8021x *setting);

Returns the anonymous identifier used by some EAP methods (like TTLS) to authenticate the user in the outer unencrypted "phase 1" authentication. The inner "phase 2" authentication will use the "identity" in a secure form, if applicable for that EAP method.

nm_setting_802_1x_get_ca_cert_blob ()

const GByteArray *  nm_setting_802_1x_get_ca_cert_blob  (NMSetting8021x *setting);

Returns the CA certificate blob if the CA certificate is stored using the NM_SETTING_802_1X_CK_SCHEME_BLOB scheme. Not all EAP methods use a CA certificate (LEAP for example), and those that can take advantage of the CA certificate allow it to be unset. Note that lack of a CA certificate reduces security by allowing man-in-the-middle attacks, because the identity of the network cannot be confirmed by the client.

nm_setting_802_1x_get_ca_cert_path ()

const char *        nm_setting_802_1x_get_ca_cert_path  (NMSetting8021x *setting);

Returns the CA certificate path if the CA certificate is stored using the NM_SETTING_802_1X_CK_SCHEME_PATH scheme. Not all EAP methods use a CA certificate (LEAP for example), and those that can take advantage of the CA certificate allow it to be unset. Note that lack of a CA certificate reduces security by allowing man-in-the-middle attacks, because the identity of the network cannot be confirmed by the client.

nm_setting_802_1x_get_ca_cert_scheme ()

NMSetting8021xCKScheme nm_setting_802_1x_get_ca_cert_scheme
                                                        (NMSetting8021x *setting);

Returns the scheme used to store the CA certificate. If the returned scheme is NM_SETTING_802_1X_CK_SCHEME_BLOB, use nm_setting_802_1x_get_ca_cert_blob(); if NM_SETTING_802_1X_CK_SCHEME_PATH, use nm_setting_802_1x_get_ca_cert_path().

nm_setting_802_1x_get_ca_path ()

const char *        nm_setting_802_1x_get_ca_path       (NMSetting8021x *setting);

Returns the path of the CA certificate directory if previously set. Systems will often have a directory that contains multiple individual CA certificates which the supplicant can then add to the verification chain. This may be used in addition to the "ca-cert" property to add more CA certificates for verifying the network to client.

nm_setting_802_1x_get_client_cert_blob ()

const GByteArray *  nm_setting_802_1x_get_client_cert_blob
                                                        (NMSetting8021x *setting);

Client certificates are used to identify the connecting client to the network when EAP-TLS is used as either the "phase 1" or "phase 2" 802.1x authentication method.

nm_setting_802_1x_get_client_cert_path ()

const char *        nm_setting_802_1x_get_client_cert_path
                                                        (NMSetting8021x *setting);

Client certificates are used to identify the connecting client to the network when EAP-TLS is used as either the "phase 1" or "phase 2" 802.1x authentication method.

nm_setting_802_1x_get_client_cert_scheme ()

NMSetting8021xCKScheme nm_setting_802_1x_get_client_cert_scheme
                                                        (NMSetting8021x *setting);

Returns the scheme used to store the client certificate. If the returned scheme is NM_SETTING_802_1X_CK_SCHEME_BLOB, use nm_setting_802_1x_get_client_cert_blob(); if NM_SETTING_802_1X_CK_SCHEME_PATH, use nm_setting_802_1x_get_client_cert_path().

nm_setting_802_1x_get_eap_method ()

const char *        nm_setting_802_1x_get_eap_method    (NMSetting8021x *setting,
                                                         guint32 i);

Returns the name of the allowed EAP method at index i.

nm_setting_802_1x_get_identity ()

const char *        nm_setting_802_1x_get_identity      (NMSetting8021x *setting);

Returns the identifier used by some EAP methods (like TLS) to authenticate the user. Often this is a username or login name.

nm_setting_802_1x_get_num_altsubject_matches ()

guint32             nm_setting_802_1x_get_num_altsubject_matches
                                                        (NMSetting8021x *setting);

Returns the number of entries in the "altsubject-matches" property of this setting.

nm_setting_802_1x_get_num_eap_methods ()

guint32             nm_setting_802_1x_get_num_eap_methods
                                                        (NMSetting8021x *setting);

Returns the number of eap methods allowed for use when connecting to the network. Generally only one EAP method is used. Use the functions nm_setting_802_1x_get_eap_method(), nm_setting_802_1x_add_eap_method(), and nm_setting_802_1x_remove_eap_method() for adding, removing, and retrieving allowed EAP methods.

nm_setting_802_1x_get_num_phase2_altsubject_matches ()

guint32             nm_setting_802_1x_get_num_phase2_altsubject_matches
                                                        (NMSetting8021x *setting);

Returns the number of entries in the "phase2-altsubject-matches" property of this setting.

nm_setting_802_1x_get_password ()

const char *        nm_setting_802_1x_get_password      (NMSetting8021x *setting);

nm_setting_802_1x_get_password_flags ()

NMSettingSecretFlags nm_setting_802_1x_get_password_flags
                                                        (NMSetting8021x *setting);

nm_setting_802_1x_get_phase1_fast_provisioning ()

const char *        nm_setting_802_1x_get_phase1_fast_provisioning
                                                        (NMSetting8021x *setting);

nm_setting_802_1x_get_phase1_peaplabel ()

const char *        nm_setting_802_1x_get_phase1_peaplabel
                                                        (NMSetting8021x *setting);

nm_setting_802_1x_get_phase1_peapver ()

const char *        nm_setting_802_1x_get_phase1_peapver
                                                        (NMSetting8021x *setting);

nm_setting_802_1x_get_phase2_altsubject_match ()

const char *        nm_setting_802_1x_get_phase2_altsubject_match
                                                        (NMSetting8021x *setting,
                                                         guint32 i);

Returns the "phase 2" altSubjectName match at index i.

nm_setting_802_1x_get_phase2_auth ()

const char *        nm_setting_802_1x_get_phase2_auth   (NMSetting8021x *setting);

nm_setting_802_1x_get_phase2_autheap ()

const char *        nm_setting_802_1x_get_phase2_autheap
                                                        (NMSetting8021x *setting);

nm_setting_802_1x_get_phase2_ca_cert_blob ()

const GByteArray *  nm_setting_802_1x_get_phase2_ca_cert_blob
                                                        (NMSetting8021x *setting);

Returns the "phase 2" CA certificate blob if the CA certificate is stored using the NM_SETTING_802_1X_CK_SCHEME_BLOB scheme. Not all EAP methods use a CA certificate (LEAP for example), and those that can take advantage of the CA certificate allow it to be unset. Note that lack of a CA certificate reduces security by allowing man-in-the-middle attacks, because the identity of the network cannot be confirmed by the client.

nm_setting_802_1x_get_phase2_ca_cert_path ()

const char *        nm_setting_802_1x_get_phase2_ca_cert_path
                                                        (NMSetting8021x *setting);

Returns the "phase 2" CA certificate path if the CA certificate is stored using the NM_SETTING_802_1X_CK_SCHEME_PATH scheme. Not all EAP methods use a CA certificate (LEAP for example), and those that can take advantage of the CA certificate allow it to be unset. Note that lack of a CA certificate reduces security by allowing man-in-the-middle attacks, because the identity of the network cannot be confirmed by the client.

nm_setting_802_1x_get_phase2_ca_cert_scheme ()

NMSetting8021xCKScheme nm_setting_802_1x_get_phase2_ca_cert_scheme
                                                        (NMSetting8021x *setting);

Returns the scheme used to store the "phase 2" CA certificate. If the returned scheme is NM_SETTING_802_1X_CK_SCHEME_BLOB, use nm_setting_802_1x_get_ca_cert_blob(); if NM_SETTING_802_1X_CK_SCHEME_PATH, use nm_setting_802_1x_get_ca_cert_path().

nm_setting_802_1x_get_phase2_ca_path ()

const char *        nm_setting_802_1x_get_phase2_ca_path
                                                        (NMSetting8021x *setting);

Returns the path of the "phase 2" CA certificate directory if previously set. Systems will often have a directory that contains multiple individual CA certificates which the supplicant can then add to the verification chain. This may be used in addition to the "phase2-ca-cert" property to add more CA certificates for verifying the network to client.

nm_setting_802_1x_get_phase2_client_cert_blob ()

const GByteArray *  nm_setting_802_1x_get_phase2_client_cert_blob
                                                        (NMSetting8021x *setting);

Client certificates are used to identify the connecting client to the network when EAP-TLS is used as either the "phase 1" or "phase 2" 802.1x authentication method.

nm_setting_802_1x_get_phase2_client_cert_path ()

const char *        nm_setting_802_1x_get_phase2_client_cert_path
                                                        (NMSetting8021x *setting);

Client certificates are used to identify the connecting client to the network when EAP-TLS is used as either the "phase 1" or "phase 2" 802.1x authentication method.

nm_setting_802_1x_get_phase2_client_cert_scheme ()

NMSetting8021xCKScheme nm_setting_802_1x_get_phase2_client_cert_scheme
                                                        (NMSetting8021x *setting);

Returns the scheme used to store the "phase 2" client certificate. If the returned scheme is NM_SETTING_802_1X_CK_SCHEME_BLOB, use nm_setting_802_1x_get_client_cert_blob(); if NM_SETTING_802_1X_CK_SCHEME_PATH, use nm_setting_802_1x_get_client_cert_path().

nm_setting_802_1x_get_phase2_private_key_blob ()

const GByteArray *  nm_setting_802_1x_get_phase2_private_key_blob
                                                        (NMSetting8021x *setting);

Private keys are used to authenticate the connecting client to the network when EAP-TLS is used as either the "phase 1" or "phase 2" 802.1x authentication method.

WARNING: the phase2 private key property is not a "secret" property, and thus unencrypted private key data may be readable by unprivileged users. Private keys should always be encrypted with a private key password.

nm_setting_802_1x_get_phase2_private_key_format ()

NMSetting8021xCKFormat nm_setting_802_1x_get_phase2_private_key_format
                                                        (NMSetting8021x *setting);

nm_setting_802_1x_get_phase2_private_key_password ()

const char *        nm_setting_802_1x_get_phase2_private_key_password
                                                        (NMSetting8021x *setting);

nm_setting_802_1x_get_phase2_private_key_password_flags ()

NMSettingSecretFlags nm_setting_802_1x_get_phase2_private_key_password_flags
                                                        (NMSetting8021x *setting);

nm_setting_802_1x_get_phase2_private_key_path ()

const char *        nm_setting_802_1x_get_phase2_private_key_path
                                                        (NMSetting8021x *setting);

Private keys are used to authenticate the connecting client to the network when EAP-TLS is used as either the "phase 1" or "phase 2" 802.1x authentication method.

nm_setting_802_1x_get_phase2_private_key_scheme ()

NMSetting8021xCKScheme nm_setting_802_1x_get_phase2_private_key_scheme
                                                        (NMSetting8021x *setting);

Returns the scheme used to store the "phase 2" private key. If the returned scheme is NM_SETTING_802_1X_CK_SCHEME_BLOB, use nm_setting_802_1x_get_client_cert_blob(); if NM_SETTING_802_1X_CK_SCHEME_PATH, use nm_setting_802_1x_get_client_cert_path().

nm_setting_802_1x_get_phase2_subject_match ()

const char *        nm_setting_802_1x_get_phase2_subject_match
                                                        (NMSetting8021x *setting);

nm_setting_802_1x_get_pin ()

const char *        nm_setting_802_1x_get_pin           (NMSetting8021x *setting);

nm_setting_802_1x_get_pin_flags ()

NMSettingSecretFlags nm_setting_802_1x_get_pin_flags    (NMSetting8021x *setting);

nm_setting_802_1x_get_private_key_blob ()

const GByteArray *  nm_setting_802_1x_get_private_key_blob
                                                        (NMSetting8021x *setting);

Private keys are used to authenticate the connecting client to the network when EAP-TLS is used as either the "phase 1" or "phase 2" 802.1x authentication method.

WARNING: the private key property is not a "secret" property, and thus unencrypted private key data may be readable by unprivileged users. Private keys should always be encrypted with a private key password.

nm_setting_802_1x_get_private_key_format ()

NMSetting8021xCKFormat nm_setting_802_1x_get_private_key_format
                                                        (NMSetting8021x *setting);

nm_setting_802_1x_get_private_key_password ()

const char *        nm_setting_802_1x_get_private_key_password
                                                        (NMSetting8021x *setting);

nm_setting_802_1x_get_private_key_password_flags ()

NMSettingSecretFlags nm_setting_802_1x_get_private_key_password_flags
                                                        (NMSetting8021x *setting);

nm_setting_802_1x_get_private_key_path ()

const char *        nm_setting_802_1x_get_private_key_path
                                                        (NMSetting8021x *setting);

Private keys are used to authenticate the connecting client to the network when EAP-TLS is used as either the "phase 1" or "phase 2" 802.1x authentication method.

nm_setting_802_1x_get_private_key_scheme ()

NMSetting8021xCKScheme nm_setting_802_1x_get_private_key_scheme
                                                        (NMSetting8021x *setting);

Returns the scheme used to store the private key. If the returned scheme is NM_SETTING_802_1X_CK_SCHEME_BLOB, use nm_setting_802_1x_get_client_cert_blob(); if NM_SETTING_802_1X_CK_SCHEME_PATH, use nm_setting_802_1x_get_client_cert_path().

nm_setting_802_1x_get_subject_match ()

const char *        nm_setting_802_1x_get_subject_match (NMSetting8021x *setting);

nm_setting_802_1x_get_system_ca_certs ()

gboolean            nm_setting_802_1x_get_system_ca_certs
                                                        (NMSetting8021x *setting);

Sets the "system-ca-certs" property. The "ca-path" and "phase2-ca-path" properties are ignored if the "system-ca-certs" property is TRUE, in which case a system-wide CA certificate directory specified at compile time (using the --system-ca-path configure option) is used in place of these properties.

nm_setting_802_1x_new ()

NMSetting *         nm_setting_802_1x_new               (void);

Creates a new NMSetting8021x object with default values.

nm_setting_802_1x_remove_altsubject_match ()

void                nm_setting_802_1x_remove_altsubject_match
                                                        (NMSetting8021x *setting,
                                                         guint32 i);

Removes the allowed altSubjectName at the specified index.

nm_setting_802_1x_remove_eap_method ()

void                nm_setting_802_1x_remove_eap_method (NMSetting8021x *setting,
                                                         guint32 i);

Removes the allowed EAP method at the specified index.

nm_setting_802_1x_remove_phase2_altsubject_match ()

void                nm_setting_802_1x_remove_phase2_altsubject_match
                                                        (NMSetting8021x *setting,
                                                         guint32 i);

Removes the allowed "phase 2" altSubjectName at the specified index.

nm_setting_802_1x_set_ca_cert ()

gboolean            nm_setting_802_1x_set_ca_cert       (NMSetting8021x *setting,
                                                         const char *cert_path,
                                                         NMSetting8021xCKScheme scheme,
                                                         NMSetting8021xCKFormat *out_format,
                                                         GError **error);

Reads a certificate from disk and sets the "ca-cert" property with the raw certificate data if using the NM_SETTING_802_1X_CK_SCHEME_BLOB scheme, or with the path to the certificate file if using the NM_SETTING_802_1X_CK_SCHEME_PATH scheme.

nm_setting_802_1x_set_client_cert ()

gboolean            nm_setting_802_1x_set_client_cert   (NMSetting8021x *setting,
                                                         const char *cert_path,
                                                         NMSetting8021xCKScheme scheme,
                                                         NMSetting8021xCKFormat *out_format,
                                                         GError **error);

Reads a certificate from disk and sets the "client-cert" property with the raw certificate data if using the NM_SETTING_802_1X_CK_SCHEME_BLOB scheme, or with the path to the certificate file if using the NM_SETTING_802_1X_CK_SCHEME_PATH scheme.

Client certificates are used to identify the connecting client to the network when EAP-TLS is used as either the "phase 1" or "phase 2" 802.1x authentication method.

nm_setting_802_1x_set_phase2_ca_cert ()

gboolean            nm_setting_802_1x_set_phase2_ca_cert
                                                        (NMSetting8021x *setting,
                                                         const char *cert_path,
                                                         NMSetting8021xCKScheme scheme,
                                                         NMSetting8021xCKFormat *out_format,
                                                         GError **error);

Reads a certificate from disk and sets the "phase2-ca-cert" property with the raw certificate data if using the NM_SETTING_802_1X_CK_SCHEME_BLOB scheme, or with the path to the certificate file if using the NM_SETTING_802_1X_CK_SCHEME_PATH scheme.

nm_setting_802_1x_set_phase2_client_cert ()

gboolean            nm_setting_802_1x_set_phase2_client_cert
                                                        (NMSetting8021x *setting,
                                                         const char *cert_path,
                                                         NMSetting8021xCKScheme scheme,
                                                         NMSetting8021xCKFormat *out_format,
                                                         GError **error);

Reads a certificate from disk and sets the "phase2-client-cert" property with the raw certificate data if using the NM_SETTING_802_1X_CK_SCHEME_BLOB scheme, or with the path to the certificate file if using the NM_SETTING_802_1X_CK_SCHEME_PATH scheme.

Client certificates are used to identify the connecting client to the network when EAP-TLS is used as either the "phase 1" or "phase 2" 802.1x authentication method.

nm_setting_802_1x_set_phase2_private_key ()

gboolean            nm_setting_802_1x_set_phase2_private_key
                                                        (NMSetting8021x *setting,
                                                         const char *key_path,
                                                         const char *password,
                                                         NMSetting8021xCKScheme scheme,
                                                         NMSetting8021xCKFormat *out_format,
                                                         GError **error);

Private keys are used to authenticate the connecting client to the network when EAP-TLS is used as either the "phase 1" or "phase 2" 802.1x authentication method.

This function reads a private key from disk and sets the "phase2-private-key" property with the private key file data if using the NM_SETTING_802_1X_CK_SCHEME_BLOB scheme, or with the path to the private key file if using the NM_SETTING_802_1X_CK_SCHEME_PATH scheme.

If password is given, this function attempts to decrypt the private key to verify that password is correct, and if it is, updates the "phase2-private-key-password" property with the given password. If the decryption is unsuccessful, FALSE is returned, error is set, and no internal data is changed. If no password is given, the private key is assumed to be valid, no decryption is performed, and the password may be set at a later time.

WARNING: the "phase2" private key property is not a "secret" property, and thus unencrypted private key data using the BLOB scheme may be readable by unprivileged users. Private keys should always be encrypted with a private key password to prevent unauthorized access to unencrypted private key data.

nm_setting_802_1x_set_private_key ()

gboolean            nm_setting_802_1x_set_private_key   (NMSetting8021x *setting,
                                                         const char *key_path,
                                                         const char *password,
                                                         NMSetting8021xCKScheme scheme,
                                                         NMSetting8021xCKFormat *out_format,
                                                         GError **error);

Private keys are used to authenticate the connecting client to the network when EAP-TLS is used as either the "phase 1" or "phase 2" 802.1x authentication method.

This function reads a private key from disk and sets the "private-key" property with the private key file data if using the NM_SETTING_802_1X_CK_SCHEME_BLOB scheme, or with the path to the private key file if using the NM_SETTING_802_1X_CK_SCHEME_PATH scheme.

If password is given, this function attempts to decrypt the private key to verify that password is correct, and if it is, updates the "private-key-password" property with the given password. If the decryption is unsuccessful, FALSE is returned, error is set, and no internal data is changed. If no password is given, the private key is assumed to be valid, no decryption is performed, and the password may be set at a later time.

WARNING: the private key property is not a "secret" property, and thus unencrypted private key data using the BLOB scheme may be readable by unprivileged users. Private keys should always be encrypted with a private key password to prevent unauthorized access to unencrypted private key data.

The "altsubject-matches" property

  "altsubject-matches"       GSList_gchararray_*   : Read / Write

List of strings to be matched against the altSubjectName of the certificate presented by the authentication server. If the list is empty, no verification of the server certificate's altSubjectName is performed.

The "anonymous-identity" property

  "anonymous-identity"       gchar*                : Read / Write

Anonymous identity string for EAP authentication methods. Used as the unencrypted identity with EAP types that support different tunneled identity like EAP-TTLS.

Default value: NULL

The "ca-cert" property

  "ca-cert"                  GArray_guchar_*       : Read / Write

Contains the CA certificate if used by the EAP method specified in the "eap" property. Setting this property directly is discouraged; use the nm_setting_802_1x_set_ca_cert() function instead.

The "ca-path" property

  "ca-path"                  gchar*                : Read / Write

UTF-8 encoded path to a directory containing PEM or DER formatted certificates to be added to the verification chain in addition to the certificate specified in the "ca-cert" property.

Default value: NULL

The "client-cert" property

  "client-cert"              GArray_guchar_*       : Read / Write

Contains the client certificate if used by the EAP method specified in the "eap" property. Setting this property directly is discouraged; use the nm_setting_802_1x_set_client_cert() function instead.

The "eap" property

  "eap"                      GSList_gchararray_*   : Read / Write

The allowed EAP method to be used when authenticating to the network with 802.1x. Valid methods are: "leap", "md5", "tls", "peap", "ttls", and "fast". Each method requires different configuration using the properties of this object; refer to wpa_supplicant documentation for the allowed combinations.

The "identity" property

  "identity"                 gchar*                : Read / Write

Identity string for EAP authentication methods. Often the user's user or login name.

Default value: NULL

The "password" property

  "password"                 gchar*                : Read / Write

Password used for EAP authentication methods.

Default value: NULL

The "password-flags" property

  "password-flags"           guint                 : Read / Write

Flags indicating how to handle "password":.

Allowed values: <= 7

Default value: 0

The "phase1-fast-provisioning" property

  "phase1-fast-provisioning" gchar*                : Read / Write

Enables or disables in-line provisioning of EAP-FAST credentials when FAST is specified as the EAP method in the "eap" property. Recognized values are "0" (disabled), "1" (allow unauthenticated provisioning), "2" (allow authenticated provisioning), and "3" (allow both authenticated and unauthenticated provisioning). See the wpa_supplicant documentation for more details.

Default value: NULL

The "phase1-peaplabel" property

  "phase1-peaplabel"         gchar*                : Read / Write

Forces use of the new PEAP label during key derivation. Some RADIUS servers may require forcing the new PEAP label to interoperate with PEAPv1. Set to "1" to force use of the new PEAP label. See the wpa_supplicant documentation for more details.

Default value: NULL

The "phase1-peapver" property

  "phase1-peapver"           gchar*                : Read / Write

Forces which PEAP version is used when PEAP is set as the EAP method in the "eap" property. When unset, the version reported by the server will be used. Sometimes when using older RADIUS servers, it is necessary to force the client to use a particular PEAP version. To do so, this property may be set to "0" or "1" to force that specific PEAP version.

Default value: NULL

The "phase2-altsubject-matches" property

  "phase2-altsubject-matches" GSList_gchararray_*   : Read / Write

List of strings to be matched against the altSubjectName of the certificate presented by the authentication server during the inner "phase 2" authentication. If the list is empty, no verification of the server certificate's altSubjectName is performed.

The "phase2-auth" property

  "phase2-auth"              gchar*                : Read / Write

Specifies the allowed "phase 2" inner non-EAP authentication methods when an EAP method that uses an inner TLS tunnel is specified in the "eap" property. Recognized non-EAP phase2 methods are "pap", "chap", "mschap", "mschapv2", "gtc", "otp", "md5", and "tls". Each 'phase 2' inner method requires specific parameters for successful authentication; see the wpa_supplicant documentation for more details.

Default value: NULL

The "phase2-autheap" property

  "phase2-autheap"           gchar*                : Read / Write

Specifies the allowed "phase 2" inner EAP-based authentication methods when an EAP method that uses an inner TLS tunnel is specified in the "eap" property. Recognized EAP-based phase2 methods are "md5", "mschapv2", "otp", "gtc", and "tls". Each 'phase 2' inner method requires specific parameters for successful authentication; see the wpa_supplicant documentation for more details.

Default value: NULL

The "phase2-ca-cert" property

  "phase2-ca-cert"           GArray_guchar_*       : Read / Write

Contains the CA certificate if used by the EAP method specified in the "phase2-auth" or "phase2-autheap" properties. Setting this property directly is discouraged; use the nm_setting_802_1x_set_phase2_ca_cert() function instead.

The "phase2-ca-path" property

  "phase2-ca-path"           gchar*                : Read / Write

UTF-8 encoded path to a directory containing PEM or DER formatted certificates to be added to the verification chain in addition to the certificate specified in the "phase2-ca-cert" property.

Default value: NULL

The "phase2-client-cert" property

  "phase2-client-cert"       GArray_guchar_*       : Read / Write

Contains the client certificate if used by the EAP method specified in the "phase2-auth" or "phase2-autheap" properties. Setting this property directly is discouraged; use the nm_setting_802_1x_set_phase2_client_cert() function instead.

The "phase2-private-key" property

  "phase2-private-key"       GArray_guchar_*       : Read / Write

Private key data used by "phase 2" inner authentication methods.

Contains the "phase 2" inner private key if the "phase2-auth" or "phase2-autheap" property is set to 'tls'. Setting this property directly is discouraged; use the nm_setting_802_1x_set_phase2_private_key() function instead.

The "phase2-private-key-password" property

  "phase2-private-key-password" gchar*                : Read / Write

The password used to decrypt the private key specified in "phase2-private-key" when the private key either uses the path scheme, or if the private key is a PKCS12 format key. Setting this property directly is not generally necessary except when returning secrets to NetworkManager; it is generally set automatically when setting the private key by the nm_setting_802_1x_set_phase2_private_key() function.

Default value: NULL

The "phase2-private-key-password-flags" property

  "phase2-private-key-password-flags" guint                 : Read / Write

Flags indicating how to handle "phase2-private-key-password":.

Allowed values: <= 7

Default value: 0

The "phase2-subject-match" property

  "phase2-subject-match"     gchar*                : Read / Write

Substring to be matched against the subject of the certificate presented by the authentication server during the inner "phase 2" authentication. When unset, no verification of the authentication server certificate's subject is performed.

Default value: NULL

The "private-key" property

  "private-key"              GArray_guchar_*       : Read / Write

Contains the private key if the "eap" property is set to 'tls'. Setting this property directly is discouraged; use the nm_setting_802_1x_set_private_key() function instead.

WARNING: "private-key" is not a "secret" property, and thus unencrypted private key data using the BLOB scheme may be readable by unprivileged users. Private keys should always be encrypted with a private key password to prevent unauthorized access to unencrypted private key data.

The "private-key-password" property

  "private-key-password"     gchar*                : Read / Write

The password used to decrypt the private key specified in "private-key" when the private key either uses the path scheme, or if the private key is a PKCS12 format key. Setting this property directly is not generally necessary except when returning secrets to NetworkManager; it is generally set automatically when setting the private key by the nm_setting_802_1x_set_private_key() function.

Default value: NULL

The "private-key-password-flags" property

  "private-key-password-flags" guint                 : Read / Write

Flags indicating how to handle "private-key-password":.

Allowed values: <= 7

Default value: 0

The "subject-match" property

  "subject-match"            gchar*                : Read / Write

Substring to be matched against the subject of the certificate presented by the authentication server. When unset, no verification of the authentication server certificate's subject is performed.

Default value: NULL

The "system-ca-certs" property

  "system-ca-certs"          gboolean              : Read / Write / Construct

When TRUE, overrides "ca-path" and "phase2-ca-path" properties using the system CA directory specified at configure time with the --system-ca-path switch. The certificates in this directory are added to the verification chain in addition to any certificates specified by the "ca-cert" and "phase2-ca-cert" properties.

Default value: FALSE