ONC: Translate EAP from Shill to ONC

components/onc/docs/onc_spec.md

 # Open Network Configuration
 
 [TOC]
 
 ## Objective
 
 We would like to create a simple, open, but complete format to describe
 multiple network configurations for WiFi, Ethernet, Cellular,
 Bluetooth/WiFi-Direct, and VPN connections in a single file format, in order
 to simplify and automate network configuration for users.
@@ skipping 1039 matching lines @@
     * (optional) - **string**
     * Identity of user. For tunneling outer protocols
       (*PEAP*, *EAP-TTLS*, and
       *EAP-FAST*), this is used to authenticate inside
       the tunnel, and **AnonymousIdentity** is used for
       the EAP identity outside the tunnel. For non-tunneling outer protocols,
       this is used for the EAP identity. This value is subject to string
       expansions.
 
 * **Inner**
-    * (optional if **Outer** is
-        *EAP-FAST*, *EAP-TTLS*
-        or *PEAP*, otherwise ignored, defaults to *Automatic*) - **string**
-    * `Allowed values are` *Automatic*,
-        *MD5*, *MSCHAPv2*,
-        *EAP-MSCHAPv2*,
-        *PAP*, and *GTC*.
+    * (optional if **Outer** is *EAP-FAST*, *EAP-TTLS* or *PEAP*, otherwise
+        ignored, defaults to *Automatic*) - **string**
+    * `Allowed values are` *Automatic*, *MD5*, *MSCHAP*, *MSCHAPv2*, *PAP*,
+        *CHAP* and *GTC*.
     * For tunneling outer protocols.
 
 * **Outer**
     * (required) - **string**
-    * `Allowed values are` *LEAP*,
-        *EAP-AKA*, *EAP-FAST*,
-        *EAP-TLS*, *EAP-TTLS*,
+    * `Allowed values are` *LEAP*, *EAP-AKA*, *EAP-FAST*, *EAP-TLS*, *EAP-TTLS*,
         *EAP-SIM* and *PEAP*.
 
 * **Password**
     * (optional) - **string**
     * Password of user. If not specified, defaults to prompting the user.
 
 * **SaveCredentials**
     * (optional, defaults to *false*) - **boolean**
     * If *false*, require user to enter credentials
       each time they connect. Specifying **Identity**
@@ skipping 19 matching lines @@
 * **ServerCARef**
     * (optional) - **string**
     * DEPRECATED, use **ServerCARefs** instead.<br/>
       Reference to a CA certificate in **Certificates**. 
     * If this field is set, **ServerCARefs** must be unset.
       If neither **ServerCARefs** nor **ServerCARef** is set, the client does
       not check that the server certificate is signed by a specific CA.
       A verification using the system's CA certificates may still apply.
       See **UseSystemCAs** for this.
 
+* **SubjectMatch**
+    * (optional) - **string**
+    * WiFi only. A substring which a remote RADIUS service certificate subject
+      name must contain in order to connect.
+
 * **UseSystemCAs**
     * (optional, defaults to *true*) - **boolean**
     * Required server certificate to be signed by "system default certificate
       authorities". If both **ServerCARefs** (or **ServerCARef**)
       and **UseSystemCAs** are supplied, a server
       certificate will be allowed if it either has a chain of trust to a system
       CA or to one of the given CA certificates. If **UseSystemCAs**
       is *false*, and no **ServerCARef** is set, the certificate
       must be a self signed certificate, and no CA signature is required.
 
@@ skipping 683 matching lines @@
 is transmitted or saved to disk should be secure. On client device, when
 user names for connections that are user-specific are persisted to disk,
 they should be stored in a location that is encrypted. Users can also opt in
 these cases to not save their user credentials in the config file and will
 instead be prompted when they are needed.
 
 ## Authors
 
 * pneubeck@chromium.org
 * stevenjb@chromium.org