diff --git a/.clang-format b/.clang-format
new file mode 100644
index 0000000000..47b20bb57d
--- /dev/null
+++ b/.clang-format
@@ -0,0 +1,108 @@
+Language: Cpp
+
+TabWidth: 4
+IndentWidth: 4
+UseTab: Never
+ColumnLimit: 100
+ContinuationIndentWidth: 4
+UseCRLF: false
+
+AlignAfterOpenBracket: Align
+AlignConsecutiveAssignments: true
+AlignConsecutiveDeclarations: true
+AlignConsecutiveMacros: true
+AlignEscapedNewlines: Left
+AlignOperands: true
+AlignTrailingComments: true
+AllowAllArgumentsOnNextLine: false
+AllowAllParametersOfDeclarationOnNextLine: false
+AllowShortBlocksOnASingleLine: Empty
+AllowShortCaseLabelsOnASingleLine: false
+AllowShortFunctionsOnASingleLine: Empty
+AllowShortIfStatementsOnASingleLine: Never
+AllowShortLoopsOnASingleLine: false
+AlwaysBreakAfterReturnType: AllDefinitions
+AlwaysBreakBeforeMultilineStrings: false
+
+BinPackArguments: false
+BinPackParameters: false
+BreakBeforeBraces: Custom
+BraceWrapping:
+    AfterCaseLabel: true
+    AfterControlStatement: Never
+    AfterEnum: false
+    AfterFunction: true
+    AfterStruct: false
+    AfterUnion: false
+    BeforeElse: false
+    IndentBraces: false
+    SplitEmptyFunction: false
+BreakBeforeBinaryOperators: All
+BreakBeforeTernaryOperators: true
+BreakStringLiterals: true
+
+IncludeBlocks: Preserve
+IndentCaseLabels: false
+IndentGotoLabels: false
+IndentPPDirectives: BeforeHash
+IndentWrappedFunctionNames: false
+KeepEmptyLinesAtTheStartOfBlocks: false
+MaxEmptyLinesToKeep: 1
+
+DerivePointerAlignment: false
+PointerAlignment: Right
+ReflowComments: false
+SortIncludes: false
+SpaceAfterCStyleCast: true
+SpaceAfterLogicalNot: false
+SpaceBeforeAssignmentOperators: true
+SpaceBeforeParens: Always
+SpaceBeforeSquareBrackets: false
+SpaceInEmptyBlock: false
+SpaceInEmptyParentheses: false
+SpacesBeforeTrailingComments: 2
+SpacesInCStyleCastParentheses: false
+SpacesInContainerLiterals: false
+SpacesInParentheses: false
+
+ForEachMacros: ['c_list_for_each',
+                'c_list_for_each_continue',
+                'c_list_for_each_entry',
+                'c_list_for_each_entry_continue',
+                'c_list_for_each_entry_safe',
+                'c_list_for_each_entry_safe_continue',
+                'c_list_for_each_entry_safe_unlink',
+                'c_list_for_each_safe',
+                'c_list_for_each_safe_continue',
+                'c_list_for_each_safe_unlink',
+                'c_rbtree_for_each',
+                'c_rbtree_for_each_entry',
+                'c_rbtree_for_each_entry_postorder',
+                'c_rbtree_for_each_entry_safe',
+                'c_rbtree_for_each_entry_safe_postorder',
+                'c_rbtree_for_each_entry_safe_postorder_unlink',
+                'c_rbtree_for_each_postorder',
+                'c_rbtree_for_each_safe',
+                'c_rbtree_for_each_safe_postorder',
+                'c_rbtree_for_each_safe_postorder_unlink',
+                'json_object_foreach_safe',
+                'ndp_msg_opt_dnssl_for_each_domain',
+                'ndp_msg_opt_for_each_offset',
+                'ndp_msg_opt_rdnss_for_each_addr',
+                'nla_for_each_attr',
+                'nla_for_each_nested',
+                'nm_c_list_for_each_entry_prev',
+                'nm_dedup_multi_iter_for_each',
+                'nm_ip_config_iter_ip4_address_for_each',
+                'nm_ip_config_iter_ip4_route_for_each',
+                'nm_ip_config_iter_ip6_address_for_each',
+                'nm_ip_config_iter_ip6_route_for_each',
+                'nm_json_array_foreach',
+                'nm_json_object_foreach',
+                'nm_manager_for_each_active_connection',
+                'nm_manager_for_each_active_connection_safe',
+                'nm_manager_for_each_device',
+                'nm_manager_for_each_device_safe',
+                'nmp_cache_iter_for_each',
+                'nmp_cache_iter_for_each_link',
+                ]
diff --git a/.gitignore b/.gitignore
index 5cb43a0374..919b1830c9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -131,6 +131,7 @@ test-*.trs
 /examples/C/qt/monitor-nm-running
 /examples/C/qt/monitor-nm-running.moc
 
+/shared/nm-glib-aux/tests/test-json-aux
 /shared/nm-glib-aux/tests/test-shared-general
 /shared/nm-version-macros.h
 
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 389da67218..253bf7593b 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -79,7 +79,7 @@ checkpatch:
   script:
     - date '+%Y%m%d-%H%M%S'; dnf install -y git black
     - date '+%Y%m%d-%H%M%S'; NM_CHECKPATCH_FETCH_UPSTREAM=1 contrib/scripts/checkpatch-feature-branch.sh 2>&1 | tee checkpatch-out.txt
-    - date '+%Y%m%d-%H%M%S'; black --check .
+    - date '+%Y%m%d-%H%M%S'; black --check . examples/python/gi/nm-wg-set
   allow_failure: true
   artifacts:
     when: on_failure
diff --git a/Makefile.am b/Makefile.am
index bec61e0405..01fd835e17 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -356,6 +356,9 @@ shared_nm_std_aux_libnm_std_aux_la_SOURCES = \
 	shared/nm-std-aux/c-list-util.c \
 	shared/nm-std-aux/c-list-util.h \
 	shared/nm-std-aux/nm-dbus-compat.h \
+	shared/nm-std-aux/nm-std-aux.h \
+	shared/nm-std-aux/nm-std-utils.c \
+	shared/nm-std-aux/nm-std-utils.h \
 	shared/nm-std-aux/unaligned.h \
 	$(NULL)
 
@@ -639,6 +642,39 @@ shared_nm_glib_aux_tests_test_shared_general_LDADD = \
 
 ###############################################################################
 
+if WITH_JANSSON
+
+check_programs += shared/nm-glib-aux/tests/test-json-aux
+
+shared_nm_glib_aux_tests_test_json_aux_CPPFLAGS = \
+	$(dflt_cppflags) \
+	-I$(srcdir)/shared \
+	-DNETWORKMANAGER_COMPILATION_TEST \
+	-DNETWORKMANAGER_COMPILATION='(NM_NETWORKMANAGER_COMPILATION_GLIB|NM_NETWORKMANAGER_COMPILATION_WITH_GLIB_I18N_PROG)' \
+	$(CODE_COVERAGE_CFLAGS) \
+	$(GLIB_CFLAGS) \
+	$(JANSSON_CFLAGS) \
+	$(SANITIZER_LIB_CFLAGS) \
+	$(NULL)
+
+shared_nm_glib_aux_tests_test_json_aux_LDFLAGS = \
+	$(CODE_COVERAGE_LDFLAGS) \
+	$(SANITIZER_EXEC_LDFLAGS) \
+	$(NULL)
+
+shared_nm_glib_aux_tests_test_json_aux_LDADD = \
+	$(JANSSON_LIBS) \
+	shared/nm-glib-aux/libnm-glib-aux.la \
+	shared/systemd/libnm-systemd-logging-stub.la \
+	shared/nm-std-aux/libnm-std-aux.la \
+	shared/libcsiphash.la \
+	$(GLIB_LIBS) \
+	$(NULL)
+
+endif
+
+###############################################################################
+
 noinst_LTLIBRARIES += introspection/libnmdbus.la
 
 introspection_libnmdbus_la_CPPFLAGS = $(GLIB_CFLAGS)
@@ -1028,13 +1064,6 @@ libnm_core_lib_c_real = \
 	libnm-core/nm-vpn-plugin-info.c \
 	$(NULL)
 
-if WITH_JSON_VALIDATION
-libnm_core_lib_h_priv += \
-	libnm-core/nm-json.h
-libnm_core_lib_c_real += \
-	libnm-core/nm-json.c
-endif
-
 libnm_core_lib_c_mkenums = \
 	libnm-core/nm-core-enum-types.c
 
@@ -1089,11 +1118,6 @@ libnm_core_libnm_core_la_CPPFLAGS = \
 	-DNETWORKMANAGER_COMPILATION=NM_NETWORKMANAGER_COMPILATION_LIBNM_CORE \
 	$(NULL)
 
-if WITH_JSON_VALIDATION
-libnm_core_libnm_core_la_CPPFLAGS += $(JANSSON_CFLAGS)
-libnm_core_libnm_core_la_CPPFLAGS += -fcommon
-endif
-
 libnm_core_libnm_core_la_SOURCES = \
 	$(libnm_core_lib_h_pub_real) \
 	$(libnm_core_lib_h_priv) \
@@ -3075,6 +3099,7 @@ EXTRA_DIST += \
 	src/settings/plugins/ifcfg-rh/tests/network-scripts/ifcfg-Test_Write_Team_Infiniband_Port.cexpected \
 	src/settings/plugins/ifcfg-rh/tests/network-scripts/ifcfg-Test_Write_Team_Port.cexpected \
 	src/settings/plugins/ifcfg-rh/tests/network-scripts/ifcfg-Test_Write_VLAN_reorder_hdr.cexpected \
+	src/settings/plugins/ifcfg-rh/tests/network-scripts/ifcfg-Test_Write_WiFi_AP_Mode.cexpected \
 	src/settings/plugins/ifcfg-rh/tests/network-scripts/ifcfg-Test_Write_WiFi_Band_A.cexpected \
 	src/settings/plugins/ifcfg-rh/tests/network-scripts/ifcfg-Test_Write_WiFi_Hidden.cexpected \
 	src/settings/plugins/ifcfg-rh/tests/network-scripts/ifcfg-Test_Write_WiFi_MAC_always.cexpected \
@@ -5238,6 +5263,12 @@ CLEANFILES += \
 
 include Makefile.examples
 
+if WITH_PYTHON_BLACK
+check-python-black:
+	test "$$NMTST_SKIP_PYTHON_BLACK" != 1 && $(BLACK) --check $(top_srcdir) $(top_srcdir)/examples/python/gi/nm-wg-set
+check_local += check-python-black
+endif
+
 ###############################################################################
 
 check-local: $(check_local)
diff --git a/NEWS b/NEWS
index f4207b82b7..ca30fd033d 100644
--- a/NEWS
+++ b/NEWS
@@ -1,3 +1,13 @@
+=============================================
+NetworkManager-1.28
+Overview of changes since NetworkManager-1.26
+=============================================
+
+This is a snapshot of NetworkManager 1.28 development series.
+The API is subject to change and not guaranteed to be compatible
+with the later release.
+USE AT YOUR OWN RISK.  NOT RECOMMENDED FOR PRODUCTION USE!
+
 =============================================
 NetworkManager-1.26
 Overview of changes since NetworkManager-1.24
diff --git a/RELICENSE.md b/RELICENSE.md
index 4bdea1e7e8..88215e0531 100644
--- a/RELICENSE.md
+++ b/RELICENSE.md
@@ -73,6 +73,7 @@ Consent/Disapproval List
 
 - [Y] Aleksander Morgado <aleksander@aleksander.es>
 - [Y] Alfonso Sánchez-Beato <alfonso.sanchez-beato@canonical.com> (Canonical, Ltd.)
+- [Y] Andrew Zaborowski <andrew.zaborowski@intel.com> (Intel Corporation)
 - [Y] Antoine Faure <antoine.faure@sigfox.com> (Sigfox)
 - [Y] Antony Mee <antony@onlymee.co.uk>
 - [Y] Atul Anand <atulhjp@gmail.com>
@@ -126,13 +127,13 @@ The contributors above may have contributed the code on behalf of a company
 that holds the copyright. This list tracks such legal entities. The contributor
 list above indicates whether a contributor provided code for a legal entity here.
 
-- [?] Intel Corporation
 - [?] Novell, Inc.
 - [?] SUSE
 
 - [Y] Canonical, Ltd.
 - [Y] Endless Mobile, Inc.
 - [Y] Endless OS LLC
+- [Y] Intel Corporation
 - [Y] One Laptop per Child
 - [Y] Pengutronix
 - [Y] Red Hat, Inc.
diff --git a/TODO b/TODO
index e24ef78e26..0732bcc404 100644
--- a/TODO
+++ b/TODO
@@ -23,7 +23,7 @@ possibly get inspired by nm-connection-editor.
 
 * Add Azure support to nm-cloud-setup.
 
-nm-cloud-setup currently only works for EC2 (and only for IPv4). Add support for Azure
+Currently, nm-cloud-setup only works for EC2 (and only for IPv4). Add support for Azure
 cloud. See for example SUSE's cloud-netconfig which supports Azure
 (https://github.com/SUSE-Enceladus/cloud-netconfig,
 https://www.suse.com/c/multi-nic-cloud-netconfig-ec2-azure/). Note that cloud-netconfig
@@ -33,7 +33,7 @@ anyway be almost impossible, because one is written in bash and the other in C.
 
 * Improve our gitlab-ci integration.
 
-Currently our .gitlab-ci starts various base containers and first installs
+Currently, our .gitlab-ci starts various base containers and first installs
 the necessary dependencies. That takes time and consumes bandwidth, we should
 instead use more suitable containers. We should instead use ci-templates from
 https://gitlab.freedesktop.org/freedesktop/ci-templates.
@@ -110,7 +110,7 @@ connected before the drop.
 * VPN IP Methods
 
 Some VPNs (openvpn with TAP for example) require that DHCP is run on a
-pseudo-ethernet device to obtain addressing information.  This is not currently
+pseudo-ethernet device to obtain addressing information.  Currenty, this is not
 possible, but NM already has all the code for DHCP.  Thus, a new "method"
 key should be defined in include/NetworkManagerVPN.h to allow for DHCP to
 be performed if the VPN service daemon requests it in the IP4Config or IP6Config
diff --git a/clients/cli/connections.c b/clients/cli/connections.c
index 2b9c4a25ad..39f8be59f5 100644
--- a/clients/cli/connections.c
+++ b/clients/cli/connections.c
@@ -5372,7 +5372,7 @@ read_properties:
 		const char *slave_type = nm_setting_connection_get_slave_type (s_con);
 
 		/* If only bother when there's a type, which is not guaranteed at this point.
-		 * Otherwise the validation will fail anyway. */
+		 * Otherwise, the validation will fail anyway. */
 		if (type) {
 			gs_free char *try_name = NULL;
 			gs_free char *default_name = NULL;
@@ -6709,7 +6709,7 @@ editor_sub_usage (const char *command)
 			g_print (_("remove [<value>|<index>|<option name>]  :: delete the value\n\n"
 			           "Removes the property value. For single-valued properties, this sets the\n"
 			           "property back to its default value. For container-type properties, this removes\n"
-			           "all the values of that property, or you can specify an argument to remove just\n"
+			           "all the values of that property or you can specify an argument to remove just\n"
 			           "a single item or option. The argument is either a value or index of the item to\n"
 			           "remove, or an option name (for properties with named options).\n\n"
 			           "Examples: nmcli ipv4.dns> remove 8.8.8.8\n"
diff --git a/clients/cli/devices.c b/clients/cli/devices.c
index 38201b339d..f849ec28d8 100644
--- a/clients/cli/devices.c
+++ b/clients/cli/devices.c
@@ -806,7 +806,7 @@ usage_device_modify (void)
 	              "\n"
 	              "ARGUMENTS := <ifname> ([+|-]<setting>.<property> <value>)+\n"
 	              "\n"
-	              "Modify one or more properties currently active on the device without modifying\n"
+	              "Modify one or more properties that are currently active on the device without modifying\n"
 	              "the connection profile. The changes have immediate effect. For multi-valued\n"
 	              "properties you can use optional '+' or '-' prefix to the property name.\n"
 	              "The '+' sign allows appending items instead of overwriting the whole value.\n"
diff --git a/clients/cli/nmcli.c b/clients/cli/nmcli.c
index 0ae4a4de57..9e8f627094 100644
--- a/clients/cli/nmcli.c
+++ b/clients/cli/nmcli.c
@@ -287,7 +287,7 @@ matches_arg (NmCli *nmc,
 
 	if (arg) {
 		/* If there's a "=" separator, replace it with NUL so that matches()
-		 * works and consider the part after it to be the arguemnt's value. */
+		 * works and consider the part after it to be the argument's value. */
 		s = strchr (opt, '=');
 		if (s) {
 			opt = nm_strndup_a (300, opt, s - opt, &opt_free);
diff --git a/clients/cli/settings.c b/clients/cli/settings.c
index 0487fb9680..c5c79f0987 100644
--- a/clients/cli/settings.c
+++ b/clients/cli/settings.c
@@ -338,7 +338,7 @@ _set_fcn_precheck_connection_secondaries (NMClient *client,
 				g_print (_("Warning: %s is not an UUID of any existing connection profile\n"),
 				         *iter);
 			} else {
-				/* Currently NM only supports VPN connections as secondaries */
+				/* Currently, NM only supports VPN connections as secondaries */
 				if (!nm_connection_is_type (con, NM_SETTING_VPN_SETTING_NAME)) {
 					g_set_error (error, 1, 0, _("'%s' is not a VPN connection profile"), *iter);
 					return FALSE;
@@ -351,7 +351,7 @@ _set_fcn_precheck_connection_secondaries (NMClient *client,
 				return FALSE;
 			}
 
-			/* Currently NM only supports VPN connections as secondaries */
+			/* Currently, NM only supports VPN connections as secondaries */
 			if (!nm_connection_is_type (con, NM_SETTING_VPN_SETTING_NAME)) {
 				g_set_error (error, 1, 0, _("'%s' is not a VPN connection profile"), *iter);
 				return FALSE;
diff --git a/clients/cloud-setup/nm-cloud-setup-utils.c b/clients/cloud-setup/nm-cloud-setup-utils.c
index ff059e7ace..5705c63179 100644
--- a/clients/cloud-setup/nm-cloud-setup-utils.c
+++ b/clients/cloud-setup/nm-cloud-setup-utils.c
@@ -6,6 +6,7 @@
 
 #include "nm-glib-aux/nm-time-utils.h"
 #include "nm-glib-aux/nm-logging-base.h"
+#include "nm-glib-aux/nm-str-buf.h"
 
 /*****************************************************************************/
 
@@ -257,7 +258,6 @@ _poll_task_data_free (gpointer data)
 
 static void
 _poll_return (PollTaskData *poll_task_data,
-              gboolean success,
               GError *error_take)
 {
 	nm_clear_g_source_inst (&poll_task_data->source_next_poll);
@@ -270,7 +270,7 @@ _poll_return (PollTaskData *poll_task_data,
 	if (error_take)
 		g_task_return_error (poll_task_data->task, g_steal_pointer (&error_take));
 	else
-		g_task_return_boolean (poll_task_data->task, success);
+		g_task_return_boolean (poll_task_data->task, TRUE);
 
 	g_object_unref (poll_task_data->task);
 }
@@ -301,7 +301,7 @@ _poll_done_cb (GObject *source,
 
 	if (   error
 	    || is_finished) {
-		_poll_return (poll_task_data, TRUE, g_steal_pointer (&error));
+		_poll_return (poll_task_data, g_steal_pointer (&error));
 		return;
 	}
 
@@ -345,8 +345,8 @@ _poll_timeout_cb (gpointer user_data)
 {
 	PollTaskData *poll_task_data = user_data;
 
-	_poll_return (poll_task_data, FALSE, nm_utils_error_new (NM_UTILS_ERROR_UNKNOWN,
-	                                                         "timeout expired"));
+	_poll_return (poll_task_data, nm_utils_error_new (NM_UTILS_ERROR_UNKNOWN,
+	                                                  "timeout expired"));
 	return G_SOURCE_CONTINUE;
 }
 
@@ -356,23 +356,22 @@ _poll_cancelled_cb (GObject *object, gpointer user_data)
 	PollTaskData *poll_task_data = user_data;
 	GError *error = NULL;
 
-	_LOGD (">> poll cancelled");
 	nm_clear_g_signal_handler (g_task_get_cancellable (poll_task_data->task),
 	                           &poll_task_data->cancellable_id);
 	nm_utils_error_set_cancelled (&error, FALSE, NULL);
-	_poll_return (poll_task_data, FALSE, error);
+	_poll_return (poll_task_data, error);
 }
 
 /**
  * nmcs_utils_poll:
  * @poll_timeout_ms: if >= 0, then this is the overall timeout for how long we poll.
- *   When this timeout expires, the request completes with failure (but no error set).
+ *   When this timeout expires, the request completes with failure (and error set).
  * @ratelimit_timeout_ms: if > 0, we ratelimit the starts from one prope_start_fcn
  *   call to the next.
  * @sleep_timeout_ms: if > 0, then we wait after a probe finished this timeout
  *   before the next. Together with @ratelimit_timeout_ms this determines how
  *   frequently we probe.
- * @probe_start_fcn: used to start a (asynchrnous) probe. A probe must be completed
+ * @probe_start_fcn: used to start a (asynchronous) probe. A probe must be completed
  *   by calling the provided callback. While a probe is in progress, we will not
  *   start another. This function is already invoked the first time synchronously,
  *   during nmcs_utils_poll().
@@ -459,7 +458,8 @@ nmcs_utils_poll (int poll_timeout_ms,
  *   %FALSE will be returned.
  *   If the probe returned a failure, this returns %FALSE and the error
  *   provided by @probe_finish_fcn.
- *   If the request times out, this returns %FALSE without error set.
+ *   If the request times out, this returns %FALSE with error set.
+ *   Error is always set if (and only if) the function returns %FALSE.
  */
 gboolean
 nmcs_utils_poll_finish (GAsyncResult *result,
@@ -565,15 +565,13 @@ nmcs_utils_uri_build_concat_v (const char *base,
                                const char **components,
                                gsize n_components)
 {
-	GString *uri;
+	NMStrBuf strbuf = NM_STR_BUF_INIT (NM_UTILS_GET_NEXT_REALLOC_SIZE_104, FALSE);
 
 	nm_assert (base);
 	nm_assert (base[0]);
 	nm_assert (!NM_STR_HAS_SUFFIX (base, "/"));
 
-	uri = g_string_sized_new (100);
-
-	g_string_append (uri, base);
+	nm_str_buf_append (&strbuf, base);
 
 	if (   n_components > 0
 	    && components[0]
@@ -583,18 +581,18 @@ nmcs_utils_uri_build_concat_v (const char *base,
 		 *
 		 * We only do that for the first component. */
 	} else
-		g_string_append_c (uri, '/');
+		nm_str_buf_append_c (&strbuf, '/');
 
 	while (n_components > 0) {
 		if (!components[0]) {
-			/* we allow NULL, to indicate nothing to append*/
+			/* we allow NULL, to indicate nothing to append */
 		} else
-			g_string_append (uri, components[0]);
+			nm_str_buf_append (&strbuf, components[0]);
 		components++;
 		n_components--;
 	}
 
-	return g_string_free (uri, FALSE);
+	return nm_str_buf_finalize (&strbuf, NULL);
 }
 
 /*****************************************************************************/
diff --git a/clients/cloud-setup/nm-http-client.c b/clients/cloud-setup/nm-http-client.c
index 946ed8ce93..a1f9586d28 100644
--- a/clients/cloud-setup/nm-http-client.c
+++ b/clients/cloud-setup/nm-http-client.c
@@ -7,6 +7,7 @@
 #include <curl/curl.h>
 
 #include "nm-cloud-setup-utils.h"
+#include "nm-glib-aux/nm-str-buf.h"
 
 #define NM_CURL_DEBUG 0
 
@@ -118,7 +119,7 @@ typedef struct {
 	CURLcode ehandle_result;
 	CURL *ehandle;
 	char *url;
-	GString *recv_data;
+	NMStrBuf recv_data;
 	struct curl_slist *headers;
 	gssize max_data;
 	gulong cancellable_id;
@@ -144,8 +145,7 @@ _ehandle_free (EHandleData *edata)
 
 	g_object_unref (edata->task);
 
-	if (edata->recv_data)
-		g_string_free (edata->recv_data, TRUE);
+	nm_str_buf_destroy (&edata->recv_data);
 	if (edata->headers)
 		curl_slist_free_all (edata->headers);
 	g_free (edata->url);
@@ -191,12 +191,15 @@ _ehandle_complete (EHandleData *edata,
 		_LOG2E (edata, "failed to get response code from curl easy handle");
 
 	_LOG2D (edata, "success getting %"G_GSIZE_FORMAT" bytes (response code %ld)",
-	        edata->recv_data->len,
+	        edata->recv_data.len,
 	        response_code);
 
 	_LOG2T (edata, "received %"G_GSIZE_FORMAT" bytes: [[%s]]",
-	       edata->recv_data->len,
-	       nm_utils_buf_utf8safe_escape (edata->recv_data->str, edata->recv_data->len, NM_UTILS_STR_UTF8_SAFE_FLAG_ESCAPE_CTRL, &str_tmp_1));
+	       edata->recv_data.len,
+	       nm_utils_buf_utf8safe_escape (nm_str_buf_get_str (&edata->recv_data),
+	                                     edata->recv_data.len,
+	                                     NM_UTILS_STR_UTF8_SAFE_FLAG_ESCAPE_CTRL,
+	                                     &str_tmp_1));
 
 	_ehandle_free_ehandle (edata);
 
@@ -205,7 +208,7 @@ _ehandle_complete (EHandleData *edata,
 		.response_code = response_code,
 		/* This ensures that response_data is always NUL terminated. This is an important guarantee
 		 * that NMHttpClient makes. */
-		.response_data = g_string_free_to_bytes (g_steal_pointer (&edata->recv_data)),
+		.response_data = nm_str_buf_finalize_to_gbytes (&edata->recv_data),
 	};
 
 	g_task_return_pointer (edata->task, get_result, _get_result_free);
@@ -225,14 +228,14 @@ _get_writefunction_cb (char *ptr, size_t size, size_t nmemb, void *user_data)
 	nmemb *= size;
 
 	if (edata->max_data >= 0) {
-		nm_assert (edata->recv_data->len <= edata->max_data);
-		nconsume = (((gsize) edata->max_data) - edata->recv_data->len);
+		nm_assert (edata->recv_data.len <= edata->max_data);
+		nconsume = (((gsize) edata->max_data) - edata->recv_data.len);
 		if (nconsume > nmemb)
 			nconsume = nmemb;
 	} else
 		nconsume = nmemb;
 
-	g_string_append_len (edata->recv_data, ptr, nconsume);
+	nm_str_buf_append_len (&edata->recv_data, ptr, nconsume);
 	return nconsume;
 }
 
@@ -283,7 +286,7 @@ nm_http_client_get (NMHttpClient *self,
 	edata = g_slice_new (EHandleData);
 	*edata = (EHandleData) {
 		.task           = nm_g_task_new (self, cancellable, nm_http_client_get, callback, user_data),
-		.recv_data      = g_string_sized_new (NM_MIN (max_data, 245)),
+		.recv_data      = NM_STR_BUF_INIT (0, FALSE),
 		.max_data       = max_data,
 		.url            = g_strdup (url),
 		.headers        = NULL,
@@ -351,6 +354,21 @@ nm_http_client_get (NMHttpClient *self,
 	}
 }
 
+/**
+ * nm_http_client_get_finish:
+ * @self: the #NMHttpClient instance
+ * @result: the #GAsyncResult which to complete.
+ * @out_response_code: (allow-none) (out): the HTTP response code or -1 on other error.
+ * @out_response_data: (allow-none) (transfer full): the HTTP response data, if any.
+ *   The GBytes buffer is guaranteed to have a trailing NUL character *after* the
+ *   returned buffer size. That means, you can always trust that the buffer is NUL terminated
+ *   and that there is one additional hidden byte after the data.
+ *   Also, the returned buffer is allocated just for you. While GBytes is immutable, you are
+ *   allowed to modify the buffer as it's not used by anybody else.
+ * @error: the error
+ *
+ * Returns: %TRUE on success or %FALSE with an error code.
+ */
 gboolean
 nm_http_client_get_finish (NMHttpClient *self,
                            GAsyncResult *result,
@@ -364,6 +382,9 @@ nm_http_client_get_finish (NMHttpClient *self,
 	g_return_val_if_fail (nm_g_task_is_valid (result, self, nm_http_client_get), FALSE);
 
 	get_result = g_task_propagate_pointer (G_TASK (result), error);
+
+	nm_assert (!error || (!!get_result) == (!*error));
+
 	if (!get_result) {
 		NM_SET_OUT (out_response_code, -1);
 		NM_SET_OUT (out_response_data, NULL);
@@ -376,7 +397,6 @@ nm_http_client_get_finish (NMHttpClient *self,
 	NM_SET_OUT (out_response_data, g_steal_pointer (&get_result->response_data));
 
 	_get_result_free (get_result);
-
 	return TRUE;
 }
 
@@ -447,11 +467,14 @@ _poll_get_probe_finish_fcn (GObject *source,
 	                                     &response_data,
 	                                     &local_error);
 
-	if (!success) {
+	nm_assert ((!!success) == (!local_error));
+
+	if (local_error) {
 		if (nm_utils_error_is_cancelled (local_error)) {
 			g_propagate_error (error, g_steal_pointer (&local_error));
 			return TRUE;
 		}
+		/* any other error. Continue polling. */
 		return FALSE;
 	}
 
@@ -468,8 +491,10 @@ _poll_get_probe_finish_fcn (GObject *source,
 		return TRUE;
 	}
 
-	if (!success)
+	if (!success) {
+		/* Not yet ready. Continue polling. */
 		return FALSE;
+	}
 
 	poll_get_data->response_code = response_code;
 	poll_get_data->response_data = g_steal_pointer (&response_data);
@@ -487,10 +512,12 @@ _poll_get_done_cb (GObject *source,
 
 	success = nmcs_utils_poll_finish (result, NULL, &error);
 
+	nm_assert ((!!success) == (!error));
+
 	if (error)
 		g_task_return_error (poll_get_data->task, g_steal_pointer (&error));
 	else
-		g_task_return_boolean (poll_get_data->task, success);
+		g_task_return_boolean (poll_get_data->task, TRUE);
 
 	g_object_unref (poll_get_data->task);
 }
@@ -569,10 +596,11 @@ nm_http_client_poll_get_finish (NMHttpClient *self,
 	task = G_TASK (result);
 
 	success = g_task_propagate_boolean (task, &local_error);
-	if (   local_error
-	    || !success) {
-		if (local_error)
-			g_propagate_error (error, g_steal_pointer (&local_error));
+
+	nm_assert ((!!success) == (!local_error));
+
+	if (local_error) {
+		g_propagate_error (error, g_steal_pointer (&local_error));
 		NM_SET_OUT (out_response_code, -1);
 		NM_SET_OUT (out_response_data, NULL);
 		return FALSE;
@@ -582,7 +610,6 @@ nm_http_client_poll_get_finish (NMHttpClient *self,
 
 	NM_SET_OUT (out_response_code, poll_get_data->response_code);
 	NM_SET_OUT (out_response_data, g_steal_pointer (&poll_get_data->response_data));
-
 	return TRUE;
 }
 
diff --git a/clients/cloud-setup/nmcs-provider-ec2.c b/clients/cloud-setup/nmcs-provider-ec2.c
index c8db31f97f..1578a33bed 100644
--- a/clients/cloud-setup/nmcs-provider-ec2.c
+++ b/clients/cloud-setup/nmcs-provider-ec2.c
@@ -90,13 +90,12 @@ _detect_get_meta_data_done_cb (GObject *source,
 	gs_unref_object GTask *task = user_data;
 	gs_free_error GError *get_error = NULL;
 	gs_free_error GError *error = NULL;
-	gboolean success;
 
-	success = nm_http_client_poll_get_finish (NM_HTTP_CLIENT (source),
-	                                          result,
-	                                          NULL,
-	                                          NULL,
-	                                          &get_error);
+	nm_http_client_poll_get_finish (NM_HTTP_CLIENT (source),
+	                                result,
+	                                NULL,
+	                                NULL,
+	                                &get_error);
 
 	if (nm_utils_error_is_cancelled (get_error)) {
 		g_task_return_error (task, g_steal_pointer (&get_error));
@@ -112,14 +111,6 @@ _detect_get_meta_data_done_cb (GObject *source,
 		return;
 	}
 
-	if (!success) {
-		nm_utils_error_set (&error,
-		                    NM_UTILS_ERROR_UNKNOWN,
-		                    "failure to detect EC2 metadata");
-		g_task_return_error (task, g_steal_pointer (&error));
-		return;
-	}
-
 	g_task_return_boolean (task, TRUE);
 }
 
@@ -191,31 +182,28 @@ _get_config_fetch_done_cb (NMHttpClient *http_client,
                            gboolean is_local_ipv4)
 {
 	GetConfigIfaceData *iface_data;
-	NMCSProviderGetConfigTaskData *get_config_data;
 	const char *hwaddr = NULL;
 	gs_unref_bytes GBytes *response_data = NULL;
 	gs_free_error GError *error = NULL;
-	gboolean success;
-	NMCSProviderGetConfigIfaceData *config_iface_data;
 
 	nm_utils_user_data_unpack (user_data, &iface_data, &hwaddr);
 
-	success = nm_http_client_poll_get_finish (http_client,
-	                                          result,
-	                                          NULL,
-	                                          &response_data,
-	                                          &error);
+	nm_http_client_poll_get_finish (http_client,
+	                                result,
+	                                NULL,
+	                                &response_data,
+	                                &error);
+
 	if (nm_utils_error_is_cancelled (error))
 		return;
 
-	get_config_data = iface_data->get_config_data;
-
-	config_iface_data = g_hash_table_lookup (get_config_data->result_dict, hwaddr);
-
-	if (success) {
+	if (!error) {
+		NMCSProviderGetConfigIfaceData *config_iface_data;
 		in_addr_t tmp_addr;
 		int tmp_prefix;
 
+		config_iface_data = g_hash_table_lookup (iface_data->get_config_data->result_dict, hwaddr);
+
 		if (is_local_ipv4) {
 			gs_free const char **s_addrs = NULL;
 			gsize i, len;
@@ -436,7 +424,9 @@ _get_config_metadata_ready_check (long response_code,
 	GetConfigMetadataData *metadata_data = check_user_data;
 	gs_unref_hashtable GHashTable *response_parsed = NULL;
 	const guint8 *r_data;
+	const char *cur_line;
 	gsize r_len;
+	gsize cur_line_len;
 	GHashTableIter h_iter;
 	gboolean has_all;
 	const char *c_hwaddr;
@@ -449,48 +439,33 @@ _get_config_metadata_ready_check (long response_code,
 	}
 
 	r_data = g_bytes_get_data (response_data, &r_len);
+	/* NMHttpClient guarantees that there is a trailing NUL after the data. */
+	nm_assert (r_data[r_len] == 0);
 
-	while (r_len > 0) {
-		const guint8 *p_eol;
-		const char *p_start;
-		gsize p_start_l;
-		gsize p_start_l_2;
-		char *hwaddr;
+	while (nm_utils_parse_next_line ((const char **) &r_data, &r_len, &cur_line, &cur_line_len)) {
 		GetConfigMetadataMac *mac_data;
+		char *hwaddr;
 
-		p_start = (const char *) r_data;
-
-		p_eol = memchr (r_data, '\n', r_len);
-		if (p_eol) {
-			p_start_l = (p_eol - r_data);
-			r_len -= p_start_l + 1;
-			r_data = &p_eol[1];
-		} else {
-			p_start_l = r_len;
-			r_data = &r_data[r_len];
-			r_len = 0;
-		}
-
-		if (p_start_l == 0)
+		if (cur_line_len == 0)
 			continue;
 
-		p_start_l_2 = p_start_l;
-		if (p_start[p_start_l_2 - 1] == '/') {
-			/* trim the trailing "/". */
-			p_start_l_2--;
-		}
+		/* Truncate the string. It's safe to do, because we own @response_data an it has an
+		 * extra NUL character after the buffer. */
+		((char *) cur_line)[cur_line_len] = '\0';
 
-		hwaddr = nmcs_utils_hwaddr_normalize (p_start, p_start_l_2);
+		hwaddr = nmcs_utils_hwaddr_normalize (cur_line,
+		                                        cur_line[cur_line_len - 1u] == '/'
+		                                      ? (gssize) (cur_line_len - 1u)
+		                                      : -1);
 		if (!hwaddr)
 			continue;
 
 		if (!response_parsed)
 			response_parsed = g_hash_table_new_full (nm_str_hash, g_str_equal, g_free, g_free);
 
-		mac_data = g_malloc (sizeof (GetConfigMetadataData) + 1 + p_start_l);
+		mac_data = g_malloc (sizeof (GetConfigMetadataMac) + 1u + cur_line_len);
 		mac_data->iface_idx = iface_idx_counter++;
-		memcpy (mac_data->path, p_start, p_start_l);
-		mac_data->path[p_start_l] = '\0';
+		memcpy (mac_data->path, cur_line, cur_line_len + 1u);
 
 		g_hash_table_insert (response_parsed, hwaddr, mac_data);
 	}
diff --git a/clients/cloud-setup/nmcs-provider-gcp.c b/clients/cloud-setup/nmcs-provider-gcp.c
index ba4016dd15..7a8f3ef893 100644
--- a/clients/cloud-setup/nmcs-provider-gcp.c
+++ b/clients/cloud-setup/nmcs-provider-gcp.c
@@ -46,13 +46,12 @@ _detect_get_meta_data_done_cb (GObject *source,
 	gs_unref_object GTask *task = user_data;
 	gs_free_error GError *get_error = NULL;
 	gs_free_error GError *error = NULL;
-	gboolean success;
 
-	success = nm_http_client_poll_get_finish (NM_HTTP_CLIENT (source),
-	                                          result,
-	                                          NULL,
-	                                          NULL,
-	                                          &get_error);
+	nm_http_client_poll_get_finish (NM_HTTP_CLIENT (source),
+	                                result,
+	                                NULL,
+	                                NULL,
+	                                &get_error);
 
 	if (nm_utils_error_is_cancelled (get_error)) {
 		g_task_return_error (task, g_steal_pointer (&get_error));
@@ -68,14 +67,6 @@ _detect_get_meta_data_done_cb (GObject *source,
 		return;
 	}
 
-	if (!success) {
-		nm_utils_error_set (&error,
-		                    NM_UTILS_ERROR_UNKNOWN,
-		                    "failure to detect GCP metadata");
-		g_task_return_error (task, g_steal_pointer (&error));
-		return;
-	}
-
 	g_task_return_boolean (task, TRUE);
 }
 
@@ -246,29 +237,29 @@ _get_config_ips_list_cb (GObject *source,
 	if (error)
 		goto fips_error;
 
+	response_str = g_bytes_get_data (response, &response_len);
+	/* NMHttpClient guarantees that there is a trailing NUL after the data. */
+	nm_assert (response_str[response_len] == 0);
 
 	uri_arr = g_ptr_array_new_with_free_func (g_free);
-	response_str = g_bytes_get_data (response, &response_len);
-
 	while (nm_utils_parse_next_line (&response_str,
 	                                 &response_len,
 	                                 &line,
 	                                 &line_len)) {
-		nm_auto_free_gstring GString *gstr = NULL;
 		gint64 fip_index;
 
-		gstr = g_string_new_len (line, line_len);
-		fip_index = _nm_utils_ascii_str_to_int64 (gstr->str, 10, 0, G_MAXINT64, -1);
+		/* Truncate the string. It's safe to do, because we own @response_data an it has an
+		 * extra NUL character after the buffer. */
+		((char *) line)[line_len] = '\0';
 
-		if (fip_index < 0) {
+		fip_index = _nm_utils_ascii_str_to_int64 (line, 10, 0, G_MAXINT64, -1);
+		if (fip_index < 0)
 			continue;
-		}
 
-		g_string_printf (gstr,
-		                 "%"G_GSSIZE_FORMAT"/forwarded-ips/%"G_GINT64_FORMAT,
-		                 iface_data->iface_idx,
-		                 fip_index);
-		g_ptr_array_add (uri_arr, g_string_free (g_steal_pointer (&gstr), FALSE));
+		g_ptr_array_add (uri_arr,
+		                 g_strdup_printf ("%"G_GSSIZE_FORMAT"/forwarded-ips/%"G_GINT64_FORMAT,
+		                                  iface_data->iface_idx,
+		                                  fip_index));
 	}
 
 	iface_data->n_fips_pending = uri_arr->len;
@@ -321,7 +312,7 @@ _get_config_iface_cb (GObject *source,
 	gs_free_error GError *error = NULL;
 	gs_free const char *hwaddr = NULL;
 	gs_free const char *uri = NULL;
-	gs_free char *str = NULL;
+	char sbuf[100];
 	GCPData *gcp_data;
 
 	gcp_data = iface_data->gcp_data;
@@ -350,11 +341,10 @@ _get_config_iface_cb (GObject *source,
 	       iface_data->iface_idx,
 	       hwaddr);
 
-	str = g_strdup_printf ("%"G_GSSIZE_FORMAT"/forwarded-ips/",
-	                       iface_data->iface_idx);
+	nm_sprintf_buf (sbuf, "%"G_GSSIZE_FORMAT"/forwarded-ips/", iface_data->iface_idx);
 
 	nm_http_client_poll_get (NM_HTTP_CLIENT (source),
-	                         (uri = _gcp_uri_interfaces (str)),
+	                         (uri = _gcp_uri_interfaces (sbuf)),
 	                         HTTP_TIMEOUT_MS,
 	                         HTTP_REQ_MAX_DATA,
 	                         HTTP_POLL_TIMEOUT_MS,
@@ -379,13 +369,10 @@ _get_net_ifaces_list_cb (GObject *source,
                          gpointer user_data)
 {
 	gs_unref_ptrarray GPtrArray *ifaces_arr = NULL;
-	nm_auto_free_gstring GString *gstr = NULL;
 	gs_unref_bytes GBytes *response = NULL;
 	gs_free_error GError *error = NULL;
 	GCPData *gcp_data = user_data;
 	const char *response_str;
-	const char *token_start;
-	const char *token_end;
 	gsize response_len;
 	const char *line;
 	gsize line_len;
@@ -403,8 +390,10 @@ _get_net_ifaces_list_cb (GObject *source,
 	}
 
 	response_str = g_bytes_get_data (response, &response_len);
+	/* NMHttpClient guarantees that there is a trailing NUL after the data. */
+	nm_assert (response_str[response_len] == 0);
+
 	ifaces_arr = g_ptr_array_new ();
-	gstr = g_string_new (NULL);
 
 	while (nm_utils_parse_next_line (&response_str,
 	                                 &response_len,
@@ -413,16 +402,16 @@ _get_net_ifaces_list_cb (GObject *source,
 		GCPIfaceData *iface_data;
 		gssize iface_idx;
 
-		token_start = line;
-		token_end = memchr (token_start, '/', line_len);
-
-		if (!token_end)
+		if (line_len == 0)
 			continue;
 
-		g_string_truncate (gstr, 0);
-		g_string_append_len (gstr, token_start, token_end - token_start);
-		iface_idx = _nm_utils_ascii_str_to_int64 (gstr->str, 10, 0, G_MAXSSIZE, -1);
+		/* Truncate the string. It's safe to do, because we own @response_data an it has an
+		 * extra NUL character after the buffer. */
+		((char *) line)[line_len] = '\0';
+		if (line[line_len - 1] == '/')
+			((char *) line)[--line_len] = '\0';
 
+		iface_idx = _nm_utils_ascii_str_to_int64 (line, 10, 0, G_MAXSSIZE, -1);
 		if (iface_idx < 0)
 			continue;
 
@@ -442,14 +431,15 @@ _get_net_ifaces_list_cb (GObject *source,
 	for (i = 0; i < ifaces_arr->len; ++i) {
 		GCPIfaceData *data = ifaces_arr->pdata[i];
 		gs_free const char *uri = NULL;
+		char sbuf[100];
 
 		_LOGD ("GCP interface[%"G_GSSIZE_FORMAT"]: retrieving configuration",
 		       data->iface_idx);
 
-		g_string_printf (gstr, "%"G_GSSIZE_FORMAT"/mac", data->iface_idx);
+		nm_sprintf_buf (sbuf, "%"G_GSSIZE_FORMAT"/mac", data->iface_idx);
 
 		nm_http_client_poll_get (NM_HTTP_CLIENT (source),
-		                         (uri = _gcp_uri_interfaces (gstr->str)),
+		                         (uri = _gcp_uri_interfaces (sbuf)),
 		                         HTTP_TIMEOUT_MS,
 		                         HTTP_REQ_MAX_DATA,
 		                         HTTP_POLL_TIMEOUT_MS,
@@ -484,7 +474,6 @@ get_config (NMCSProvider *provider,
 		.n_ifaces_pending = 0,
 		.error = NULL,
 		.success = FALSE,
-
 	};
 
 	nm_http_client_poll_get (nmcs_provider_get_http_client (provider),
diff --git a/clients/common/nm-client-utils.c b/clients/common/nm-client-utils.c
index d3a02161ce..a063fd596d 100644
--- a/clients/common/nm-client-utils.c
+++ b/clients/common/nm-client-utils.c
@@ -515,7 +515,7 @@ can_show_graphics (void)
  * Converts @strength into a 4-character-wide graphical representation of
  * strength suitable for printing to stdout. If the current locale and terminal
  * support it, this will use unicode graphics characters to represent
- * "bars". Otherwise it will use 0 to 4 asterisks.
+ * "bars". Otherwise, it will use 0 to 4 asterisks.
  *
  * Returns: the graphical representation of the access point strength
  */
diff --git a/clients/common/nm-meta-setting-desc.c b/clients/common/nm-meta-setting-desc.c
index 2ac91b415c..5a574adea1 100644
--- a/clients/common/nm-meta-setting-desc.c
+++ b/clients/common/nm-meta-setting-desc.c
@@ -834,14 +834,14 @@ _get_fcn_gobject_impl (const NMMetaPropertyInfo *property_info,
 	                                                     G_TYPE_HASH_TABLE);
 
 	if (glib_handles_str_transform) {
-		/* We rely on the type convertion of the gobject property to string. */
+		/* We rely on the type conversion of the gobject property to string. */
 		g_value_init (&val, G_TYPE_STRING);
 	} else
 		g_value_init (&val, gtype_prop);
 
 	g_object_get_property (G_OBJECT (setting), property_info->property_name, &val);
 
-	/* Currently only one particular property asks us to "handle_emptyunset".
+	/* Currently, only one particular property asks us to "handle_emptyunset".
 	 * So, don't implement it (yet) for the other types, where it's unneeded. */
 	nm_assert (   !handle_emptyunset
 	           || (   gtype_prop == G_TYPE_STRV
@@ -3294,7 +3294,7 @@ _set_fcn_objlist (ARGS_SET_FCN)
 	}
 
 	for (i = 0; i < nstrv; i++) {
-		/* FIXME: there is the problem here that set_fcn() might succed on the first item
+		/* FIXME: there is the problem here that set_fcn() might succeed on the first item
 		 * (modifying it), and fail to parse the second one.
 		 *
 		 * Optimally, we would first parse all input strings before starting the
@@ -7507,6 +7507,9 @@ static const NMMetaPropertyInfo *const property_infos_WIRELESS[] = {
 	        ),
 	    ),
 	),
+	PROPERTY_INFO_WITH_DESC (NM_SETTING_WIRELESS_AP_ISOLATION,
+	    .property_type =                &_pt_gobject_enum,
+	),
 	NULL
 };
 
diff --git a/clients/common/qrcodegen.c b/clients/common/qrcodegen.c
index 7cda9659b8..bbbc7d5e5f 100644
--- a/clients/common/qrcodegen.c
+++ b/clients/common/qrcodegen.c
@@ -970,7 +970,7 @@ struct qrcodegen_Segment qrcodegen_makeEci(long assignVal, uint8_t buf[]) {
 
 
 // Calculates the number of bits needed to encode the given segments at the given version.
-// Returns a non-negative number if successful. Otherwise returns -1 if a segment has too
+// Returns a non-negative number if successful. Otherwise, returns -1 if a segment has too
 // many characters to fit its length field, or the total bits exceeds INT16_MAX.
 testable int getTotalBits(const struct qrcodegen_Segment segs[], size_t len, int version) {
 	assert(segs != NULL || len == 0);
diff --git a/clients/common/settings-docs.h.in b/clients/common/settings-docs.h.in
index 7b891500d8..e6bca1377b 100644
--- a/clients/common/settings-docs.h.in
+++ b/clients/common/settings-docs.h.in
@@ -4,6 +4,7 @@
 #define DESCRIBE_DOC_NM_SETTING_OLPC_MESH_CHANNEL N_("Channel on which the mesh network to join is located.")
 #define DESCRIBE_DOC_NM_SETTING_OLPC_MESH_DHCP_ANYCAST_ADDRESS N_("Anycast DHCP MAC address used when requesting an IP address via DHCP. The specific anycast address used determines which DHCP server class answers the request.")
 #define DESCRIBE_DOC_NM_SETTING_OLPC_MESH_SSID N_("SSID of the mesh network to join.")
+#define DESCRIBE_DOC_NM_SETTING_WIRELESS_AP_ISOLATION N_("Configures AP isolation, which prevents communication between wireless devices connected to this AP. This property can be set to a value different from NM_TERNARY_DEFAULT (-1) only when the interface is configured in AP mode. If set to NM_TERNARY_TRUE (1), devices are not able to communicate with each other. This increases security because it protects devices against attacks from other clients in the network. At the same time, it prevents devices to access resources on the same wireless networks as file shares, printers, etc. If set to NM_TERNARY_FALSE (0), devices can talk to each other. When set to NM_TERNARY_DEFAULT (-1), the global default is used; in case the global default is unspecified it is assumed to be NM_TERNARY_FALSE (0).")
 #define DESCRIBE_DOC_NM_SETTING_WIRELESS_BAND N_("802.11 frequency band of the network.  One of \"a\" for 5GHz 802.11a or \"bg\" for 2.4GHz 802.11.  This will lock associations to the Wi-Fi network to the specific band, i.e. if \"a\" is specified, the device will not associate with the same network in the 2.4GHz band even if the network's settings are compatible.  This setting depends on specific driver capability and may not work with all drivers.")
 #define DESCRIBE_DOC_NM_SETTING_WIRELESS_BSSID N_("If specified, directs the device to only associate with the given access point.  This capability is highly driver dependent and not supported by all devices.  Note: this property does not control the BSSID used when creating an Ad-Hoc network and is unlikely to in the future.")
 #define DESCRIBE_DOC_NM_SETTING_WIRELESS_CHANNEL N_("Wireless channel to use for the Wi-Fi connection.  The device will only join (or create for Ad-Hoc networks) a Wi-Fi network on the specified channel.  Because channel numbers overlap between bands, this property also requires the \"band\" property to be set.")
@@ -128,7 +129,7 @@
 #define DESCRIBE_DOC_NM_SETTING_BRIDGE_MULTICAST_QUERY_INTERVAL N_("Interval (in deciseconds) between queries sent by the bridge after the end of the startup phase.")
 #define DESCRIBE_DOC_NM_SETTING_BRIDGE_MULTICAST_QUERY_RESPONSE_INTERVAL N_("Set the Max Response Time/Max Response Delay (in deciseconds) for IGMP/MLD queries sent by the bridge.")
 #define DESCRIBE_DOC_NM_SETTING_BRIDGE_MULTICAST_QUERY_USE_IFADDR N_("If enabled the bridge's own IP address is used as the source address for IGMP queries otherwise the default of 0.0.0.0 is used.")
-#define DESCRIBE_DOC_NM_SETTING_BRIDGE_MULTICAST_ROUTER N_("Sets bridge's multicast router. Multicast-snooping must be enabled for this option to work. Supported values are: 'auto', 'disabled', 'enabled'. If not specified the default value is 'auto'.")
+#define DESCRIBE_DOC_NM_SETTING_BRIDGE_MULTICAST_ROUTER N_("Sets bridge's multicast router. Multicast-snooping must be enabled for this option to work. Supported values are: 'auto', 'disabled', 'enabled' to which kernel assigns the numbers 1, 0, and 2, respectively. If not specified the default value is 'auto' (1).")
 #define DESCRIBE_DOC_NM_SETTING_BRIDGE_MULTICAST_SNOOPING N_("Controls whether IGMP snooping is enabled for this bridge. Note that if snooping was automatically disabled due to hash collisions, the system may refuse to enable the feature until the collisions are resolved.")
 #define DESCRIBE_DOC_NM_SETTING_BRIDGE_MULTICAST_STARTUP_QUERY_COUNT N_("Set the number of IGMP queries to send during startup phase.")
 #define DESCRIBE_DOC_NM_SETTING_BRIDGE_MULTICAST_STARTUP_QUERY_INTERVAL N_("Sets the time (in deciseconds) between queries sent out at startup to determine membership information.")
@@ -148,7 +149,7 @@
 #define DESCRIBE_DOC_NM_SETTING_CDMA_PASSWORD N_("The password used to authenticate with the network, if required.  Many providers do not require a password, or accept any password.  But if a password is required, it is specified here.")
 #define DESCRIBE_DOC_NM_SETTING_CDMA_PASSWORD_FLAGS N_("Flags indicating how to handle the \"password\" property.")
 #define DESCRIBE_DOC_NM_SETTING_CDMA_USERNAME N_("The username used to authenticate with the network, if required.  Many providers do not require a username, or accept any username.  But if a username is required, it is specified here.")
-#define DESCRIBE_DOC_NM_SETTING_CONNECTION_AUTH_RETRIES N_("The number of retries for the authentication. Zero means to try indefinitely; -1 means to use a global default. If the global default is not set, the authentication retries for 3 times before failing the connection. Currently this only applies to 802-1x authentication.")
+#define DESCRIBE_DOC_NM_SETTING_CONNECTION_AUTH_RETRIES N_("The number of retries for the authentication. Zero means to try indefinitely; -1 means to use a global default. If the global default is not set, the authentication retries for 3 times before failing the connection. Currently, this only applies to 802-1x authentication.")
 #define DESCRIBE_DOC_NM_SETTING_CONNECTION_AUTOCONNECT N_("Whether or not the connection should be automatically connected by NetworkManager when the resources for the connection are available. TRUE to automatically activate the connection, FALSE to require manual intervention to activate the connection. Note that autoconnect is not implemented for VPN profiles. See \"secondaries\" as an alternative to automatically connect VPN profiles.")
 #define DESCRIBE_DOC_NM_SETTING_CONNECTION_AUTOCONNECT_PRIORITY N_("The autoconnect priority. If the connection is set to autoconnect, connections with higher priority will be preferred. Defaults to 0. The higher number means higher priority.")
 #define DESCRIBE_DOC_NM_SETTING_CONNECTION_AUTOCONNECT_RETRIES N_("The number of times a connection should be tried when autoactivating before giving up. Zero means forever, -1 means the global default (4 times if not overridden). Setting this to 1 means to try activation only once before blocking autoconnect. Note that after a timeout, NetworkManager will try to autoconnect again.")
@@ -157,17 +158,17 @@
 #define DESCRIBE_DOC_NM_SETTING_CONNECTION_ID N_("A human readable unique identifier for the connection, like \"Work Wi-Fi\" or \"T-Mobile 3G\".")
 #define DESCRIBE_DOC_NM_SETTING_CONNECTION_INTERFACE_NAME N_("The name of the network interface this connection is bound to. If not set, then the connection can be attached to any interface of the appropriate type (subject to restrictions imposed by other settings). For software devices this specifies the name of the created device. For connection types where interface names cannot easily be made persistent (e.g. mobile broadband or USB Ethernet), this property should not be used. Setting this property restricts the interfaces a connection can be used with, and if interface names change or are reordered the connection may be applied to the wrong interface.")
 #define DESCRIBE_DOC_NM_SETTING_CONNECTION_LLDP N_("Whether LLDP is enabled for the connection.")
-#define DESCRIBE_DOC_NM_SETTING_CONNECTION_LLMNR N_("Whether Link-Local Multicast Name Resolution (LLMNR) is enabled for the connection. LLMNR is a protocol based on the Domain Name System (DNS) packet format that allows both IPv4 and IPv6 hosts to perform name resolution for hosts on the same local link. The permitted values are: \"yes\" (2) register hostname and resolving for the connection, \"no\" (0) disable LLMNR for the interface, \"resolve\" (1) do not register hostname but allow resolving of LLMNR host names If unspecified, \"default\" ultimately depends on the DNS plugin (which for systemd-resolved currently means \"yes\"). This feature requires a plugin which supports LLMNR. Otherwise the setting has no effect. One such plugin is dns-systemd-resolved.")
+#define DESCRIBE_DOC_NM_SETTING_CONNECTION_LLMNR N_("Whether Link-Local Multicast Name Resolution (LLMNR) is enabled for the connection. LLMNR is a protocol based on the Domain Name System (DNS) packet format that allows both IPv4 and IPv6 hosts to perform name resolution for hosts on the same local link. The permitted values are: \"yes\" (2) register hostname and resolving for the connection, \"no\" (0) disable LLMNR for the interface, \"resolve\" (1) do not register hostname but allow resolving of LLMNR host names If unspecified, \"default\" ultimately depends on the DNS plugin (which for systemd-resolved currently means \"yes\"). This feature requires a plugin which supports LLMNR. Otherwise, the setting has no effect. One such plugin is dns-systemd-resolved.")
 #define DESCRIBE_DOC_NM_SETTING_CONNECTION_MASTER N_("Interface name of the master device or UUID of the master connection.")
-#define DESCRIBE_DOC_NM_SETTING_CONNECTION_MDNS N_("Whether mDNS is enabled for the connection. The permitted values are: \"yes\" (2) register hostname and resolving for the connection, \"no\" (0) disable mDNS for the interface, \"resolve\" (1) do not register hostname but allow resolving of mDNS host names and \"default\" (-1) to allow lookup of a global default in NetworkManager.conf. If unspecified, \"default\" ultimately depends on the DNS plugin (which for systemd-resolved currently means \"no\"). This feature requires a plugin which supports mDNS. Otherwise the setting has no effect. One such plugin is dns-systemd-resolved.")
+#define DESCRIBE_DOC_NM_SETTING_CONNECTION_MDNS N_("Whether mDNS is enabled for the connection. The permitted values are: \"yes\" (2) register hostname and resolving for the connection, \"no\" (0) disable mDNS for the interface, \"resolve\" (1) do not register hostname but allow resolving of mDNS host names and \"default\" (-1) to allow lookup of a global default in NetworkManager.conf. If unspecified, \"default\" ultimately depends on the DNS plugin (which for systemd-resolved currently means \"no\"). This feature requires a plugin which supports mDNS. Otherwise, the setting has no effect. One such plugin is dns-systemd-resolved.")
 #define DESCRIBE_DOC_NM_SETTING_CONNECTION_METERED N_("Whether the connection is metered. When updating this property on a currently activated connection, the change takes effect immediately.")
 #define DESCRIBE_DOC_NM_SETTING_CONNECTION_MUD_URL N_("If configured, set to a Manufacturer Usage Description (MUD) URL that points to manufacturer-recommended network policies for IoT devices. It is transmitted as a DHCPv4 or DHCPv6 option. The value must be a valid URL starting with \"https://\". The special value \"none\" is allowed to indicate that no MUD URL is used. If the per-profile value is unspecified (the default), a global connection default gets consulted. If still unspecified, the ultimate default is \"none\".")
 #define DESCRIBE_DOC_NM_SETTING_CONNECTION_MULTI_CONNECT N_("Specifies whether the profile can be active multiple times at a particular moment. The value is of type NMConnectionMultiConnect.")
 #define DESCRIBE_DOC_NM_SETTING_CONNECTION_PERMISSIONS N_("An array of strings defining what access a given user has to this connection.  If this is NULL or empty, all users are allowed to access this connection; otherwise users are allowed if and only if they are in this list.  When this is not empty, the connection can be active only when one of the specified users is logged into an active session.  Each entry is of the form \"[type]:[id]:[reserved]\"; for example, \"user:dcbw:blah\". At this time only the \"user\" [type] is allowed.  Any other values are ignored and reserved for future use.  [id] is the username that this permission refers to, which may not contain the \":\" character. Any [reserved] information present must be ignored and is reserved for future use.  All of [type], [id], and [reserved] must be valid UTF-8.")
 #define DESCRIBE_DOC_NM_SETTING_CONNECTION_READ_ONLY N_("FALSE if the connection can be modified using the provided settings service's D-Bus interface with the right privileges, or TRUE if the connection is read-only and cannot be modified.")
-#define DESCRIBE_DOC_NM_SETTING_CONNECTION_SECONDARIES N_("List of connection UUIDs that should be activated when the base connection itself is activated. Currently only VPN connections are supported.")
+#define DESCRIBE_DOC_NM_SETTING_CONNECTION_SECONDARIES N_("List of connection UUIDs that should be activated when the base connection itself is activated. Currently, only VPN connections are supported.")
 #define DESCRIBE_DOC_NM_SETTING_CONNECTION_SLAVE_TYPE N_("Setting name of the device type of this slave's master connection (eg, \"bond\"), or NULL if this connection is not a slave.")
-#define DESCRIBE_DOC_NM_SETTING_CONNECTION_STABLE_ID N_("This represents the identity of the connection used for various purposes. It allows to configure multiple profiles to share the identity. Also, the stable-id can contain placeholders that are substituted dynamically and deterministically depending on the context. The stable-id is used for generating IPv6 stable private addresses with ipv6.addr-gen-mode=stable-privacy. It is also used to seed the generated cloned MAC address for ethernet.cloned-mac-address=stable and wifi.cloned-mac-address=stable. It is also used as DHCP client identifier with ipv4.dhcp-client-id=stable and to derive the DHCP DUID with ipv6.dhcp-duid=stable-[llt,ll,uuid]. Note that depending on the context where it is used, other parameters are also seeded into the generation algorithm. For example, a per-host key is commonly also included, so that different systems end up generating different IDs. Or with ipv6.addr-gen-mode=stable-privacy, also the device's name is included, so that different interfaces yield different addresses. The '$' character is treated special to perform dynamic substitutions at runtime. Currently supported are \"${CONNECTION}\", \"${DEVICE}\", \"${MAC}\", \"${BOOT}\", \"${RANDOM}\". These effectively create unique IDs per-connection, per-device, per-boot, or every time. Note that \"${DEVICE}\" corresponds to the interface name of the device and \"${MAC}\" is the permanent MAC address of the device. Any unrecognized patterns following '$' are treated verbatim, however are reserved for future use. You are thus advised to avoid '$' or escape it as \"$$\". For example, set it to \"${CONNECTION}-${BOOT}-${DEVICE}\" to create a unique id for this connection that changes with every reboot and differs depending on the interface where the profile activates. If the value is unset, a global connection default is consulted. If the value is still unset, the default is similar to \"${CONNECTION}\" and uses a unique, fixed ID for the connection.")
+#define DESCRIBE_DOC_NM_SETTING_CONNECTION_STABLE_ID N_("This represents the identity of the connection used for various purposes. It allows to configure multiple profiles to share the identity. Also, the stable-id can contain placeholders that are substituted dynamically and deterministically depending on the context. The stable-id is used for generating IPv6 stable private addresses with ipv6.addr-gen-mode=stable-privacy. It is also used to seed the generated cloned MAC address for ethernet.cloned-mac-address=stable and wifi.cloned-mac-address=stable. It is also used as DHCP client identifier with ipv4.dhcp-client-id=stable and to derive the DHCP DUID with ipv6.dhcp-duid=stable-[llt,ll,uuid]. Note that depending on the context where it is used, other parameters are also seeded into the generation algorithm. For example, a per-host key is commonly also included, so that different systems end up generating different IDs. Or with ipv6.addr-gen-mode=stable-privacy, also the device's name is included, so that different interfaces yield different addresses. The '$' character is treated special to perform dynamic substitutions at runtime. Currently, supported are \"${CONNECTION}\", \"${DEVICE}\", \"${MAC}\", \"${BOOT}\", \"${RANDOM}\". These effectively create unique IDs per-connection, per-device, per-boot, or every time. Note that \"${DEVICE}\" corresponds to the interface name of the device and \"${MAC}\" is the permanent MAC address of the device. Any unrecognized patterns following '$' are treated verbatim, however are reserved for future use. You are thus advised to avoid '$' or escape it as \"$$\". For example, set it to \"${CONNECTION}-${BOOT}-${DEVICE}\" to create a unique id for this connection that changes with every reboot and differs depending on the interface where the profile activates. If the value is unset, a global connection default is consulted. If the value is still unset, the default is similar to \"${CONNECTION}\" and uses a unique, fixed ID for the connection.")
 #define DESCRIBE_DOC_NM_SETTING_CONNECTION_TIMESTAMP N_("The time, in seconds since the Unix Epoch, that the connection was last _successfully_ fully activated. NetworkManager updates the connection timestamp periodically when the connection is active to ensure that an active connection has the latest timestamp. The property is only meant for reading (changes to this property will not be preserved).")
 #define DESCRIBE_DOC_NM_SETTING_CONNECTION_TYPE N_("Base type of the connection. For hardware-dependent connections, should contain the setting name of the hardware-type specific setting (ie, \"802-3-ethernet\" or \"802-11-wireless\" or \"bluetooth\", etc), and for non-hardware dependent connections like VPN or otherwise, should contain the setting name of that setting type (ie, \"vpn\" or \"bridge\", etc).")
 #define DESCRIBE_DOC_NM_SETTING_CONNECTION_UUID N_("A universally unique identifier for the connection, for example generated with libuuid.  It should be assigned when the connection is created, and never changed as long as the connection still applies to the same network.  For example, it should not be changed when the \"id\" property or NMSettingIP4Config changes, but might need to be re-created when the Wi-Fi SSID, mobile broadband network provider, or \"type\" property changes. The UUID must be in the format \"2815492f-7e56-435e-b2e9-246bd7cdc664\" (ie, contains only hexadecimal characters and \"-\").")
@@ -204,11 +205,11 @@
 #define DESCRIBE_DOC_NM_SETTING_GSM_USERNAME N_("The username used to authenticate with the network, if required.  Many providers do not require a username, or accept any username.  But if a username is required, it is specified here.")
 #define DESCRIBE_DOC_NM_SETTING_INFINIBAND_MAC_ADDRESS N_("If specified, this connection will only apply to the IPoIB device whose permanent MAC address matches. This property does not change the MAC address of the device (i.e. MAC spoofing).")
 #define DESCRIBE_DOC_NM_SETTING_INFINIBAND_MTU N_("If non-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple frames.")
-#define DESCRIBE_DOC_NM_SETTING_INFINIBAND_P_KEY N_("The InfiniBand P_Key to use for this device. A value of -1 means to use the default P_Key (aka \"the P_Key at index 0\").  Otherwise it is a 16-bit unsigned integer, whose high bit is set if it is a \"full membership\" P_Key.")
+#define DESCRIBE_DOC_NM_SETTING_INFINIBAND_P_KEY N_("The InfiniBand P_Key to use for this device. A value of -1 means to use the default P_Key (aka \"the P_Key at index 0\"). Otherwise, it is a 16-bit unsigned integer, whose high bit is set if it is a \"full membership\" P_Key.")
 #define DESCRIBE_DOC_NM_SETTING_INFINIBAND_PARENT N_("The interface name of the parent device of this device. Normally NULL, but if the \"p_key\" property is set, then you must specify the base device by setting either this property or \"mac-address\".")
 #define DESCRIBE_DOC_NM_SETTING_INFINIBAND_TRANSPORT_MODE N_("The IP-over-InfiniBand transport mode. Either \"datagram\" or \"connected\".")
 #define DESCRIBE_DOC_NM_SETTING_IP_TUNNEL_ENCAPSULATION_LIMIT N_("How many additional levels of encapsulation are permitted to be prepended to packets. This property applies only to IPv6 tunnels.")
-#define DESCRIBE_DOC_NM_SETTING_IP_TUNNEL_FLAGS N_("Tunnel flags. Currently the following values are supported: NM_IP_TUNNEL_FLAG_IP6_IGN_ENCAP_LIMIT (0x1), NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_TCLASS (0x2), NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_FLOWLABEL (0x4), NM_IP_TUNNEL_FLAG_IP6_MIP6_DEV (0x8), NM_IP_TUNNEL_FLAG_IP6_RCV_DSCP_COPY (0x10), NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_FWMARK (0x20). They are valid only for IPv6 tunnels.")
+#define DESCRIBE_DOC_NM_SETTING_IP_TUNNEL_FLAGS N_("Tunnel flags. Currently, the following values are supported: NM_IP_TUNNEL_FLAG_IP6_IGN_ENCAP_LIMIT (0x1), NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_TCLASS (0x2), NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_FLOWLABEL (0x4), NM_IP_TUNNEL_FLAG_IP6_MIP6_DEV (0x8), NM_IP_TUNNEL_FLAG_IP6_RCV_DSCP_COPY (0x10), NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_FWMARK (0x20). They are valid only for IPv6 tunnels.")
 #define DESCRIBE_DOC_NM_SETTING_IP_TUNNEL_FLOW_LABEL N_("The flow label to assign to tunnel packets. This property applies only to IPv6 tunnels.")
 #define DESCRIBE_DOC_NM_SETTING_IP_TUNNEL_INPUT_KEY N_("The key used for tunnel input packets; the property is valid only for certain tunnel modes (GRE, IP6GRE). If empty, no key is used.")
 #define DESCRIBE_DOC_NM_SETTING_IP_TUNNEL_LOCAL N_("The local endpoint of the tunnel; the value can be empty, otherwise it must contain an IPv4 or IPv6 address.")
@@ -225,7 +226,7 @@
 #define DESCRIBE_DOC_NM_SETTING_IP4_CONFIG_DHCP_CLIENT_ID N_("A string sent to the DHCP server to identify the local machine which the DHCP server may use to customize the DHCP lease and options. When the property is a hex string ('aa:bb:cc') it is interpreted as a binary client ID, in which case the first byte is assumed to be the 'type' field as per RFC 2132 section 9.14 and the remaining bytes may be an hardware address (e.g. '01:xx:xx:xx:xx:xx:xx' where 1 is the Ethernet ARP type and the rest is a MAC address). If the property is not a hex string it is considered as a non-hardware-address client ID and the 'type' field is set to 0. The special values \"mac\" and \"perm-mac\" are supported, which use the current or permanent MAC address of the device to generate a client identifier with type ethernet (01). Currently, these options only work for ethernet type of links. The special value \"duid\" generates a RFC4361-compliant client identifier based on a hash of the interface name as IAID and /etc/machine-id. The special value \"stable\" is supported to generate a type 0 client identifier based on the stable-id (see connection.stable-id) and a per-host key. If you set the stable-id, you may want to include the \"${DEVICE}\" or \"${MAC}\" specifier to get a per-device key. If unset, a globally configured default is used. If still unset, the default depends on the DHCP plugin.")
 #define DESCRIBE_DOC_NM_SETTING_IP4_CONFIG_DHCP_FQDN N_("If the \"dhcp-send-hostname\" property is TRUE, then the specified FQDN will be sent to the DHCP server when acquiring a lease. This property and \"dhcp-hostname\" are mutually exclusive and cannot be set at the same time.")
 #define DESCRIBE_DOC_NM_SETTING_IP4_CONFIG_DHCP_HOSTNAME N_("If the \"dhcp-send-hostname\" property is TRUE, then the specified name will be sent to the DHCP server when acquiring a lease. This property and \"dhcp-fqdn\" are mutually exclusive and cannot be set at the same time.")
-#define DESCRIBE_DOC_NM_SETTING_IP4_CONFIG_DHCP_HOSTNAME_FLAGS N_("Flags for the DHCP hostname and FQDN. Currently this property only includes flags to control the FQDN flags set in the DHCP FQDN option. Supported FQDN flags are NM_DHCP_HOSTNAME_FLAG_FQDN_SERV_UPDATE (0x1), NM_DHCP_HOSTNAME_FLAG_FQDN_ENCODED (0x2) and NM_DHCP_HOSTNAME_FLAG_FQDN_NO_UPDATE (0x4).  When no FQDN flag is set and NM_DHCP_HOSTNAME_FLAG_FQDN_CLEAR_FLAGS (0x8) is set, the DHCP FQDN option will contain no flag. Otherwise, if no FQDN flag is set and NM_DHCP_HOSTNAME_FLAG_FQDN_CLEAR_FLAGS (0x8) is not set, the standard FQDN flags are set in the request: NM_DHCP_HOSTNAME_FLAG_FQDN_SERV_UPDATE (0x1), NM_DHCP_HOSTNAME_FLAG_FQDN_ENCODED (0x2) for IPv4 and NM_DHCP_HOSTNAME_FLAG_FQDN_SERV_UPDATE (0x1) for IPv6. When this property is set to the default value NM_DHCP_HOSTNAME_FLAG_NONE (0x0), a global default is looked up in NetworkManager configuration. If that value is unset or also NM_DHCP_HOSTNAME_FLAG_NONE (0x0), then the standard FQDN flags described above are sent in the DHCP requests.")
+#define DESCRIBE_DOC_NM_SETTING_IP4_CONFIG_DHCP_HOSTNAME_FLAGS N_("Flags for the DHCP hostname and FQDN. Currently, this property only includes flags to control the FQDN flags set in the DHCP FQDN option. Supported FQDN flags are NM_DHCP_HOSTNAME_FLAG_FQDN_SERV_UPDATE (0x1), NM_DHCP_HOSTNAME_FLAG_FQDN_ENCODED (0x2) and NM_DHCP_HOSTNAME_FLAG_FQDN_NO_UPDATE (0x4).  When no FQDN flag is set and NM_DHCP_HOSTNAME_FLAG_FQDN_CLEAR_FLAGS (0x8) is set, the DHCP FQDN option will contain no flag. Otherwise, if no FQDN flag is set and NM_DHCP_HOSTNAME_FLAG_FQDN_CLEAR_FLAGS (0x8) is not set, the standard FQDN flags are set in the request: NM_DHCP_HOSTNAME_FLAG_FQDN_SERV_UPDATE (0x1), NM_DHCP_HOSTNAME_FLAG_FQDN_ENCODED (0x2) for IPv4 and NM_DHCP_HOSTNAME_FLAG_FQDN_SERV_UPDATE (0x1) for IPv6. When this property is set to the default value NM_DHCP_HOSTNAME_FLAG_NONE (0x0), a global default is looked up in NetworkManager configuration. If that value is unset or also NM_DHCP_HOSTNAME_FLAG_NONE (0x0), then the standard FQDN flags described above are sent in the DHCP requests.")
 #define DESCRIBE_DOC_NM_SETTING_IP4_CONFIG_DHCP_IAID N_("A string containing the \"Identity Association Identifier\" (IAID) used by the DHCP client. The property is a 32-bit decimal value or a special value among \"mac\", \"perm-mac\", \"ifname\" and \"stable\". When set to \"mac\" (or \"perm-mac\"), the last 4 bytes of the current (or permanent) MAC address are used as IAID. When set to \"ifname\", the IAID is computed by hashing the interface name. The special value \"stable\" can be used to generate an IAID based on the stable-id (see connection.stable-id), a per-host key and the interface name. When the property is unset, the value from global configuration is used; if no global default is set then the IAID is assumed to be \"ifname\". Note that at the moment this property is ignored for IPv6 by dhclient, which always derives the IAID from the MAC address.")
 #define DESCRIBE_DOC_NM_SETTING_IP4_CONFIG_DHCP_SEND_HOSTNAME N_("If TRUE, a hostname is sent to the DHCP server when acquiring a lease. Some DHCP servers use this hostname to update DNS databases, essentially providing a static hostname for the computer.  If the \"dhcp-hostname\" property is NULL and this property is TRUE, the current persistent hostname of the computer is sent.")
 #define DESCRIBE_DOC_NM_SETTING_IP4_CONFIG_DHCP_TIMEOUT N_("A timeout for a DHCP transaction in seconds. If zero (the default), a globally configured default is used. If still unspecified, a device specific timeout is used (usually 45 seconds). Set to 2147483647 (MAXINT32) for infinity.")
@@ -247,7 +248,7 @@
 #define DESCRIBE_DOC_NM_SETTING_IP6_CONFIG_DAD_TIMEOUT N_("Timeout in milliseconds used to check for the presence of duplicate IP addresses on the network.  If an address conflict is detected, the activation will fail.  A zero value means that no duplicate address detection is performed, -1 means the default value (either configuration ipvx.dad-timeout override or zero).  A value greater than zero is a timeout in milliseconds. The property is currently implemented only for IPv4.")
 #define DESCRIBE_DOC_NM_SETTING_IP6_CONFIG_DHCP_DUID N_("A string containing the DHCPv6 Unique Identifier (DUID) used by the dhcp client to identify itself to DHCPv6 servers (RFC 3315). The DUID is carried in the Client Identifier option. If the property is a hex string ('aa:bb:cc') it is interpreted as a binary DUID and filled as an opaque value in the Client Identifier option. The special value \"lease\" will retrieve the DUID previously used from the lease file belonging to the connection. If no DUID is found and \"dhclient\" is the configured dhcp client, the DUID is searched in the system-wide dhclient lease file. If still no DUID is found, or another dhcp client is used, a global and permanent DUID-UUID (RFC 6355) will be generated based on the machine-id. The special values \"llt\" and \"ll\" will generate a DUID of type LLT or LL (see RFC 3315) based on the current MAC address of the device. In order to try providing a stable DUID-LLT, the time field will contain a constant timestamp that is used globally (for all profiles) and persisted to disk. The special values \"stable-llt\", \"stable-ll\" and \"stable-uuid\" will generate a DUID of the corresponding type, derived from the connection's stable-id and a per-host unique key. You may want to include the \"${DEVICE}\" or \"${MAC}\" specifier in the stable-id, in case this profile gets activated on multiple devices. So, the link-layer address of \"stable-ll\" and \"stable-llt\" will be a generated address derived from the stable id. The DUID-LLT time value in the \"stable-llt\" option will be picked among a static timespan of three years (the upper bound of the interval is the same constant timestamp used in \"llt\"). When the property is unset, the global value provided for \"ipv6.dhcp-duid\" is used. If no global value is provided, the default \"lease\" value is assumed.")
 #define DESCRIBE_DOC_NM_SETTING_IP6_CONFIG_DHCP_HOSTNAME N_("If the \"dhcp-send-hostname\" property is TRUE, then the specified name will be sent to the DHCP server when acquiring a lease. This property and \"dhcp-fqdn\" are mutually exclusive and cannot be set at the same time.")
-#define DESCRIBE_DOC_NM_SETTING_IP6_CONFIG_DHCP_HOSTNAME_FLAGS N_("Flags for the DHCP hostname and FQDN. Currently this property only includes flags to control the FQDN flags set in the DHCP FQDN option. Supported FQDN flags are NM_DHCP_HOSTNAME_FLAG_FQDN_SERV_UPDATE (0x1), NM_DHCP_HOSTNAME_FLAG_FQDN_ENCODED (0x2) and NM_DHCP_HOSTNAME_FLAG_FQDN_NO_UPDATE (0x4).  When no FQDN flag is set and NM_DHCP_HOSTNAME_FLAG_FQDN_CLEAR_FLAGS (0x8) is set, the DHCP FQDN option will contain no flag. Otherwise, if no FQDN flag is set and NM_DHCP_HOSTNAME_FLAG_FQDN_CLEAR_FLAGS (0x8) is not set, the standard FQDN flags are set in the request: NM_DHCP_HOSTNAME_FLAG_FQDN_SERV_UPDATE (0x1), NM_DHCP_HOSTNAME_FLAG_FQDN_ENCODED (0x2) for IPv4 and NM_DHCP_HOSTNAME_FLAG_FQDN_SERV_UPDATE (0x1) for IPv6. When this property is set to the default value NM_DHCP_HOSTNAME_FLAG_NONE (0x0), a global default is looked up in NetworkManager configuration. If that value is unset or also NM_DHCP_HOSTNAME_FLAG_NONE (0x0), then the standard FQDN flags described above are sent in the DHCP requests.")
+#define DESCRIBE_DOC_NM_SETTING_IP6_CONFIG_DHCP_HOSTNAME_FLAGS N_("Flags for the DHCP hostname and FQDN. Currently, this property only includes flags to control the FQDN flags set in the DHCP FQDN option. Supported FQDN flags are NM_DHCP_HOSTNAME_FLAG_FQDN_SERV_UPDATE (0x1), NM_DHCP_HOSTNAME_FLAG_FQDN_ENCODED (0x2) and NM_DHCP_HOSTNAME_FLAG_FQDN_NO_UPDATE (0x4).  When no FQDN flag is set and NM_DHCP_HOSTNAME_FLAG_FQDN_CLEAR_FLAGS (0x8) is set, the DHCP FQDN option will contain no flag. Otherwise, if no FQDN flag is set and NM_DHCP_HOSTNAME_FLAG_FQDN_CLEAR_FLAGS (0x8) is not set, the standard FQDN flags are set in the request: NM_DHCP_HOSTNAME_FLAG_FQDN_SERV_UPDATE (0x1), NM_DHCP_HOSTNAME_FLAG_FQDN_ENCODED (0x2) for IPv4 and NM_DHCP_HOSTNAME_FLAG_FQDN_SERV_UPDATE (0x1) for IPv6. When this property is set to the default value NM_DHCP_HOSTNAME_FLAG_NONE (0x0), a global default is looked up in NetworkManager configuration. If that value is unset or also NM_DHCP_HOSTNAME_FLAG_NONE (0x0), then the standard FQDN flags described above are sent in the DHCP requests.")
 #define DESCRIBE_DOC_NM_SETTING_IP6_CONFIG_DHCP_IAID N_("A string containing the \"Identity Association Identifier\" (IAID) used by the DHCP client. The property is a 32-bit decimal value or a special value among \"mac\", \"perm-mac\", \"ifname\" and \"stable\". When set to \"mac\" (or \"perm-mac\"), the last 4 bytes of the current (or permanent) MAC address are used as IAID. When set to \"ifname\", the IAID is computed by hashing the interface name. The special value \"stable\" can be used to generate an IAID based on the stable-id (see connection.stable-id), a per-host key and the interface name. When the property is unset, the value from global configuration is used; if no global default is set then the IAID is assumed to be \"ifname\". Note that at the moment this property is ignored for IPv6 by dhclient, which always derives the IAID from the MAC address.")
 #define DESCRIBE_DOC_NM_SETTING_IP6_CONFIG_DHCP_SEND_HOSTNAME N_("If TRUE, a hostname is sent to the DHCP server when acquiring a lease. Some DHCP servers use this hostname to update DNS databases, essentially providing a static hostname for the computer.  If the \"dhcp-hostname\" property is NULL and this property is TRUE, the current persistent hostname of the computer is sent.")
 #define DESCRIBE_DOC_NM_SETTING_IP6_CONFIG_DHCP_TIMEOUT N_("A timeout for a DHCP transaction in seconds. If zero (the default), a globally configured default is used. If still unspecified, a device specific timeout is used (usually 45 seconds). Set to 2147483647 (MAXINT32) for infinity.")
@@ -332,7 +333,7 @@
 #define DESCRIBE_DOC_NM_SETTING_SERIAL_STOPBITS N_("Number of stop bits for communication on the serial port.  Either 1 or 2. The 1 in \"8n1\" for example.")
 #define DESCRIBE_DOC_NM_SETTING_SRIOV_AUTOPROBE_DRIVERS N_("Whether to autoprobe virtual functions by a compatible driver. If set to NM_TERNARY_TRUE (1), the kernel will try to bind VFs to a compatible driver and if this succeeds a new network interface will be instantiated for each VF. If set to NM_TERNARY_FALSE (0), VFs will not be claimed and no network interfaces will be created for them. When set to NM_TERNARY_DEFAULT (-1), the global default is used; in case the global default is unspecified it is assumed to be NM_TERNARY_TRUE (1).")
 #define DESCRIBE_DOC_NM_SETTING_SRIOV_TOTAL_VFS N_("The total number of virtual functions to create. Note that when the sriov setting is present NetworkManager enforces the number of virtual functions on the interface (also when it is zero) during activation and resets it upon deactivation. To prevent any changes to SR-IOV parameters don't add a sriov setting to the connection.")
-#define DESCRIBE_DOC_NM_SETTING_SRIOV_VFS N_("Array of virtual function descriptors. Each VF descriptor is a dictionary mapping attribute names to GVariant values. The 'index' entry is mandatory for each VF. When represented as string a VF is in the form: \"INDEX [ATTR=VALUE[ ATTR=VALUE]...]\". for example: \"2 mac=00:11:22:33:44:55 spoof-check=true\". Multiple VFs can be specified using a comma as separator. Currently the following attributes are supported: mac, spoof-check, trust, min-tx-rate, max-tx-rate, vlans. The \"vlans\" attribute is represented as a semicolon-separated list of VLAN descriptors, where each descriptor has the form \"ID[.PRIORITY[.PROTO]]\". PROTO can be either 'q' for 802.1Q (the default) or 'ad' for 802.1ad.")
+#define DESCRIBE_DOC_NM_SETTING_SRIOV_VFS N_("Array of virtual function descriptors. Each VF descriptor is a dictionary mapping attribute names to GVariant values. The 'index' entry is mandatory for each VF. When represented as string a VF is in the form: \"INDEX [ATTR=VALUE[ ATTR=VALUE]...]\". for example: \"2 mac=00:11:22:33:44:55 spoof-check=true\". Multiple VFs can be specified using a comma as separator. Currently, the following attributes are supported: mac, spoof-check, trust, min-tx-rate, max-tx-rate, vlans. The \"vlans\" attribute is represented as a semicolon-separated list of VLAN descriptors, where each descriptor has the form \"ID[.PRIORITY[.PROTO]]\". PROTO can be either 'q' for 802.1Q (the default) or 'ad' for 802.1ad.")
 #define DESCRIBE_DOC_NM_SETTING_TC_CONFIG_QDISCS N_("Array of TC queueing disciplines.")
 #define DESCRIBE_DOC_NM_SETTING_TC_CONFIG_TFILTERS N_("Array of TC traffic filters.")
 #define DESCRIBE_DOC_NM_SETTING_TEAM_CONFIG N_("The JSON configuration for the team network interface.  The property should contain raw JSON configuration data suitable for teamd, because the value is passed directly to teamd. If not specified, the default configuration is used.  See man teamd.conf for the format details.")
@@ -393,12 +394,12 @@
 #define DESCRIBE_DOC_NM_SETTING_VXLAN_SOURCE_PORT_MIN N_("Specifies the minimum UDP source port to communicate to the remote VXLAN tunnel endpoint.")
 #define DESCRIBE_DOC_NM_SETTING_VXLAN_TOS N_("Specifies the TOS value to use in outgoing packets.")
 #define DESCRIBE_DOC_NM_SETTING_VXLAN_TTL N_("Specifies the time-to-live value to use in outgoing packets.")
-#define DESCRIBE_DOC_NM_SETTING_WIFI_P2P_PEER N_("The P2P device that should be connected to. Currently this is the only way to create or join a group.")
+#define DESCRIBE_DOC_NM_SETTING_WIFI_P2P_PEER N_("The P2P device that should be connected to. Currently, this is the only way to create or join a group.")
 #define DESCRIBE_DOC_NM_SETTING_WIFI_P2P_WFD_IES N_("The Wi-Fi Display (WFD) Information Elements (IEs) to set. Wi-Fi Display requires a protocol specific information element to be set in certain Wi-Fi frames. These can be specified here for the purpose of establishing a connection. This setting is only useful when implementing a Wi-Fi Display client.")
 #define DESCRIBE_DOC_NM_SETTING_WIFI_P2P_WPS_METHOD N_("Flags indicating which mode of WPS is to be used. There's little point in changing the default setting as NetworkManager will automatically determine the best method to use.")
 #define DESCRIBE_DOC_NM_SETTING_WIMAX_MAC_ADDRESS N_("If specified, this connection will only apply to the WiMAX device whose MAC address matches. This property does not change the MAC address of the device (known as MAC spoofing). Deprecated: 1")
 #define DESCRIBE_DOC_NM_SETTING_WIMAX_NETWORK_NAME N_("Network Service Provider (NSP) name of the WiMAX network this connection should use. Deprecated: 1")
-#define DESCRIBE_DOC_NM_SETTING_WIREGUARD_FWMARK N_("The use of fwmark is optional and is by default off. Setting it to 0 disables it. Otherwise it is a 32-bit fwmark for outgoing packets. Note that \"ip4-auto-default-route\" or \"ip6-auto-default-route\" enabled, implies to automatically choose a fwmark.")
+#define DESCRIBE_DOC_NM_SETTING_WIREGUARD_FWMARK N_("The use of fwmark is optional and is by default off. Setting it to 0 disables it. Otherwise, it is a 32-bit fwmark for outgoing packets. Note that \"ip4-auto-default-route\" or \"ip6-auto-default-route\" enabled, implies to automatically choose a fwmark.")
 #define DESCRIBE_DOC_NM_SETTING_WIREGUARD_IP4_AUTO_DEFAULT_ROUTE N_("Whether to enable special handling of the IPv4 default route. If enabled, the IPv4 default route from wireguard.peer-routes will be placed to a dedicated routing-table and two policy routing rules will be added. The fwmark number is also used as routing-table for the default-route, and if fwmark is zero, an unused fwmark/table is chosen automatically. This corresponds to what wg-quick does with Table=auto and what WireGuard calls \"Improved Rule-based Routing\". Note that for this automatism to work, you usually don't want to set ipv4.gateway, because that will result in a conflicting default route. Leaving this at the default will enable this option automatically if ipv4.never-default is not set and there are any peers that use a default-route as allowed-ips.")
 #define DESCRIBE_DOC_NM_SETTING_WIREGUARD_IP6_AUTO_DEFAULT_ROUTE N_("Like ip4-auto-default-route, but for the IPv6 default route.")
 #define DESCRIBE_DOC_NM_SETTING_WIREGUARD_LISTEN_PORT N_("The listen-port. If listen-port is not specified, the port will be chosen randomly when the interface comes up.")
diff --git a/clients/tests/test-client.check-on-disk/test_004.expected b/clients/tests/test-client.check-on-disk/test_004.expected
index 5ee00fc9e4..0313fce54d 100644
--- a/clients/tests/test-client.check-on-disk/test_004.expected
+++ b/clients/tests/test-client.check-on-disk/test_004.expected
@@ -58,12 +58,12 @@ location: clients/tests/test-client.py:test_004()/7
 cmd: $NMCLI connection mod con-xx1 ipv4.addresses 192.168.77.5/24 ipv4.routes '2.3.4.5/32 192.168.77.1' ipv6.addresses 1:2:3:4::6/64 ipv6.routes 1:2:3:4:5:6::5/128
 lang: C
 returncode: 0
-size: 4464
+size: 4517
 location: clients/tests/test-client.py:test_004()/8
 cmd: $NMCLI con s con-xx1
 lang: C
 returncode: 0
-stdout: 4336 bytes
+stdout: 4389 bytes
 >>>
 connection.id:                          con-xx1
 connection.uuid:                        UUID-con-xx1-REPLACED-REPLACED-REPLA
@@ -106,6 +106,7 @@ connection.wait-device-timeout:         -1
 802-11-wireless.hidden:                 no
 802-11-wireless.powersave:              0 (default)
 802-11-wireless.wake-on-wlan:           0x1 (default)
+802-11-wireless.ap-isolation:           -1 (default)
 ipv4.method:                            auto
 ipv4.dns:                               --
 ipv4.dns-search:                        --
@@ -160,12 +161,12 @@ proxy.pac-url:                          --
 proxy.pac-script:                       --
 
 <<<
-size: 4492
+size: 4545
 location: clients/tests/test-client.py:test_004()/9
 cmd: $NMCLI con s con-xx1
 lang: pl_PL.UTF-8
 returncode: 0
-stdout: 4354 bytes
+stdout: 4407 bytes
 >>>
 connection.id:                          con-xx1
 connection.uuid:                        UUID-con-xx1-REPLACED-REPLACED-REPLA
@@ -208,6 +209,7 @@ connection.wait-device-timeout:         -1
 802-11-wireless.hidden:                 nie
 802-11-wireless.powersave:              0 (default)
 802-11-wireless.wake-on-wlan:           0x1 (default)
+802-11-wireless.ap-isolation:           -1 (default)
 ipv4.method:                            auto
 ipv4.dns:                               --
 ipv4.dns-search:                        --
diff --git a/clients/tui/newt/nmt-newt-form.c b/clients/tui/newt/nmt-newt-form.c
index 2142e3c567..c2f4572992 100644
--- a/clients/tui/newt/nmt-newt-form.c
+++ b/clients/tui/newt/nmt-newt-form.c
@@ -287,7 +287,7 @@ nmt_newt_form_iterate (NmtNewtForm *form)
 
 	if (es.reason == NEWT_EXIT_COMPONENT) {
 		/* The user hit Return/Space on a component; update the form focus
-		 * to point that that component, and activate it.
+		 * to point that component, and activate it.
 		 */
 		focus = nmt_newt_widget_find_component (priv->content, es.u.co);
 		if (focus) {
diff --git a/clients/tui/newt/nmt-newt-textbox.c b/clients/tui/newt/nmt-newt-textbox.c
index 945284c879..edcf7f82bd 100644
--- a/clients/tui/newt/nmt-newt-textbox.c
+++ b/clients/tui/newt/nmt-newt-textbox.c
@@ -40,7 +40,7 @@ enum {
 
 /**
  * NmtNewtTextboxFlags:
- * @NMT_NEWT_TEXTBOX_SCROLLABLE: the textbox should be scollable.
+ * @NMT_NEWT_TEXTBOX_SCROLLABLE: the textbox should be scrollable.
  * @NMT_NEWT_TEXTBOX_SET_BACKGROUND: the textbox should have a
  *   white background
  *
diff --git a/clients/tui/nmt-mtu-entry.c b/clients/tui/nmt-mtu-entry.c
index c6077a657e..f782ee0104 100644
--- a/clients/tui/nmt-mtu-entry.c
+++ b/clients/tui/nmt-mtu-entry.c
@@ -13,7 +13,7 @@
  * contains a valid MTU.
  *
  * The entry also has an attached #NmtNewtLabel. When the entry value
- * is "0", the label will read "(default)". Otherwise it reads "bytes",
+ * is "0", the label will read "(default)". Otherwise, it reads "bytes",
  * indicating the units used by the entry.
  */
 
diff --git a/config.h.meson b/config.h.meson
index b421ee1e71..bb5458aa64 100644
--- a/config.h.meson
+++ b/config.h.meson
@@ -212,9 +212,6 @@
 /* Define if JANSSON is enabled */
 #mesondefine WITH_JANSSON
 
-/* Define if JSON validation in libnm is enabled */
-#mesondefine WITH_JSON_VALIDATION
-
 /* Define if you have libpsl */
 #mesondefine WITH_LIBPSL
 
diff --git a/configure.ac b/configure.ac
index 118d54380c..8c582f6b09 100644
--- a/configure.ac
+++ b/configure.ac
@@ -7,8 +7,8 @@ dnl  - add corresponding NM_VERSION_x_y_z macros in
 dnl    "shared/nm-version-macros.h.in"
 dnl  - update number in meson.build
 m4_define([nm_major_version], [1])
-m4_define([nm_minor_version], [26])
-m4_define([nm_micro_version], [0])
+m4_define([nm_minor_version], [27])
+m4_define([nm_micro_version], [1])
 m4_define([nm_version],
           [nm_major_version.nm_minor_version.nm_micro_version])
 
@@ -174,7 +174,7 @@ AC_ARG_ENABLE(ifupdown, AS_HELP_STRING([--enable-ifupdown], [enable ifupdown con
 # Default alternative plugins by distribution
 AS_IF([test -z "$enable_ifcfg_rh" -a -d /etc/sysconfig/network-scripts], enable_ifcfg_rh=yes)
 AS_IF([test -z "$enable_ifupdown" -a -f /etc/debian_version],            enable_ifupdown=yes)
-# Otherwise plugins default to "no"
+# Otherwise, plugins default to "no"
 AS_IF([test -z "$enable_ifcfg_rh"], enable_ifcfg_rh=no)
 AS_IF([test -z "$enable_ifupdown"], enable_ifupdown=no)
 # Create automake conditionals
@@ -583,7 +583,7 @@ PKG_CHECK_MODULES(UUID, uuid)
 
 # Teamd control checks
 
-PKG_CHECK_MODULES(JANSSON, [jansson >= 2.5], [have_jansson=yes], [have_jansson=no])
+PKG_CHECK_MODULES(JANSSON, [jansson >= 2.7], [have_jansson=yes], [have_jansson=no])
 if test "$have_jansson" = "yes"; then
 	AC_DEFINE(WITH_JANSSON, 1, [Define if JANSSON is enabled])
 
@@ -596,6 +596,8 @@ if test "$have_jansson" = "yes"; then
 	fi
 	AC_DEFINE_UNQUOTED(JANSSON_SONAME, "$JANSSON_SONAME", [Define to path to the Jansson shared library])
 else
+	have_jansson=no
+	JANSSON_SONAME=
 	AC_DEFINE(WITH_JANSSON, 0, [Define if JANSSON is enabled])
 fi
 AM_CONDITIONAL(WITH_JANSSON, test "${have_jansson}" = "yes")
@@ -622,21 +624,6 @@ if test "${enable_teamdctl}" = "yes"; then
 fi
 AM_CONDITIONAL(WITH_TEAMDCTL, test "${enable_teamdctl}" = "yes")
 
-# Jansson for team configuration validation
-AC_ARG_ENABLE(json-validation,
-              AS_HELP_STRING([--enable-json-validation], [Enable JSON validation in libnm]),
-              [enable_json_validation=${enableval}],
-              [enable_json_validation=${have_jansson}])
-if test "${enable_json_validation}" = "no"; then
-	AC_DEFINE(WITH_JSON_VALIDATION, 0, [Define if JSON validation in libnm is enabled])
-else
-	if test "$have_jansson" = "no"; then
-		AC_MSG_ERROR([jansson is needed for team configuration validation. Use --disable-json-validation to build without it.])
-	fi
-		AC_DEFINE(WITH_JSON_VALIDATION, 1, [Define if JSON validation in libnm is enabled])
-fi
-AM_CONDITIONAL(WITH_JSON_VALIDATION, test "${enable_json_validation}" != "no")
-
 # we usually compile with polkit support. --enable-polkit=yes|no only sets the
 # default configuration for main.auth-polkit. User can always enable/disable polkit
 # authorization via config.
@@ -915,7 +902,7 @@ if test "$config_dns_rc_manager_default" != "" -a \
 fi
 # Use netconfig by default on SUSE
 AS_IF([test -z "$with_netconfig" -a -f /etc/SuSE-release], with_netconfig=yes)
-# Otherwise default to "no"
+# Otherwise, default to "no"
 AS_IF([test -z "$with_resolvconf"], with_resolvconf=no)
 AS_IF([test -z "$with_netconfig"], with_netconfig=no)
 
@@ -1272,6 +1259,10 @@ else
 	have_introspection=no
 fi
 
+# check for python black. And check if all files are formatted with python black
+AC_PATH_PROG(BLACK, black)
+AM_CONDITIONAL(WITH_PYTHON_BLACK, test "${BLACK}" != "")
+
 # check for pregenerated manpages and documentation to be installed
 use_pregen_docs=no
 if test "$build_docs" != "yes" -a \
@@ -1362,6 +1353,7 @@ echo "  nmcli: $build_nmcli"
 echo "  nmtui: $build_nmtui"
 echo "  nm-cloud-setup: $with_nm_cloud_setup"
 echo "  iwd: $ac_with_iwd"
+echo "  jansson: $have_jansson${JANSSON_SONAME:+ (soname: $JANSSON_SONAME)}"
 echo
 
 echo "Configuration plugins (main.plugins=${config_plugins_default})"
@@ -1394,7 +1386,6 @@ echo "  valgrind: $with_valgrind   $with_valgrind_suppressions"
 echo "  code coverage: $enable_code_coverage"
 echo "  LTO: $enable_lto"
 echo "  linker garbage collection: $enable_ld_gc"
-echo "  JSON validation for libnm: $enable_json_validation"
 echo "  crypto: $with_crypto (have-gnutls: $have_crypto_gnutls, have-nss: $have_crypto_nss)"
 echo "  sanitizers: $sanitizers"
 echo "  Mozilla Public Suffix List: $with_libpsl"
diff --git a/contrib/fedora/rpm/release.sh b/contrib/fedora/rpm/release.sh
index 465e763f1d..549a4069e9 100755
--- a/contrib/fedora/rpm/release.sh
+++ b/contrib/fedora/rpm/release.sh
@@ -1,12 +1,43 @@
 #!/bin/bash
 
+# Script for doing NetworkManager releases.
 #
-# You need to start with a clean working directory of NetworkManager
-# and all branches up to date.
+# Run with --help for usage.
 #
+# There are 5 modes:
+#
+#  - "devel" : on master branch to tag "1.25.2-dev"
+#  - "rc1"   : the first release candidate on "master" branch which branches off
+#              "nm-1-26" branch. The tag is "1.26-rc1" with version number 1.25.90.
+#  - "rc"    : further release candidates on RC branch "nm-1-26". For example
+#              "1.26-rc2" with version number 1.25.91.
+#  - "major" : on stable branch nm-1-26 to release 1.26.0. This also merged
+#              the release with master branch and does a devel tag like "1.27.2-dev"
+#  - "major-post": after a "major" release, merge the release branch with master and
+#              do another devel snapshot on master.
+#  - "minor" : on a stable branch nm-1-26 to do minor release 1.26.4 and bump
+#              to "1.26.5-dev".
+#
+# Requisites:
+#
+#   * You need to start with a clean working directory (git clean -fdx)
+#
+#   * Run in a "clean" environment, no unusual environment variables set.
+#
+#   * First, ensure that you have ssh keys for master.gnome.org installed (and ssh-agent running)
+#     Also, ensure you have a GPG key that you want to use for signing. Also, have gpg-agent running
+#     and possibly configure `git config --get user.signingkey` for the proper key.
+#
+#   * Your git repository needs a remote "origin" that points to the upstream git repository.
+#
+#   * All your (relevant) local branches (master and nm-1-*) must be up to date with their
+#     remote tracking branches for origin.
+#
+# Run with --no-test to do the actual release.
 
 die() {
-    echo "FAIL: $@"
+    echo -n "FAIL: "
+    echo_color 31 "$@"
     exit 1
 }
 
@@ -18,11 +49,21 @@ echo_color() {
     echo -e -n '\033[0m'
 }
 
-die_usage() {
-    echo "FAIL: $@"
-    echo
+print_usage() {
     echo "Usage:"
-    echo "  $0 [devel|rc1|rc|major|minor] [--no-test] [--no-find-backports] [--no-cleanup] [--allow-local-branches]"
+    echo "  $BASH_SOURCE [devel|rc1|rc|major|major-post|minor] [--no-test] [--no-find-backports] [--no-cleanup] [--allow-local-branches]"
+}
+
+die_help() {
+    print_usage
+    exit 0
+}
+
+die_usage() {
+    echo -n "FAIL: "
+    echo_color 31 "$@"
+    echo
+    print_usage
     exit 1
 }
 
@@ -40,11 +81,11 @@ do_command() {
 }
 
 parse_version() {
-    local MAJ="$(sed -n '1,20 s/^m4_define(\[nm_major_version\], \[\([0-9]\+\)\])$/\1/p' configure.ac)"
-    local MIN="$(sed -n '1,20 s/^m4_define(\[nm_minor_version\], \[\([0-9]\+\)\])$/\1/p' configure.ac)"
-    local MIC="$(sed -n '1,20 s/^m4_define(\[nm_micro_version\], \[\([0-9]\+\)\])$/\1/p' configure.ac)"
+    local MAJ="$(sed -n '1,20 s/^m4_define(\[nm_major_version\], \[\([0-9]\+\)\])$/\1/p' ./configure.ac)"
+    local MIN="$(sed -n '1,20 s/^m4_define(\[nm_minor_version\], \[\([0-9]\+\)\])$/\1/p' ./configure.ac)"
+    local MIC="$(sed -n '1,20 s/^m4_define(\[nm_micro_version\], \[\([0-9]\+\)\])$/\1/p' ./configure.ac)"
 
-    re='^[0-9]+ [0-9]+ [0-9]+$'
+    re='^[0-9][1-9]* [0-9][1-9]* [0-9][1-9]*$'
     [[ "$MAJ $MIN $MIC" =~ $re ]] || return 1
     echo "$MAJ $MIN $MIC"
 }
@@ -108,32 +149,15 @@ cd "$DIR" &&
 test -f ./src/NetworkManagerUtils.h &&
 test -f ./contrib/fedora/rpm/build_clean.sh || die "cannot find NetworkManager base directory"
 
-TMP="$(git status --porcelain)" || die "git status failed"
-test -z "$TMP" || die "git working directory is not clean (git status --porcelain)"
-
-TMP="$(LANG=C git clean -ndx)" || die "git clean -ndx failed"
-test -z "$TMP" || die "git working directory is not clean (git clean -ndx)"
-
-VERSION_ARR=( $(parse_version) ) || die "cannot detect NetworkManager version"
-VERSION_STR="$(IFS=.; echo "${VERSION_ARR[*]}")"
-
 RELEASE_MODE=""
 DRY_RUN=1
 FIND_BACKPORTS=1
 ALLOW_LOCAL_BRANCHES=0
+HELP_AND_EXIT=1
 while [ "$#" -ge 1 ]; do
     A="$1"
     shift
-    if [ -z "$RELEASE_MODE" ]; then
-        case "$A" in
-            devel|rc1|rc|major|minor)
-                RELEASE_MODE="$A"
-                ;;
-            *)
-                ;;
-        esac
-        continue
-    fi
+    HELP_AND_EXIT=0
     case "$A" in
         --no-test)
             DRY_RUN=0
@@ -150,28 +174,50 @@ while [ "$#" -ge 1 ]; do
             # that differ from upstream. Set this flag to override that check.
             ALLOW_LOCAL_BRANCHES=1
             ;;
+        --help|-h)
+            die_help
+            ;;
+        devel|rc1|rc|major|major-post|minor)
+            [ -z "$RELEASE_MODE" ] || die_usage "duplicate release-mode"
+            RELEASE_MODE="$A"
+            ;;
         *)
             die_usage "unknown argument \"$A\""
             ;;
     esac
 done
+[ "$HELP_AND_EXIT" = 1 ] && die_help
+
 [ -n "$RELEASE_MODE" ] || die_usage "specify the desired release mode"
 
-echo "Current version before release: $VERSION_STR (do $RELEASE_MODE release)"
+VERSION_ARR=( $(parse_version) ) || die "cannot detect NetworkManager version"
+VERSION_STR="$(IFS=.; echo "${VERSION_ARR[*]}")"
+
+echo "Current version before release: $VERSION_STR (do \"$RELEASE_MODE\" release)"
+
+grep -q "version: '${VERSION_ARR[0]}.${VERSION_ARR[1]}.${VERSION_ARR[2]}'," ./meson.build || die "meson.build does not have expected version"
+
+TMP="$(git status --porcelain)" || die "git status failed"
+test -z "$TMP" || die "git working directory is not clean (git status --porcelain)"
+
+TMP="$(LANG=C git clean -ndx)" || die "git clean -ndx failed"
+test -z "$TMP" || die "git working directory is not clean? (git clean -ndx)"
 
 CUR_BRANCH="$(git rev-parse --abbrev-ref HEAD)"
 TMP_BRANCH=release-branch
 
 if [ "$CUR_BRANCH" = master ]; then
     number_is_odd "${VERSION_ARR[1]}" || die "Unexpected version number on master. Should be an odd development version"
+    [ "$RELEASE_MODE" = devel -o "$RELEASE_MODE" = rc1 -o "$RELEASE_MODE" = major-post ] || die "Unexpected branch name \"$CUR_BRANCH\" for \"$RELEASE_MODE\""
 else
-    re='^nm-[0-9]+-[0-9]+$'
+    re='^nm-[0-9][1-9]*-[0-9][1-9]*$'
     [[ "$CUR_BRANCH" =~ $re ]] || die "Unexpected current branch $CUR_BRANCH. Should be master or nm-?-??"
     if number_is_odd "${VERSION_ARR[1]}"; then
         # we are on a release candiate branch.
-        [ "$RELEASE_MODE" = rc ] || "Unexpected branch name \"$CUR_BRANCH\" for \"$RELEASE_MODE\""
+        [ "$RELEASE_MODE" = rc -o "$RELEASE_MODE" = major ] || die "Unexpected branch name \"$CUR_BRANCH\" for \"$RELEASE_MODE\""
         [ "$CUR_BRANCH" == "nm-${VERSION_ARR[0]}-$((${VERSION_ARR[1]} + 1))" ] || die "Unexpected current branch $CUR_BRANCH. Should be nm-${VERSION_ARR[0]}-$((${VERSION_ARR[1]} + 1))"
     else
+        [ "$RELEASE_MODE" = minor ] || die "Unexpected branch name \"$CUR_BRANCH\" for \"$RELEASE_MODE\""
         [ "$CUR_BRANCH" == "nm-${VERSION_ARR[0]}-${VERSION_ARR[1]}" ] || die "Unexpected current branch $CUR_BRANCH. Should be nm-${VERSION_ARR[0]}-${VERSION_ARR[1]}"
     fi
 fi
@@ -183,16 +229,26 @@ case "$RELEASE_MODE" in
         number_is_odd  "${VERSION_ARR[2]}" || die "cannot do minor release on top of version $VERSION_STR"
         [ "$CUR_BRANCH" != master ] || die "cannot do a minor release on master"
         ;;
-    devel|rc)
+    devel)
         number_is_odd "${VERSION_ARR[1]}" || die "cannot do devel release on top of version $VERSION_STR"
-        if [ "$RELEASE_MODE" = devel ]; then
-            [ "$((${VERSION_ARR[2]} + 1))" -lt 90 ] || die "devel release must have a micro version smaller than 90 but current version is $VERSION_STR"
-            [ "$CUR_BRANCH" == master ] || die "devel release can only be on master"
-        else
-            [ "${VERSION_ARR[2]}" -ge 90 ] || die "rc release must have a micro version larger than ${VERSION_ARR[0]}.90 but current version is $VERSION_STR"
-            RC_VERSION="$((${VERSION_ARR[2]} - 88))"
-            [ "$CUR_BRANCH" == "nm-${VERSION_ARR[0]}-$((${VERSION_ARR[1]} + 1))" ] || die "devel release can only be on \"nm-${VERSION_ARR[0]}-$((${VERSION_ARR[1]} + 1))\" branch"
-        fi
+        [ "$((${VERSION_ARR[2]} + 1))" -lt 90 ] || die "devel release must have a micro version smaller than 90 but current version is $VERSION_STR"
+        [ "$CUR_BRANCH" == master ] || die "devel release can only be on master"
+        ;;
+    rc)
+        number_is_odd "${VERSION_ARR[1]}" || die "cannot do rc release on top of version $VERSION_STR"
+        [ "${VERSION_ARR[2]}" -ge 90 ] || die "rc release must have a micro version larger than ${VERSION_ARR[0]}.90 but current version is $VERSION_STR"
+        RC_VERSION="$((${VERSION_ARR[2]} - 88))"
+        [ "$CUR_BRANCH" == "nm-${VERSION_ARR[0]}-$((${VERSION_ARR[1]} + 1))" ] || die "devel release can only be on \"nm-${VERSION_ARR[0]}-$((${VERSION_ARR[1]} + 1))\" branch"
+        ;;
+    major)
+        number_is_odd "${VERSION_ARR[1]}" || die "cannot do major release on top of version $VERSION_STR"
+        [ "${VERSION_ARR[2]}" -ge 90 ] || die "parent version for major release must have a micro version larger than ${VERSION_ARR[0]}.90 but current version is $VERSION_STR"
+        [ "$CUR_BRANCH" == "nm-${VERSION_ARR[0]}-$((${VERSION_ARR[1]} + 1))" ] || die "major release can only be on \"nm-${VERSION_ARR[0]}-$((${VERSION_ARR[1]} + 1))\" branch"
+        ;;
+    major-post)
+        number_is_odd "${VERSION_ARR[1]}" || die "cannot do major-post release on top of version $VERSION_STR"
+        [ "$((${VERSION_ARR[2]} + 1))" -lt 90 ] || die "major-post release must have a micro version smaller than 90 but current version is $VERSION_STR"
+        [ "$CUR_BRANCH" == master ] || die "major-post release can only be on master"
         ;;
     *)
         die "Release mode $RELEASE_MODE not yet implemented"
@@ -203,7 +259,7 @@ git fetch || die "git fetch failed"
 
 if [ "$ALLOW_LOCAL_BRANCHES" != 1 ]; then
     git_same_ref "$CUR_BRANCH" "refs/heads/$CUR_BRANCH" || die "Current branch $CUR_BRANCH is not a branch??"
-    git_same_ref "$CUR_BRANCH" "refs/remotes/$ORIGIN/$CUR_BRANCH" || die "Current branch $CUR_BRANCH seems not up to date. Git pull?"
+    git_same_ref "$CUR_BRANCH" "refs/remotes/$ORIGIN/$CUR_BRANCH" || die "Current branch $CUR_BRANCH seems not up to date with refs/remotes/$ORIGIN/$CUR_BRANCH. Git pull?"
 fi
 
 NEWER_BRANCHES=()
@@ -218,17 +274,21 @@ if [ "$CUR_BRANCH" != master ]; then
         fi
         if [ "$ALLOW_LOCAL_BRANCHES" != 1 ]; then
             git_same_ref "$b" "refs/heads/$b" || die "branch $b is not a branch??"
-            git_same_ref "$b" "refs/remotes/$ORIGIN/$b" || die "branch $b seems not up to date. Git pull?"
+            git_same_ref "$b" "refs/remotes/$ORIGIN/$b" || die "branch $b seems not up to date with refs/remotes/$ORIGIN/$b. Git pull?"
         fi
         NEWER_BRANCHES+=("refs/heads/$b")
     done
     b=master
     if [ "$ALLOW_LOCAL_BRANCHES" != 1 ]; then
         git_same_ref "$b" "refs/heads/$b" || die "branch $b is not a branch??"
-        git_same_ref "$b" "refs/remotes/$ORIGIN/$b" || die "branch $b seems not up to date. Git pull?"
+        git_same_ref "$b" "refs/remotes/$ORIGIN/$b" || die "branch $b seems not up to date with refs/remotes/$ORIGIN/$b. Git pull?"
     fi
 fi
 
+if [ "$ALLOW_LOCAL_BRANCHES" != 1 ]; then
+    cmp <(git show origin/master:contrib/fedora/rpm/release.sh) "$BASH_SOURCE" || die "$BASH_SOURCE is not identical to \`git show origin/master:contrib/fedora/rpm/release.sh\`"
+fi
+
 if [ $FIND_BACKPORTS = 1 ]; then
     git show "$ORIGIN/automation:contrib/rh-utils/find-backports.sh" > ./.git/nm-find-backports.sh \
     && chmod +x ./.git/nm-find-backports.sh \
@@ -243,12 +303,11 @@ BUILD_TAG=
 
 CLEANUP_CHECKOUT_BRANCH="$CUR_BRANCH"
 
-CLEANUP_REFS+=("$TMP_BRANCH")
+git checkout -B "$TMP_BRANCH"
+CLEANUP_REFS+=("refs/heads/$TMP_BRANCH")
 
 case "$RELEASE_MODE" in
     minor)
-        git checkout -B "$TMP_BRANCH"
-        CLEANUP_REFS+=("refs/heads/$TMP_BRANCH")
         set_version_number "${VERSION_ARR[0]}" "${VERSION_ARR[1]}" $(("${VERSION_ARR[2]}" + 1))
         git commit -m "release: bump version to ${VERSION_ARR[0]}.${VERSION_ARR[1]}.$(("${VERSION_ARR[2]}" + 1))" -a || die "failed to commit release"
         set_version_number "${VERSION_ARR[0]}" "${VERSION_ARR[1]}" $(("${VERSION_ARR[2]}" + 2))
@@ -266,8 +325,6 @@ case "$RELEASE_MODE" in
         TAR_VERSION="$BUILD_TAG"
         ;;
     devel)
-        git checkout -B "$TMP_BRANCH"
-        CLEANUP_REFS+=("refs/heads/$TMP_BRANCH")
         set_version_number "${VERSION_ARR[0]}" "${VERSION_ARR[1]}" $(("${VERSION_ARR[2]}" + 1))
         git commit -m "release: bump version to ${VERSION_ARR[0]}.${VERSION_ARR[1]}.$(("${VERSION_ARR[2]}" + 1)) (development)" -a || die "failed to commit devel version bump"
 
@@ -279,8 +336,6 @@ case "$RELEASE_MODE" in
         TAR_VERSION="$b"
         ;;
     rc)
-        git checkout -B "$TMP_BRANCH"
-        CLEANUP_REFS+=("refs/heads/$TMP_BRANCH")
         b="${VERSION_ARR[0]}.${VERSION_ARR[1]}.$(("${VERSION_ARR[2]}" + 1))"
         t="${VERSION_ARR[0]}.$(("${VERSION_ARR[1]}" + 1))-rc$RC_VERSION"
         set_version_number "${VERSION_ARR[0]}" "${VERSION_ARR[1]}" $(("${VERSION_ARR[2]}" + 1))
@@ -292,6 +347,42 @@ case "$RELEASE_MODE" in
         BUILD_TAG="$t"
         TAR_VERSION="$b"
         ;;
+    major)
+        b="${VERSION_ARR[0]}.$((${VERSION_ARR[1]} + 1)).0"
+        b2="${VERSION_ARR[0]}.$((${VERSION_ARR[1]} + 1)).1"
+
+        set_version_number "${VERSION_ARR[0]}" "$((${VERSION_ARR[1]} + 1))" 0
+        git commit -m "release: bump version to $b" -a || die "failed to commit major version bump"
+        git tag -s -a -m "Tag $b" "$b" HEAD || die "failed to tag release"
+        TAGS+=("$b")
+        CLEANUP_REFS+=("refs/tags/$b")
+
+        set_version_number "${VERSION_ARR[0]}" "$((${VERSION_ARR[1]} + 1))" 1
+        git commit -m "release: bump version to $b2 (development)" -a || die "failed to commit another bump after major version bump"
+        git tag -s -a -m "Tag $b (development)" "$b2-dev" HEAD || die "failed to tag release"
+        TAGS+=("$b2-dev")
+        CLEANUP_REFS+=("refs/tags/$b2-dev")
+
+        BUILD_TAG="$b"
+        TAR_VERSION="$b"
+        ;;
+    major-post)
+        git checkout -B "$TMP_BRANCH" "${VERSION_ARR[0]}.$((${VERSION_ARR[1]} - 1)).0" || die "merge0"
+        git merge -Xours --commit -m tmp master || die "merge1"
+        git rm --cached -r . || die "merge2"
+        git checkout master -- . || die "merge3"
+        b="${VERSION_ARR[0]}.${VERSION_ARR[1]}.$((${VERSION_ARR[2]} + 1))"
+        git commit --amend -m tmp -a || die "failed to commit major version bump"
+        test x = "x$(git diff master HEAD)" || die "there is a diff after merge!"
+
+        set_version_number "${VERSION_ARR[0]}" "${VERSION_ARR[1]}" "$((${VERSION_ARR[2]} + 1))"
+        git commit --amend -m "release: bump version to $b (development)" -a || die "failed to commit major version bump"
+        git tag -s -a -m "Tag $b (development)" "$b-dev" HEAD || die "failed to tag release"
+        TAGS+=("$b-dev")
+        CLEANUP_REFS+=("refs/tags/$b-dev")
+        BUILD_TAG="$b-dev"
+        TAR_VERSION="$b"
+        ;;
     *)
         die "Release mode $RELEASE_MODE not yet implemented"
         ;;
diff --git a/docs/libnm/libnm-docs.xml b/docs/libnm/libnm-docs.xml
index b482207abb..47b1fa1c08 100644
--- a/docs/libnm/libnm-docs.xml
+++ b/docs/libnm/libnm-docs.xml
@@ -235,7 +235,7 @@ print ("NetworkManager version " + client.get_version())]]></programlisting></in
             <listitem>
               <para>
                 Instead of calling g_dbus_connection_call_sync(), use the
-                asynchronous g_dbus_connection_call(). If we would use a sepaate
+                asynchronous g_dbus_connection_call(). If we would use a separate
                 GMainContext for all D-Bus related calls, we could ensure that
                 while we block for the response, we iterate the internal main context.
                 This might be nice, because all events are processed in order and
diff --git a/examples/python/gi/nm-wg-set b/examples/python/gi/nm-wg-set
index 1f5279ee69..4f074605c1 100755
--- a/examples/python/gi/nm-wg-set
+++ b/examples/python/gi/nm-wg-set
@@ -61,23 +61,32 @@ import sys
 import os
 
 import gi
-gi.require_version('NM', '1.0')
+
+gi.require_version("NM", "1.0")
 from gi.repository import NM
 
+
 class MyError(Exception):
     pass
 
+
 def pr(v):
     import pprint
+
     pprint.pprint(v, indent=4, depth=5, width=60)
 
+
 ###############################################################################
 
+
 def connection_is_wireguard(conn):
     s_con = conn.get_setting(NM.SettingConnection)
-    return     s_con \
-           and s_con.get_connection_type() == NM.SETTING_WIREGUARD_SETTING_NAME \
-           and conn.get_setting(NM.SettingWireGuard)
+    return (
+        s_con
+        and s_con.get_connection_type() == NM.SETTING_WIREGUARD_SETTING_NAME
+        and conn.get_setting(NM.SettingWireGuard)
+    )
+
 
 def connection_to_str(conn):
     if connection_is_wireguard(conn):
@@ -85,52 +94,57 @@ def connection_to_str(conn):
         if iface:
             extra = ', interface: "%s"' % (iface)
         else:
-            extra = ''
+            extra = ""
     else:
-        extra = ', type: %s' % (conn.get_setting(NM.SettingConnection).get_connection_type())
+        extra = ", type: %s" % (
+            conn.get_setting(NM.SettingConnection).get_connection_type()
+        )
 
     return '"%s" (%s%s)' % (conn.get_id(), conn.get_uuid(), extra)
 
+
 def connections_wg(connections):
     l = list([c for c in connections if connection_is_wireguard(c)])
-    l.sort(key = connection_to_str)
+    l.sort(key=connection_to_str)
     return l
 
+
 def connections_find(connections, con_spec, con_id):
     connections = list(sorted(connections, key=connection_to_str))
     l = []
-    if con_spec in [None, 'id']:
+    if con_spec in [None, "id"]:
         for c in connections:
             if con_id == c.get_id():
                 if c not in l:
                     l.append(c)
-    if con_spec in [None, 'interface']:
+    if con_spec in [None, "interface"]:
         for c in connections:
             s_con = c.get_setting(NM.SettingConnection)
-            if     s_con \
-               and con_id == s_con.get_interface_name():
+            if s_con and con_id == s_con.get_interface_name():
                 if c not in l:
                     l.append(c)
-    if con_spec in [None, 'uuid']:
+    if con_spec in [None, "uuid"]:
         for c in connections:
             if con_id == c.get_uuid():
                 if c not in l:
                     l.append(c)
-    l.sort(key = connection_to_str)
+    l.sort(key=connection_to_str)
     return l
 
 
 def print_hint(nm_client):
-    print('Maybe you want to create a profile first with')
-    print('  nmcli connection add type wireguard ifname wg0 $MORE_ARGS')
+    print("Maybe you want to create a profile first with")
+    print("  nmcli connection add type wireguard ifname wg0 $MORE_ARGS")
     connections = connections_wg(nm_client.get_connections())
     if connections:
-        print('Or edit one of the following WireGuard profiles:')
+        print("Or edit one of the following WireGuard profiles:")
         for c in connections:
-            print ('  - %s' % (connection_to_str(c)))
+            print("  - %s" % (connection_to_str(c)))
+
 
 ###############################################################################
 
+
 def argv_get_one(argv, idx, type_ctor=None, topic=None):
 
     if topic is not None:
@@ -146,7 +160,7 @@ def argv_get_one(argv, idx, type_ctor=None, topic=None):
     try:
         v = argv[idx]
     except:
-        raise MyError('missing argument')
+        raise MyError("missing argument")
     if type_ctor is not None:
         try:
             v = type_ctor(v)
@@ -154,16 +168,18 @@ def argv_get_one(argv, idx, type_ctor=None, topic=None):
             raise MyError('invalid argument "%s" (%s)' % (v, e.message))
     return v
 
+
 ###############################################################################
 
+
 def arg_parse_secret_flags(arg):
     try:
         f = arg.strip()
         n = {
-            'none':         NM.SettingSecretFlags.NONE,
-            'not-saved':    NM.SettingSecretFlags.NOT_SAVED,
-            'not-required': NM.SettingSecretFlags.NOT_REQUIRED,
-            'agent-owned':  NM.SettingSecretFlags.AGENT_OWNED,
+            "none": NM.SettingSecretFlags.NONE,
+            "not-saved": NM.SettingSecretFlags.NOT_SAVED,
+            "not-required": NM.SettingSecretFlags.NOT_REQUIRED,
+            "agent-owned": NM.SettingSecretFlags.AGENT_OWNED,
         }.get(f)
         if n is not None:
             return n
@@ -171,7 +187,8 @@ def arg_parse_secret_flags(arg):
     except Exception as e:
         raise MyError('invalid secret flags "%s"' % (arg))
 
-def _arg_parse_int(arg, vmin, vmax, key, base = 0):
+
+def _arg_parse_int(arg, vmin, vmax, key, base=0):
     try:
         v = int(arg, base)
         if v >= vmin and vmax <= 0xFFFFFFFF:
@@ -180,18 +197,22 @@ def _arg_parse_int(arg, vmin, vmax, key, base = 0):
         raise MyError('invalid %s "%s"' % (key, arg))
     raise MyError("%s out of range" % (key))
 
+
 def arg_parse_listen_port(arg):
     return _arg_parse_int(arg, 0, 0xFFFF, "listen-port")
 
+
 def arg_parse_fwmark(arg):
-    return _arg_parse_int(arg, 0, 0xFFFFFFFF, "fwmark", base = 0)
+    return _arg_parse_int(arg, 0, 0xFFFFFFFF, "fwmark", base=0)
+
 
 def arg_parse_persistent_keep_alive(arg):
     return _arg_parse_int(arg, 0, 0xFFFFFFFF, "persistent-keepalive")
 
+
 def arg_parse_allowed_ips(arg):
-    l = [s.strip() for s in arg.strip().split(',')]
-    l = [s for s in l if s != '']
+    l = [s.strip() for s in arg.strip().split(",")]
+    l = [s for s in l if s != ""]
     l = list(l)
     # use a peer to parse and validate the allowed-ips.
     peer = NM.WireGuardPeer()
@@ -200,40 +221,47 @@ def arg_parse_allowed_ips(arg):
             raise MyError('invalid allowed-ip "%s"' % (aip))
     return l
 
+
 ###############################################################################
 
+
 def secret_flags_to_string(flags):
     nick = {
-            NM.SettingSecretFlags.NONE:         'none',
-            NM.SettingSecretFlags.NOT_SAVED:    'not-saved',
-            NM.SettingSecretFlags.NOT_REQUIRED: 'not-required',
-            NM.SettingSecretFlags.AGENT_OWNED:  'agent-owned',
-        }.get(flags)
+        NM.SettingSecretFlags.NONE: "none",
+        NM.SettingSecretFlags.NOT_SAVED: "not-saved",
+        NM.SettingSecretFlags.NOT_REQUIRED: "not-required",
+        NM.SettingSecretFlags.AGENT_OWNED: "agent-owned",
+    }.get(flags)
     num = str(int(flags))
     if nick is None:
         return num
-    return '%s (%s)' % (num, nick)
+    return "%s (%s)" % (num, nick)
+
 
 def secret_to_string(secret):
-    if os.environ.get('WG_HIDE_KEYS', '') != 'never':
-        return '(hidden)'
+    if os.environ.get("WG_HIDE_KEYS", "") != "never":
+        return "(hidden)"
     if not secret:
-        return ''
+        return ""
     return secret
 
+
 def val_to_str(val):
     if val == NM.Ternary.DEFAULT:
-        return 'default'
+        return "default"
     if val == NM.Ternary.TRUE:
-        return 'true'
+        return "true"
     if val == NM.Ternary.FALSE:
-        return 'false'
+        return "false"
     return repr(val)
 
+
 ###############################################################################
 
+
 def wg_read_private_key(privkey_file):
     import base64
+
     try:
         with open(privkey_file, "r") as f:
             data = f.read()
@@ -244,17 +272,20 @@ def wg_read_private_key(privkey_file):
     except Exception as e:
         raise MyError('failed to read private key "%s": %s' % (privkey_file, e.message))
 
-def wg_peer_is_valid(peer, msg = None):
+
+def wg_peer_is_valid(peer, msg=None):
     try:
         peer.is_valid(True, True)
     except gi.repository.GLib.Error as e:
         if msg is None:
-            raise MyError('%s' % (e.message))
+            raise MyError("%s" % (e.message))
         else:
-            raise MyError('%s' % (msg))
+            raise MyError("%s" % (msg))
+
 
 ###############################################################################
 
+
 def do_get(nm_client, connection):
     s_con = conn.get_setting(NM.SettingConnection)
     s_wg = conn.get_setting(NM.SettingWireGuard)
@@ -262,24 +293,55 @@ def do_get(nm_client, connection):
     # Fetching secrets is not implemented. For now show them all as
     # <hidden>.
 
-    print('interface:                    %s' % (s_con.get_interface_name()))
-    print('uuid:                         %s' % (conn.get_uuid()))
-    print('id:                           %s' % (conn.get_id()))
-    print('private-key:                  %s' % (secret_to_string(s_wg.get_private_key())))
-    print('private-key-flags:            %s' % (secret_flags_to_string(s_wg.get_private_key_flags())))
-    print('listen-port:                  %s' % (s_wg.get_listen_port()))
-    print('fwmark:                       0x%x' % (s_wg.get_fwmark()))
-    print('peer-routes:                  %s' % (val_to_str(s_wg.get_peer_routes())))
-    print('ip4-auto-default-route:       %s' % (val_to_str(s_wg.get_ip4_auto_default_route())))
-    print('ip6-auto-default-route:       %s' % (val_to_str(s_wg.get_ip6_auto_default_route())))
+    print("interface:                    %s" % (s_con.get_interface_name()))
+    print("uuid:                         %s" % (conn.get_uuid()))
+    print("id:                           %s" % (conn.get_id()))
+    print(
+        "private-key:                  %s" % (secret_to_string(s_wg.get_private_key()))
+    )
+    print(
+        "private-key-flags:            %s"
+        % (secret_flags_to_string(s_wg.get_private_key_flags()))
+    )
+    print("listen-port:                  %s" % (s_wg.get_listen_port()))
+    print("fwmark:                       0x%x" % (s_wg.get_fwmark()))
+    print("peer-routes:                  %s" % (val_to_str(s_wg.get_peer_routes())))
+    print(
+        "ip4-auto-default-route:       %s"
+        % (val_to_str(s_wg.get_ip4_auto_default_route()))
+    )
+    print(
+        "ip6-auto-default-route:       %s"
+        % (val_to_str(s_wg.get_ip6_auto_default_route()))
+    )
     for i in range(s_wg.get_peers_len()):
         peer = s_wg.get_peer(i)
-        print('peer[%d].public-key:           %s' % (i, peer.get_public_key()))
-        print('peer[%d].preshared-key:        %s' % (i, secret_to_string(peer.get_preshared_key())))
-        print('peer[%d].preshared-key-flags:  %s' % (i, secret_flags_to_string(peer.get_preshared_key_flags())))
-        print('peer[%d].endpoint:             %s' % (i, peer.get_endpoint() if peer.get_endpoint() else ''))
-        print('peer[%d].persistent-keepalive: %s' % (i, peer.get_persistent_keepalive()))
-        print('peer[%d].allowed-ips:          %s' % (i, ','.join([peer.get_allowed_ip(j) for j in range(peer.get_allowed_ips_len())])))
+        print("peer[%d].public-key:           %s" % (i, peer.get_public_key()))
+        print(
+            "peer[%d].preshared-key:        %s"
+            % (i, secret_to_string(peer.get_preshared_key()))
+        )
+        print(
+            "peer[%d].preshared-key-flags:  %s"
+            % (i, secret_flags_to_string(peer.get_preshared_key_flags()))
+        )
+        print(
+            "peer[%d].endpoint:             %s"
+            % (i, peer.get_endpoint() if peer.get_endpoint() else "")
+        )
+        print(
+            "peer[%d].persistent-keepalive: %s" % (i, peer.get_persistent_keepalive())
+        )
+        print(
+            "peer[%d].allowed-ips:          %s"
+            % (
+                i,
+                ",".join(
+                    [peer.get_allowed_ip(j) for j in range(peer.get_allowed_ips_len())]
+                ),
+            )
+        )
+
 
 def do_set(nm_client, conn, argv):
     s_wg = conn.get_setting(NM.SettingWireGuard)
@@ -291,9 +353,7 @@ def do_set(nm_client, conn, argv):
     try:
         idx = 0
         while True:
-            if     peer \
-               and (   idx >= len(argv) \
-                    or argv[idx] == 'peer'):
+            if peer and (idx >= len(argv) or argv[idx] == "peer"):
                 if peer_remove:
                     pp_peer, pp_idx = s_wg.get_peer_by_public_key(peer.get_public_key())
                     if pp_peer:
@@ -312,29 +372,40 @@ def do_set(nm_client, conn, argv):
                 peer_secret_flags = None
 
             if idx >= len(argv):
-                break;
+                break
 
-            if not peer and argv[idx] == 'private-key':
+            if not peer and argv[idx] == "private-key":
                 key = argv_get_one(argv, idx + 1, None, idx)
-                if key == '':
+                if key == "":
                     s_wg.set_property(NM.SETTING_WIREGUARD_PRIVATE_KEY, None)
                 else:
-                    s_wg.set_property(NM.SETTING_WIREGUARD_PRIVATE_KEY, wg_read_private_key(key))
+                    s_wg.set_property(
+                        NM.SETTING_WIREGUARD_PRIVATE_KEY, wg_read_private_key(key)
+                    )
                 idx += 2
                 continue
-            if not peer and argv[idx] == 'private-key-flags':
-                s_wg.set_property(NM.SETTING_WIREGUARD_PRIVATE_KEY_FLAGS, argv_get_one(argv, idx + 1, arg_parse_secret_flags, idx))
+            if not peer and argv[idx] == "private-key-flags":
+                s_wg.set_property(
+                    NM.SETTING_WIREGUARD_PRIVATE_KEY_FLAGS,
+                    argv_get_one(argv, idx + 1, arg_parse_secret_flags, idx),
+                )
                 idx += 2
                 continue
-            if not peer and argv[idx] == 'listen-port':
-                s_wg.set_property(NM.SETTING_WIREGUARD_LISTEN_PORT, argv_get_one(argv, idx + 1, arg_parse_listen_port, idx))
+            if not peer and argv[idx] == "listen-port":
+                s_wg.set_property(
+                    NM.SETTING_WIREGUARD_LISTEN_PORT,
+                    argv_get_one(argv, idx + 1, arg_parse_listen_port, idx),
+                )
                 idx += 2
                 continue
-            if not peer and argv[idx] == 'fwmark':
-                s_wg.set_property(NM.SETTING_WIREGUARD_FWMARK, argv_get_one(argv, idx + 1, arg_parse_fwmark, idx))
+            if not peer and argv[idx] == "fwmark":
+                s_wg.set_property(
+                    NM.SETTING_WIREGUARD_FWMARK,
+                    argv_get_one(argv, idx + 1, arg_parse_fwmark, idx),
+                )
                 idx += 2
                 continue
-            if argv[idx] == 'peer':
+            if argv[idx] == "peer":
                 public_key = argv_get_one(argv, idx + 1, None, idx)
                 peer, peer_idx = s_wg.get_peer_by_public_key(public_key)
                 if peer:
@@ -347,13 +418,13 @@ def do_set(nm_client, conn, argv):
                 peer_remove = False
                 idx += 2
                 continue
-            if peer and argv[idx] == 'remove':
+            if peer and argv[idx] == "remove":
                 peer_remove = True
                 idx += 1
                 continue
-            if peer and argv[idx] == 'preshared-key':
+            if peer and argv[idx] == "preshared-key":
                 psk = argv_get_one(argv, idx + 1, None, idx)
-                if psk == '':
+                if psk == "":
                     peer.set_preshared_key(None, True)
                     if peer_secret_flags is not None:
                         peer_secret_flags = NM.SettingSecretFlags.NOT_REQUIRED
@@ -363,20 +434,26 @@ def do_set(nm_client, conn, argv):
                         peer_secret_flags = NM.SettingSecretFlags.NONE
                 idx += 2
                 continue
-            if peer and argv[idx] == 'preshared-key-flags':
-                peer_secret_flags = argv_get_one(argv, idx + 1, arg_parse_secret_flags, idx)
+            if peer and argv[idx] == "preshared-key-flags":
+                peer_secret_flags = argv_get_one(
+                    argv, idx + 1, arg_parse_secret_flags, idx
+                )
                 idx += 2
                 continue
-            if peer and argv[idx] == 'endpoint':
+            if peer and argv[idx] == "endpoint":
                 peer.set_endpoint(argv_get_one(argv, idx + 1, None, idx), True)
                 idx += 2
                 continue
-            if peer and argv[idx] == 'persistent-keepalive':
-                peer.set_persistent_keepalive(argv_get_one(argv, idx + 1, arg_parse_persistent_keep_alive, idx))
+            if peer and argv[idx] == "persistent-keepalive":
+                peer.set_persistent_keepalive(
+                    argv_get_one(argv, idx + 1, arg_parse_persistent_keep_alive, idx)
+                )
                 idx += 2
                 continue
-            if peer and argv[idx] == 'allowed-ips':
-                allowed_ips = list(argv_get_one(argv, idx + 1, arg_parse_allowed_ips, idx))
+            if peer and argv[idx] == "allowed-ips":
+                allowed_ips = list(
+                    argv_get_one(argv, idx + 1, arg_parse_allowed_ips, idx)
+                )
                 peer.clear_allowed_ips()
                 for aip in allowed_ips:
                     peer.append_allowed_ip(aip, False)
@@ -386,21 +463,22 @@ def do_set(nm_client, conn, argv):
 
             raise MyError('invalid argument "%s"' % (argv[idx]))
     except MyError as e:
-        print('Error: %s' % (e.message))
+        print("Error: %s" % (e.message))
         sys.exit(1)
 
     try:
         conn.commit_changes(True, None)
     except Exception as e:
-        print('failure to commit connection: %s' % (e))
+        print("failure to commit connection: %s" % (e))
         sys.exit(1)
 
-    print('Success')
+    print("Success")
     sys.exit(0)
 
+
 ###############################################################################
 
-if __name__ == '__main__':
+if __name__ == "__main__":
 
     nm_client = NM.Client.new(None)
 
@@ -409,13 +487,17 @@ if __name__ == '__main__':
 
     con_spec = None
     if len(argv) >= 1:
-        if argv[0] in [ 'id', 'uuid', 'interface' ]:
+        if argv[0] in ["id", "uuid", "interface"]:
             con_spec = argv[0]
             del argv[0]
 
     if len(argv) < 1:
-        print('Requires an existing NetworkManager connection profile as first argument')
-        print('Select it based on the connection ID, UUID, or interface-name (optionally qualify the selection with [id|uuid|interface])')
+        print(
+            "Requires an existing NetworkManager connection profile as first argument"
+        )
+        print(
+            "Select it based on the connection ID, UUID, or interface-name (optionally qualify the selection with [id|uuid|interface])"
+        )
         print_hint(nm_client)
         sys.exit(1)
     con_id = argv[0]
@@ -423,19 +505,29 @@ if __name__ == '__main__':
 
     connections = connections_find(nm_client.get_connections(), con_spec, con_id)
     if len(connections) == 0:
-        print('No matching connection %s\"%s\" found.' % ((con_spec+' ' if con_spec else ''), con_id))
+        print(
+            'No matching connection %s"%s" found.'
+            % ((con_spec + " " if con_spec else ""), con_id)
+        )
         print_hint(nm_client)
         sys.exit(1)
     if len(connections) > 1:
-        print("Connection %s\"%s\" is not unique (%s)" % ((con_spec+' ' if con_spec else ''), con_id, ', '.join(['['+connection_to_str(c)+']' for c in connections])))
+        print(
+            'Connection %s"%s" is not unique (%s)'
+            % (
+                (con_spec + " " if con_spec else ""),
+                con_id,
+                ", ".join(["[" + connection_to_str(c) + "]" for c in connections]),
+            )
+        )
         if not con_spec:
-            print('Maybe qualify the name with [id|uuid|interface]?')
+            print("Maybe qualify the name with [id|uuid|interface]?")
         sys.exit(1)
 
     conn = connections[0]
     if not connection_is_wireguard(conn):
-        print('Connection %s is not a WireGuard profile' % (connection_to_str(conn)))
-        print('See available profiles with `nmcli connection show`')
+        print("Connection %s is not a WireGuard profile" % (connection_to_str(conn)))
+        print("See available profiles with `nmcli connection show`")
         sys.exit(1)
 
     try:
@@ -449,4 +541,3 @@ if __name__ == '__main__':
         do_get(nm_client, conn)
     else:
         do_set(nm_client, conn, argv)
-
diff --git a/introspection/org.freedesktop.NetworkManager.Device.WifiP2P.xml b/introspection/org.freedesktop.NetworkManager.Device.WifiP2P.xml
index 9e74eb6e56..f5e2fdceaa 100644
--- a/introspection/org.freedesktop.NetworkManager.Device.WifiP2P.xml
+++ b/introspection/org.freedesktop.NetworkManager.Device.WifiP2P.xml
@@ -31,7 +31,7 @@
 
     <!--
         StartFind:
-        @options: Options of find. Currently 'timeout' option with value of "i"
+        @options: Options of find. Currently, 'timeout' option with value of "i"
                   in the range of 1-600 seconds is supported. The default is
                   30 seconds.
 
diff --git a/introspection/org.freedesktop.NetworkManager.Device.Wireless.xml b/introspection/org.freedesktop.NetworkManager.Device.Wireless.xml
index d9af0964ec..c043a2c2f7 100644
--- a/introspection/org.freedesktop.NetworkManager.Device.Wireless.xml
+++ b/introspection/org.freedesktop.NetworkManager.Device.Wireless.xml
@@ -34,7 +34,7 @@
 
     <!--
         RequestScan:
-        @options: Options of scan. Currently 'ssids' option with value of "aay" type is supported.
+        @options: Options of scan. Currently, 'ssids' option with value of "aay" type is supported.
 
         Request the device to scan. To know when the scan is finished, use the "PropertiesChanged" signal from "org.freedesktop.DBus.Properties" to listen to changes to the "LastScan" property.
     -->
diff --git a/introspection/org.freedesktop.NetworkManager.Device.xml b/introspection/org.freedesktop.NetworkManager.Device.xml
index 7303a95f28..f1ab3db53b 100644
--- a/introspection/org.freedesktop.NetworkManager.Device.xml
+++ b/introspection/org.freedesktop.NetworkManager.Device.xml
@@ -312,7 +312,7 @@
 
     <!--
         Reapply:
-        @connection: The optional connection settings that will be reapplied on the device. If empty, the currently active settings-connection will be used. The connection cannot arbitrarly differ from the current applied-connection otherwise the call will fail. Only certain changes are supported, like adding or removing IP addresses.
+        @connection: The optional connection settings that will be reapplied on the device. If empty, the currently active settings-connection will be used. The connection cannot arbitrarily differ from the current applied-connection otherwise the call will fail. Only certain changes are supported, like adding or removing IP addresses.
         @version_id: If non-zero, the current version id of the applied-connection must match. The current version id can be retrieved via GetAppliedConnection. This optional argument allows to catch concurrent modifications between the GetAppliedConnection call and Reapply.
         @flags: Flags which would modify the behavior of the Reapply call. There are no flags defined currently and the users should use the value of 0.
 
diff --git a/introspection/org.freedesktop.NetworkManager.IP4Config.xml b/introspection/org.freedesktop.NetworkManager.IP4Config.xml
index e4388fd4fe..8ee29c3e08 100644
--- a/introspection/org.freedesktop.NetworkManager.IP4Config.xml
+++ b/introspection/org.freedesktop.NetworkManager.IP4Config.xml
@@ -62,7 +62,7 @@
     <!--
         NameserverData:
 
-        The nameservers in use. Currently only the value "address"
+        The nameservers in use. Currently, only the value "address"
         is recognized (with an IP address string).
 
         Since: 1.14
diff --git a/introspection/org.freedesktop.NetworkManager.Settings.Connection.xml b/introspection/org.freedesktop.NetworkManager.Settings.Connection.xml
index 6211274fd9..40829e252d 100644
--- a/introspection/org.freedesktop.NetworkManager.Settings.Connection.xml
+++ b/introspection/org.freedesktop.NetworkManager.Settings.Connection.xml
@@ -62,7 +62,7 @@
 
     <!--
         GetSecrets:
-        @setting_name: Name of the setting to return secrets for. If empty, all all secrets will be returned.
+        @setting_name: Name of the setting to return secrets for. If empty, all secrets will be returned.
         @secrets: Nested settings maps containing secrets.
 
         Get the secrets belonging to this network configuration. Only secrets from
@@ -105,7 +105,7 @@
         Update2:
         @settings: New connection settings, properties, and (optionally) secrets.
           Provide an empty array, to use the current settings.
-        @flags: optional flags argument. Currently supported flags are:
+        @flags: optional flags argument. Currently, supported flags are:
           "0x1" (to-disk),
           "0x2" (in-memory),
           "0x4" (in-memory-detached),
@@ -114,7 +114,7 @@
           "0x20" (block-autoconnect),
           "0x40" (no-reapply).
           Unknown flags cause the call to fail.
-        @args: optional arguments dictionary, for extensibility. Currently no
+        @args: optional arguments dictionary, for extentibility. Currently, no
           arguments are accepted. Specifying unknown keys causes the call
           to fail.
         @result: output argument, currently no results are returned.
diff --git a/introspection/org.freedesktop.NetworkManager.Settings.xml b/introspection/org.freedesktop.NetworkManager.Settings.xml
index 42e6f1ef85..1544e5529b 100644
--- a/introspection/org.freedesktop.NetworkManager.Settings.xml
+++ b/introspection/org.freedesktop.NetworkManager.Settings.xml
@@ -66,12 +66,12 @@
     <!--
         AddConnection2:
         @settings: New connection settings, properties, and (optionally) secrets.
-        @flags: optional flags argument. Currently the following flags are supported:
+        @flags: optional flags argument. Currently, the following flags are supported:
           "0x1" (to-disk),
           "0x2" (in-memory),
           "0x20" (block-autoconnect).
           Unknown flags cause the call to fail.
-        @args: optional arguments dictionary, for extensibility. Currently no
+        @args: optional arguments dictionary, for extentibility. Currently, no
           arguments are accepted. Specifying unknown keys causes the call
           to fail.
         @path: Object path of the new connection that was just added.
@@ -82,7 +82,7 @@
         Either the flags 0x1 (to-disk) or 0x2 (in-memory) must be specified.
         The effect is whether to behave like AddConnection or AddConnectionUnsaved.
         If 0x20 (block-autoconnect) is specified, autoconnect for the new profile
-        is blocked from the beginnin. Otherwise, the profile might automatically
+        is blocked from the beginning. Otherwise, the profile might automatically
         connect if a suitable device is around.
 
         AddConnection2 is a extensible alternative to AddConnection, and AddConnectionUnsaved.
diff --git a/introspection/org.freedesktop.NetworkManager.xml b/introspection/org.freedesktop.NetworkManager.xml
index 0ebfe2434f..2bcb156eec 100644
--- a/introspection/org.freedesktop.NetworkManager.xml
+++ b/introspection/org.freedesktop.NetworkManager.xml
@@ -119,7 +119,7 @@
         @options: Further options for the method call.
         @path: Object path of the new connection that was just added.
         @active_connection: The path of the active connection object representing this active connection.
-        @result: a dictionary of additional output arguments for future extension. Currently not additional
+        @result: a dictionary of additional output arguments for future extension. Currently, not additional
           output arguments are supported.
 
         Adds a new connection using the given details (if any) as a template
@@ -523,7 +523,7 @@
         ConnectivityCheckEnabled:
 
         Indicates whether connectivity checking is enabled.  This
-        property can also be written to to disable connectivity
+        property can also be written to disable connectivity
         checking (as a privacy control panel might want to do).
     -->
     <property name="ConnectivityCheckEnabled" type="b" access="readwrite"/>
diff --git a/libnm-core/meson.build b/libnm-core/meson.build
index 89acaf72ad..0509deaa54 100644
--- a/libnm-core/meson.build
+++ b/libnm-core/meson.build
@@ -196,12 +196,6 @@ links = [
 
 libnm_core_c_args = common_c_flags
 
-if enable_json_validation
-  libnm_core_sources += files('nm-json.c')
-  deps += jansson_dep
-  libnm_core_c_args += ['-fcommon']
-endif
-
 libnm_core = static_library(
   'nm-core',
   sources: libnm_core_sources + libnm_core_enum_sources + nm_meta_setting_source + [nm_version_macro_header],
diff --git a/libnm-core/nm-connection.c b/libnm-core/nm-connection.c
index 5f18b651cb..b1eff83e7c 100644
--- a/libnm-core/nm-connection.c
+++ b/libnm-core/nm-connection.c
@@ -2089,7 +2089,7 @@ _clear_secrets_by_secret_flags_cb (NMSetting *setting,
 		/* Can't use bitops with SECRET_FLAG_NONE so handle that specifically */
 		remove_secret = (flags != NM_SETTING_SECRET_FLAG_NONE);
 	} else {
-		/* Otherwise if the secret has at least one of the desired flags keep it */
+		/* Otherwise, if the secret has at least one of the desired flags keep it */
 		remove_secret = !NM_FLAGS_ANY (flags, filter_flags);
 	}
 
@@ -2101,7 +2101,7 @@ _clear_secrets_by_secret_flags_cb (NMSetting *setting,
  * @self: the #NMConnection to filter (will be modified)
  * @filter_flags: the secret flags to control whether to drop/remove
  *   a secret or to keep it. The meaning of the filter flags is to
- *   preseve the secrets. The secrets that have matching (see below)
+ *   preserve the secrets. The secrets that have matching (see below)
  *   flags are kept, the others are dropped.
  *
  * Removes/drops secrets from @self according to @filter_flags.
@@ -2370,8 +2370,8 @@ nm_connection_for_each_setting_value (NMConnection *connection,
 
 /**
  * _nm_connection_aggregate:
- * @connecition: the #NMConnection for which values are to be aggregated.
- * @type: one of the supported aggrate types.
+ * @connection: the #NMConnection for which values are to be aggregated.
+ * @type: one of the supported aggregate types.
  * @arg: the input/output argument that depends on @type.
  *
  * For example, with %NM_CONNECTION_AGGREGATE_ANY_SECRETS and
diff --git a/libnm-core/nm-core-internal.h b/libnm-core/nm-core-internal.h
index 3a15d2e956..053b5384c3 100644
--- a/libnm-core/nm-core-internal.h
+++ b/libnm-core/nm-core-internal.h
@@ -879,10 +879,6 @@ gboolean nm_utils_base64secret_normalize (const char *base64_key,
 
 /*****************************************************************************/
 
-void _nm_bridge_vlan_str_append_rest (const NMBridgeVlan *vlan,
-                                      GString *string,
-                                      gboolean leading_space);
-
 gboolean nm_utils_connection_is_adhoc_wpa (NMConnection *connection);
 
 const char *nm_utils_wifi_freq_to_band (guint32 freq);
diff --git a/libnm-core/nm-dbus-interface.h b/libnm-core/nm-dbus-interface.h
index 4c85dae470..c55b1a5383 100644
--- a/libnm-core/nm-dbus-interface.h
+++ b/libnm-core/nm-dbus-interface.h
@@ -1024,7 +1024,7 @@ typedef enum { /*< flags >*/
  * @NM_ACTIVATION_STATE_FLAG_MASTER_HAS_SLAVES: The master has any slave devices attached.
  *   This only makes sense if the device is a master.
  * @NM_ACTIVATION_STATE_FLAG_LIFETIME_BOUND_TO_PROFILE_VISIBILITY: the lifetime
- *   of the activation is bound to the visilibity of the connection profile,
+ *   of the activation is bound to the visibility of the connection profile,
  *   which in turn depends on "connection.permissions" and whether a session
  *   for the user exists. Since: 1.16
  * @NM_ACTIVATION_STATE_FLAG_EXTERNAL: the active connection was generated to
@@ -1087,7 +1087,7 @@ typedef enum { /*< flags >*/
  *   as %NM_SETTINGS_UPDATE2_FLAG_IN_MEMORY, with one difference: when later deleting
  *   the profile, the original profile will not be deleted. Instead a nmmeta
  *   file is written to /run to indicate that the profile is gone.
- *   Note that if such a nmmeta tombstone file exists and hides a file in persistant
+ *   Note that if such a nmmeta tombstone file exists and hides a file in persistent
  *   storage, then when re-adding the profile with the same UUID, then the original
  *   storage is taken over again.
  * @NM_SETTINGS_UPDATE2_FLAG_IN_MEMORY_ONLY: this is like %NM_SETTINGS_UPDATE2_FLAG_IN_MEMORY,
diff --git a/libnm-core/nm-dbus-utils.c b/libnm-core/nm-dbus-utils.c
index 72b9fe1f44..c099ff472c 100644
--- a/libnm-core/nm-dbus-utils.c
+++ b/libnm-core/nm-dbus-utils.c
@@ -201,7 +201,7 @@ _nm_dbus_typecheck_response (GVariant *response,
  * will also check that the response matches that type signature, and return
  * an error if not.
  *
- * Returns: %NULL if @error is set. Otherwise a #GVariant tuple with
+ * Returns: %NULL if @error is set. Otherwise, a #GVariant tuple with
  * return values. Free with g_variant_unref().
  */
 GVariant *
diff --git a/libnm-core/nm-json.c b/libnm-core/nm-json.c
deleted file mode 100644
index 001d53dbb6..0000000000
--- a/libnm-core/nm-json.c
+++ /dev/null
@@ -1,110 +0,0 @@
-// SPDX-License-Identifier: LGPL-2.1+
-/*
- * Copyright (C) 2017, 2018 Red Hat, Inc.
- */
-
-#include "nm-default.h"
-
-#define NM_JANSSON_C
-#include "nm-json.h"
-
-#include <dlfcn.h>
-
-void *_nm_jansson_json_object_iter_value;
-void *_nm_jansson_json_object_key_to_iter;
-void *_nm_jansson_json_integer;
-void *_nm_jansson_json_object_del;
-void *_nm_jansson_json_array_get;
-void *_nm_jansson_json_array_size;
-void *_nm_jansson_json_array_append_new;
-void *_nm_jansson_json_string;
-void *_nm_jansson_json_object_iter_next;
-void *_nm_jansson_json_loads;
-void *_nm_jansson_json_dumps;
-void *_nm_jansson_json_object_iter_key;
-void *_nm_jansson_json_object;
-void *_nm_jansson_json_object_get;
-void *_nm_jansson_json_array;
-void *_nm_jansson_json_false;
-void *_nm_jansson_json_delete;
-void *_nm_jansson_json_true;
-void *_nm_jansson_json_object_size;
-void *_nm_jansson_json_object_set_new;
-void *_nm_jansson_json_object_iter;
-void *_nm_jansson_json_integer_value;
-void *_nm_jansson_json_string_value;
-
-#define TRY_BIND_SYMBOL(symbol) \
-	G_STMT_START { \
-		void *sym = dlsym (handle, #symbol); \
-		if (_nm_jansson_ ## symbol && sym != _nm_jansson_ ## symbol) \
-			return FALSE; \
-		_nm_jansson_ ## symbol = sym; \
-	} G_STMT_END
-
-static gboolean
-bind_symbols (void *handle)
-{
-	TRY_BIND_SYMBOL (json_object_iter_value);
-	TRY_BIND_SYMBOL (json_object_key_to_iter);
-	TRY_BIND_SYMBOL (json_integer);
-	TRY_BIND_SYMBOL (json_object_del);
-	TRY_BIND_SYMBOL (json_array_get);
-	TRY_BIND_SYMBOL (json_array_size);
-	TRY_BIND_SYMBOL (json_array_append_new);
-	TRY_BIND_SYMBOL (json_string);
-	TRY_BIND_SYMBOL (json_object_iter_next);
-	TRY_BIND_SYMBOL (json_loads);
-	TRY_BIND_SYMBOL (json_dumps);
-	TRY_BIND_SYMBOL (json_object_iter_key);
-	TRY_BIND_SYMBOL (json_object);
-	TRY_BIND_SYMBOL (json_object_get);
-	TRY_BIND_SYMBOL (json_array);
-	TRY_BIND_SYMBOL (json_false);
-	TRY_BIND_SYMBOL (json_delete);
-	TRY_BIND_SYMBOL (json_true);
-	TRY_BIND_SYMBOL (json_object_size);
-	TRY_BIND_SYMBOL (json_object_set_new);
-	TRY_BIND_SYMBOL (json_object_iter);
-	TRY_BIND_SYMBOL (json_integer_value);
-	TRY_BIND_SYMBOL (json_string_value);
-
-	return TRUE;
-}
-
-gboolean
-nm_jansson_load (void)
-{
-	static enum {
-		UNKNOWN,
-		AVAILABLE,
-		MISSING,
-	} state = UNKNOWN;
-	void *handle;
-	int mode;
-
-	if (G_LIKELY (state != UNKNOWN))
-		goto out;
-
-	/* First just resolve the symbols to see if there's a conflict already. */
-	if (!bind_symbols (RTLD_DEFAULT))
-		goto out;
-
-	mode = RTLD_LAZY | RTLD_LOCAL | RTLD_NODELETE | RTLD_DEEPBIND;
-#if defined (ASAN_BUILD)
-	/* Address sanitizer is incompatible with RTLD_DEEPBIND. */
-	mode &= ~RTLD_DEEPBIND;
-#endif
-	handle = dlopen (JANSSON_SONAME, mode);
-
-	if (!handle)
-		goto out;
-
-	/* Now do the actual binding. */
-	if (!bind_symbols (handle))
-		goto out;
-
-	state = AVAILABLE;
-out:
-	return state == AVAILABLE;
-}
diff --git a/libnm-core/nm-json.h b/libnm-core/nm-json.h
deleted file mode 100644
index d857fe0275..0000000000
--- a/libnm-core/nm-json.h
+++ /dev/null
@@ -1,39 +0,0 @@
-// SPDX-License-Identifier: LGPL-2.1+
-/*
- * Copyright (C) 2017, 2018 Red Hat, Inc.
- */
-
-#ifndef __NM_JSON_H__
-#define __NM_JSON_H__
-
-gboolean nm_jansson_load (void);
-
-#ifndef NM_JANSSON_C
-#define json_object_iter_value  (*_nm_jansson_json_object_iter_value)
-#define json_object_key_to_iter (*_nm_jansson_json_object_key_to_iter)
-#define json_integer            (*_nm_jansson_json_integer)
-#define json_object_del         (*_nm_jansson_json_object_del)
-#define json_array_get          (*_nm_jansson_json_array_get)
-#define json_array_size         (*_nm_jansson_json_array_size)
-#define json_array_append_new   (*_nm_jansson_json_array_append_new)
-#define json_string             (*_nm_jansson_json_string)
-#define json_object_iter_next   (*_nm_jansson_json_object_iter_next)
-#define json_loads              (*_nm_jansson_json_loads)
-#define json_dumps              (*_nm_jansson_json_dumps)
-#define json_object_iter_key    (*_nm_jansson_json_object_iter_key)
-#define json_object             (*_nm_jansson_json_object)
-#define json_object_get         (*_nm_jansson_json_object_get)
-#define json_array              (*_nm_jansson_json_array)
-#define json_false              (*_nm_jansson_json_false)
-#define json_delete             (*_nm_jansson_json_delete)
-#define json_true               (*_nm_jansson_json_true)
-#define json_object_size        (*_nm_jansson_json_object_size)
-#define json_object_set_new     (*_nm_jansson_json_object_set_new)
-#define json_object_iter        (*_nm_jansson_json_object_iter)
-#define json_integer_value      (*_nm_jansson_json_integer_value)
-#define json_string_value       (*_nm_jansson_json_string_value)
-
-#include "nm-glib-aux/nm-jansson.h"
-#endif
-
-#endif /* __NM_JSON_H__ */
diff --git a/libnm-core/nm-keyfile/nm-keyfile-utils.c b/libnm-core/nm-keyfile/nm-keyfile-utils.c
index 0ffce40b96..0e88609fd0 100644
--- a/libnm-core/nm-keyfile/nm-keyfile-utils.c
+++ b/libnm-core/nm-keyfile/nm-keyfile-utils.c
@@ -504,8 +504,9 @@ static const char *
 _keyfile_key_encode (const char *name,
                      char **out_to_free)
 {
-	gsize len, i;
-	GString *str;
+	NMStrBuf str;
+	gsize len;
+	gsize i;
 
 	nm_assert (name);
 	nm_assert (out_to_free && !*out_to_free);
@@ -525,7 +526,7 @@ _keyfile_key_encode (const char *name,
 	 */
 
 	if (!name[0]) {
-		/* empty keys are are backslash encoded. Note that usually
+		/* empty keys are backslash encoded. Note that usually
 		 * \\00 is not a valid encode, the only exception is the empty
 		 * word. */
 		return "\\00";
@@ -555,14 +556,15 @@ _keyfile_key_encode (const char *name,
 
 	len = i + strlen (&name[i]);
 	nm_assert (len == strlen (name));
-	str = g_string_sized_new (len + 15);
+
+	nm_str_buf_init (&str, len + 15u, FALSE);
 
 	if (name[0] == ' ') {
 		nm_assert (i == 0);
-		g_string_append (str, "\\20");
+		nm_str_buf_append (&str, "\\20");
 		i = 1;
 	} else
-		g_string_append_len (str, name, i);
+		nm_str_buf_append_len (&str, name, i);
 
 	for (;; i++) {
 		const guchar ch = (guchar) name[i];
@@ -577,21 +579,24 @@ _keyfile_key_encode (const char *name,
 		        && g_ascii_isxdigit (name[i + 1])
 		        && g_ascii_isxdigit (name[i + 2]))
 		    || (   ch == ' '
-		        && name[i + 1] == '\0'))
-			g_string_append_printf (str, "\\%02X", ch);
-		else
-			g_string_append_c (str, (char) ch);
+		        && name[i + 1] == '\0')) {
+			nm_str_buf_append_c (&str, '\\');
+			nm_str_buf_append_c_hex (&str, ch, TRUE);
+		} else
+			nm_str_buf_append_c (&str, (char) ch);
 	}
 
-	return (*out_to_free = g_string_free (str, FALSE));
+	return (*out_to_free = nm_str_buf_finalize (&str, NULL));
 }
 
 static const char *
 _keyfile_key_decode (const char *key,
                      char **out_to_free)
 {
-	gsize i, len;
-	GString *str;
+	char *out;
+	gsize len;
+	gsize i;
+	gsize j;
 
 	nm_assert (key);
 	nm_assert (out_to_free && !*out_to_free);
@@ -617,9 +622,12 @@ _keyfile_key_decode (const char *key,
 		return "";
 
 	nm_assert (len == strlen (key));
-	str = g_string_sized_new (len + 3);
 
-	g_string_append_len (str, key, i);
+	out = g_new (char, len + 1u);
+
+	memcpy (out, key, sizeof (char) * i);
+
+	j = i;
 	for (;;) {
 		const char ch = key[i];
 		char ch1, ch2;
@@ -633,16 +641,18 @@ _keyfile_key_decode (const char *key,
 		    && g_ascii_isxdigit ((ch2 = key[i + 2]))) {
 			v = (g_ascii_xdigit_value (ch1) << 4) + g_ascii_xdigit_value (ch2);
 			if (v != 0) {
-				g_string_append_c (str, (char) v);
+				out[j++] = (char) v;
 				i += 3;
 				continue;
 			}
 		}
-		g_string_append_c (str, ch);
+		out[j++] = ch;
 		i++;
 	}
 
-	return (*out_to_free = g_string_free (str, FALSE));
+	nm_assert (j <= len);
+	out[j] = '\0';
+	return (*out_to_free = out);
 }
 
 /*****************************************************************************/
@@ -689,7 +699,7 @@ nm_keyfile_key_decode (const char *key,
 		const char *key2;
 
 		key2 = _keyfile_key_encode (name, &to_free2);
-		/* key2, the result of decode+encode may not be idential
+		/* key2, the result of decode+encode may not be identical
 		 * to the original key. That is, decode() is a surjective
 		 * function mapping different keys to the same name.
 		 * However, decode() behaves injective for input that
diff --git a/libnm-core/nm-keyfile/nm-keyfile.c b/libnm-core/nm-keyfile/nm-keyfile.c
index 77af2b6492..05c8044556 100644
--- a/libnm-core/nm-keyfile/nm-keyfile.c
+++ b/libnm-core/nm-keyfile/nm-keyfile.c
@@ -16,6 +16,7 @@
 #include <arpa/inet.h>
 #include <linux/pkt_sched.h>
 
+#include "nm-glib-aux/nm-str-buf.h"
 #include "nm-glib-aux/nm-secret-utils.h"
 #include "systemd/nm-sd-utils-shared.h"
 #include "nm-libnm-core-intern/nm-common-macros.h"
@@ -472,7 +473,7 @@ openconnect_fix_secret_flags (NMSetting *setting)
 	/* Huge hack.  There were some openconnect changes that needed to happen
 	 * pretty late, too late to get into distros.  Migration has already
 	 * happened for many people, and their secret flags are wrong.  But we
-	 * don't want to requrie re-migration, so we have to fix it up here. Ugh.
+	 * don't want to require re-migration, so we have to fix it up here. Ugh.
 	 */
 
 	if (!NM_IS_SETTING_VPN (setting))
@@ -2107,79 +2108,81 @@ write_ip_values (GKeyFile *file,
                  const char *gateway,
                  gboolean is_route)
 {
-	nm_auto_free_gstring GString *output = NULL;
-	int addr_family;
-	guint i;
-	const char *addr;
-	const char *gw;
-	guint32 plen;
-	char key_name[64];
-	char *key_name_idx;
+	if (array->len > 0) {
+		nm_auto_str_buf NMStrBuf output = NM_STR_BUF_INIT (2*INET_ADDRSTRLEN + 10, FALSE);
+		int addr_family;
+		guint i;
+		const char *addr;
+		const char *gw;
+		guint32 plen;
+		char key_name[64];
+		char *key_name_idx;
 
-	if (!array->len)
-		return;
+		addr_family =   nm_streq (setting_name, NM_SETTING_IP4_CONFIG_SETTING_NAME)
+		              ? AF_INET
+		              : AF_INET6;
 
-	addr_family =   nm_streq (setting_name, NM_SETTING_IP4_CONFIG_SETTING_NAME)
-	              ? AF_INET
-	              : AF_INET6;
+		strcpy (key_name, is_route ? "route" : "address");
+		key_name_idx = key_name + strlen (key_name);
 
-	strcpy (key_name, is_route ? "route" : "address");
-	key_name_idx = key_name + strlen (key_name);
+		for (i = 0; i < array->len; i++) {
+			gint64 metric = -1;
 
-	output = g_string_sized_new (2*INET_ADDRSTRLEN + 10);
-	for (i = 0; i < array->len; i++) {
-		gint64 metric = -1;
+			if (is_route) {
+				NMIPRoute *route = array->pdata[i];
 
-		if (is_route) {
-			NMIPRoute *route = array->pdata[i];
+				addr = nm_ip_route_get_dest (route);
+				plen = nm_ip_route_get_prefix (route);
+				gw = nm_ip_route_get_next_hop (route);
+				metric = nm_ip_route_get_metric (route);
+			} else {
+				NMIPAddress *address = array->pdata[i];
 
-			addr = nm_ip_route_get_dest (route);
-			plen = nm_ip_route_get_prefix (route);
-			gw = nm_ip_route_get_next_hop (route);
-			metric = nm_ip_route_get_metric (route);
-		} else {
-			NMIPAddress *address = array->pdata[i];
-
-			addr = nm_ip_address_get_address (address);
-			plen = nm_ip_address_get_prefix (address);
-			gw =   (i == 0)
-			     ? gateway
-			     : NULL;
-		}
-
-		g_string_set_size (output, 0);
-		g_string_append_printf (output, "%s/%u", addr, plen);
-		if (   metric != -1
-		    || gw) {
-			/* Older versions of the plugin do not support the form
-			 * "a.b.c.d/plen,,metric", so, we always have to write the
-			 * gateway, even if there isn't one.
-			 * The current version supports reading of the above form.
-			 */
-			if (!gw) {
-				if (addr_family == AF_INET)
-					gw = "0.0.0.0";
-				else
-					gw = "::";
+				addr = nm_ip_address_get_address (address);
+				plen = nm_ip_address_get_prefix (address);
+				gw =   (i == 0)
+				     ? gateway
+				     : NULL;
 			}
 
-			g_string_append_printf (output, ",%s", gw);
-			if (   is_route
-			    && metric != -1)
-				g_string_append_printf (output, ",%lu", (unsigned long) metric);
-		}
+			nm_str_buf_set_size (&output, 0, FALSE, FALSE);
+			nm_str_buf_append_printf (&output, "%s/%u", addr, plen);
+			if (   metric != -1
+			    || gw) {
+				/* Older versions of the plugin do not support the form
+				 * "a.b.c.d/plen,,metric", so, we always have to write the
+				 * gateway, even if there isn't one.
+				 * The current version supports reading of the above form.
+				 */
+				if (!gw) {
+					if (addr_family == AF_INET)
+						gw = "0.0.0.0";
+					else
+						gw = "::";
+				}
 
-		sprintf (key_name_idx, "%u", i + 1);
-		nm_keyfile_plugin_kf_set_string (file, setting_name, key_name, output->str);
+				nm_str_buf_append_c (&output, ',');
+				nm_str_buf_append (&output, gw);
+				if (   is_route
+				    && metric != -1)
+					nm_str_buf_append_printf (&output, ",%lu", (unsigned long) metric);
+			}
 
-		if (is_route) {
-			gs_free char *attributes = NULL;
+			sprintf (key_name_idx, "%u", i + 1);
+			nm_keyfile_plugin_kf_set_string (file,
+			                                 setting_name,
+			                                 key_name,
+			                                 nm_str_buf_get_str (&output));
 
-			attributes = nm_utils_format_variant_attributes (_nm_ip_route_get_attributes (array->pdata[i]),
-			                                                 ',', '=');
-			if (attributes) {
-				g_strlcat (key_name, "_options", sizeof (key_name));
-				nm_keyfile_plugin_kf_set_string (file, setting_name, key_name, attributes);
+			if (is_route) {
+				gs_free char *attributes = NULL;
+
+				attributes = nm_utils_format_variant_attributes (_nm_ip_route_get_attributes (array->pdata[i]),
+				                                                 ',', '=');
+				if (attributes) {
+					g_strlcat (key_name, "_options", sizeof (key_name));
+					nm_keyfile_plugin_kf_set_string (file, setting_name, key_name, attributes);
+				}
 			}
 		}
 	}
@@ -2220,34 +2223,29 @@ bridge_vlan_writer (KeyfileWriterInfo *info,
                     const char *key,
                     const GValue *value)
 {
-	NMBridgeVlan *vlan;
 	GPtrArray *vlans;
-	GString *string;
-	guint i;
 
-	vlans = (GPtrArray *) g_value_get_boxed (value);
-	if (!vlans || !vlans->len)
-		return;
+	vlans = g_value_get_boxed (value);
+	if (   vlans
+	    && vlans->len > 0) {
+		const guint string_initial_size = vlans->len * 10u;
+		nm_auto_str_buf NMStrBuf string = NM_STR_BUF_INIT (string_initial_size, FALSE);
+		guint i;
 
-	string = g_string_new ("");
-	for (i = 0; i < vlans->len; i++) {
-		gs_free char *vlan_str = NULL;
+		for (i = 0; i < vlans->len; i++) {
+			gs_free char *vlan_str = NULL;
 
-		vlan = vlans->pdata[i];
-		vlan_str = nm_bridge_vlan_to_str (vlan, NULL);
-		if (!vlan_str)
-			continue;
-		if (string->len > 0)
-			g_string_append (string, ",");
-		nm_utils_escaped_tokens_escape_gstr_assert (vlan_str, ",", string);
+			vlan_str = nm_bridge_vlan_to_str (vlans->pdata[i], NULL);
+			if (i > 0)
+				nm_str_buf_append_c (&string, ',');
+			nm_utils_escaped_tokens_escape_strbuf_assert (vlan_str, ",", &string);
+		}
+
+		nm_keyfile_plugin_kf_set_string (info->keyfile,
+		                                 nm_setting_get_name (setting),
+		                                 "vlans",
+		                                 nm_str_buf_get_str (&string));
 	}
-
-	nm_keyfile_plugin_kf_set_string (info->keyfile,
-	                                 nm_setting_get_name (setting),
-	                                 "vlans",
-	                                 string->str);
-
-	g_string_free (string, TRUE);
 }
 
 
@@ -2348,17 +2346,21 @@ qdisc_writer (KeyfileWriterInfo *info,
               const char *key,
               const GValue *value)
 {
-	gsize i;
+	nm_auto_free_gstring GString *key_name = NULL;
+	nm_auto_free_gstring GString *value_str = NULL;
 	GPtrArray *array;
+	guint i;
 
-	array = (GPtrArray *) g_value_get_boxed (value);
-	if (!array || !array->len)
+	array = g_value_get_boxed (value);
+	if (   !array
+	    || !array->len)
 		return;
 
 	for (i = 0; i < array->len; i++) {
 		NMTCQdisc *qdisc = array->pdata[i];
-		GString *key_name = g_string_sized_new (16);
-		GString *value_str = g_string_sized_new (60);
+
+		nm_gstring_prepare (&key_name);
+		nm_gstring_prepare (&value_str);
 
 		g_string_append (key_name, "qdisc.");
 		_nm_utils_string_append_tc_parent (key_name, NULL,
@@ -2369,9 +2371,6 @@ qdisc_writer (KeyfileWriterInfo *info,
 		                                 NM_SETTING_TC_CONFIG_SETTING_NAME,
 		                                 key_name->str,
 		                                 value_str->str);
-
-		g_string_free (key_name, TRUE);
-		g_string_free (value_str, TRUE);
 	}
 }
 
@@ -2381,17 +2380,21 @@ tfilter_writer (KeyfileWriterInfo *info,
               const char *key,
               const GValue *value)
 {
-	gsize i;
+	nm_auto_free_gstring GString *key_name = NULL;
+	nm_auto_free_gstring GString *value_str = NULL;
 	GPtrArray *array;
+	guint i;
 
-	array = (GPtrArray *) g_value_get_boxed (value);
-	if (!array || !array->len)
+	array = g_value_get_boxed (value);
+	if (   !array
+	    || !array->len)
 		return;
 
 	for (i = 0; i < array->len; i++) {
 		NMTCTfilter *tfilter = array->pdata[i];
-		GString *key_name = g_string_sized_new (16);
-		GString *value_str = g_string_sized_new (60);
+
+		nm_gstring_prepare (&key_name);
+		nm_gstring_prepare (&value_str);
 
 		g_string_append (key_name, "tfilter.");
 		_nm_utils_string_append_tc_parent (key_name, NULL,
@@ -2402,9 +2405,6 @@ tfilter_writer (KeyfileWriterInfo *info,
 		                                 NM_SETTING_TC_CONFIG_SETTING_NAME,
 		                                 key_name->str,
 		                                 value_str->str);
-
-		g_string_free (key_name, TRUE);
-		g_string_free (value_str, TRUE);
 	}
 }
 
@@ -4309,46 +4309,53 @@ char *
 nm_keyfile_utils_create_filename (const char *name,
                                   gboolean with_extension)
 {
-	GString *str;
-	const char *f = name;
 	/* keyfile used to escape with '*', do not change that behavior.
 	 *
 	 * But for newly added escapings, use '_' instead.
 	 * Also, @with_extension is new-style. */
 	const char ESCAPE_CHAR = with_extension ? '_' : '*';
 	const char ESCAPE_CHAR2 = '_';
+	NMStrBuf str;
+	char *p;
+	gsize len;
+	gsize i;
 
 	g_return_val_if_fail (name && name[0], NULL);
 
-	str = g_string_sized_new (60);
+	nm_str_buf_init (&str, 0, FALSE);
+
+	len = strlen (name);
+
+	p = nm_str_buf_append_len0 (&str, name, len);
 
 	/* Convert '/' to ESCAPE_CHAR */
-	for (f = name; f[0]; f++) {
-		if (f[0] == '/')
-			g_string_append_c (str, ESCAPE_CHAR);
-		else
-			g_string_append_c (str, f[0]);
+	for (i = 0; i < len; i++) {
+		if (p[i] == '/')
+			p[i] = ESCAPE_CHAR;
 	}
 
 	/* nm_keyfile_utils_create_filename() must avoid anything that ignore_filename() would reject.
-	 * We can escape here more aggressivly then what we would read back. */
-	if (str->str[0] == '.')
-		str->str[0] = ESCAPE_CHAR2;
-	if (str->str[str->len - 1] == '~')
-		str->str[str->len - 1] = ESCAPE_CHAR2;
-	if (   check_mkstemp_suffix (str->str)
-	    || check_suffix (str->str, PEM_TAG)
-	    || check_suffix (str->str, DER_TAG))
-		g_string_append_c (str, ESCAPE_CHAR2);
+	 * We can escape here more aggressively then what we would read back. */
+	if (p[0] == '.')
+		p[0] = ESCAPE_CHAR2;
+	if (p[str.len - 1] == '~')
+		p[str.len - 1] = ESCAPE_CHAR2;
+
+	if (   check_mkstemp_suffix (p)
+	    || check_suffix (p, PEM_TAG)
+	    || check_suffix (p, DER_TAG))
+		nm_str_buf_append_c (&str, ESCAPE_CHAR2);
 
 	if (with_extension)
-		g_string_append (str, NM_KEYFILE_PATH_SUFFIX_NMCONNECTION);
+		nm_str_buf_append (&str, NM_KEYFILE_PATH_SUFFIX_NMCONNECTION);
+
+	p = nm_str_buf_finalize (&str, NULL);
 
 	/* nm_keyfile_utils_create_filename() must mirror ignore_filename() */
-	nm_assert (!strchr (str->str, '/'));
-	nm_assert (!nm_keyfile_utils_ignore_filename (str->str, with_extension));
+	nm_assert (!strchr (p, '/'));
+	nm_assert (!nm_keyfile_utils_ignore_filename (p, with_extension));
 
-	return g_string_free (str, FALSE);;
+	return p;
 }
 
 /*****************************************************************************/
diff --git a/libnm-core/nm-setting-8021x.c b/libnm-core/nm-setting-8021x.c
index f6dbda6341..93478c22e3 100644
--- a/libnm-core/nm-setting-8021x.c
+++ b/libnm-core/nm-setting-8021x.c
@@ -990,7 +990,7 @@ nm_setting_802_1x_get_ca_cert_path (NMSetting8021x *setting)
  * nm_setting_802_1x_get_ca_cert_blob() and
  * nm_setting_802_1x_get_ca_cert_path().
  *
- * Currently it's limited to PKCS#11 URIs ('pkcs11' scheme as defined by RFC
+ * Currently, it's limited to PKCS#11 URIs ('pkcs11' scheme as defined by RFC
  * 7512), but may be extended to other schemes in future (such as 'file' URIs
  * for local files and 'data' URIs for inline certificate data).
  *
@@ -1321,7 +1321,7 @@ nm_setting_802_1x_get_client_cert_path (NMSetting8021x *setting)
  * nm_setting_802_1x_get_client_cert_blob() and
  * nm_setting_802_1x_get_client_cert_path().
  *
- * Currently it's limited to PKCS#11 URIs ('pkcs11' scheme as defined by RFC
+ * Currently, it's limited to PKCS#11 URIs ('pkcs11' scheme as defined by RFC
  * 7512), but may be extended to other schemes in future (such as 'file' URIs
  * for local files and 'data' URIs for inline certificate data).
  *
@@ -1583,7 +1583,7 @@ nm_setting_802_1x_get_phase2_ca_cert_path (NMSetting8021x *setting)
  * nm_setting_802_1x_get_phase2_ca_cert_blob() and
  * nm_setting_802_1x_get_phase2_ca_cert_path().
  *
- * Currently it's limited to PKCS#11 URIs ('pkcs11' scheme as defined by RFC
+ * Currently, it's limited to PKCS#11 URIs ('pkcs11' scheme as defined by RFC
  * 7512), but may be extended to other schemes in future (such as 'file' URIs
  * for local files and 'data' URIs for inline certificate data).
  *
@@ -1918,7 +1918,7 @@ nm_setting_802_1x_get_phase2_client_cert_path (NMSetting8021x *setting)
  * nm_setting_802_1x_get_phase2_ca_cert_blob() and
  * nm_setting_802_1x_get_phase2_ca_cert_path().
  *
- * Currently it's limited to PKCS#11 URIs ('pkcs11' scheme as defined by RFC
+ * Currently, it's limited to PKCS#11 URIs ('pkcs11' scheme as defined by RFC
  * 7512), but may be extended to other schemes in future (such as 'file' URIs
  * for local files and 'data' URIs for inline certificate data).
  *
@@ -2154,7 +2154,7 @@ nm_setting_802_1x_get_private_key_path (NMSetting8021x *setting)
  * nm_setting_802_1x_get_private_key_blob() and
  * nm_setting_802_1x_get_private_key_path().
  *
- * Currently it's limited to PKCS#11 URIs ('pkcs11' scheme as defined by RFC
+ * Currently, it's limited to PKCS#11 URIs ('pkcs11' scheme as defined by RFC
  * 7512), but may be extended to other schemes in future (such as 'file' URIs
  * for local files and 'data' URIs for inline certificate data).
  *
@@ -2357,7 +2357,7 @@ nm_setting_802_1x_get_phase2_private_key_path (NMSetting8021x *setting)
  * nm_setting_802_1x_get_phase2_private_key_blob() and
  * nm_setting_802_1x_get_phase2_private_key_path().
  *
- * Currently it's limited to PKCS#11 URIs ('pkcs11' scheme as defined by RFC
+ * Currently, it's limited to PKCS#11 URIs ('pkcs11' scheme as defined by RFC
  * 7512), but may be extended to other schemes in future (such as 'file' URIs
  * for local files and 'data' URIs for inline certificate data).
  *
diff --git a/libnm-core/nm-setting-bond.c b/libnm-core/nm-setting-bond.c
index 6e0a5e5b3a..651cd4532f 100644
--- a/libnm-core/nm-setting-bond.c
+++ b/libnm-core/nm-setting-bond.c
@@ -370,7 +370,7 @@ static void
 _ensure_options_idx_cache (NMSettingBondPrivate *priv)
 {
 	if (!G_UNLIKELY (priv->options_idx_cache))
-		priv->options_idx_cache = nm_utils_named_values_from_str_dict_with_sort (priv->options, NULL, _get_option_sort, NULL);
+		priv->options_idx_cache = nm_utils_named_values_from_strdict_full (priv->options, NULL, _get_option_sort, NULL, NULL, 0, NULL);
 }
 
 /**
diff --git a/libnm-core/nm-setting-bridge.c b/libnm-core/nm-setting-bridge.c
index 2ead27393e..02ad4f010c 100644
--- a/libnm-core/nm-setting-bridge.c
+++ b/libnm-core/nm-setting-bridge.c
@@ -10,6 +10,7 @@
 #include <ctype.h>
 #include <stdlib.h>
 
+#include "nm-glib-aux/nm-str-buf.h"
 #include "nm-connection-private.h"
 #include "nm-utils.h"
 #include "nm-utils-private.h"
@@ -407,25 +408,6 @@ nm_bridge_vlan_new_clone (const NMBridgeVlan *vlan)
 	return copy;
 }
 
-void
-_nm_bridge_vlan_str_append_rest (const NMBridgeVlan *vlan,
-                                 GString *string,
-                                 gboolean leading_space)
-{
-	if (nm_bridge_vlan_is_pvid (vlan)) {
-		if (leading_space)
-			g_string_append_c (string, ' ');
-		g_string_append (string, "pvid");
-		leading_space = TRUE;
-	}
-	if (nm_bridge_vlan_is_untagged (vlan)) {
-		if (leading_space)
-			g_string_append_c (string, ' ');
-		g_string_append (string, "untagged");
-		leading_space = TRUE;
-	}
-}
-
 /**
  * nm_bridge_vlan_to_str:
  * @vlan: the %NMBridgeVlan
@@ -440,7 +422,7 @@ _nm_bridge_vlan_str_append_rest (const NMBridgeVlan *vlan,
 char *
 nm_bridge_vlan_to_str (const NMBridgeVlan *vlan, GError **error)
 {
-	GString *string;
+	NMStrBuf string;
 
 	g_return_val_if_fail (vlan, NULL);
 	g_return_val_if_fail (!error || !*error, NULL);
@@ -449,16 +431,19 @@ nm_bridge_vlan_to_str (const NMBridgeVlan *vlan, GError **error)
 	 * future if more parameters are added to the object that could
 	 * make it invalid. */
 
-	string = g_string_sized_new (28);
+	nm_str_buf_init (&string, NM_UTILS_GET_NEXT_REALLOC_SIZE_32, FALSE);
 
 	if (vlan->vid_start == vlan->vid_end)
-		g_string_append_printf (string, "%u", vlan->vid_start);
+		nm_str_buf_append_printf (&string, "%u", vlan->vid_start);
 	else
-		g_string_append_printf (string, "%u-%u", vlan->vid_start, vlan->vid_end);
+		nm_str_buf_append_printf (&string, "%u-%u", vlan->vid_start, vlan->vid_end);
 
-	_nm_bridge_vlan_str_append_rest (vlan, string, TRUE);
+	if (nm_bridge_vlan_is_pvid (vlan))
+		nm_str_buf_append (&string, " pvid");
+	if (nm_bridge_vlan_is_untagged (vlan))
+		nm_str_buf_append (&string, " untagged");
 
-	return g_string_free (string, FALSE);
+	return nm_str_buf_finalize (&string, NULL);
 }
 
 /**
@@ -1988,8 +1973,9 @@ nm_setting_bridge_class_init (NMSettingBridgeClass *klass)
 	 * Sets bridge's multicast router. Multicast-snooping must be enabled
 	 * for this option to work.
 	 *
-	 * Supported values are: 'auto', 'disabled', 'enabled'.
-	 * If not specified the default value is 'auto'.
+	 * Supported values are: 'auto', 'disabled', 'enabled' to which kernel
+	 * assigns the numbers 1, 0, and 2, respectively.
+	 * If not specified the default value is 'auto' (1).
 	 **/
 	/* ---ifcfg-rh---
 	 * property: multicast-router
diff --git a/libnm-core/nm-setting-connection.c b/libnm-core/nm-setting-connection.c
index 018129bef2..ff3f516365 100644
--- a/libnm-core/nm-setting-connection.c
+++ b/libnm-core/nm-setting-connection.c
@@ -808,7 +808,7 @@ nm_setting_connection_add_secondary (NMSettingConnection *setting,
  * @setting: the #NMSettingConnection
  * @idx: index number of the secondary connection UUID
  *
- * Removes the secondary coonnection UUID at index @idx.
+ * Removes the secondary connection UUID at index @idx.
  **/
 void
 nm_setting_connection_remove_secondary (NMSettingConnection *setting, guint32 idx)
@@ -832,7 +832,7 @@ nm_setting_connection_remove_secondary (NMSettingConnection *setting, guint32 id
  * @setting: the #NMSettingConnection
  * @sec_uuid: the secondary connection UUID to remove
  *
- * Removes the secondary coonnection UUID @sec_uuid.
+ * Removes the secondary connection UUID @sec_uuid.
  *
  * Returns: %TRUE if the secondary connection UUID was found and removed; %FALSE if it was not.
  **/
@@ -1758,7 +1758,7 @@ nm_setting_connection_class_init (NMSettingConnectionClass *klass)
 	 * name is included, so that different interfaces yield different addresses.
 	 *
 	 * The '$' character is treated special to perform dynamic substitutions
-	 * at runtime. Currently supported are "${CONNECTION}", "${DEVICE}", "${MAC}",
+	 * at runtime. Currently, supported are "${CONNECTION}", "${DEVICE}", "${MAC}",
 	 * "${BOOT}", "${RANDOM}".
 	 * These effectively create unique IDs per-connection, per-device, per-boot,
 	 * or every time. Note that "${DEVICE}" corresponds to the interface name of the
@@ -2128,7 +2128,7 @@ nm_setting_connection_class_init (NMSettingConnectionClass *klass)
 	 * NMSettingConnection:secondaries:
 	 *
 	 * List of connection UUIDs that should be activated when the base
-	 * connection itself is activated. Currently only VPN connections are
+	 * connection itself is activated. Currently, only VPN connections are
 	 * supported.
 	 **/
 	/* ---ifcfg-rh---
@@ -2222,7 +2222,7 @@ nm_setting_connection_class_init (NMSettingConnectionClass *klass)
 	 * to use a global default. If the global default is not set, the authentication
 	 * retries for 3 times before failing the connection.
 	 *
-	 * Currently this only applies to 802-1x authentication.
+	 * Currently, this only applies to 802-1x authentication.
 	 *
 	 * Since: 1.10
 	 **/
@@ -2252,7 +2252,7 @@ nm_setting_connection_class_init (NMSettingConnectionClass *klass)
 	 * If unspecified, "default" ultimately depends on the DNS plugin (which
 	 * for systemd-resolved currently means "no").
 	 *
-	 * This feature requires a plugin which supports mDNS. Otherwise the
+	 * This feature requires a plugin which supports mDNS. Otherwise, the
 	 * setting has no effect. One such plugin is dns-systemd-resolved.
 *
 	 * Since: 1.12
@@ -2287,7 +2287,7 @@ nm_setting_connection_class_init (NMSettingConnectionClass *klass)
 	 * If unspecified, "default" ultimately depends on the DNS plugin (which
 	 * for systemd-resolved currently means "yes").
 	 *
-	 * This feature requires a plugin which supports LLMNR. Otherwise the
+	 * This feature requires a plugin which supports LLMNR. Otherwise, the
 	 * setting has no effect. One such plugin is dns-systemd-resolved.
 	 *
 	 * Since: 1.14
diff --git a/libnm-core/nm-setting-infiniband.c b/libnm-core/nm-setting-infiniband.c
index bfce580eda..777f1feebe 100644
--- a/libnm-core/nm-setting-infiniband.c
+++ b/libnm-core/nm-setting-infiniband.c
@@ -97,7 +97,7 @@ nm_setting_infiniband_get_transport_mode (NMSettingInfiniband *setting)
  * @setting: the #NMSettingInfiniband
  *
  * Returns the P_Key to use for this device. A value of -1 means to
- * use the default P_Key (aka "the P_Key at index 0"). Otherwise it is
+ * use the default P_Key (aka "the P_Key at index 0"). Otherwise, it is
  * a 16-bit unsigned integer.
  *
  * Returns: the IPoIB P_Key
@@ -448,7 +448,7 @@ nm_setting_infiniband_class_init (NMSettingInfinibandClass *klass)
 	 * NMSettingInfiniband:p-key:
 	 *
 	 * The InfiniBand P_Key to use for this device. A value of -1 means to use
-	 * the default P_Key (aka "the P_Key at index 0").  Otherwise it is a 16-bit
+	 * the default P_Key (aka "the P_Key at index 0"). Otherwise, it is a 16-bit
 	 * unsigned integer, whose high bit is set if it is a "full membership"
 	 * P_Key.
 	 **/
diff --git a/libnm-core/nm-setting-ip-config.c b/libnm-core/nm-setting-ip-config.c
index bc81129177..a843ba99f7 100644
--- a/libnm-core/nm-setting-ip-config.c
+++ b/libnm-core/nm-setting-ip-config.c
@@ -11,6 +11,7 @@
 #include <arpa/inet.h>
 #include <linux/fib_rules.h>
 
+#include "nm-glib-aux/nm-str-buf.h"
 #include "nm-setting-ip4-config.h"
 #include "nm-setting-ip6-config.h"
 #include "nm-utils.h"
@@ -745,7 +746,7 @@ nm_ip_route_unref (NMIPRoute *route)
  * nm_ip_route_equal_full:
  * @route: the #NMIPRoute
  * @other: the #NMIPRoute to compare @route to.
- * @cmp_flags: tune how to compare attributes. Currently only
+ * @cmp_flags: tune how to compare attributes. Currently, only
  *   NM_IP_ROUTE_EQUAL_CMP_FLAGS_NONE (0) and NM_IP_ROUTE_EQUAL_CMP_FLAGS_WITH_ATTRS (1)
  *   is supported.
  *
@@ -1363,9 +1364,12 @@ nm_ip_route_attribute_validate  (const char *name,
 gboolean
 _nm_ip_route_attribute_validate_all (const NMIPRoute *route, GError **error)
 {
-	GHashTableIter iter;
-	const char *key;
+	NMUtilsNamedValue attrs_static[G_N_ELEMENTS (ip_route_attribute_spec)];
+	gs_free NMUtilsNamedValue *attrs_free = NULL;
+	const NMUtilsNamedValue *attrs;
+	guint attrs_len;
 	GVariant *val;
+	guint i;
 	guint8 u8;
 
 	g_return_val_if_fail (route, FALSE);
@@ -1374,9 +1378,15 @@ _nm_ip_route_attribute_validate_all (const NMIPRoute *route, GError **error)
 	if (!route->attributes)
 		return TRUE;
 
-	g_hash_table_iter_init (&iter, route->attributes);
-	while (g_hash_table_iter_next (&iter, (gpointer *) &key, (gpointer *) &val)) {
-		if (!nm_ip_route_attribute_validate (key, val, route->family, NULL, error))
+	attrs = nm_utils_named_values_from_strdict (route->attributes,
+	                                            &attrs_len,
+	                                            attrs_static,
+	                                            &attrs_free);
+	for (i = 0; i < attrs_len; i++) {
+		const char *key = attrs[i].name;
+		GVariant *val2 = attrs[i].value_ptr;
+
+		if (!nm_ip_route_attribute_validate (key, val2, route->family, NULL, NULL))
 			return FALSE;
 	}
 
@@ -3021,7 +3031,7 @@ _rr_string_addr_family_from_flags (NMIPRoutingRuleAsStringFlags to_string_flags)
  * @to_string_flags: #NMIPRoutingRuleAsStringFlags for controlling the
  *   string conversion.
  * @extra_args: (allow-none): extra arguments for controlling the string
- *   conversion. Currently not extra arguments are supported.
+ *   conversion. Currently, not extra arguments are supported.
  * @error: (allow-none) (out): the error reason.
  *
  * Returns: (transfer full): the new #NMIPRoutingRule or %NULL on error.
@@ -3081,7 +3091,7 @@ nm_ip_routing_rule_from_string (const char *str,
 	 * - iproute2 in may regards is flexible about the command lines. For example
 	 *   - for tables it accepts table names from /etc/iproute2/rt_tables. We only
 	 *     accept the special aliases "main", "local", and "default".
-	 *   - key names like "preference" can be abbreviated to "prefe", we don't do that.
+	 *   - key names like "preference" can be abbreviated to "pref", we don't do that.
 	 *   - the "preference"/"priority" may be unspecified, in which kernel automatically
 	 *     chooses an unused priority (during `ip rule add`). We don't allow for that, the
 	 *     priority must be explicitly set.
@@ -3117,7 +3127,7 @@ nm_ip_routing_rule_from_string (const char *str,
 		}
 
 		/* iproute2 matches keywords with any partial prefix. We don't allow
-		 * for that flexiblity. */
+		 * for that flexibility. */
 
 		if (NM_IN_STRSET (word0, "from")) {
 			if (!word1)
@@ -3395,7 +3405,7 @@ next_words_consumed:
 }
 
 static void
-_rr_string_append_inet_addr (GString *str,
+_rr_string_append_inet_addr (NMStrBuf *str,
                              gboolean is_from /* or else is-to */,
                              gboolean required,
                              int addr_family,
@@ -3406,26 +3416,26 @@ _rr_string_append_inet_addr (GString *str,
 
 	if (addr_len == 0) {
 		if (required) {
-			g_string_append_printf (nm_gstring_add_space_delimiter (str),
-			                        "%s %s/0",
-			                        is_from ? "from" : "to",
-			                          (addr_family == AF_INET)
-			                        ? "0.0.0.0"
-			                        : "::");
+			nm_str_buf_append_printf (nm_str_buf_append_required_delimiter (str, ' '),
+			                          "%s %s/0",
+			                          is_from ? "from" : "to",
+			                            (addr_family == AF_INET)
+			                          ? "0.0.0.0"
+			                          : "::");
 		}
 		return;
 	}
 
-	g_string_append_printf (nm_gstring_add_space_delimiter (str),
-	                        "%s %s",
-	                        is_from ? "from" : "to",
-	                        nm_utils_inet_ntop (addr_family,
-	                                            addr_bin,
-	                                            addr_str));
+	nm_str_buf_append_printf (nm_str_buf_append_required_delimiter (str, ' '),
+	                          "%s %s",
+	                          is_from ? "from" : "to",
+	                          nm_utils_inet_ntop (addr_family,
+	                                              addr_bin,
+	                                              addr_str));
 	if (addr_len != nm_utils_addr_family_to_size (addr_family) * 8) {
-		g_string_append_printf (str,
-		                        "/%u",
-		                        addr_len);
+		nm_str_buf_append_printf (str,
+		                          "/%u",
+		                          addr_len);
 	}
 }
 
@@ -3435,7 +3445,7 @@ _rr_string_append_inet_addr (GString *str,
  * @to_string_flags: #NMIPRoutingRuleAsStringFlags for controlling the
  *   string conversion.
  * @extra_args: (allow-none): extra arguments for controlling the string
- *   conversion. Currently not extra arguments are supported.
+ *   conversion. Currently, not extra arguments are supported.
  * @error: (allow-none) (out): the error reason.
  *
  * Returns: (transfer full): the string representation or %NULL on error.
@@ -3448,8 +3458,8 @@ nm_ip_routing_rule_to_string (const NMIPRoutingRule *self,
                               GHashTable *extra_args,
                               GError **error)
 {
-	nm_auto_free_gstring GString *str = NULL;
 	int addr_family;
+	NMStrBuf str;
 
 	g_return_val_if_fail (NM_IS_IP_ROUTING_RULE (self, TRUE), NULL);
 
@@ -3485,18 +3495,18 @@ nm_ip_routing_rule_to_string (const NMIPRoutingRule *self,
 		}
 	}
 
-	str = g_string_sized_new (30);
+	nm_str_buf_init (&str, NM_UTILS_GET_NEXT_REALLOC_SIZE_32, FALSE);
 
 	if (self->priority_has) {
-		g_string_append_printf (nm_gstring_add_space_delimiter (str),
-		                        "priority %u",
-		                        (guint) self->priority);
+		nm_str_buf_append_printf (nm_str_buf_append_required_delimiter (&str, ' '),
+		                          "priority %u",
+		                          (guint) self->priority);
 	}
 
 	if (self->invert)
-		g_string_append (nm_gstring_add_space_delimiter (str), "not");
+		nm_str_buf_append (nm_str_buf_append_required_delimiter (&str, ' '), "not");
 
-	_rr_string_append_inet_addr (str,
+	_rr_string_append_inet_addr (&str,
 	                             TRUE,
 	                             (   !self->to_has
 	                              || !self->to_valid),
@@ -3506,7 +3516,7 @@ nm_ip_routing_rule_to_string (const NMIPRoutingRule *self,
 	                             ? self->from_len
 	                             : 0);
 
-	_rr_string_append_inet_addr (str,
+	_rr_string_append_inet_addr (&str,
 	                             FALSE,
 	                             FALSE,
 	                             addr_family,
@@ -3516,88 +3526,88 @@ nm_ip_routing_rule_to_string (const NMIPRoutingRule *self,
 	                             : 0);
 
 	if (self->tos != 0) {
-		g_string_append_printf (nm_gstring_add_space_delimiter (str),
-		                        "tos 0x%02x",
-		                        (guint) self->tos);
+		nm_str_buf_append_printf (nm_str_buf_append_required_delimiter (&str, ' '),
+		                          "tos 0x%02x",
+		                          (guint) self->tos);
 	}
 
 	if (self->ipproto != 0) {
-		g_string_append_printf (nm_gstring_add_space_delimiter (str),
-		                        "ipproto %u",
-		                        (guint) self->ipproto);
+		nm_str_buf_append_printf (nm_str_buf_append_required_delimiter (&str, ' '),
+		                          "ipproto %u",
+		                          (guint) self->ipproto);
 	}
 
 	if (   self->fwmark != 0
 	    || self->fwmask != 0) {
 		if (self->fwmark != 0) {
-			g_string_append_printf (nm_gstring_add_space_delimiter (str),
-			                        "fwmark 0x%x",
-			                        self->fwmark);
+			nm_str_buf_append_printf (nm_str_buf_append_required_delimiter (&str, ' '),
+			                          "fwmark 0x%x",
+			                          self->fwmark);
 		} else {
-			g_string_append_printf (nm_gstring_add_space_delimiter (str),
-			                        "fwmark 0");
+			nm_str_buf_append_printf (nm_str_buf_append_required_delimiter (&str, ' '),
+			                          "fwmark 0");
 		}
 		if (self->fwmask != 0xFFFFFFFFu) {
 			if (self->fwmask != 0)
-				g_string_append_printf (str, "/0x%x", self->fwmask);
+				nm_str_buf_append_printf (&str, "/0x%x", self->fwmask);
 			else
-				g_string_append_printf (str, "/0");
+				nm_str_buf_append_printf (&str, "/0");
 		}
 	}
 
 	if (   self->sport_start != 0
 	    || self->sport_end != 0) {
-		g_string_append_printf (nm_gstring_add_space_delimiter (str),
-		                        "sport %u",
-		                        self->sport_start);
+		nm_str_buf_append_printf (nm_str_buf_append_required_delimiter (&str, ' '),
+		                          "sport %u",
+		                          self->sport_start);
 		if (self->sport_start != self->sport_end) {
-			g_string_append_printf (str,
-			                        "-%u",
-			                        self->sport_end);
+			nm_str_buf_append_printf (&str,
+			                          "-%u",
+			                          self->sport_end);
 		}
 	}
 
 	if (   self->dport_start != 0
 	    || self->dport_end != 0) {
-		g_string_append_printf (nm_gstring_add_space_delimiter (str),
-		                        "dport %u",
-		                        self->dport_start);
+		nm_str_buf_append_printf (nm_str_buf_append_required_delimiter (&str, ' '),
+		                          "dport %u",
+		                          self->dport_start);
 		if (self->dport_start != self->dport_end) {
-			g_string_append_printf (str,
-			                        "-%u",
-			                        self->dport_end);
+			nm_str_buf_append_printf (&str,
+			                          "-%u",
+			                          self->dport_end);
 		}
 	}
 
 	if (self->iifname) {
-		g_string_append (nm_gstring_add_space_delimiter (str),
-		                 "iif ");
-		nm_utils_escaped_tokens_escape_gstr (self->iifname,
-		                                     NM_ASCII_SPACES,
-		                                     str);
+		nm_str_buf_append (nm_str_buf_append_required_delimiter (&str, ' '),
+		                   "iif ");
+		nm_utils_escaped_tokens_escape_strbuf (self->iifname,
+		                                       NM_ASCII_SPACES,
+		                                       &str);
 	}
 
 	if (self->oifname) {
-		g_string_append (nm_gstring_add_space_delimiter (str),
-		                 "oif ");
-		nm_utils_escaped_tokens_escape_gstr (self->oifname,
-		                                     NM_ASCII_SPACES,
-		                                     str);
+		nm_str_buf_append (nm_str_buf_append_required_delimiter (&str, ' '),
+		                   "oif ");
+		nm_utils_escaped_tokens_escape_strbuf (self->oifname,
+		                                       NM_ASCII_SPACES,
+		                                       &str);
 	}
 
 	if (self->table != 0) {
-		g_string_append_printf (nm_gstring_add_space_delimiter (str),
-		                        "table %u",
-		                        (guint) self->table);
+		nm_str_buf_append_printf (nm_str_buf_append_required_delimiter (&str, ' '),
+		                          "table %u",
+		                          (guint) self->table);
 	}
 
 	if (self->suppress_prefixlength != -1) {
-		g_string_append_printf (nm_gstring_add_space_delimiter (str),
-		                        "suppress_prefixlength %d",
-		                        (int) self->suppress_prefixlength);
+		nm_str_buf_append_printf (nm_str_buf_append_required_delimiter (&str, ' '),
+		                          "suppress_prefixlength %d",
+		                          (int) self->suppress_prefixlength);
 	}
 
-	return g_string_free (g_steal_pointer (&str), FALSE);
+	return nm_str_buf_finalize (&str, NULL);
 }
 
 /*****************************************************************************/
@@ -5967,7 +5977,7 @@ nm_setting_ip_config_class_init (NMSettingIPConfigClass *klass)
 	 *
 	 * Flags for the DHCP hostname and FQDN.
 	 *
-	 * Currently this property only includes flags to control the FQDN flags
+	 * Currently, this property only includes flags to control the FQDN flags
 	 * set in the DHCP FQDN option. Supported FQDN flags are
 	 * %NM_DHCP_HOSTNAME_FLAG_FQDN_SERV_UPDATE,
 	 * %NM_DHCP_HOSTNAME_FLAG_FQDN_ENCODED and
diff --git a/libnm-core/nm-setting-ip-tunnel.c b/libnm-core/nm-setting-ip-tunnel.c
index 5db2dde59b..543fd4366c 100644
--- a/libnm-core/nm-setting-ip-tunnel.c
+++ b/libnm-core/nm-setting-ip-tunnel.c
@@ -816,7 +816,7 @@ nm_setting_ip_tunnel_class_init (NMSettingIPTunnelClass *klass)
 	/**
 	 * NMSettingIPTunnel:flags:
 	 *
-	 * Tunnel flags. Currently the following values are supported:
+	 * Tunnel flags. Currently, the following values are supported:
 	 * %NM_IP_TUNNEL_FLAG_IP6_IGN_ENCAP_LIMIT, %NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_TCLASS,
 	 * %NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_FLOWLABEL, %NM_IP_TUNNEL_FLAG_IP6_MIP6_DEV,
 	 * %NM_IP_TUNNEL_FLAG_IP6_RCV_DSCP_COPY, %NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_FWMARK.
diff --git a/libnm-core/nm-setting-ip4-config.c b/libnm-core/nm-setting-ip4-config.c
index 31c822202b..b8e0f8e3cb 100644
--- a/libnm-core/nm-setting-ip4-config.c
+++ b/libnm-core/nm-setting-ip4-config.c
@@ -197,7 +197,7 @@ verify (NMSetting *setting, NMConnection *connection, GError **error)
 	if (   NM_FLAGS_ANY (nm_setting_ip_config_get_dhcp_hostname_flags (s_ip),
 	                     NM_DHCP_HOSTNAME_FLAGS_FQDN_MASK)
 	    && !priv->dhcp_fqdn) {
-		/* Currently we send a FQDN option only when ipv4.dhcp-fqdn is set */
+		/* Currently, we send a FQDN option only when ipv4.dhcp-fqdn is set */
 		g_set_error_literal (error,
 		                     NM_CONNECTION_ERROR,
 		                     NM_CONNECTION_ERROR_INVALID_PROPERTY,
diff --git a/libnm-core/nm-setting-sriov.c b/libnm-core/nm-setting-sriov.c
index 3c52dc6cc8..70d4bac81a 100644
--- a/libnm-core/nm-setting-sriov.c
+++ b/libnm-core/nm-setting-sriov.c
@@ -1305,7 +1305,7 @@ nm_setting_sriov_class_init (NMSettingSriovClass *klass)
 	 *   "2 mac=00:11:22:33:44:55 spoof-check=true".
 	 *
 	 * Multiple VFs can be specified using a comma as separator.
-	 * Currently the following attributes are supported: mac,
+	 * Currently, the following attributes are supported: mac,
 	 * spoof-check, trust, min-tx-rate, max-tx-rate, vlans.
 	 *
 	 * The "vlans" attribute is represented as a semicolon-separated
diff --git a/libnm-core/nm-setting-tc-config.c b/libnm-core/nm-setting-tc-config.c
index 8658231562..2ece266976 100644
--- a/libnm-core/nm-setting-tc-config.c
+++ b/libnm-core/nm-setting-tc-config.c
@@ -174,13 +174,14 @@ nm_tc_qdisc_equal (NMTCQdisc *qdisc, NMTCQdisc *other)
 static guint
 _nm_tc_qdisc_hash (NMTCQdisc *qdisc)
 {
-	gs_free const char **names = NULL;
-	GVariant *variant;
+	NMUtilsNamedValue attrs_static[30];
+	gs_free NMUtilsNamedValue *attrs_free = NULL;
+	const NMUtilsNamedValue *attrs;
 	NMHashState h;
 	guint length;
 	guint i;
 
-	names = nm_utils_strdict_get_keys (qdisc->attributes, TRUE, &length);
+	attrs = nm_utils_named_values_from_strdict (qdisc->attributes, &length, attrs_static, &attrs_free);
 
 	nm_hash_init (&h, 43869703);
 	nm_hash_update_vals (&h,
@@ -189,13 +190,13 @@ _nm_tc_qdisc_hash (NMTCQdisc *qdisc)
 	                     length);
 	nm_hash_update_str0 (&h, qdisc->kind);
 	for (i = 0; i < length; i++) {
+		const char *key = attrs[i].name;
+		GVariant *variant = attrs[i].value_ptr;
 		const GVariantType *vtype;
 
-		variant = g_hash_table_lookup (qdisc->attributes, names[i]);
-
 		vtype = g_variant_get_type (variant);
 
-		nm_hash_update_str (&h, names[i]);
+		nm_hash_update_str (&h, key);
 		nm_hash_update_str (&h, (const char *) vtype);
 		if (g_variant_type_is_basic (vtype))
 			nm_hash_update_val (&h, g_variant_hash (variant));
@@ -585,6 +586,8 @@ nm_tc_action_get_kind (NMTCAction *action)
  * Gets an array of attribute names defined on @action.
  *
  * Returns: (transfer full): a %NULL-terminated array of attribute names,
+ *
+ * Since: 1.12
  **/
 char **
 nm_tc_action_get_attribute_names (NMTCAction *action)
@@ -614,6 +617,8 @@ _nm_tc_action_get_attributes (NMTCAction *action)
  *
  * Returns: (transfer none): the value of the attribute with name @name on
  *   @action, or %NULL if @action has no such attribute.
+ *
+ * Since: 1.12
  **/
 GVariant *
 nm_tc_action_get_attribute (NMTCAction *action, const char *name)
@@ -634,6 +639,8 @@ nm_tc_action_get_attribute (NMTCAction *action, const char *name)
  * @value: (transfer none) (allow-none): the value
  *
  * Sets or clears the named attribute on @action to the given value.
+ *
+ * Since: 1.12
  **/
 void
 nm_tc_action_set_attribute (NMTCAction *action, const char *name, GVariant *value)
@@ -792,24 +799,31 @@ nm_tc_tfilter_equal (NMTCTfilter *tfilter, NMTCTfilter *other)
 static guint
 _nm_tc_tfilter_hash (NMTCTfilter *tfilter)
 {
-	gs_free const char **names = NULL;
-	guint i, attr_hash;
-	GVariant *variant;
 	NMHashState h;
-	guint length;
 
 	nm_hash_init (&h, 63624437);
 	nm_hash_update_vals (&h,
 	                     tfilter->handle,
 	                     tfilter->parent);
 	nm_hash_update_str0 (&h, tfilter->kind);
+
 	if (tfilter->action) {
+		gs_free NMUtilsNamedValue *attrs_free = NULL;
+		NMUtilsNamedValue attrs_static[30];
+		const NMUtilsNamedValue *attrs;
+		guint length;
+		guint i;
+
 		nm_hash_update_str0 (&h, tfilter->action->kind);
-		names = nm_utils_strdict_get_keys (tfilter->action->attributes, TRUE, &length);
+
+		attrs = nm_utils_named_values_from_strdict (tfilter->action->attributes, &length, attrs_static, &attrs_free);
 		for (i = 0; i < length; i++) {
-			nm_hash_update_str (&h, names[i]);
-			variant = g_hash_table_lookup (tfilter->action->attributes, names[i]);
+			GVariant *variant = attrs[i].value_ptr;
+
+			nm_hash_update_str (&h, attrs[i].name);
 			if (g_variant_type_is_basic (g_variant_get_type (variant))) {
+				guint attr_hash;
+
 				/* g_variant_hash() works only for basic types, thus
 				 * we ignore any non-basic attribute. Actions differing
 				 * only for non-basic attributes will collide. */
@@ -818,6 +832,7 @@ _nm_tc_tfilter_hash (NMTCTfilter *tfilter)
 			}
 		}
 	}
+
 	return nm_hash_complete (&h);
 }
 
@@ -1374,9 +1389,11 @@ _qdiscs_to_variant (GPtrArray *qdiscs)
 
 	if (qdiscs) {
 		for (i = 0; i < qdiscs->len; i++) {
+			NMUtilsNamedValue attrs_static[30];
+			gs_free NMUtilsNamedValue *attrs_free = NULL;
+			const NMUtilsNamedValue *attrs;
 			NMTCQdisc *qdisc = qdiscs->pdata[i];
 			guint length;
-			gs_free const char **attrs = nm_utils_strdict_get_keys (qdisc->attributes, TRUE, &length);
 			GVariantBuilder qdisc_builder;
 			guint y;
 
@@ -1391,9 +1408,12 @@ _qdiscs_to_variant (GPtrArray *qdiscs)
 			g_variant_builder_add (&qdisc_builder, "{sv}", "parent",
 			                       g_variant_new_uint32 (nm_tc_qdisc_get_parent (qdisc)));
 
+			attrs = nm_utils_named_values_from_strdict (qdisc->attributes, &length, attrs_static, &attrs_free);
 			for (y = 0; y < length; y++) {
-				g_variant_builder_add (&qdisc_builder, "{sv}", attrs[y],
-				                       g_hash_table_lookup (qdisc->attributes, attrs[y]));
+				g_variant_builder_add (&qdisc_builder,
+				                       "{sv}",
+				                       attrs[y].name,
+				                       attrs[y].value_ptr);
 			}
 
 			g_variant_builder_add (&builder, "a{sv}", &qdisc_builder);
diff --git a/libnm-core/nm-setting-vlan.c b/libnm-core/nm-setting-vlan.c
index b4bbdd644e..5270a36ab1 100644
--- a/libnm-core/nm-setting-vlan.c
+++ b/libnm-core/nm-setting-vlan.c
@@ -272,7 +272,7 @@ nm_setting_vlan_get_num_priorities (NMSettingVlan *setting, NMVlanPriorityMap ma
  * Retrieve one of the entries of the #NMSettingVlan:ingress_priority_map
  * or #NMSettingVlan:egress_priority_map properties of this setting.
  *
- * Returns: returns %TRUE if @idx is in range. Otherwise %FALSE.
+ * Returns: returns %TRUE if @idx is in range. Otherwise, %FALSE.
  **/
 gboolean
 nm_setting_vlan_get_priority (NMSettingVlan *setting,
diff --git a/libnm-core/nm-setting-wifi-p2p.c b/libnm-core/nm-setting-wifi-p2p.c
index 065f6e327f..97f0a87d93 100644
--- a/libnm-core/nm-setting-wifi-p2p.c
+++ b/libnm-core/nm-setting-wifi-p2p.c
@@ -240,7 +240,7 @@ nm_setting_wifi_p2p_class_init (NMSettingWifiP2PClass *setting_wifi_p2p_class)
 	/**
 	 * NMSettingWifiP2P:peer:
 	 *
-	 * The P2P device that should be connected to. Currently this is the only
+	 * The P2P device that should be connected to. Currently, this is the only
 	 * way to create or join a group.
 	 *
 	 * Since: 1.16
diff --git a/libnm-core/nm-setting-wireguard.c b/libnm-core/nm-setting-wireguard.c
index 2bd633cecb..00e37a1f21 100644
--- a/libnm-core/nm-setting-wireguard.c
+++ b/libnm-core/nm-setting-wireguard.c
@@ -30,7 +30,7 @@ G_DEFINE_BOXED_TYPE (NMWireGuardPeer, nm_wireguard_peer, _wireguard_peer_dup, nm
 
 /* NMWireGuardPeer can also track invalid allowed-ip settings, and only reject
  * them later during is_valid(). Such values are marked by a leading 'X' character
- * in the @allowed_ips. It is expected, that such values are the expception, and
+ * in the @allowed_ips. It is expected, that such values are the exception, and
  * commonly not present. */
 #define ALLOWED_IP_INVALID_X     'X'
 #define ALLOWED_IP_INVALID_X_STR "X"
@@ -157,7 +157,7 @@ nm_wireguard_peer_ref (NMWireGuardPeer *self)
  * @self: (allow-none): the #NMWireGuardPeer instance
  *
  * Drop a reference to @self. If the last reference is dropped,
- * the instance is freed and all accociate data released.
+ * the instance is freed and all associate data released.
  *
  * This is not thread-safe.
  *
@@ -737,9 +737,9 @@ nm_wireguard_peer_remove_allowed_ip (NMWireGuardPeer *self,
  * nm_wireguard_peer_is_valid:
  * @self: the #NMWireGuardPeer instance
  * @check_secrets: if %TRUE, non-secret properties are validated.
- *   Otherwise they are ignored for this purpose.
+ *   Otherwise, they are ignored for this purpose.
  * @check_non_secrets: if %TRUE, secret properties are validated.
- *   Otherwise they are ignored for this purpose.
+ *   Otherwise, they are ignored for this purpose.
  * @error: the #GError location for returning the failure reason.
  *
  * Returns:  %TRUE if the peer is valid or fails with an error
@@ -2458,7 +2458,7 @@ nm_setting_wireguard_class_init (NMSettingWireGuardClass *klass)
 	 * NMSettingWireGuard:fwmark:
 	 *
 	 * The use of fwmark is optional and is by default off. Setting it to 0
-	 * disables it. Otherwise it is a 32-bit fwmark for outgoing packets.
+	 * disables it. Otherwise, it is a 32-bit fwmark for outgoing packets.
 	 *
 	 * Note that "ip4-auto-default-route" or "ip6-auto-default-route" enabled,
 	 * implies to automatically choose a fwmark.
diff --git a/libnm-core/nm-setting-wireless-security.c b/libnm-core/nm-setting-wireless-security.c
index 036434cc3c..267920ac0e 100644
--- a/libnm-core/nm-setting-wireless-security.c
+++ b/libnm-core/nm-setting-wireless-security.c
@@ -665,7 +665,7 @@ nm_setting_wireless_security_get_wep_key (NMSettingWirelessSecurity *setting, gu
  * @setting: the #NMSettingWirelessSecurity
  * @idx: the index of the key (0..3 inclusive)
  * @key: the WEP key as a string, in either hexadecimal, ASCII, or passphrase
- * form as determiend by the value of the #NMSettingWirelessSecurity:wep-key-type
+ * form as determined by the value of the #NMSettingWirelessSecurity:wep-key-type
  * property.
  *
  * Sets a WEP key in the given index.
diff --git a/libnm-core/nm-setting-wireless-security.h b/libnm-core/nm-setting-wireless-security.h
index c9e921af06..1ca0c280fb 100644
--- a/libnm-core/nm-setting-wireless-security.h
+++ b/libnm-core/nm-setting-wireless-security.h
@@ -78,7 +78,7 @@ typedef enum {
  * @NM_SETTING_WIRELESS_SECURITY_WPS_METHOD_DEFAULT: Attempt whichever method AP supports
  * @NM_SETTING_WIRELESS_SECURITY_WPS_METHOD_DISABLED: WPS can not be used.
  * @NM_SETTING_WIRELESS_SECURITY_WPS_METHOD_AUTO: Use WPS, any method
- * @NM_SETTING_WIRELESS_SECURITY_WPS_METHOD_PBC: use WPS push-buthon method
+ * @NM_SETTING_WIRELESS_SECURITY_WPS_METHOD_PBC: use WPS push-button method
  * @NM_SETTING_WIRELESS_SECURITY_WPS_METHOD_PIN: use PIN method
  *
  * Configure the use of WPS by a connection while it activates.
diff --git a/libnm-core/nm-setting-wireless.c b/libnm-core/nm-setting-wireless.c
index 124f9c45cf..39bcda6813 100644
--- a/libnm-core/nm-setting-wireless.c
+++ b/libnm-core/nm-setting-wireless.c
@@ -43,6 +43,7 @@ NM_GOBJECT_PROPERTIES_DEFINE (NMSettingWireless,
 	PROP_POWERSAVE,
 	PROP_MAC_ADDRESS_RANDOMIZATION,
 	PROP_WAKE_ON_WLAN,
+	PROP_AP_ISOLATION,
 );
 
 typedef struct {
@@ -55,13 +56,14 @@ typedef struct {
 	char *device_mac_address;
 	char *cloned_mac_address;
 	char *generate_mac_address_mask;
+	NMSettingMacRandomization mac_address_randomization;
+	NMTernary ap_isolation;
 	guint32 channel;
 	guint32 rate;
 	guint32 tx_power;
 	guint32 mtu;
 	guint32 powersave;
 	guint32 wowl;
-	NMSettingMacRandomization mac_address_randomization;
 	bool hidden:1;
 } NMSettingWirelessPrivate;
 
@@ -739,6 +741,22 @@ _to_dbus_fcn_seen_bssids (const NMSettInfoSetting *sett_info,
 	return g_variant_new_strv ((const char *const*) priv->seen_bssids->pdata, priv->seen_bssids->len);
 }
 
+/**
+ * nm_setting_wireless_get_ap_isolation:
+ * @setting: the #NMSettingWireless
+ *
+ * Returns: the #NMSettingWireless:ap-isolation property of the setting
+ *
+ * Since: 1.28
+ */
+NMTernary
+nm_setting_wireless_get_ap_isolation (NMSettingWireless *setting)
+{
+	g_return_val_if_fail (NM_IS_SETTING_WIRELESS (setting), NM_TERNARY_DEFAULT);
+
+	return NM_SETTING_WIRELESS_GET_PRIVATE (setting)->ap_isolation;
+}
+
 /*****************************************************************************/
 
 static gboolean
@@ -934,6 +952,17 @@ verify (NMSetting *setting, NMConnection *connection, GError **error)
 		return FALSE;
 	}
 
+	if (   priv->ap_isolation != NM_TERNARY_DEFAULT
+	    && !nm_streq0 (priv->mode, NM_SETTING_WIRELESS_MODE_AP)) {
+		g_set_error_literal (error,
+		                     NM_CONNECTION_ERROR,
+		                     NM_CONNECTION_ERROR_INVALID_PROPERTY,
+		                     _("AP isolation can be set only in AP mode"));
+		g_prefix_error (error, "%s.%s: ", NM_SETTING_WIRELESS_SETTING_NAME,
+		                NM_SETTING_WIRELESS_AP_ISOLATION);
+		return FALSE;
+	}
+
 	/* from here on, check for NM_SETTING_VERIFY_NORMALIZABLE conditions. */
 
 	if (priv->cloned_mac_address) {
@@ -1094,6 +1123,9 @@ get_property (GObject *object, guint prop_id,
 	case PROP_WAKE_ON_WLAN:
 		g_value_set_uint (value, nm_setting_wireless_get_wake_on_wlan (setting));
 		break;
+	case PROP_AP_ISOLATION:
+		g_value_set_enum (value, priv->ap_isolation);
+		break;
 	default:
 		G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
 		break;
@@ -1203,6 +1235,9 @@ set_property (GObject *object, guint prop_id,
 	case PROP_WAKE_ON_WLAN:
 		priv->wowl = g_value_get_uint (value);
 		break;
+	case PROP_AP_ISOLATION:
+		priv->ap_isolation = g_value_get_enum (value);
+		break;
 	default:
 		G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
 		break;
@@ -1221,6 +1256,7 @@ nm_setting_wireless_init (NMSettingWireless *setting)
 	g_array_set_clear_func (priv->mac_address_blacklist, (GDestroyNotify) clear_blacklist_item);
 
 	priv->wowl = NM_SETTING_WIRELESS_WAKE_ON_WLAN_DEFAULT;
+	priv->ap_isolation = NM_TERNARY_DEFAULT;
 }
 
 /**
@@ -1769,6 +1805,44 @@ nm_setting_wireless_class_init (NMSettingWirelessClass *klass)
 	                       G_PARAM_READWRITE |
 	                       G_PARAM_STATIC_STRINGS);
 
+	/**
+	 * NMSettingWireless:ap-isolation
+	 *
+	 * Configures AP isolation, which prevents communication between
+	 * wireless devices connected to this AP. This property can be set
+	 * to a value different from %NM_TERNARY_DEFAULT only when the
+	 * interface is configured in AP mode.
+	 *
+	 * If set to %NM_TERNARY_TRUE, devices are not able to communicate
+	 * with each other. This increases security because it protects
+	 * devices against attacks from other clients in the network. At
+	 * the same time, it prevents devices to access resources on the
+	 * same wireless networks as file shares, printers, etc.
+	 *
+	 * If set to %NM_TERNARY_FALSE, devices can talk to each other.
+	 *
+	 * When set to %NM_TERNARY_DEFAULT, the global default is used; in
+	 * case the global default is unspecified it is assumed to be
+	 * %NM_TERNARY_FALSE.
+	 *
+	 * Since: 1.28
+	 **/
+	/* ---ifcfg-rh---
+	 * property: ap-isolation
+	 * variable: AP_ISOLATION(+)
+	 * values: "yes", "no"
+	 * default: missing variable means global default
+	 * description: Whether AP isolation is enabled
+	 * ---end---
+	 */
+	obj_properties[PROP_AP_ISOLATION] =
+	    g_param_spec_enum (NM_SETTING_WIRELESS_AP_ISOLATION, "", "",
+	                       NM_TYPE_TERNARY,
+	                       NM_TERNARY_DEFAULT,
+	                       NM_SETTING_PARAM_FUZZY_IGNORE |
+	                       G_PARAM_READWRITE |
+	                       G_PARAM_STATIC_STRINGS);
+
 	g_object_class_install_properties (object_class, _PROPERTY_ENUMS_LAST, obj_properties);
 
 	_nm_setting_class_commit_full (setting_class, NM_META_SETTING_TYPE_WIRELESS,
diff --git a/libnm-core/nm-setting-wireless.h b/libnm-core/nm-setting-wireless.h
index 093e2ef085..0ae64486f4 100644
--- a/libnm-core/nm-setting-wireless.h
+++ b/libnm-core/nm-setting-wireless.h
@@ -84,6 +84,7 @@ typedef enum { /*< flags >*/
 #define NM_SETTING_WIRELESS_POWERSAVE   "powersave"
 #define NM_SETTING_WIRELESS_MAC_ADDRESS_RANDOMIZATION   "mac-address-randomization"
 #define NM_SETTING_WIRELESS_WAKE_ON_WLAN "wake-on-wlan"
+#define NM_SETTING_WIRELESS_AP_ISOLATION "ap-isolation"
 
 /**
  * NM_SETTING_WIRELESS_MODE_ADHOC:
@@ -205,6 +206,9 @@ gboolean          nm_setting_wireless_ap_security_compatible (NMSettingWireless
 NM_AVAILABLE_IN_1_12
 NMSettingWirelessWakeOnWLan  nm_setting_wireless_get_wake_on_wlan (NMSettingWireless *setting);
 
+NM_AVAILABLE_IN_1_28
+NMTernary nm_setting_wireless_get_ap_isolation (NMSettingWireless *setting);
+
 G_END_DECLS
 
 #endif /* __NM_SETTING_WIRELESS_H__ */
diff --git a/libnm-core/nm-setting.c b/libnm-core/nm-setting.c
index dfb2bed958..06c3d988ee 100644
--- a/libnm-core/nm-setting.c
+++ b/libnm-core/nm-setting.c
@@ -2661,7 +2661,7 @@ nm_setting_option_get_uint32 (NMSetting *setting,
  *
  * Note that not all setting types support options. It is a bug
  * setting a variant to a setting that doesn't support it.
- * Currently only #NMSettingEthtool supports it.
+ * Currently, only #NMSettingEthtool supports it.
  *
  * Since: 1.26
  */
diff --git a/libnm-core/nm-team-utils.c b/libnm-core/nm-team-utils.c
index 084547c8f8..ca18c7d6a0 100644
--- a/libnm-core/nm-team-utils.c
+++ b/libnm-core/nm-team-utils.c
@@ -11,7 +11,6 @@
 
 #include "nm-errors.h"
 #include "nm-utils-private.h"
-#include "nm-json.h"
 #include "nm-glib-aux/nm-json-aux.h"
 #include "nm-core-internal.h"
 #include "nm-setting-team.h"
@@ -460,9 +459,9 @@ _team_attr_data_to_json (const TeamAttrData *attr_data,
 	_team_attr_data_ASSERT (attr_data);
 	nm_assert (p_field);
 
-	nm_json_aux_gstr_append_obj_name (gstr,
-	                                  attr_data->js_keys[attr_data->js_keys_len - 1],
-	                                  '\0');
+	nm_json_gstr_append_obj_name (gstr,
+	                              attr_data->js_keys[attr_data->js_keys_len - 1],
+	                              '\0');
 
 	if (attr_data->value_type != NM_VALUE_TYPE_UNSPEC) {
 		nm_value_type_to_json (attr_data->value_type, gstr, p_field);
@@ -482,7 +481,7 @@ _team_attr_data_to_json (const TeamAttrData *attr_data,
 			g_string_append (gstr, "[ ");
 			for (i = 0; i < v_ptrarray->len; i++) {
 				if (i > 0)
-					nm_json_aux_gstr_append_delimiter (gstr);
+					nm_json_gstr_append_delimiter (gstr);
 				_link_watcher_to_json (v_ptrarray->pdata[i], gstr);
 			}
 			g_string_append (gstr, " ]");
@@ -500,8 +499,8 @@ _team_attr_data_to_json (const TeamAttrData *attr_data,
 			g_string_append (gstr, "[ ");
 			for (i = 0; i < v_ptrarray->len; i++) {
 				if (i > 0)
-					nm_json_aux_gstr_append_delimiter (gstr);
-				nm_json_aux_gstr_append_string (gstr, v_ptrarray->pdata[i]);
+					nm_json_gstr_append_delimiter (gstr);
+				nm_json_gstr_append_string (gstr, v_ptrarray->pdata[i]);
 			}
 			g_string_append (gstr, i > 0 ? " ]" : "]");
 		}
@@ -671,7 +670,7 @@ _team_setting_field_to_json (const NMTeamSetting *self,
 		return FALSE;
 
 	if (prepend_delimiter)
-		nm_json_aux_gstr_append_delimiter (gstr);
+		nm_json_gstr_append_delimiter (gstr);
 	_team_attr_data_to_json (attr_data,
 	                         self->d.is_port,
 	                         gstr,
@@ -1108,29 +1107,29 @@ _link_watcher_to_json (const NMTeamLinkWatcher *link_watcher,
 		if (is_first)
 			is_first = FALSE;
 		else
-			nm_json_aux_gstr_append_delimiter (gstr);
-		nm_json_aux_gstr_append_obj_name (gstr, attr_data->js_key, '\0');
+			nm_json_gstr_append_delimiter (gstr);
+		nm_json_gstr_append_obj_name (gstr, attr_data->js_key, '\0');
 		nm_value_type_to_json (attr_data->value_type, gstr, &p_val->val);
 	}
 
 	g_string_append (gstr, " }");
 }
 
-#if WITH_JSON_VALIDATION
 static NMTeamLinkWatcher *
-_link_watcher_from_json (const json_t *root_js_obj,
+_link_watcher_from_json (const NMJsonVt *vt,
+                         const nm_json_t *root_js_obj,
                          gboolean *out_unrecognized_content)
 {
 	NMValueTypUnioMaybe args[G_N_ELEMENTS (link_watcher_attr_datas)] = { };
 	const char *j_key;
-	json_t *j_val;
+	nm_json_t *j_val;
 	const char *v_name;
 	NMTeamLinkWatcher *result = NULL;
 
-	if (!json_is_object (root_js_obj))
+	if (!nm_json_is_object (root_js_obj))
 		goto fail;
 
-	json_object_foreach ((json_t *) root_js_obj, j_key, j_val) {
+	nm_json_object_foreach (vt, (nm_json_t *) root_js_obj, j_key, j_val) {
 		const LinkWatcherAttrData *attr_data = NULL;
 		NMValueTypUnioMaybe *parse_result;
 
@@ -1154,7 +1153,7 @@ _link_watcher_from_json (const json_t *root_js_obj,
 		if (parse_result->has)
 			*out_unrecognized_content = TRUE;
 
-		if (!nm_value_type_from_json (attr_data->value_type, j_val, &parse_result->val))
+		if (!nm_value_type_from_json (vt, attr_data->value_type, j_val, &parse_result->val))
 			*out_unrecognized_content = TRUE;
 		else
 			parse_result->has = TRUE;
@@ -1218,7 +1217,6 @@ fail:
 	*out_unrecognized_content = TRUE;
 	return NULL;
 }
-#endif
 
 /*****************************************************************************/
 
@@ -1575,15 +1573,15 @@ nm_team_setting_config_get (const NMTeamSetting *self)
 
 				nm_assert (list_is_empty);
 
-				nm_json_aux_gstr_append_obj_name (gstr, "runner", '{');
+				nm_json_gstr_append_obj_name (gstr, "runner", '{');
 
 				if (_team_setting_fields_to_json_maybe (self, gstr, !list_is_empty2, attr_lst_runner_pt1, G_N_ELEMENTS (attr_lst_runner_pt1)))
 					list_is_empty2 = FALSE;
 
 				if (_team_setting_has_fields_any_v (self, attr_lst_runner_pt2, G_N_ELEMENTS (attr_lst_runner_pt2))) {
 					if (!list_is_empty2)
-						nm_json_aux_gstr_append_delimiter (gstr);
-					nm_json_aux_gstr_append_obj_name (gstr, "tx_balancer", '{');
+						nm_json_gstr_append_delimiter (gstr);
+					nm_json_gstr_append_obj_name (gstr, "tx_balancer", '{');
 					if (!_team_setting_fields_to_json_maybe (self, gstr, FALSE, attr_lst_runner_pt2, G_N_ELEMENTS (attr_lst_runner_pt2)))
 						nm_assert_not_reached ();
 					g_string_append (gstr, " }");
@@ -1600,8 +1598,8 @@ nm_team_setting_config_get (const NMTeamSetting *self)
 
 			if (_team_setting_has_fields_any_v (self, attr_lst_notify_peers, G_N_ELEMENTS (attr_lst_notify_peers))) {
 				if (!list_is_empty)
-					nm_json_aux_gstr_append_delimiter (gstr);
-				nm_json_aux_gstr_append_obj_name (gstr, "notify_peers", '{');
+					nm_json_gstr_append_delimiter (gstr);
+				nm_json_gstr_append_obj_name (gstr, "notify_peers", '{');
 				if (!_team_setting_fields_to_json_maybe (self, gstr, FALSE, attr_lst_notify_peers, G_N_ELEMENTS (attr_lst_notify_peers)))
 					nm_assert_not_reached ();
 				g_string_append (gstr, " }");
@@ -1610,8 +1608,8 @@ nm_team_setting_config_get (const NMTeamSetting *self)
 
 			if (_team_setting_has_fields_any_v (self, attr_lst_mcast_rejoin, G_N_ELEMENTS (attr_lst_mcast_rejoin))) {
 				if (!list_is_empty)
-					nm_json_aux_gstr_append_delimiter (gstr);
-				nm_json_aux_gstr_append_obj_name (gstr, "mcast_rejoin", '{');
+					nm_json_gstr_append_delimiter (gstr);
+				nm_json_gstr_append_obj_name (gstr, "mcast_rejoin", '{');
 				if (!_team_setting_fields_to_json_maybe (self, gstr, FALSE, attr_lst_mcast_rejoin, G_N_ELEMENTS (attr_lst_mcast_rejoin)))
 					nm_assert_not_reached ();
 				g_string_append (gstr, " }");
@@ -1641,7 +1639,6 @@ nm_team_setting_config_get (const NMTeamSetting *self)
 
 /*****************************************************************************/
 
-#if WITH_JSON_VALIDATION
 static gboolean
 _attr_data_match_keys (const TeamAttrData *attr_data,
                        const char *const*keys,
@@ -1686,18 +1683,21 @@ _attr_data_find_by_json_key (gboolean is_port,
 }
 
 static void
-_js_parse_locate_keys (NMTeamSetting *self,
-                       json_t *root_js_obj,
-                       json_t *found_keys[static _NM_TEAM_ATTRIBUTE_NUM],
+_js_parse_locate_keys (const NMJsonVt *vt,
+                       NMTeamSetting *self,
+                       nm_json_t *root_js_obj,
+                       nm_json_t *found_keys[static _NM_TEAM_ATTRIBUTE_NUM],
                        gboolean *out_unrecognized_content)
 {
 	const char *keys[3];
 	const char *cur_key1;
 	const char *cur_key2;
 	const char *cur_key3;
-	json_t *cur_val1;
-	json_t *cur_val2;
-	json_t *cur_val3;
+	nm_json_t *cur_val1;
+	nm_json_t *cur_val2;
+	nm_json_t *cur_val3;
+
+	nm_assert (vt);
 
 #define _handle(_self, _cur_key, _cur_val, _keys, _level, _found_keys, _out_unrecognized_content) \
 	({ \
@@ -1713,18 +1713,18 @@ _js_parse_locate_keys (NMTeamSetting *self,
 			(_found_keys)[_attr_data->team_attr] = (_cur_val); \
 			_handled = TRUE; \
 		} else if (   !_attr_data \
-		           || !json_is_object ((_cur_val))) { \
+		           || !nm_json_is_object ((_cur_val))) { \
 			*(_out_unrecognized_content) = TRUE; \
 			_handled = TRUE; \
 		} \
 		_handled; \
 	})
 
-	json_object_foreach (root_js_obj, cur_key1, cur_val1) {
+	nm_json_object_foreach (vt, root_js_obj, cur_key1, cur_val1) {
 		if (!_handle (self, cur_key1, cur_val1, keys, 1, found_keys, out_unrecognized_content)) {
-			json_object_foreach (cur_val1, cur_key2, cur_val2) {
+			nm_json_object_foreach (vt, cur_val1, cur_key2, cur_val2) {
 				if (!_handle (self, cur_key2, cur_val2, keys, 2, found_keys, out_unrecognized_content)) {
-					json_object_foreach (cur_val2, cur_key3, cur_val3) {
+					nm_json_object_foreach (vt, cur_val2, cur_key3, cur_val3) {
 						if (!_handle (self, cur_key3, cur_val3, keys, 3, found_keys, out_unrecognized_content))
 							*out_unrecognized_content = TRUE;
 					}
@@ -1737,8 +1737,9 @@ _js_parse_locate_keys (NMTeamSetting *self,
 }
 
 static void
-_js_parse_unpack (gboolean is_port,
-                  json_t *found_keys[static _NM_TEAM_ATTRIBUTE_NUM],
+_js_parse_unpack (const NMJsonVt *vt,
+                  gboolean is_port,
+                  nm_json_t *found_keys[static _NM_TEAM_ATTRIBUTE_NUM],
                   bool out_has_lst[static _NM_TEAM_ATTRIBUTE_NUM],
                   NMValueTypUnion out_val_lst[static _NM_TEAM_ATTRIBUTE_NUM],
                   gboolean *out_unrecognized_content,
@@ -1747,10 +1748,12 @@ _js_parse_unpack (gboolean is_port,
 {
 	const TeamAttrData *attr_data;
 
+	nm_assert (vt);
+
 	for (attr_data = &team_attr_datas[TEAM_ATTR_IDX_CONFIG + 1]; attr_data < &team_attr_datas[G_N_ELEMENTS (team_attr_datas)]; attr_data++) {
 		NMValueTypUnion *p_out_val;
 		gboolean valid = FALSE;
-		json_t *arg_js_obj;
+		nm_json_t *arg_js_obj;
 
 		if (!_team_attr_data_is_relevant (attr_data, is_port))
 			continue;
@@ -1764,25 +1767,27 @@ _js_parse_unpack (gboolean is_port,
 		p_out_val = &out_val_lst[attr_data->team_attr];
 
 		if (attr_data->value_type != NM_VALUE_TYPE_UNSPEC)
-			valid = nm_value_type_from_json (attr_data->value_type, arg_js_obj, p_out_val);
+			valid = nm_value_type_from_json (vt, attr_data->value_type, arg_js_obj, p_out_val);
 		else if (attr_data->team_attr == NM_TEAM_ATTRIBUTE_LINK_WATCHERS) {
 			GPtrArray *link_watchers = NULL;
 			NMTeamLinkWatcher *link_watcher;
 
 			nm_assert (out_ptr_array_link_watchers_free && !*out_ptr_array_link_watchers_free);
-			if (json_is_array (arg_js_obj)) {
+			if (nm_json_is_array (arg_js_obj)) {
 				gsize i, len;
 
-				len = json_array_size (arg_js_obj);
+				len = vt->nm_json_array_size (arg_js_obj);
 				link_watchers = g_ptr_array_new_full (len, (GDestroyNotify) nm_team_link_watcher_unref);
 				for (i = 0; i < len; i++) {
-					link_watcher = _link_watcher_from_json (json_array_get (arg_js_obj, i),
+					link_watcher = _link_watcher_from_json (vt,
+					                                        vt->nm_json_array_get (arg_js_obj, i),
 					                                        out_unrecognized_content);
 					if (link_watcher)
 						g_ptr_array_add (link_watchers, link_watcher);
 				}
 			} else {
-				link_watcher = _link_watcher_from_json (arg_js_obj,
+				link_watcher = _link_watcher_from_json (vt,
+				                                        arg_js_obj,
 				                                        out_unrecognized_content);
 				if (link_watcher) {
 					link_watchers = g_ptr_array_new_full (1, (GDestroyNotify) nm_team_link_watcher_unref);
@@ -1799,16 +1804,17 @@ _js_parse_unpack (gboolean is_port,
 			GPtrArray *strv = NULL;
 
 			nm_assert (out_ptr_array_master_runner_tx_hash_free && !*out_ptr_array_master_runner_tx_hash_free);
-			if (json_is_array (arg_js_obj)) {
+			if (nm_json_is_array (arg_js_obj)) {
 				gsize i, len;
 
-				len = json_array_size (arg_js_obj);
+				len = vt->nm_json_array_size (arg_js_obj);
 				if (len > 0) {
 					strv = g_ptr_array_sized_new (len);
 					for (i = 0; i < len; i++) {
 						const char *v_string;
 
-						if (   nm_jansson_json_as_string (json_array_get (arg_js_obj, i),
+						if (   nm_jansson_json_as_string (vt,
+						                                  vt->nm_json_array_get (arg_js_obj, i),
 						                                  &v_string) <= 0
 						    || !v_string
 						    || v_string[0] == '\0') {
@@ -1832,11 +1838,11 @@ _js_parse_unpack (gboolean is_port,
 			*out_unrecognized_content = TRUE;
 	}
 }
-#endif
 
 guint32
 nm_team_setting_config_set (NMTeamSetting *self, const char *js_str)
 {
+	const NMJsonVt *vt;
 	guint32 changed_flags = 0;
 	gboolean do_set_default = TRUE;
 	gboolean new_js_str_invalid = FALSE;
@@ -1866,30 +1872,29 @@ nm_team_setting_config_set (NMTeamSetting *self, const char *js_str)
 	} else
 		changed_flags |= nm_team_attribute_to_flags (NM_TEAM_ATTRIBUTE_CONFIG);
 
-#if WITH_JSON_VALIDATION
-	{
-		nm_auto_decref_json json_t *root_js_obj = NULL;
-
-		if (nm_jansson_load ())
-			root_js_obj = json_loads (js_str, 0, NULL);
+	if ((vt = nm_json_vt ())) {
+		nm_auto_decref_json nm_json_t *root_js_obj = NULL;
 
+		root_js_obj = vt->nm_json_loads (js_str, 0, NULL);
 		if (   !root_js_obj
-		    || !json_is_object (root_js_obj))
+		    || !nm_json_is_object (root_js_obj))
 			new_js_str_invalid = TRUE;
 		else {
 			gboolean unrecognized_content = FALSE;
 			bool has_lst[_NM_TEAM_ATTRIBUTE_NUM] = { FALSE, };
 			NMValueTypUnion val_lst[_NM_TEAM_ATTRIBUTE_NUM];
-			json_t *found_keys[_NM_TEAM_ATTRIBUTE_NUM] = { NULL, };
+			nm_json_t *found_keys[_NM_TEAM_ATTRIBUTE_NUM] = { NULL, };
 			gs_unref_ptrarray GPtrArray *ptr_array_master_runner_tx_hash_free = NULL;
 			gs_unref_ptrarray GPtrArray *ptr_array_link_watchers_free = NULL;
 
-			_js_parse_locate_keys (self,
+			_js_parse_locate_keys (vt,
+			                       self,
 			                       root_js_obj,
 			                       found_keys,
 			                       &unrecognized_content);
 
-			_js_parse_unpack (self->d.is_port,
+			_js_parse_unpack (vt,
+			                  self->d.is_port,
 			                  found_keys,
 			                  has_lst,
 			                  val_lst,
@@ -1906,8 +1911,6 @@ nm_team_setting_config_set (NMTeamSetting *self, const char *js_str)
 		}
 	}
 
-#endif
-
 	if (do_set_default)
 		changed_flags |= _team_setting_set_default (self);
 
@@ -2222,6 +2225,7 @@ nm_team_setting_reset_from_dbus (NMTeamSetting *self,
 	GVariantIter iter;
 	const char *v_key;
 	GVariant *v_val;
+	const NMJsonVt *vt;
 
 	*out_changed = 0;
 
@@ -2271,10 +2275,12 @@ nm_team_setting_reset_from_dbus (NMTeamSetting *self,
 		variants[attr_data->team_attr] = g_steal_pointer (&v_val_free);
 	}
 
+	vt = nm_json_vt ();
+
 	if (variants[NM_TEAM_ATTRIBUTE_LINK_WATCHERS]) {
 
 		if (   variants[NM_TEAM_ATTRIBUTE_CONFIG]
-		    && WITH_JSON_VALIDATION
+		    && vt
 		    && !NM_FLAGS_HAS (parse_flags, NM_SETTING_PARSE_FLAGS_STRICT)) {
 			/* we don't require the content of the "link-watchers" and we also
 			 * don't perform strict validation. No need to parse it. */
@@ -2282,7 +2288,7 @@ nm_team_setting_reset_from_dbus (NMTeamSetting *self,
 			gs_free_error GError *local = NULL;
 
 			/* We might need the parsed v_link_watchers array below (because there is no JSON
-			 * "config" present or because we don't build WITH_JSON_VALIDATION).
+			 * "config" present or because we don't have json support).
 			 *
 			 * Or we might run with NM_SETTING_PARSE_FLAGS_STRICT. In that mode, we may not necessarily
 			 * require that the entire setting as a whole validates (if a JSON config is present and
@@ -2310,7 +2316,7 @@ nm_team_setting_reset_from_dbus (NMTeamSetting *self,
 	                                            ? g_variant_get_string (variants[NM_TEAM_ATTRIBUTE_CONFIG], NULL)
 	                                            : NULL);
 
-	if (   WITH_JSON_VALIDATION
+	if (   vt
 	    && variants[NM_TEAM_ATTRIBUTE_CONFIG]) {
 		/* for team settings, the JSON must be able to express all possible options. That means,
 		 * if the GVariant contains both the JSON "config" and other options, then the other options
diff --git a/libnm-core/nm-utils-private.h b/libnm-core/nm-utils-private.h
index dd3785be0f..75e8b5bd86 100644
--- a/libnm-core/nm-utils-private.h
+++ b/libnm-core/nm-utils-private.h
@@ -13,16 +13,6 @@
 #include "nm-setting-private.h"
 #include "nm-setting-ip-config.h"
 
-struct _NMVariantAttributeSpec {
-	char *name;
-	const GVariantType *type;
-	bool v4:1;
-	bool v6:1;
-	bool no_value:1;
-	bool consumes_rest:1;
-	char str_type;
-};
-
 #define NM_VARIANT_ATTRIBUTE_SPEC_DEFINE(_name, _type, ...) \
 	(&((const NMVariantAttributeSpec) { \
 		.name          = _name, \
diff --git a/libnm-core/nm-utils.c b/libnm-core/nm-utils.c
index 425c302713..b633a5099c 100644
--- a/libnm-core/nm-utils.c
+++ b/libnm-core/nm-utils.c
@@ -16,10 +16,8 @@
 #include <sys/stat.h>
 #include <linux/pkt_sched.h>
 
-#if WITH_JSON_VALIDATION
-#include "nm-json.h"
-#endif
-
+#include "nm-glib-aux/nm-json-aux.h"
+#include "nm-glib-aux/nm-str-buf.h"
 #include "nm-glib-aux/nm-enum-utils.h"
 #include "nm-glib-aux/nm-time-utils.h"
 #include "nm-glib-aux/nm-secret-utils.h"
@@ -2067,8 +2065,8 @@ nm_utils_ip_addresses_from_variant (GVariant *value,
 
 		g_variant_iter_init (&attrs_iter, addr_var);
 		while (g_variant_iter_next (&attrs_iter, "{&sv}", &attr_name, &attr_val)) {
-			if (   strcmp (attr_name, "address") != 0
-			    && strcmp (attr_name, "prefix") != 0)
+			if (!NM_IN_STRSET (attr_name, "address",
+			                              "prefix"))
 				nm_ip_address_set_attribute (addr, attr_name, attr_val);
 			g_variant_unref (attr_val);
 		}
@@ -2193,10 +2191,10 @@ nm_utils_ip_routes_from_variant (GVariant *value,
 
 		g_variant_iter_init (&attrs_iter, route_var);
 		while (g_variant_iter_next (&attrs_iter, "{&sv}", &attr_name, &attr_val)) {
-			if (   strcmp (attr_name, "dest") != 0
-			    && strcmp (attr_name, "prefix") != 0
-			    && strcmp (attr_name, "next-hop") != 0
-			    && strcmp (attr_name, "metric") != 0)
+			if (!NM_IN_STRSET (attr_name, "dest",
+			                              "prefix",
+			                              "next-hop",
+			                              "metric"))
 				nm_ip_route_set_attribute (route, attr_name, attr_val);
 			g_variant_unref (attr_val);
 		}
@@ -2227,7 +2225,7 @@ _string_append_tc_handle (GString *string, guint32 handle)
  *
  * This is used to either write out the parent handle to the tc qdisc string
  * or to pretty-format (use symbolic name for root) the key in keyfile.
- * The presence of prefix determnines which one is the case.
+ * The presence of prefix determines which one is the case.
  *
  * Private API due to general ugliness and overall uselessness for anything
  * sensible.
@@ -2376,7 +2374,8 @@ _nm_utils_string_append_tc_qdisc_rest (GString *string, NMTCQdisc *qdisc)
 	const char *kind = nm_tc_qdisc_get_kind (qdisc);
 	gs_free char *str = NULL;
 
-	if (handle != TC_H_UNSPEC && strcmp (kind, "ingress") != 0) {
+	if (   handle != TC_H_UNSPEC
+	    && !nm_streq (kind, "ingress")) {
 		g_string_append (string, "handle ");
 		_string_append_tc_handle (string, handle);
 		g_string_append_c (string, ' ');
@@ -2468,7 +2467,7 @@ _tc_read_common_opts (const char *str,
 	variant = g_hash_table_lookup (ht, "kind");
 	if (variant) {
 		*kind = g_variant_dup_string (variant, NULL);
-		if (strcmp (*kind, "ingress") == 0) {
+		if (nm_streq (*kind, "ingress")) {
 			if (*parent == TC_H_UNSPEC)
 				*parent = TC_H_INGRESS;
 			if (*handle == TC_H_UNSPEC)
@@ -2524,7 +2523,7 @@ nm_utils_tc_qdisc_from_str (const char *str, GError **error)
 		return NULL;
 
 	for (i = 0; rest && tc_qdisc_attribute_spec[i]; i++) {
-		if (strcmp (tc_qdisc_attribute_spec[i]->kind, kind) == 0) {
+		if (nm_streq (tc_qdisc_attribute_spec[i]->kind, kind)) {
 			options = nm_utils_parse_variant_attributes (rest,
 			                                             ' ', ' ', FALSE,
 			                                             tc_qdisc_attribute_spec[i]->attrs,
@@ -2589,11 +2588,21 @@ _string_append_tc_action (GString *string, NMTCAction *action, GError **error)
 {
 	const char *kind = nm_tc_action_get_kind (action);
 	gs_free char *str = NULL;
+	const NMVariantAttributeSpec *const *attrs;
+
+	if (nm_streq (kind, "simple"))
+		attrs = tc_action_simple_attribute_spec;
+	else if (nm_streq (kind, "mirred"))
+		attrs = tc_action_mirred_attribute_spec;
+	else
+		attrs = NULL;
+
 
 	g_string_append (string, kind);
 
-	str = nm_utils_format_variant_attributes (_nm_tc_action_get_attributes (action),
-	                                          ' ', ' ');
+	str = _nm_utils_format_variant_attributes (_nm_tc_action_get_attributes (action),
+	                                           attrs,
+	                                           ' ', ' ');
 	if (str) {
 		g_string_append_c (string, ' ');
 		g_string_append (string, str);
@@ -2670,9 +2679,9 @@ nm_utils_tc_action_from_str (const char *str, GError **error)
 	}
 
 	kind = g_variant_get_string (variant, NULL);
-	if (strcmp (kind, "simple") == 0)
+	if (nm_streq (kind, "simple"))
 		attrs = tc_action_simple_attribute_spec;
-	else if (strcmp (kind, "mirred") == 0)
+	else if (nm_streq (kind, "mirred"))
 		attrs = tc_action_mirred_attribute_spec;
 	else
 		attrs = NULL;
@@ -2893,7 +2902,7 @@ nm_utils_sriov_vf_to_str (const NMSriovVF *vf, gboolean omit_index, GError **err
 	if (num_attrs > 0) {
 		if (!omit_index)
 			g_string_append_c (str, ' ');
-		_nm_utils_format_variant_attributes_full (str, values, num_attrs, ' ', '=');
+		_nm_utils_format_variant_attributes_full (str, values, num_attrs, NULL, ' ', '=');
 	}
 
 	vlan_ids = nm_sriov_vf_get_vlan_ids (vf, &num_vlans);
@@ -3300,30 +3309,29 @@ nm_utils_uuid_generate_from_string (const char *s, gssize slen, int uuid_type, g
 char *
 _nm_utils_uuid_generate_from_strings (const char *string1, ...)
 {
-	GString *str;
-	va_list args;
-	const char *s;
-	char *uuid;
-
 	if (!string1)
 		return nm_utils_uuid_generate_from_string (NULL, 0, NM_UTILS_UUID_TYPE_VERSION3, NM_UTILS_UUID_NS);
 
-	str = g_string_sized_new (120); /* effectively allocates power of 2 (128)*/
+	{
+		nm_auto_str_buf NMStrBuf str = NM_STR_BUF_INIT (NM_UTILS_GET_NEXT_REALLOC_SIZE_104, FALSE);
+		va_list args;
+		const char *s;
 
-	g_string_append_len (str, string1, strlen (string1) + 1);
+		nm_str_buf_append_len (&str, string1, strlen (string1) + 1u);
 
-	va_start (args, string1);
-	s = va_arg (args, const char *);
-	while (s) {
-		g_string_append_len (str, s, strlen (s) + 1);
+		va_start (args, string1);
 		s = va_arg (args, const char *);
+		while (s) {
+			nm_str_buf_append_len (&str, s, strlen (s) + 1u);
+			s = va_arg (args, const char *);
+		}
+		va_end (args);
+
+		return nm_utils_uuid_generate_from_string (nm_str_buf_get_str_unsafe (&str),
+		                                           str.len,
+		                                           NM_UTILS_UUID_TYPE_VERSION3,
+		                                           NM_UTILS_UUID_NS);
 	}
-	va_end (args);
-
-	uuid = nm_utils_uuid_generate_from_string (str->str, str->len, NM_UTILS_UUID_TYPE_VERSION3, NM_UTILS_UUID_NS);
-
-	g_string_free (str, TRUE);
-	return uuid;
 }
 
 /*****************************************************************************/
@@ -3571,9 +3579,6 @@ nm_utils_file_search_in_paths (const char *progname,
                                gpointer user_data,
                                GError **error)
 {
-	GString *tmp;
-	const char *ret;
-
 	g_return_val_if_fail (!error || !*error, NULL);
 	g_return_val_if_fail (progname && progname[0] && !strchr (progname, '/'), NULL);
 	g_return_val_if_fail (file_test_flags || predicate, NULL);
@@ -3582,32 +3587,35 @@ nm_utils_file_search_in_paths (const char *progname,
 	 * it simpler to pass in a path from configure checks. */
 	if (   try_first
 	    && try_first[0] == '/'
-	    && (file_test_flags == 0 || g_file_test (try_first, file_test_flags))
-	    && (!predicate || predicate (try_first, user_data)))
+	    && (   file_test_flags == 0
+	        || g_file_test (try_first, file_test_flags))
+	    && (   !predicate
+	        || predicate (try_first, user_data)))
 		return g_intern_string (try_first);
 
-	if (!paths || !*paths)
-		goto NOT_FOUND;
+	if (   paths
+	    && paths[0]) {
+		nm_auto_str_buf NMStrBuf strbuf = NM_STR_BUF_INIT (NM_UTILS_GET_NEXT_REALLOC_SIZE_104, FALSE);
 
-	tmp = g_string_sized_new (50);
-	for (; *paths; paths++) {
-		if (!*paths)
-			continue;
-		g_string_append (tmp, *paths);
-		if (tmp->str[tmp->len - 1] != '/')
-			g_string_append_c (tmp, '/');
-		g_string_append (tmp, progname);
-		if (   (file_test_flags == 0 || g_file_test (tmp->str, file_test_flags))
-		    && (!predicate || predicate (tmp->str, user_data))) {
-			ret = g_intern_string (tmp->str);
-			g_string_free (tmp, TRUE);
-			return ret;
+		for (; *paths; paths++) {
+			const char *path = *paths;
+			const char *s;
+
+			if (!path[0])
+				continue;
+
+			nm_str_buf_reset (&strbuf, path);
+			nm_str_buf_ensure_trailing_c (&strbuf, '/');
+			s = nm_str_buf_append0 (&strbuf, progname);
+
+			if (   (   file_test_flags == 0
+			        || g_file_test (s, file_test_flags))
+			    && (   !predicate
+			        || predicate (s, user_data)))
+				return g_intern_string (s);
 		}
-		g_string_set_size (tmp, 0);
 	}
-	g_string_free (tmp, TRUE);
 
-NOT_FOUND:
 	g_set_error (error, G_IO_ERROR, G_IO_ERROR_NOT_FOUND, _("Could not find \"%s\" binary"), progname);
 	return NULL;
 }
@@ -3620,7 +3628,7 @@ struct cf_pair {
 	guint32 freq;
 };
 
-static struct cf_pair a_table[] = {
+static const struct cf_pair a_table[] = {
 	/* A band */
 	{  7, 5035 },
 	{  8, 5040 },
@@ -3667,10 +3675,60 @@ static struct cf_pair a_table[] = {
 	{ 188, 4945 },
 	{ 192, 4960 },
 	{ 196, 4980 },
-	{ 0, -1 }
+	{ 0, 0 }
 };
 
-static struct cf_pair bg_table[] = {
+static const guint a_table_freqs[G_N_ELEMENTS (a_table)] = {
+	/* A band */
+	5035,
+	5040,
+	5045,
+	5055,
+	5060,
+	5080,
+	5170,
+	5180,
+	5190,
+	5200,
+	5210,
+	5220,
+	5230,
+	5240,
+	5250,
+	5260,
+	5280,
+	5290,
+	5300,
+	5320,
+	5500,
+	5520,
+	5540,
+	5560,
+	5580,
+	5600,
+	5620,
+	5640,
+	5660,
+	5680,
+	5700,
+	5745,
+	5760,
+	5765,
+	5785,
+	5800,
+	5805,
+	5825,
+	4915,
+	4920,
+	4925,
+	4935,
+	4945,
+	4960,
+	4980,
+	0,
+};
+
+static const struct cf_pair bg_table[] = {
 	/* B/G band */
 	{ 1, 2412 },
 	{ 2, 2417 },
@@ -3686,7 +3744,26 @@ static struct cf_pair bg_table[] = {
 	{ 12, 2467 },
 	{ 13, 2472 },
 	{ 14, 2484 },
-	{ 0, -1 }
+	{ 0, 0 }
+};
+
+static const guint bg_table_freqs[G_N_ELEMENTS (bg_table)] = {
+	/* B/G band */
+	2412,
+	2417,
+	2422,
+	2427,
+	2432,
+	2437,
+	2442,
+	2447,
+	2452,
+	2457,
+	2462,
+	2467,
+	2472,
+	2484,
+	0,
 };
 
 /**
@@ -3703,16 +3780,16 @@ nm_utils_wifi_freq_to_channel (guint32 freq)
 	int i = 0;
 
 	if (freq > 4900) {
-		while (a_table[i].chan && (a_table[i].freq != freq))
+		while (   a_table[i].freq
+		       && (a_table[i].freq != freq))
 			i++;
 		return a_table[i].chan;
-	} else {
-		while (bg_table[i].chan && (bg_table[i].freq != freq))
-			i++;
-		return bg_table[i].chan;
 	}
 
-	return 0;
+	while (   bg_table[i].freq
+	       && (bg_table[i].freq != freq))
+		i++;
+	return bg_table[i].chan;
 }
 
 /**
@@ -3748,16 +3825,24 @@ nm_utils_wifi_freq_to_band (guint32 freq)
 guint32
 nm_utils_wifi_channel_to_freq (guint32 channel, const char *band)
 {
-	int i = 0;
+	int i;
 
-	if (!strcmp (band, "a")) {
-		while (a_table[i].chan && (a_table[i].chan != channel))
-			i++;
-		return a_table[i].freq;
-	} else if (!strcmp (band, "bg")) {
-		while (bg_table[i].chan && (bg_table[i].chan != channel))
-			i++;
-		return bg_table[i].freq;
+	g_return_val_if_fail (band, 0);
+
+	if (nm_streq (band, "a")) {
+		for (i = 0; a_table[i].chan; i++) {
+			if (a_table[i].chan == channel)
+				return a_table[i].freq;
+		}
+		return ((guint32) -1);
+	}
+
+	if (nm_streq (band, "bg")) {
+		for (i = 0; bg_table[i].chan; i++) {
+			if (bg_table[i].chan == channel)
+				return bg_table[i].freq;
+		}
+		return ((guint32) -1);
 	}
 
 	return 0;
@@ -3776,26 +3861,24 @@ nm_utils_wifi_channel_to_freq (guint32 channel, const char *band)
 guint32
 nm_utils_wifi_find_next_channel (guint32 channel, int direction, char *band)
 {
-	size_t a_size = sizeof (a_table) / sizeof (struct cf_pair);
-	size_t bg_size = sizeof (bg_table) / sizeof (struct cf_pair);
-	struct cf_pair *pair = NULL;
+	size_t a_size = G_N_ELEMENTS (a_table);
+	size_t bg_size = G_N_ELEMENTS (bg_table);
+	const struct cf_pair *pair;
 
-	if (!strcmp (band, "a")) {
+	if (nm_streq (band, "a")) {
 		if (channel < a_table[0].chan)
 			return a_table[0].chan;
 		if (channel > a_table[a_size - 2].chan)
 			return a_table[a_size - 2].chan;
 		pair = &a_table[0];
-	} else if (!strcmp (band, "bg")) {
+	} else if (nm_streq (band, "bg")) {
 		if (channel < bg_table[0].chan)
 			return bg_table[0].chan;
 		if (channel > bg_table[bg_size - 2].chan)
 			return bg_table[bg_size - 2].chan;
 		pair = &bg_table[0];
-	} else {
-		g_assert_not_reached ();
-		return 0;
-	}
+	} else
+		g_return_val_if_reached (0);
 
 	while (pair->chan) {
 		if (channel == pair->chan)
@@ -3823,49 +3906,32 @@ nm_utils_wifi_find_next_channel (guint32 channel, int direction, char *band)
 gboolean
 nm_utils_wifi_is_channel_valid (guint32 channel, const char *band)
 {
-	struct cf_pair *table = NULL;
-	int i = 0;
+	guint32 freq;
 
-	if (!strcmp (band, "a"))
-		table = a_table;
-	else if (!strcmp (band, "bg"))
-		table = bg_table;
-	else
-		return FALSE;
+	freq = nm_utils_wifi_channel_to_freq (channel, band);
 
-	while (table[i].chan && (table[i].chan != channel))
-		i++;
-
-	if (table[i].chan != 0)
-		return TRUE;
-	else
-		return FALSE;
+	return !NM_IN_SET (freq, 0u, (guint32) -1);
 }
 
-static const guint *
-_wifi_freqs (gboolean bg_band)
-{
-	static guint *freqs_2ghz = NULL;
-	static guint *freqs_5ghz = NULL;
-	guint *freqs;
-
-	freqs = bg_band ? freqs_2ghz : freqs_5ghz;
-	if (G_UNLIKELY (freqs == NULL)) {
-		struct cf_pair *table;
-		int i;
-
-		table = bg_band ? bg_table : a_table;
-		freqs = g_new0 (guint, bg_band ? G_N_ELEMENTS (bg_table) : G_N_ELEMENTS (a_table));
-		for (i = 0; table[i].chan; i++)
-			freqs[i] = table[i].freq;
-		freqs[i] = 0;
-		if (bg_band)
-			freqs_2ghz = freqs;
-		else
-			freqs_5ghz = freqs;
-	}
-	return freqs;
-}
+#define _nm_assert_wifi_freqs(table, table_freqs) \
+	G_STMT_START { \
+		if (NM_MORE_ASSERT_ONCE (5)) { \
+			int i, j; \
+			\
+			G_STATIC_ASSERT (G_N_ELEMENTS (table) > 0); \
+			G_STATIC_ASSERT (G_N_ELEMENTS (table) == G_N_ELEMENTS (table_freqs)); \
+			\
+			for (i = 0; i < G_N_ELEMENTS (table); i++) { \
+				nm_assert ((i == G_N_ELEMENTS (table) - 1) == (table[i].chan == 0)); \
+				nm_assert ((i == G_N_ELEMENTS (table) - 1) == (table[i].freq == 0)); \
+				nm_assert (table[i].freq == table_freqs[i]); \
+				for (j = 0; j < i; j++) { \
+					nm_assert (table[j].chan != table[i].chan); \
+					nm_assert (table[j].freq != table[i].freq); \
+				} \
+			} \
+		} \
+	} G_STMT_END
 
 /**
  * nm_utils_wifi_2ghz_freqs:
@@ -3879,7 +3945,8 @@ _wifi_freqs (gboolean bg_band)
 const guint *
 nm_utils_wifi_2ghz_freqs (void)
 {
-	return _wifi_freqs (TRUE);
+	_nm_assert_wifi_freqs (bg_table, bg_table_freqs);
+	return bg_table_freqs;
 }
 
 /**
@@ -3894,7 +3961,8 @@ nm_utils_wifi_2ghz_freqs (void)
 const guint *
 nm_utils_wifi_5ghz_freqs (void)
 {
-	return _wifi_freqs (FALSE);
+	_nm_assert_wifi_freqs (a_table, a_table_freqs);
+	return a_table_freqs;
 }
 
 /**
@@ -4019,7 +4087,7 @@ fail:
  * @out_length: the output length in case of success.
  *
  * Parses @asc and converts it to binary form in @buffer.
- * Bytes in @asc can be sepatared by colons (:), or hyphens (-), but not mixed.
+ * Bytes in @asc can be separated by colons (:), or hyphens (-), but not mixed.
  *
  * It is like nm_utils_hwaddr_aton(), but contrary to that it
  * can parse addresses of any length. That is, you don't need
@@ -4046,7 +4114,7 @@ _nm_utils_hwaddr_aton (const char *asc, gpointer buffer, gsize buffer_length, gs
  * the size of the buffer in bytes.
  *
  * Parses @asc and converts it to binary form in @buffer.
- * Bytes in @asc can be sepatared by colons (:), or hyphens (-), but not mixed.
+ * Bytes in @asc can be separated by colons (:), or hyphens (-), but not mixed.
  *
  * Return value: @buffer, or %NULL if @asc couldn't be parsed
  *   or would be shorter or longer than @length.
@@ -5028,7 +5096,7 @@ typedef struct {
 	const char *num;
 } BondMode;
 
-static BondMode bond_mode_table[] = {
+static const BondMode bond_mode_table[] = {
 	[0] = { "balance-rr",    "0" },
 	[1] = { "active-backup", "1" },
 	[2] = { "balance-xor",   "2" },
@@ -5080,8 +5148,8 @@ nm_utils_bond_mode_string_to_int (const char *mode)
 		return -1;
 
 	for (i = 0; i < G_N_ELEMENTS (bond_mode_table); i++) {
-		if (   strcmp (mode, bond_mode_table[i].str) == 0
-		    || strcmp (mode, bond_mode_table[i].num) == 0)
+		if (NM_IN_STRSET (mode, bond_mode_table[i].str,
+		                        bond_mode_table[i].num))
 			return i;
 	}
 	return -1;
@@ -5139,13 +5207,13 @@ _nm_utils_strstrdictkey_equal  (gconstpointer a, gconstpointer b)
 		return FALSE;
 
 	if (k1->type & STRSTRDICTKEY_ALL_SET) {
-		if (strcmp (k1->data, k2->data) != 0)
+		if (!nm_streq (k1->data, k2->data))
 			return FALSE;
 
 		if (k1->type == STRSTRDICTKEY_ALL_SET) {
 			gsize l = strlen (k1->data) + 1;
 
-			return strcmp (&k1->data[l], &k2->data[l]) == 0;
+			return nm_streq (&k1->data[l], &k2->data[l]);
 		}
 	}
 
@@ -5196,7 +5264,7 @@ validate_dns_option (const char *name,
 		return !!*name;
 
 	for (desc = option_descs; desc->name; desc++) {
-		if (!strcmp (name, desc->name) &&
+		if (nm_streq (name, desc->name) &&
 		    numeric == desc->numeric &&
 		    (!desc->ipv6_only || ipv6))
 			return TRUE;
@@ -5286,26 +5354,21 @@ _nm_utils_dns_option_validate (const char *option,
  */
 gssize _nm_utils_dns_option_find_idx (GPtrArray *array, const char *option)
 {
-	gboolean ret;
-	char *option_name, *tmp_name;
+	gs_free char *option_name = NULL;
 	guint i;
 
 	if (!_nm_utils_dns_option_validate (option, &option_name, NULL, FALSE, NULL))
 		return -1;
 
 	for (i = 0; i < array->len; i++) {
-		if (_nm_utils_dns_option_validate (array->pdata[i], &tmp_name, NULL, FALSE, NULL)) {
-			ret = strcmp (tmp_name, option_name);
-			g_free (tmp_name);
-			if (!ret) {
-				g_free (option_name);
-				return i;
-			}
-		}
+		gs_free char *tmp_name = NULL;
 
+		if (_nm_utils_dns_option_validate (array->pdata[i], &tmp_name, NULL, FALSE, NULL)) {
+			if (nm_streq (tmp_name, option_name))
+				return i;
+		}
 	}
 
-	g_free (option_name);
 	return -1;
 }
 
@@ -5427,9 +5490,9 @@ _nm_utils_is_json_object_no_validation (const char *str, GError **error)
 gboolean
 nm_utils_is_json_object (const char *str, GError **error)
 {
-#if WITH_JSON_VALIDATION
-	nm_auto_decref_json json_t *json = NULL;
-	json_error_t jerror;
+	nm_auto_decref_json nm_json_t *json = NULL;
+	const NMJsonVt *vt;
+	nm_json_error_t jerror;
 
 	g_return_val_if_fail (!error || !*error, FALSE);
 
@@ -5441,10 +5504,10 @@ nm_utils_is_json_object (const char *str, GError **error)
 		return FALSE;
 	}
 
-	if (!nm_jansson_load ())
+	if (!(vt = nm_json_vt ()))
 		return _nm_utils_is_json_object_no_validation (str, error);
 
-	json = json_loads (str, JSON_REJECT_DUPLICATES, &jerror);
+	json = vt->nm_json_loads (str, NM_JSON_REJECT_DUPLICATES, &jerror);
 	if (!json) {
 		g_set_error (error,
 		             NM_CONNECTION_ERROR,
@@ -5457,7 +5520,7 @@ nm_utils_is_json_object (const char *str, GError **error)
 
 	/* valid JSON (depending on the definition) can also be a literal.
 	 * Here we only allow objects. */
-	if (!json_is_object (json)) {
+	if (!nm_json_is_object (json)) {
 		g_set_error_literal (error,
 		                     NM_CONNECTION_ERROR,
 		                     NM_CONNECTION_ERROR_INVALID_PROPERTY,
@@ -5466,19 +5529,6 @@ nm_utils_is_json_object (const char *str, GError **error)
 	}
 
 	return TRUE;
-#else /* !WITH_JSON_VALIDATION */
-	g_return_val_if_fail (!error || !*error, FALSE);
-
-	if (!str || !str[0]) {
-		g_set_error_literal (error,
-		                     NM_CONNECTION_ERROR,
-		                     NM_CONNECTION_ERROR_INVALID_PROPERTY,
-		                     str ? _("value is NULL") : _("value is empty"));
-		return FALSE;
-	}
-
-	return _nm_utils_is_json_object_no_validation (str, error);
-#endif
 }
 
 static char *
@@ -5752,6 +5802,7 @@ nm_utils_format_variant_attributes (GHashTable *attributes,
                                     char key_value_separator)
 {
 	return _nm_utils_format_variant_attributes (attributes,
+	                                            NULL,
 	                                            attr_separator,
 	                                            key_value_separator);
 }
diff --git a/libnm-core/nm-version.h b/libnm-core/nm-version.h
index 203840376e..a43d710f9d 100644
--- a/libnm-core/nm-version.h
+++ b/libnm-core/nm-version.h
@@ -243,6 +243,20 @@
 # define NM_AVAILABLE_IN_1_26
 #endif
 
+#if NM_VERSION_MIN_REQUIRED >= NM_VERSION_1_28
+# define NM_DEPRECATED_IN_1_28           G_DEPRECATED
+# define NM_DEPRECATED_IN_1_28_FOR(f)    G_DEPRECATED_FOR(f)
+#else
+# define NM_DEPRECATED_IN_1_28
+# define NM_DEPRECATED_IN_1_28_FOR(f)
+#endif
+
+#if NM_VERSION_MAX_ALLOWED < NM_VERSION_1_28
+# define NM_AVAILABLE_IN_1_28            G_UNAVAILABLE(1,28)
+#else
+# define NM_AVAILABLE_IN_1_28
+#endif
+
 /*
  * Synchronous API for calling D-Bus in libnm is deprecated. See
  * https://developer.gnome.org/libnm/stable/usage.html#sync-api
diff --git a/libnm-core/nm-vpn-plugin-info.c b/libnm-core/nm-vpn-plugin-info.c
index 7fbd89544c..881bd755ef 100644
--- a/libnm-core/nm-vpn-plugin-info.c
+++ b/libnm-core/nm-vpn-plugin-info.c
@@ -640,7 +640,7 @@ nm_vpn_plugin_info_list_find_service_type (GSList *list, const char *name)
 	if (info)
 		return g_strdup (NM_VPN_PLUGIN_INFO_GET_PRIVATE (info)->service);
 
-	/* check the hard-coded list of short-names. They all have have the same
+	/* check the hard-coded list of short-names. They all have the same
 	 * well-known prefix org.freedesktop.NetworkManager and the name. */
 	if (nm_utils_strv_find_first ((char **) known_names, G_N_ELEMENTS (known_names), name) >= 0)
 		return g_strdup_printf ("%s.%s", NM_DBUS_INTERFACE, name);
diff --git a/libnm-core/tests/test-general.c b/libnm-core/tests/test-general.c
index f70a7d5a65..1e4efe2452 100644
--- a/libnm-core/tests/test-general.c
+++ b/libnm-core/tests/test-general.c
@@ -14,6 +14,7 @@
 #include "nm-std-aux/c-list-util.h"
 #include "nm-glib-aux/nm-enum-utils.h"
 #include "nm-glib-aux/nm-str-buf.h"
+#include "nm-glib-aux/nm-json-aux.h"
 #include "systemd/nm-sd-utils-shared.h"
 
 #include "nm-utils.h"
@@ -269,7 +270,7 @@ _do_test_nm_utils_strsplit_set_f_one (NMUtilsStrsplitSetFlags flags,
 	g_assert (!NM_FLAGS_ANY (flags, ~(  NM_UTILS_STRSPLIT_SET_FLAGS_ALLOW_ESCAPING
 	                                  | NM_UTILS_STRSPLIT_SET_FLAGS_PRESERVE_EMPTY)));
 
-	/* assert that the epected words are valid (and don't contain unescaped delimiters). */
+	/* assert that the expected words are valid (and don't contain unescaped delimiters). */
 	for (i = 0; i < words_len; i++) {
 		const char *w = exp_words[i];
 
@@ -7125,17 +7126,19 @@ test_nm_utils_check_valid_json (void)
 {
 	_json_config_check_valid (NULL, FALSE);
 	_json_config_check_valid ("", FALSE);
-#if WITH_JSON_VALIDATION
-	_json_config_check_valid ("{ }", TRUE);
-	_json_config_check_valid ("{ \"a\" : 1 }", TRUE);
-	_json_config_check_valid ("{ \"a\" : }", FALSE);
-#else
+
 	/* Without JSON library everything except empty string is considered valid */
+	nmtst_json_vt_reset (FALSE);
 	_json_config_check_valid ("{ }", TRUE);
 	_json_config_check_valid ("{'%!-a1} ", TRUE);
 	_json_config_check_valid (" {'%!-a1}", TRUE);
 	_json_config_check_valid ("{'%!-a1", FALSE);
-#endif
+
+	if (nmtst_json_vt_reset (TRUE)) {
+		_json_config_check_valid ("{ }", TRUE);
+		_json_config_check_valid ("{ \"a\" : 1 }", TRUE);
+		_json_config_check_valid ("{ \"a\" : }", FALSE);
+	}
 }
 
 static void
@@ -7172,86 +7175,96 @@ _team_config_equal_check (const char *conf1,
 static void
 test_nm_utils_team_config_equal (void)
 {
-	_team_config_equal_check ("",
-	                          "",
-	                          TRUE,
-	                          TRUE);
-	_team_config_equal_check ("",
-	                          " ",
-	                          TRUE,
-	                          TRUE);
-	_team_config_equal_check ("{}",
-	                          "{ }",
-	                          TRUE,
-	                          TRUE);
-	_team_config_equal_check ("{}",
-	                          "{",
-	                          TRUE,
-	                          TRUE);
-	_team_config_equal_check ("{ \"a\": 1 }",
-	                          "{ \"a\": 1 }",
-	                          TRUE,
-	                          TRUE);
-	_team_config_equal_check ("{ \"a\": 1 }",
-	                          "{ \"a\":   1 }",
-	                          TRUE,
-	                          TRUE);
+	int with_json_vt;
 
-	/* team config */
-	_team_config_equal_check ("{ }",
-	                          "{ \"runner\" :  { \"name\" : \"random\"} }",
-	                          FALSE,
-	                          !WITH_JSON_VALIDATION);
-	_team_config_equal_check ("{ \"runner\" :  { \"name\" : \"roundrobin\"} }",
-	                          "{ \"runner\" :  { \"name\" : \"random\"} }",
-	                          FALSE,
-	                          !WITH_JSON_VALIDATION);
-	_team_config_equal_check ("{ \"runner\" :  { \"name\" : \"random\"} }",
-	                          "{ \"runner\" :  { \"name\" : \"random\"} }",
-	                          FALSE,
-	                          TRUE);
-	_team_config_equal_check ("{ \"runner\" :  { \"name\" : \"loadbalance\"} }",
-	                          "{ \"runner\" :  { \"name\" : \"loadbalance\"} }",
-	                          FALSE,
-	                          TRUE);
-	_team_config_equal_check ("{ \"runner\" :  { \"name\" : \"random\"}, \"ports\" : { \"eth0\" : {} } }",
-	                          "{ \"runner\" :  { \"name\" : \"random\"}, \"ports\" : { \"eth1\" : {} } }",
-	                          FALSE,
-	                          TRUE);
-	_team_config_equal_check ("{ \"runner\" :  { \"name\" : \"lacp\"} }",
-	                          "{ \"runner\" :  { \"name\" : \"lacp\", \"tx_hash\" : [ \"eth\", \"ipv4\", \"ipv6\" ] } }",
-	                          FALSE,
-	                          !WITH_JSON_VALIDATION);
-	_team_config_equal_check ("{ \"runner\" :  { \"name\" : \"roundrobin\"} }",
-	                          "{ \"runner\" :  { \"name\" : \"roundrobin\", \"tx_hash\" : [ \"eth\", \"ipv4\", \"ipv6\" ] } }",
-	                          FALSE,
-	                          !WITH_JSON_VALIDATION);
-	_team_config_equal_check ("{ \"runner\" :  { \"name\" : \"lacp\"} }",
-	                          "{ \"runner\" :  { \"name\" : \"lacp\", \"tx_hash\" : [ \"eth\" ] } }",
-	                          FALSE,
-	                          !WITH_JSON_VALIDATION);
+	for (with_json_vt = 0; with_json_vt < 2; with_json_vt++) {
+		const NMJsonVt *vt;
 
-	/* team port config */
-	_team_config_equal_check ("{ }",
-	                          "{ \"link_watch\" :  { \"name\" : \"ethtool\"} }",
-	                          TRUE,
-	                          !WITH_JSON_VALIDATION);
-	_team_config_equal_check ("{ }",
-	                          "{ \"link_watch\" :  { \"name\" : \"arp_ping\"} }",
-	                          TRUE,
-	                          TRUE);
-	_team_config_equal_check ("{ \"link_watch\" :  { \"name\" : \"ethtool\"} }",
-	                          "{ \"link_watch\" :  { \"name\" : \"arp_ping\"} }",
-	                          TRUE,
-	                          !WITH_JSON_VALIDATION);
-	_team_config_equal_check ("{ \"link_watch\" :  { \"name\" : \"arp_ping\"} }",
-	                          "{ \"link_watch\" :  { \"name\" : \"arp_ping\"} }",
-	                          TRUE,
-	                          TRUE);
-	_team_config_equal_check ("{ \"link_watch\" :  { \"name\" : \"arp_ping\"}, \"ports\" : { \"eth0\" : {} } }",
-	                          "{ \"link_watch\" :  { \"name\" : \"arp_ping\"}, \"ports\" : { \"eth1\" : {} } }",
-	                          TRUE,
-	                          TRUE);
+		vt = nmtst_json_vt_reset (!!with_json_vt);
+
+		_team_config_equal_check ("",
+		                          "",
+		                          TRUE,
+		                          TRUE);
+		_team_config_equal_check ("",
+		                          " ",
+		                          TRUE,
+		                          TRUE);
+		_team_config_equal_check ("{}",
+		                          "{ }",
+		                          TRUE,
+		                          TRUE);
+		_team_config_equal_check ("{}",
+		                          "{",
+		                          TRUE,
+		                          TRUE);
+		_team_config_equal_check ("{ \"a\": 1 }",
+		                          "{ \"a\": 1 }",
+		                          TRUE,
+		                          TRUE);
+		_team_config_equal_check ("{ \"a\": 1 }",
+		                          "{ \"a\":   1 }",
+		                          TRUE,
+		                          TRUE);
+
+		/* team config */
+		_team_config_equal_check ("{ }",
+		                          "{ \"runner\" :  { \"name\" : \"random\"} }",
+		                          FALSE,
+		                          !vt);
+		_team_config_equal_check ("{ \"runner\" :  { \"name\" : \"roundrobin\"} }",
+		                          "{ \"runner\" :  { \"name\" : \"random\"} }",
+		                          FALSE,
+		                          !vt);
+		_team_config_equal_check ("{ \"runner\" :  { \"name\" : \"random\"} }",
+		                          "{ \"runner\" :  { \"name\" : \"random\"} }",
+		                          FALSE,
+		                          TRUE);
+		_team_config_equal_check ("{ \"runner\" :  { \"name\" : \"loadbalance\"} }",
+		                          "{ \"runner\" :  { \"name\" : \"loadbalance\"} }",
+		                          FALSE,
+		                          TRUE);
+		_team_config_equal_check ("{ \"runner\" :  { \"name\" : \"random\"}, \"ports\" : { \"eth0\" : {} } }",
+		                          "{ \"runner\" :  { \"name\" : \"random\"}, \"ports\" : { \"eth1\" : {} } }",
+		                          FALSE,
+		                          TRUE);
+		_team_config_equal_check ("{ \"runner\" :  { \"name\" : \"lacp\"} }",
+		                          "{ \"runner\" :  { \"name\" : \"lacp\", \"tx_hash\" : [ \"eth\", \"ipv4\", \"ipv6\" ] } }",
+		                          FALSE,
+		                          !vt);
+		_team_config_equal_check ("{ \"runner\" :  { \"name\" : \"roundrobin\"} }",
+		                          "{ \"runner\" :  { \"name\" : \"roundrobin\", \"tx_hash\" : [ \"eth\", \"ipv4\", \"ipv6\" ] } }",
+		                          FALSE,
+		                          !vt);
+		_team_config_equal_check ("{ \"runner\" :  { \"name\" : \"lacp\"} }",
+		                          "{ \"runner\" :  { \"name\" : \"lacp\", \"tx_hash\" : [ \"eth\" ] } }",
+		                          FALSE,
+		                          !vt);
+
+		/* team port config */
+		_team_config_equal_check ("{ }",
+		                          "{ \"link_watch\" :  { \"name\" : \"ethtool\"} }",
+		                          TRUE,
+		                          !vt);
+		_team_config_equal_check ("{ }",
+		                          "{ \"link_watch\" :  { \"name\" : \"arp_ping\"} }",
+		                          TRUE,
+		                          TRUE);
+		_team_config_equal_check ("{ \"link_watch\" :  { \"name\" : \"ethtool\"} }",
+		                          "{ \"link_watch\" :  { \"name\" : \"arp_ping\"} }",
+		                          TRUE,
+		                          !vt);
+		_team_config_equal_check ("{ \"link_watch\" :  { \"name\" : \"arp_ping\"} }",
+		                          "{ \"link_watch\" :  { \"name\" : \"arp_ping\"} }",
+		                          TRUE,
+		                          TRUE);
+		_team_config_equal_check ("{ \"link_watch\" :  { \"name\" : \"arp_ping\"}, \"ports\" : { \"eth0\" : {} } }",
+		                          "{ \"link_watch\" :  { \"name\" : \"arp_ping\"}, \"ports\" : { \"eth1\" : {} } }",
+		                          TRUE,
+		                          TRUE);
+	}
+
+	nmtst_json_vt_reset (TRUE);
 }
 
 /*****************************************************************************/
@@ -7845,7 +7858,7 @@ _do_test_utils_str_utf8safe_unescape (const char *str, const char *expected, gsi
 
 	if (   expected
 	    && l == strlen (expected)) {
-		/* there are no embeeded NULs. Check that nm_utils_str_utf8safe_unescape() yields the same result. */
+		/* there are no embedded NULs. Check that nm_utils_str_utf8safe_unescape() yields the same result. */
 		s = nm_utils_str_utf8safe_unescape (str, NM_UTILS_STR_UTF8_SAFE_FLAG_NONE, &str_free_1);
 		g_assert_cmpstr (s, ==, expected);
 		if (strchr (str, '\\')) {
@@ -9100,6 +9113,55 @@ test_strsplit_quoted (void)
 
 /*****************************************************************************/
 
+static void
+_do_wifi_ghz_freqs (const guint *freqs, const char *band)
+{
+	int len;
+	int j;
+	int i;
+
+	g_assert (NM_IN_STRSET (band, "a", "bg"));
+	g_assert (freqs);
+	g_assert (freqs[0] != 0);
+
+	for (i = 0; freqs[i]; i++) {
+		for (j = 0; j < i; j++)
+			g_assert (freqs[i] != freqs[j]);
+	}
+	len = i;
+
+	g_assert (nm_utils_wifi_freq_to_channel (0) == 0);
+	g_assert (nm_utils_wifi_channel_to_freq (0, "bg") == -1);
+	g_assert (nm_utils_wifi_channel_to_freq (0, "foo") == 0);
+	g_assert (!nm_utils_wifi_is_channel_valid (0, "bg"));
+	g_assert (!nm_utils_wifi_is_channel_valid (0, "foo"));
+
+	for (i = 0; i < len; i++) {
+		guint freq = freqs[i];
+		guint32 chan;
+		guint32 freq2;
+
+		chan = nm_utils_wifi_freq_to_channel (freq);
+		g_assert (chan != 0);
+
+		freq2 = nm_utils_wifi_channel_to_freq (chan, band);
+		g_assert (freq2 == freq);
+
+		g_assert (nm_utils_wifi_is_channel_valid (chan, band));
+	}
+
+	g_assert (freqs[len] == 0);
+}
+
+static void
+test_nm_utils_wifi_ghz_freqs (void)
+{
+	_do_wifi_ghz_freqs (nm_utils_wifi_2ghz_freqs (), "bg");
+	_do_wifi_ghz_freqs (nm_utils_wifi_5ghz_freqs (), "a");
+}
+
+/*****************************************************************************/
+
 NMTST_DEFINE ();
 
 int main (int argc, char **argv)
@@ -9273,6 +9335,7 @@ int main (int argc, char **argv)
 	g_test_add_data_func ("/core/general/test_integrate_maincontext/2", GUINT_TO_POINTER (2), test_integrate_maincontext);
 
 	g_test_add_func ("/core/general/test_nm_ip_addr_zero", test_nm_ip_addr_zero);
+	g_test_add_func ("/core/general/test_nm_utils_wifi_ghz_freqs", test_nm_utils_wifi_ghz_freqs);
 
 	g_test_add_func ("/core/general/test_strsplit_quoted", test_strsplit_quoted);
 
diff --git a/libnm-core/tests/test-keyfile.c b/libnm-core/tests/test-keyfile.c
index 23149b618d..c9ec51f01b 100644
--- a/libnm-core/tests/test-keyfile.c
+++ b/libnm-core/tests/test-keyfile.c
@@ -5,6 +5,7 @@
 
 #include "nm-default.h"
 
+#include "nm-glib-aux/nm-json-aux.h"
 #include "nm-keyfile/nm-keyfile-utils.h"
 #include "nm-keyfile/nm-keyfile-internal.h"
 #include "nm-simple-connection.h"
@@ -627,7 +628,7 @@ test_team_conf_read_invalid (void)
 	gs_unref_object NMConnection *con = NULL;
 	NMSettingTeam *s_team;
 
-	if (!WITH_JSON_VALIDATION) {
+	if (!nm_json_vt ()) {
 		g_test_skip ("team test requires JSON validation");
 		return;
 	}
diff --git a/libnm-core/tests/test-setting.c b/libnm-core/tests/test-setting.c
index 359c20c43c..1b53baeda3 100644
--- a/libnm-core/tests/test-setting.c
+++ b/libnm-core/tests/test-setting.c
@@ -8,6 +8,7 @@
 #include <linux/pkt_sched.h>
 #include <net/if.h>
 
+#include "nm-glib-aux/nm-json-aux.h"
 #include "nm-core-internal.h"
 #include "nm-utils.h"
 #include "nm-utils-private.h"
@@ -32,15 +33,6 @@
 
 /*****************************************************************************/
 
-/* assert that the define is just a plain integer (boolean). */
-
-G_STATIC_ASSERT (   (WITH_JSON_VALIDATION) == 1
-                 || (WITH_JSON_VALIDATION) == 0);
-
-_nm_unused static const int _with_json_validation = WITH_JSON_VALIDATION;
-
-/*****************************************************************************/
-
 /* converts @dict to a connection. In this case, @dict must be good, without warnings, so that
  * NM_SETTING_PARSE_FLAGS_STRICT and NM_SETTING_PARSE_FLAGS_BEST_EFFORT yield the exact same results. */
 static NMConnection *
@@ -978,6 +970,24 @@ test_dcb_bandwidth_sums (void)
 
 /*****************************************************************************/
 
+static void
+test_nm_json (void)
+{
+	g_assert (NM_IN_SET (WITH_JANSSON, 0, 1));
+
+#if WITH_JANSSON
+	g_assert (nm_json_vt ());
+#else
+	g_assert (!nm_json_vt ());
+#endif
+
+#if WITH_JANSSON != defined (JANSSON_SONAME)
+#error "WITH_JANSON and JANSSON_SONAME are defined inconsistently."
+#endif
+}
+
+/*****************************************************************************/
+
 static void
 _test_team_config_sync (const char *team_config,
                         int notify_peer_count,
@@ -1000,7 +1010,7 @@ _test_team_config_sync (const char *team_config,
 	guint i, j;
 	gboolean found;
 
-	if (!WITH_JSON_VALIDATION) {
+	if (!nm_json_vt ()) {
 		g_test_skip ("team test requires JSON validation");
 		return;
 	}
@@ -1265,7 +1275,7 @@ _test_team_port_config_sync (const char *team_port_config,
 	guint i, j;
 	gboolean found;
 
-	if (!WITH_JSON_VALIDATION) {
+	if (!nm_json_vt ()) {
 		g_test_skip ("team test requires JSON validation");
 		return;
 	}
@@ -1397,7 +1407,7 @@ _check_team_setting (NMSetting *setting)
 	                         : nm_setting_team_get_config (NM_SETTING_TEAM (setting)),
 	                         NULL);
 
-	if (WITH_JSON_VALIDATION)
+	if (nm_json_vt ())
 		nmtst_assert_setting_is_equal (setting, setting2, NM_SETTING_COMPARE_FLAG_EXACT);
 
 	g_clear_object (&setting2);
@@ -2389,7 +2399,7 @@ test_tc_config_action (void)
 }
 
 static void
-test_tc_config_tfilter (void)
+test_tc_config_tfilter_matchall_sdata (void)
 {
 	NMTCAction *action1;
 	NMTCTfilter *tfilter1, *tfilter2;
@@ -2443,6 +2453,50 @@ test_tc_config_tfilter (void)
 	nm_tc_tfilter_unref (tfilter2);
 }
 
+static void
+test_tc_config_tfilter_matchall_mirred (void)
+{
+	NMTCAction *action;
+	NMTCTfilter *tfilter1;
+	GError *error = NULL;
+	gs_strfreev char **attr_names = NULL;
+	gs_free char *str;
+	GVariant *variant;
+
+	tfilter1 = nm_utils_tc_tfilter_from_str ("parent ffff: matchall action mirred ingress mirror dev eth0", &error);
+	nmtst_assert_success (tfilter1, error);
+	g_assert_cmpint (nm_tc_tfilter_get_parent (tfilter1), ==, TC_H_MAKE (0xffff << 16, 0));
+	g_assert_cmpstr (nm_tc_tfilter_get_kind (tfilter1), ==, "matchall");
+
+	action = nm_tc_tfilter_get_action (tfilter1);
+	nm_assert (action);
+	g_assert_cmpstr (nm_tc_action_get_kind (action), ==, "mirred");
+	attr_names = nm_tc_action_get_attribute_names (action);
+	g_assert (attr_names);
+	g_assert_cmpint (g_strv_length (attr_names), ==, 3);
+
+	variant = nm_tc_action_get_attribute (action, "ingress");
+	g_assert (variant);
+	g_assert (g_variant_is_of_type (variant, G_VARIANT_TYPE_BOOLEAN));
+	g_assert (g_variant_get_boolean (variant));
+
+	variant = nm_tc_action_get_attribute (action, "mirror");
+	g_assert (variant);
+	g_assert (g_variant_is_of_type (variant, G_VARIANT_TYPE_BOOLEAN));
+	g_assert (g_variant_get_boolean (variant));
+
+	variant = nm_tc_action_get_attribute (action, "dev");
+	g_assert (variant);
+	g_assert (g_variant_is_of_type (variant, G_VARIANT_TYPE_STRING));
+	g_assert_cmpstr (g_variant_get_string (variant, NULL), ==, "eth0");
+
+	str = nm_utils_tc_tfilter_to_str (tfilter1, &error);
+	nmtst_assert_success (str, error);
+	g_assert_cmpstr (str, ==, "parent ffff: matchall action mirred dev eth0 ingress mirror");
+
+	nm_tc_tfilter_unref (tfilter1);
+}
+
 static void
 test_tc_config_setting_valid (void)
 {
@@ -3977,10 +4031,10 @@ test_setting_metadata (void)
 				    || (pt   == &nm_sett_info_propert_type_plain_u && pt_2 == &nm_sett_info_propert_type_deprecated_ignore_u)
 				    || (pt_2 == &nm_sett_info_propert_type_plain_u && pt   == &nm_sett_info_propert_type_deprecated_ignore_u)) {
 					/* These are known to be duplicated. This is the case for
-					 *   "gsm.network-type"  and plain properies like "802-11-wireless-security.fils" ("i" D-Bus type)
-					 *   "gsm.allowed-bands" and plain properies like "802-11-olpc-mesh.channel" ("u" D-Bus type)
+					 *   "gsm.network-type"  and plain properties like "802-11-wireless-security.fils" ("i" D-Bus type)
+					 *   "gsm.allowed-bands" and plain properties like "802-11-olpc-mesh.channel" ("u" D-Bus type)
 					 * While the content/behaviour of the property types are identical, their purpose
-					 * is different. So allowe them.
+					 * is different. So allow them.
 					 */
 					continue;
 				}
@@ -4040,7 +4094,10 @@ main (int argc, char **argv)
 
 	g_test_add_func ("/libnm/settings/tc_config/qdisc", test_tc_config_qdisc);
 	g_test_add_func ("/libnm/settings/tc_config/action", test_tc_config_action);
-	g_test_add_func ("/libnm/settings/tc_config/tfilter", test_tc_config_tfilter);
+	g_test_add_func ("/libnm/settings/tc_config/tfilter/matchall_sdata",
+	                 test_tc_config_tfilter_matchall_sdata);
+	g_test_add_func ("/libnm/settings/tc_config/tfilter/matchall_mirred",
+	                 test_tc_config_tfilter_matchall_mirred);
 	g_test_add_func ("/libnm/settings/tc_config/setting/valid", test_tc_config_setting_valid);
 	g_test_add_func ("/libnm/settings/tc_config/setting/duplicates", test_tc_config_setting_duplicates);
 	g_test_add_func ("/libnm/settings/tc_config/dbus", test_tc_config_dbus);
@@ -4048,6 +4105,7 @@ main (int argc, char **argv)
 	g_test_add_func ("/libnm/settings/bridge/vlans", test_bridge_vlans);
 	g_test_add_func ("/libnm/settings/bridge/verify", test_bridge_verify);
 
+	g_test_add_func ("/libnm/test_nm_json", test_nm_json);
 	g_test_add_func ("/libnm/settings/team/sync_runner_from_config_roundrobin",
 	                 test_runner_roundrobin_sync_from_config);
 	g_test_add_func ("/libnm/settings/team/sync_runner_from_config_broadcast",
diff --git a/libnm/libnm.ver b/libnm/libnm.ver
index 44437435d3..f4c61c20bf 100644
--- a/libnm/libnm.ver
+++ b/libnm/libnm.ver
@@ -1741,3 +1741,8 @@ global:
 	nm_setting_option_set_boolean;
 	nm_setting_option_set_uint32;
 } libnm_1_24_0;
+
+libnm_1_28_0 {
+global:
+	nm_setting_wireless_get_ap_isolation;
+} libnm_1_26_0;
diff --git a/libnm/nm-active-connection.c b/libnm/nm-active-connection.c
index ade2edbe73..3a38c2a50c 100644
--- a/libnm/nm-active-connection.c
+++ b/libnm/nm-active-connection.c
@@ -158,7 +158,7 @@ nm_active_connection_get_connection_type (NMActiveConnection *connection)
  *
  * Gets the path of the "specific object" used at activation.
  *
- * Currently there is no single method that will allow you to automatically turn
+ * Currently, there is no single method that will allow you to automatically turn
  * this into an appropriate #NMObject; you need to know what kind of object it
  * is based on other information. (Eg, if @connection corresponds to a Wi-Fi
  * connection, then the specific object will be an #NMAccessPoint, and you can
diff --git a/libnm/nm-client.c b/libnm/nm-client.c
index d7f61152dc..9053271c21 100644
--- a/libnm/nm-client.c
+++ b/libnm/nm-client.c
@@ -2580,7 +2580,7 @@ _obj_handle_dbus_iface_changes (NMClient *self,
 			nm_assert (db_prop_data < &db_iface_data->prop_datas[db_iface_data->dbus_iface.meta->n_dbus_properties]);
 			nm_assert (db_prop_data->prop_data_value);
 
-			/* Currently NMLDBusObject forgets about the variant. Theoretically, it could cache
+			/* Currently, NMLDBusObject forgets about the variant. Theoretically, it could cache
 			 * it, but there is no need because we update the property in nmobj (which extracts and
 			 * keeps the property value itself).
 			 *
@@ -2610,7 +2610,7 @@ _obj_handle_dbus_changes (NMClient *self,
 
 	_ASSERT_dbobj (dbobj, self);
 
-	/* In a first step we only remember all the changes that that a D-Bus message brings
+	/* In a first step we only remember all the changes that a D-Bus message brings
 	 * and queue the object to process them.
 	 *
 	 * Here (in step 2) we look at what changed on D-Bus and propagate those changes
@@ -4425,7 +4425,7 @@ nm_client_get_permission_result (NMClient *client, NMClientPermission permission
  *   means that no permissions result was yet received. All permissions
  *   are unknown. %NM_TERNARY_TRUE means that the permissions got received
  *   and are cached. %%NM_TERNARY_FALSE means that permissions are cached,
- *   but they are invalided as as "CheckPermissions" signal was received
+ *   but they are invalided as "CheckPermissions" signal was received
  *   in the meantime.
  *
  * Since: 1.24
@@ -5235,7 +5235,7 @@ nm_client_add_and_activate_connection_finish (NMClient *client,
  * track the activation to its completion.
  *
  * This is identical to nm_client_add_and_activate_connection_async() but takes
- * a further @options parameter. Currently the following options are supported
+ * a further @options parameter. Currently, the following options are supported
  * by the daemon:
  *  * "persist": A string describing how the connection should be stored.
  *               The default is "disk", but it can be modified to "memory" (until
@@ -5274,7 +5274,7 @@ nm_client_add_and_activate_connection2 (NMClient *client,
  * @result: the result passed to the #GAsyncReadyCallback
  * @error: location for a #GError, or %NULL
  * @out_result: (allow-none) (transfer full): the output result
- *   of type "a{sv}" returned by D-Bus' AddAndActivate2 call. Currently no
+ *   of type "a{sv}" returned by D-Bus' AddAndActivate2 call. Currently, no
  *   output is implemented yet.
  *
  * Gets the result of a call to nm_client_add_and_activate_connection2().
@@ -8356,7 +8356,7 @@ nm_client_class_init (NMClientClass *client_class)
 	 * NMClient:capabilities: (type GArray(guint32))
 	 *
 	 * The list of capabilities numbers as guint32 or %NULL if
-	 * there are no capabitilies. The numeric value correspond
+	 * there are no capabilities. The numeric value correspond
 	 * to %NMCapability enum.
 	 *
 	 * Since: 1.24
diff --git a/libnm/nm-device.c b/libnm/nm-device.c
index daa23c763d..7dbaf370f3 100644
--- a/libnm/nm-device.c
+++ b/libnm/nm-device.c
@@ -2315,7 +2315,7 @@ nm_device_reapply_finish (NMDevice *device,
 /**
  * nm_device_get_applied_connection:
  * @device: a #NMDevice
- * @flags: the flags argument. Currently this value must always be zero.
+ * @flags: the flags argument. Currently, this value must always be zero.
  * @version_id: (out) (allow-none): returns the current version id of
  *   the applied connection
  * @cancellable: a #GCancellable, or %NULL
@@ -2379,7 +2379,7 @@ nm_device_get_applied_connection (NMDevice *device,
 /**
  * nm_device_get_applied_connection_async:
  * @device: a #NMDevice
- * @flags: the flags argument. Currently this value must always be zero.
+ * @flags: the flags argument. Currently, this value must always be zero.
  * @cancellable: a #GCancellable, or %NULL
  * @callback: callback to be called when the reapply operation completes
  * @user_data: caller-specific data passed to @callback
diff --git a/libnm/nm-libnm-utils.h b/libnm/nm-libnm-utils.h
index b59ba5f036..5a5a5d77eb 100644
--- a/libnm/nm-libnm-utils.h
+++ b/libnm/nm-libnm-utils.h
@@ -38,7 +38,7 @@ typedef enum {
 	 * for unknown D-Bus API that could just result because we run against a
 	 * newer NetworkManager version (such warnings are more graceful, because
 	 * we want that libnm can be forward compatible against newer servers).
-	 * Critial warnings should be emitted when NetworkManager exposes something
+	 * Critical warnings should be emitted when NetworkManager exposes something
 	 * on D-Bus that breaks the current expectations. Usually NetworkManager
 	 * should not break API, hence such issues are more severe. */
 	_NML_DBUS_LOG_LEVEL_WARN        = 0x08,
diff --git a/libnm/nm-secret-agent-old.c b/libnm/nm-secret-agent-old.c
index d614a34c3c..42739a0bb8 100644
--- a/libnm/nm-secret-agent-old.c
+++ b/libnm/nm-secret-agent-old.c
@@ -234,7 +234,7 @@ nm_secret_agent_old_get_context_busy_watcher (NMSecretAgentOld *self)
  * Returns: the current D-Bus name owner. While this property
  *   is set while registering, it really only makes sense when
  *   the nm_secret_agent_old_get_registered() indicates that
- *   registration is successfull.
+ *   registration is successful.
  *
  * Since: 1.24
  */
@@ -1974,7 +1974,7 @@ nm_secret_agent_old_class_init (NMSecretAgentOldClass *class)
 	 * In particular, if this property is %TRUE at construct time, then the
 	 * agent will register itself with NetworkManager during
 	 * construction/initialization and initialization will only complete
-	 * after registration is completed (either successfully or unsucessfully).
+	 * after registration is completed (either successfully or unsuccessfully).
 	 * Since 1.24, a failure to register will no longer cause initialization
 	 * of #NMSecretAgentOld to fail.
 	 *
diff --git a/man/NetworkManager.conf.xml b/man/NetworkManager.conf.xml
index 76a535fb5d..6f23dd2b2d 100644
--- a/man/NetworkManager.conf.xml
+++ b/man/NetworkManager.conf.xml
@@ -403,7 +403,7 @@ no-auto-default=*
         <term><varname>debug</varname></term>
         <listitem><para>Comma separated list of options to aid
         debugging. This value will be combined with the environment
-        variable <literal>NM_DEBUG</literal>. Currently the following
+        variable <literal>NM_DEBUG</literal>. Currently, the following
         values are supported:</para>
         <para>
           <literal>RLIMIT_CORE</literal>: set ulimit -c unlimited
@@ -478,7 +478,7 @@ no-auto-default=*
           <listitem><para>Set devices that should be ignored by
            NetworkManager.
           </para>
-          <para>See <xref linkend="device-spec"/> for the syntax how to
+          <para>See <xref linkend="device-spec"/> for the syntax on how to
            specify a device.
           </para>
           <para>
@@ -805,6 +805,10 @@ ipv6.ip6-privacy=0
           <term><varname>vpn.timeout</varname></term>
           <listitem><para>If left unspecified, default value of 60 seconds is used.</para></listitem>
         </varlistentry>
+        <varlistentry>
+          <term><varname>wifi.ap-isolation</varname></term>
+          <listitem><para>If left unspecified, AP isolation is disabled.</para></listitem>
+        </varlistentry>
         <varlistentry>
           <term><varname>wifi.cloned-mac-address</varname></term>
           <listitem><para>If left unspecified, it defaults to "preserve".</para></listitem>
@@ -1027,7 +1031,7 @@ managed=1
           <term><varname>wifi.backend</varname></term>
           <listitem>
             <para>
-              Specify the Wi-Fi backend used for the device. Currently supported
+              Specify the Wi-Fi backend used for the device. Currently, supported
               are <literal>wpa_supplicant</literal> and <literal>iwd</literal> (experimental).
             </para>
           </listitem>
@@ -1044,7 +1048,7 @@ managed=1
           </listitem>
         </varlistentry>
         <varlistentry id="sriov-num-vfs">
-          <term><varname>sriov-num-vfs</varname></term>
+         , <term><varname>sriov-num-vfs</varname></term>
           <listitem>
             <para>
               Specify the number of virtual functions (VF) to enable
@@ -1247,7 +1251,7 @@ enable=nm-version-min:1.2
 
 # Match against the maximum allowed version. The example matches
 # versions 1.2.0, 1.2.2, 1.2.4. Again, only the last version digit
-# is allowed to be smaller. So this would not match match on 1.1.10.
+# is allowed to be smaller. So this would not match on 1.1.10.
 [.config]
 enable=nm-version-max:1.2.6
 </programlisting>
diff --git a/man/nmcli-examples.xml b/man/nmcli-examples.xml
index a4dfc3d75c..5744ad12bb 100644
--- a/man/nmcli-examples.xml
+++ b/man/nmcli-examples.xml
@@ -222,7 +222,7 @@ B,DISPATCH</screen>
         change the configuration with <emphasis>modify</emphasis> command
         (<emphasis role="bold">nmcli con modify Team1 team.config team1-master-another-json.conf</emphasis>).
         The last two commands add slaves profiles, both enslaved to <emphasis>Team1</emphasis>.
-        The first slave will be bound to <emphasis>em1</emphasis> interface, the second to
+        The first slave will be bound to the <emphasis>em1</emphasis> interface, the second to
         <emphasis>em2</emphasis>. The slaves don't specify <emphasis>config</emphasis> and thus
         <emphasis>teamd</emphasis> will use its default configuration. You will activate the whole setup
         by activating both slaves:
@@ -302,7 +302,7 @@ IP4:192.168.1.12/24:192.168.1.1::192.168.1.1::</screen>
         VF is configured with MAC address 00:11:22:33:44:55 and VLAN
         10, the second one has the <emphasis>trust</emphasis> and
         <emphasis>spoof-check</emphasis> features respectively enabled
-        and disabled. VF number 2 has a maximux transmission rate of
+        and disabled. VF number 2 has a maximum transmission rate of
         20Mbps. The kernel is instructed to not automatically
         instantiate a network interface for the VFs.
       </para>
diff --git a/man/nmcli.xml b/man/nmcli.xml
index fdc79ad482..7ee86026ab 100644
--- a/man/nmcli.xml
+++ b/man/nmcli.xml
@@ -1506,7 +1506,7 @@
               <term><option>private</option></term>
               <listitem>
                 <para>if set to <literal>yes</literal>, the connection will only be visible
-                to the user who created it. Otherwise the connection is system-wide, which is
+                to the user who created it. Otherwise, the connection is system-wide, which is
                 the default.</para>
               </listitem>
             </varlistentry>
@@ -1514,7 +1514,7 @@
               <term><option>hidden</option></term>
               <listitem>
                 <para>set to <literal>yes</literal> when connecting for the first time to an
-                AP not broadcasting its SSID. Otherwise the SSID would not be found and the
+                AP not broadcasting its SSID. Otherwise, the SSID would not be found and the
                 connection attempt would fail.</para>
               </listitem>
             </varlistentry>
@@ -1749,35 +1749,35 @@
       <varlistentry>
         <term><option>connectivity-full</option></term>
         <listitem>
-          <para>Conectivity state when Internet is reachable.</para>
+          <para>Connectivity state when Internet is reachable.</para>
         </listitem>
       </varlistentry>
 
       <varlistentry>
         <term><option>connectivity-limited</option></term>
         <listitem>
-          <para>Conectivity state when only a local network reachable.</para>
+          <para>Connectivity state when only a local network reachable.</para>
         </listitem>
       </varlistentry>
 
       <varlistentry>
         <term><option>connectivity-none</option></term>
         <listitem>
-          <para>Conectivity state when the network is disconnected.</para>
+          <para>Connectivity state when the network is disconnected.</para>
         </listitem>
       </varlistentry>
 
       <varlistentry>
         <term><option>connectivity-portal</option></term>
         <listitem>
-          <para>Conectivity state when a captive portal hijacked the connection.</para>
+          <para>Connectivity state when a captive portal hijacked the connection.</para>
         </listitem>
       </varlistentry>
 
       <varlistentry>
         <term><option>connectivity-unknown</option></term>
         <listitem>
-          <para>Conectivity state when a connectivity check didn't run.</para>
+          <para>Connectivity state when a connectivity check didn't run.</para>
         </listitem>
       </varlistentry>
 
diff --git a/meson.build b/meson.build
index a5f14648df..a059971e55 100644
--- a/meson.build
+++ b/meson.build
@@ -6,7 +6,7 @@ project(
 #  - add corresponding NM_VERSION_x_y_z macros in
 #    "shared/nm-version-macros.h.in"
 #  - update number in configure.ac
-  version: '1.26.0',
+  version: '1.27.1',
   license: 'GPL2+',
   default_options: [
     'buildtype=debugoptimized',
@@ -253,9 +253,10 @@ libudev_dep = dependency('libudev', version: '>= 175')
 dbus_dep = dependency('dbus-1', version: '>= 1.1')
 libndp_dep = dependency('libndp')
 
-jansson_dep = dependency('jansson', version: '>= 2.5', required: false)
+jansson_dep = dependency('jansson', version: '>= 2.7', required: false)
 config_h.set10('WITH_JANSSON', jansson_dep.found())
 
+jansson_msg = 'no'
 if jansson_dep.found()
   jansson_libdir = jansson_dep.get_pkgconfig_variable('libdir')
   res = run_command(find_program('eu-readelf', 'readelf'), '-d', join_paths(jansson_libdir, 'libjansson.so'))
@@ -267,6 +268,7 @@ if jansson_dep.found()
   endforeach
   assert(jansson_soname != '', 'Unable to determine Jansson SONAME')
   config_h.set_quoted('JANSSON_SONAME', jansson_soname)
+  jansson_msg = 'yes (soname: ' + jansson_soname + ')'
 endif
 
 libsystemd_dep = dependency('libsystemd', version: '>= 209', required: false)
@@ -497,12 +499,6 @@ if enable_teamdctl
   assert(libteamdctl_dep.found(), 'You must have libteamdctl installed to build. Use -Dteamdctl=false to disable it')
 endif
 
-enable_json_validation = get_option('json_validation')
-if enable_json_validation
-  assert(jansson_dep.found(), 'jansson is needed for team configuration validation. Use -Djson_validation=false to disable it')
-endif
-config_h.set10('WITH_JSON_VALIDATION', enable_json_validation)
-
 # polkit
 enable_polkit = get_option('polkit')
 if enable_polkit
@@ -1013,6 +1009,7 @@ if enable_ppp
   output += ' ' + pppd_path + ' plugins:' + pppd_plugin_dir
 endif
 output += '\n'
+output += '  jansson: ' + jansson_msg + '\n'
 output += '  modemmanager-1: ' + enable_modem_manager.to_string() + '\n'
 output += '  ofono: ' + enable_ofono.to_string() + '\n'
 output += '  concheck: ' + enable_concheck.to_string() + '\n'
@@ -1047,7 +1044,6 @@ output += '\n'
 output += '  code coverage: ' + get_option('b_coverage').to_string() + '\n'
 output += '  LTO: ' + enable_lto.to_string() + '\n'
 output += '  Linker garbage collection: ' + enable_ld_gc.to_string() + '\n'
-output += '  JSON validation for libnm: ' + enable_json_validation.to_string() + '\n'
 output += '  crypto: ' + crypto + '\n'
 output += '  sanitizers: ' + get_option('b_sanitize') + '\n'
 output += '  Mozilla Public Suffix List: ' + enable_libpsl.to_string() + '\n'
diff --git a/meson_options.txt b/meson_options.txt
index a5c6a22fb0..d6306711ec 100644
--- a/meson_options.txt
+++ b/meson_options.txt
@@ -69,6 +69,5 @@ option('valgrind', type: 'array', value: ['no'], description: 'Use valgrind to m
 option('valgrind_suppressions', type: 'string', value: '', description: 'Use specific valgrind suppression file')
 option('ld_gc', type: 'boolean', value: true, description: 'Enable garbage collection of unused symbols on linking')
 option('libpsl', type: 'boolean', value: true, description: 'Link against libpsl')
-option('json_validation', type: 'boolean', value: true, description: 'Enable JSON validation in libnm')
 option('crypto', type: 'combo', choices: ['nss', 'gnutls'], value: 'nss', description: 'Cryptography library to use for certificate and key operations')
 option('qt', type: 'boolean', value: true, description: 'enable Qt examples')
diff --git a/po/uk.po b/po/uk.po
index 56d718a3c2..3e57e2d8c1 100644
--- a/po/uk.po
+++ b/po/uk.po
@@ -10,8 +10,8 @@ msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: https://gitlab.freedesktop.org/NetworkManager/NetworkMan"
 "ager/issues\n"
-"POT-Creation-Date: 2020-06-17 03:27+0000\n"
-"PO-Revision-Date: 2020-06-17 14:43+0300\n"
+"POT-Creation-Date: 2020-07-04 03:28+0000\n"
+"PO-Revision-Date: 2020-07-04 12:04+0300\n"
 "Last-Translator: Yuri Chornoivan <yurchor@ukr.net>\n"
 "Language-Team: Ukrainian <kde-i18n-uk@kde.org>\n"
 "Language: uk\n"
@@ -1105,9 +1105,9 @@ msgstr "Профілі з'єднань NetworkManager"
 #: ../clients/cli/devices.c:3527 ../clients/cli/devices.c:4047
 #: ../clients/cli/devices.c:4058 ../clients/cli/devices.c:4067
 #: ../clients/cli/devices.c:4081 ../clients/cli/devices.c:4098
-#: ../clients/cli/devices.c:4107 ../clients/cli/devices.c:4254
-#: ../clients/cli/devices.c:4265 ../clients/cli/devices.c:4481
-#: ../clients/cli/devices.c:4653
+#: ../clients/cli/devices.c:4107 ../clients/cli/devices.c:4253
+#: ../clients/cli/devices.c:4264 ../clients/cli/devices.c:4480
+#: ../clients/cli/devices.c:4652
 #, c-format
 msgid "Error: %s argument is missing."
 msgstr "Помилка: пропущено аргумент %s."
@@ -1123,13 +1123,13 @@ msgstr "Помилка: профілю з'єднання %s не існує."
 #: ../clients/cli/devices.c:1801 ../clients/cli/devices.c:2069
 #: ../clients/cli/devices.c:2239 ../clients/cli/devices.c:2352
 #: ../clients/cli/devices.c:2541 ../clients/cli/devices.c:3318
-#: ../clients/cli/devices.c:4218 ../clients/cli/devices.c:4660
+#: ../clients/cli/devices.c:4217 ../clients/cli/devices.c:4659
 #: ../clients/cli/general.c:997
 #, c-format
 msgid "Error: %s."
 msgstr "Помилка: %s."
 
-#: ../clients/cli/connections.c:2389 ../clients/cli/devices.c:4432
+#: ../clients/cli/connections.c:2389 ../clients/cli/devices.c:4431
 #, c-format
 msgid "no active connection on device '%s'"
 msgstr "на пристрої «%s» немає активних з'єднань"
@@ -1202,8 +1202,8 @@ msgstr "некоректний файл passwd «%s»: %s"
 #: ../clients/cli/devices.c:1759 ../clients/cli/devices.c:1807
 #: ../clients/cli/devices.c:2245 ../clients/cli/devices.c:3181
 #: ../clients/cli/devices.c:3540 ../clients/cli/devices.c:4117
-#: ../clients/cli/devices.c:4271 ../clients/cli/devices.c:4491
-#: ../clients/cli/devices.c:4665
+#: ../clients/cli/devices.c:4270 ../clients/cli/devices.c:4490
+#: ../clients/cli/devices.c:4664
 #, c-format
 msgid "Error: invalid extra argument '%s'."
 msgstr "Помилка: некоректний додатковий аргумент, «%s»."
@@ -1397,7 +1397,7 @@ msgstr "Запис з'єднання «%s» (%s) успішно додано.\n"
 #: ../clients/cli/connections.c:5008 ../clients/cli/connections.c:6934
 #: ../clients/cli/connections.c:6935 ../clients/cli/devices.c:525
 #: ../clients/cli/devices.c:532 ../clients/cli/devices.c:1250
-#: ../clients/cli/general.c:93 ../clients/cli/utils.h:294
+#: ../clients/cli/general.c:93 ../clients/cli/utils.h:312
 #: ../clients/common/nm-client-utils.c:303
 #: ../clients/common/nm-meta-setting-desc.c:871
 #: ../clients/common/nm-meta-setting-desc.c:2675
@@ -1407,7 +1407,7 @@ msgstr "ні"
 #: ../clients/cli/connections.c:5009 ../clients/cli/connections.c:6934
 #: ../clients/cli/connections.c:6935 ../clients/cli/devices.c:524
 #: ../clients/cli/devices.c:531 ../clients/cli/devices.c:1250
-#: ../clients/cli/general.c:92 ../clients/cli/utils.h:294
+#: ../clients/cli/general.c:92 ../clients/cli/utils.h:312
 #: ../clients/common/nm-client-utils.c:302
 #: ../clients/common/nm-meta-setting-desc.c:871
 #: ../clients/common/nm-meta-setting-desc.c:2672
@@ -1793,13 +1793,29 @@ msgstr ""
 
 #: ../clients/cli/connections.c:6713
 #, c-format
+#| msgid ""
+#| "remove [<value>|<index>|<option name>]  :: delete the value\n"
+#| "\n"
+#| "Removes the property value. For single-valued properties, this sets the\n"
+#| "property back to its default value. For container-type properties, this "
+#| "removes\n"
+#| "all the values of that property, or you can specify an argument to remove "
+#| "just\n"
+#| "a single item or option. The argument is either a value or index of the "
+#| "item to\n"
+#| "remove, or an option name (for properties with named options).\n"
+#| "\n"
+#| "Examples: nmcli ipv4.dns> remove 8.8.8.8\n"
+#| "          nmcli ipv4.dns> remove 2\n"
+#| "          nmcli bond.options> remove downdelay\n"
+#| "\n"
 msgid ""
 "remove [<value>|<index>|<option name>]  :: delete the value\n"
 "\n"
 "Removes the property value. For single-valued properties, this sets the\n"
 "property back to its default value. For container-type properties, this "
 "removes\n"
-"all the values of that property, or you can specify an argument to remove "
+"all the values of that property or you can specify an argument to remove "
 "just\n"
 "a single item or option. The argument is either a value or index of the item "
 "to\n"
@@ -2413,10 +2429,6 @@ msgstr "Інтерфейси: "
 msgid "(none)"
 msgstr "(немає)"
 
-#: ../clients/cli/devices.c:171 ../clients/cli/devices.c:178
-msgid "(unknown)"
-msgstr "(невідомо)"
-
 #: ../clients/cli/devices.c:329
 #, c-format
 msgid "<invisible> | %s"
@@ -2609,13 +2621,33 @@ msgstr ""
 
 #: ../clients/cli/devices.c:805
 #, c-format
+#| msgid ""
+#| "Usage: nmcli device modify { ARGUMENTS | --help }\n"
+#| "\n"
+#| "ARGUMENTS := <ifname> ([+|-]<setting>.<property> <value>)+\n"
+#| "\n"
+#| "Modify one or more properties currently active on the device without "
+#| "modifying\n"
+#| "the connection profile. The changes have immediate effect. For multi-"
+#| "valued\n"
+#| "properties you can use optional '+' or '-' prefix to the property name.\n"
+#| "The '+' sign allows appending items instead of overwriting the whole "
+#| "value.\n"
+#| "The '-' sign allows removing selected items instead of the whole value.\n"
+#| "\n"
+#| "Examples:\n"
+#| "nmcli dev mod em1 ipv4.method manual ipv4.addr \"192.168.1.2/24, "
+#| "10.10.1.5/8\"\n"
+#| "nmcli dev mod em1 +ipv4.dns 8.8.4.4\n"
+#| "nmcli dev mod em1 -ipv4.dns 1\n"
+#| "nmcli dev mod em1 -ipv6.addr \"abbe::cafe/56\"\n"
 msgid ""
 "Usage: nmcli device modify { ARGUMENTS | --help }\n"
 "\n"
 "ARGUMENTS := <ifname> ([+|-]<setting>.<property> <value>)+\n"
 "\n"
-"Modify one or more properties currently active on the device without "
-"modifying\n"
+"Modify one or more properties that are currently active on the device "
+"without modifying\n"
 "the connection profile. The changes have immediate effect. For multi-valued\n"
 "properties you can use optional '+' or '-' prefix to the property name.\n"
 "The '+' sign allows appending items instead of overwriting the whole value.\n"
@@ -3108,8 +3140,8 @@ msgstr ""
 "додаток Wi-Fi NetworkManager."
 
 #: ../clients/cli/devices.c:3241 ../clients/cli/devices.c:3570
-#: ../clients/cli/devices.c:4159 ../clients/cli/devices.c:4287
-#: ../clients/cli/devices.c:4420
+#: ../clients/cli/devices.c:4159 ../clients/cli/devices.c:4286
+#: ../clients/cli/devices.c:4419
 #, c-format
 msgid "Error: Device '%s' is not a Wi-Fi device."
 msgstr "Помилка: пристрій «%s» не є пристроєм Wi-Fi."
@@ -3153,7 +3185,7 @@ msgid "Error: Parameter '%s' is neither SSID nor BSSID."
 msgstr "Помилка: параметр «%s» не дорівнює ні SSID, ні BSSID."
 
 #: ../clients/cli/devices.c:3572 ../clients/cli/devices.c:4161
-#: ../clients/cli/devices.c:4289 ../clients/cli/devices.c:4525
+#: ../clients/cli/devices.c:4288 ../clients/cli/devices.c:4524
 #, c-format
 msgid "Error: No Wi-Fi device found."
 msgstr "Помилка: не знайдено жодного пристрою Wi-Fi."
@@ -3235,27 +3267,27 @@ msgstr ""
 "Помилка: для пристрою «%s» не передбачено ні режиму точки доступу, ні режиму "
 "Ad-Hoc."
 
-#: ../clients/cli/devices.c:4196
+#: ../clients/cli/devices.c:4195
 #, c-format
 msgid "Error: Invalid 'password': %s."
 msgstr "Помилка: некоректне значення «password»: %s."
 
-#: ../clients/cli/devices.c:4247 ../clients/cli/devices.c:4472
+#: ../clients/cli/devices.c:4246 ../clients/cli/devices.c:4471
 #, c-format
 msgid "Error: '%s' cannot repeat."
 msgstr "Помилка: не можна повторювати «%s»."
 
-#: ../clients/cli/devices.c:4378 ../clients/cli/devices.c:4382
-#: ../clients/cli/devices.c:4387 ../clients/cli/devices.c:4390
+#: ../clients/cli/devices.c:4377 ../clients/cli/devices.c:4381
+#: ../clients/cli/devices.c:4386 ../clients/cli/devices.c:4389
 #: ../clients/tui/nmt-page-wifi.c:250
 msgid "Security"
 msgstr "Захист"
 
-#: ../clients/cli/devices.c:4378
+#: ../clients/cli/devices.c:4377
 msgid "None"
 msgstr "Немає"
 
-#: ../clients/cli/devices.c:4394 ../clients/common/nm-secret-agent-simple.c:273
+#: ../clients/cli/devices.c:4393 ../clients/common/nm-secret-agent-simple.c:273
 #: ../clients/common/nm-secret-agent-simple.c:310
 #: ../clients/common/nm-secret-agent-simple.c:333
 #: ../clients/common/nm-secret-agent-simple.c:366
@@ -3271,17 +3303,17 @@ msgstr "Немає"
 msgid "Password"
 msgstr "Пароль"
 
-#: ../clients/cli/devices.c:4512
+#: ../clients/cli/devices.c:4511
 #, c-format
 msgid "%s"
 msgstr "%s"
 
 #. Main header name
-#: ../clients/cli/devices.c:4566
+#: ../clients/cli/devices.c:4565
 msgid "Device LLDP neighbors"
 msgstr "LLDP-сусіди пристрою"
 
-#: ../clients/cli/devices.c:4683
+#: ../clients/cli/devices.c:4682
 #, c-format
 msgid "Error: 'device lldp list': %s"
 msgstr "Помилка: «device lldp list»: %s"
@@ -4198,20 +4230,24 @@ msgstr "Не вдалося створити відгалуження пейдж
 msgid "Failed to duplicate pager pipe: %s\n"
 msgstr "Не вдалося здублювати конвеєр пейджера: %s\n"
 
-#: ../clients/cli/utils.h:300 ../clients/common/nm-meta-setting-desc.c:4129
+#: ../clients/cli/utils.h:306
+msgid "(unknown)"
+msgstr "(невідомо)"
+
+#: ../clients/cli/utils.h:318 ../clients/common/nm-meta-setting-desc.c:4129
 msgid "on"
 msgstr "увімкн."
 
-#: ../clients/cli/utils.h:300 ../clients/common/nm-meta-setting-desc.c:4130
+#: ../clients/cli/utils.h:318 ../clients/common/nm-meta-setting-desc.c:4130
 msgid "off"
 msgstr "вимкн."
 
-#: ../clients/cli/utils.h:326
+#: ../clients/cli/utils.h:344
 #, c-format
 msgid "%lld (%s)"
 msgstr "%lld (%s)"
 
-#: ../clients/cli/utils.h:333
+#: ../clients/cli/utils.h:351
 #, c-format
 msgid "%lld - %s"
 msgstr "%lld — %s"
@@ -4790,7 +4826,7 @@ msgid "invalid option '%s', use a combination of [%s]"
 msgstr "некоректний параметр «%s», скористайтеся комбінацією [%s]"
 
 #: ../clients/common/nm-meta-setting-desc.c:1595
-#: ../libnm-core/nm-keyfile/nm-keyfile.c:1076
+#: ../libnm-core/nm-keyfile/nm-keyfile.c:1077
 #, c-format
 msgid "invalid option '%s', use one of [%s]"
 msgstr ""
@@ -5079,8 +5115,8 @@ msgstr "«%ld» не є коректним каналом"
 #: ../clients/common/nm-meta-setting-desc.c:3975
 #: ../libnm-core/nm-setting-sriov.c:438 ../libnm-core/nm-setting-wired.c:758
 #: ../libnm-core/nm-setting-wired.c:771 ../libnm-core/nm-setting-wired.c:824
-#: ../libnm-core/nm-setting-wired.c:867 ../libnm-core/nm-setting-wireless.c:881
-#: ../libnm-core/nm-setting-wireless.c:897
+#: ../libnm-core/nm-setting-wired.c:867 ../libnm-core/nm-setting-wireless.c:899
+#: ../libnm-core/nm-setting-wireless.c:915
 #, c-format
 msgid "'%s' is not a valid MAC address"
 msgstr "%s не є припустимою MAC-адресою"
@@ -5342,7 +5378,7 @@ msgstr "Адреса пристрою Bluetooth"
 #: ../clients/common/nm-meta-setting-desc.c:7200
 #: ../clients/common/nm-meta-setting-desc.c:7238
 #: ../clients/common/nm-meta-setting-desc.c:7420
-#: ../clients/common/nm-meta-setting-desc.c:7650
+#: ../clients/common/nm-meta-setting-desc.c:7653
 msgid "MAC [none]"
 msgstr "MAC [типово немає]"
 
@@ -5782,7 +5818,7 @@ msgstr ""
 "\n"
 "Приклад: 0.0.0e20 0.0.0e21 0.0.0e22\n"
 
-#: ../clients/common/nm-meta-setting-desc.c:7599
+#: ../clients/common/nm-meta-setting-desc.c:7602
 msgid ""
 "Enter the type of WEP keys. The accepted values are: 0 or unknown, 1 or key, "
 "and 2 or passphrase.\n"
@@ -5790,221 +5826,221 @@ msgstr ""
 "Вкажіть тип ключів WEP. Можливі значення: 0 або unknown (невідомо), 1 або "
 "key (ключ) та 2 або passphrase (пароль).\n"
 
-#: ../clients/common/nm-meta-setting-desc.c:7658
+#: ../clients/common/nm-meta-setting-desc.c:7661
 msgid "Short address (<0x0000-0xffff>)"
 msgstr "Коротка адреса (<0x0000-0xffff>)"
 
-#: ../clients/common/nm-meta-setting-desc.c:7674
+#: ../clients/common/nm-meta-setting-desc.c:7677
 msgid "PAN Identifier (<0x0000-0xffff>)"
 msgstr "Ідентифікатор PAN (<0x0000-0xffff>)"
 
-#: ../clients/common/nm-meta-setting-desc.c:7689
+#: ../clients/common/nm-meta-setting-desc.c:7692
 msgid "Page (<default|0-31>)"
 msgstr "Сторінка (<default|0-31>)"
 
-#: ../clients/common/nm-meta-setting-desc.c:7703
+#: ../clients/common/nm-meta-setting-desc.c:7706
 msgid "Channel (<default|0-26>)"
 msgstr "Канал (<default|0-26>)"
 
 #. ***************************************************************************
-#: ../clients/common/nm-meta-setting-desc.c:7838
+#: ../clients/common/nm-meta-setting-desc.c:7841
 msgid "6LOWPAN settings"
 msgstr "Параметри 6LOWPAN"
 
-#: ../clients/common/nm-meta-setting-desc.c:7839
+#: ../clients/common/nm-meta-setting-desc.c:7842
 msgid "802-1x settings"
 msgstr "Параметри 802-1x"
 
-#: ../clients/common/nm-meta-setting-desc.c:7840
+#: ../clients/common/nm-meta-setting-desc.c:7843
 #: ../src/devices/adsl/nm-device-adsl.c:117
 msgid "ADSL connection"
 msgstr "З'єднання ADSL"
 
-#: ../clients/common/nm-meta-setting-desc.c:7841
+#: ../clients/common/nm-meta-setting-desc.c:7844
 msgid "bluetooth connection"
 msgstr "з'єднання bluetooth"
 
-#: ../clients/common/nm-meta-setting-desc.c:7842
+#: ../clients/common/nm-meta-setting-desc.c:7845
 msgid "Bond device"
 msgstr "Пристрій Bond"
 
-#: ../clients/common/nm-meta-setting-desc.c:7843
+#: ../clients/common/nm-meta-setting-desc.c:7846
 msgid "Bridge device"
 msgstr "Пристрій містка"
 
-#: ../clients/common/nm-meta-setting-desc.c:7844
+#: ../clients/common/nm-meta-setting-desc.c:7847
 msgid "Bridge port"
 msgstr "Порт містка"
 
-#: ../clients/common/nm-meta-setting-desc.c:7845
+#: ../clients/common/nm-meta-setting-desc.c:7848
 msgid "CDMA mobile broadband connection"
 msgstr "мобільне широкосмугове з'єднання CDMA"
 
-#: ../clients/common/nm-meta-setting-desc.c:7846
+#: ../clients/common/nm-meta-setting-desc.c:7849
 msgid "General settings"
 msgstr "Загальні параметри"
 
-#: ../clients/common/nm-meta-setting-desc.c:7847
+#: ../clients/common/nm-meta-setting-desc.c:7850
 msgid "DCB settings"
 msgstr "Параметри DCB"
 
-#: ../clients/common/nm-meta-setting-desc.c:7848
+#: ../clients/common/nm-meta-setting-desc.c:7851
 msgid "Dummy settings"
 msgstr "Фіктивні параметри"
 
-#: ../clients/common/nm-meta-setting-desc.c:7849
+#: ../clients/common/nm-meta-setting-desc.c:7852
 msgid "Ethtool settings"
 msgstr "Параметри Ethtool"
 
-#: ../clients/common/nm-meta-setting-desc.c:7850
+#: ../clients/common/nm-meta-setting-desc.c:7853
 msgid "Generic settings"
 msgstr "Загальні параметри"
 
-#: ../clients/common/nm-meta-setting-desc.c:7851
+#: ../clients/common/nm-meta-setting-desc.c:7854
 msgid "GSM mobile broadband connection"
 msgstr "мобільне широкосмугове з'єднання GSM"
 
-#: ../clients/common/nm-meta-setting-desc.c:7852
+#: ../clients/common/nm-meta-setting-desc.c:7855
 #: ../src/devices/nm-device-infiniband.c:158
 msgid "InfiniBand connection"
 msgstr "З'єднання InfiniBand"
 
-#: ../clients/common/nm-meta-setting-desc.c:7853
+#: ../clients/common/nm-meta-setting-desc.c:7856
 msgid "IPv4 protocol"
 msgstr "Протокол IPv4"
 
-#: ../clients/common/nm-meta-setting-desc.c:7854
+#: ../clients/common/nm-meta-setting-desc.c:7857
 msgid "IPv6 protocol"
 msgstr "Протокол IPv6"
 
-#: ../clients/common/nm-meta-setting-desc.c:7855
+#: ../clients/common/nm-meta-setting-desc.c:7858
 msgid "IP-tunnel settings"
 msgstr "Параметри IP-тунелювання"
 
-#: ../clients/common/nm-meta-setting-desc.c:7856
+#: ../clients/common/nm-meta-setting-desc.c:7859
 msgid "MACsec connection"
 msgstr "З'єднання MACsec"
 
-#: ../clients/common/nm-meta-setting-desc.c:7857
+#: ../clients/common/nm-meta-setting-desc.c:7860
 msgid "macvlan connection"
 msgstr "З'єднання MACVLAN"
 
-#: ../clients/common/nm-meta-setting-desc.c:7858
+#: ../clients/common/nm-meta-setting-desc.c:7861
 msgid "Match"
 msgstr "Відповідність"
 
-#: ../clients/common/nm-meta-setting-desc.c:7859
+#: ../clients/common/nm-meta-setting-desc.c:7862
 msgid "OLPC Mesh connection"
 msgstr "З'єднання OLPC Mesh"
 
-#: ../clients/common/nm-meta-setting-desc.c:7860
+#: ../clients/common/nm-meta-setting-desc.c:7863
 msgid "Open vSwitch bridge settings"
 msgstr "Параметри містка Open vSwitch"
 
-#: ../clients/common/nm-meta-setting-desc.c:7861
+#: ../clients/common/nm-meta-setting-desc.c:7864
 msgid "Open vSwitch DPDK interface settings"
 msgstr "Параметри інтерфейсу Open vSwitch DPDK"
 
-#: ../clients/common/nm-meta-setting-desc.c:7862
+#: ../clients/common/nm-meta-setting-desc.c:7865
 msgid "Open vSwitch interface settings"
 msgstr "Параметри інтерфейсу Open vSwitch"
 
-#: ../clients/common/nm-meta-setting-desc.c:7863
+#: ../clients/common/nm-meta-setting-desc.c:7866
 msgid "Open vSwitch patch interface settings"
 msgstr "Параметри інтерфейсу латок Open vSwitch"
 
-#: ../clients/common/nm-meta-setting-desc.c:7864
+#: ../clients/common/nm-meta-setting-desc.c:7867
 msgid "Open vSwitch port settings"
 msgstr "Параметри портів Open vSwitch"
 
-#: ../clients/common/nm-meta-setting-desc.c:7865
+#: ../clients/common/nm-meta-setting-desc.c:7868
 msgid "PPP settings"
 msgstr "Параметри PPP"
 
-#: ../clients/common/nm-meta-setting-desc.c:7866
+#: ../clients/common/nm-meta-setting-desc.c:7869
 msgid "PPPoE"
 msgstr "PPPoE"
 
-#: ../clients/common/nm-meta-setting-desc.c:7867
+#: ../clients/common/nm-meta-setting-desc.c:7870
 msgid "Proxy"
 msgstr "Проксі"
 
-#: ../clients/common/nm-meta-setting-desc.c:7868
+#: ../clients/common/nm-meta-setting-desc.c:7871
 msgid "Serial settings"
 msgstr "Параметри послідовного з'єднання"
 
-#: ../clients/common/nm-meta-setting-desc.c:7869
+#: ../clients/common/nm-meta-setting-desc.c:7872
 msgid "SR-IOV settings"
 msgstr "Параметри SR-IOV"
 
-#: ../clients/common/nm-meta-setting-desc.c:7870
+#: ../clients/common/nm-meta-setting-desc.c:7873
 msgid "Traffic controls"
 msgstr "Засоби керування обміном даними"
 
-#: ../clients/common/nm-meta-setting-desc.c:7871
+#: ../clients/common/nm-meta-setting-desc.c:7874
 msgid "Team device"
 msgstr "Пристрій Team"
 
-#: ../clients/common/nm-meta-setting-desc.c:7872
+#: ../clients/common/nm-meta-setting-desc.c:7875
 msgid "Team port"
 msgstr "Порт Team"
 
-#: ../clients/common/nm-meta-setting-desc.c:7873
+#: ../clients/common/nm-meta-setting-desc.c:7876
 msgid "Tun device"
 msgstr "Пристрій TUN"
 
-#: ../clients/common/nm-meta-setting-desc.c:7874
+#: ../clients/common/nm-meta-setting-desc.c:7877
 msgid "User settings"
 msgstr "Параметри користувача"
 
-#: ../clients/common/nm-meta-setting-desc.c:7875
+#: ../clients/common/nm-meta-setting-desc.c:7878
 #: ../src/devices/nm-device-vlan.c:385
 msgid "VLAN connection"
 msgstr "З'єднання VLAN"
 
-#: ../clients/common/nm-meta-setting-desc.c:7876 ../src/nm-manager.c:5697
+#: ../clients/common/nm-meta-setting-desc.c:7879 ../src/nm-manager.c:5697
 msgid "VPN connection"
 msgstr "З'єднання VPN"
 
-#: ../clients/common/nm-meta-setting-desc.c:7877
+#: ../clients/common/nm-meta-setting-desc.c:7880
 #: ../src/devices/nm-device-vrf.c:175
 msgid "VRF connection"
 msgstr "З'єднання VRF"
 
-#: ../clients/common/nm-meta-setting-desc.c:7878
+#: ../clients/common/nm-meta-setting-desc.c:7881
 #: ../src/devices/nm-device-vxlan.c:354
 msgid "VXLAN connection"
 msgstr "З'єднання VXLAN"
 
-#: ../clients/common/nm-meta-setting-desc.c:7879
+#: ../clients/common/nm-meta-setting-desc.c:7882
 msgid "Wi-Fi P2P connection"
 msgstr "З'єднання P2P Wi-Fi"
 
-#: ../clients/common/nm-meta-setting-desc.c:7880
+#: ../clients/common/nm-meta-setting-desc.c:7883
 msgid "WiMAX connection"
 msgstr "З'єднання WiMAX"
 
-#: ../clients/common/nm-meta-setting-desc.c:7881
+#: ../clients/common/nm-meta-setting-desc.c:7884
 msgid "Wired Ethernet"
 msgstr "Дротовий Ethernet"
 
-#: ../clients/common/nm-meta-setting-desc.c:7882
+#: ../clients/common/nm-meta-setting-desc.c:7885
 msgid "WireGuard VPN settings"
 msgstr "Параметри VPN WireGuard"
 
-#: ../clients/common/nm-meta-setting-desc.c:7883
+#: ../clients/common/nm-meta-setting-desc.c:7886
 msgid "Wi-Fi connection"
 msgstr "З'єднання Wi-Fi"
 
-#: ../clients/common/nm-meta-setting-desc.c:7884
+#: ../clients/common/nm-meta-setting-desc.c:7887
 msgid "Wi-Fi security settings"
 msgstr "Параметри захисту Wi-Fi"
 
-#: ../clients/common/nm-meta-setting-desc.c:7885
+#: ../clients/common/nm-meta-setting-desc.c:7888
 msgid "WPAN settings"
 msgstr "Параметри WPAN"
 
-#: ../clients/common/nm-meta-setting-desc.c:8262
+#: ../clients/common/nm-meta-setting-desc.c:8265
 msgid "name"
 msgstr "назва"
 
@@ -6243,6 +6279,35 @@ msgstr "SSID мережі mesh, до якої слід долучитися."
 
 #: ../clients/common/settings-docs.h.in:7
 msgid ""
+"Configures AP isolation, which prevents communication between wireless "
+"devices connected to this AP. This property can be set to a value different "
+"from NM_TERNARY_DEFAULT (-1) only when the interface is configured in AP "
+"mode. If set to NM_TERNARY_TRUE (1), devices are not able to communicate "
+"with each other. This increases security because it protects devices against "
+"attacks from other clients in the network. At the same time, it prevents "
+"devices to access resources on the same wireless networks as file shares, "
+"printers, etc. If set to NM_TERNARY_FALSE (0), devices can talk to each "
+"other. When set to NM_TERNARY_DEFAULT (-1), the global default is used; in "
+"case the global default is unspecified it is assumed to be NM_TERNARY_FALSE "
+"(0)."
+msgstr ""
+"Налаштовує ізоляцію точки доступу, яка запобігає обміну даними між"
+" бездротовими пристроями, які з'єднано із цією точкою доступу. Для цієї"
+" властивості ви можете встановити значення, яке відрізняється від"
+" NM_TERNARY_DEFAULT (-1), лише якщо інтерфейс налаштовано у режимі точки"
+" доступу. Якщо встановити значення NM_TERNARY_TRUE (1), пристрої не зможуть"
+" обмінюватися даними один із одним. Це підвищує захист, оскільки запобігає"
+" атакам на пристрій з боку інших клієнтів у мережі. Одночасно, це закриває"
+" пристроям доступ до ресурсів у цій бездротовій мережі, зокрема закриває"
+" доступу до файлів спільного користування, принтерів тощо. Якщо встановити"
+" значення NM_TERNARY_FALSE (0), пристрої зможуть обмінюватися даними один з"
+" одним. Якщо встановити значення NM_TERNARY_DEFAULT (-1), буде використано"
+" загальні типові налаштування; якщо загальні типові налаштування не"
+" визначено, буде використано значення NM_TERNARY_FALSE "
+"(0)."
+
+#: ../clients/common/settings-docs.h.in:8
+msgid ""
 "802.11 frequency band of the network.  One of \"a\" for 5GHz 802.11a or \"bg"
 "\" for 2.4GHz 802.11.  This will lock associations to the Wi-Fi network to "
 "the specific band, i.e. if \"a\" is specified, the device will not associate "
@@ -6257,7 +6322,7 @@ msgstr ""
 "сумісними. Використання цього параметра залежить від можливостей певного "
 "драйвера і можливе не для усіх драйверів."
 
-#: ../clients/common/settings-docs.h.in:8
+#: ../clients/common/settings-docs.h.in:9
 msgid ""
 "If specified, directs the device to only associate with the given access "
 "point.  This capability is highly driver dependent and not supported by all "
@@ -6270,7 +6335,7 @@ msgstr ""
 "використовується для створення ситуативної мережі, і малоймовірно, що "
 "керуватиме ним у майбутньому."
 
-#: ../clients/common/settings-docs.h.in:9
+#: ../clients/common/settings-docs.h.in:10
 msgid ""
 "Wireless channel to use for the Wi-Fi connection.  The device will only join "
 "(or create for Ad-Hoc networks) a Wi-Fi network on the specified channel.  "
@@ -6283,7 +6348,7 @@ msgstr ""
 "різних смугах перекриваються, для використання цієї властивості має бути "
 "також встановлено властивість «band»."
 
-#: ../clients/common/settings-docs.h.in:10
+#: ../clients/common/settings-docs.h.in:11
 msgid ""
 "If specified, request that the device use this MAC address instead. This is "
 "known as MAC cloning or spoofing. Beside explicitly specifying a MAC "
@@ -6313,8 +6378,8 @@ msgstr ""
 "використовуватися інше типове значення). У D-Bus це поле позначається як "
 "«assigned-mac-address», а у застарілих версіях, як «cloned-mac-address»."
 
-#: ../clients/common/settings-docs.h.in:11
-#: ../clients/common/settings-docs.h.in:94
+#: ../clients/common/settings-docs.h.in:12
+#: ../clients/common/settings-docs.h.in:95
 msgid ""
 "With \"cloned-mac-address\" setting \"random\" or \"stable\", by default all "
 "bits of the MAC address are scrambled and a locally-administered, unicast "
@@ -6367,7 +6432,7 @@ msgstr ""
 "буде створено повністю перемішану MAC-адресу із випадковим локальним або "
 "глобальним адмініструванням."
 
-#: ../clients/common/settings-docs.h.in:12
+#: ../clients/common/settings-docs.h.in:13
 msgid ""
 "If TRUE, indicates that the network is a non-broadcasting network that hides "
 "its SSID. This works both in infrastructure and AP mode. In infrastructure "
@@ -6391,7 +6456,7 @@ msgstr ""
 "інфраструктури) або клієнтських станцій (у режимі точки доступу), оскільки "
 "явне зондування можна буде легко виявити в ефірі."
 
-#: ../clients/common/settings-docs.h.in:13
+#: ../clients/common/settings-docs.h.in:14
 msgid ""
 "If specified, this connection will only apply to the Wi-Fi device whose "
 "permanent MAC address matches. This property does not change the MAC address "
@@ -6401,7 +6466,7 @@ msgstr ""
 "відповідною сталою адресою MAC. Ця властивість не змінює MAC-адреси пристрою "
 "(таку зміну називають підміною MAC)."
 
-#: ../clients/common/settings-docs.h.in:14
+#: ../clients/common/settings-docs.h.in:15
 msgid ""
 "A list of permanent MAC addresses of Wi-Fi devices to which this connection "
 "should never apply.  Each MAC address should be given in the standard hex-"
@@ -6412,7 +6477,7 @@ msgstr ""
 "стандартного запису із шістнадцяткових цифр із двокрапками (наприклад, "
 "«00:11:22:33:44:55»)."
 
-#: ../clients/common/settings-docs.h.in:15
+#: ../clients/common/settings-docs.h.in:16
 msgid ""
 "One of NM_SETTING_MAC_RANDOMIZATION_DEFAULT (0) (never randomize unless the "
 "user has set a global default to randomize and the supplicant supports "
@@ -6430,7 +6495,7 @@ msgstr ""
 "випадковим чином). Якщо властивість вважається застарілою, використовуйте "
 "замість неї «cloned-mac-address». Застаріла: 1"
 
-#: ../clients/common/settings-docs.h.in:16
+#: ../clients/common/settings-docs.h.in:17
 msgid ""
 "Wi-Fi network mode; one of \"infrastructure\", \"mesh\", \"adhoc\" or \"ap"
 "\".  If blank, infrastructure is assumed."
@@ -6438,8 +6503,8 @@ msgstr ""
 "Режим роботи мережі Wi-Fi. Одне з таких значень: «infrastructure», «mesh», "
 "«adhoc» або «ap». Якщо не вказано, використовується режим «infrastructure»."
 
-#: ../clients/common/settings-docs.h.in:17
-#: ../clients/common/settings-docs.h.in:97
+#: ../clients/common/settings-docs.h.in:18
+#: ../clients/common/settings-docs.h.in:98
 msgid ""
 "If non-zero, only transmit packets of the specified size or smaller, "
 "breaking larger packets up into multiple Ethernet frames."
@@ -6447,7 +6512,7 @@ msgstr ""
 "Якщо має ненульове значення, передавати пакети лише вказаного або меншого "
 "розміру, розбиваючи великі пакети на декілька кадрів Ethernet."
 
-#: ../clients/common/settings-docs.h.in:18
+#: ../clients/common/settings-docs.h.in:19
 msgid ""
 "One of NM_SETTING_WIRELESS_POWERSAVE_DISABLE (2) (disable Wi-Fi power "
 "saving), NM_SETTING_WIRELESS_POWERSAVE_ENABLE (3) (enable Wi-Fi power "
@@ -6462,7 +6527,7 @@ msgstr ""
 "або NM_SETTING_WIRELESS_POWERSAVE_DEFAULT (0) (використовувати налаштоване "
 "на загальному рівні значення). Усі інші значення поки зарезервовано."
 
-#: ../clients/common/settings-docs.h.in:19
+#: ../clients/common/settings-docs.h.in:20
 msgid ""
 "If non-zero, directs the device to only use the specified bitrate for "
 "communication with the access point.  Units are in Kb/s, ie 5500 = 5.5 Mbit/"
@@ -6475,7 +6540,7 @@ msgstr ""
 "властивості дуже залежить від драйвера. Підтримку встановлення статичної "
 "бітової швидкості передбачено не для усіх пристрої."
 
-#: ../clients/common/settings-docs.h.in:20
+#: ../clients/common/settings-docs.h.in:21
 msgid ""
 "A list of BSSIDs (each BSSID formatted as a MAC address like "
 "\"00:11:22:33:44:55\") that have been detected as part of the Wi-Fi "
@@ -6490,11 +6555,11 @@ msgstr ""
 "NetworkManager. Зміни, які буде внесено до значення цієї властивості не "
 "зберігатимуться."
 
-#: ../clients/common/settings-docs.h.in:21
+#: ../clients/common/settings-docs.h.in:22
 msgid "SSID of the Wi-Fi network. Must be specified."
 msgstr "SSID мережі Wi-Fi. Має бути вказано."
 
-#: ../clients/common/settings-docs.h.in:22
+#: ../clients/common/settings-docs.h.in:23
 msgid ""
 "If non-zero, directs the device to use the specified transmit power. Units "
 "are dBm.  This property is highly driver dependent and not all devices "
@@ -6505,7 +6570,7 @@ msgstr ""
 "властивості дуже залежить від драйвера. Підтримку встановлення статичної "
 "потужності передавання передбачено не для усіх пристрої."
 
-#: ../clients/common/settings-docs.h.in:23
+#: ../clients/common/settings-docs.h.in:24
 msgid ""
 "The NMSettingWirelessWakeOnWLan options to enable. Not all devices support "
 "all options. May be any combination of NM_SETTING_WIRELESS_WAKE_ON_WLAN_ANY "
@@ -6534,7 +6599,7 @@ msgstr ""
 "параметрів) і NM_SETTING_WIRELESS_WAKE_ON_WLAN_IGNORE (0x8000) (для "
 "вимикання керування Wake-on-LAN у NetworkManager)."
 
-#: ../clients/common/settings-docs.h.in:24
+#: ../clients/common/settings-docs.h.in:25
 msgid ""
 "When WEP is used (ie, key-mgmt = \"none\" or \"ieee8021x\") indicate the "
 "802.11 authentication algorithm required by the AP here.  One of \"open\" "
@@ -6550,7 +6615,7 @@ msgstr ""
 "= \"leap\") слід вказати значення для властивостей «leap-username» і «leap-"
 "password»."
 
-#: ../clients/common/settings-docs.h.in:25
+#: ../clients/common/settings-docs.h.in:26
 msgid ""
 "Indicates whether Fast Initial Link Setup (802.11ai) must be enabled for the "
 "connection.  One of NM_SETTING_WIRELESS_SECURITY_FILS_DEFAULT (0) (use "
@@ -6572,7 +6637,7 @@ msgstr ""
 "NM_SETTING_WIRELESS_SECURITY_FILS_DEFAULT (0), а загальне типове значення не "
 "встановлено, буде, якщо можна, увімкнено FILS."
 
-#: ../clients/common/settings-docs.h.in:26
+#: ../clients/common/settings-docs.h.in:27
 msgid ""
 "A list of group/broadcast encryption algorithms which prevents connections "
 "to Wi-Fi networks that do not utilize one of the algorithms in the list.  "
@@ -6585,7 +6650,7 @@ msgstr ""
 "властивість порожньою. Кожен з елементів списку може мати одне зі значень, "
 "«wep40», «wep104», «tkip» або «ccmp»."
 
-#: ../clients/common/settings-docs.h.in:27
+#: ../clients/common/settings-docs.h.in:28
 msgid ""
 "Key management used for the connection.  One of \"none\" (WEP), \"ieee8021x"
 "\" (Dynamic WEP), \"wpa-psk\" (infrastructure WPA-PSK), \"sae\" (SAE), \"owe"
@@ -6598,7 +6663,7 @@ msgstr ""
 "Encryption) або «wpa-eap» (WPA-Enterprise). Значення цієї властивості слід "
 "встановити для усіх з'єднань Wi-Fi, для яких використовується захист."
 
-#: ../clients/common/settings-docs.h.in:28
+#: ../clients/common/settings-docs.h.in:29
 msgid ""
 "The login password for legacy LEAP connections (ie, key-mgmt = \"ieee8021x\" "
 "and auth-alg = \"leap\")."
@@ -6606,11 +6671,11 @@ msgstr ""
 "Пароль для застарілих з'єднань LEAP (тобто для key-mgmt = \"ieee8021x\" і "
 "auth-alg = \"leap\")."
 
-#: ../clients/common/settings-docs.h.in:29
+#: ../clients/common/settings-docs.h.in:30
 msgid "Flags indicating how to handle the \"leap-password\" property."
 msgstr "Прапорці, які позначають, як обробляти властивість «leap-password»."
 
-#: ../clients/common/settings-docs.h.in:30
+#: ../clients/common/settings-docs.h.in:31
 msgid ""
 "The login username for legacy LEAP connections (ie, key-mgmt = \"ieee8021x\" "
 "and auth-alg = \"leap\")."
@@ -6618,7 +6683,7 @@ msgstr ""
 "Ім'я користувача для застарілих з'єднань LEAP (тобто для key-mgmt = "
 "\"ieee8021x\" і auth-alg = \"leap\")."
 
-#: ../clients/common/settings-docs.h.in:31
+#: ../clients/common/settings-docs.h.in:32
 msgid ""
 "A list of pairwise encryption algorithms which prevents connections to Wi-Fi "
 "networks that do not utilize one of the algorithms in the list. For maximum "
@@ -6630,7 +6695,7 @@ msgstr ""
 "максимальної сумісності залиште цю властивість порожньою. Кожен з елементів "
 "списку може мати одне зі значень, «tkip» або «ccmp»."
 
-#: ../clients/common/settings-docs.h.in:32
+#: ../clients/common/settings-docs.h.in:33
 msgid ""
 "Indicates whether Protected Management Frames (802.11w) must be enabled for "
 "the connection.  One of NM_SETTING_WIRELESS_SECURITY_PMF_DEFAULT (0) (use "
@@ -6652,7 +6717,7 @@ msgstr ""
 "значення NM_SETTING_WIRELESS_SECURITY_PMF_DEFAULT (0) і немає загального "
 "типового значення, додатково буде увімкнено PMF."
 
-#: ../clients/common/settings-docs.h.in:33
+#: ../clients/common/settings-docs.h.in:34
 msgid ""
 "List of strings specifying the allowed WPA protocol versions to use. Each "
 "element may be one \"wpa\" (allow WPA) or \"rsn\" (allow WPA2/RSN).  If not "
@@ -6663,7 +6728,7 @@ msgstr ""
 "або «rsn» (дозволити WPA2/RSN). Якщо не вказано буде дозволено як з'єднання "
 "WPA, так і з'єднання RSN."
 
-#: ../clients/common/settings-docs.h.in:34
+#: ../clients/common/settings-docs.h.in:35
 msgid ""
 "Pre-Shared-Key for WPA networks. For WPA-PSK, it's either an ASCII "
 "passphrase of 8 to 63 characters that is (as specified in the 802.11i "
@@ -6677,11 +6742,11 @@ msgstr ""
 "форматі 64-розрядного шістнадцяткового числа. У мережах WPA3-Personal для "
 "розпізнавання за SAE використовують пароль будь-якої довжини."
 
-#: ../clients/common/settings-docs.h.in:35
+#: ../clients/common/settings-docs.h.in:36
 msgid "Flags indicating how to handle the \"psk\" property."
 msgstr "Прапорці, які позначають, як обробляти властивість «psk»."
 
-#: ../clients/common/settings-docs.h.in:36
+#: ../clients/common/settings-docs.h.in:37
 msgid ""
 "Flags indicating how to handle the \"wep-key0\", \"wep-key1\", \"wep-key2\", "
 "and \"wep-key3\" properties."
@@ -6689,7 +6754,7 @@ msgstr ""
 "Прапорці, які позначають, як обробляти властивості «wep-key0», «wep-key1», "
 "«wep-key2» та «wep-key3»."
 
-#: ../clients/common/settings-docs.h.in:37
+#: ../clients/common/settings-docs.h.in:38
 msgid ""
 "Controls the interpretation of WEP keys.  Allowed values are "
 "NM_WEP_KEY_TYPE_KEY (1), in which case the key is either a 10- or 26-"
@@ -6704,7 +6769,7 @@ msgstr ""
 "вказано як текстовий рядок, який буде хешовано за допомогою фактичного "
 "методу MD5 для отримання справжнього ключа WEP."
 
-#: ../clients/common/settings-docs.h.in:38
+#: ../clients/common/settings-docs.h.in:39
 msgid ""
 "Index 0 WEP key.  This is the WEP key used in most networks.  See the \"wep-"
 "key-type\" property for a description of how this key is interpreted."
@@ -6713,7 +6778,7 @@ msgstr ""
 "Опис інтерпретації цього ключа наведено у довідці щодо властивості «wep-key-"
 "type»."
 
-#: ../clients/common/settings-docs.h.in:39
+#: ../clients/common/settings-docs.h.in:40
 msgid ""
 "Index 1 WEP key.  This WEP index is not used by most networks.  See the "
 "\"wep-key-type\" property for a description of how this key is interpreted."
@@ -6722,7 +6787,7 @@ msgstr ""
 "Опис інтерпретації цього ключа наведено у довідці щодо властивості «wep-key-"
 "type»."
 
-#: ../clients/common/settings-docs.h.in:40
+#: ../clients/common/settings-docs.h.in:41
 msgid ""
 "Index 2 WEP key.  This WEP index is not used by most networks.  See the "
 "\"wep-key-type\" property for a description of how this key is interpreted."
@@ -6731,7 +6796,7 @@ msgstr ""
 "Опис інтерпретації цього ключа наведено у довідці щодо властивості «wep-key-"
 "type»."
 
-#: ../clients/common/settings-docs.h.in:41
+#: ../clients/common/settings-docs.h.in:42
 msgid ""
 "Index 3 WEP key.  This WEP index is not used by most networks.  See the "
 "\"wep-key-type\" property for a description of how this key is interpreted."
@@ -6740,7 +6805,7 @@ msgstr ""
 "Опис інтерпретації цього ключа наведено у довідці щодо властивості «wep-key-"
 "type»."
 
-#: ../clients/common/settings-docs.h.in:42
+#: ../clients/common/settings-docs.h.in:43
 msgid ""
 "When static WEP is used (ie, key-mgmt = \"none\") and a non-default WEP key "
 "index is used by the AP, put that WEP key index here.  Valid values are 0 "
@@ -6753,7 +6818,7 @@ msgstr ""
 "на деяких поширених точках доступу (зокрема Linksys WRT54G) ключі "
 "нумеруються у діапазоні 1 - 4."
 
-#: ../clients/common/settings-docs.h.in:43
+#: ../clients/common/settings-docs.h.in:44
 msgid ""
 "Flags indicating which mode of WPS is to be used if any. There's little "
 "point in changing the default setting as NetworkManager will automatically "
@@ -6766,7 +6831,7 @@ msgstr ""
 "можливо запустити засіб надання ролей WPS, на основі можливостей точки "
 "доступу. WPS можна вимкнути встановленням для цієї властивості значення 1."
 
-#: ../clients/common/settings-docs.h.in:44
+#: ../clients/common/settings-docs.h.in:45
 msgid ""
 "List of strings to be matched against the altSubjectName of the certificate "
 "presented by the authentication server. If the list is empty, no "
@@ -6776,7 +6841,7 @@ msgstr ""
 "надано сервером розпізнавання. Якщо список порожній, перевірка значення "
 "altSubjectName сертифіката сервера не здійснюватиметься."
 
-#: ../clients/common/settings-docs.h.in:45
+#: ../clients/common/settings-docs.h.in:46
 msgid ""
 "Anonymous identity string for EAP authentication methods.  Used as the "
 "unencrypted identity with EAP types that support different tunneled identity "
@@ -6786,7 +6851,7 @@ msgstr ""
 "шифрований профіль з типами EAP, які підтримують тунелювання іншого профілю, "
 "наприклад, EAP-TTLS."
 
-#: ../clients/common/settings-docs.h.in:46
+#: ../clients/common/settings-docs.h.in:47
 msgid ""
 "A timeout for the authentication. Zero means the global default; if the "
 "global default is not set, the authentication timeout is 25 seconds."
@@ -6795,7 +6860,7 @@ msgstr ""
 "час очікування. Якщо загальне типове значення не встановлено, час очікування "
 "на розпізнавання складатиме 25 секунд."
 
-#: ../clients/common/settings-docs.h.in:47
+#: ../clients/common/settings-docs.h.in:48
 msgid ""
 "Contains the CA certificate if used by the EAP method specified in the \"eap"
 "\" property. Certificate data is specified using a \"scheme\"; three are "
@@ -6823,7 +6888,7 @@ msgstr ""
 "certs перевизначить цей параметр на використання вбудованого шляху, якщо "
 "вбудований шлях не є каталогом."
 
-#: ../clients/common/settings-docs.h.in:48
+#: ../clients/common/settings-docs.h.in:49
 msgid ""
 "The password used to access the CA certificate stored in \"ca-cert\" "
 "property. Only makes sense if the certificate is stored on a PKCS#11 token "
@@ -6834,11 +6899,11 @@ msgstr ""
 "якщо сертифікат зберігається на ключі PKCS#11, для доступу до якого слід "
 "пройти розпізнавання."
 
-#: ../clients/common/settings-docs.h.in:49
+#: ../clients/common/settings-docs.h.in:50
 msgid "Flags indicating how to handle the \"ca-cert-password\" property."
 msgstr "Прапорці, які позначають, як обробляти властивість «ca-cert-password»."
 
-#: ../clients/common/settings-docs.h.in:50
+#: ../clients/common/settings-docs.h.in:51
 msgid ""
 "UTF-8 encoded path to a directory containing PEM or DER formatted "
 "certificates to be added to the verification chain in addition to the "
@@ -6852,7 +6917,7 @@ msgstr ""
 "NMSetting8021x:system-ca-certs і вбудований шлях до CA є наявним каталогом, "
 "цей параметр буде проігноровано."
 
-#: ../clients/common/settings-docs.h.in:51
+#: ../clients/common/settings-docs.h.in:52
 msgid ""
 "Contains the client certificate if used by the EAP method specified in the "
 "\"eap\" property. Certificate data is specified using a \"scheme\"; two are "
@@ -6870,7 +6935,7 @@ msgstr ""
 "path, для цієї властивості слід встановити повний шлях у кодуванні UTF-8 до "
 "сертифіката із рядком-префіксом «file://» та завершальним байтом NUL."
 
-#: ../clients/common/settings-docs.h.in:52
+#: ../clients/common/settings-docs.h.in:53
 msgid ""
 "The password used to access the client certificate stored in \"client-cert\" "
 "property. Only makes sense if the certificate is stored on a PKCS#11 token "
@@ -6881,12 +6946,12 @@ msgstr ""
 "зберігається на ключі PKCS#11, для доступу до якого слід пройти "
 "розпізнавання."
 
-#: ../clients/common/settings-docs.h.in:53
+#: ../clients/common/settings-docs.h.in:54
 msgid "Flags indicating how to handle the \"client-cert-password\" property."
 msgstr ""
 "Прапорці, які позначають, як обробляти властивість «client-cert-password»."
 
-#: ../clients/common/settings-docs.h.in:54
+#: ../clients/common/settings-docs.h.in:55
 msgid ""
 "Constraint for server domain name. If set, this list of FQDNs is used as a "
 "match requirement for dNSName element(s) of the certificate presented by the "
@@ -6904,7 +6969,7 @@ msgstr ""
 "порівняння. Починаючи з версії 1.24, можна передавати декілька чинних FQDN з "
 "використанням «;» для відокремлення окремих записів у списку."
 
-#: ../clients/common/settings-docs.h.in:55
+#: ../clients/common/settings-docs.h.in:56
 msgid ""
 "Constraint for server domain name. If set, this FQDN is used as a suffix "
 "match requirement for dNSName element(s) of the certificate presented by the "
@@ -6922,7 +6987,7 @@ msgstr ""
 "Починаючи з версії 1.24, можна передавати декілька чинних FQDN з "
 "використанням «;» для відокремлення окремих записів у списку."
 
-#: ../clients/common/settings-docs.h.in:56
+#: ../clients/common/settings-docs.h.in:57
 msgid ""
 "The allowed EAP method to be used when authenticating to the network with "
 "802.1x.  Valid methods are: \"leap\", \"md5\", \"tls\", \"peap\", \"ttls\", "
@@ -6936,7 +7001,7 @@ msgstr ""
 "властивостей цього параметра; можливі комбінації параметрів наведено у "
 "документації з wpa_supplicant."
 
-#: ../clients/common/settings-docs.h.in:57
+#: ../clients/common/settings-docs.h.in:58
 msgid ""
 "Identity string for EAP authentication methods.  Often the user's user or "
 "login name."
@@ -6944,7 +7009,7 @@ msgstr ""
 "Рядок профілю для способів розпізнавання EAP. Часто ім'я користувача або "
 "назва облікового запису."
 
-#: ../clients/common/settings-docs.h.in:58
+#: ../clients/common/settings-docs.h.in:59
 msgid ""
 "Whether the 802.1X authentication is optional. If TRUE, the activation will "
 "continue even after a timeout or an authentication failure. Setting the "
@@ -6958,11 +7023,11 @@ msgstr ""
 "значення FALSE, активацію буде продовжено, лише після успішного проходження "
 "розпізнавання."
 
-#: ../clients/common/settings-docs.h.in:59
+#: ../clients/common/settings-docs.h.in:60
 msgid "UTF-8 encoded file path containing PAC for EAP-FAST."
 msgstr "Шлях у кодуванні UTF-8 до файла, який містить PAC для EAP-FAST."
 
-#: ../clients/common/settings-docs.h.in:60
+#: ../clients/common/settings-docs.h.in:61
 msgid ""
 "UTF-8 encoded password used for EAP authentication methods. If both the "
 "\"password\" property and the \"password-raw\" property are specified, "
@@ -6972,15 +7037,15 @@ msgstr ""
 "розпізнавання EAP. Якщо вказано обидві властивості, «password» і «password-"
 "raw», пріоритет матиме властивість «password»."
 
-#: ../clients/common/settings-docs.h.in:61
-#: ../clients/common/settings-docs.h.in:107
-#: ../clients/common/settings-docs.h.in:149
-#: ../clients/common/settings-docs.h.in:199
-#: ../clients/common/settings-docs.h.in:321
+#: ../clients/common/settings-docs.h.in:62
+#: ../clients/common/settings-docs.h.in:108
+#: ../clients/common/settings-docs.h.in:150
+#: ../clients/common/settings-docs.h.in:200
+#: ../clients/common/settings-docs.h.in:322
 msgid "Flags indicating how to handle the \"password\" property."
 msgstr "Прапорці, які позначають, як обробляти властивість «password»."
 
-#: ../clients/common/settings-docs.h.in:62
+#: ../clients/common/settings-docs.h.in:63
 msgid ""
 "Password used for EAP authentication methods, given as a byte array to allow "
 "passwords in other encodings than UTF-8 to be used. If both the \"password\" "
@@ -6992,11 +7057,11 @@ msgstr ""
 "відмінних від UTF-8. Якщо вказано обидві властивості, «password» і «password-"
 "raw», пріоритет матиме властивість «password»."
 
-#: ../clients/common/settings-docs.h.in:63
+#: ../clients/common/settings-docs.h.in:64
 msgid "Flags indicating how to handle the \"password-raw\" property."
 msgstr "Прапорці, які позначають, як обробляти властивість «password-raw»."
 
-#: ../clients/common/settings-docs.h.in:64
+#: ../clients/common/settings-docs.h.in:65
 msgid ""
 "Specifies authentication flags to use in \"phase 1\" outer authentication "
 "using NMSetting8021xAuthFlags options. The individual TLS versions can be "
@@ -7013,7 +7078,7 @@ msgstr ""
 "tls_disable_tlsv1_x. Докладнішу інформацію можна знайти у документації до "
 "wpa_supplicant."
 
-#: ../clients/common/settings-docs.h.in:65
+#: ../clients/common/settings-docs.h.in:66
 msgid ""
 "Enables or disables in-line provisioning of EAP-FAST credentials when FAST "
 "is specified as the EAP method in the \"eap\" property. Recognized values "
@@ -7029,7 +7094,7 @@ msgstr ""
 "режими ініціалізації — з розпізнаванням і без нього). Див. документацію до "
 "wpa_supplicant, щоб дізнатися більше."
 
-#: ../clients/common/settings-docs.h.in:66
+#: ../clients/common/settings-docs.h.in:67
 msgid ""
 "Forces use of the new PEAP label during key derivation.  Some RADIUS servers "
 "may require forcing the new PEAP label to interoperate with PEAPv1.  Set to "
@@ -7042,7 +7107,7 @@ msgstr ""
 "використовувати нову мітку PEAP. Див. документацію до wpa_supplicant, щоб "
 "дізнатися більше."
 
-#: ../clients/common/settings-docs.h.in:67
+#: ../clients/common/settings-docs.h.in:68
 msgid ""
 "Forces which PEAP version is used when PEAP is set as the EAP method in the "
 "\"eap\" property.  When unset, the version reported by the server will be "
@@ -7058,7 +7123,7 @@ msgstr ""
 "використовується встановлення для цієї властивості значення «0» або «1», яке "
 "примусово визначає певну версію PEAP."
 
-#: ../clients/common/settings-docs.h.in:68
+#: ../clients/common/settings-docs.h.in:69
 msgid ""
 "List of strings to be matched against the altSubjectName of the certificate "
 "presented by the authentication server during the inner \"phase 2\" "
@@ -7070,7 +7135,7 @@ msgstr ""
 "Якщо список порожній, перевірка значення altSubjectName сертифіката сервера "
 "не здійснюватиметься."
 
-#: ../clients/common/settings-docs.h.in:69
+#: ../clients/common/settings-docs.h.in:70
 msgid ""
 "Specifies the allowed \"phase 2\" inner non-EAP authentication method when "
 "an EAP method that uses an inner TLS tunnel is specified in the \"eap\" "
@@ -7087,7 +7152,7 @@ msgstr ""
 "специфічні параметри. Докладніший опис параметрів можна знайти у "
 "документації з wpa_supplicant."
 
-#: ../clients/common/settings-docs.h.in:70
+#: ../clients/common/settings-docs.h.in:71
 msgid ""
 "Specifies the allowed \"phase 2\" inner EAP-based authentication method when "
 "an EAP method that uses an inner TLS tunnel is specified in the \"eap\" "
@@ -7103,7 +7168,7 @@ msgstr ""
 "внутрішніх способів «phase 2» слід вказати специфічні параметри. Докладніший "
 "опис параметрів можна знайти у документації з wpa_supplicant."
 
-#: ../clients/common/settings-docs.h.in:71
+#: ../clients/common/settings-docs.h.in:72
 msgid ""
 "Contains the \"phase 2\" CA certificate if used by the EAP method specified "
 "in the \"phase2-auth\" or \"phase2-autheap\" properties. Certificate data is "
@@ -7131,7 +7196,7 @@ msgstr ""
 "що вмикання NMSetting8021x:system-ca-certs перевизначить цей параметр на "
 "використання вбудованого шляху, якщо вбудований шлях не є каталогом."
 
-#: ../clients/common/settings-docs.h.in:72
+#: ../clients/common/settings-docs.h.in:73
 msgid ""
 "The password used to access the \"phase2\" CA certificate stored in \"phase2-"
 "ca-cert\" property. Only makes sense if the certificate is stored on a "
@@ -7142,13 +7207,13 @@ msgstr ""
 "лише якщо сертифікат зберігається на ключі PKCS#11, для доступу до якого "
 "слід пройти розпізнавання."
 
-#: ../clients/common/settings-docs.h.in:73
+#: ../clients/common/settings-docs.h.in:74
 msgid ""
 "Flags indicating how to handle the \"phase2-ca-cert-password\" property."
 msgstr ""
 "Прапорці, які позначають, як обробляти властивість «phase2-ca-cert-password»."
 
-#: ../clients/common/settings-docs.h.in:74
+#: ../clients/common/settings-docs.h.in:75
 msgid ""
 "UTF-8 encoded path to a directory containing PEM or DER formatted "
 "certificates to be added to the verification chain in addition to the "
@@ -7162,7 +7227,7 @@ msgstr ""
 "увімкнено NMSetting8021x:system-ca-certs і вбудований шлях до CA є наявним "
 "каталогом, цей параметр буде проігноровано."
 
-#: ../clients/common/settings-docs.h.in:75
+#: ../clients/common/settings-docs.h.in:76
 msgid ""
 "Contains the \"phase 2\" client certificate if used by the EAP method "
 "specified in the \"phase2-auth\" or \"phase2-autheap\" properties. "
@@ -7187,7 +7252,7 @@ msgstr ""
 "служб сертифікації, але це уможливлює втручання сторонніх осіб у ланцюжки "
 "передавання даних, тому ми наполегливо не рекомендуємо це робити."
 
-#: ../clients/common/settings-docs.h.in:76
+#: ../clients/common/settings-docs.h.in:77
 msgid ""
 "The password used to access the \"phase2\" client certificate stored in "
 "\"phase2-client-cert\" property. Only makes sense if the certificate is "
@@ -7198,14 +7263,14 @@ msgstr ""
 "значення, лише якщо сертифікат зберігається на ключі PKCS#11, для доступу до "
 "якого слід пройти розпізнавання."
 
-#: ../clients/common/settings-docs.h.in:77
+#: ../clients/common/settings-docs.h.in:78
 msgid ""
 "Flags indicating how to handle the \"phase2-client-cert-password\" property."
 msgstr ""
 "Прапорці, які позначають, як обробляти властивість «phase2-client-cert-"
 "password»."
 
-#: ../clients/common/settings-docs.h.in:78
+#: ../clients/common/settings-docs.h.in:79
 msgid ""
 "Constraint for server domain name. If set, this list of FQDNs is used as a "
 "match requirement for dNSName element(s) of the certificate presented by the "
@@ -7223,7 +7288,7 @@ msgstr ""
 "використанням тих самих правил порівняння. Можна передавати декілька чинних "
 "FQDN з використанням «;» для відокремлення окремих записів у списку."
 
-#: ../clients/common/settings-docs.h.in:79
+#: ../clients/common/settings-docs.h.in:80
 msgid ""
 "Constraint for server domain name. If set, this FQDN is used as a suffix "
 "match requirement for dNSName element(s) of the certificate presented by the "
@@ -7243,7 +7308,7 @@ msgstr ""
 "передавати декілька чинних FQDN з використанням «;» для відокремлення "
 "окремих записів у списку."
 
-#: ../clients/common/settings-docs.h.in:80
+#: ../clients/common/settings-docs.h.in:81
 msgid ""
 "Contains the \"phase 2\" inner private key when the \"phase2-auth\" or "
 "\"phase2-autheap\" property is set to \"tls\". Key data is specified using a "
@@ -7280,7 +7345,7 @@ msgstr ""
 "значення пароля, який використовується для розшифрування закритого ключа і "
 "сертифіката PKCS#12."
 
-#: ../clients/common/settings-docs.h.in:81
+#: ../clients/common/settings-docs.h.in:82
 msgid ""
 "The password used to decrypt the \"phase 2\" private key specified in the "
 "\"phase2-private-key\" property when the private key either uses the path "
@@ -7290,14 +7355,14 @@ msgstr ""
 "вказаного за допомогою властивості «phase2-private-key», коли для закритого "
 "ключа або використовується схема path, або це ключ у форматі PKCS#12."
 
-#: ../clients/common/settings-docs.h.in:82
+#: ../clients/common/settings-docs.h.in:83
 msgid ""
 "Flags indicating how to handle the \"phase2-private-key-password\" property."
 msgstr ""
 "Прапорці, які позначають, як обробляти властивість «phase2-private-key-"
 "password»."
 
-#: ../clients/common/settings-docs.h.in:83
+#: ../clients/common/settings-docs.h.in:84
 msgid ""
 "Substring to be matched against the subject of the certificate presented by "
 "the authentication server during the inner \"phase 2\" authentication. When "
@@ -7312,16 +7377,16 @@ msgstr ""
 "якщо взагалі його поліпшує, тому її використання вважається застарілим. "
 "Рекомендованим є використання NMSetting8021x:phase2-domain-suffix-match."
 
-#: ../clients/common/settings-docs.h.in:84
+#: ../clients/common/settings-docs.h.in:85
 msgid "PIN used for EAP authentication methods."
 msgstr "PIN, який використовується для методів розпізнавання EAP."
 
-#: ../clients/common/settings-docs.h.in:85
-#: ../clients/common/settings-docs.h.in:201
+#: ../clients/common/settings-docs.h.in:86
+#: ../clients/common/settings-docs.h.in:202
 msgid "Flags indicating how to handle the \"pin\" property."
 msgstr "Прапорці, які позначають, як обробляти властивість «pin»."
 
-#: ../clients/common/settings-docs.h.in:86
+#: ../clients/common/settings-docs.h.in:87
 msgid ""
 "Contains the private key when the \"eap\" property is set to \"tls\". Key "
 "data is specified using a \"scheme\"; two are currently supported: blob and "
@@ -7365,7 +7430,7 @@ msgstr ""
 "допомогою пароля для закритих ключів, щоб запобігти доступу сторонніх осіб "
 "до незашифрованих даних закритого ключа."
 
-#: ../clients/common/settings-docs.h.in:87
+#: ../clients/common/settings-docs.h.in:88
 msgid ""
 "The password used to decrypt the private key specified in the \"private-key"
 "\" property when the private key either uses the path scheme, or if the "
@@ -7376,12 +7441,12 @@ msgstr ""
 "використовується схема path, або якщо закрити ключ є ключем у форматі "
 "PKCS#12."
 
-#: ../clients/common/settings-docs.h.in:88
+#: ../clients/common/settings-docs.h.in:89
 msgid "Flags indicating how to handle the \"private-key-password\" property."
 msgstr ""
 "Прапорці, які позначають, як обробляти властивість «private-key-password»."
 
-#: ../clients/common/settings-docs.h.in:89
+#: ../clients/common/settings-docs.h.in:90
 msgid ""
 "Substring to be matched against the subject of the certificate presented by "
 "the authentication server. When unset, no verification of the authentication "
@@ -7396,7 +7461,7 @@ msgstr ""
 "використання вважається застарілим. Рекомендованим є використання "
 "NMSetting8021x:domain-suffix-match."
 
-#: ../clients/common/settings-docs.h.in:90
+#: ../clients/common/settings-docs.h.in:91
 msgid ""
 "When TRUE, overrides the \"ca-path\" and \"phase2-ca-path\" properties using "
 "the system CA directory specified at configure time with the --system-ca-"
@@ -7417,7 +7482,7 @@ msgstr ""
 "«ca-cert» і «phase2-ca-cert» (встановлює параметри ca_cert/ca_cert2 для "
 "wpa_supplicant)."
 
-#: ../clients/common/settings-docs.h.in:91
+#: ../clients/common/settings-docs.h.in:92
 msgid ""
 "When TRUE, enforce auto-negotiation of speed and duplex mode. If \"speed\" "
 "and \"duplex\" properties are both specified, only that single mode will be "
@@ -7436,7 +7501,7 @@ msgstr ""
 "FALSE, має бути вручну встановлено значення властивостей «speed» і «duplex», "
 "інакше налаштування зв'язку буде пропущено."
 
-#: ../clients/common/settings-docs.h.in:92
+#: ../clients/common/settings-docs.h.in:93
 msgid ""
 "If specified, request that the device use this MAC address instead. This is "
 "known as MAC cloning or spoofing. Beside explicitly specifying a MAC "
@@ -7468,7 +7533,7 @@ msgstr ""
 "використовуватися інше типове значення). У D-Bus це поле позначається як "
 "«assigned-mac-address», а у застарілих версіях, як «cloned-mac-address»."
 
-#: ../clients/common/settings-docs.h.in:93
+#: ../clients/common/settings-docs.h.in:94
 msgid ""
 "When a value is set, either \"half\" or \"full\", configures the device to "
 "use the specified duplex mode. If \"auto-negotiate\" is \"yes\" the "
@@ -7495,7 +7560,7 @@ msgstr ""
 "Перш ніж вказувати двобічний режим, переконайтеся, що у пристрої передбачено "
 "його підтримку."
 
-#: ../clients/common/settings-docs.h.in:95
+#: ../clients/common/settings-docs.h.in:96
 msgid ""
 "If specified, this connection will only apply to the Ethernet device whose "
 "permanent MAC address matches. This property does not change the MAC address "
@@ -7505,7 +7570,7 @@ msgstr ""
 "відповідною сталою адресою MAC. Ця властивість не змінює MAC-адреси пристрою "
 "(таку зміну називають підміною MAC)."
 
-#: ../clients/common/settings-docs.h.in:96
+#: ../clients/common/settings-docs.h.in:97
 msgid ""
 "If specified, this connection will never apply to the Ethernet device whose "
 "permanent MAC address matches an address in the list.  Each MAC address is "
@@ -7516,7 +7581,7 @@ msgstr ""
 "адреси слід вказувати у стандартному позначенні із шістнадцяткових цифр і "
 "двокрапок (00:11:22:33:44:55)."
 
-#: ../clients/common/settings-docs.h.in:98
+#: ../clients/common/settings-docs.h.in:99
 msgid ""
 "Specific port type to use if the device supports multiple attachment "
 "methods.  One of \"tp\" (Twisted Pair), \"aui\" (Attachment Unit Interface), "
@@ -7529,7 +7594,7 @@ msgstr ""
 "Independent Interface). Якщо для пристрою передбачено підтримку лише одного "
 "типу порту, цей параметр буде проігноровано."
 
-#: ../clients/common/settings-docs.h.in:99
+#: ../clients/common/settings-docs.h.in:100
 msgid ""
 "s390 network device type; one of \"qeth\", \"lcs\", or \"ctc\", representing "
 "the different types of virtual network devices available on s390 systems."
@@ -7538,7 +7603,7 @@ msgstr ""
 "відповідно до різних типів пристроїв віртуальної мережі, які доступні на "
 "системах s390."
 
-#: ../clients/common/settings-docs.h.in:100
+#: ../clients/common/settings-docs.h.in:101
 msgid ""
 "Dictionary of key/value pairs of s390-specific device options.  Both keys "
 "and values must be strings.  Allowed keys include \"portno\", \"layer2\", "
@@ -7550,7 +7615,7 @@ msgstr ""
 "«portno», «layer2», «portname», «protocol». Параметр names має містити лише "
 "літери латинської абетки та цифри (тобто [a-zA-Z0-9])."
 
-#: ../clients/common/settings-docs.h.in:101
+#: ../clients/common/settings-docs.h.in:102
 msgid ""
 "Identifies specific subchannels that this network device uses for "
 "communication with z/VM or s390 host.  Like the \"mac-address\" property for "
@@ -7566,7 +7631,7 @@ msgstr ""
 "використовує вказані підканали. Список має містити точно три рядки, кожен з "
 "рядків може складатися лише із шістнадцяткових цифр та символів крапки (.)."
 
-#: ../clients/common/settings-docs.h.in:102
+#: ../clients/common/settings-docs.h.in:103
 msgid ""
 "When a value greater than 0 is set, configures the device to use the "
 "specified speed. If \"auto-negotiate\" is \"yes\" the specified speed will "
@@ -7594,7 +7659,7 @@ msgstr ""
 "значенням властивості «duplex». Перш ніж встановлювати значення швидкості, "
 "переконайтеся, що у вашому пристрої передбачено її підтримку."
 
-#: ../clients/common/settings-docs.h.in:103
+#: ../clients/common/settings-docs.h.in:104
 msgid ""
 "The NMSettingWiredWakeOnLan options to enable. Not all devices support all "
 "options. May be any combination of NM_SETTING_WIRED_WAKE_ON_LAN_PHY (0x2), "
@@ -7617,7 +7682,7 @@ msgstr ""
 "(використання загальних параметрів) та NM_SETTING_WIRED_WAKE_ON_LAN_IGNORE "
 "(0x8000) (вимкнути керування Wake-on-LAN у NetworkManager)."
 
-#: ../clients/common/settings-docs.h.in:104
+#: ../clients/common/settings-docs.h.in:105
 msgid ""
 "If specified, the password used with magic-packet-based Wake-on-LAN, "
 "represented as an Ethernet MAC address.  If NULL, no password will be "
@@ -7627,37 +7692,37 @@ msgstr ""
 "магічних пакетах, представлений як MAC-адреса Ethernet. Якщо має значення "
 "NULL, пароль не потрібен."
 
-#: ../clients/common/settings-docs.h.in:105
+#: ../clients/common/settings-docs.h.in:106
 msgid "Encapsulation of ADSL connection.  Can be \"vcmux\" or \"llc\"."
 msgstr "Вкладеність з'єднання ADSL. Може мати значення «vcmux» або «llc»."
 
-#: ../clients/common/settings-docs.h.in:106
+#: ../clients/common/settings-docs.h.in:107
 msgid "Password used to authenticate with the ADSL service."
 msgstr "Пароль, який використовуватиметься для розпізнавання на службі ADSL."
 
-#: ../clients/common/settings-docs.h.in:108
+#: ../clients/common/settings-docs.h.in:109
 msgid "ADSL connection protocol.  Can be \"pppoa\", \"pppoe\" or \"ipoatm\"."
 msgstr ""
 "Протокол з'єднання ADSL. Може мати значення «pppoa», «pppoe» та «ipoatm»."
 
-#: ../clients/common/settings-docs.h.in:109
+#: ../clients/common/settings-docs.h.in:110
 msgid "Username used to authenticate with the ADSL service."
 msgstr ""
 "Ім'я користувача, яке використовуватиметься для розпізнавання на службі ADSL."
 
-#: ../clients/common/settings-docs.h.in:110
+#: ../clients/common/settings-docs.h.in:111
 msgid "VCI of ADSL connection"
 msgstr "VCI з'єднання ADSL"
 
-#: ../clients/common/settings-docs.h.in:111
+#: ../clients/common/settings-docs.h.in:112
 msgid "VPI of ADSL connection"
 msgstr "VPI з'єднання ADSL"
 
-#: ../clients/common/settings-docs.h.in:112
+#: ../clients/common/settings-docs.h.in:113
 msgid "The Bluetooth address of the device."
 msgstr "Адреса Bluetooth пристрою."
 
-#: ../clients/common/settings-docs.h.in:113
+#: ../clients/common/settings-docs.h.in:114
 msgid ""
 "Either \"dun\" for Dial-Up Networking connections or \"panu\" for Personal "
 "Area Networking connections to devices supporting the NAP profile."
@@ -7666,7 +7731,7 @@ msgstr ""
 "особистої області мережі із пристроями, для яких передбачено підтримку "
 "профілю NAP."
 
-#: ../clients/common/settings-docs.h.in:114
+#: ../clients/common/settings-docs.h.in:115
 msgid ""
 "Dictionary of key/value pairs of bonding options.  Both keys and values must "
 "be strings. Option names must contain only alphanumeric characters (ie, [a-"
@@ -7676,15 +7741,15 @@ msgstr ""
 "значення мають бути рядками. Параметр names має містити лише літери "
 "латинської абетки та цифри (тобто [a-zA-Z0-9])."
 
-#: ../clients/common/settings-docs.h.in:115
+#: ../clients/common/settings-docs.h.in:116
 msgid "The Ethernet MAC address aging time, in seconds."
 msgstr "Час застарівання MAC-адреси Ethernet, у секундах."
 
-#: ../clients/common/settings-docs.h.in:116
+#: ../clients/common/settings-docs.h.in:117
 msgid "The Spanning Tree Protocol (STP) forwarding delay, in seconds."
 msgstr "Затримка переспрямовування за протоколом STP, у секундах."
 
-#: ../clients/common/settings-docs.h.in:117
+#: ../clients/common/settings-docs.h.in:118
 msgid ""
 "If specified, The MAC address of the multicast group this bridge uses for "
 "STP. The address must be a link-local address in standard Ethernet MAC "
@@ -7697,7 +7762,7 @@ msgstr ""
 "01:80:C2:00:00:0X, де X має належати множині [0, 4..F]. Якщо не вказано, "
 "типовим значенням є 01:80:C2:00:00:00."
 
-#: ../clients/common/settings-docs.h.in:118
+#: ../clients/common/settings-docs.h.in:119
 msgid ""
 "A mask of group addresses to forward. Usually, group addresses in the range "
 "from 01:80:C2:00:00:00 to 01:80:C2:00:00:0F are not forwarded according to "
@@ -7713,11 +7778,11 @@ msgstr ""
 "2, оскільки ці біти використовуються для кадрів призупинення STP, MAC та "
 "LACP."
 
-#: ../clients/common/settings-docs.h.in:119
+#: ../clients/common/settings-docs.h.in:120
 msgid "The Spanning Tree Protocol (STP) hello time, in seconds."
 msgstr "Тривалість вітання за протоколом STP, у секундах."
 
-#: ../clients/common/settings-docs.h.in:120
+#: ../clients/common/settings-docs.h.in:121
 msgid ""
 "If specified, the MAC address of bridge. When creating a new bridge, this "
 "MAC address will be set. If this field is left unspecified, the \"ethernet."
@@ -7732,17 +7797,17 @@ msgstr ""
 "Зауважте, що встановлення «ethernet.cloned-mac-address» завжди перевизначає "
 "MAC-адресу містка під час активації. Отже, ця властивість є застарілою."
 
-#: ../clients/common/settings-docs.h.in:121
+#: ../clients/common/settings-docs.h.in:122
 msgid "The Spanning Tree Protocol (STP) maximum message age, in seconds."
 msgstr "Максимальний вік повідомлення за протоколом STP, у секундах."
 
-#: ../clients/common/settings-docs.h.in:122
+#: ../clients/common/settings-docs.h.in:123
 msgid "Set maximum size of multicast hash table (value must be a power of 2)."
 msgstr ""
 "Встановити максимальний розмір таблиці хешів універсальної трансляції "
 "(значення має бути степенем 2)."
 
-#: ../clients/common/settings-docs.h.in:123
+#: ../clients/common/settings-docs.h.in:124
 msgid ""
 "Set the number of queries the bridge will send before stopping forwarding a "
 "multicast group after a \"leave\" message has been received."
@@ -7751,7 +7816,7 @@ msgstr ""
 "переспрямовування групи універсальної трансляції після отримання "
 "повідомлення «leave»."
 
-#: ../clients/common/settings-docs.h.in:124
+#: ../clients/common/settings-docs.h.in:125
 msgid ""
 "Set interval (in deciseconds) between queries to find remaining members of a "
 "group, after a \"leave\" message is received."
@@ -7759,7 +7824,7 @@ msgstr ""
 "Встановити інтервал (у децисекундах) між запитами для пошуку решти учасників "
 "групи після отримання повідомлення «leave»."
 
-#: ../clients/common/settings-docs.h.in:125
+#: ../clients/common/settings-docs.h.in:126
 msgid ""
 "Set delay (in deciseconds) after which the bridge will leave a group, if no "
 "membership reports for this group are received."
@@ -7767,7 +7832,7 @@ msgstr ""
 "Встановити затримку (у децисекундах), після якої місток полишить групу, якщо "
 "не буде отримано звітів щодо членства для цієї групи."
 
-#: ../clients/common/settings-docs.h.in:126
+#: ../clients/common/settings-docs.h.in:127
 msgid ""
 "Enable or disable sending of multicast queries by the bridge. If not "
 "specified the option is disabled."
@@ -7775,7 +7840,7 @@ msgstr ""
 "Увімкнути або вимкнути надсилання запитів універсальної трансляції містком. "
 "Якщо не вказано, вважається вимкненим."
 
-#: ../clients/common/settings-docs.h.in:127
+#: ../clients/common/settings-docs.h.in:128
 msgid ""
 "If no queries are seen after this delay (in deciseconds) has passed, the "
 "bridge will start to send its own queries."
@@ -7783,7 +7848,7 @@ msgstr ""
 "Якщо протягом цього часу затримки (у децисекундах) не буде передано жодного "
 "запиту, місток почне надсилати власні запити."
 
-#: ../clients/common/settings-docs.h.in:128
+#: ../clients/common/settings-docs.h.in:129
 msgid ""
 "Interval (in deciseconds) between queries sent by the bridge after the end "
 "of the startup phase."
@@ -7791,7 +7856,7 @@ msgstr ""
 "Інтервал (у децисекундах) між запитами, які буде надіслано містком після "
 "завершення початкової фази."
 
-#: ../clients/common/settings-docs.h.in:129
+#: ../clients/common/settings-docs.h.in:130
 msgid ""
 "Set the Max Response Time/Max Response Delay (in deciseconds) for IGMP/MLD "
 "queries sent by the bridge."
@@ -7799,7 +7864,7 @@ msgstr ""
 "Встановити максимальний час на відповідь та максимальну затримку відповіді "
 "(у децисекундах) для запитів IGMP/MLD, які буде надіслано містком."
 
-#: ../clients/common/settings-docs.h.in:130
+#: ../clients/common/settings-docs.h.in:131
 msgid ""
 "If enabled the bridge's own IP address is used as the source address for "
 "IGMP queries otherwise the default of 0.0.0.0 is used."
@@ -7807,21 +7872,23 @@ msgstr ""
 "Якщо увімкнено, як адресу джерела для запитів IGMP буде використано власну "
 "IP-адресу містка. Якщо вимкнено, буде використано типову адресу 0.0.0.0."
 
-#: ../clients/common/settings-docs.h.in:131
+#: ../clients/common/settings-docs.h.in:132
 #| msgid ""
-#| "Sets bridge's multicast router. multicast-snooping must be enabled for "
+#| "Sets bridge's multicast router. Multicast-snooping must be enabled for "
 #| "this option to work. Supported values are: 'auto', 'disabled', 'enabled'. "
 #| "If not specified the default value is 'auto'."
 msgid ""
 "Sets bridge's multicast router. Multicast-snooping must be enabled for this "
-"option to work. Supported values are: 'auto', 'disabled', 'enabled'. If not "
-"specified the default value is 'auto'."
+"option to work. Supported values are: 'auto', 'disabled', 'enabled' to which "
+"kernel assigns the numbers 1, 0, and 2, respectively. If not specified the "
+"default value is 'auto' (1)."
 msgstr ""
 "Встановлює маршрутизатор універсальної трансляції містка. Щоб цей параметр "
 "спрацював, має бути увімкнено multicast-snooping. Підтримувані значення: "
-"«auto», «disabled», «enabled». Якщо не вказано, типовим значенням є «auto»."
+"«auto», «disabled», «enabled», з якими ядро пов'язує числа 1, 0 і 2,"
+" відповідно. Якщо не вказано, типовим значенням є «auto» (1)."
 
-#: ../clients/common/settings-docs.h.in:132
+#: ../clients/common/settings-docs.h.in:133
 msgid ""
 "Controls whether IGMP snooping is enabled for this bridge. Note that if "
 "snooping was automatically disabled due to hash collisions, the system may "
@@ -7831,13 +7898,13 @@ msgstr ""
 "стеження було автоматично вимкнено через конфлікти хешування, система може "
 "відмовити у вмиканні цієї можливості, аж доки конфлікти не буде усунено."
 
-#: ../clients/common/settings-docs.h.in:133
+#: ../clients/common/settings-docs.h.in:134
 msgid "Set the number of IGMP queries to send during startup phase."
 msgstr ""
 "Встановити кількість запитів IGMP, які слід надіслати під час початкової "
 "фази."
 
-#: ../clients/common/settings-docs.h.in:134
+#: ../clients/common/settings-docs.h.in:135
 msgid ""
 "Sets the time (in deciseconds) between queries sent out at startup to "
 "determine membership information."
@@ -7845,7 +7912,7 @@ msgstr ""
 "Встановити час (у децисекундах) між надсиланнями запитів під час запуску для "
 "визначення інформації щодо членства."
 
-#: ../clients/common/settings-docs.h.in:135
+#: ../clients/common/settings-docs.h.in:136
 msgid ""
 "Sets the Spanning Tree Protocol (STP) priority for this bridge.  Lower "
 "values are \"better\"; the lowest priority bridge will be elected the root "
@@ -7855,14 +7922,14 @@ msgstr ""
 "пріоритетнішими; місток із найменшим значенням пріоритетності буде вибрано "
 "як кореневий місток."
 
-#: ../clients/common/settings-docs.h.in:136
+#: ../clients/common/settings-docs.h.in:137
 msgid ""
 "Controls whether Spanning Tree Protocol (STP) is enabled for this bridge."
 msgstr ""
 "Керує тим, чи увімкнено протокол пересування ієрархією (STP) для цього "
 "містка."
 
-#: ../clients/common/settings-docs.h.in:137
+#: ../clients/common/settings-docs.h.in:138
 msgid ""
 "The default PVID for the ports of the bridge, that is the VLAN id assigned "
 "to incoming untagged frames."
@@ -7870,11 +7937,11 @@ msgstr ""
 "Типовий PVID для портів містка. Це ідентифікатор VLAN, який пов'язано із "
 "вхідними кадрами без міток."
 
-#: ../clients/common/settings-docs.h.in:138
+#: ../clients/common/settings-docs.h.in:139
 msgid "Control whether VLAN filtering is enabled on the bridge."
 msgstr "Керування тим, чи увімкнено фільтрування VLAN на містку."
 
-#: ../clients/common/settings-docs.h.in:139
+#: ../clients/common/settings-docs.h.in:140
 msgid ""
 "If specified, the protocol used for VLAN filtering. Supported values are: "
 "'802.1Q', '802.1ad'. If not specified the default value is '802.1Q'."
@@ -7883,11 +7950,11 @@ msgstr ""
 "Підтримувані значення: «802.1Q», «802.1ad». Якщо не вказано, типовим "
 "значенням буде «802.1Q»."
 
-#: ../clients/common/settings-docs.h.in:140
+#: ../clients/common/settings-docs.h.in:141
 msgid "Controls whether per-VLAN stats accounting is enabled."
 msgstr "Керує тим, чи увімкнено облік статистичних даних для окремих VLAN."
 
-#: ../clients/common/settings-docs.h.in:141
+#: ../clients/common/settings-docs.h.in:142
 msgid ""
 "Array of bridge VLAN objects. In addition to the VLANs specified here, the "
 "bridge will also have the default-pvid VLAN configured  by the bridge.vlan-"
@@ -7904,7 +7971,7 @@ msgstr ""
 "від 1 до 4094, або діапазон, який визначається парою ідентифікаторів, які "
 "відокремлено дефісом."
 
-#: ../clients/common/settings-docs.h.in:142
+#: ../clients/common/settings-docs.h.in:143
 msgid ""
 "Enables or disables \"hairpin mode\" for the port, which allows frames to be "
 "sent back out through the port the frame was received on."
@@ -7912,19 +7979,19 @@ msgstr ""
 "Вмикає або вимикає «режим початкової зони» для порту, що уможливлює зворотне "
 "надсилання кадрів крізь порт, з якого було отримано кадр."
 
-#: ../clients/common/settings-docs.h.in:143
+#: ../clients/common/settings-docs.h.in:144
 msgid ""
 "The Spanning Tree Protocol (STP) port cost for destinations via this port."
 msgstr ""
 "Вартість порту у протоколі пересування ієрархією (STP) для призначень, що "
 "маршрутизуються через цей порт."
 
-#: ../clients/common/settings-docs.h.in:144
+#: ../clients/common/settings-docs.h.in:145
 msgid "The Spanning Tree Protocol (STP) priority of this bridge port."
 msgstr ""
 "Пріоритетність протоколу пересування ієрархією (STP) цього порту містка."
 
-#: ../clients/common/settings-docs.h.in:145
+#: ../clients/common/settings-docs.h.in:146
 msgid ""
 "Array of bridge VLAN objects. In addition to the VLANs specified here, the "
 "port will also have the default-pvid VLAN configured on the bridge by the "
@@ -7941,9 +8008,9 @@ msgstr ""
 "від 1 до 4094, або діапазон, який визначається парою ідентифікаторів, які "
 "відокремлено дефісом."
 
-#: ../clients/common/settings-docs.h.in:146
-#: ../clients/common/settings-docs.h.in:195
-#: ../clients/common/settings-docs.h.in:206
+#: ../clients/common/settings-docs.h.in:147
+#: ../clients/common/settings-docs.h.in:196
+#: ../clients/common/settings-docs.h.in:207
 msgid ""
 "If non-zero, only transmit packets of the specified size or smaller, "
 "breaking larger packets up into multiple frames."
@@ -7951,7 +8018,7 @@ msgstr ""
 "Якщо має ненульове значення, передавати пакети лише вказаного або меншого "
 "розміру, розбиваючи великі пакети на декілька кадрів."
 
-#: ../clients/common/settings-docs.h.in:147
+#: ../clients/common/settings-docs.h.in:148
 msgid ""
 "The number to dial to establish the connection to the CDMA-based mobile "
 "broadband network, if any.  If not specified, the default number (#777) is "
@@ -7961,8 +8028,8 @@ msgstr ""
 "широкосмуговою мережею на основі CDMA, якщо такий передбачено. Якщо не "
 "вказано, буде використано типовий номер (#777)."
 
-#: ../clients/common/settings-docs.h.in:148
-#: ../clients/common/settings-docs.h.in:198
+#: ../clients/common/settings-docs.h.in:149
+#: ../clients/common/settings-docs.h.in:199
 msgid ""
 "The password used to authenticate with the network, if required.  Many "
 "providers do not require a password, or accept any password.  But if a "
@@ -7972,8 +8039,8 @@ msgstr ""
 "Багато надавачів послуг не вимагають надання пароля або приймають будь-який "
 "пароль. Втім, якщо пароль потрібен, його слід вказати тут."
 
-#: ../clients/common/settings-docs.h.in:150
-#: ../clients/common/settings-docs.h.in:204
+#: ../clients/common/settings-docs.h.in:151
+#: ../clients/common/settings-docs.h.in:205
 msgid ""
 "The username used to authenticate with the network, if required.  Many "
 "providers do not require a username, or accept any username.  But if a "
@@ -7984,12 +8051,17 @@ msgstr ""
 "приймають будь-яке ім'я користувача. Втім, якщо ім'я користувача потрібне, "
 "його слід вказати тут."
 
-#: ../clients/common/settings-docs.h.in:151
+#: ../clients/common/settings-docs.h.in:152
+#| msgid ""
+#| "The number of retries for the authentication. Zero means to try "
+#| "indefinitely; -1 means to use a global default. If the global default is "
+#| "not set, the authentication retries for 3 times before failing the "
+#| "connection. Currently this only applies to 802-1x authentication."
 msgid ""
 "The number of retries for the authentication. Zero means to try "
 "indefinitely; -1 means to use a global default. If the global default is not "
 "set, the authentication retries for 3 times before failing the connection. "
-"Currently this only applies to 802-1x authentication."
+"Currently, this only applies to 802-1x authentication."
 msgstr ""
 "Кількість повторних спроб розпізнавання. Нульове значення означає, що спроби "
 "продовжуватиметься нескінченно довго; -1 означає використання загального "
@@ -7998,7 +8070,7 @@ msgstr ""
 "неможливість встановлення з'єднання. У поточній версії стосується лише до "
 "розпізнавання за протоколом 802-1x."
 
-#: ../clients/common/settings-docs.h.in:152
+#: ../clients/common/settings-docs.h.in:153
 msgid ""
 "Whether or not the connection should be automatically connected by "
 "NetworkManager when the resources for the connection are available. TRUE to "
@@ -8015,7 +8087,7 @@ msgstr ""
 "якщо потрібна альтернатива для автоматичного встановлення з'єднань для "
 "профілів VPN."
 
-#: ../clients/common/settings-docs.h.in:153
+#: ../clients/common/settings-docs.h.in:154
 msgid ""
 "The autoconnect priority. If the connection is set to autoconnect, "
 "connections with higher priority will be preferred. Defaults to 0. The "
@@ -8026,7 +8098,7 @@ msgstr ""
 "пріоритетністю Типовим значенням пріоритетності є 0. Більші значення "
 "означають вищу пріоритетність."
 
-#: ../clients/common/settings-docs.h.in:154
+#: ../clients/common/settings-docs.h.in:155
 msgid ""
 "The number of times a connection should be tried when autoactivating before "
 "giving up. Zero means forever, -1 means the global default (4 times if not "
@@ -8041,7 +8113,7 @@ msgstr ""
 "виконуватиметься лише один раз. Зауважте, що по завершенню часу очікування "
 "NetworkManager знову спробує встановити з'єднання у автоматичному режимі."
 
-#: ../clients/common/settings-docs.h.in:155
+#: ../clients/common/settings-docs.h.in:156
 msgid ""
 "Whether or not slaves of this connection should be automatically brought up "
 "when NetworkManager activates this connection. This only has a real effect "
@@ -8063,7 +8135,7 @@ msgstr ""
 "slaves. Якщо і для нього встановлено типове значення, використовується "
 "значення 0."
 
-#: ../clients/common/settings-docs.h.in:156
+#: ../clients/common/settings-docs.h.in:157
 msgid ""
 "If greater than zero, delay success of IP addressing until either the "
 "timeout is reached, or an IP gateway replies to a ping."
@@ -8072,7 +8144,7 @@ msgstr ""
 "встановлення адреси IP, доки або не буде вичерпано час очікування або шлюз "
 "IP відповість на надісланий йому сигнал."
 
-#: ../clients/common/settings-docs.h.in:157
+#: ../clients/common/settings-docs.h.in:158
 msgid ""
 "A human readable unique identifier for the connection, like \"Work Wi-Fi\" "
 "or \"T-Mobile 3G\"."
@@ -8080,7 +8152,7 @@ msgstr ""
 "Зручний для читання ідентифікатор для цього з'єднання, наприклад «Робочий Wi-"
 "Fi» або «T-Mobile 3G»."
 
-#: ../clients/common/settings-docs.h.in:158
+#: ../clients/common/settings-docs.h.in:159
 msgid ""
 "The name of the network interface this connection is bound to. If not set, "
 "then the connection can be attached to any interface of the appropriate type "
@@ -8103,11 +8175,23 @@ msgstr ""
 "з'єднання. Якщо змінюється назва інтерфейсу або перевпорядковується список "
 "з'єднань, з'єднання може бути застосовано до помилкового інтерфейсу."
 
-#: ../clients/common/settings-docs.h.in:159
+#: ../clients/common/settings-docs.h.in:160
 msgid "Whether LLDP is enabled for the connection."
 msgstr "Визначає, чи увімкнено LLDP для з'єднання."
 
-#: ../clients/common/settings-docs.h.in:160
+#: ../clients/common/settings-docs.h.in:161
+#| msgid ""
+#| "Whether Link-Local Multicast Name Resolution (LLMNR) is enabled for the "
+#| "connection. LLMNR is a protocol based on the Domain Name System (DNS) "
+#| "packet format that allows both IPv4 and IPv6 hosts to perform name "
+#| "resolution for hosts on the same local link. The permitted values are: "
+#| "\"yes\" (2) register hostname and resolving for the connection, \"no"
+#| "\" (0) disable LLMNR for the interface, \"resolve\" (1) do not register "
+#| "hostname but allow resolving of LLMNR host names If unspecified, \"default"
+#| "\" ultimately depends on the DNS plugin (which for systemd-resolved "
+#| "currently means \"yes\"). This feature requires a plugin which supports "
+#| "LLMNR. Otherwise the setting has no effect. One such plugin is dns-"
+#| "systemd-resolved."
 msgid ""
 "Whether Link-Local Multicast Name Resolution (LLMNR) is enabled for the "
 "connection. LLMNR is a protocol based on the Domain Name System (DNS) packet "
@@ -8117,8 +8201,8 @@ msgid ""
 "interface, \"resolve\" (1) do not register hostname but allow resolving of "
 "LLMNR host names If unspecified, \"default\" ultimately depends on the DNS "
 "plugin (which for systemd-resolved currently means \"yes\"). This feature "
-"requires a plugin which supports LLMNR. Otherwise the setting has no effect. "
-"One such plugin is dns-systemd-resolved."
+"requires a plugin which supports LLMNR. Otherwise, the setting has no "
+"effect. One such plugin is dns-systemd-resolved."
 msgstr ""
 "Визначає, чи увімкнено Link-Local Multicast Name Resolution (LLMNR) для "
 "з'єднання. LLMNR — протокол, який засновано та форматі пакетів Domain Name "
@@ -8133,11 +8217,21 @@ msgstr ""
 "буде, параметр ні на що не впливатиме. Одним з таких додатків є dns-systemd-"
 "resolved."
 
-#: ../clients/common/settings-docs.h.in:161
+#: ../clients/common/settings-docs.h.in:162
 msgid "Interface name of the master device or UUID of the master connection."
 msgstr "Назва інтерфейсу основного пристрою або UUID основного з'єднання."
 
-#: ../clients/common/settings-docs.h.in:162
+#: ../clients/common/settings-docs.h.in:163
+#| msgid ""
+#| "Whether mDNS is enabled for the connection. The permitted values are: "
+#| "\"yes\" (2) register hostname and resolving for the connection, \"no"
+#| "\" (0) disable mDNS for the interface, \"resolve\" (1) do not register "
+#| "hostname but allow resolving of mDNS host names and \"default\" (-1) to "
+#| "allow lookup of a global default in NetworkManager.conf. If unspecified, "
+#| "\"default\" ultimately depends on the DNS plugin (which for systemd-"
+#| "resolved currently means \"no\"). This feature requires a plugin which "
+#| "supports mDNS. Otherwise the setting has no effect. One such plugin is "
+#| "dns-systemd-resolved."
 msgid ""
 "Whether mDNS is enabled for the connection. The permitted values are: \"yes"
 "\" (2) register hostname and resolving for the connection, \"no\" (0) "
@@ -8145,8 +8239,9 @@ msgid ""
 "allow resolving of mDNS host names and \"default\" (-1) to allow lookup of a "
 "global default in NetworkManager.conf. If unspecified, \"default\" "
 "ultimately depends on the DNS plugin (which for systemd-resolved currently "
-"means \"no\"). This feature requires a plugin which supports mDNS. Otherwise "
-"the setting has no effect. One such plugin is dns-systemd-resolved."
+"means \"no\"). This feature requires a plugin which supports mDNS. "
+"Otherwise, the setting has no effect. One such plugin is dns-systemd-"
+"resolved."
 msgstr ""
 "Визначає, чи увімкнено mDNS для з'єднання. Дозволені значення: «yes» (2): "
 "зареєструвати назву вузла і визначення адрес для з'єднання, «no» (0): "
@@ -8159,7 +8254,7 @@ msgstr ""
 "буде, параметр ні на що не впливатиме. Одним з таких додатків є dns-systemd-"
 "resolved."
 
-#: ../clients/common/settings-docs.h.in:163
+#: ../clients/common/settings-docs.h.in:164
 msgid ""
 "Whether the connection is metered. When updating this property on a "
 "currently activated connection, the change takes effect immediately."
@@ -8168,7 +8263,7 @@ msgstr ""
 "властивість для поточного активованого з'єднання, зміни набудуть чинності "
 "негайно."
 
-#: ../clients/common/settings-docs.h.in:164
+#: ../clients/common/settings-docs.h.in:165
 msgid ""
 "If configured, set to a Manufacturer Usage Description (MUD) URL that points "
 "to manufacturer-recommended network policies for IoT devices. It is "
@@ -8188,7 +8283,7 @@ msgstr ""
 "Якщо встановити значення за типовими параметрами не вдасться, остаточним "
 "типовим варіантом буде вибрано «none»."
 
-#: ../clients/common/settings-docs.h.in:165
+#: ../clients/common/settings-docs.h.in:166
 msgid ""
 "Specifies whether the profile can be active multiple times at a particular "
 "moment. The value is of type NMConnectionMultiConnect."
@@ -8196,7 +8291,7 @@ msgstr ""
 "Визначає, чи може бути профіль активним для декількох з'єднань одночасно. "
 "Значення належить до типу NMConnectionMultiConnect."
 
-#: ../clients/common/settings-docs.h.in:166
+#: ../clients/common/settings-docs.h.in:167
 msgid ""
 "An array of strings defining what access a given user has to this "
 "connection.  If this is NULL or empty, all users are allowed to access this "
@@ -8226,7 +8321,7 @@ msgstr ""
 "використано у майбутньому. Усі значення, [тип], [ідентифікатор] і "
 "[зарезервоване значення], мають бути коректними рядками UTF-8."
 
-#: ../clients/common/settings-docs.h.in:167
+#: ../clients/common/settings-docs.h.in:168
 msgid ""
 "FALSE if the connection can be modified using the provided settings "
 "service's D-Bus interface with the right privileges, or TRUE if the "
@@ -8237,15 +8332,19 @@ msgstr ""
 "якщо параметри з'єднання є придатними лише для читання, і їх не можна "
 "змінювати."
 
-#: ../clients/common/settings-docs.h.in:168
+#: ../clients/common/settings-docs.h.in:169
+#| msgid ""
+#| "List of connection UUIDs that should be activated when the base "
+#| "connection itself is activated. Currently only VPN connections are "
+#| "supported."
 msgid ""
 "List of connection UUIDs that should be activated when the base connection "
-"itself is activated. Currently only VPN connections are supported."
+"itself is activated. Currently, only VPN connections are supported."
 msgstr ""
 "Список UUID з'єднань, які має бути активовано, якщо активовано базове "
 "з'єднання. У поточній версії передбачено підтримку лише з'єднань VPN."
 
-#: ../clients/common/settings-docs.h.in:169
+#: ../clients/common/settings-docs.h.in:170
 msgid ""
 "Setting name of the device type of this slave's master connection (eg, \"bond"
 "\"), or NULL if this connection is not a slave."
@@ -8253,7 +8352,36 @@ msgstr ""
 "Встановлює назву типу пристрою для основного з'єднання цього підлеглого "
 "з'єднання (наприклад «bond») або NULL, якщо це з'єднання не є підлеглим."
 
-#: ../clients/common/settings-docs.h.in:170
+#: ../clients/common/settings-docs.h.in:171
+#| msgid ""
+#| "This represents the identity of the connection used for various purposes. "
+#| "It allows to configure multiple profiles to share the identity. Also, the "
+#| "stable-id can contain placeholders that are substituted dynamically and "
+#| "deterministically depending on the context. The stable-id is used for "
+#| "generating IPv6 stable private addresses with ipv6.addr-gen-mode=stable-"
+#| "privacy. It is also used to seed the generated cloned MAC address for "
+#| "ethernet.cloned-mac-address=stable and wifi.cloned-mac-address=stable. It "
+#| "is also used as DHCP client identifier with ipv4.dhcp-client-id=stable "
+#| "and to derive the DHCP DUID with ipv6.dhcp-duid=stable-[llt,ll,uuid]. "
+#| "Note that depending on the context where it is used, other parameters are "
+#| "also seeded into the generation algorithm. For example, a per-host key is "
+#| "commonly also included, so that different systems end up generating "
+#| "different IDs. Or with ipv6.addr-gen-mode=stable-privacy, also the "
+#| "device's name is included, so that different interfaces yield different "
+#| "addresses. The '$' character is treated special to perform dynamic "
+#| "substitutions at runtime. Currently supported are \"${CONNECTION}\", "
+#| "\"${DEVICE}\", \"${MAC}\", \"${BOOT}\", \"${RANDOM}\". These effectively "
+#| "create unique IDs per-connection, per-device, per-boot, or every time. "
+#| "Note that \"${DEVICE}\" corresponds to the interface name of the device "
+#| "and \"${MAC}\" is the permanent MAC address of the device. Any "
+#| "unrecognized patterns following '$' are treated verbatim, however are "
+#| "reserved for future use. You are thus advised to avoid '$' or escape it "
+#| "as \"$$\". For example, set it to \"${CONNECTION}-${BOOT}-${DEVICE}\" to "
+#| "create a unique id for this connection that changes with every reboot and "
+#| "differs depending on the interface where the profile activates. If the "
+#| "value is unset, a global connection default is consulted. If the value is "
+#| "still unset, the default is similar to \"${CONNECTION}\" and uses a "
+#| "unique, fixed ID for the connection."
 msgid ""
 "This represents the identity of the connection used for various purposes. It "
 "allows to configure multiple profiles to share the identity. Also, the "
@@ -8269,7 +8397,7 @@ msgid ""
 "included, so that different systems end up generating different IDs. Or with "
 "ipv6.addr-gen-mode=stable-privacy, also the device's name is included, so "
 "that different interfaces yield different addresses. The '$' character is "
-"treated special to perform dynamic substitutions at runtime. Currently "
+"treated special to perform dynamic substitutions at runtime. Currently, "
 "supported are \"${CONNECTION}\", \"${DEVICE}\", \"${MAC}\", \"${BOOT}\", "
 "\"${RANDOM}\". These effectively create unique IDs per-connection, per-"
 "device, per-boot, or every time. Note that \"${DEVICE}\" corresponds to the "
@@ -8319,7 +8447,7 @@ msgstr ""
 "алгоритму для «${CONNECTION}», і використано унікальний фіксований "
 "ідентифікатор для з'єднання."
 
-#: ../clients/common/settings-docs.h.in:171
+#: ../clients/common/settings-docs.h.in:172
 msgid ""
 "The time, in seconds since the Unix Epoch, that the connection was last "
 "_successfully_ fully activated. NetworkManager updates the connection "
@@ -8333,7 +8461,7 @@ msgstr ""
 "активного з'єднання найсвіжішої часової позначки. Властивість можна лише "
 "читати (зміни до цієї властивості не зберігатимуться)."
 
-#: ../clients/common/settings-docs.h.in:172
+#: ../clients/common/settings-docs.h.in:173
 msgid ""
 "Base type of the connection. For hardware-dependent connections, should "
 "contain the setting name of the hardware-type specific setting (ie, \"802-3-"
@@ -8347,7 +8475,7 @@ msgstr ""
 "з'єднань VPN та інших має містити назву параметра відповідного типу "
 "параметрів (тобто «vpn» або «bridge» тощо)."
 
-#: ../clients/common/settings-docs.h.in:173
+#: ../clients/common/settings-docs.h.in:174
 msgid ""
 "A universally unique identifier for the connection, for example generated "
 "with libuuid.  It should be assigned when the connection is created, and "
@@ -8369,7 +8497,7 @@ msgstr ""
 "«2815492f-7e56-435e-b2e9-246bd7cdc664» (тобто у форматі запису, який містить "
 "лише шістнадцяткові цифри і символи «-»)."
 
-#: ../clients/common/settings-docs.h.in:174
+#: ../clients/common/settings-docs.h.in:175
 msgid ""
 "Timeout in milliseconds to wait for device at startup. During boot, devices "
 "may take a while to be detected by the driver. This property will cause to "
@@ -8389,7 +8517,7 @@ msgstr ""
 "значенням є -1, що у поточній версії означає, що очікування на запуск "
 "пристрою не буде."
 
-#: ../clients/common/settings-docs.h.in:175
+#: ../clients/common/settings-docs.h.in:176
 msgid ""
 "The trust level of a the connection.  Free form case-insensitive string (for "
 "example \"Home\", \"Work\", \"Public\").  NULL or unspecified zone means the "
@@ -8403,7 +8531,7 @@ msgstr ""
 "брандмауером. Якщо ця властивість оновлюється для поточного активованого "
 "з'єднання, зміни набудуть чинності негайно."
 
-#: ../clients/common/settings-docs.h.in:176
+#: ../clients/common/settings-docs.h.in:177
 msgid ""
 "Specifies the NMSettingDcbFlags for the DCB FCoE application.  Flags may be "
 "any combination of NM_SETTING_DCB_FLAG_ENABLE (0x1), "
@@ -8413,11 +8541,11 @@ msgstr ""
 "будь-яка комбінація NM_SETTING_DCB_FLAG_ENABLE (0x1), "
 "NM_SETTING_DCB_FLAG_ADVERTISE (0x2) і NM_SETTING_DCB_FLAG_WILLING (0x4)."
 
-#: ../clients/common/settings-docs.h.in:177
+#: ../clients/common/settings-docs.h.in:178
 msgid "The FCoE controller mode; either \"fabric\" (default) or \"vn2vn\"."
 msgstr "Режим контролера FCoE; або «fabric» (типовий), або «vn2vn»."
 
-#: ../clients/common/settings-docs.h.in:178
+#: ../clients/common/settings-docs.h.in:179
 msgid ""
 "The highest User Priority (0 - 7) which FCoE frames should use, or -1 for "
 "default priority.  Only used when the \"app-fcoe-flags\" property includes "
@@ -8428,7 +8556,7 @@ msgstr ""
 "лише якщо до властивості «app-fcoe-flags» включає прапорець "
 "NM_SETTING_DCB_FLAG_ENABLE (0x1)."
 
-#: ../clients/common/settings-docs.h.in:179
+#: ../clients/common/settings-docs.h.in:180
 msgid ""
 "Specifies the NMSettingDcbFlags for the DCB FIP application.  Flags may be "
 "any combination of NM_SETTING_DCB_FLAG_ENABLE (0x1), "
@@ -8438,7 +8566,7 @@ msgstr ""
 "будь-якою комбінацією NM_SETTING_DCB_FLAG_ENABLE (0x1), "
 "NM_SETTING_DCB_FLAG_ADVERTISE (0x2) і NM_SETTING_DCB_FLAG_WILLING (0x4)."
 
-#: ../clients/common/settings-docs.h.in:180
+#: ../clients/common/settings-docs.h.in:181
 msgid ""
 "The highest User Priority (0 - 7) which FIP frames should use, or -1 for "
 "default priority.  Only used when the \"app-fip-flags\" property includes "
@@ -8449,7 +8577,7 @@ msgstr ""
 "лише якщо до властивості «app-fip-flags» включає прапорець "
 "NM_SETTING_DCB_FLAG_ENABLE (0x1)."
 
-#: ../clients/common/settings-docs.h.in:181
+#: ../clients/common/settings-docs.h.in:182
 msgid ""
 "Specifies the NMSettingDcbFlags for the DCB iSCSI application.  Flags may be "
 "any combination of NM_SETTING_DCB_FLAG_ENABLE (0x1), "
@@ -8459,7 +8587,7 @@ msgstr ""
 "будь-якою комбінацією NM_SETTING_DCB_FLAG_ENABLE (0x1), "
 "NM_SETTING_DCB_FLAG_ADVERTISE (0x2) і NM_SETTING_DCB_FLAG_WILLING (0x4)."
 
-#: ../clients/common/settings-docs.h.in:182
+#: ../clients/common/settings-docs.h.in:183
 msgid ""
 "The highest User Priority (0 - 7) which iSCSI frames should use, or -1 for "
 "default priority. Only used when the \"app-iscsi-flags\" property includes "
@@ -8470,7 +8598,7 @@ msgstr ""
 "лише якщо до властивості «app-iscsi-flags» включає прапорець "
 "NM_SETTING_DCB_FLAG_ENABLE (0x1)."
 
-#: ../clients/common/settings-docs.h.in:183
+#: ../clients/common/settings-docs.h.in:184
 msgid ""
 "An array of 8 uint values, where the array index corresponds to the User "
 "Priority (0 - 7) and the value indicates the percentage of bandwidth of the "
@@ -8484,7 +8612,7 @@ msgstr ""
 "може використовувати. Сума усіх значень у межах однієї групи має складати "
 "100 відсотків."
 
-#: ../clients/common/settings-docs.h.in:184
+#: ../clients/common/settings-docs.h.in:185
 msgid ""
 "An array of 8 boolean values, where the array index corresponds to the User "
 "Priority (0 - 7) and the value indicates whether or not the corresponding "
@@ -8494,7 +8622,7 @@ msgstr ""
 "користувача (від 0 до 7), а значення відповідає за те, чи має відповідна "
 "пріоритетність передавати паузу пріоритетності."
 
-#: ../clients/common/settings-docs.h.in:185
+#: ../clients/common/settings-docs.h.in:186
 msgid ""
 "Specifies the NMSettingDcbFlags for DCB Priority Flow Control (PFC). Flags "
 "may be any combination of NM_SETTING_DCB_FLAG_ENABLE (0x1), "
@@ -8504,7 +8632,7 @@ msgstr ""
 "Прапорці можуть бути будь-якою комбінацією NM_SETTING_DCB_FLAG_ENABLE (0x1), "
 "NM_SETTING_DCB_FLAG_ADVERTISE (0x2) і NM_SETTING_DCB_FLAG_WILLING (0x4)."
 
-#: ../clients/common/settings-docs.h.in:186
+#: ../clients/common/settings-docs.h.in:187
 msgid ""
 "An array of 8 uint values, where the array index corresponds to the Priority "
 "Group ID (0 - 7) and the value indicates the percentage of link bandwidth "
@@ -8516,7 +8644,7 @@ msgstr ""
 "каналу з'єднання, яку пов'язано із відповідною групою. Допустимими є "
 "значення від 0 до 100. Сума усіх значень має складати 100 відсотків."
 
-#: ../clients/common/settings-docs.h.in:187
+#: ../clients/common/settings-docs.h.in:188
 msgid ""
 "Specifies the NMSettingDcbFlags for DCB Priority Groups.  Flags may be any "
 "combination of NM_SETTING_DCB_FLAG_ENABLE (0x1), "
@@ -8526,7 +8654,7 @@ msgstr ""
 "будь-якою комбінацією NM_SETTING_DCB_FLAG_ENABLE (0x1), "
 "NM_SETTING_DCB_FLAG_ADVERTISE (0x2) і NM_SETTING_DCB_FLAG_WILLING (0x4)"
 
-#: ../clients/common/settings-docs.h.in:188
+#: ../clients/common/settings-docs.h.in:189
 msgid ""
 "An array of 8 uint values, where the array index corresponds to the User "
 "Priority (0 - 7) and the value indicates the Priority Group ID.  Allowed "
@@ -8537,7 +8665,7 @@ msgstr ""
 "пріоритетності. Дозволеними значенням ідентифікатора групи пріоритетності є "
 "значення від 0 до 7 або 15 для групи без обмежень."
 
-#: ../clients/common/settings-docs.h.in:189
+#: ../clients/common/settings-docs.h.in:190
 msgid ""
 "An array of 8 boolean values, where the array index corresponds to the User "
 "Priority (0 - 7) and the value indicates whether or not the priority may use "
@@ -8548,7 +8676,7 @@ msgstr ""
 "пріоритетність використовувати усю ширину каналу, пов'язаного із відповідною "
 "групою."
 
-#: ../clients/common/settings-docs.h.in:190
+#: ../clients/common/settings-docs.h.in:191
 msgid ""
 "An array of 8 uint values, where the array index corresponds to the User "
 "Priority (0 - 7) and the value indicates the traffic class (0 - 7) to which "
@@ -8558,7 +8686,7 @@ msgstr ""
 "користувача (0 - 7), а значення відповідає за клас передавання даних (від 0 "
 "до 7), із яким пов'язано пріоритетність."
 
-#: ../clients/common/settings-docs.h.in:191
+#: ../clients/common/settings-docs.h.in:192
 msgid ""
 "The GPRS Access Point Name specifying the APN used when establishing a data "
 "session with the GSM-based network.  The APN often determines how the user "
@@ -8576,7 +8704,7 @@ msgstr ""
 "користувача важливо використовувати належну APN. Назва APN може складатися "
 "лише із символів a-z, 0-9, . та - за стандартом GSM 03.60, розділ 14.9."
 
-#: ../clients/common/settings-docs.h.in:192
+#: ../clients/common/settings-docs.h.in:193
 msgid ""
 "When TRUE, the settings such as APN, username, or password will default to "
 "values that match the network the modem will register to in the Mobile "
@@ -8587,7 +8715,7 @@ msgstr ""
 "зареєстровано модем у бази даних надавачів послуг мобільного широкосмугового "
 "доступу до інтернету."
 
-#: ../clients/common/settings-docs.h.in:193
+#: ../clients/common/settings-docs.h.in:194
 msgid ""
 "The device unique identifier (as given by the WWAN management service) which "
 "this connection applies to.  If given, the connection will only apply to the "
@@ -8597,7 +8725,7 @@ msgstr ""
 "WWAN), до якого застосовується це з'єднання. Якщо вказано, з'єднання "
 "застосовуватиметься лише для вказаного пристрою."
 
-#: ../clients/common/settings-docs.h.in:194
+#: ../clients/common/settings-docs.h.in:195
 msgid ""
 "When TRUE, only connections to the home network will be allowed. Connections "
 "to roaming networks will not be made."
@@ -8605,7 +8733,7 @@ msgstr ""
 "Якщо має значення TRUE, буде дозволено лише з'єднання із домашньою мережею. "
 "З'єднання із мережами роумінґу не виконуватимуться."
 
-#: ../clients/common/settings-docs.h.in:196
+#: ../clients/common/settings-docs.h.in:197
 msgid ""
 "The Network ID (GSM LAI format, ie MCC-MNC) to force specific network "
 "registration.  If the Network ID is specified, NetworkManager will attempt "
@@ -8620,7 +8748,7 @@ msgstr ""
 "роумінґовою мережею, якщо керування роумінґом пристрою у інший спосіб "
 "неможливе."
 
-#: ../clients/common/settings-docs.h.in:197
+#: ../clients/common/settings-docs.h.in:198
 msgid ""
 "Legacy setting that used to help establishing PPP data sessions for GSM-"
 "based modems. Deprecated: 1"
@@ -8628,7 +8756,7 @@ msgstr ""
 "Застарілий параметр, який використовувався для полегшення встановлення "
 "сеансів обміну даними PPP для модемів на основі технології GSM. Застарілий: 1"
 
-#: ../clients/common/settings-docs.h.in:200
+#: ../clients/common/settings-docs.h.in:201
 msgid ""
 "If the SIM is locked with a PIN it must be unlocked before any other "
 "operations are requested.  Specify the PIN here to allow operation of the "
@@ -8638,7 +8766,7 @@ msgstr ""
 "виконувати будь-які інші дії. Тут слід вказати PIN-код, який відкриває "
 "доступ до дій із пристроєм."
 
-#: ../clients/common/settings-docs.h.in:202
+#: ../clients/common/settings-docs.h.in:203
 msgid ""
 "The SIM card unique identifier (as given by the WWAN management service) "
 "which this connection applies to.  If given, the connection will apply to "
@@ -8650,7 +8778,7 @@ msgstr ""
 "застосовуватиметься до будь-якого пристрою, який також дозволено «device-"
 "id», де міститься значення відповідності SIM-картки вказаному ідентифікатору."
 
-#: ../clients/common/settings-docs.h.in:203
+#: ../clients/common/settings-docs.h.in:204
 msgid ""
 "A MCC/MNC string like \"310260\" or \"21601\" identifying the specific "
 "mobile network operator which this connection applies to.  If given, the "
@@ -8663,7 +8791,7 @@ msgstr ""
 "властивостями «device-id» і «sim-id» і який містить SIM-картку, яку випущено "
 "вказаним оператором."
 
-#: ../clients/common/settings-docs.h.in:205
+#: ../clients/common/settings-docs.h.in:206
 msgid ""
 "If specified, this connection will only apply to the IPoIB device whose "
 "permanent MAC address matches. This property does not change the MAC address "
@@ -8673,10 +8801,15 @@ msgstr ""
 "відповідною сталою адресою MAC. Ця властивість не змінює MAC-адреси пристрою "
 "(таку зміну називають підміною MAC)."
 
-#: ../clients/common/settings-docs.h.in:207
+#: ../clients/common/settings-docs.h.in:208
+#| msgid ""
+#| "The InfiniBand P_Key to use for this device. A value of -1 means to use "
+#| "the default P_Key (aka \"the P_Key at index 0\").  Otherwise it is a 16-"
+#| "bit unsigned integer, whose high bit is set if it is a \"full membership"
+#| "\" P_Key."
 msgid ""
 "The InfiniBand P_Key to use for this device. A value of -1 means to use the "
-"default P_Key (aka \"the P_Key at index 0\").  Otherwise it is a 16-bit "
+"default P_Key (aka \"the P_Key at index 0\"). Otherwise, it is a 16-bit "
 "unsigned integer, whose high bit is set if it is a \"full membership\" P_Key."
 msgstr ""
 "P_Key InfiniBand , який слід використати для цього пристрою. Значення -1 "
@@ -8684,7 +8817,7 @@ msgstr ""
 "Інші значення має бути вказано у форматі 16-бітового цілого числа без знаку, "
 "старший біт якого дорівнює одиниці, якщо P_Key є ключем «повного членства»."
 
-#: ../clients/common/settings-docs.h.in:208
+#: ../clients/common/settings-docs.h.in:209
 msgid ""
 "The interface name of the parent device of this device. Normally NULL, but "
 "if the \"p_key\" property is set, then you must specify the base device by "
@@ -8695,14 +8828,14 @@ msgstr ""
 "вказати базовий пристрій або встановленням значення для цієї властивості, "
 "або встановленням значення для властивості «mac-address»."
 
-#: ../clients/common/settings-docs.h.in:209
+#: ../clients/common/settings-docs.h.in:210
 msgid ""
 "The IP-over-InfiniBand transport mode. Either \"datagram\" or \"connected\"."
 msgstr ""
 "Режим передавання IP-over-InfiniBand. Можливі значення: «datagram» або "
 "«connected»."
 
-#: ../clients/common/settings-docs.h.in:210
+#: ../clients/common/settings-docs.h.in:211
 msgid ""
 "How many additional levels of encapsulation are permitted to be prepended to "
 "packets. This property applies only to IPv6 tunnels."
@@ -8710,9 +8843,17 @@ msgstr ""
 "Кількість додаткових рівнів вкладеності, які дозволено дописувати до "
 "пакетів. Цю властивість стосується лише тунелів IPv6."
 
-#: ../clients/common/settings-docs.h.in:211
+#: ../clients/common/settings-docs.h.in:212
+#| msgid ""
+#| "Tunnel flags. Currently the following values are supported: "
+#| "NM_IP_TUNNEL_FLAG_IP6_IGN_ENCAP_LIMIT (0x1), "
+#| "NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_TCLASS (0x2), "
+#| "NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_FLOWLABEL (0x4), "
+#| "NM_IP_TUNNEL_FLAG_IP6_MIP6_DEV (0x8), NM_IP_TUNNEL_FLAG_IP6_RCV_DSCP_COPY "
+#| "(0x10), NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_FWMARK (0x20). They are valid only "
+#| "for IPv6 tunnels."
 msgid ""
-"Tunnel flags. Currently the following values are supported: "
+"Tunnel flags. Currently, the following values are supported: "
 "NM_IP_TUNNEL_FLAG_IP6_IGN_ENCAP_LIMIT (0x1), "
 "NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_TCLASS (0x2), "
 "NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_FLOWLABEL (0x4), "
@@ -8728,14 +8869,14 @@ msgstr ""
 "(0x10), NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_FWMARK (0x20). Ці значення є "
 "коректними лише для тунелів IPv6."
 
-#: ../clients/common/settings-docs.h.in:212
+#: ../clients/common/settings-docs.h.in:213
 msgid ""
 "The flow label to assign to tunnel packets. This property applies only to "
 "IPv6 tunnels."
 msgstr ""
 "Мітка потоку для пакетів тунелю. Ця властивість стосується лише тунелів IPv6."
 
-#: ../clients/common/settings-docs.h.in:213
+#: ../clients/common/settings-docs.h.in:214
 msgid ""
 "The key used for tunnel input packets; the property is valid only for "
 "certain tunnel modes (GRE, IP6GRE). If empty, no key is used."
@@ -8744,7 +8885,7 @@ msgstr ""
 "лише для певних режимів роботи тунелю (GRE, IP6GRE). Якщо порожній, ключ не "
 "використовується."
 
-#: ../clients/common/settings-docs.h.in:214
+#: ../clients/common/settings-docs.h.in:215
 msgid ""
 "The local endpoint of the tunnel; the value can be empty, otherwise it must "
 "contain an IPv4 or IPv6 address."
@@ -8752,7 +8893,7 @@ msgstr ""
 "Локальна кінцева точка тунелю; значення може бути порожнім або має містити "
 "адресу IPv4 або IPv6."
 
-#: ../clients/common/settings-docs.h.in:215
+#: ../clients/common/settings-docs.h.in:216
 msgid ""
 "The tunneling mode, for example NM_IP_TUNNEL_MODE_IPIP (1) or "
 "NM_IP_TUNNEL_MODE_GRE (2)."
@@ -8760,7 +8901,7 @@ msgstr ""
 "Режим тунелювання, наприклад NM_IP_TUNNEL_MODE_IPIP (1) або "
 "NM_IP_TUNNEL_MODE_GRE (2)."
 
-#: ../clients/common/settings-docs.h.in:216
+#: ../clients/common/settings-docs.h.in:217
 msgid ""
 "If non-zero, only transmit packets of the specified size or smaller, "
 "breaking larger packets up into multiple fragments."
@@ -8768,7 +8909,7 @@ msgstr ""
 "Якщо має ненульове значення, передавати пакети лише вказаного або меншого "
 "розміру, розбиваючи великі пакети на декілька фрагментів."
 
-#: ../clients/common/settings-docs.h.in:217
+#: ../clients/common/settings-docs.h.in:218
 msgid ""
 "The key used for tunnel output packets; the property is valid only for "
 "certain tunnel modes (GRE, IP6GRE). If empty, no key is used."
@@ -8777,7 +8918,7 @@ msgstr ""
 "чинною лише для певних режимів роботи тунелю (GRE, IP6GRE). Якщо порожній, "
 "ключ не використовується."
 
-#: ../clients/common/settings-docs.h.in:218
+#: ../clients/common/settings-docs.h.in:219
 msgid ""
 "If given, specifies the parent interface name or parent connection UUID the "
 "new device will be bound to so that tunneled packets will only be routed via "
@@ -8787,18 +8928,18 @@ msgstr ""
 "з'єднання, до якого буде прив'язано новий пристрій так, що тунельовані "
 "пакети маршрутизуватимуться лише крізь цей інтерфейс."
 
-#: ../clients/common/settings-docs.h.in:219
+#: ../clients/common/settings-docs.h.in:220
 msgid "Whether to enable Path MTU Discovery on this tunnel."
 msgstr "Визначає, чи слід вмикати Path MTU Discovery для цього тунелю."
 
-#: ../clients/common/settings-docs.h.in:220
+#: ../clients/common/settings-docs.h.in:221
 msgid ""
 "The remote endpoint of the tunnel; the value must contain an IPv4 or IPv6 "
 "address."
 msgstr ""
 "Віддалена кінцева точка тунелю; значення має містити адресу IPv4 або IPv6."
 
-#: ../clients/common/settings-docs.h.in:221
+#: ../clients/common/settings-docs.h.in:222
 msgid ""
 "The type of service (IPv4) or traffic class (IPv6) field to be set on "
 "tunneled packets."
@@ -8806,7 +8947,7 @@ msgstr ""
 "Поле типу служби (IPv4) або класу передавання даних (IPv6), яке слід "
 "встановити для тунельованих пакетів."
 
-#: ../clients/common/settings-docs.h.in:222
+#: ../clients/common/settings-docs.h.in:223
 msgid ""
 "The TTL to assign to tunneled packets. 0 is a special value meaning that "
 "packets inherit the TTL value."
@@ -8814,13 +8955,13 @@ msgstr ""
 "Значення TTL, яке слід призначити для тунельованих пакетів. 0 — спеціальне "
 "значення, яке означає, що пакети успадковують значення TTL."
 
-#: ../clients/common/settings-docs.h.in:223
-#: ../clients/common/settings-docs.h.in:246
+#: ../clients/common/settings-docs.h.in:224
+#: ../clients/common/settings-docs.h.in:247
 msgid "Array of IP addresses."
 msgstr "Масив IP-адрес."
 
-#: ../clients/common/settings-docs.h.in:224
-#: ../clients/common/settings-docs.h.in:247
+#: ../clients/common/settings-docs.h.in:225
+#: ../clients/common/settings-docs.h.in:248
 msgid ""
 "Timeout in milliseconds used to check for the presence of duplicate IP "
 "addresses on the network.  If an address conflict is detected, the "
@@ -8837,7 +8978,7 @@ msgstr ""
 "перевищує нуль, вважатиметься часом очікування у мілісекундах. Цю "
 "властивість у поточній версії реалізовано лише для IPv4."
 
-#: ../clients/common/settings-docs.h.in:225
+#: ../clients/common/settings-docs.h.in:226
 msgid ""
 "A string sent to the DHCP server to identify the local machine which the "
 "DHCP server may use to customize the DHCP lease and options. When the "
@@ -8881,7 +9022,7 @@ msgstr ""
 "налаштоване значення. Якщо і це значення не налаштовано, типове значення "
 "залежатиме від додатка DHCP."
 
-#: ../clients/common/settings-docs.h.in:226
+#: ../clients/common/settings-docs.h.in:227
 msgid ""
 "If the \"dhcp-send-hostname\" property is TRUE, then the specified FQDN will "
 "be sent to the DHCP server when acquiring a lease. This property and \"dhcp-"
@@ -8891,8 +9032,8 @@ msgstr ""
 "адреси до сервера DHCP буде надіслано вказану FDQN. Цю властивість не можна "
 "використовувати разом із властивістю «dhcp-hostname»."
 
-#: ../clients/common/settings-docs.h.in:227
-#: ../clients/common/settings-docs.h.in:249
+#: ../clients/common/settings-docs.h.in:228
+#: ../clients/common/settings-docs.h.in:250
 msgid ""
 "If the \"dhcp-send-hostname\" property is TRUE, then the specified name will "
 "be sent to the DHCP server when acquiring a lease. This property and \"dhcp-"
@@ -8902,10 +9043,26 @@ msgstr ""
 "адреси до сервера DHCP буде надіслано вказану назву. Цю властивість не можна "
 "використовувати разом із властивістю «dhcp-fqdn»."
 
-#: ../clients/common/settings-docs.h.in:228
-#: ../clients/common/settings-docs.h.in:250
+#: ../clients/common/settings-docs.h.in:229
+#: ../clients/common/settings-docs.h.in:251
+#| msgid ""
+#| "Flags for the DHCP hostname and FQDN. Currently this property only "
+#| "includes flags to control the FQDN flags set in the DHCP FQDN option. "
+#| "Supported FQDN flags are NM_DHCP_HOSTNAME_FLAG_FQDN_SERV_UPDATE (0x1), "
+#| "NM_DHCP_HOSTNAME_FLAG_FQDN_ENCODED (0x2) and "
+#| "NM_DHCP_HOSTNAME_FLAG_FQDN_NO_UPDATE (0x4).  When no FQDN flag is set and "
+#| "NM_DHCP_HOSTNAME_FLAG_FQDN_CLEAR_FLAGS (0x8) is set, the DHCP FQDN option "
+#| "will contain no flag. Otherwise, if no FQDN flag is set and "
+#| "NM_DHCP_HOSTNAME_FLAG_FQDN_CLEAR_FLAGS (0x8) is not set, the standard "
+#| "FQDN flags are set in the request: NM_DHCP_HOSTNAME_FLAG_FQDN_SERV_UPDATE "
+#| "(0x1), NM_DHCP_HOSTNAME_FLAG_FQDN_ENCODED (0x2) for IPv4 and "
+#| "NM_DHCP_HOSTNAME_FLAG_FQDN_SERV_UPDATE (0x1) for IPv6. When this property "
+#| "is set to the default value NM_DHCP_HOSTNAME_FLAG_NONE (0x0), a global "
+#| "default is looked up in NetworkManager configuration. If that value is "
+#| "unset or also NM_DHCP_HOSTNAME_FLAG_NONE (0x0), then the standard FQDN "
+#| "flags described above are sent in the DHCP requests."
 msgid ""
-"Flags for the DHCP hostname and FQDN. Currently this property only includes "
+"Flags for the DHCP hostname and FQDN. Currently, this property only includes "
 "flags to control the FQDN flags set in the DHCP FQDN option. Supported FQDN "
 "flags are NM_DHCP_HOSTNAME_FLAG_FQDN_SERV_UPDATE (0x1), "
 "NM_DHCP_HOSTNAME_FLAG_FQDN_ENCODED (0x2) and "
@@ -8940,8 +9097,8 @@ msgstr ""
 "NM_DHCP_HOSTNAME_FLAG_NONE (0x0), у запитах DHCP надсилатимуться стандартні "
 "прапорці FQDN, описані вище."
 
-#: ../clients/common/settings-docs.h.in:229
-#: ../clients/common/settings-docs.h.in:251
+#: ../clients/common/settings-docs.h.in:230
+#: ../clients/common/settings-docs.h.in:252
 msgid ""
 "A string containing the \"Identity Association Identifier\" (IAID) used by "
 "the DHCP client. The property is a 32-bit decimal value or a special value "
@@ -8970,8 +9127,8 @@ msgstr ""
 "буде проігноровано у dhclient, який завжди визначає IAID на основі MAC-"
 "адреси."
 
-#: ../clients/common/settings-docs.h.in:230
-#: ../clients/common/settings-docs.h.in:252
+#: ../clients/common/settings-docs.h.in:231
+#: ../clients/common/settings-docs.h.in:253
 msgid ""
 "If TRUE, a hostname is sent to the DHCP server when acquiring a lease. Some "
 "DHCP servers use this hostname to update DNS databases, essentially "
@@ -8986,8 +9143,8 @@ msgstr ""
 "властивості вказано значення TRUE, буде надіслано поточну стану назву вузла "
 "комп'ютера."
 
-#: ../clients/common/settings-docs.h.in:231
-#: ../clients/common/settings-docs.h.in:253
+#: ../clients/common/settings-docs.h.in:232
+#: ../clients/common/settings-docs.h.in:254
 msgid ""
 "A timeout for a DHCP transaction in seconds. If zero (the default), a "
 "globally configured default is used. If still unspecified, a device specific "
@@ -9001,13 +9158,13 @@ msgstr ""
 "секунд). Встановіть значення 2147483647 (MAXINT32), якщо час очікування має "
 "бути необмеженим."
 
-#: ../clients/common/settings-docs.h.in:232
-#: ../clients/common/settings-docs.h.in:254
+#: ../clients/common/settings-docs.h.in:233
+#: ../clients/common/settings-docs.h.in:255
 msgid "Array of IP addresses of DNS servers."
 msgstr "Масив IP-адрес серверів DNS."
 
-#: ../clients/common/settings-docs.h.in:233
-#: ../clients/common/settings-docs.h.in:255
+#: ../clients/common/settings-docs.h.in:234
+#: ../clients/common/settings-docs.h.in:256
 msgid ""
 "Array of DNS options as described in man 5 resolv.conf. NULL means that the "
 "options are unset and left at the default. In this case NetworkManager will "
@@ -9031,8 +9188,8 @@ msgstr ""
 "уваги, лише якщо профіль вказує сервери назв у resolv.conf і для всіх "
 "відповідних профілів увімкнено «trust-ad»."
 
-#: ../clients/common/settings-docs.h.in:234
-#: ../clients/common/settings-docs.h.in:256
+#: ../clients/common/settings-docs.h.in:235
+#: ../clients/common/settings-docs.h.in:257
 msgid ""
 "DNS servers priority. The relative priority for DNS servers specified by "
 "this setting.  A lower value is better (higher priority). Zero selects a "
@@ -9088,8 +9245,8 @@ msgstr ""
 "домен, який є піддоменом іншого домену із від'ємним значенням пріоритетності "
 "DNS, цей піддомен буде проігноровано."
 
-#: ../clients/common/settings-docs.h.in:235
-#: ../clients/common/settings-docs.h.in:257
+#: ../clients/common/settings-docs.h.in:236
+#: ../clients/common/settings-docs.h.in:258
 msgid ""
 "Array of DNS search domains. Domains starting with a tilde ('~') are "
 "considered 'routing' domains and are used only to decide the interface over "
@@ -9101,8 +9258,8 @@ msgstr ""
 "визначення інтерфейсу, крізь який слід спрямовувати запит; такі записи не "
 "використовуватимуться для доповнення неповних назв вузлів."
 
-#: ../clients/common/settings-docs.h.in:236
-#: ../clients/common/settings-docs.h.in:258
+#: ../clients/common/settings-docs.h.in:237
+#: ../clients/common/settings-docs.h.in:259
 msgid ""
 "The gateway associated with this configuration. This is only meaningful if "
 "\"addresses\" is also set. The gateway's main purpose is to control the next "
@@ -9118,8 +9275,8 @@ msgstr ""
 "налаштувань IP вказано never-default. Альтернативою встановленню шлюзу є "
 "налаштовування статичного типового маршруту з довжиною префікса /0."
 
-#: ../clients/common/settings-docs.h.in:237
-#: ../clients/common/settings-docs.h.in:259
+#: ../clients/common/settings-docs.h.in:238
+#: ../clients/common/settings-docs.h.in:260
 msgid ""
 "When \"method\" is set to \"auto\" and this property to TRUE, automatically "
 "configured nameservers and search domains are ignored and only nameservers "
@@ -9132,8 +9289,8 @@ msgstr ""
 "пошуку, вказані за допомогою властивостей «dns» і «dns-search», якщо буде "
 "вказано якісь записи серверів і доменів для цих властивостей."
 
-#: ../clients/common/settings-docs.h.in:238
-#: ../clients/common/settings-docs.h.in:260
+#: ../clients/common/settings-docs.h.in:239
+#: ../clients/common/settings-docs.h.in:261
 msgid ""
 "When \"method\" is set to \"auto\" and this property to TRUE, automatically "
 "configured routes are ignored and only routes specified in the \"routes\" "
@@ -9144,8 +9301,8 @@ msgstr ""
 "використовуватимуться лише маршрути, вказані за допомогою властивості "
 "«routes», якщо такі існують."
 
-#: ../clients/common/settings-docs.h.in:239
-#: ../clients/common/settings-docs.h.in:262
+#: ../clients/common/settings-docs.h.in:240
+#: ../clients/common/settings-docs.h.in:263
 msgid ""
 "If TRUE, allow overall network configuration to proceed even if the "
 "configuration specified by this property times out.  Note that at least one "
@@ -9162,8 +9319,8 @@ msgstr ""
 "NMSettingIP4Config уможливлює успішне налаштовування усієї мережі, якщо не "
 "вдається налаштувати IPv4, але IPv6 налаштовано успішно."
 
-#: ../clients/common/settings-docs.h.in:240
-#: ../clients/common/settings-docs.h.in:263
+#: ../clients/common/settings-docs.h.in:241
+#: ../clients/common/settings-docs.h.in:264
 msgid ""
 "IP configuration method. NMSettingIP4Config and NMSettingIP6Config both "
 "support \"disabled\", \"auto\", \"manual\", and \"link-local\". See the "
@@ -9192,8 +9349,8 @@ msgstr ""
 "налаштовано на інтерфейсі, який надає спільний доступ до інтернету для "
 "підмережі, а не на з'єднанні, яке надається у спільний доступ."
 
-#: ../clients/common/settings-docs.h.in:241
-#: ../clients/common/settings-docs.h.in:264
+#: ../clients/common/settings-docs.h.in:242
+#: ../clients/common/settings-docs.h.in:265
 msgid ""
 "If TRUE, this connection will never be the default connection for this IP "
 "type, meaning it will never be assigned the default route by NetworkManager."
@@ -9202,8 +9359,8 @@ msgstr ""
 "IP, що означає, що його ніколи не буде пов'язано із типовим маршрутом у "
 "NetworkManager."
 
-#: ../clients/common/settings-docs.h.in:242
-#: ../clients/common/settings-docs.h.in:266
+#: ../clients/common/settings-docs.h.in:243
+#: ../clients/common/settings-docs.h.in:267
 msgid ""
 "The default metric for routes that don't explicitly specify a metric. The "
 "default value -1 means that the metric is chosen automatically based on the "
@@ -9223,8 +9380,8 @@ msgstr ""
 "насправді означає, що встановлено значення 1024. Для IPv4 нуль є звичайним "
 "значенням для метрики."
 
-#: ../clients/common/settings-docs.h.in:243
-#: ../clients/common/settings-docs.h.in:267
+#: ../clients/common/settings-docs.h.in:244
+#: ../clients/common/settings-docs.h.in:268
 msgid ""
 "Enable policy routing (source routing) and set the routing table used when "
 "adding routes. This affects all routes, including device-routes, IPv4LL, "
@@ -9256,12 +9413,12 @@ msgstr ""
 "таблиці. Так зроблено, щоб зберегти зворотну сумісність для користувачів, "
 "які змінюють таблиці маршрутизації з-поза меж NetworkManager."
 
-#: ../clients/common/settings-docs.h.in:244
-#: ../clients/common/settings-docs.h.in:268
+#: ../clients/common/settings-docs.h.in:245
+#: ../clients/common/settings-docs.h.in:269
 msgid "Array of IP routes."
 msgstr "Масив IP-маршрутів."
 
-#: ../clients/common/settings-docs.h.in:245
+#: ../clients/common/settings-docs.h.in:246
 msgid ""
 "Configure method for creating the address for use with RFC4862 IPv6 "
 "Stateless Address Autoconfiguration. The permitted values are: "
@@ -9302,7 +9459,7 @@ msgstr ""
 "конфіденційності, які налаштовуються властивістю «ip6-privacy», і не впливає "
 "на тимчасові адреси, які налаштовано за допомогою відповідної властивості."
 
-#: ../clients/common/settings-docs.h.in:248
+#: ../clients/common/settings-docs.h.in:249
 msgid ""
 "A string containing the DHCPv6 Unique Identifier (DUID) used by the dhcp "
 "client to identify itself to DHCPv6 servers (RFC 3315). The DUID is carried "
@@ -9359,7 +9516,7 @@ msgstr ""
 "використано загальне значення для «ipv6.dhcp-duid». Якщо загальне значення "
 "не вказано, буде використано типове значення «lease»."
 
-#: ../clients/common/settings-docs.h.in:261
+#: ../clients/common/settings-docs.h.in:262
 msgid ""
 "Configure IPv6 Privacy Extensions for SLAAC, described in RFC4941.  If "
 "enabled, it makes the kernel generate a temporary IPv6 address in addition "
@@ -9390,7 +9547,7 @@ msgstr ""
 "увімкнено за допомогою параметра «stable-privacy» властивості «addr-gen-"
 "mode», як інший спосіб уникнути стеження за вузлом за допомогою адрес IPv6."
 
-#: ../clients/common/settings-docs.h.in:265
+#: ../clients/common/settings-docs.h.in:266
 msgid ""
 "A timeout for waiting Router Advertisements in seconds. If zero (the "
 "default), a globally configured default is used. If still unspecified, the "
@@ -9403,7 +9560,7 @@ msgstr ""
 "залежатиме від параметрів sysctl пристрою. Встановіть значення 2147483647 "
 "(MAXINT32), якщо час очікування має бути необмеженим."
 
-#: ../clients/common/settings-docs.h.in:269
+#: ../clients/common/settings-docs.h.in:270
 msgid ""
 "Configure the token for draft-chown-6man-tokenised-ipv6-identifiers-02 IPv6 "
 "tokenized interface identifiers. Useful with eui64 addr-gen-mode."
@@ -9412,22 +9569,22 @@ msgstr ""
 "chown-6man-tokenised-ipv6-identifiers-02. Корисне у поєднанні зі значення "
 "addr-gen-mode eui64."
 
-#: ../clients/common/settings-docs.h.in:270
+#: ../clients/common/settings-docs.h.in:271
 msgid "Whether the transmitted traffic must be encrypted."
 msgstr "Визначає, чи слід шифрувати дані, які передаються."
 
-#: ../clients/common/settings-docs.h.in:271
+#: ../clients/common/settings-docs.h.in:272
 msgid ""
 "The pre-shared CAK (Connectivity Association Key) for MACsec Key Agreement."
 msgstr ""
 "Попереднього поширений CAK (ключ прив'язки з'єднань) для узгодження ключів "
 "MACsec."
 
-#: ../clients/common/settings-docs.h.in:272
+#: ../clients/common/settings-docs.h.in:273
 msgid "Flags indicating how to handle the \"mka-cak\" property."
 msgstr "Прапорці, які позначають, як обробляти властивість «mka-cak»."
 
-#: ../clients/common/settings-docs.h.in:273
+#: ../clients/common/settings-docs.h.in:274
 msgid ""
 "The pre-shared CKN (Connectivity-association Key Name) for MACsec Key "
 "Agreement."
@@ -9435,7 +9592,7 @@ msgstr ""
 "Попереднього поширена CKN (назва ключа ключ прив'язки з'єднань) для "
 "узгодження ключів MACsec."
 
-#: ../clients/common/settings-docs.h.in:274
+#: ../clients/common/settings-docs.h.in:275
 msgid ""
 "Specifies how the CAK (Connectivity Association Key) for MKA (MACsec Key "
 "Agreement) is obtained."
@@ -9443,7 +9600,7 @@ msgstr ""
 "Визначає спосіб отримання CAK (ключа прив'язки з'єднань) для MKA (узгодження "
 "ключів MACsec)."
 
-#: ../clients/common/settings-docs.h.in:275
+#: ../clients/common/settings-docs.h.in:276
 msgid ""
 "If given, specifies the parent interface name or parent connection UUID from "
 "which this MACSEC interface should be created.  If this property is not "
@@ -9455,7 +9612,7 @@ msgstr ""
 "значення для цієї властивості не вказано, запис з'єднання має містити "
 "параметр «802-3-ethernet» із властивістю «mac-address»."
 
-#: ../clients/common/settings-docs.h.in:276
+#: ../clients/common/settings-docs.h.in:277
 msgid ""
 "The port component of the SCI (Secure Channel Identifier), between 1 and "
 "65534."
@@ -9463,17 +9620,17 @@ msgstr ""
 "Компонент порту SCI (ідентифікатора безпечного каналу), значення від 1 до "
 "65534."
 
-#: ../clients/common/settings-docs.h.in:277
+#: ../clients/common/settings-docs.h.in:278
 msgid ""
 "Specifies whether the SCI (Secure Channel Identifier) is included in every "
 "packet."
 msgstr "Вказує, чи включено SCI (Secure Channel Identifier) до кожного пакета."
 
-#: ../clients/common/settings-docs.h.in:278
+#: ../clients/common/settings-docs.h.in:279
 msgid "Specifies the validation mode for incoming frames."
 msgstr "Визначає режим перевірки для вхідних кадрів."
 
-#: ../clients/common/settings-docs.h.in:279
+#: ../clients/common/settings-docs.h.in:280
 msgid ""
 "The macvlan mode, which specifies the communication mechanism between "
 "multiple macvlans on the same lower device."
@@ -9481,7 +9638,7 @@ msgstr ""
 "Режим macvlan, який визначає механізм обміну даними між декількома macvlan "
 "на одному пристрої нижнього рівня."
 
-#: ../clients/common/settings-docs.h.in:280
+#: ../clients/common/settings-docs.h.in:281
 msgid ""
 "If given, specifies the parent interface name or parent connection UUID from "
 "which this MAC-VLAN interface should be created.  If this property is not "
@@ -9493,57 +9650,78 @@ msgstr ""
 "значення для цієї властивості не вказано, запис з'єднання має містити "
 "параметр «802-3-ethernet» із властивістю «mac-address»."
 
-#: ../clients/common/settings-docs.h.in:281
+#: ../clients/common/settings-docs.h.in:282
 msgid "Whether the interface should be put in promiscuous mode."
 msgstr "Визначає, чи слід переводити інтерфейс у нерозбірливий режим."
 
-#: ../clients/common/settings-docs.h.in:282
+#: ../clients/common/settings-docs.h.in:283
 msgid "Whether the interface should be a MACVTAP."
 msgstr "Визначає, чи має бути інтерфейс інтерфейсом MACVTAP."
 
-#: ../clients/common/settings-docs.h.in:283
-msgid ""
-"A list of driver names to match. Each element is a shell wildcard pattern. "
-"When an element is prefixed with exclamation mark (!) the condition is "
-"inverted. A candidate driver name is considered matching when both these "
-"conditions are satisfied: (a) any of the elements not prefixed with '!' "
-"matches or there aren't such elements; (b) none of the elements prefixed "
-"with '!' match."
-msgstr ""
-"Список назв драйверів для встановлення відповідності. Кожен елемент є "
-"шаблоном командної оболонки. Якщо перед записом елемента вказано префікс — "
-"знак оклику (!), сутність умови буде змінено на протилежну. Варіант назви "
-"драйвера вважається прийнятним, якщо задовольняються обидві умови: (a) маємо "
-"відповідність будь-якому з елементів без префікса «!» або відповідних "
-"елементів немає; (b) не встановлено відповідності жодному з елементів із "
-"префіксом «!»."
-
 #: ../clients/common/settings-docs.h.in:284
 msgid ""
-"A list of interface names to match. Each element is a shell wildcard "
-"pattern.  When an element is prefixed with exclamation mark (!) the "
-"condition is inverted. A candidate interface name is considered matching "
-"when both these conditions are satisfied: (a) any of the elements not "
-"prefixed with '!' matches or there aren't such elements; (b) none of the "
-"elements prefixed with '!' match."
+"A list of driver names to match. Each element is a shell wildcard pattern. "
+"See NMSettingMatch:interface-name for how special characters '|', '&', '!' "
+"and '\\' are used for optional and mandatory matches and inverting the "
+"pattern."
 msgstr ""
-"Список назв інтерфейсів для встановлення відповідності. Кожен елемент є "
-"шаблоном командної оболонки. Якщо перед записом елемента вказано префікс — "
-"знак оклику (!), сутність умови буде змінено на протилежну. Варіант назви "
-"інтерфейсу вважається прийнятним, якщо задовольняються обидві умови: (a) "
-"маємо відповідність будь-якому з елементів без префікса «!» або відповідних "
-"елементів немає; (b) не встановлено відповідності жодному з елементів із "
-"префіксом «!»."
+"Список назв драйверів для встановлення відповідності. Кожен із елементів є"
+" взірцем із символами-замінниками командної оболонки. Див."
+" NMSettingMatch:назва-інтерфейсу, щоб дізнатися більше про те, які"
+" скористатися спеціальними символами — «|», «&», «!» та «\\» — для визначення"
+" необов'язкових і обов'язкових відповідностей та інвертування взірців."
 
 #: ../clients/common/settings-docs.h.in:285
 msgid ""
+"A list of interface names to match. Each element is a shell wildcard "
+"pattern. An element can be prefixed with a pipe symbol (|) or an ampersand "
+"(&). The former means that the element is optional and the latter means that "
+"it is mandatory. If there are any optional elements, than the match "
+"evaluates to true if at least one of the optional element matches (logical "
+"OR). If there are any mandatory elements, then they all must match (logical "
+"AND). By default, an element is optional. This means that an element \"foo\" "
+"behaves the same as \"|foo\". An element can also be inverted with "
+"exclamation mark (!) between the pipe symbol (or the ampersand) and before "
+"the pattern. Note that \"!foo\" is a shortcut for the mandatory match \"&!foo"
+"\". Finally, a backslash can be used at the beginning of the element (after "
+"the optional special characters) to escape the start of the pattern. For "
+"example, \"&\\!a\" is an mandatory match for literally \"!a\"."
+msgstr ""
+"Список назв інтерфейсів для встановлення відповідності. Кожен із елементів є"
+" взірцем із символами-замінниками командної оболонки. До елемента можна"
+" дописати префікс-вертикальну риску (|) або амперсанд (&). Перший означає, що"
+" елемент є необов'язковим, а другий — що елемент є обов'язковим. Якщо є якісь"
+" необов'язкові елемент, відповідність встановлюватиметься, якщо відповідним є"
+" принаймні один із необов'язкових елементів (логічне «АБО»). Якщо є якісь"
+" обов'язкові елементи, відповідними мають бути всі ці елементи (логічне «І»)."
+" Типово, елементи вважаються необов'язковими. Це означає, що запис «щось» має"
+" те саме значення, що і запис «|щось». Крім того, елементу можна надати"
+" протилежного значення за допомогою знаку оклику (!) між вертикальною рискою"
+" (або амперсандом) та перед взірцем. Зауважте, що «!щось» є тим самим, що і"
+" «&!щось». Нарешті, можна скористатися зворотною похилою рискою на початку"
+" запису елемента (після необов'язкових спеціальних символів) для екранування"
+" початку взірця. Наприклад, «&\\!a» є обов'язковою умовою для встановлення"
+" відповідності рядку «!a»."
+
+#: ../clients/common/settings-docs.h.in:286
+#| msgid ""
+#| "A list of kernel command line arguments to match. This may be used to "
+#| "check whether a specific kernel command line option is set (or if "
+#| "prefixed with the exclamation mark unset). The argument must either be a "
+#| "single word, or an assignment (i.e. two words, separated \"=\"). In the "
+#| "former case the kernel command line is searched for the word appearing as "
+#| "is, or as left hand side of an assignment. In the latter case, the exact "
+#| "assignment is looked for with right and left hand side matching."
+msgid ""
 "A list of kernel command line arguments to match. This may be used to check "
 "whether a specific kernel command line option is set (or if prefixed with "
 "the exclamation mark unset). The argument must either be a single word, or "
 "an assignment (i.e. two words, separated \"=\"). In the former case the "
 "kernel command line is searched for the word appearing as is, or as left "
 "hand side of an assignment. In the latter case, the exact assignment is "
-"looked for with right and left hand side matching."
+"looked for with right and left hand side matching. See NMSettingMatch:"
+"interface-name for how special characters '|', '&', '!' and '\\' are used "
+"for optional and mandatory matches and inverting the pattern."
 msgstr ""
 "Список аргументів командного рядка ядра для встановлення відповідності. Цим "
 "параметром можна скористатися для перевірки того, чи встановлено певний "
@@ -9552,9 +9730,27 @@ msgstr ""
 "рівняння (тобто два слова, які відокремлено «=»). У першому випадку буде "
 "виконано пошук у командному рядку слова-параметра або лівої частини запису "
 "визначення значення параметра. У другому випадку буде виконано пошук усього "
-"рівняння зі встановленням відповідності правої і лівої його частин."
+"рівняння зі встановленням відповідності правої і лівої його частин. Див."
+" NMSettingMatch:назва-інтерфейсу, щоб дізнатися більше про те, які"
+" скористатися спеціальними символами — «|», «&», «!» та «\\» — для визначення"
+" необов'язкових і обов'язкових відповідностей та інвертування взірців."
 
-#: ../clients/common/settings-docs.h.in:286
+#: ../clients/common/settings-docs.h.in:287
+#| msgid ""
+#| "A list of paths to match against the ID_PATH udev property of devices. "
+#| "ID_PATH represents the topological persistent path of a device. It "
+#| "typically contains a subsystem string (pci, usb, platform, etc.) and a "
+#| "subsystem-specific identifier. For PCI devices the path has the form "
+#| "\"pci-$domain:$bus:$device.$function\", where each variable is an "
+#| "hexadecimal value; for example \"pci-0000:0a:00.0\". The path of a device "
+#| "can be obtained with \"udevadm info /sys/class/net/$dev | grep ID_PATH=\" "
+#| "or by looking at the \"path\" property exported by NetworkManager "
+#| "(\"nmcli -f general.path device show $dev\"). Each element of the list is "
+#| "a shell wildcard pattern. When an element is prefixed with exclamation "
+#| "mark (!) the condition is inverted. A candidate path is considered "
+#| "matching when both these conditions are satisfied: (a) any of the "
+#| "elements not prefixed with '!' matches or there aren't such elements; (b) "
+#| "none of the elements prefixed with '!' match."
 msgid ""
 "A list of paths to match against the ID_PATH udev property of devices. "
 "ID_PATH represents the topological persistent path of a device. It typically "
@@ -9564,56 +9760,53 @@ msgid ""
 "example \"pci-0000:0a:00.0\". The path of a device can be obtained with "
 "\"udevadm info /sys/class/net/$dev | grep ID_PATH=\" or by looking at the "
 "\"path\" property exported by NetworkManager (\"nmcli -f general.path device "
-"show $dev\"). Each element of the list is a shell wildcard pattern. When an "
-"element is prefixed with exclamation mark (!) the condition is inverted. A "
-"candidate path is considered matching when both these conditions are "
-"satisfied: (a) any of the elements not prefixed with '!' matches or there "
-"aren't such elements; (b) none of the elements prefixed with '!' match."
+"show $dev\"). Each element of the list is a shell wildcard pattern. See "
+"NMSettingMatch:interface-name for how special characters '|', '&', '!' and "
+"'\\' are used for optional and mandatory matches and inverting the pattern."
 msgstr ""
-"Список шляхів для порівняння із властивістю udev ID_PATH пристроїв. ID_PATH є"
-" топологічно сталим шляхом пристрою. У ньому, типово, міститься рядок"
-" підсистеми (pci, usb, platform тощо) і специфічний для підсистеми"
-" ідентифікатор. Для пристроїв PCI шлях має формат"
-" «pci-$домен:$шина:$пристрій.$функція», де кожна зі змінних є шістнадцятковим"
-" значенням. Приклад: «pci-0000:0a:00.0». Шлях пристрою можна отримати за"
-" допомогою команди «udevadm info /sys/class/net/$dev | grep ID_PATH=» або за"
-" рядком властивості «path» у експортованих NetworkManager даних («nmcli -f"
-" general.path device show $dev»). Кожен із елементів списку є взірцем"
-" командної оболонки із символами-замінниками. Якщо до елемента додано префікс"
-" — знак оклику (!), умова замінюється на протилежну. Шлях-кандидат вважається"
-" відповідним, якщо задовольняються обидві такі умови: (а) запису відповідає"
-" якийсь із елементів без префікса «!» або у списку немає таких елементів; (б)"
-" запису не відповідає жоден із елементів із префіксом «!»."
+"Список шляхів для порівняння із властивістю udev ID_PATH пристроїв. ID_PATH "
+"є топологічно сталим шляхом пристрою. У ньому, типово, міститься рядок "
+"підсистеми (pci, usb, platform тощо) і специфічний для підсистеми "
+"ідентифікатор. Для пристроїв PCI шлях має формат «pci-$домен:$шина:$пристрій."
+"$функція», де кожна зі змінних є шістнадцятковим значенням. Приклад: "
+"«pci-0000:0a:00.0». Шлях пристрою можна отримати за допомогою команди "
+"«udevadm info /sys/class/net/$dev | grep ID_PATH=» або за рядком властивості "
+"«path» у експортованих NetworkManager даних («nmcli -f general.path device "
+"show $dev»). Кожен із елементів списку є взірцем командної оболонки із "
+"символами-замінниками.  Див. NMSettingMatch:назва-інтерфейсу, щоб дізнатися"
+" більше про те, які скористатися спеціальними символами — «|», «&», «!» та"
+" «\\» — для визначення необов'язкових і обов'язкових відповідностей та"
+" інвертування взірців."
 
-#: ../clients/common/settings-docs.h.in:287
+#: ../clients/common/settings-docs.h.in:288
 msgid "The data path type. One of \"system\", \"netdev\" or empty."
 msgstr ""
 "Тип шляху до даних. Одне з таких значень: «system», «netdev» або порожнє "
 "значення."
 
-#: ../clients/common/settings-docs.h.in:288
+#: ../clients/common/settings-docs.h.in:289
 msgid "The bridge failure mode. One of \"secure\", \"standalone\" or empty."
 msgstr ""
 "Режим відмови містка. Одне з таких значень: «secure», «standalone» або "
 "порожнє значення."
 
-#: ../clients/common/settings-docs.h.in:289
+#: ../clients/common/settings-docs.h.in:290
 msgid "Enable or disable multicast snooping."
 msgstr "Увімкнути або вимкнути переставляння універсальної трансляції."
 
-#: ../clients/common/settings-docs.h.in:290
+#: ../clients/common/settings-docs.h.in:291
 msgid "Enable or disable RSTP."
 msgstr "Увімкнути або вимкнути RSTP."
 
-#: ../clients/common/settings-docs.h.in:291
+#: ../clients/common/settings-docs.h.in:292
 msgid "Enable or disable STP."
 msgstr "Увімкнути або вимкнути STP."
 
-#: ../clients/common/settings-docs.h.in:292
+#: ../clients/common/settings-docs.h.in:293
 msgid "Open vSwitch DPDK device arguments."
 msgstr "Параметри пристрою Open vSwitch DPDK."
 
-#: ../clients/common/settings-docs.h.in:293
+#: ../clients/common/settings-docs.h.in:294
 msgid ""
 "The interface type. Either \"internal\", \"system\", \"patch\", \"dpdk\", or "
 "empty."
@@ -9621,7 +9814,7 @@ msgstr ""
 "Тип інтерфейсу. Рядок «internal», «system», «patch», «dpdk» або порожній "
 "рядок."
 
-#: ../clients/common/settings-docs.h.in:294
+#: ../clients/common/settings-docs.h.in:295
 msgid ""
 "Specifies the name of the interface for the other side of the patch. The "
 "patch on the other side must also set this interface as peer."
@@ -9630,30 +9823,30 @@ msgstr ""
 "з'єднання на іншому боці також має встановлювати цей інтерфейс як "
 "однорівневий вузол."
 
-#: ../clients/common/settings-docs.h.in:295
+#: ../clients/common/settings-docs.h.in:296
 msgid "The time port must be inactive in order to be considered down."
 msgstr "Щоб вважатися вимкненим, порт часу має бути неактивним."
 
-#: ../clients/common/settings-docs.h.in:296
+#: ../clients/common/settings-docs.h.in:297
 msgid ""
 "Bonding mode. One of \"active-backup\", \"balance-slb\", or \"balance-tcp\"."
 msgstr ""
 "Режим прив'язування. Одне з таких значень: «active-backup», «balance-slb» "
 "або «balance-tcp»."
 
-#: ../clients/common/settings-docs.h.in:297
+#: ../clients/common/settings-docs.h.in:298
 msgid "The time port must be active before it starts forwarding traffic."
 msgstr "Щоб почати переспрямовувати дані, слід активувати порт часу."
 
-#: ../clients/common/settings-docs.h.in:298
+#: ../clients/common/settings-docs.h.in:299
 msgid "LACP mode. One of \"active\", \"off\", or \"passive\"."
 msgstr "Режим LACP. Одне з таких значень: «active», «off» або «passive»."
 
-#: ../clients/common/settings-docs.h.in:299
+#: ../clients/common/settings-docs.h.in:300
 msgid "The VLAN tag in the range 0-4095."
 msgstr "Теґ VLAN у діапазоні від 0 до 4095."
 
-#: ../clients/common/settings-docs.h.in:300
+#: ../clients/common/settings-docs.h.in:301
 msgid ""
 "The VLAN mode. One of \"access\", \"native-tagged\", \"native-untagged\", "
 "\"trunk\" or unset."
@@ -9661,7 +9854,7 @@ msgstr ""
 "Режим VLAN. Одне з таких значень: «access», «native-tagged», «native-"
 "untagged», «trunk» або порожнє значення."
 
-#: ../clients/common/settings-docs.h.in:301
+#: ../clients/common/settings-docs.h.in:302
 msgid ""
 "If non-zero, instruct pppd to set the serial port to the specified "
 "baudrate.  This value should normally be left as 0 to automatically choose "
@@ -9671,7 +9864,7 @@ msgstr ""
 "вказану швидкість передавання даних у бодах. Зазвичай, для цієї властивості "
 "слід залишити нульове значення, щоб швидкість було вибрано автоматично."
 
-#: ../clients/common/settings-docs.h.in:302
+#: ../clients/common/settings-docs.h.in:303
 msgid ""
 "If TRUE, specify that pppd should set the serial port to use hardware flow "
 "control with RTS and CTS signals.  This value should normally be set to "
@@ -9681,7 +9874,7 @@ msgstr ""
 "керування потоком апаратних даних за допомогою сигналів RTS і CTS. За "
 "звичних умов, для цієї властивості має бути встановлено значення FALSE."
 
-#: ../clients/common/settings-docs.h.in:303
+#: ../clients/common/settings-docs.h.in:304
 msgid ""
 "If non-zero, instruct pppd to presume the connection to the peer has failed "
 "if the specified number of LCP echo-requests go unanswered by the peer.  The "
@@ -9693,7 +9886,7 @@ msgstr ""
 "кількість луна-запитів LCP. Якщо використовується ця властивість, для "
 "властивості «lcp-echo-interval» слід встановити ненульове значення."
 
-#: ../clients/common/settings-docs.h.in:304
+#: ../clients/common/settings-docs.h.in:305
 msgid ""
 "If non-zero, instruct pppd to send an LCP echo-request frame to the peer "
 "every n seconds (where n is the specified value).  Note that some PPP peers "
@@ -9705,7 +9898,7 @@ msgstr ""
 "відповідатимуть на луна-запити, а деякі — ні. Визначити, чи відповідатиме "
 "певний вузол, у автоматичному режимі неможливо."
 
-#: ../clients/common/settings-docs.h.in:305
+#: ../clients/common/settings-docs.h.in:306
 msgid ""
 "If TRUE, stateful MPPE is used.  See pppd documentation for more information "
 "on stateful MPPE."
@@ -9713,7 +9906,7 @@ msgstr ""
 "Якщо TRUE, використовуватиметься режим MPPE зі станами (stateful). "
 "Докладніший опис режиму MPPE зі станами наведено у документації із pppd."
 
-#: ../clients/common/settings-docs.h.in:306
+#: ../clients/common/settings-docs.h.in:307
 msgid ""
 "If non-zero, instruct pppd to request that the peer send packets no larger "
 "than the specified size.  If non-zero, the MRU should be between 128 and "
@@ -9723,20 +9916,20 @@ msgstr ""
 "щодо того, щоб він надсилав пакети, не більші за вказаний розмір. Якщо має "
 "ненульове значення, MRU має бути від 128 до 16384."
 
-#: ../clients/common/settings-docs.h.in:307
+#: ../clients/common/settings-docs.h.in:308
 msgid ""
 "If non-zero, instruct pppd to send packets no larger than the specified size."
 msgstr ""
 "Якщо має ненульове значення, наказує pppd надсилати пакети, не більші за "
 "вказаний розмір."
 
-#: ../clients/common/settings-docs.h.in:308
+#: ../clients/common/settings-docs.h.in:309
 msgid "If TRUE, Van Jacobsen TCP header compression will not be requested."
 msgstr ""
 "Якщо має значення TRUE, запит щодо стискання заголовків TCP ван Якобсена не "
 "надсилатиметься."
 
-#: ../clients/common/settings-docs.h.in:309
+#: ../clients/common/settings-docs.h.in:310
 msgid ""
 "If TRUE, do not require the other side (usually the PPP server) to "
 "authenticate itself to the client.  If FALSE, require authentication from "
@@ -9747,35 +9940,35 @@ msgstr ""
 "FALSE, вимагати проходження розпізнавання з боку віддаленого вузла. У "
 "більшості випадків слід використовувати значення TRUE."
 
-#: ../clients/common/settings-docs.h.in:310
+#: ../clients/common/settings-docs.h.in:311
 msgid "If TRUE, BSD compression will not be requested."
 msgstr "Якщо TRUE, стискання BSD не вимагатиметься."
 
-#: ../clients/common/settings-docs.h.in:311
+#: ../clients/common/settings-docs.h.in:312
 msgid "If TRUE, \"deflate\" compression will not be requested."
 msgstr "Якщо TRUE, стискання «deflate» не вимагатиметься."
 
-#: ../clients/common/settings-docs.h.in:312
+#: ../clients/common/settings-docs.h.in:313
 msgid "If TRUE, the CHAP authentication method will not be used."
 msgstr "Якщо TRUE, спосіб розпізнавання CHAP не використовуватиметься."
 
-#: ../clients/common/settings-docs.h.in:313
+#: ../clients/common/settings-docs.h.in:314
 msgid "If TRUE, the EAP authentication method will not be used."
 msgstr "Якщо TRUE, спосіб розпізнавання EAP не використовуватиметься."
 
-#: ../clients/common/settings-docs.h.in:314
+#: ../clients/common/settings-docs.h.in:315
 msgid "If TRUE, the MSCHAP authentication method will not be used."
 msgstr "Якщо TRUE, спосіб розпізнавання MSCHAP не використовуватиметься."
 
-#: ../clients/common/settings-docs.h.in:315
+#: ../clients/common/settings-docs.h.in:316
 msgid "If TRUE, the MSCHAPv2 authentication method will not be used."
 msgstr "Якщо TRUE, спосіб розпізнавання MSCHAPv2 не використовуватиметься."
 
-#: ../clients/common/settings-docs.h.in:316
+#: ../clients/common/settings-docs.h.in:317
 msgid "If TRUE, the PAP authentication method will not be used."
 msgstr "Якщо TRUE, спосіб розпізнавання PAP не використовуватиметься."
 
-#: ../clients/common/settings-docs.h.in:317
+#: ../clients/common/settings-docs.h.in:318
 msgid ""
 "If TRUE, MPPE (Microsoft Point-to-Point Encryption) will be required for the "
 "PPP session.  If either 64-bit or 128-bit MPPE is not available the session "
@@ -9786,7 +9979,7 @@ msgstr ""
 "128-бітове MPPE виявиться недоступним, сеанс не буде створено. Зауважте, що "
 "MPPE не використовується для мобільних широкосмугових з'єднань."
 
-#: ../clients/common/settings-docs.h.in:318
+#: ../clients/common/settings-docs.h.in:319
 msgid ""
 "If TRUE, 128-bit MPPE (Microsoft Point-to-Point Encryption) will be required "
 "for the PPP session, and the \"require-mppe\" property must also be set to "
@@ -9797,7 +9990,7 @@ msgstr ""
 "для властивості «require-mppe» також має бути встановлено TRUE. Якщо 128-"
 "бітове MPPE виявиться недоступним, сеанс не буде створено."
 
-#: ../clients/common/settings-docs.h.in:319
+#: ../clients/common/settings-docs.h.in:320
 msgid ""
 "If given, specifies the parent interface name on which this PPPoE connection "
 "should be created.  If this property is not specified, the connection is "
@@ -9809,11 +10002,11 @@ msgstr ""
 "з'єднання буде активовано на інтерфейсі, який вказано за допомогою параметра "
 "«interface-name» NMSettingConnection."
 
-#: ../clients/common/settings-docs.h.in:320
+#: ../clients/common/settings-docs.h.in:321
 msgid "Password used to authenticate with the PPPoE service."
 msgstr "Пароль, який використовуватиметься для розпізнавання на службі PPPoE."
 
-#: ../clients/common/settings-docs.h.in:322
+#: ../clients/common/settings-docs.h.in:323
 msgid ""
 "If specified, instruct PPPoE to only initiate sessions with access "
 "concentrators that provide the specified service.  For most providers, this "
@@ -9826,33 +10019,33 @@ msgstr ""
 "якщо ви маєте справу із концентраторами із декількома способами доступу або "
 "відомо, що вказана служба є необхідною."
 
-#: ../clients/common/settings-docs.h.in:323
+#: ../clients/common/settings-docs.h.in:324
 msgid "Username used to authenticate with the PPPoE service."
 msgstr ""
 "Ім'я користувача, яке використовуватиметься для розпізнавання на службі "
 "PPPoE."
 
-#: ../clients/common/settings-docs.h.in:324
+#: ../clients/common/settings-docs.h.in:325
 msgid "Whether the proxy configuration is for browser only."
 msgstr ""
 "Визначає, чи використовуються налаштування проксі лише для програм для "
 "перегляду інтернету."
 
-#: ../clients/common/settings-docs.h.in:325
+#: ../clients/common/settings-docs.h.in:326
 msgid ""
 "Method for proxy configuration, Default is NM_SETTING_PROXY_METHOD_NONE (0)"
 msgstr ""
 "Спосіб налаштовування проксі. Типовим є NM_SETTING_PROXY_METHOD_NONE (0)"
 
-#: ../clients/common/settings-docs.h.in:326
+#: ../clients/common/settings-docs.h.in:327
 msgid "PAC script for the connection."
 msgstr "Скрипт PAC для з'єднання."
 
-#: ../clients/common/settings-docs.h.in:327
+#: ../clients/common/settings-docs.h.in:328
 msgid "PAC URL for obtaining PAC file."
 msgstr "Адреса PAC для отримання файла PAC."
 
-#: ../clients/common/settings-docs.h.in:328
+#: ../clients/common/settings-docs.h.in:329
 msgid ""
 "Speed to use for communication over the serial port.  Note that this value "
 "usually has no effect for mobile broadband modems as they generally ignore "
@@ -9863,20 +10056,20 @@ msgstr ""
 "загалом, для них параметри швидкості ігноруються — просто використовується "
 "найвища доступна швидкість."
 
-#: ../clients/common/settings-docs.h.in:329
+#: ../clients/common/settings-docs.h.in:330
 msgid "Byte-width of the serial communication. The 8 in \"8n1\" for example."
 msgstr "Байтова ширина послідовного обміну даними. Наприклад, 8 у «8n1»."
 
-#: ../clients/common/settings-docs.h.in:330
+#: ../clients/common/settings-docs.h.in:331
 msgid "Parity setting of the serial port."
 msgstr "Параметр парності послідовного порту."
 
-#: ../clients/common/settings-docs.h.in:331
+#: ../clients/common/settings-docs.h.in:332
 msgid "Time to delay between each byte sent to the modem, in microseconds."
 msgstr ""
 "Затримка у часі між надсиланнями одного байта на модем, у мікросекундах."
 
-#: ../clients/common/settings-docs.h.in:332
+#: ../clients/common/settings-docs.h.in:333
 msgid ""
 "Number of stop bits for communication on the serial port.  Either 1 or 2. "
 "The 1 in \"8n1\" for example."
@@ -9884,7 +10077,7 @@ msgstr ""
 "Кількість бітів зупинки для обміну даними на послідовному порту. Може мати "
 "значення 1 або 2. Наприклад, 1 у «8n1»."
 
-#: ../clients/common/settings-docs.h.in:333
+#: ../clients/common/settings-docs.h.in:334
 msgid ""
 "Whether to autoprobe virtual functions by a compatible driver. If set to "
 "NM_TERNARY_TRUE (1), the kernel will try to bind VFs to a compatible driver "
@@ -9904,7 +10097,7 @@ msgstr ""
 "використовуватимуться загальні типові параметри. Якщо загальні типові "
 "параметри не вказано, припускатиметься варіант NM_TERNARY_TRUE (1)."
 
-#: ../clients/common/settings-docs.h.in:334
+#: ../clients/common/settings-docs.h.in:335
 msgid ""
 "The total number of virtual functions to create. Note that when the sriov "
 "setting is present NetworkManager enforces the number of virtual functions "
@@ -9919,14 +10112,26 @@ msgstr ""
 "внесенню будь-яких змін до параметрів SR-IOV, не додавайте параметр sriov до "
 "параметрів з'єднання."
 
-#: ../clients/common/settings-docs.h.in:335
+#: ../clients/common/settings-docs.h.in:336
+#| msgid ""
+#| "Array of virtual function descriptors. Each VF descriptor is a dictionary "
+#| "mapping attribute names to GVariant values. The 'index' entry is "
+#| "mandatory for each VF. When represented as string a VF is in the form: "
+#| "\"INDEX [ATTR=VALUE[ ATTR=VALUE]...]\". for example: \"2 "
+#| "mac=00:11:22:33:44:55 spoof-check=true\". Multiple VFs can be specified "
+#| "using a comma as separator. Currently the following attributes are "
+#| "supported: mac, spoof-check, trust, min-tx-rate, max-tx-rate, vlans. The "
+#| "\"vlans\" attribute is represented as a semicolon-separated list of VLAN "
+#| "descriptors, where each descriptor has the form \"ID[.PRIORITY[."
+#| "PROTO]]\". PROTO can be either 'q' for 802.1Q (the default) or 'ad' for "
+#| "802.1ad."
 msgid ""
 "Array of virtual function descriptors. Each VF descriptor is a dictionary "
 "mapping attribute names to GVariant values. The 'index' entry is mandatory "
 "for each VF. When represented as string a VF is in the form: \"INDEX "
 "[ATTR=VALUE[ ATTR=VALUE]...]\". for example: \"2 mac=00:11:22:33:44:55 spoof-"
 "check=true\". Multiple VFs can be specified using a comma as separator. "
-"Currently the following attributes are supported: mac, spoof-check, trust, "
+"Currently, the following attributes are supported: mac, spoof-check, trust, "
 "min-tx-rate, max-tx-rate, vlans. The \"vlans\" attribute is represented as a "
 "semicolon-separated list of VLAN descriptors, where each descriptor has the "
 "form \"ID[.PRIORITY[.PROTO]]\". PROTO can be either 'q' for 802.1Q (the "
@@ -9945,15 +10150,15 @@ msgstr ""
 "форму: «ІДЕНТИФІКАТОР[.ПРІОРИТЕТНІСТЬ[.ПРОТОКОЛ]]». Значенням ПРОТОКОЛ може "
 "бути або «q» для 802.1Q (типовий варіант) або «ad» для 802.1ad."
 
-#: ../clients/common/settings-docs.h.in:336
+#: ../clients/common/settings-docs.h.in:337
 msgid "Array of TC queueing disciplines."
 msgstr "Масив дисциплін TC у черзі."
 
-#: ../clients/common/settings-docs.h.in:337
+#: ../clients/common/settings-docs.h.in:338
 msgid "Array of TC traffic filters."
 msgstr "Список TC фільтрів обміну даними."
 
-#: ../clients/common/settings-docs.h.in:338
+#: ../clients/common/settings-docs.h.in:339
 msgid ""
 "The JSON configuration for the team network interface.  The property should "
 "contain raw JSON configuration data suitable for teamd, because the value is "
@@ -9966,8 +10171,8 @@ msgstr ""
 "використовуватимуться типові налаштування. Щоб дізнатися більше про "
 "форматування даних, ознайомитеся із підручником (man) з teamd.conf."
 
-#: ../clients/common/settings-docs.h.in:339
-#: ../clients/common/settings-docs.h.in:357
+#: ../clients/common/settings-docs.h.in:340
+#: ../clients/common/settings-docs.h.in:358
 msgid ""
 "Link watchers configuration for the connection: each link watcher is defined "
 "by a dictionary, whose keys depend upon the selected link watcher. Available "
@@ -9988,23 +10193,23 @@ msgstr ""
 "«validate-inactive», «send-always». Докладніше про це на сторінці підручника "
 "(man) щодо teamd.conf."
 
-#: ../clients/common/settings-docs.h.in:340
+#: ../clients/common/settings-docs.h.in:341
 msgid "Corresponds to the teamd mcast_rejoin.count."
 msgstr "Відповідає mcast_rejoin.count у teamd."
 
-#: ../clients/common/settings-docs.h.in:341
+#: ../clients/common/settings-docs.h.in:342
 msgid "Corresponds to the teamd mcast_rejoin.interval."
 msgstr "Відповідає mcast_rejoin.interval у teamd."
 
-#: ../clients/common/settings-docs.h.in:342
+#: ../clients/common/settings-docs.h.in:343
 msgid "Corresponds to the teamd notify_peers.count."
 msgstr "Відповідає notify_peers.count у teamd."
 
-#: ../clients/common/settings-docs.h.in:343
+#: ../clients/common/settings-docs.h.in:344
 msgid "Corresponds to the teamd notify_peers.interval."
 msgstr "Відповідає notify_peers.interval у teamd."
 
-#: ../clients/common/settings-docs.h.in:344
+#: ../clients/common/settings-docs.h.in:345
 msgid ""
 "Corresponds to the teamd runner.name. Permitted values are: \"roundrobin\", "
 "\"broadcast\", \"activebackup\", \"loadbalance\", \"lacp\", \"random\"."
@@ -10012,43 +10217,43 @@ msgstr ""
 "Відповідає runner.name у teamd. Можливі такі значення: «roundrobin», "
 "«broadcast», «activebackup», «loadbalance», «lacp», «random»."
 
-#: ../clients/common/settings-docs.h.in:345
+#: ../clients/common/settings-docs.h.in:346
 msgid "Corresponds to the teamd runner.active."
 msgstr "Відповідає runner.active у teamd."
 
-#: ../clients/common/settings-docs.h.in:346
+#: ../clients/common/settings-docs.h.in:347
 msgid "Corresponds to the teamd runner.agg_select_policy."
 msgstr "Відповідає runner.agg_select_policy у teamd."
 
-#: ../clients/common/settings-docs.h.in:347
+#: ../clients/common/settings-docs.h.in:348
 msgid "Corresponds to the teamd runner.fast_rate."
 msgstr "Відповідає runner.fast_rate у teamd."
 
-#: ../clients/common/settings-docs.h.in:348
+#: ../clients/common/settings-docs.h.in:349
 msgid "Corresponds to the teamd runner.hwaddr_policy."
 msgstr "Відповідає runner.hwaddr_policy у teamd."
 
-#: ../clients/common/settings-docs.h.in:349
+#: ../clients/common/settings-docs.h.in:350
 msgid "Corresponds to the teamd runner.min_ports."
 msgstr "Відповідає runner.min_ports у teamd."
 
-#: ../clients/common/settings-docs.h.in:350
+#: ../clients/common/settings-docs.h.in:351
 msgid "Corresponds to the teamd runner.sys_prio."
 msgstr "Відповідає runner.sys_prio у teamd."
 
-#: ../clients/common/settings-docs.h.in:351
+#: ../clients/common/settings-docs.h.in:352
 msgid "Corresponds to the teamd runner.tx_balancer.name."
 msgstr "Відповідає runner.tx_balancer.name у teamd."
 
-#: ../clients/common/settings-docs.h.in:352
+#: ../clients/common/settings-docs.h.in:353
 msgid "Corresponds to the teamd runner.tx_balancer.interval."
 msgstr "Відповідає runner.tx_balancer.interval у teamd."
 
-#: ../clients/common/settings-docs.h.in:353
+#: ../clients/common/settings-docs.h.in:354
 msgid "Corresponds to the teamd runner.tx_hash."
 msgstr "Відповідає runner.tx_hash у teamd."
 
-#: ../clients/common/settings-docs.h.in:354
+#: ../clients/common/settings-docs.h.in:355
 msgid ""
 "The JSON configuration for the team port. The property should contain raw "
 "JSON configuration data suitable for teamd, because the value is passed "
@@ -10061,19 +10266,19 @@ msgstr ""
 "використовуватимуться типові налаштування. Щоб дізнатися більше про "
 "форматування даних, ознайомитеся із підручником (man) з teamd.conf."
 
-#: ../clients/common/settings-docs.h.in:355
+#: ../clients/common/settings-docs.h.in:356
 msgid "Corresponds to the teamd ports.PORTIFNAME.lacp_key."
 msgstr "Відповідає ports.PORTIFNAME.lacp_key у teamd."
 
-#: ../clients/common/settings-docs.h.in:356
+#: ../clients/common/settings-docs.h.in:357
 msgid "Corresponds to the teamd ports.PORTIFNAME.lacp_prio."
 msgstr "Відповідає ports.PORTIFNAME.lacp_prio у teamd."
 
-#: ../clients/common/settings-docs.h.in:358
+#: ../clients/common/settings-docs.h.in:359
 msgid "Corresponds to the teamd ports.PORTIFNAME.prio."
 msgstr "Відповідає ports.PORTIFNAME.prio у teamd."
 
-#: ../clients/common/settings-docs.h.in:359
+#: ../clients/common/settings-docs.h.in:360
 msgid ""
 "Corresponds to the teamd ports.PORTIFNAME.queue_id. When set to -1 means the "
 "parameter is skipped from the json config."
@@ -10081,11 +10286,11 @@ msgstr ""
 "Відповідає ports.PORTIFNAME.queue_id у teamd. Значення -1 означає, що "
 "параметр пропускається у налаштуваннях json."
 
-#: ../clients/common/settings-docs.h.in:360
+#: ../clients/common/settings-docs.h.in:361
 msgid "Corresponds to the teamd ports.PORTIFNAME.sticky."
 msgstr "Відповідає ports.PORTIFNAME.sticky у teamd."
 
-#: ../clients/common/settings-docs.h.in:361
+#: ../clients/common/settings-docs.h.in:362
 msgid ""
 "The group ID which will own the device. If set to NULL everyone will be able "
 "to use the device."
@@ -10093,7 +10298,7 @@ msgstr ""
 "Ідентифікатор групи-власника пристрою. Якщо встановлено значення NULL, "
 "пристроєм зможе користуватися будь-хто."
 
-#: ../clients/common/settings-docs.h.in:362
+#: ../clients/common/settings-docs.h.in:363
 msgid ""
 "The operating mode of the virtual device. Allowed values are "
 "NM_SETTING_TUN_MODE_TUN (1) to create a layer 3 device and "
@@ -10103,7 +10308,7 @@ msgstr ""
 "NM_SETTING_TUN_MODE_TUN (1) для створення пристрою шару 3 і "
 "NM_SETTING_TUN_MODE_TAP (2) для створення пристрою Ethernet-подібного шару 2."
 
-#: ../clients/common/settings-docs.h.in:363
+#: ../clients/common/settings-docs.h.in:364
 msgid ""
 "If the property is set to TRUE, the interface will support multiple file "
 "descriptors (queues) to parallelize packet sending or receiving. Otherwise, "
@@ -10114,7 +10319,7 @@ msgstr ""
 "надсилання або отримування пакетів. Якщо ж встановлено значення FALSE, "
 "інтерфейсом підтримуватиметься лише одна черга."
 
-#: ../clients/common/settings-docs.h.in:364
+#: ../clients/common/settings-docs.h.in:365
 msgid ""
 "The user ID which will own the device. If set to NULL everyone will be able "
 "to use the device."
@@ -10122,7 +10327,7 @@ msgstr ""
 "Ідентифікатор користувача-власника пристрою. Якщо встановлено значення NULL, "
 "пристроєм зможе користуватися будь-хто."
 
-#: ../clients/common/settings-docs.h.in:365
+#: ../clients/common/settings-docs.h.in:366
 msgid ""
 "If TRUE the interface will prepend a 4 byte header describing the physical "
 "interface to the packets."
@@ -10130,7 +10335,7 @@ msgstr ""
 "Якщо TRUE, інтерфейс дописуватиме на початку пакетів заголовок у 4 байти із "
 "описом фізичного інтерфейсу."
 
-#: ../clients/common/settings-docs.h.in:366
+#: ../clients/common/settings-docs.h.in:367
 msgid ""
 "If TRUE the IFF_VNET_HDR the tunnel packets will include a virtio network "
 "header."
@@ -10138,7 +10343,7 @@ msgstr ""
 "Якщо IFF_VNET_HDR має значення TRUE, тунельовані пакети включатимуть "
 "заголовок мережі virtio."
 
-#: ../clients/common/settings-docs.h.in:367
+#: ../clients/common/settings-docs.h.in:368
 msgid ""
 "A dictionary of key/value pairs with user data. This data is ignored by "
 "NetworkManager and can be used at the users discretion. The keys only "
@@ -10151,7 +10356,7 @@ msgstr ""
 "формату ASCII, але значення можуть бути довільними рядками UTF8, довжина "
 "яких не перевищує певного значення."
 
-#: ../clients/common/settings-docs.h.in:368
+#: ../clients/common/settings-docs.h.in:369
 msgid ""
 "For outgoing packets, a list of mappings from Linux SKB priorities to 802.1p "
 "priorities.  The mapping is given in the format \"from:to\" where both \"from"
@@ -10161,7 +10366,7 @@ msgstr ""
 "802.1p. Прив'язка визначається у форматі «з:до», де обидва значення, «з» і "
 "«до» є цілими додатними числами, наприклад «7:3»."
 
-#: ../clients/common/settings-docs.h.in:369
+#: ../clients/common/settings-docs.h.in:370
 msgid ""
 "One or more flags which control the behavior and features of the VLAN "
 "interface.  Flags include NM_VLAN_FLAG_REORDER_HEADERS (0x1) (reordering of "
@@ -10183,7 +10388,7 @@ msgstr ""
 "зберегти зворотну сумісність, типовим значенням у програмному інтерфейсі D-"
 "Bus лишається 0, а нестача властивості у D-Bus також розглядається як 0."
 
-#: ../clients/common/settings-docs.h.in:370
+#: ../clients/common/settings-docs.h.in:371
 msgid ""
 "The VLAN identifier that the interface created by this connection should be "
 "assigned. The valid range is from 0 to 4094, without the reserved id 4095."
@@ -10192,7 +10397,7 @@ msgstr ""
 "з'єднанням. Коректним діапазоном є діапазон від 0 до 4094, без "
 "зарезервованого ідентифікатора 4095."
 
-#: ../clients/common/settings-docs.h.in:371
+#: ../clients/common/settings-docs.h.in:372
 msgid ""
 "For incoming packets, a list of mappings from 802.1p priorities to Linux SKB "
 "priorities.  The mapping is given in the format \"from:to\" where both \"from"
@@ -10202,7 +10407,7 @@ msgstr ""
 "Linux. Прив'язка визначається у форматі «з:до», де обидва значення, «з» і "
 "«до» є цілими додатними числами, наприклад «7:3»."
 
-#: ../clients/common/settings-docs.h.in:372
+#: ../clients/common/settings-docs.h.in:373
 msgid ""
 "If given, specifies the parent interface name or parent connection UUID from "
 "which this VLAN interface should be created.  If this property is not "
@@ -10214,7 +10419,7 @@ msgstr ""
 "значення для цієї властивості не вказано, запис з'єднання має містити "
 "параметр «802-3-ethernet» із властивістю «mac-address»."
 
-#: ../clients/common/settings-docs.h.in:373
+#: ../clients/common/settings-docs.h.in:374
 msgid ""
 "Dictionary of key/value pairs of VPN plugin specific data.  Both keys and "
 "values must be strings."
@@ -10222,7 +10427,7 @@ msgstr ""
 "Словник із пар ключ-значення для специфічних даних додатка VPN. Величинами "
 "ключа і значення можуть бути лише текстові рядки."
 
-#: ../clients/common/settings-docs.h.in:374
+#: ../clients/common/settings-docs.h.in:375
 msgid ""
 "If the VPN service supports persistence, and this property is TRUE, the VPN "
 "will attempt to stay connected across link changes and outages, until "
@@ -10233,7 +10438,7 @@ msgstr ""
 "час зміни параметрів зв'язку або неможливості обміну даними, аж доки "
 "з'єднання не буде розірвано явним чином."
 
-#: ../clients/common/settings-docs.h.in:375
+#: ../clients/common/settings-docs.h.in:376
 msgid ""
 "Dictionary of key/value pairs of VPN plugin specific secrets like passwords "
 "or private keys.  Both keys and values must be strings."
@@ -10242,7 +10447,7 @@ msgstr ""
 "VPN, зокрема паролів або закритих ключів. Величинами ключа і значення можуть "
 "бути лише текстові рядки."
 
-#: ../clients/common/settings-docs.h.in:376
+#: ../clients/common/settings-docs.h.in:377
 msgid ""
 "D-Bus service name of the VPN plugin that this setting uses to connect to "
 "its network.  i.e. org.freedesktop.NetworkManager.vpnc for the vpnc plugin."
@@ -10251,7 +10456,7 @@ msgstr ""
 "додатка з його мережею. Приклад: org.freedesktop.NetworkManager.vpnc для "
 "додатка vpnc."
 
-#: ../clients/common/settings-docs.h.in:377
+#: ../clients/common/settings-docs.h.in:378
 msgid ""
 "Timeout for the VPN service to establish the connection. Some services may "
 "take quite a long time to connect. Value of 0 means a default timeout, which "
@@ -10264,7 +10469,7 @@ msgstr ""
 "допомогою параметра vpn.timeout у файлі налаштувань). Значення, які "
 "перевищують нуль, визначають час очікування у секундах."
 
-#: ../clients/common/settings-docs.h.in:378
+#: ../clients/common/settings-docs.h.in:379
 msgid ""
 "If the VPN connection requires a user name for authentication, that name "
 "should be provided here.  If the connection is available to more than one "
@@ -10280,15 +10485,15 @@ msgstr ""
 "порожнє, NetworkManager автоматично використає ім'я користувача, який "
 "надіслав запит щодо встановлення з'єднання VPN."
 
-#: ../clients/common/settings-docs.h.in:379
+#: ../clients/common/settings-docs.h.in:380
 msgid "The routing table for this VRF."
 msgstr "Таблиця маршрутизації для цього VRF."
 
-#: ../clients/common/settings-docs.h.in:380
+#: ../clients/common/settings-docs.h.in:381
 msgid "Specifies the lifetime in seconds of FDB entries learnt by the kernel."
 msgstr "Визначає час життя у секундах записів FDB, вивчених ядром."
 
-#: ../clients/common/settings-docs.h.in:381
+#: ../clients/common/settings-docs.h.in:382
 msgid ""
 "Specifies the UDP destination port to communicate to the remote VXLAN tunnel "
 "endpoint."
@@ -10296,22 +10501,22 @@ msgstr ""
 "Визначає порт призначення UDP для обміну даними із віддаленою кінцевою "
 "точкою тунелю VXLAN."
 
-#: ../clients/common/settings-docs.h.in:382
+#: ../clients/common/settings-docs.h.in:383
 msgid ""
 "Specifies the VXLAN Network Identifier (or VXLAN Segment Identifier) to use."
 msgstr ""
 "Визначає ідентифікатор мережі VXLAN (або ідентифікатор сегмента VXLAN), яким "
 "слід скористатися."
 
-#: ../clients/common/settings-docs.h.in:383
+#: ../clients/common/settings-docs.h.in:384
 msgid "Specifies whether netlink LL ADDR miss notifications are generated."
 msgstr "Визначає, чи будуть створюватися сповіщення netlink LL ADDR miss."
 
-#: ../clients/common/settings-docs.h.in:384
+#: ../clients/common/settings-docs.h.in:385
 msgid "Specifies whether netlink IP ADDR miss notifications are generated."
 msgstr "Визначає, чи будуть створюватися сповіщення netlink IP ADDR miss."
 
-#: ../clients/common/settings-docs.h.in:385
+#: ../clients/common/settings-docs.h.in:386
 msgid ""
 "Specifies whether unknown source link layer addresses and IP addresses are "
 "entered into the VXLAN device forwarding database."
@@ -10319,7 +10524,7 @@ msgstr ""
 "Вказує, чи вводяться невідомі адреси шару посилань та IP-адреси до бази "
 "даних переспрямовування пристроїв VXLAN."
 
-#: ../clients/common/settings-docs.h.in:386
+#: ../clients/common/settings-docs.h.in:387
 msgid ""
 "Specifies the maximum number of FDB entries. A value of zero means that the "
 "kernel will store unlimited entries."
@@ -10327,24 +10532,24 @@ msgstr ""
 "Вказує максимальну кількість записів FDB. Нульове значення означає, що ядро "
 "зберігатиме необмежену кількість записів."
 
-#: ../clients/common/settings-docs.h.in:387
+#: ../clients/common/settings-docs.h.in:388
 msgid "If given, specifies the source IP address to use in outgoing packets."
 msgstr ""
 "Якщо задано, визначає початкову IP-адресу, якою слід скористатися для "
 "вихідних пакетів."
 
-#: ../clients/common/settings-docs.h.in:388
+#: ../clients/common/settings-docs.h.in:389
 msgid ""
 "If given, specifies the parent interface name or parent connection UUID."
 msgstr ""
 "Якщо задано, визначає назву батьківського інтерфейсу або UUID батьківського "
 "з'єднання."
 
-#: ../clients/common/settings-docs.h.in:389
+#: ../clients/common/settings-docs.h.in:390
 msgid "Specifies whether ARP proxy is turned on."
 msgstr "Визначає, чи увімкнено ARP-проксі."
 
-#: ../clients/common/settings-docs.h.in:390
+#: ../clients/common/settings-docs.h.in:391
 msgid ""
 "Specifies the unicast destination IP address to use in outgoing packets when "
 "the destination link layer address is not known in the VXLAN device "
@@ -10355,11 +10560,11 @@ msgstr ""
 "переспрямовування пристроїв VXLAN, або IP-адреса універсальної трансляції, з "
 "якою слід встановити зв'язок."
 
-#: ../clients/common/settings-docs.h.in:391
+#: ../clients/common/settings-docs.h.in:392
 msgid "Specifies whether route short circuit is turned on."
 msgstr "Визначає, чи увімкнено коротке замикання маршруту."
 
-#: ../clients/common/settings-docs.h.in:392
+#: ../clients/common/settings-docs.h.in:393
 msgid ""
 "Specifies the maximum UDP source port to communicate to the remote VXLAN "
 "tunnel endpoint."
@@ -10367,7 +10572,7 @@ msgstr ""
 "Визначає максимальний початковий порт UDP для обміну даними із віддаленою "
 "кінцевою точкою тунелю VXLAN."
 
-#: ../clients/common/settings-docs.h.in:393
+#: ../clients/common/settings-docs.h.in:394
 msgid ""
 "Specifies the minimum UDP source port to communicate to the remote VXLAN "
 "tunnel endpoint."
@@ -10375,24 +10580,27 @@ msgstr ""
 "Визначає мінімальний початковий порт UDP для обміну даними із віддаленою "
 "кінцевою точкою тунелю VXLAN."
 
-#: ../clients/common/settings-docs.h.in:394
+#: ../clients/common/settings-docs.h.in:395
 msgid "Specifies the TOS value to use in outgoing packets."
 msgstr "Визначає значення TOS, яке слід використовувати для вихідних пакетів."
 
-#: ../clients/common/settings-docs.h.in:395
+#: ../clients/common/settings-docs.h.in:396
 msgid "Specifies the time-to-live value to use in outgoing packets."
 msgstr ""
 "Визначає значення часу життя, яке слід використовувати для вихідних пакетів."
 
-#: ../clients/common/settings-docs.h.in:396
+#: ../clients/common/settings-docs.h.in:397
+#| msgid ""
+#| "The P2P device that should be connected to. Currently this is the only "
+#| "way to create or join a group."
 msgid ""
-"The P2P device that should be connected to. Currently this is the only way "
+"The P2P device that should be connected to. Currently, this is the only way "
 "to create or join a group."
 msgstr ""
 "Пристрій P2P, з яким слід встановити з'єднання. У поточній версії це єдиний "
 "спосіб створення групи або долучення до неї."
 
-#: ../clients/common/settings-docs.h.in:397
+#: ../clients/common/settings-docs.h.in:398
 msgid ""
 "The Wi-Fi Display (WFD) Information Elements (IEs) to set. Wi-Fi Display "
 "requires a protocol specific information element to be set in certain Wi-Fi "
@@ -10406,7 +10614,7 @@ msgstr ""
 "Вказати ці елементи з метою встановлення з'єднання можна тут. Цей параметр є "
 "корисним лише для реалізації клієнта дисплея Wi-Fi."
 
-#: ../clients/common/settings-docs.h.in:398
+#: ../clients/common/settings-docs.h.in:399
 msgid ""
 "Flags indicating which mode of WPS is to be used. There's little point in "
 "changing the default setting as NetworkManager will automatically determine "
@@ -10416,7 +10624,7 @@ msgstr ""
 "типове значення не варто, оскільки NetworkManager автоматично визначає "
 "найкращий режим."
 
-#: ../clients/common/settings-docs.h.in:399
+#: ../clients/common/settings-docs.h.in:400
 msgid ""
 "If specified, this connection will only apply to the WiMAX device whose MAC "
 "address matches. This property does not change the MAC address of the device "
@@ -10426,7 +10634,7 @@ msgstr ""
 "відповідною адресою MAC. Ця властивість не змінює MAC-адреси пристрою (таку "
 "зміну називають підміною MAC). Застаріле: 1"
 
-#: ../clients/common/settings-docs.h.in:400
+#: ../clients/common/settings-docs.h.in:401
 msgid ""
 "Network Service Provider (NSP) name of the WiMAX network this connection "
 "should use. Deprecated: 1"
@@ -10434,19 +10642,24 @@ msgstr ""
 "Назва надавача мережевих послуг (NSP) для мережі WiMAX, яку має "
 "використовувати це з'єднання. Застаріле: 1"
 
-#: ../clients/common/settings-docs.h.in:401
+#: ../clients/common/settings-docs.h.in:402
+#| msgid ""
+#| "The use of fwmark is optional and is by default off. Setting it to 0 "
+#| "disables it. Otherwise it is a 32-bit fwmark for outgoing packets. Note "
+#| "that \"ip4-auto-default-route\" or \"ip6-auto-default-route\" enabled, "
+#| "implies to automatically choose a fwmark."
 msgid ""
 "The use of fwmark is optional and is by default off. Setting it to 0 "
-"disables it. Otherwise it is a 32-bit fwmark for outgoing packets. Note that "
-"\"ip4-auto-default-route\" or \"ip6-auto-default-route\" enabled, implies to "
-"automatically choose a fwmark."
+"disables it. Otherwise, it is a 32-bit fwmark for outgoing packets. Note "
+"that \"ip4-auto-default-route\" or \"ip6-auto-default-route\" enabled, "
+"implies to automatically choose a fwmark."
 msgstr ""
 "Використання fwmark є необов'язковим і типово його вимкнено. Встановлення "
 "значення 0 вимикає його. Якщо цього не зроблено, буде використано 32-бітову "
 "fwmark для вихідних пакетів. Зауважте, що вмикання «ip4-auto-default-route» "
 "або «ip6-auto-default-route» неявним чином призводить до вибору fwmark."
 
-#: ../clients/common/settings-docs.h.in:402
+#: ../clients/common/settings-docs.h.in:403
 msgid ""
 "Whether to enable special handling of the IPv4 default route. If enabled, "
 "the IPv4 default route from wireguard.peer-routes will be placed to a "
@@ -10474,11 +10687,11 @@ msgstr ""
 "і не буде жодного вузла, який використовує типовий маршрут (default-route) у "
 "дозволених IP-адресах (allowed-ips)."
 
-#: ../clients/common/settings-docs.h.in:403
+#: ../clients/common/settings-docs.h.in:404
 msgid "Like ip4-auto-default-route, but for the IPv6 default route."
 msgstr "Те саме, що ip4-auto-default-route, але для типового маршруту IPv6."
 
-#: ../clients/common/settings-docs.h.in:404
+#: ../clients/common/settings-docs.h.in:405
 msgid ""
 "The listen-port. If listen-port is not specified, the port will be chosen "
 "randomly when the interface comes up."
@@ -10486,7 +10699,7 @@ msgstr ""
 "Порт для очікування на дані. Якщо порт для очікування на дані не вказано, "
 "номер буде вибрано випадковим чином під час підняття інтерфейсу."
 
-#: ../clients/common/settings-docs.h.in:405
+#: ../clients/common/settings-docs.h.in:406
 msgid ""
 "If non-zero, only transmit packets of the specified size or smaller, "
 "breaking larger packets up into multiple fragments. If zero a default MTU is "
@@ -10499,7 +10712,7 @@ msgstr ""
 "відміну від параметра MTU wg-quick, тут не беруться до уваги поточні "
 "маршрути на момент активації."
 
-#: ../clients/common/settings-docs.h.in:406
+#: ../clients/common/settings-docs.h.in:407
 msgid ""
 "Whether to automatically add routes for the AllowedIPs ranges of the peers. "
 "If TRUE (the default), NetworkManager will automatically add routes in the "
@@ -10521,15 +10734,15 @@ msgstr ""
 "«0.0.0.0/0» або «::/0», а для профілю увімкнено ipv4.never-default або ipv6."
 "never-default, маршрут вузла для цього вузла не буде додано автоматично."
 
-#: ../clients/common/settings-docs.h.in:407
+#: ../clients/common/settings-docs.h.in:408
 msgid "The 256 bit private-key in base64 encoding."
 msgstr "256-бітовий закритий ключ у кодуванні base64."
 
-#: ../clients/common/settings-docs.h.in:408
+#: ../clients/common/settings-docs.h.in:409
 msgid "Flags indicating how to handle the \"private-key\" property."
 msgstr "Прапорці, які позначають, як обробляти властивість «private-key»."
 
-#: ../clients/common/settings-docs.h.in:409
+#: ../clients/common/settings-docs.h.in:410
 msgid ""
 "IEEE 802.15.4 channel. A positive integer or -1, meaning \"do not set, use "
 "whatever the device is already set to\"."
@@ -10537,7 +10750,7 @@ msgstr ""
 "Канал IEEE 802.15.4. Додане ціле значення або -1, що означає «не "
 "встановлювати, використовувати той, який вже встановлено пристроєм»."
 
-#: ../clients/common/settings-docs.h.in:410
+#: ../clients/common/settings-docs.h.in:411
 msgid ""
 "If specified, this connection will only apply to the IEEE 802.15.4 (WPAN) "
 "MAC layer device whose permanent MAC address matches."
@@ -10545,7 +10758,7 @@ msgstr ""
 "Якщо вказано, це з'єднання застосовуватиметься лише до пристрою шару MAC "
 "IEEE 802.15.4 (WPAN) із відповідною сталою адресою MAC."
 
-#: ../clients/common/settings-docs.h.in:411
+#: ../clients/common/settings-docs.h.in:412
 msgid ""
 "IEEE 802.15.4 channel page. A positive integer or -1, meaning \"do not set, "
 "use whatever the device is already set to\"."
@@ -10553,11 +10766,11 @@ msgstr ""
 "Сторінка каналу IEEE 80215.4. Додане ціле значення або -1, що означає «не "
 "встановлювати, використовувати ту, яку вже встановлено пристроєм»."
 
-#: ../clients/common/settings-docs.h.in:412
+#: ../clients/common/settings-docs.h.in:413
 msgid "IEEE 802.15.4 Personal Area Network (PAN) identifier."
 msgstr "Ідентифікатор Personal Area Network (PAN) IEEE 802.15.4."
 
-#: ../clients/common/settings-docs.h.in:413
+#: ../clients/common/settings-docs.h.in:414
 msgid "Short IEEE 802.15.4 address to be used within a restricted environment."
 msgstr ""
 "Коротка адреса IEEE 802.15.4, яку слід використовувати у обмеженому "
@@ -10683,7 +10896,7 @@ msgstr "З'єднання DSL %d"
 
 #: ../clients/tui/nm-editor-utils.c:179 ../libnm-core/nm-connection.c:2705
 #: ../libnm/nm-device.c:1587
-#: ../src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-reader.c:5216
+#: ../src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-reader.c:5225
 msgid "Bond"
 msgstr "Прив'язка"
 
@@ -10694,7 +10907,7 @@ msgstr "Прив'язане з'єднання %d"
 
 #: ../clients/tui/nm-editor-utils.c:188 ../libnm-core/nm-connection.c:2709
 #: ../libnm/nm-device.c:1591
-#: ../src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-reader.c:5599
+#: ../src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-reader.c:5608
 msgid "Bridge"
 msgstr "Місток"
 
@@ -10705,7 +10918,7 @@ msgstr "З'єднання містка %d"
 
 #: ../clients/tui/nm-editor-utils.c:197 ../libnm-core/nm-connection.c:2707
 #: ../libnm/nm-device.c:1589
-#: ../src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-reader.c:5289
+#: ../src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-reader.c:5298
 msgid "Team"
 msgstr "Команда"
 
@@ -11897,14 +12110,14 @@ msgstr "неочікуваний UUID %s замість %s"
 #: ../libnm-core/nm-setting-connection.c:975
 #: ../libnm-core/nm-setting-connection.c:1004
 #: ../libnm-core/nm-setting-connection.c:1266
-#: ../libnm-core/nm-setting-ip-config.c:4974
+#: ../libnm-core/nm-setting-ip-config.c:4984
 #: ../libnm-core/nm-setting-ip-tunnel.c:367
 #: ../libnm-core/nm-setting-olpc-mesh.c:84
 #: ../libnm-core/nm-setting-ovs-patch.c:77 ../libnm-core/nm-setting-pppoe.c:130
 #: ../libnm-core/nm-setting-vpn.c:551 ../libnm-core/nm-setting-vxlan.c:323
 #: ../libnm-core/nm-setting-wifi-p2p.c:122 ../libnm-core/nm-setting-wimax.c:94
 #: ../libnm-core/nm-setting-wireless-security.c:894
-#: ../libnm-core/nm-setting-wireless.c:764
+#: ../libnm-core/nm-setting-wireless.c:782
 msgid "property is missing"
 msgstr "не вказано властивості"
 
@@ -11927,144 +12140,144 @@ msgstr "Значення не може бути оброблено як спис
 msgid "value is not an integer in range [%lld, %lld]"
 msgstr "значення не є цілим числом у діапазоні [%lld, %lld]"
 
-#: ../libnm-core/nm-keyfile/nm-keyfile.c:271
+#: ../libnm-core/nm-keyfile/nm-keyfile.c:272
 msgid "ignoring missing number"
 msgstr "ігноруємо пропущене число"
 
-#: ../libnm-core/nm-keyfile/nm-keyfile.c:283
+#: ../libnm-core/nm-keyfile/nm-keyfile.c:284
 #, c-format
 msgid "ignoring invalid number '%s'"
 msgstr "ігноруємо некоректне число «%s»"
 
-#: ../libnm-core/nm-keyfile/nm-keyfile.c:312
+#: ../libnm-core/nm-keyfile/nm-keyfile.c:313
 #, c-format
 msgid "ignoring invalid %s address: %s"
 msgstr "ігноруємо некоректну адресу %s: %s"
 
-#: ../libnm-core/nm-keyfile/nm-keyfile.c:359
+#: ../libnm-core/nm-keyfile/nm-keyfile.c:360
 #, c-format
 msgid "ignoring invalid gateway '%s' for %s route"
 msgstr "ігноруємо некоректний шлюз «%s» для маршруту %s"
 
-#: ../libnm-core/nm-keyfile/nm-keyfile.c:391
+#: ../libnm-core/nm-keyfile/nm-keyfile.c:392
 #, c-format
 msgid "ignoring invalid %s route: %s"
 msgstr "ігноруємо некоректний маршрут %s: %s"
 
-#: ../libnm-core/nm-keyfile/nm-keyfile.c:566
+#: ../libnm-core/nm-keyfile/nm-keyfile.c:567
 #, c-format
 msgid "unexpected character '%c' for address %s: '%s' (position %td)"
 msgstr "неочікуваний символ «%c» для адреси %s: «%s» (позиція %td)"
 
-#: ../libnm-core/nm-keyfile/nm-keyfile.c:582
+#: ../libnm-core/nm-keyfile/nm-keyfile.c:583
 #, c-format
 msgid "unexpected character '%c' for %s: '%s' (position %td)"
 msgstr "неочікуваний символ «%c» для %s: «%s» (позиція %td)"
 
-#: ../libnm-core/nm-keyfile/nm-keyfile.c:597
+#: ../libnm-core/nm-keyfile/nm-keyfile.c:598
 #, c-format
 msgid "unexpected character '%c' in prefix length for %s: '%s' (position %td)"
 msgstr "неочікуваний символ «%c» у префіксі довжини для %s: «%s» (позиція %td)"
 
-#: ../libnm-core/nm-keyfile/nm-keyfile.c:614
+#: ../libnm-core/nm-keyfile/nm-keyfile.c:615
 #, c-format
 msgid "garbage at the end of value %s: '%s'"
 msgstr "зайві дані наприкінці значення %s: «%s»"
 
-#: ../libnm-core/nm-keyfile/nm-keyfile.c:624
+#: ../libnm-core/nm-keyfile/nm-keyfile.c:625
 #, c-format
 msgid "deprecated semicolon at the end of value %s: '%s'"
 msgstr "застаріла крапка з комою наприкінці значення %s: «%s»"
 
-#: ../libnm-core/nm-keyfile/nm-keyfile.c:647
+#: ../libnm-core/nm-keyfile/nm-keyfile.c:648
 #, c-format
 msgid "invalid prefix length for %s '%s', defaulting to %d"
 msgstr "некоректний префікс довжини для %s «%s», повертаємося до типового, %d"
 
-#: ../libnm-core/nm-keyfile/nm-keyfile.c:659
+#: ../libnm-core/nm-keyfile/nm-keyfile.c:660
 #, c-format
 msgid "missing prefix length for %s '%s', defaulting to %d"
 msgstr "пропущено префікс довжини для %s «%s», повертаємося до типового, %d"
 
-#: ../libnm-core/nm-keyfile/nm-keyfile.c:1001
+#: ../libnm-core/nm-keyfile/nm-keyfile.c:1002
 #: ../libnm-core/nm-setting-user.c:358
 #, c-format
 msgid "invalid value for \"%s\": %s"
 msgstr "некоректне значення для «%s»: %s"
 
-#: ../libnm-core/nm-keyfile/nm-keyfile.c:1041
+#: ../libnm-core/nm-keyfile/nm-keyfile.c:1042
 #, c-format
 msgid "ignoring invalid DNS server IPv%c address '%s'"
 msgstr "ігноруємо некоректну адресу IPv%c сервера DNS «%s»"
 
-#: ../libnm-core/nm-keyfile/nm-keyfile.c:1132
+#: ../libnm-core/nm-keyfile/nm-keyfile.c:1133
 msgid "ignoring invalid MAC address"
 msgstr "ігноруємо некоректну MAC-адресу"
 
-#: ../libnm-core/nm-keyfile/nm-keyfile.c:1391
+#: ../libnm-core/nm-keyfile/nm-keyfile.c:1392
 msgid "ignoring invalid SSID"
 msgstr "ігноруємо некоректний SSID"
 
-#: ../libnm-core/nm-keyfile/nm-keyfile.c:1409
+#: ../libnm-core/nm-keyfile/nm-keyfile.c:1410
 msgid "ignoring invalid raw password"
 msgstr "ігноруємо некоректний необроблений пароль"
 
-#: ../libnm-core/nm-keyfile/nm-keyfile.c:1554
+#: ../libnm-core/nm-keyfile/nm-keyfile.c:1555
 msgid "invalid key/cert value"
 msgstr "некоректне значення ключа/сертифіката"
 
-#: ../libnm-core/nm-keyfile/nm-keyfile.c:1568
+#: ../libnm-core/nm-keyfile/nm-keyfile.c:1569
 #, c-format
 msgid "invalid key/cert value path \"%s\""
 msgstr "некоректний шлях до ключа/сертифіката, «%s»"
 
-#: ../libnm-core/nm-keyfile/nm-keyfile.c:1592
-#: ../libnm-core/nm-keyfile/nm-keyfile.c:1688
+#: ../libnm-core/nm-keyfile/nm-keyfile.c:1593
+#: ../libnm-core/nm-keyfile/nm-keyfile.c:1689
 #, c-format
 msgid "certificate or key file '%s' does not exist"
 msgstr "файла сертифіката або ключа «%s» не існує"
 
-#: ../libnm-core/nm-keyfile/nm-keyfile.c:1604
+#: ../libnm-core/nm-keyfile/nm-keyfile.c:1605
 #, c-format
 msgid "invalid PKCS#11 URI \"%s\""
 msgstr "некоректна адреса PKCS#11 «%s»"
 
-#: ../libnm-core/nm-keyfile/nm-keyfile.c:1652
+#: ../libnm-core/nm-keyfile/nm-keyfile.c:1653
 msgid "invalid key/cert value data:;base64, is not base64"
 msgstr "некоректні дані значення ключа/сертифіката data:;base64, не є base64"
 
-#: ../libnm-core/nm-keyfile/nm-keyfile.c:1664
+#: ../libnm-core/nm-keyfile/nm-keyfile.c:1665
 msgid "invalid key/cert value data:;base64,file://"
 msgstr "некоректне значення ключа/сертифіката data:;base64,file://"
 
-#: ../libnm-core/nm-keyfile/nm-keyfile.c:1703
+#: ../libnm-core/nm-keyfile/nm-keyfile.c:1704
 msgid "invalid key/cert value is not a valid blob"
 msgstr ""
 "некоректне значення ключа/сертифіката, не є коректним значення «%s» не є "
 "коректним великим бінарним об'єктом"
 
-#: ../libnm-core/nm-keyfile/nm-keyfile.c:1808
+#: ../libnm-core/nm-keyfile/nm-keyfile.c:1809
 #, c-format
 msgid "invalid parity value '%s'"
 msgstr "некоректне значення парності, «%s»"
 
-#: ../libnm-core/nm-keyfile/nm-keyfile.c:1826
+#: ../libnm-core/nm-keyfile/nm-keyfile.c:1827
 #: ../libnm-core/nm-keyfile/nm-keyfile.c:3391
 #, c-format
 msgid "invalid setting: %s"
 msgstr "некоректний параметр: %s"
 
-#: ../libnm-core/nm-keyfile/nm-keyfile.c:1847
+#: ../libnm-core/nm-keyfile/nm-keyfile.c:1848
 #, c-format
 msgid "ignoring invalid team configuration: %s"
 msgstr "ігноруємо некоректне налаштування команди: %s"
 
-#: ../libnm-core/nm-keyfile/nm-keyfile.c:1932
+#: ../libnm-core/nm-keyfile/nm-keyfile.c:1933
 #, c-format
 msgid "invalid qdisc: %s"
 msgstr "некоректний qdisc: %s"
 
-#: ../libnm-core/nm-keyfile/nm-keyfile.c:1981
+#: ../libnm-core/nm-keyfile/nm-keyfile.c:1982
 #, c-format
 msgid "invalid tfilter: %s"
 msgstr "некоректний tfilter: %s"
@@ -12266,7 +12479,7 @@ msgstr ""
 #: ../libnm-core/nm-setting-connection.c:1238
 #: ../libnm-core/nm-setting-gsm.c:283 ../libnm-core/nm-setting-gsm.c:341
 #: ../libnm-core/nm-setting-gsm.c:378 ../libnm-core/nm-setting-gsm.c:387
-#: ../libnm-core/nm-setting-ip-config.c:4981
+#: ../libnm-core/nm-setting-ip-config.c:4991
 #: ../libnm-core/nm-setting-ip4-config.c:167
 #: ../libnm-core/nm-setting-ip4-config.c:174
 #: ../libnm-core/nm-setting-pppoe.c:137 ../libnm-core/nm-setting-pppoe.c:146
@@ -12305,10 +12518,10 @@ msgstr "можна вмикати лише для з'єднань Ethernet"
 #: ../libnm-core/nm-setting-wireless-security.c:1041
 #: ../libnm-core/nm-setting-wireless-security.c:1079
 #: ../libnm-core/nm-setting-wireless-security.c:1120
-#: ../libnm-core/nm-setting-wireless.c:835
-#: ../libnm-core/nm-setting-wireless.c:844
-#: ../libnm-core/nm-setting-wireless.c:855 ../libnm-core/nm-setting-wpan.c:162
-#: ../libnm-core/nm-utils.c:4596
+#: ../libnm-core/nm-setting-wireless.c:853
+#: ../libnm-core/nm-setting-wireless.c:862
+#: ../libnm-core/nm-setting-wireless.c:873 ../libnm-core/nm-setting-wpan.c:162
+#: ../libnm-core/nm-utils.c:4657
 msgid "property is invalid"
 msgstr "властивість є некоректною"
 
@@ -12431,32 +12644,32 @@ msgstr ""
 "Для з'єднання з параметром «%s» має бути встановлено тип підлеглості «%s». "
 "Замість цього маємо «%s»."
 
-#: ../libnm-core/nm-setting-bridge.c:1180
+#: ../libnm-core/nm-setting-bridge.c:1165
 #, c-format
 msgid "value '%d' is out of range <%d-%d>"
 msgstr "значення «%d» лежить поза діапазоном <%d-%d>"
 
-#: ../libnm-core/nm-setting-bridge.c:1197
+#: ../libnm-core/nm-setting-bridge.c:1182
 msgid "is not a valid MAC address"
 msgstr "не є коректною MAC-адресою"
 
-#: ../libnm-core/nm-setting-bridge.c:1238
+#: ../libnm-core/nm-setting-bridge.c:1223
 msgid "the mask can't contain bits 0 (STP), 1 (MAC) or 2 (LACP)"
 msgstr "маска не може містити біти 0 (STP), 1 (MAC) і 2 (LACP)"
 
-#: ../libnm-core/nm-setting-bridge.c:1258
+#: ../libnm-core/nm-setting-bridge.c:1243
 msgid "is not a valid link local MAC address"
 msgstr "не є коректною MAC-адресою для локальних з'єднань"
 
-#: ../libnm-core/nm-setting-bridge.c:1270
+#: ../libnm-core/nm-setting-bridge.c:1255
 msgid "is not a valid VLAN filtering protocol"
 msgstr "не є коректним протоколом фільтрування VLAN"
 
-#: ../libnm-core/nm-setting-bridge.c:1283
+#: ../libnm-core/nm-setting-bridge.c:1268
 msgid "is not a valid option"
 msgstr "не є коректним параметром"
 
-#: ../libnm-core/nm-setting-bridge.c:1292
+#: ../libnm-core/nm-setting-bridge.c:1277
 #, c-format
 msgid "'%s' option must be a power of 2"
 msgstr "Значенням параметра «%s» має бути степінь 2"
@@ -12648,305 +12861,302 @@ msgstr ""
 msgid "mtu can be at most %u but it is %u"
 msgstr "mtu не може перевищувати %u, але маємо %u"
 
-#: ../libnm-core/nm-setting-ip-config.c:109
+#: ../libnm-core/nm-setting-ip-config.c:110
 #, c-format
 msgid "Missing IPv4 address"
 msgstr "Не вказано адреси IPv4"
 
-#: ../libnm-core/nm-setting-ip-config.c:109
+#: ../libnm-core/nm-setting-ip-config.c:110
 #, c-format
 msgid "Missing IPv6 address"
 msgstr "Не вказано адреси IPv6"
 
-#: ../libnm-core/nm-setting-ip-config.c:114
+#: ../libnm-core/nm-setting-ip-config.c:115
 #, c-format
 msgid "Invalid IPv4 address '%s'"
 msgstr "Некоректна адреса IPv4, «%s»"
 
-#: ../libnm-core/nm-setting-ip-config.c:114
+#: ../libnm-core/nm-setting-ip-config.c:115
 #, c-format
 msgid "Invalid IPv6 address '%s'"
 msgstr "Некоректна адреса IPv6, «%s»"
 
-#: ../libnm-core/nm-setting-ip-config.c:129
+#: ../libnm-core/nm-setting-ip-config.c:130
 #, c-format
 msgid "Invalid IPv4 address prefix '%u'"
 msgstr "Некоректний префікс адреси IPv4, «%u»"
 
-#: ../libnm-core/nm-setting-ip-config.c:129
+#: ../libnm-core/nm-setting-ip-config.c:130
 #, c-format
 msgid "Invalid IPv6 address prefix '%u'"
 msgstr "Некоректний префікс адреси IPv6, «%u»"
 
-#: ../libnm-core/nm-setting-ip-config.c:144
+#: ../libnm-core/nm-setting-ip-config.c:145
 #, c-format
 msgid "Invalid routing metric '%s'"
 msgstr "Некоректна метрика маршрутизації, «%s»"
 
-#: ../libnm-core/nm-setting-ip-config.c:1272
+#: ../libnm-core/nm-setting-ip-config.c:1273
 #: ../libnm-core/nm-setting-sriov.c:413
 msgid "unknown attribute"
 msgstr "невідомий атрибут"
 
-#: ../libnm-core/nm-setting-ip-config.c:1282
+#: ../libnm-core/nm-setting-ip-config.c:1283
 #: ../libnm-core/nm-setting-sriov.c:423
 #, c-format
 msgid "invalid attribute type '%s'"
 msgstr "некоректний тип атрибута «%s»"
 
-#: ../libnm-core/nm-setting-ip-config.c:1293
+#: ../libnm-core/nm-setting-ip-config.c:1294
 #, c-format
 msgid "attribute is not valid for a IPv4 route"
 msgstr "атрибут не є коректним для маршрутизації IPv4"
 
-#: ../libnm-core/nm-setting-ip-config.c:1294
+#: ../libnm-core/nm-setting-ip-config.c:1295
 #, c-format
 msgid "attribute is not valid for a IPv6 route"
 msgstr "атрибут не є коректним для маршрутизації IPv6"
 
-#: ../libnm-core/nm-setting-ip-config.c:1308
-#: ../libnm-core/nm-setting-ip-config.c:1336
+#: ../libnm-core/nm-setting-ip-config.c:1309
+#: ../libnm-core/nm-setting-ip-config.c:1337
 #, c-format
 msgid "'%s' is not a valid IPv4 address"
 msgstr "«%s» не є коректною адресою IPv4"
 
-#: ../libnm-core/nm-setting-ip-config.c:1309
-#: ../libnm-core/nm-setting-ip-config.c:1337
+#: ../libnm-core/nm-setting-ip-config.c:1310
+#: ../libnm-core/nm-setting-ip-config.c:1338
 #, c-format
 msgid "'%s' is not a valid IPv6 address"
 msgstr "«%s» не є коректною адресою IPv6"
 
-#: ../libnm-core/nm-setting-ip-config.c:1327
+#: ../libnm-core/nm-setting-ip-config.c:1328
 #, c-format
 msgid "invalid prefix %s"
 msgstr "некоректний префікс %s"
 
-#: ../libnm-core/nm-setting-ip-config.c:1350
+#: ../libnm-core/nm-setting-ip-config.c:1351
 #, c-format
-#| msgid "'%s' is not a valid interface type"
 msgid "%s is not a valid route type"
 msgstr "%s не є коректним типом маршруту"
 
-#: ../libnm-core/nm-setting-ip-config.c:1400
+#: ../libnm-core/nm-setting-ip-config.c:1410
 #, c-format
-#| msgid "%d. route is invalid"
 msgid "route scope is invalid"
 msgstr "область маршрутів є некоректною"
 
-#: ../libnm-core/nm-setting-ip-config.c:2541
+#: ../libnm-core/nm-setting-ip-config.c:2551
 msgid "invalid priority"
 msgstr "некоректна пріоритетність"
 
-#: ../libnm-core/nm-setting-ip-config.c:2552
+#: ../libnm-core/nm-setting-ip-config.c:2562
 msgid "missing table"
 msgstr "не вказано таблиці"
 
-#: ../libnm-core/nm-setting-ip-config.c:2558
+#: ../libnm-core/nm-setting-ip-config.c:2568
 msgid "invalid action"
 msgstr "некоректна дія"
 
-#: ../libnm-core/nm-setting-ip-config.c:2565
+#: ../libnm-core/nm-setting-ip-config.c:2575
 msgid "has from/src but the prefix-length is zero"
 msgstr ""
 "містить from/src, але значення довжини префікса (prefix-length) є нульовим"
 
-#: ../libnm-core/nm-setting-ip-config.c:2572
+#: ../libnm-core/nm-setting-ip-config.c:2582
 msgid "missing from/src for a non zero prefix-length"
 msgstr "пропущено from/src для ненульового значення довжини префікса"
 
-#: ../libnm-core/nm-setting-ip-config.c:2577
+#: ../libnm-core/nm-setting-ip-config.c:2587
 msgid "invalid from/src"
 msgstr "некоректне значення from/src"
 
-#: ../libnm-core/nm-setting-ip-config.c:2582
+#: ../libnm-core/nm-setting-ip-config.c:2592
 msgid "invalid prefix length for from/src"
 msgstr "некоректна довжина префікса для from/src"
 
-#: ../libnm-core/nm-setting-ip-config.c:2589
+#: ../libnm-core/nm-setting-ip-config.c:2599
 msgid "has to/dst but the prefix-length is zero"
 msgstr ""
 "містить to/dst, але значення довжини префікса (prefix-length) є нульовим"
 
-#: ../libnm-core/nm-setting-ip-config.c:2596
+#: ../libnm-core/nm-setting-ip-config.c:2606
 msgid "missing to/dst for a non zero prefix-length"
 msgstr "пропущено to/dst для ненульового значення довжини префікса"
 
-#: ../libnm-core/nm-setting-ip-config.c:2601
+#: ../libnm-core/nm-setting-ip-config.c:2611
 msgid "invalid to/dst"
 msgstr "некоректне значення to/dst"
 
-#: ../libnm-core/nm-setting-ip-config.c:2606
+#: ../libnm-core/nm-setting-ip-config.c:2616
 msgid "invalid prefix length for to/dst"
 msgstr "некоректна довжина префікса для to/dst"
 
-#: ../libnm-core/nm-setting-ip-config.c:2614
+#: ../libnm-core/nm-setting-ip-config.c:2624
 msgid "invalid iifname"
 msgstr "некоректна назва інтерфейсу"
 
-#: ../libnm-core/nm-setting-ip-config.c:2622
+#: ../libnm-core/nm-setting-ip-config.c:2632
 msgid "invalid oifname"
 msgstr "некоректна назва інтерфейсу (oifname)"
 
-#: ../libnm-core/nm-setting-ip-config.c:2628
+#: ../libnm-core/nm-setting-ip-config.c:2638
 msgid "invalid source port range"
 msgstr "некоректний діапазон номерів порту джерела"
 
-#: ../libnm-core/nm-setting-ip-config.c:2634
+#: ../libnm-core/nm-setting-ip-config.c:2644
 msgid "invalid destination port range"
 msgstr "некоректний діапазон номерів порту призначення"
 
-#: ../libnm-core/nm-setting-ip-config.c:2642
+#: ../libnm-core/nm-setting-ip-config.c:2652
 msgid "suppress_prefixlength out of range"
 msgstr "suppress_prefixlength поза припустимим діапазоном"
 
-#: ../libnm-core/nm-setting-ip-config.c:2647
+#: ../libnm-core/nm-setting-ip-config.c:2657
 msgid "suppress_prefixlength is only allowed with the to-table action"
 msgstr ""
 "suppress_prefixlength можна використовувати лише разом із дією to-table"
 
-#: ../libnm-core/nm-setting-ip-config.c:2754
+#: ../libnm-core/nm-setting-ip-config.c:2764
 #, c-format
 msgid "duplicate key %s"
 msgstr "дублікат ключа %s"
 
-#: ../libnm-core/nm-setting-ip-config.c:2768
+#: ../libnm-core/nm-setting-ip-config.c:2778
 #, c-format
 msgid "invalid key \"%s\""
 msgstr "некоректний ключ «%s»"
 
-#: ../libnm-core/nm-setting-ip-config.c:2781
+#: ../libnm-core/nm-setting-ip-config.c:2791
 #, c-format
 msgid "invalid variant type '%s' for \"%s\""
 msgstr "некоректний тип варіанта «%s» для «%s»"
 
-#: ../libnm-core/nm-setting-ip-config.c:2790
+#: ../libnm-core/nm-setting-ip-config.c:2800
 msgid "missing \""
 msgstr "не вистачає \""
 
-#: ../libnm-core/nm-setting-ip-config.c:2796
+#: ../libnm-core/nm-setting-ip-config.c:2806
 msgid "invalid \""
 msgstr "некоректна \""
 
-#: ../libnm-core/nm-setting-ip-config.c:2993
+#: ../libnm-core/nm-setting-ip-config.c:3003
 msgid "Unsupported to-string-flags argument"
 msgstr "Непідтримуваний аргумент to-string-flags"
 
-#: ../libnm-core/nm-setting-ip-config.c:3000
+#: ../libnm-core/nm-setting-ip-config.c:3010
 msgid "Unsupported extra-argument"
 msgstr "Непідтримуваний додатковий аргумент"
 
-#: ../libnm-core/nm-setting-ip-config.c:3267
+#: ../libnm-core/nm-setting-ip-config.c:3277
 #, c-format
 msgid "unsupported key \"%s\""
 msgstr "непідтримуваний ключ «%s»"
 
-#: ../libnm-core/nm-setting-ip-config.c:3272
+#: ../libnm-core/nm-setting-ip-config.c:3282
 #, c-format
 msgid "duplicate key \"%s\""
 msgstr "дублікат ключа «%s»"
 
-#: ../libnm-core/nm-setting-ip-config.c:3277
+#: ../libnm-core/nm-setting-ip-config.c:3287
 #, c-format
 msgid "invalid value for \"%s\""
 msgstr "некоректне значення «%s»"
 
-#: ../libnm-core/nm-setting-ip-config.c:3287
+#: ../libnm-core/nm-setting-ip-config.c:3297
 msgid "empty text does not describe a rule"
 msgstr "порожній текст не описує правило"
 
-#: ../libnm-core/nm-setting-ip-config.c:3293
+#: ../libnm-core/nm-setting-ip-config.c:3303
 #, c-format
 msgid "missing argument for \"%s\""
 msgstr "пропущено аргумент «%s»"
 
-#: ../libnm-core/nm-setting-ip-config.c:3305
+#: ../libnm-core/nm-setting-ip-config.c:3315
 msgid "invalid \"from\" part"
 msgstr "некоректна частина «from»"
 
-#: ../libnm-core/nm-setting-ip-config.c:3319
+#: ../libnm-core/nm-setting-ip-config.c:3329
 msgid "invalid \"to\" part"
 msgstr "некоректна частина «to»"
 
-#: ../libnm-core/nm-setting-ip-config.c:3328
+#: ../libnm-core/nm-setting-ip-config.c:3338
 #, c-format
 msgid "cannot detect address family for rule"
 msgstr "не вдалося визначити сімейство адрес для правила"
 
-#: ../libnm-core/nm-setting-ip-config.c:3388
-#: ../libnm-core/nm-setting-ip-config.c:3482
+#: ../libnm-core/nm-setting-ip-config.c:3398
+#: ../libnm-core/nm-setting-ip-config.c:3492
 #, c-format
 msgid "rule is invalid: %s"
 msgstr "правило є некоректним: %s"
 
-#: ../libnm-core/nm-setting-ip-config.c:3465
+#: ../libnm-core/nm-setting-ip-config.c:3475
 msgid "invalid address family"
 msgstr "некоректне сімейство адрес"
 
-#: ../libnm-core/nm-setting-ip-config.c:4738
+#: ../libnm-core/nm-setting-ip-config.c:4748
 #, c-format
 msgid "rule #%u is invalid: %s"
 msgstr "правило %u є некоректним: %s"
 
-#: ../libnm-core/nm-setting-ip-config.c:4994
+#: ../libnm-core/nm-setting-ip-config.c:5004
 #, c-format
 msgid "%d. DNS server address is invalid"
 msgstr "%d. Адреса сервера DNS є некоректною."
 
-#: ../libnm-core/nm-setting-ip-config.c:5010
+#: ../libnm-core/nm-setting-ip-config.c:5020
 #, c-format
 msgid "%d. IP address is invalid"
 msgstr "%d. IP-адреса є некоректною."
 
-#: ../libnm-core/nm-setting-ip-config.c:5022
+#: ../libnm-core/nm-setting-ip-config.c:5032
 #, c-format
 msgid "%d. IP address has 'label' property with invalid type"
 msgstr "%d. IP-адреса має властивість «label» некоректного типу"
 
-#: ../libnm-core/nm-setting-ip-config.c:5031
+#: ../libnm-core/nm-setting-ip-config.c:5041
 #, c-format
 msgid "%d. IP address has invalid label '%s'"
 msgstr "%d. IP-адреса має некоректну мітку, «%s»"
 
-#: ../libnm-core/nm-setting-ip-config.c:5045
+#: ../libnm-core/nm-setting-ip-config.c:5055
 msgid "gateway cannot be set if there are no addresses configured"
 msgstr "шлюз не може бути встановлено, якщо не налаштовано адрес"
 
-#: ../libnm-core/nm-setting-ip-config.c:5054
+#: ../libnm-core/nm-setting-ip-config.c:5064
 msgid "gateway is invalid"
 msgstr "шлюз є некоректним"
 
-#: ../libnm-core/nm-setting-ip-config.c:5069
+#: ../libnm-core/nm-setting-ip-config.c:5079
 #, c-format
 msgid "%d. route is invalid"
 msgstr "%d. Некоректний маршрут"
 
-#: ../libnm-core/nm-setting-ip-config.c:5079
+#: ../libnm-core/nm-setting-ip-config.c:5089
 #, c-format
-#| msgid "invalid attribute type '%s'"
 msgid "invalid attribute: %s"
 msgstr "некоректний атрибут: %s"
 
-#: ../libnm-core/nm-setting-ip-config.c:5098
+#: ../libnm-core/nm-setting-ip-config.c:5108
 #, c-format
 msgid "%u. rule has wrong address-family"
 msgstr "%u. у правилі вказано помилкове сімейство адрес"
 
-#: ../libnm-core/nm-setting-ip-config.c:5107
+#: ../libnm-core/nm-setting-ip-config.c:5117
 #, c-format
 msgid "%u. rule is invalid: %s"
 msgstr "%u. правило є некоректним: %s"
 
-#: ../libnm-core/nm-setting-ip-config.c:5121
+#: ../libnm-core/nm-setting-ip-config.c:5131
 #, c-format
 msgid "'%s' is not a valid IAID"
 msgstr "«%s» не є коректним IAID"
 
-#: ../libnm-core/nm-setting-ip-config.c:5135
+#: ../libnm-core/nm-setting-ip-config.c:5145
 #, c-format
 msgid "the property cannot be set when '%s' is disabled"
 msgstr "властивість не можна встановлювати, якщо вимкнено «%s»"
 
-#: ../libnm-core/nm-setting-ip-config.c:5157
+#: ../libnm-core/nm-setting-ip-config.c:5167
 #, c-format
 msgid "a gateway is incompatible with '%s'"
 msgstr "шлюз є несумісним з «%s»"
@@ -13097,12 +13307,12 @@ msgid "is empty"
 msgstr "є порожнім"
 
 #: ../libnm-core/nm-setting-olpc-mesh.c:94
-#: ../libnm-core/nm-setting-wireless.c:774
+#: ../libnm-core/nm-setting-wireless.c:792
 msgid "SSID length is out of range <1-32> bytes"
 msgstr "Довжина SSID лежить поза діапазоном у <1-32> байтів"
 
 #: ../libnm-core/nm-setting-olpc-mesh.c:103
-#: ../libnm-core/nm-setting-wireless.c:814
+#: ../libnm-core/nm-setting-wireless.c:832
 #, c-format
 msgid "'%d' is not a valid channel"
 msgstr "«%d» не є коректним каналом"
@@ -13262,29 +13472,29 @@ msgid "VFs %d and %d are not sorted by ascending index"
 msgstr "VF %d і %d не упорядковано за зростанням"
 
 #: ../libnm-core/nm-setting-tc-config.c:56
-#: ../libnm-core/nm-setting-tc-config.c:422
-#: ../libnm-core/nm-setting-tc-config.c:692
+#: ../libnm-core/nm-setting-tc-config.c:423
+#: ../libnm-core/nm-setting-tc-config.c:699
 #, c-format
 msgid "kind is missing"
 msgstr "пропущено тип"
 
 #: ../libnm-core/nm-setting-tc-config.c:64
-#: ../libnm-core/nm-setting-tc-config.c:430
-#: ../libnm-core/nm-setting-tc-config.c:700
+#: ../libnm-core/nm-setting-tc-config.c:431
+#: ../libnm-core/nm-setting-tc-config.c:707
 #, c-format
 msgid "'%s' is not a valid kind"
 msgstr "«%s» не є коректним типом"
 
 #: ../libnm-core/nm-setting-tc-config.c:72
-#: ../libnm-core/nm-setting-tc-config.c:708
+#: ../libnm-core/nm-setting-tc-config.c:715
 msgid "parent handle missing"
 msgstr "не вказано батьківського дескриптора"
 
-#: ../libnm-core/nm-setting-tc-config.c:1278
+#: ../libnm-core/nm-setting-tc-config.c:1293
 msgid "there are duplicate TC qdiscs"
 msgstr "маємо дублювання q-дисків TC"
 
-#: ../libnm-core/nm-setting-tc-config.c:1298
+#: ../libnm-core/nm-setting-tc-config.c:1313
 msgid "there are duplicate TC filters"
 msgstr "маємо дублювання фільтрів TC"
 
@@ -13588,42 +13798,46 @@ msgstr ""
 "«%s» можна використовувати лише з керуванням ключами «wpa-eap», «wpa-psk» "
 "або «sae»"
 
-#: ../libnm-core/nm-setting-wireless.c:783
+#: ../libnm-core/nm-setting-wireless.c:801
 #, c-format
 msgid "'%s' is not a valid Wi-Fi mode"
 msgstr "«%s» не є коректним режимом Wi-Fi"
 
-#: ../libnm-core/nm-setting-wireless.c:793
+#: ../libnm-core/nm-setting-wireless.c:811
 #, c-format
 msgid "'%s' is not a valid band"
 msgstr "«%s» не є коректним значенням смуги"
 
-#: ../libnm-core/nm-setting-wireless.c:803
+#: ../libnm-core/nm-setting-wireless.c:821
 #, c-format
 msgid "'%s' requires setting '%s' property"
 msgstr "«%s» потребує встановлення властивості «%s»"
 
-#: ../libnm-core/nm-setting-wireless.c:825
+#: ../libnm-core/nm-setting-wireless.c:843
 #, c-format
 msgid "'%s' requires '%s' and '%s' property"
 msgstr "«%s» потребує «%s» і властивості «%s»"
 
-#: ../libnm-core/nm-setting-wireless.c:912 ../libnm-core/nm-team-utils.c:1990
+#: ../libnm-core/nm-setting-wireless.c:930 ../libnm-core/nm-team-utils.c:1990
 #, c-format
 msgid "invalid value"
 msgstr "некоректне значення"
 
-#: ../libnm-core/nm-setting-wireless.c:922
+#: ../libnm-core/nm-setting-wireless.c:940
 msgid "Wake-on-WLAN mode 'default' and 'ignore' are exclusive flags"
 msgstr ""
 "Прапорці режиму Wake-on-WLAN «default» і «ignore» не можна використовувати "
 "одночасно"
 
-#: ../libnm-core/nm-setting-wireless.c:931
+#: ../libnm-core/nm-setting-wireless.c:949
 msgid "Wake-on-WLAN trying to set unknown flag"
 msgstr "Wake-on-WLAN намагається встановити невідомий прапорець"
 
-#: ../libnm-core/nm-setting-wireless.c:953
+#: ../libnm-core/nm-setting-wireless.c:960
+msgid "AP isolation can be set only in AP mode"
+msgstr "Ізоляцію точки доступу можна встановлювати лише у режимі точки доступу"
+
+#: ../libnm-core/nm-setting-wireless.c:982
 #, c-format
 msgid "conflicting value of mac-address-randomization and cloned-mac-address"
 msgstr "конфлікт значень mac-address-randomization і cloned-mac-address"
@@ -13734,7 +13948,7 @@ msgid "team config is not valid UTF-8"
 msgstr "файл налаштувань team не є коректними даними у кодуванні UTF-8"
 
 #: ../libnm-core/nm-team-utils.c:2104
-#: ../src/settings/plugins/ifcfg-rh/tests/test-ifcfg-rh.c:9088
+#: ../src/settings/plugins/ifcfg-rh/tests/test-ifcfg-rh.c:9136
 #, c-format
 msgid "invalid json"
 msgstr "некоректний код JSON"
@@ -13749,228 +13963,228 @@ msgstr "некоректний тип D-Bus «%s»"
 msgid "invalid link-watchers: %s"
 msgstr "некоректне значення link-watchers: %s"
 
-#: ../libnm-core/nm-utils.c:2298
+#: ../libnm-core/nm-utils.c:2299
 #, c-format
 msgid "'%s' is not a valid handle."
 msgstr "«%s» не є коректним дескриптором."
 
-#: ../libnm-core/nm-utils.c:2446
+#: ../libnm-core/nm-utils.c:2448
 #, c-format
 msgid "'%s' unexpected: parent already specified."
 msgstr "Неочікуване «%s»: батьківський запис вже вказано."
 
-#: ../libnm-core/nm-utils.c:2462
+#: ../libnm-core/nm-utils.c:2464
 #, c-format
 msgid "invalid handle: '%s'"
 msgstr "некоректний дескриптор: «%s»"
 
-#: ../libnm-core/nm-utils.c:2484
+#: ../libnm-core/nm-utils.c:2486
 msgid "parent not specified."
 msgstr "не вказано батьківський запис."
 
-#: ../libnm-core/nm-utils.c:2546
+#: ../libnm-core/nm-utils.c:2548
 #, c-format
 msgid "unsupported qdisc option: '%s'."
 msgstr "непідтримуваний параметр qdisc: «%s»."
 
-#: ../libnm-core/nm-utils.c:2668
+#: ../libnm-core/nm-utils.c:2670
 msgid "action name missing."
 msgstr "не вказано назви дії."
 
-#: ../libnm-core/nm-utils.c:2694
+#: ../libnm-core/nm-utils.c:2696
 #, c-format
 msgid "unsupported action option: '%s'."
 msgstr "непідтримуваний параметр дії: «%s»."
 
-#: ../libnm-core/nm-utils.c:2832
+#: ../libnm-core/nm-utils.c:2834
 msgid "invalid action: "
 msgstr "некоректна дія: "
 
-#: ../libnm-core/nm-utils.c:2836
+#: ../libnm-core/nm-utils.c:2838
 #, c-format
 msgid "unsupported tfilter option: '%s'."
 msgstr "непідтримуваний параметр tfilter: «%s»."
 
-#: ../libnm-core/nm-utils.c:3437
+#: ../libnm-core/nm-utils.c:3438
 #, c-format
 msgid "failed stat file %s: %s"
 msgstr "не вдалося отримати статистичні дані щодо файла %s: %s"
 
-#: ../libnm-core/nm-utils.c:3446
+#: ../libnm-core/nm-utils.c:3447
 #, c-format
 msgid "not a file (%s)"
 msgstr "не є файлом (%s)"
 
-#: ../libnm-core/nm-utils.c:3457
+#: ../libnm-core/nm-utils.c:3458
 #, c-format
 msgid "invalid file owner %d for %s"
 msgstr "некоректний власник файла, %d, %s"
 
-#: ../libnm-core/nm-utils.c:3468
+#: ../libnm-core/nm-utils.c:3469
 #, c-format
 msgid "file permissions for %s"
 msgstr "файлові права доступу до %s"
 
-#: ../libnm-core/nm-utils.c:3478
+#: ../libnm-core/nm-utils.c:3479
 #, c-format
 msgid "reject %s"
 msgstr "відмовити %s"
 
-#: ../libnm-core/nm-utils.c:3497
+#: ../libnm-core/nm-utils.c:3498
 #, c-format
 msgid "path is not absolute (%s)"
 msgstr "шлях не є абсолютним (%s)"
 
-#: ../libnm-core/nm-utils.c:3511
+#: ../libnm-core/nm-utils.c:3512
 #, c-format
 msgid "Plugin file does not exist (%s)"
 msgstr "Файла додатка не існує (%s)"
 
-#: ../libnm-core/nm-utils.c:3519
+#: ../libnm-core/nm-utils.c:3520
 #, c-format
 msgid "Plugin is not a valid file (%s)"
 msgstr "Додаток не є коректним файлом (%s)"
 
-#: ../libnm-core/nm-utils.c:3529
+#: ../libnm-core/nm-utils.c:3530
 #, c-format
 msgid "libtool archives are not supported (%s)"
 msgstr "Підтримки архівів libtool не передбачено (%s)"
 
-#: ../libnm-core/nm-utils.c:3611
+#: ../libnm-core/nm-utils.c:3612
 #, c-format
 msgid "Could not find \"%s\" binary"
 msgstr "Не вдалося знайти виконуваний файл «%s»"
 
-#: ../libnm-core/nm-utils.c:4547
+#: ../libnm-core/nm-utils.c:4608
 msgid "unknown secret flags"
 msgstr "невідомі прапорці реєстраційних даних"
 
-#: ../libnm-core/nm-utils.c:4557
+#: ../libnm-core/nm-utils.c:4618
 msgid "conflicting secret flags"
 msgstr "конфлікт прапорців реєстраційних даних"
 
-#: ../libnm-core/nm-utils.c:4568
+#: ../libnm-core/nm-utils.c:4629
 msgid "secret flags must not be \"not-required\""
 msgstr "прапорці реєстраційних даних не можуть бути «not-required»"
 
-#: ../libnm-core/nm-utils.c:4576
+#: ../libnm-core/nm-utils.c:4637
 msgid "unsupported secret flags"
 msgstr "непідтримувані прапорці реєстраційних даних"
 
-#: ../libnm-core/nm-utils.c:4606
+#: ../libnm-core/nm-utils.c:4667
 msgid "can't be simultaneously disabled and enabled"
 msgstr "не може бути одночасно вимкнено і увімкнено"
 
-#: ../libnm-core/nm-utils.c:4614
+#: ../libnm-core/nm-utils.c:4675
 msgid "WPS is required"
 msgstr "Потрібна WPS"
 
-#: ../libnm-core/nm-utils.c:4680
+#: ../libnm-core/nm-utils.c:4741
 #, c-format
 msgid "not a valid ethernet MAC address for mask at position %lld"
 msgstr "некоректна адреса MAC ethernet для маски у позиції %lld"
 
-#: ../libnm-core/nm-utils.c:4695
+#: ../libnm-core/nm-utils.c:4756
 #, c-format
 msgid "not a valid ethernet MAC address #%u at position %lld"
 msgstr "некоректна адреса MAC ethernet #%u у позиції %lld"
 
-#: ../libnm-core/nm-utils.c:5390
+#: ../libnm-core/nm-utils.c:5446
 msgid "not valid utf-8"
 msgstr "некоректні дані UTF-8"
 
-#: ../libnm-core/nm-utils.c:5411 ../libnm-core/nm-utils.c:5464
+#: ../libnm-core/nm-utils.c:5467 ../libnm-core/nm-utils.c:5520
 msgid "is not a JSON object"
 msgstr "не є об'єктом JSON"
 
-#: ../libnm-core/nm-utils.c:5440 ../libnm-core/nm-utils.c:5477
+#: ../libnm-core/nm-utils.c:5496 ../libnm-core/nm-utils.c:5532
 msgid "value is NULL"
 msgstr "значенням є NULL"
 
-#: ../libnm-core/nm-utils.c:5440 ../libnm-core/nm-utils.c:5477
+#: ../libnm-core/nm-utils.c:5496 ../libnm-core/nm-utils.c:5532
 msgid "value is empty"
 msgstr "порожнє значення"
 
-#: ../libnm-core/nm-utils.c:5452
+#: ../libnm-core/nm-utils.c:5508
 #, c-format
 msgid "invalid JSON at position %d (%s)"
 msgstr "некоректний код JSON на позиції %d (%s)"
 
-#: ../libnm-core/nm-utils.c:5597 ../libnm-core/nm-utils.c:5617
+#: ../libnm-core/nm-utils.c:5652 ../libnm-core/nm-utils.c:5672
 msgid "unterminated escape sequence"
 msgstr "незавершена екранована послідовність"
 
-#: ../libnm-core/nm-utils.c:5642
+#: ../libnm-core/nm-utils.c:5697
 #, c-format
 msgid "unknown attribute '%s'"
 msgstr "невідомий атрибут «%s»"
 
-#: ../libnm-core/nm-utils.c:5657
+#: ../libnm-core/nm-utils.c:5712
 #, c-format
 msgid "missing key-value separator '%c' after '%s'"
 msgstr "пропущено роздільник пар ключ-значення «%c» після «%s»"
 
-#: ../libnm-core/nm-utils.c:5673
+#: ../libnm-core/nm-utils.c:5728
 #, c-format
 msgid "invalid uint32 value '%s' for attribute '%s'"
 msgstr "некоректне значення uint32 «%s» атрибута «%s»"
 
-#: ../libnm-core/nm-utils.c:5682
+#: ../libnm-core/nm-utils.c:5737
 #, c-format
 msgid "invalid int32 value '%s' for attribute '%s'"
 msgstr "некоректне значення int32 «%s» атрибута «%s»"
 
-#: ../libnm-core/nm-utils.c:5691
+#: ../libnm-core/nm-utils.c:5746
 #, c-format
 msgid "invalid uint64 value '%s' for attribute '%s'"
 msgstr "некоректне значення uint64 «%s» атрибута «%s»"
 
-#: ../libnm-core/nm-utils.c:5700
+#: ../libnm-core/nm-utils.c:5755
 #, c-format
 msgid "invalid uint8 value '%s' for attribute '%s'"
 msgstr "некоректне значення uint8 «%s» атрибута «%s»"
 
-#: ../libnm-core/nm-utils.c:5710
+#: ../libnm-core/nm-utils.c:5765
 #, c-format
 msgid "invalid boolean value '%s' for attribute '%s'"
 msgstr "некоректне булеве значення «%s» атрибута «%s»"
 
-#: ../libnm-core/nm-utils.c:5720
+#: ../libnm-core/nm-utils.c:5775
 #, c-format
 msgid "unsupported attribute '%s' of type '%s'"
 msgstr "непідтримуваний атрибут «%s» типу «%s»"
 
-#: ../libnm-core/nm-utils.c:6020
+#: ../libnm-core/nm-utils.c:6075
 #, c-format
 msgid "Bridge VLANs %d and %d are not sorted by ascending vid"
 msgstr "VLAN містка %d і %d не упорядковано за зростанням vid"
 
-#: ../libnm-core/nm-utils.c:6044
+#: ../libnm-core/nm-utils.c:6099
 #, c-format
 msgid "duplicate bridge VLAN vid %u"
 msgstr "дублікат містка vid VLAN %u"
 
-#: ../libnm-core/nm-utils.c:6056
+#: ../libnm-core/nm-utils.c:6111
 msgid "only one VLAN can be the PVID"
 msgstr "лише одна з VLAN може бути PVID"
 
-#: ../libnm-core/nm-utils.c:6106
+#: ../libnm-core/nm-utils.c:6161
 #, c-format
 msgid "unknown flags 0x%x"
 msgstr "невідомі прапорці 0x%x"
 
-#: ../libnm-core/nm-utils.c:6116
+#: ../libnm-core/nm-utils.c:6171
 msgid ""
 "'fqdn-no-update' and 'fqdn-serv-update' flags cannot be set at the same time"
 msgstr ""
 "не можна одночасно встановлювати прапорці «fqdn-no-update» і «fqdn-serv-"
 "update»"
 
-#: ../libnm-core/nm-utils.c:6127
+#: ../libnm-core/nm-utils.c:6182
 msgid "'fqdn-clear-flags' flag is incompatible with other FQDN flags"
 msgstr "прапорець «fqdn-clear-flags» є несумісним із іншими прапорцями FQDN"
 
-#: ../libnm-core/nm-utils.c:6136
+#: ../libnm-core/nm-utils.c:6191
 msgid "DHCPv6 does not support the E (encoded) FQDN flag"
 msgstr "у DHCPv6 не передбачено підтримки прапорця E (закодовано) FQDN"
 
@@ -14541,36 +14755,36 @@ msgstr ""
 "Правила системи забороняють вмикання або вимикання перевірки придатності до "
 "з'єднання"
 
-#: ../shared/nm-glib-aux/nm-shared-utils.c:2211
+#: ../shared/nm-glib-aux/nm-shared-utils.c:2365
 #, c-format
 msgid "object class '%s' has no property named '%s'"
 msgstr "у класі об'єктів «%s» немає властивості із назвою «%s»"
 
-#: ../shared/nm-glib-aux/nm-shared-utils.c:2218
+#: ../shared/nm-glib-aux/nm-shared-utils.c:2372
 #, c-format
 msgid "property '%s' of object class '%s' is not writable"
 msgstr "властивість «%s» класу об'єктів «%s» є непридатною до запису"
 
-#: ../shared/nm-glib-aux/nm-shared-utils.c:2225
+#: ../shared/nm-glib-aux/nm-shared-utils.c:2379
 #, c-format
 msgid ""
 "construct property \"%s\" for object '%s' can't be set after construction"
 msgstr ""
 "властивість construct «%s» об'єкта «%s» не можна встановлювати після побудови"
 
-#: ../shared/nm-glib-aux/nm-shared-utils.c:2233
+#: ../shared/nm-glib-aux/nm-shared-utils.c:2387
 #, c-format
 msgid "'%s::%s' is not a valid property name; '%s' is not a GObject subtype"
 msgstr "«%s::%s» не є коректною назвою властивості; «%s» не є підтипом GObject"
 
-#: ../shared/nm-glib-aux/nm-shared-utils.c:2242
+#: ../shared/nm-glib-aux/nm-shared-utils.c:2396
 #, c-format
 msgid "unable to set property '%s' of type '%s' from value of type '%s'"
 msgstr ""
 "не вдалося встановити значення властивості «%s» типу «%s» на основі значення "
 "типу «%s»"
 
-#: ../shared/nm-glib-aux/nm-shared-utils.c:2253
+#: ../shared/nm-glib-aux/nm-shared-utils.c:2407
 #, c-format
 msgid ""
 "value \"%s\" of type '%s' is invalid or out of range for property '%s' of "
@@ -14579,48 +14793,48 @@ msgstr ""
 "значення «%s» типу «%s» є некоректним для властивості «%s» типу «%s» або не "
 "належить до припустимого діапазону значень"
 
-#: ../shared/nm-glib-aux/nm-shared-utils.c:4666
+#: ../shared/nm-glib-aux/nm-shared-utils.c:4836
 msgid "interface name is missing"
 msgstr "пропущено назву інтерфейсу"
 
-#: ../shared/nm-glib-aux/nm-shared-utils.c:4672
+#: ../shared/nm-glib-aux/nm-shared-utils.c:4842
 msgid "interface name is too short"
 msgstr "назва інтерфейсу є надто короткою"
 
-#: ../shared/nm-glib-aux/nm-shared-utils.c:4681
+#: ../shared/nm-glib-aux/nm-shared-utils.c:4851
 msgid "interface name is reserved"
 msgstr "таку назву інтерфейсу зарезервовано"
 
-#: ../shared/nm-glib-aux/nm-shared-utils.c:4693
+#: ../shared/nm-glib-aux/nm-shared-utils.c:4863
 msgid "interface name contains an invalid character"
 msgstr "назва інтерфейсу містить некоректний символ"
 
-#: ../shared/nm-glib-aux/nm-shared-utils.c:4699
+#: ../shared/nm-glib-aux/nm-shared-utils.c:4869
 msgid "interface name is longer than 15 characters"
 msgstr "назва інтерфейсу є довшою за 15 символів"
 
-#: ../shared/nm-glib-aux/nm-shared-utils.c:4722
+#: ../shared/nm-glib-aux/nm-shared-utils.c:4892
 #, c-format
 msgid "'%%' is not allowed in interface names"
 msgstr "«%%» не можна використовувати у назвах інтерфейсів"
 
-#: ../shared/nm-glib-aux/nm-shared-utils.c:4735
+#: ../shared/nm-glib-aux/nm-shared-utils.c:4905
 #, c-format
 msgid "'%s' is not allowed as interface name"
 msgstr "«%s» не можна використовувати як назву інтерфейсу"
 
-#: ../shared/nm-glib-aux/nm-shared-utils.c:4756
+#: ../shared/nm-glib-aux/nm-shared-utils.c:4926
 msgid ""
 "interface name must be alphanumerical with no forward or backward slashes"
 msgstr ""
 "назва інтерфейсу має складатися з літер і цифр без початкового і "
 "завершального символів похилої риски"
 
-#: ../shared/nm-glib-aux/nm-shared-utils.c:4773
+#: ../shared/nm-glib-aux/nm-shared-utils.c:4943
 msgid "interface name must not be empty"
 msgstr "назва інтерфейсу не може бути порожньою"
 
-#: ../shared/nm-glib-aux/nm-shared-utils.c:4779
+#: ../shared/nm-glib-aux/nm-shared-utils.c:4949
 msgid "interface name must be UTF-8 encoded"
 msgstr "назва інтерфейсу має бути набором символів у кодуванні UTF-8"
 
@@ -14772,12 +14986,12 @@ msgid "DUN connection must include a GSM or CDMA setting"
 msgstr "З'єднання DUN має включати параметр GSM або CDMA"
 
 #: ../src/devices/bluetooth/nm-device-bt.c:352
-#: ../src/devices/wwan/nm-modem-broadband.c:784
+#: ../src/devices/wwan/nm-modem-broadband.c:797
 msgid "GSM connection"
 msgstr "З'єднання GSM"
 
 #: ../src/devices/bluetooth/nm-device-bt.c:354
-#: ../src/devices/wwan/nm-modem-broadband.c:809
+#: ../src/devices/wwan/nm-modem-broadband.c:822
 msgid "CDMA connection"
 msgstr "З'єднання CDMA"
 
diff --git a/shared/c-siphash/src/c-siphash.c b/shared/c-siphash/src/c-siphash.c
index fae3abadd7..720e403a43 100644
--- a/shared/c-siphash/src/c-siphash.c
+++ b/shared/c-siphash/src/c-siphash.c
@@ -227,7 +227,7 @@ _c_public_ uint64_t c_siphash_finalize(CSipHash *state) {
  *
  *         CSipHash state;
  *         c_siphash_init(&state, seed);
- *         c_siphash_apend(&state, bytes, n_bytes);
+ *         c_siphash_append(&state, bytes, n_bytes);
  *         return c_siphash_finalize(&state);
  *
  * Unlike the streaming API, this is a one-shot call suitable for any data that
diff --git a/shared/c-stdaux/src/test-basic.c b/shared/c-stdaux/src/test-basic.c
index 291a8e199b..9549a14303 100644
--- a/shared/c-stdaux/src/test-basic.c
+++ b/shared/c-stdaux/src/test-basic.c
@@ -203,7 +203,7 @@ static void test_misc(int non_constant_expr) {
         /*
          * Div Round Up: Normal division, but round up to next integer, instead
          * of clipping. Also verify that it does not suffer from the integer
-         * overflow in the prevalant, alternative implementation:
+         * overflow in the prevalent, alternative implementation:
          *      [(x + y - 1) / y].
          */
         {
diff --git a/shared/meson.build b/shared/meson.build
index 48880ec4f6..0f46a00cbb 100644
--- a/shared/meson.build
+++ b/shared/meson.build
@@ -113,15 +113,17 @@ nm_test_utils_impl_source = files('nm-test-utils-impl.c')
 
 nm_vpn_plugin_utils_source = files('nm-utils/nm-vpn-plugin-utils.c')
 
-c_flags = [
-  '-DG_LOG_DOMAIN="@0@"'.format(libnm_name),
-  '-DNETWORKMANAGER_COMPILATION=0',
-]
-
 libnm_std_aux = static_library(
   'nm-std-aux',
-  sources: 'nm-std-aux/c-list-util.c',
-  c_args: c_flags,
+  sources: [
+    'nm-std-aux/c-list-util.c',
+    'nm-std-aux/nm-std-utils.c',
+  ],
+  include_directories: top_inc,
+  c_args: [
+    '-DG_LOG_DOMAIN="@0@"'.format(libnm_name),
+    '-DNETWORKMANAGER_COMPILATION=0',
+  ],
 )
 
 sources = files(
diff --git a/shared/n-acd/src/n-acd-probe.c b/shared/n-acd/src/n-acd-probe.c
index 43dd344c38..2a5c645192 100644
--- a/shared/n-acd/src/n-acd-probe.c
+++ b/shared/n-acd/src/n-acd-probe.c
@@ -682,7 +682,7 @@ _c_public_ void n_acd_probe_get_userdata(NAcdProbe *probe, void **userdatap) {
 /**
  * n_acd_probe_announce() - announce the configured IP address
  * @probe:                      probe to operate on
- * @defend:                     defence policy
+ * @defend:                     defense policy
  *
  * Announce the IP address on the local link, and start defending it according
  * to the given policy, which mut be one of N_ACD_DEFEND_ONCE,
@@ -691,7 +691,7 @@ _c_public_ void n_acd_probe_get_userdata(NAcdProbe *probe, void **userdatap) {
  * This must be called in response to an N_ACD_EVENT_READY event, and only
  * after the given address has been configured on the given network interface.
  *
- * Return: 0 on success, N_ACD_E_INVALID_ARGUMENT in case the defence policy
+ * Return: 0 on success, N_ACD_E_INVALID_ARGUMENT in case the defense policy
  *         is invalid, negative error code on failure.
  */
 _c_public_ int n_acd_probe_announce(NAcdProbe *probe, unsigned int defend) {
diff --git a/shared/n-acd/src/n-acd.c b/shared/n-acd/src/n-acd.c
index af3328c141..c1d9286503 100644
--- a/shared/n-acd/src/n-acd.c
+++ b/shared/n-acd/src/n-acd.c
@@ -578,11 +578,11 @@ static int n_acd_handle_timeout(NAcd *acd) {
         int r;
 
         /*
-         * Read the current time once, and handle all timouts that triggered
+         * Read the current time once, and handle all timeouts that triggered
          * before the current time. Rereading the current time in each loop
          * might risk creating a live-lock, and the fact that we read the
          * time after reading the timer guarantees that the timeout which
-         * woke us up is hanlded.
+         * woke us up is handled.
          *
          * When there are no more timeouts to handle at the given time, we
          * rearm the timer to potentially wake us up again in the future.
diff --git a/shared/n-acd/src/test.h b/shared/n-acd/src/test.h
index 4c6ffebb6a..69a786a013 100644
--- a/shared/n-acd/src/test.h
+++ b/shared/n-acd/src/test.h
@@ -191,7 +191,7 @@ static inline void test_setup(void) {
         /*
          * Move into a new network and mount namespace both associated
          * with a new user namespace where the current eUID is mapped to
-         * 0. Then create a a private instance of /run/netns. This ensures
+         * 0. Then create a private instance of /run/netns. This ensures
          * that any network devices or network namespaces are private to
          * the test process.
          */
diff --git a/shared/n-acd/src/util/timer.c b/shared/n-acd/src/util/timer.c
index 3c9570a1e8..af2a887cea 100644
--- a/shared/n-acd/src/util/timer.c
+++ b/shared/n-acd/src/util/timer.c
@@ -55,7 +55,7 @@ void timer_rearm(Timer *timer) {
         int r;
 
         /*
-         * A timeout value of 0 clears the timer, we sholud only set that if
+         * A timeout value of 0 clears the timer, we should only set that if
          * no timeout exists in the tree.
          */
 
diff --git a/shared/n-dhcp4/src/n-dhcp4-c-connection.c b/shared/n-dhcp4/src/n-dhcp4-c-connection.c
index 8c32a984dd..6becfb5087 100644
--- a/shared/n-dhcp4/src/n-dhcp4-c-connection.c
+++ b/shared/n-dhcp4/src/n-dhcp4-c-connection.c
@@ -1236,7 +1236,7 @@ int n_dhcp4_c_connection_dispatch_io(NDhcp4CConnection *connection,
                 /*
                  * Remember the start time of the transaction, and the base
                  * time of any relative timestamps from the pending request.
-                 * Thes same times applies to the response, and sholud be
+                 * The same time applies to the response, and should be
                  * copied over.
                  */
                 message->userdata.start_time = connection->request->userdata.start_time;
diff --git a/shared/n-dhcp4/src/n-dhcp4-c-lease.c b/shared/n-dhcp4/src/n-dhcp4-c-lease.c
index 695a112ab7..6d9b4f3340 100644
--- a/shared/n-dhcp4/src/n-dhcp4-c-lease.c
+++ b/shared/n-dhcp4/src/n-dhcp4-c-lease.c
@@ -2,7 +2,7 @@
  * DHCP4 Client Leases
  *
  * This implements the public API wrapping DHCP4 client leases. A lease object
- * conists of the information given to us from the server, together with the
+ * consists of the information given to us from the server, together with the
  * timestamp recording the start of the validity of the lease.
  *
  * A probe may yield many OFFERS, each of which contains a lease object. One of
@@ -98,7 +98,7 @@ static int n_dhcp4_incoming_get_timeouts(NDhcp4Incoming *message, uint64_t *t1p,
 
 /**
  * n_dhcp4_client_lease_new() - allocate new client lease object
- * @leasep:                     output argumnet for new client lease object
+ * @leasep:                     output argument for new client lease object
  * @message:                    incoming message representing the lease
  *
  * This creates a new client lease object. Client lease objects are simple
@@ -194,7 +194,7 @@ void n_dhcp4_client_lease_unlink(NDhcp4ClientLease *lease) {
  * @lease:                      the lease to operate on
  * @yiaddr:                     return argument for the IP address
  *
- * Gets the IP address cotained in the lease. Or INADDR_ANY if the lease
+ * Gets the IP address contained in the lease. Or INADDR_ANY if the lease
  * does not contain an IP address.
  */
 _c_public_ void n_dhcp4_client_lease_get_yiaddr(NDhcp4ClientLease *lease, struct in_addr *yiaddr) {
@@ -208,7 +208,7 @@ _c_public_ void n_dhcp4_client_lease_get_yiaddr(NDhcp4ClientLease *lease, struct
  * @lease:                      the lease to operate on
  * @siaddr:                     return argument for the IP address
  *
- * Gets the server IP address cotained in the lease. Or INADDR_ANY if the
+ * Gets the server IP address contained in the lease. Or INADDR_ANY if the
  * lease does not contain an IP address.
  */
 _c_public_ void n_dhcp4_client_lease_get_siaddr(NDhcp4ClientLease *lease, struct in_addr *siaddr) {
diff --git a/shared/n-dhcp4/src/n-dhcp4-c-probe.c b/shared/n-dhcp4/src/n-dhcp4-c-probe.c
index f3d4f265c6..7f20ac0527 100644
--- a/shared/n-dhcp4/src/n-dhcp4-c-probe.c
+++ b/shared/n-dhcp4/src/n-dhcp4-c-probe.c
@@ -221,7 +221,7 @@ _c_public_ void n_dhcp4_client_probe_config_set_requested_ip(NDhcp4ClientProbeCo
  * delay is specified to be a random value in the range 1000 to 10.000 ms.
  * However, there does not appear to be any particular reason to
  * unconditionally wait at least one second, so we move the range down to
- * start at 0 ms. The reaon for the random delay is to avoid network-wide
+ * start at 0 ms. The reason for the random delay is to avoid network-wide
  * events causing too much simultaneous network traffic. However, on modern
  * networks, a more reasonable value may be in the 10 ms range.
  */
@@ -236,7 +236,7 @@ _c_public_ void n_dhcp4_client_probe_config_set_start_delay(NDhcp4ClientProbeCon
  *
  * This adds an option to the list of options to request from the server.
  *
- * A server may send options that we do not requst, and it may omit options
+ * A server may send options that we do not request, and it may omit options
  * that we do request. However, to increase the likelyhood of uniform behavior
  * between server implementations, we do not expose options that were not
  * explicitly requested.
@@ -316,10 +316,9 @@ static void n_dhcp4_client_probe_config_initialize_random_seed(NDhcp4ClientProbe
         unsigned short int seed16v[3];
         const uint8_t *p;
         uint64_t u64;
-        int r;
 
         /*
-         * Initialize seed48_r(3)
+         * Initialize config's entropy buffer for successive jrand48(3) calls.
          *
          * We need random jitter for all timeouts and delays, used to reduce
          * network traffic during bursts. This is not meant as security measure
@@ -360,8 +359,7 @@ static void n_dhcp4_client_probe_config_initialize_random_seed(NDhcp4ClientProbe
         seed16v[1] = (u64 >> 16) ^ (u64 >>  0);
         seed16v[2] = (u64 >> 32) ^ (u64 >> 16);
 
-        r = seed48_r(seed16v, &config->entropy);
-        c_assert(!r);
+        memcpy(config->entropy, seed16v, sizeof(seed16v));
 }
 
 /**
@@ -374,13 +372,7 @@ static void n_dhcp4_client_probe_config_initialize_random_seed(NDhcp4ClientProbe
  * Return: the random data.
  */
 uint32_t n_dhcp4_client_probe_config_get_random(NDhcp4ClientProbeConfig *config) {
-        long int result;
-        int r;
-
-        r = mrand48_r(&config->entropy, &result);
-        c_assert(!r);
-
-        return result;
+        return jrand48(config->entropy);
 };
 
 /**
diff --git a/shared/n-dhcp4/src/n-dhcp4-client.c b/shared/n-dhcp4/src/n-dhcp4-client.c
index 403a693247..1dedbf30c8 100644
--- a/shared/n-dhcp4/src/n-dhcp4-client.c
+++ b/shared/n-dhcp4/src/n-dhcp4-client.c
@@ -146,14 +146,14 @@ _c_public_ void n_dhcp4_client_config_set_transport(NDhcp4ClientConfig *config,
  *
  * Background: OFFER and ACK messages from DHCP servers to clients are unicast
  *             to the IP address handed out, even before the IP address has
- *             been configured on the taregt interface. This usually works
+ *             been configured on the target interface. This usually works
  *             because the correct destination hardware address is explicitly
  *             set on the outgoing packets, rather than being resolved (which
  *             would not work). However, some hardware does not accept incoming
  *             IP packets destined for addresses they do not own, even if the
  *             hardware address is correct. In this case, the server must
  *             broadcast the replies in order for the client to receive them.
- *             In general, unneccesary broadcasting is something one wants to
+ *             In general, unnecessary broadcasting is something one wants to
  *             avoid, and some networks will not deliver broadcasts to the
  *             client at all, in which case this flag must not be set.
  */
@@ -549,7 +549,7 @@ void n_dhcp4_log_queue_fmt(NDhcp4LogQueue *log_queue,
         if (level > log_queue->log_level)
                 return;
 
-        /* Currently the logging queue is only implemented for
+        /* Currently, the logging queue is only implemented for
          * the client. Nobody would enable logging except a
          * client instance. */
         c_assert(log_queue->is_client);
@@ -953,7 +953,7 @@ _c_public_ int n_dhcp4_client_update_mtu(NDhcp4Client *client, uint16_t mtu) {
  * This creates a new probe on @client. Probes represent DHCP requests and
  * track the state over the entire lifetime of a lease. Once a probe is created
  * it will start looking for DHCP servers, request a lease from them, and renew
- * the lease continously whenever it expires. Furthermore, if a lease cannot be
+ * the lease continuously whenever it expires. Furthermore, if a lease cannot be
  * renewed, a new lease will be requested.
  *
  * The API allows for many probes to be run at the same time. However, the DHCP
diff --git a/shared/n-dhcp4/src/n-dhcp4-private.h b/shared/n-dhcp4/src/n-dhcp4-private.h
index 90f8f0c355..db7b24ff7d 100644
--- a/shared/n-dhcp4/src/n-dhcp4-private.h
+++ b/shared/n-dhcp4/src/n-dhcp4-private.h
@@ -263,7 +263,7 @@ struct NDhcp4ClientProbeConfig {
         bool inform_only;
         bool init_reboot;
         struct in_addr requested_ip;
-        struct drand48_data entropy;    /* entropy pool */
+        unsigned short int entropy[3];
         uint64_t ms_start_delay;        /* max ms to wait before starting probe */
         NDhcp4ClientProbeOption *options[UINT8_MAX + 1];
         int8_t request_parameters[UINT8_MAX + 1];
diff --git a/shared/n-dhcp4/src/n-dhcp4-s-connection.c b/shared/n-dhcp4/src/n-dhcp4-s-connection.c
index 71ae0be826..474a7b63c8 100644
--- a/shared/n-dhcp4/src/n-dhcp4-s-connection.c
+++ b/shared/n-dhcp4/src/n-dhcp4-s-connection.c
@@ -375,7 +375,7 @@ int n_dhcp4_s_connection_nak_new(NDhcp4SConnection *connection,
 
         /*
          * The RFC is a bit unclear on how NAK should be sent, on the
-         * one hand it says that they should be unconditinoally broadcast
+         * one hand it says that they should be unconditionally broadcast
          * (unless going through a relay agent), on the other, when they
          * do go through a relay agent, they will not be. We treat them
          * as any other reply and only broadcast when the broadcast bit
diff --git a/shared/n-dhcp4/src/n-dhcp4-socket.c b/shared/n-dhcp4/src/n-dhcp4-socket.c
index c7e897726e..4a83dd1528 100644
--- a/shared/n-dhcp4/src/n-dhcp4-socket.c
+++ b/shared/n-dhcp4/src/n-dhcp4-socket.c
@@ -22,7 +22,7 @@
 
 /**
  * n_dhcp4_c_socket_packet_new() - create a new DHCP4 client packet socket
- * @sockfdp:            return argumnet for the new socket
+ * @sockfdp:            return argument for the new socket
  * @ifindex:            interface index to bind to
  *
  * Create a new AF_PACKET/SOCK_DGRAM socket usable to listen to and send DHCP client
@@ -129,7 +129,7 @@ int n_dhcp4_c_socket_packet_new(int *sockfdp, int ifindex) {
 
 /**
  * n_dhcp4_c_socket_udp_new() - create a new DHCP4 client UDP socket
- * @sockfdp:            return argumnet for the new socket
+ * @sockfdp:            return argument for the new socket
  * @ifindex:            interface index to bind to
  * @client_addr:        client address to bind to
  * @server_addr:        server address to connect to
@@ -230,7 +230,7 @@ int n_dhcp4_c_socket_udp_new(int *sockfdp,
 
 /**
  * n_dhcp4_s_socket_packet_new() - create a new DHCP4 server packet socket
- * @sockfdp:            return argumnet for the new socket
+ * @sockfdp:            return argument for the new socket
  *
  * Create a new AF_PACKET/SOCK_DGRAM socket usable to send DHCP packets to clients
  * before they have an IP address configured, on the given interface.
@@ -251,7 +251,7 @@ int n_dhcp4_s_socket_packet_new(int *sockfdp) {
 
 /**
  * n_dhcp4_s_socket_udp_new() - create a new DHCP4 server UDP socket
- * @sockfdp:            return argumnet for the new socket
+ * @sockfdp:            return argument for the new socket
  * @ifindex:            intercafe index to bind to
  *
  * Create a new AF_INET/SOCK_DGRAM socket usable to listen to DHCP server packets,
diff --git a/shared/n-dhcp4/src/test-run-client.c b/shared/n-dhcp4/src/test-run-client.c
index d29dbf1f2a..e558801470 100644
--- a/shared/n-dhcp4/src/test-run-client.c
+++ b/shared/n-dhcp4/src/test-run-client.c
@@ -440,7 +440,7 @@ static void print_help(void) {
                "     --ifindex IDX                     Index of interface to run on\n"
                "     --mac HEX                         Hardware address to use\n"
                "     --broadcast-mac HEX               Broadcast hardware address to use\n"
-               "     --requested-ip IP                 Requested IP adress\n"
+               "     --requested-ip IP                 Requested IP address\n"
                "     --requested-lifetime SECS         Requested lease lifetime in seconds\n"
                "     --requested-parameters P1,P2,...  Requested parameters\n"
                "     --client-id HEX                   Client Identifier to use\n"
diff --git a/shared/n-dhcp4/src/test.h b/shared/n-dhcp4/src/test.h
index 6933982e8c..b5acd14b37 100644
--- a/shared/n-dhcp4/src/test.h
+++ b/shared/n-dhcp4/src/test.h
@@ -85,7 +85,7 @@ static inline void test_setup(void) {
         /*
          * Move into a new network and mount namespace both associated
          * with a new user namespace where the current eUID is mapped to
-         * 0. Then create a a private instance of /run/netns. This ensures
+         * 0. Then create a private instance of /run/netns. This ensures
          * that any network devices or network namespaces are private to
          * the test process.
          */
diff --git a/shared/n-dhcp4/src/util/packet.c b/shared/n-dhcp4/src/util/packet.c
index 38cb399d5c..fb0313abe7 100644
--- a/shared/n-dhcp4/src/util/packet.c
+++ b/shared/n-dhcp4/src/util/packet.c
@@ -244,7 +244,7 @@ int packet_sendto_udp(int sockfd,
  * @buf:                buffor for payload
  * @n_buf:              max length of payload in bytes
  * @n_transmittedp:     output argument for number transmitted bytes
- * @src:                return argumnet for source address, or NULL, see ip(7)
+ * @src:                return argument for source address, or NULL, see ip(7)
  *
  * Receives an UDP packet on a AF_PACKET socket. The difference between
  * this and recvfrom() on an AF_INET socket is that the packet will be
diff --git a/shared/nm-default.h b/shared/nm-default.h
index ace6ede16c..447b4dbf73 100644
--- a/shared/nm-default.h
+++ b/shared/nm-default.h
@@ -261,6 +261,8 @@ _nm_g_return_if_fail_warning (const char *log_domain,
 
 /*****************************************************************************/
 
+#include "nm-std-aux/nm-std-aux.h"
+#include "nm-std-aux/nm-std-utils.h"
 #include "nm-glib-aux/nm-macros-internal.h"
 #include "nm-glib-aux/nm-shared-utils.h"
 #include "nm-glib-aux/nm-errno.h"
diff --git a/shared/nm-glib-aux/nm-errno.c b/shared/nm-glib-aux/nm-errno.c
index e709f9e693..135e49cf80 100644
--- a/shared/nm-glib-aux/nm-errno.c
+++ b/shared/nm-glib-aux/nm-errno.c
@@ -58,7 +58,7 @@ NM_UTILS_LOOKUP_STR_DEFINE (_geterror,
  * our own defines. For numbers that don't fall into this range, the numbers
  * are identical to the common error numbers.
  *
- * Idential to strerror(), g_strerror(), nm_strerror_native() for error numbers
+ * Identical to strerror(), g_strerror(), nm_strerror_native() for error numbers
  * that are not in the reserved range of NetworkManager specific errors.
  *
  * Returns: (transfer none): the string representation of the error number.
@@ -97,7 +97,7 @@ nm_strerror (int nmerr)
  * string may be longer than @buf_size.
  *
  * Returns: (transfer none): a NUL terminated error message. This is either a static
- *   string (that is never freed), or the provided @buf argumnt.
+ *   string (that is never freed), or the provided @buf argument.
  */
 const char *
 nm_strerror_native_r (int errsv, char *buf, gsize buf_size)
diff --git a/shared/nm-glib-aux/nm-hash-utils.h b/shared/nm-glib-aux/nm-hash-utils.h
index be69bfa8dc..d1ab8dbc83 100644
--- a/shared/nm-glib-aux/nm-hash-utils.h
+++ b/shared/nm-glib-aux/nm-hash-utils.h
@@ -99,7 +99,7 @@ nm_hash_update (NMHashState *state, const void *ptr, gsize n)
 	nm_assert (n == 0 || ptr);
 
 	/* Note: the data passed in here might be sensitive data (secrets),
-	 * that we should nm_explicty_zero() afterwards. However, since
+	 * that we should nm_explicit_bzero() afterwards. However, since
 	 * we are using siphash24 with a random key, that is not really
 	 * necessary. Something to keep in mind, if we ever move away from
 	 * this hash implementation. */
diff --git a/shared/nm-glib-aux/nm-io-utils.c b/shared/nm-glib-aux/nm-io-utils.c
index 776c63e111..81c6ad3510 100644
--- a/shared/nm-glib-aux/nm-io-utils.c
+++ b/shared/nm-glib-aux/nm-io-utils.c
@@ -357,7 +357,7 @@ nm_utils_file_set_contents (const char *filename,
 
 	/* If the final destination exists and is > 0 bytes, we want to sync the
 	 * newly written file to ensure the data is on disk when we rename over
-	 * the destination. Otherwise if we get a system crash we can lose both
+	 * the destination. Otherwise, if we get a system crash we can lose both
 	 * the new and the old file on some filesystems. (I.E. those that don't
 	 * guarantee the data is written to the disk before the metadata.)
 	 */
diff --git a/shared/nm-glib-aux/nm-io-utils.h b/shared/nm-glib-aux/nm-io-utils.h
index 31326fc79a..aa0b8f9b48 100644
--- a/shared/nm-glib-aux/nm-io-utils.h
+++ b/shared/nm-glib-aux/nm-io-utils.h
@@ -14,7 +14,7 @@
  * NMUtilsFileGetContentsFlags:
  * @NM_UTILS_FILE_GET_CONTENTS_FLAG_NONE: no flag
  * @NM_UTILS_FILE_GET_CONTENTS_FLAG_SECRET: if present, ensure that no
- *   data is left in memory. Essentially, it means to call explicity_bzero()
+ *   data is left in memory. Essentially, it means to call nm_explicit_bzero()
  *   to not leave key material on the heap (when reading secrets).
  */
 typedef enum {
diff --git a/shared/nm-glib-aux/nm-jansson.h b/shared/nm-glib-aux/nm-jansson.h
index 7c034222c4..9314b50c69 100644
--- a/shared/nm-glib-aux/nm-jansson.h
+++ b/shared/nm-glib-aux/nm-jansson.h
@@ -12,11 +12,6 @@
 
 #include <jansson.h>
 
-/* Added in Jansson v2.7 */
-#ifndef json_boolean_value
-#define json_boolean_value json_is_true
-#endif
-
 /* Added in Jansson v2.8 */
 #ifndef json_object_foreach_safe
 #define json_object_foreach_safe(object, n, key, value)     \
@@ -30,106 +25,6 @@
 NM_AUTO_DEFINE_FCN0 (json_t *, _nm_auto_decref_json, json_decref)
 #define nm_auto_decref_json nm_auto(_nm_auto_decref_json)
 
-/*****************************************************************************/
-
-static inline int
-nm_jansson_json_as_bool (const json_t *elem,
-                         bool *out_val)
-{
-	if (!elem)
-		return 0;
-
-	if (!json_is_boolean (elem))
-		return -EINVAL;
-
-	NM_SET_OUT (out_val, json_boolean_value (elem));
-	return 1;
-}
-
-static inline int
-nm_jansson_json_as_int32 (const json_t *elem,
-                          gint32 *out_val)
-{
-	json_int_t v;
-
-	if (!elem)
-		return 0;
-
-	if (!json_is_integer (elem))
-		return -EINVAL;
-
-	v = json_integer_value (elem);
-	if (   v < (gint64) G_MININT32
-	    || v > (gint64) G_MAXINT32)
-		return -ERANGE;
-
-	NM_SET_OUT (out_val, v);
-	return 1;
-}
-
-static inline int
-nm_jansson_json_as_int (const json_t *elem,
-                        int *out_val)
-{
-	json_int_t v;
-
-	if (!elem)
-		return 0;
-
-	if (!json_is_integer (elem))
-		return -EINVAL;
-
-	v = json_integer_value (elem);
-	if (   v < (gint64) G_MININT
-	    || v > (gint64) G_MAXINT)
-		return -ERANGE;
-
-	NM_SET_OUT (out_val, v);
-	return 1;
-}
-
-static inline int
-nm_jansson_json_as_string (const json_t *elem,
-                           const char **out_val)
-{
-	if (!elem)
-		return 0;
-
-	if (!json_is_string (elem))
-		return -EINVAL;
-
-	NM_SET_OUT (out_val, json_string_value (elem));
-	return 1;
-}
-
-/*****************************************************************************/
-
-#ifdef NM_VALUE_TYPE_DEFINE_FUNCTIONS
-#include "nm-value-type.h"
-static inline gboolean
-nm_value_type_from_json (NMValueType value_type,
-                         const json_t *elem,
-                         gpointer out_val)
-{
-	switch (value_type) {
-	case NM_VALUE_TYPE_BOOL:   return (nm_jansson_json_as_bool   (elem, out_val) > 0);
-	case NM_VALUE_TYPE_INT32:  return (nm_jansson_json_as_int32  (elem, out_val) > 0);
-	case NM_VALUE_TYPE_INT:    return (nm_jansson_json_as_int    (elem, out_val) > 0);
-
-	/* warning: this overwrites/leaks the previous value. You better have *out_val
-	 * point to uninitialized memory or NULL. */
-	case NM_VALUE_TYPE_STRING: return (nm_jansson_json_as_string (elem, out_val) > 0);
-
-	case NM_VALUE_TYPE_UNSPEC:
-		break;
-	}
-	nm_assert_not_reached ();
-	return FALSE;
-}
-#endif
-
-/*****************************************************************************/
-
 #endif /* WITH_JANSON */
 
 #endif  /* __NM_JANSSON_H__ */
diff --git a/shared/nm-glib-aux/nm-json-aux.c b/shared/nm-glib-aux/nm-json-aux.c
index a738ab7257..e9816d7781 100644
--- a/shared/nm-glib-aux/nm-json-aux.c
+++ b/shared/nm-glib-aux/nm-json-aux.c
@@ -1,12 +1,14 @@
 // SPDX-License-Identifier: LGPL-2.1+
 /*
- * Copyright (C) 2019 Red Hat, Inc.
+ * Copyright (C) 2017 - 2019 Red Hat, Inc.
  */
 
 #include "nm-default.h"
 
 #include "nm-json-aux.h"
 
+#include <dlfcn.h>
+
 /*****************************************************************************/
 
 static void
@@ -78,7 +80,7 @@ _gstr_append_string_len (GString *gstr,
 			 * JSON can only contain UTF-8 and even the escape sequences can only escape Unicode
 			 * codepoints (but not binary).
 			 *
-			 * The argument is not a a string (in any known encoding), hence we cannot represent
+			 * The argument is not a string (in any known encoding), hence we cannot represent
 			 * it as a JSON string (which are unicode strings).
 			 *
 			 * Print an underscore instead of the invalid char :) */
@@ -96,9 +98,9 @@ _gstr_append_string_len (GString *gstr,
 }
 
 void
-nm_json_aux_gstr_append_string_len (GString *gstr,
-                                    const char *str,
-                                    gsize n)
+nm_json_gstr_append_string_len (GString *gstr,
+                                const char *str,
+                                gsize n)
 {
 	g_return_if_fail (gstr);
 
@@ -106,8 +108,8 @@ nm_json_aux_gstr_append_string_len (GString *gstr,
 }
 
 void
-nm_json_aux_gstr_append_string (GString *gstr,
-                                const char *str)
+nm_json_gstr_append_string (GString *gstr,
+                            const char *str)
 {
 	g_return_if_fail (gstr);
 
@@ -118,14 +120,14 @@ nm_json_aux_gstr_append_string (GString *gstr,
 }
 
 void
-nm_json_aux_gstr_append_obj_name (GString *gstr,
-                                  const char *key,
-                                  char start_container)
+nm_json_gstr_append_obj_name (GString *gstr,
+                              const char *key,
+                              char start_container)
 {
 	g_return_if_fail (gstr);
 	g_return_if_fail (key);
 
-	nm_json_aux_gstr_append_string (gstr, key);
+	nm_json_gstr_append_string (gstr, key);
 
 	if (start_container != '\0') {
 		nm_assert (NM_IN_SET (start_container, '[', '{'));
@@ -133,3 +135,136 @@ nm_json_aux_gstr_append_obj_name (GString *gstr,
 	} else
 		g_string_append (gstr, ": ");
 }
+
+/*****************************************************************************/
+
+typedef struct {
+	NMJsonVt vt;
+	void *dl_handle;
+} NMJsonVtInternal;
+
+static NMJsonVtInternal *
+_nm_json_vt_internal_load (void)
+{
+	NMJsonVtInternal *v;
+	const char *soname;
+	void *handle;
+
+	v = g_new0 (NMJsonVtInternal, 1);
+
+#if WITH_JANSSON && defined (JANSSON_SONAME)
+	G_STATIC_ASSERT_EXPR (NM_STRLEN (JANSSON_SONAME) > 0);
+	nm_assert (strlen (JANSSON_SONAME) > 0);
+	soname = JANSSON_SONAME;
+#elif !WITH_JANSSON && !defined (JANSSON_SONAME)
+	soname = NULL;
+#else
+#error "WITH_JANSON and JANSSON_SONAME are defined inconsistently."
+#endif
+
+	if (!soname)
+		return v;
+
+	handle = dlopen (soname,   RTLD_LAZY
+	                         | RTLD_LOCAL
+	                         | RTLD_NODELETE
+#if !defined (ASAN_BUILD)
+	                         | RTLD_DEEPBIND
+#endif
+	                         | 0);
+	if (!handle)
+		return v;
+
+#define TRY_BIND_SYMBOL(symbol) \
+	G_STMT_START { \
+		void *_sym = dlsym (handle, #symbol); \
+		\
+		if (!_sym) \
+			goto fail_symbol; \
+		v->vt.nm_ ## symbol = _sym; \
+	} G_STMT_END
+
+	TRY_BIND_SYMBOL (json_array);
+	TRY_BIND_SYMBOL (json_array_append_new);
+	TRY_BIND_SYMBOL (json_array_get);
+	TRY_BIND_SYMBOL (json_array_size);
+	TRY_BIND_SYMBOL (json_delete);
+	TRY_BIND_SYMBOL (json_dumps);
+	TRY_BIND_SYMBOL (json_false);
+	TRY_BIND_SYMBOL (json_integer);
+	TRY_BIND_SYMBOL (json_integer_value);
+	TRY_BIND_SYMBOL (json_loads);
+	TRY_BIND_SYMBOL (json_object);
+	TRY_BIND_SYMBOL (json_object_del);
+	TRY_BIND_SYMBOL (json_object_get);
+	TRY_BIND_SYMBOL (json_object_iter);
+	TRY_BIND_SYMBOL (json_object_iter_key);
+	TRY_BIND_SYMBOL (json_object_iter_next);
+	TRY_BIND_SYMBOL (json_object_iter_value);
+	TRY_BIND_SYMBOL (json_object_key_to_iter);
+	TRY_BIND_SYMBOL (json_object_set_new);
+	TRY_BIND_SYMBOL (json_object_size);
+	TRY_BIND_SYMBOL (json_string);
+	TRY_BIND_SYMBOL (json_string_value);
+	TRY_BIND_SYMBOL (json_true);
+
+	v->vt.loaded = TRUE;
+	v->dl_handle = handle;
+	return v;
+
+fail_symbol:
+	dlclose (&handle);
+	*v = (NMJsonVtInternal) { };
+	return v;
+}
+
+const NMJsonVt *_nm_json_vt_ptr = NULL;
+
+const NMJsonVt *
+_nm_json_vt_init (void)
+{
+	NMJsonVtInternal *v;
+
+again:
+	v = g_atomic_pointer_get ((gpointer *) &_nm_json_vt_ptr);
+	if (G_UNLIKELY (!v)) {
+		v = _nm_json_vt_internal_load ();
+		if (!g_atomic_pointer_compare_and_exchange ((gpointer *) &_nm_json_vt_ptr, NULL, v)) {
+			if (v->dl_handle)
+				dlclose (v->dl_handle);
+			g_free (v);
+			goto again;
+		}
+
+		/* we transfer ownership. */
+	}
+
+	nm_assert (v && v == g_atomic_pointer_get ((gpointer *) &_nm_json_vt_ptr));
+	return &v->vt;
+}
+
+const NMJsonVt *
+nmtst_json_vt_reset (gboolean loaded)
+{
+	NMJsonVtInternal *v_old;
+	NMJsonVtInternal *v;
+
+	v_old = g_atomic_pointer_get ((gpointer *) &_nm_json_vt_ptr);
+
+	if (!loaded) {
+		/* load a fake instance for testing. */
+		v = g_new0 (NMJsonVtInternal, 1);
+	} else
+		v = _nm_json_vt_internal_load ();
+
+	if (!g_atomic_pointer_compare_and_exchange ((gpointer *) &_nm_json_vt_ptr, v_old, v))
+		g_assert_not_reached ();
+
+	if (v_old) {
+		if (v_old->dl_handle)
+			dlclose (v_old->dl_handle);
+		g_free ((gpointer *) v_old);
+	}
+
+	return v->vt.loaded ? &v->vt : NULL;
+}
diff --git a/shared/nm-glib-aux/nm-json-aux.h b/shared/nm-glib-aux/nm-json-aux.h
index ed3be3768f..082b9e5205 100644
--- a/shared/nm-glib-aux/nm-json-aux.h
+++ b/shared/nm-glib-aux/nm-json-aux.h
@@ -1,49 +1,281 @@
 // SPDX-License-Identifier: LGPL-2.1+
 /*
- * Copyright (C) 2019 Red Hat, Inc.
+ * Copyright (C) 2017 - 2019 Red Hat, Inc.
  */
 
 #ifndef __NM_JSON_AUX_H__
 #define __NM_JSON_AUX_H__
 
+#include "nm-value-type.h"
+
 /*****************************************************************************/
 
 static inline GString *
-nm_json_aux_gstr_append_delimiter (GString *gstr)
+nm_json_gstr_append_delimiter (GString *gstr)
 {
 	g_string_append (gstr, ", ");
 	return gstr;
 }
 
-void nm_json_aux_gstr_append_string_len (GString *gstr,
-                                         const char *str,
-                                         gsize n);
+void nm_json_gstr_append_string_len (GString *gstr,
+                                     const char *str,
+                                     gsize n);
 
-void nm_json_aux_gstr_append_string (GString *gstr,
-                                     const char *str);
+void nm_json_gstr_append_string (GString *gstr,
+                                 const char *str);
 
 static inline void
-nm_json_aux_gstr_append_bool (GString *gstr,
-                              gboolean v)
+nm_json_gstr_append_bool (GString *gstr,
+                          gboolean v)
 {
 	g_string_append (gstr, v ? "true" : "false");
 }
 
 static inline void
-nm_json_aux_gstr_append_int64 (GString *gstr,
-                               gint64 v)
+nm_json_gstr_append_int64 (GString *gstr,
+                           gint64 v)
 {
 	g_string_append_printf (gstr, "%"G_GINT64_FORMAT, v);
 }
 
-void nm_json_aux_gstr_append_obj_name (GString *gstr,
-                                       const char *key,
-                                       char start_container);
+void nm_json_gstr_append_obj_name (GString *gstr,
+                                   const char *key,
+                                   char start_container);
+
+/*****************************************************************************/
+
+#define NM_JSON_REJECT_DUPLICATES  0x1
+
+typedef enum {
+	NM_JSON_OBJECT,
+	NM_JSON_ARRAY,
+	NM_JSON_STRING,
+	NM_JSON_INTEGER,
+	NM_JSON_REAL,
+	NM_JSON_TRUE,
+	NM_JSON_FALSE,
+	NM_JSON_NULL,
+} nm_json_type;
+
+typedef struct nm_json_t {
+	nm_json_type type;
+	volatile size_t refcount;
+} nm_json_t;
+
+typedef long long nm_json_int_t;
+
+#define NM_JSON_ERROR_TEXT_LENGTH   160
+#define NM_JSON_ERROR_SOURCE_LENGTH 80
+
+typedef struct nm_json_error_t {
+	int line;
+	int column;
+	int position;
+	char source[NM_JSON_ERROR_SOURCE_LENGTH];
+	char text[NM_JSON_ERROR_TEXT_LENGTH];
+} nm_json_error_t;
+
+typedef struct {
+	gboolean loaded;
+	char          *(*nm_json_dumps)              (const nm_json_t *json, size_t flags);
+	const char    *(*nm_json_object_iter_key)    (void *iter);
+	const char    *(*nm_json_string_value)       (const nm_json_t *json);
+	int            (*nm_json_array_append_new)   (nm_json_t *json, nm_json_t *value);
+	int            (*nm_json_object_del)         (nm_json_t *json, const char *key);
+	int            (*nm_json_object_set_new)     (nm_json_t *json, const char *key, nm_json_t *value);
+	nm_json_int_t  (*nm_json_integer_value)      (const nm_json_t *json);
+	nm_json_t     *(*nm_json_array)              (void);
+	nm_json_t     *(*nm_json_array_get)          (const nm_json_t *json, size_t index);
+	nm_json_t     *(*nm_json_false)              (void);
+	nm_json_t     *(*nm_json_integer)            (nm_json_int_t value);
+	nm_json_t     *(*nm_json_loads)              (const char *string, size_t flags, nm_json_error_t *error);
+	nm_json_t     *(*nm_json_object)             (void);
+	nm_json_t     *(*nm_json_object_get)         (const nm_json_t *json, const char *key);
+	nm_json_t     *(*nm_json_object_iter_value)  (void *);
+	nm_json_t     *(*nm_json_string)             (const char *value);
+	nm_json_t     *(*nm_json_true)               (void);
+	size_t         (*nm_json_array_size)         (const nm_json_t *json);
+	size_t         (*nm_json_object_size)        (const nm_json_t *json);
+	void           (*nm_json_delete)             (nm_json_t *json);
+	void          *(*nm_json_object_iter)        (nm_json_t *json);
+	void          *(*nm_json_object_iter_next)   (nm_json_t *json, void *iter);
+	void          *(*nm_json_object_key_to_iter) (const char *key);
+} NMJsonVt;
+
+extern const NMJsonVt *_nm_json_vt_ptr;
+
+const NMJsonVt *_nm_json_vt_init (void);
+
+static inline const NMJsonVt *
+_nm_json_vt (void)
+{
+	const NMJsonVt *vt;
+
+	vt = g_atomic_pointer_get ((gpointer *) &_nm_json_vt_ptr);
+	if (G_UNLIKELY (!vt)) {
+		vt = _nm_json_vt_init ();
+		nm_assert (vt);
+	}
+	return vt;
+}
+
+static inline const NMJsonVt *
+nm_json_vt (void)
+{
+	const NMJsonVt *vt;
+
+	vt = _nm_json_vt();
+	return vt->loaded ? vt : NULL;
+}
+
+static inline const NMJsonVt *
+nm_json_vt_assert (void)
+{
+	const NMJsonVt *vt;
+
+	vt = _nm_json_vt();
+	nm_assert (vt->loaded);
+	return vt;
+}
+
+const NMJsonVt *nmtst_json_vt_reset (gboolean loaded);
+
+/*****************************************************************************/
+
+#define nm_json_boolean(vt, val) \
+	((val) ? (vt)->nm_json_true () : (vt)->nm_json_false ())
+
+static inline void
+nm_json_decref (const NMJsonVt *vt, nm_json_t *json)
+{
+	/* Our ref-counting is not threadsafe, unlike libjansson's. But we never
+	 * share one json_t instance between threads, and if we would, we would very likely
+	 * wrap a mutex around it. */
+	if (   json
+	    && json->refcount != (size_t) -1
+	    && --json->refcount == 0)
+		vt->nm_json_delete (json);
+}
+
+static inline void
+_nm_auto_decref_json (nm_json_t **p_json)
+{
+	if (   *p_json
+	    && (*p_json)->refcount != (size_t) -1
+	    && --(*p_json)->refcount == 0)
+		nm_json_vt ()->nm_json_delete (*p_json);
+}
+
+#define nm_auto_decref_json nm_auto(_nm_auto_decref_json)
+
+/*****************************************************************************/
+
+/* the following are implemented as pure macros in jansson.h.
+ * They can be used directly, however, add a nm_json* variant,
+ * to make it explict we don't accidentally use jansson ABI. */
+
+#define nm_json_typeof(json)      ((json)->type)
+#define nm_json_is_object(json)   ((json) && nm_json_typeof(json) == NM_JSON_OBJECT)
+#define nm_json_is_array(json)    ((json) && nm_json_typeof(json) == NM_JSON_ARRAY)
+#define nm_json_is_string(json)   ((json) && nm_json_typeof(json) == NM_JSON_STRING)
+#define nm_json_is_integer(json)  ((json) && nm_json_typeof(json) == NM_JSON_INTEGER)
+#define nm_json_is_real(json)     ((json) && nm_json_typeof(json) == NM_JSON_REAL)
+#define nm_json_is_number(json)   (nm_json_is_integer(json) || nm_json_is_real(json))
+#define nm_json_is_true(json)     ((json) && nm_json_typeof(json) == NM_JSON_TRUE)
+#define nm_json_is_false(json)    ((json) && nm_json_typeof(json) == NM_JSON_FALSE)
+#define nm_json_boolean_value     nm_json_is_true
+#define nm_json_is_boolean(json)  (nm_json_is_true(json) || nm_json_is_false(json))
+#define nm_json_is_null(json)     ((json) && nm_json_typeof(json) == NM_JSON_NULL)
+
+#define nm_json_array_foreach(vt, array, index, value) \
+    for(index = 0; \
+        index < vt->nm_json_array_size (array) && (value = vt->nm_json_array_get (array, index)); \
+        index++)
+
+#define nm_json_object_foreach(vt, object, key, value) \
+    for(key = vt->nm_json_object_iter_key (vt->nm_json_object_iter (object)); \
+        key && (value = vt->nm_json_object_iter_value (vt->nm_json_object_key_to_iter (key))); \
+        key = vt->nm_json_object_iter_key (vt->nm_json_object_iter_next (object, vt->nm_json_object_key_to_iter (key))))
+
+/*****************************************************************************/
+
+static inline int
+nm_jansson_json_as_bool (const nm_json_t *elem,
+                         bool *out_val)
+{
+	if (!elem)
+		return 0;
+
+	if (!nm_json_is_boolean (elem))
+		return -EINVAL;
+
+	NM_SET_OUT (out_val, nm_json_boolean_value (elem));
+	return 1;
+}
+
+static inline int
+nm_jansson_json_as_int32 (const NMJsonVt *vt,
+                          const nm_json_t *elem,
+                          gint32 *out_val)
+{
+	nm_json_int_t v;
+
+	if (!elem)
+		return 0;
+
+	if (!nm_json_is_integer (elem))
+		return -EINVAL;
+
+	v = vt->nm_json_integer_value (elem);
+	if (   v < (gint64) G_MININT32
+	    || v > (gint64) G_MAXINT32)
+		return -ERANGE;
+
+	NM_SET_OUT (out_val, v);
+	return 1;
+}
+
+static inline int
+nm_jansson_json_as_int (const NMJsonVt *vt,
+                        const nm_json_t *elem,
+                        int *out_val)
+{
+	nm_json_int_t v;
+
+	if (!elem)
+		return 0;
+
+	if (!nm_json_is_integer (elem))
+		return -EINVAL;
+
+	v = vt->nm_json_integer_value (elem);
+	if (   v < (gint64) G_MININT
+	    || v > (gint64) G_MAXINT)
+		return -ERANGE;
+
+	NM_SET_OUT (out_val, v);
+	return 1;
+}
+
+static inline int
+nm_jansson_json_as_string (const NMJsonVt *vt,
+                           const nm_json_t *elem,
+                           const char **out_val)
+{
+	if (!elem)
+		return 0;
+
+	if (!nm_json_is_string (elem))
+		return -EINVAL;
+
+	NM_SET_OUT (out_val, vt->nm_json_string_value (elem));
+	return 1;
+}
 
 /*****************************************************************************/
 
 #ifdef NM_VALUE_TYPE_DEFINE_FUNCTIONS
-#include "nm-value-type.h"
+
 static inline void
 nm_value_type_to_json (NMValueType value_type,
                        GString *gstr,
@@ -53,17 +285,38 @@ nm_value_type_to_json (NMValueType value_type,
 	nm_assert (gstr);
 
 	switch (value_type) {
-	case NM_VALUE_TYPE_BOOL:   nm_json_aux_gstr_append_bool   (gstr, *((const bool        *) p_field)); return;
-	case NM_VALUE_TYPE_INT32:  nm_json_aux_gstr_append_int64  (gstr, *((const gint32      *) p_field)); return;
-	case NM_VALUE_TYPE_INT:    nm_json_aux_gstr_append_int64  (gstr, *((const int         *) p_field)); return;
-	case NM_VALUE_TYPE_STRING: nm_json_aux_gstr_append_string (gstr, *((const char *const *) p_field)); return;
+	case NM_VALUE_TYPE_BOOL:   nm_json_gstr_append_bool   (gstr, *((const bool        *) p_field)); return;
+	case NM_VALUE_TYPE_INT32:  nm_json_gstr_append_int64  (gstr, *((const gint32      *) p_field)); return;
+	case NM_VALUE_TYPE_INT:    nm_json_gstr_append_int64  (gstr, *((const int         *) p_field)); return;
+	case NM_VALUE_TYPE_STRING: nm_json_gstr_append_string (gstr, *((const char *const *) p_field)); return;
 	case NM_VALUE_TYPE_UNSPEC:
 		break;
 	}
 	nm_assert_not_reached ();
 }
-#endif
 
-/*****************************************************************************/
+static inline gboolean
+nm_value_type_from_json (const NMJsonVt *vt,
+                         NMValueType value_type,
+                         const nm_json_t *elem,
+                         gpointer out_val)
+{
+	switch (value_type) {
+	case NM_VALUE_TYPE_BOOL:   return (nm_jansson_json_as_bool   (elem, out_val) > 0);
+	case NM_VALUE_TYPE_INT32:  return (nm_jansson_json_as_int32  (vt, elem, out_val) > 0);
+	case NM_VALUE_TYPE_INT:    return (nm_jansson_json_as_int    (vt, elem, out_val) > 0);
 
-#endif  /* __NM_JSON_AUX_H__ */
+	/* warning: this overwrites/leaks the previous value. You better have *out_val
+	 * point to uninitialized memory or NULL. */
+	case NM_VALUE_TYPE_STRING: return (nm_jansson_json_as_string (vt, elem, out_val) > 0);
+
+	case NM_VALUE_TYPE_UNSPEC:
+		break;
+	}
+	nm_assert_not_reached ();
+	return FALSE;
+}
+
+#endif /* NM_VALUE_TYPE_DEFINE_FUNCTIONS */
+
+#endif /* __NM_JSON_AUX_H__ */
diff --git a/shared/nm-glib-aux/nm-macros-internal.h b/shared/nm-glib-aux/nm-macros-internal.h
index f56ed85699..d12fa3b602 100644
--- a/shared/nm-glib-aux/nm-macros-internal.h
+++ b/shared/nm-glib-aux/nm-macros-internal.h
@@ -16,53 +16,6 @@
 
 /*****************************************************************************/
 
-#define _nm_packed           __attribute__ ((__packed__))
-#define _nm_unused           __attribute__ ((__unused__))
-#define _nm_used             __attribute__ ((__used__))
-#define _nm_pure             __attribute__ ((__pure__))
-#define _nm_const            __attribute__ ((__const__))
-#define _nm_printf(a,b)      __attribute__ ((__format__ (__printf__, a, b)))
-#define _nm_align(s)         __attribute__ ((__aligned__ (s)))
-#define _nm_section(s)       __attribute__ ((__section__ (s)))
-#define _nm_alignof(type)    __alignof (type)
-#define _nm_alignas(type)    _nm_align (_nm_alignof (type))
-#define nm_auto(fcn)         __attribute__ ((__cleanup__(fcn)))
-
-
-/* This is required to make LTO working.
- *
- * See https://gitlab.freedesktop.org/NetworkManager/NetworkManager/merge_requests/76#note_112694
- *     https://gcc.gnu.org/bugzilla/show_bug.cgi?id=48200#c28
- */
-#ifndef __clang__
-#define _nm_externally_visible __attribute__ ((__externally_visible__))
-#else
-#define _nm_externally_visible
-#endif
-
-
-#if __GNUC__ >= 7
-#define _nm_fallthrough      __attribute__ ((__fallthrough__))
-#else
-#define _nm_fallthrough
-#endif
-
-/*****************************************************************************/
-
-#ifdef thread_local
-#define _nm_thread_local thread_local
-/*
- * Don't break on glibc < 2.16 that doesn't define __STDC_NO_THREADS__
- * see http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53769
- */
-#elif __STDC_VERSION__ >= 201112L && !(defined(__STDC_NO_THREADS__) || (defined(__GNU_LIBRARY__) && __GLIBC__ == 2 && __GLIBC_MINOR__ < 16))
-#define _nm_thread_local _Thread_local
-#else
-#define _nm_thread_local __thread
-#endif
-
-/*****************************************************************************/
-
 /* most of our code is single-threaded with a mainloop. Hence, we usually don't need
  * any thread-safety. Sometimes, we do need thread-safety (nm-logging), but we can
  * avoid locking if we are on the main-thread by:
@@ -85,34 +38,6 @@
 
 /*****************************************************************************/
 
-#define NM_AUTO_DEFINE_FCN_VOID(CastType, name, func) \
-static inline void name (void *v) \
-{ \
-	func (*((CastType *) v)); \
-}
-
-#define NM_AUTO_DEFINE_FCN_VOID0(CastType, name, func) \
-static inline void name (void *v) \
-{ \
-	if (*((CastType *) v)) \
-		func (*((CastType *) v)); \
-}
-
-#define NM_AUTO_DEFINE_FCN(Type, name, func) \
-static inline void name (Type *v) \
-{ \
-	func (*v); \
-}
-
-#define NM_AUTO_DEFINE_FCN0(Type, name, func) \
-static inline void name (Type *v) \
-{ \
-	if (*v) \
-		func (*v); \
-}
-
-/*****************************************************************************/
-
 /**
  * gs_free:
  *
@@ -226,25 +151,6 @@ NM_AUTO_DEFINE_FCN0 (GKeyFile *, gs_local_keyfile_unref, g_key_file_unref)
 
 /*****************************************************************************/
 
-static inline int nm_close (int fd);
-
-/**
- * nm_auto_free:
- *
- * Call free() on a variable location when it goes out of scope.
- * This is for pointers that are allocated with malloc() instead of
- * g_malloc().
- *
- * In practice, since glib 2.45, g_malloc()/g_free() always wraps malloc()/free().
- * See bgo#751592. In that case, it would be safe to free pointers allocated with
- * malloc() with gs_free or g_free().
- *
- * However, let's never mix them. To free malloc'ed memory, always use
- * free() or nm_auto_free.
- */
-NM_AUTO_DEFINE_FCN_VOID0 (void *, _nm_auto_free_impl, free)
-#define nm_auto_free nm_auto(_nm_auto_free_impl)
-
 NM_AUTO_DEFINE_FCN0 (GVariantIter *, _nm_auto_free_variant_iter, g_variant_iter_free)
 #define nm_auto_free_variant_iter nm_auto(_nm_auto_free_variant_iter)
 
@@ -275,30 +181,6 @@ _nm_auto_free_gstring (GString **str)
 }
 #define nm_auto_free_gstring nm_auto(_nm_auto_free_gstring)
 
-static inline void
-_nm_auto_close (int *pfd)
-{
-	if (*pfd >= 0) {
-		int errsv = errno;
-
-		(void) nm_close (*pfd);
-		errno = errsv;
-	}
-}
-#define nm_auto_close nm_auto(_nm_auto_close)
-
-static inline void
-_nm_auto_fclose (FILE **pfd)
-{
-	if (*pfd) {
-		int errsv = errno;
-
-		(void) fclose (*pfd);
-		errno = errsv;
-	}
-}
-#define nm_auto_fclose nm_auto(_nm_auto_fclose)
-
 static inline void
 _nm_auto_protect_errno (int *p_saved_errno)
 {
@@ -456,43 +338,6 @@ NM_G_ERROR_MSG (GError *error)
 
 /*****************************************************************************/
 
-/* macro to return strlen() of a compile time string. */
-#define NM_STRLEN(str)     ( sizeof (""str"") - 1 )
-
-/* returns the length of a NULL terminated array of pointers,
- * like g_strv_length() does. The difference is:
- *  - it operats on arrays of pointers (of any kind, requiring no cast).
- *  - it accepts NULL to return zero. */
-#define NM_PTRARRAY_LEN(array) \
-	({ \
-		typeof (*(array)) *const _array = (array); \
-		gsize _n = 0; \
-		\
-		if (_array) { \
-			_nm_unused gconstpointer _type_check_is_pointer = _array[0]; \
-			\
-			while (_array[_n]) \
-				_n++; \
-		} \
-		_n; \
-	})
-
-/* Note: @value is only evaluated when *out_val is present.
- * Thus,
- *    NM_SET_OUT (out_str, g_strdup ("hallo"));
- * does the right thing.
- */
-#define NM_SET_OUT(out_val, value) \
-	G_STMT_START { \
-		typeof(*(out_val)) *_out_val = (out_val); \
-		\
-		if (_out_val) { \
-			*_out_val = (value); \
-		} \
-	} G_STMT_END
-
-/*****************************************************************************/
-
 #ifndef _NM_CC_SUPPORT_AUTO_TYPE
 #if (defined (__GNUC__) && (__GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ >= 9 )))
 #define _NM_CC_SUPPORT_AUTO_TYPE 1
@@ -716,156 +561,6 @@ NM_G_ERROR_MSG (GError *error)
 
 /*****************************************************************************/
 
-#define _NM_IN_SET_EVAL_1( op, _x, y)           (_x == (y))
-#define _NM_IN_SET_EVAL_2( op, _x, y, ...)      (_x == (y)) op _NM_IN_SET_EVAL_1  (op, _x, __VA_ARGS__)
-#define _NM_IN_SET_EVAL_3( op, _x, y, ...)      (_x == (y)) op _NM_IN_SET_EVAL_2  (op, _x, __VA_ARGS__)
-#define _NM_IN_SET_EVAL_4( op, _x, y, ...)      (_x == (y)) op _NM_IN_SET_EVAL_3  (op, _x, __VA_ARGS__)
-#define _NM_IN_SET_EVAL_5( op, _x, y, ...)      (_x == (y)) op _NM_IN_SET_EVAL_4  (op, _x, __VA_ARGS__)
-#define _NM_IN_SET_EVAL_6( op, _x, y, ...)      (_x == (y)) op _NM_IN_SET_EVAL_5  (op, _x, __VA_ARGS__)
-#define _NM_IN_SET_EVAL_7( op, _x, y, ...)      (_x == (y)) op _NM_IN_SET_EVAL_6  (op, _x, __VA_ARGS__)
-#define _NM_IN_SET_EVAL_8( op, _x, y, ...)      (_x == (y)) op _NM_IN_SET_EVAL_7  (op, _x, __VA_ARGS__)
-#define _NM_IN_SET_EVAL_9( op, _x, y, ...)      (_x == (y)) op _NM_IN_SET_EVAL_8  (op, _x, __VA_ARGS__)
-#define _NM_IN_SET_EVAL_10(op, _x, y, ...)      (_x == (y)) op _NM_IN_SET_EVAL_9  (op, _x, __VA_ARGS__)
-#define _NM_IN_SET_EVAL_11(op, _x, y, ...)      (_x == (y)) op _NM_IN_SET_EVAL_10 (op, _x, __VA_ARGS__)
-#define _NM_IN_SET_EVAL_12(op, _x, y, ...)      (_x == (y)) op _NM_IN_SET_EVAL_11 (op, _x, __VA_ARGS__)
-#define _NM_IN_SET_EVAL_13(op, _x, y, ...)      (_x == (y)) op _NM_IN_SET_EVAL_12 (op, _x, __VA_ARGS__)
-#define _NM_IN_SET_EVAL_14(op, _x, y, ...)      (_x == (y)) op _NM_IN_SET_EVAL_13 (op, _x, __VA_ARGS__)
-#define _NM_IN_SET_EVAL_15(op, _x, y, ...)      (_x == (y)) op _NM_IN_SET_EVAL_14 (op, _x, __VA_ARGS__)
-#define _NM_IN_SET_EVAL_16(op, _x, y, ...)      (_x == (y)) op _NM_IN_SET_EVAL_15 (op, _x, __VA_ARGS__)
-
-#define _NM_IN_SET_EVAL_N2(op, _x, n, ...)      (_NM_IN_SET_EVAL_##n(op, _x, __VA_ARGS__))
-#define _NM_IN_SET_EVAL_N(op, type, x, n, ...)                      \
-    ({                                                              \
-        type _x = (x);                                              \
-                                                                    \
-        /* trigger a -Wenum-compare warning */                      \
-        nm_assert (TRUE || _x == (x));                              \
-                                                                    \
-        !!_NM_IN_SET_EVAL_N2(op, _x, n, __VA_ARGS__);               \
-    })
-
-#define _NM_IN_SET(op, type, x, ...)        _NM_IN_SET_EVAL_N(op, type, x, NM_NARG (__VA_ARGS__), __VA_ARGS__)
-
-/* Beware that this does short-circuit evaluation (use "||" instead of "|")
- * which has a possibly unexpected non-function-like behavior.
- * Use NM_IN_SET_SE if you need all arguments to be evaluated. */
-#define NM_IN_SET(x, ...)                   _NM_IN_SET(||, typeof (x), x, __VA_ARGS__)
-
-/* "SE" stands for "side-effect". Contrary to NM_IN_SET(), this does not do
- * short-circuit evaluation, which can make a difference if the arguments have
- * side-effects. */
-#define NM_IN_SET_SE(x, ...)                _NM_IN_SET(|,  typeof (x), x, __VA_ARGS__)
-
-/* the *_TYPED forms allow to explicitly select the type of "x". This is useful
- * if "x" doesn't support typeof (bitfields) or you want to gracefully convert
- * a type using automatic type conversion rules (but not forcing the conversion
- * with a cast). */
-#define NM_IN_SET_TYPED(type, x, ...)       _NM_IN_SET(||, type,       x, __VA_ARGS__)
-#define NM_IN_SET_SE_TYPED(type, x, ...)    _NM_IN_SET(|,  type,       x, __VA_ARGS__)
-
-/*****************************************************************************/
-
-#define NM_SWAP(a, b) \
-	G_STMT_START { \
-		typeof (a) _tmp; \
-		\
-		_tmp = (a); \
-		(a) = (b); \
-		(b) = _tmp; \
-	} G_STMT_END
-
-/*****************************************************************************/
-
-static inline gboolean
-_NM_IN_STRSET_streq (const char *x, const char *s)
-{
-	return s && strcmp (x, s) == 0;
-}
-
-#define _NM_IN_STRSET_EVAL_1( op, _x, y)        _NM_IN_STRSET_streq (_x, y)
-#define _NM_IN_STRSET_EVAL_2( op, _x, y, ...)   _NM_IN_STRSET_streq (_x, y) op _NM_IN_STRSET_EVAL_1  (op, _x, __VA_ARGS__)
-#define _NM_IN_STRSET_EVAL_3( op, _x, y, ...)   _NM_IN_STRSET_streq (_x, y) op _NM_IN_STRSET_EVAL_2  (op, _x, __VA_ARGS__)
-#define _NM_IN_STRSET_EVAL_4( op, _x, y, ...)   _NM_IN_STRSET_streq (_x, y) op _NM_IN_STRSET_EVAL_3  (op, _x, __VA_ARGS__)
-#define _NM_IN_STRSET_EVAL_5( op, _x, y, ...)   _NM_IN_STRSET_streq (_x, y) op _NM_IN_STRSET_EVAL_4  (op, _x, __VA_ARGS__)
-#define _NM_IN_STRSET_EVAL_6( op, _x, y, ...)   _NM_IN_STRSET_streq (_x, y) op _NM_IN_STRSET_EVAL_5  (op, _x, __VA_ARGS__)
-#define _NM_IN_STRSET_EVAL_7( op, _x, y, ...)   _NM_IN_STRSET_streq (_x, y) op _NM_IN_STRSET_EVAL_6  (op, _x, __VA_ARGS__)
-#define _NM_IN_STRSET_EVAL_8( op, _x, y, ...)   _NM_IN_STRSET_streq (_x, y) op _NM_IN_STRSET_EVAL_7  (op, _x, __VA_ARGS__)
-#define _NM_IN_STRSET_EVAL_9( op, _x, y, ...)   _NM_IN_STRSET_streq (_x, y) op _NM_IN_STRSET_EVAL_8  (op, _x, __VA_ARGS__)
-#define _NM_IN_STRSET_EVAL_10(op, _x, y, ...)   _NM_IN_STRSET_streq (_x, y) op _NM_IN_STRSET_EVAL_9  (op, _x, __VA_ARGS__)
-#define _NM_IN_STRSET_EVAL_11(op, _x, y, ...)   _NM_IN_STRSET_streq (_x, y) op _NM_IN_STRSET_EVAL_10 (op, _x, __VA_ARGS__)
-#define _NM_IN_STRSET_EVAL_12(op, _x, y, ...)   _NM_IN_STRSET_streq (_x, y) op _NM_IN_STRSET_EVAL_11 (op, _x, __VA_ARGS__)
-#define _NM_IN_STRSET_EVAL_13(op, _x, y, ...)   _NM_IN_STRSET_streq (_x, y) op _NM_IN_STRSET_EVAL_12 (op, _x, __VA_ARGS__)
-#define _NM_IN_STRSET_EVAL_14(op, _x, y, ...)   _NM_IN_STRSET_streq (_x, y) op _NM_IN_STRSET_EVAL_13 (op, _x, __VA_ARGS__)
-#define _NM_IN_STRSET_EVAL_15(op, _x, y, ...)   _NM_IN_STRSET_streq (_x, y) op _NM_IN_STRSET_EVAL_14 (op, _x, __VA_ARGS__)
-#define _NM_IN_STRSET_EVAL_16(op, _x, y, ...)   _NM_IN_STRSET_streq (_x, y) op _NM_IN_STRSET_EVAL_15 (op, _x, __VA_ARGS__)
-
-#define _NM_IN_STRSET_EVAL_N2(op, _x, n, ...)   (_NM_IN_STRSET_EVAL_##n(op, _x, __VA_ARGS__))
-#define _NM_IN_STRSET_EVAL_N(op, x, n, ...)                       \
-    ({                                                            \
-        const char *_x = (x);                                     \
-        (   ((_x == NULL) && _NM_IN_SET_EVAL_N2    (op, ((const char *) NULL), n, __VA_ARGS__)) \
-         || ((_x != NULL) && _NM_IN_STRSET_EVAL_N2 (op, _x,                    n, __VA_ARGS__)) \
-        ); \
-    })
-
-/* Beware that this does short-circuit evaluation (use "||" instead of "|")
- * which has a possibly unexpected non-function-like behavior.
- * Use NM_IN_STRSET_SE if you need all arguments to be evaluated. */
-#define NM_IN_STRSET(x, ...)               _NM_IN_STRSET_EVAL_N(||, x, NM_NARG (__VA_ARGS__), __VA_ARGS__)
-
-/* "SE" stands for "side-effect". Contrary to NM_IN_STRSET(), this does not do
- * short-circuit evaluation, which can make a difference if the arguments have
- * side-effects. */
-#define NM_IN_STRSET_SE(x, ...)            _NM_IN_STRSET_EVAL_N(|, x, NM_NARG (__VA_ARGS__), __VA_ARGS__)
-
-#define NM_STRCHAR_ALL(str, ch_iter, predicate) \
-	({ \
-		gboolean _val = TRUE; \
-		const char *_str = (str); \
-		\
-		if (_str) { \
-			for (;;) { \
-				const char ch_iter = _str[0]; \
-				\
-				if (ch_iter != '\0') { \
-					if (predicate) {\
-						_str++; \
-						continue; \
-					} \
-					_val = FALSE; \
-				} \
-				break; \
-			} \
-		} \
-		_val; \
-	})
-
-#define NM_STRCHAR_ANY(str, ch_iter, predicate) \
-	({ \
-		gboolean _val = FALSE; \
-		const char *_str = (str); \
-		\
-		if (_str) { \
-			for (;;) { \
-				const char ch_iter = _str[0]; \
-				\
-				if (ch_iter != '\0') { \
-					if (predicate) { \
-						; \
-					} else { \
-						_str++; \
-						continue; \
-					} \
-					_val = TRUE; \
-				} \
-				break; \
-			} \
-		} \
-		_val; \
-	})
-
-/*****************************************************************************/
-
 /* NM_CACHED_QUARK() returns the GQuark for @string, but caches
  * it in a static variable to speed up future lookups.
  *
@@ -900,77 +595,6 @@ fcn (void) \
 
 /*****************************************************************************/
 
-static inline int
-nm_strcmp0 (const char *s1, const char *s2)
-{
-	int c;
-
-	/* like g_strcmp0(), but this is inlinable.
-	 *
-	 * Also, it is guaranteed to return either -1, 0, or 1. */
-	if (s1 == s2)
-		return 0;
-	if (!s1)
-		return -1;
-	if (!s2)
-		return 1;
-	c = strcmp (s1, s2);
-	if (c < 0)
-		return -1;
-	if (c > 0)
-		return 1;
-	return 0;
-}
-
-static inline gboolean
-nm_streq (const char *s1, const char *s2)
-{
-	return strcmp (s1, s2) == 0;
-}
-
-static inline gboolean
-nm_streq0 (const char *s1, const char *s2)
-{
-	return    (s1 == s2)
-	       || (s1 && s2 && strcmp (s1, s2) == 0);
-}
-
-#define NM_STR_HAS_PREFIX(str, prefix) \
-	({ \
-		const char *const _str_has_prefix = (str); \
-		\
-		nm_assert (strlen (prefix) == NM_STRLEN (prefix)); \
-		\
-		   _str_has_prefix \
-		&& (strncmp (_str_has_prefix, ""prefix"", NM_STRLEN (prefix)) == 0); \
-	})
-
-#define NM_STR_HAS_SUFFIX(str, suffix) \
-	({ \
-		const char *const _str_has_suffix = (str); \
-		gsize _l; \
-		\
-		nm_assert (strlen (suffix) == NM_STRLEN (suffix)); \
-		\
-		(   _str_has_suffix \
-		 && ((_l = strlen (_str_has_suffix)) >= NM_STRLEN (suffix)) \
-		 && (memcmp (&_str_has_suffix[_l - NM_STRLEN (suffix)], \
-		             ""suffix"", \
-		             NM_STRLEN (suffix)) == 0)); \
-	})
-
-/* whether @str starts with the string literal @prefix and is followed by
- * some other text. It is like NM_STR_HAS_PREFIX() && !nm_streq() together. */
-#define NM_STR_HAS_PREFIX_WITH_MORE(str, prefix) \
-	({ \
-		const char *const _str_has_prefix_with_more = (str); \
-		\
-		   NM_STR_HAS_PREFIX (_str_has_prefix_with_more, ""prefix"") \
-		&& _str_has_prefix_with_more[NM_STRLEN (prefix)] != '\0'; \
-	})
-
-/*****************************************************************************/
-
 static inline GString *
 nm_gstring_prepare (GString **l)
 {
@@ -1038,31 +662,11 @@ nm_str_realloc (char *str)
 
 /*****************************************************************************/
 
-/* glib/C provides the following kind of assertions:
- *   - assert() -- disable with NDEBUG
- *   - g_return_if_fail() -- disable with G_DISABLE_CHECKS
- *   - g_assert() -- disable with G_DISABLE_ASSERT
- * but they are all enabled by default and usually even production builds have
- * these kind of assertions enabled. It also means, that disabling assertions
- * is an untested configuration, and might have bugs.
- *
- * Add our own assertion macro nm_assert(), which is disabled by default and must
- * be explicitly enabled. They are useful for more expensive checks or checks that
- * depend less on runtime conditions (that is, are generally expected to be true). */
-
-#ifndef NM_MORE_ASSERTS
-#define NM_MORE_ASSERTS 0
-#endif
-
-#if NM_MORE_ASSERTS
-#define nm_assert(cond) G_STMT_START { g_assert (cond); } G_STMT_END
-#define nm_assert_se(cond) G_STMT_START { if (G_LIKELY (cond)) { ; } else { g_assert (FALSE && (cond)); } } G_STMT_END
-#define nm_assert_not_reached() G_STMT_START { g_assert_not_reached (); } G_STMT_END
-#else
-#define nm_assert(cond) G_STMT_START { if (FALSE) { if (cond) { } } } G_STMT_END
-#define nm_assert_se(cond) G_STMT_START { if (G_LIKELY (cond)) { ; } } G_STMT_END
-#define nm_assert_not_reached() G_STMT_START { ; } G_STMT_END
-#endif
+/* redefine assertions to use g_assert*() */
+#undef _nm_assert_call
+#undef _nm_assert_call_not_reached
+#define _nm_assert_call(cond)         g_assert(cond)
+#define _nm_assert_call_not_reached() g_assert_not_reached()
 
 /* Usage:
  *
@@ -1170,9 +774,9 @@ nm_g_object_ref (gpointer obj)
 static inline void
 nm_g_object_unref (gpointer obj)
 {
-	/* g_object_unref() doesn't accept NULL. Usully, we workaround that
+	/* g_object_unref() doesn't accept NULL. Usually, we workaround that
 	 * by using g_clear_object(), but sometimes that is not convenient
-	 * (for example as as destroy function for a hash table that can contain
+	 * (for example as destroy function for a hash table that can contain
 	 * NULL values). */
 	if (obj)
 		g_object_unref (obj);
@@ -1204,32 +808,6 @@ nm_g_object_unref (gpointer obj)
 		_changed; \
 	})
 
-#define nm_clear_pointer(pp, destroy) \
-	({ \
-		typeof (*(pp)) *_pp = (pp); \
-		typeof (*_pp) _p; \
-		gboolean _changed = FALSE; \
-		\
-		if (   _pp \
-		    && (_p = *_pp)) { \
-			_nm_unused gconstpointer _p_check_is_pointer = _p; \
-			\
-			*_pp = NULL; \
-			/* g_clear_pointer() assigns @destroy first to a local variable, so that
-			 * you can call "g_clear_pointer (pp, (GDestroyNotify) destroy);" without
-			 * gcc emitting a warning. We don't do that, hence, you cannot cast
-			 * "destroy" first.
-			 *
-			 * On the upside: you are not supposed to cast fcn, because the pointer
-			 * types are preserved. If you really need a cast, you should cast @pp.
-			 * But that is hardly ever necessary. */ \
-			(destroy) (_p); \
-			\
-			_changed = TRUE; \
-		} \
-		_changed; \
-	})
-
 /* basically, replaces
  *   g_clear_pointer (&location, g_free)
  * with
@@ -1628,68 +1206,6 @@ nm_strcmp_p (gconstpointer a, gconstpointer b)
 
 /*****************************************************************************/
 
-/* Taken from systemd's UNIQ_T and UNIQ macros. */
-
-#define NM_UNIQ_T(x, uniq) G_PASTE(__unique_prefix_, G_PASTE(x, uniq))
-#define NM_UNIQ __COUNTER__
-
-/*****************************************************************************/
-
-/* glib's MIN()/MAX() macros don't have function-like behavior, in that they evaluate
- * the argument possibly twice.
- *
- * Taken from systemd's MIN()/MAX() macros. */
-
-#define NM_MIN(a, b) __NM_MIN(NM_UNIQ, a, NM_UNIQ, b)
-#define __NM_MIN(aq, a, bq, b) \
-	({ \
-		typeof (a) NM_UNIQ_T(A, aq) = (a); \
-		typeof (b) NM_UNIQ_T(B, bq) = (b); \
-		((NM_UNIQ_T(A, aq) < NM_UNIQ_T(B, bq)) ? NM_UNIQ_T(A, aq) : NM_UNIQ_T(B, bq)); \
-	})
-
-#define NM_MAX(a, b) __NM_MAX(NM_UNIQ, a, NM_UNIQ, b)
-#define __NM_MAX(aq, a, bq, b) \
-	({ \
-		typeof (a) NM_UNIQ_T(A, aq) = (a); \
-		typeof (b) NM_UNIQ_T(B, bq) = (b); \
-		((NM_UNIQ_T(A, aq) > NM_UNIQ_T(B, bq)) ? NM_UNIQ_T(A, aq) : NM_UNIQ_T(B, bq)); \
-	})
-
-#define NM_CLAMP(x, low, high) __NM_CLAMP(NM_UNIQ, x, NM_UNIQ, low, NM_UNIQ, high)
-#define __NM_CLAMP(xq, x, lowq, low, highq, high) \
-	({ \
-		typeof(x)NM_UNIQ_T(X,xq) = (x); \
-		typeof(low) NM_UNIQ_T(LOW,lowq) = (low); \
-		typeof(high) NM_UNIQ_T(HIGH,highq) = (high); \
-		\
-		( (NM_UNIQ_T(X,xq) > NM_UNIQ_T(HIGH,highq)) \
-		  ? NM_UNIQ_T(HIGH,highq) \
-		  : (NM_UNIQ_T(X,xq) < NM_UNIQ_T(LOW,lowq)) \
-		     ? NM_UNIQ_T(LOW,lowq) \
-		     : NM_UNIQ_T(X,xq)); \
-	})
-
-#define NM_MAX_WITH_CMP(cmp, a, b) \
-	({ \
-		typeof (a) _a = (a); \
-		typeof (b) _b = (b); \
-		\
-		(  ((cmp (_a, _b)) >= 0) \
-		 ? _a \
-		 : _b); \
-	})
-
-/* evaluates to (void) if _A or _B are not constant or of different types */
-#define NM_CONST_MAX(_A, _B) \
-	(__builtin_choose_expr ((   __builtin_constant_p (_A) \
-	                         && __builtin_constant_p (_B) \
-	                         && __builtin_types_compatible_p (typeof (_A), typeof (_B))), \
-	                        ((_A) > (_B)) ? (_A) : (_B),                            \
-	                        ((void)  0)))
-
-/*****************************************************************************/
-
 #define nm_g_slice_free(ptr) \
 	g_slice_free (typeof (*(ptr)), ptr)
 
@@ -1987,51 +1503,6 @@ nm_decode_version (guint version, guint *major, guint *minor, guint *micro)
 
 /*****************************************************************************/
 
-/**
- * The boolean type _Bool is C99 while we mostly stick to C89. However, _Bool is too
- * convenient to miss and is effectively available in gcc and clang. So, just use it.
- *
- * Usually, one would include "stdbool.h" to get the "bool" define which aliases
- * _Bool. We provide this define here, because we want to make use of it anywhere.
- * (also, stdbool.h is again C99).
- *
- * Using _Bool has advantages over gboolean:
- *
- * - commonly _Bool is one byte large, instead of gboolean's 4 bytes (because gboolean
- *   is a typedef for int). Especially when having boolean fields in a struct, we can
- *   thereby easily save some space.
- *
- * - _Bool type guarantees that two "true" expressions compare equal. E.g. the following
- *   will not work:
- *        gboolean v1 = 1;
- *        gboolean v2 = 2;
- *        g_assert_cmpint (v1, ==, v2); // will fail
- *   For that, we often to use !! to coerce gboolean values to 0 or 1:
- *        g_assert_cmpint (!!v2, ==, TRUE);
- *   With _Bool type, this will be handled properly by the compiler.
- *
- * - For structs, we might want to safe even more space and use bitfields:
- *       struct s1 {
- *           gboolean v1:1;
- *       };
- *   But the problem here is that gboolean is signed, so that
- *   v1 will be either 0 or -1 (not 1, TRUE). Thus, the following
- *   fails:
- *      struct s1 s = { .v1 = TRUE, };
- *      g_assert_cmpint (s1.v1, ==, TRUE);
- *   It will however work just fine with bool/_Bool while retaining the
- *   notion of having a boolean value.
- *
- * Also, add the defines for "true" and "false". Those are nicely highlighted by the editor
- * as special types, contrary to glib's "TRUE"/"FALSE".
- */
-
-#ifndef bool
-#define bool _Bool
-#define true    1
-#define false   0
-#endif
-
 #ifdef _G_BOOLEAN_EXPR
 /* g_assert() uses G_LIKELY(), which in turn uses _G_BOOLEAN_EXPR().
  * As glib's implementation uses a local variable _g_boolean_var_,
@@ -2044,70 +1515,11 @@ nm_decode_version (guint version, guint *major, guint *minor, guint *micro)
  * Workaround that by re-defining _G_BOOLEAN_EXPR()
  **/
 #undef  _G_BOOLEAN_EXPR
-#define __NM_G_BOOLEAN_EXPR_IMPL(v, expr) \
-	({ \
-		int NM_UNIQ_T(V, v); \
-		\
-		if (expr) \
-			NM_UNIQ_T(V, v) = 1; \
-		else \
-			NM_UNIQ_T(V, v) = 0; \
-		NM_UNIQ_T(V, v); \
-	})
-#define _G_BOOLEAN_EXPR(expr) __NM_G_BOOLEAN_EXPR_IMPL (NM_UNIQ, expr)
+#define _G_BOOLEAN_EXPR(expr) NM_BOOLEAN_EXPR (expr)
 #endif
 
 /*****************************************************************************/
 
-/**
- * nm_steal_int:
- * @p_val: pointer to an int type.
- *
- * Returns: *p_val and sets *p_val to zero the same time.
- *   Accepts %NULL, in which case also numeric 0 will be returned.
- */
-#define nm_steal_int(p_val) \
-	({ \
-		typeof (p_val) const _p_val = (p_val); \
-		typeof (*_p_val) _val = 0; \
-		\
-		if (   _p_val \
-		    && (_val = *_p_val)) { \
-			*_p_val = 0; \
-		} \
-		_val; \
-	})
-
-static inline int
-nm_steal_fd (int *p_fd)
-{
-	int fd;
-
-	if (   p_fd
-	    && ((fd = *p_fd) >= 0)) {
-		*p_fd = -1;
-		return fd;
-	}
-	return -1;
-}
-
-/**
- * nm_close:
- *
- * Like close() but throws an assertion if the input fd is
- * invalid.  Closing an invalid fd is a programming error, so
- * it's better to catch it early.
- */
-static inline int
-nm_close (int fd)
-{
-	int r;
-
-	r = close (fd);
-	nm_assert (r != -1 || fd < 0 || errno != EBADF);
-	return r;
-}
-
 #define NM_PID_T_INVAL ((pid_t) -1)
 
 /*****************************************************************************/
diff --git a/shared/nm-glib-aux/nm-ref-string.c b/shared/nm-glib-aux/nm-ref-string.c
index 0a0b0d3a41..ccc29303b3 100644
--- a/shared/nm-glib-aux/nm-ref-string.c
+++ b/shared/nm-glib-aux/nm-ref-string.c
@@ -70,7 +70,7 @@ _ASSERT (const RefString *rstr0)
  * nm_ref_string_new_len:
  * @cstr: the string to intern. Must contain @len bytes.
  *   If @len is zero, @cstr may be %NULL. Note that it is
- *   accetable that the string contains a NUL character
+ *   acceptable that the string contains a NUL character
  *   within the first @len bytes. That is, the string is
  *   not treated as a NUL terminated string, but as binary.
  *   Also, contrary to strncpy(), this will read all the
@@ -83,7 +83,7 @@ _ASSERT (const RefString *rstr0)
  * (at position @len).
  *
  * Note that NMRefString are always interned/deduplicated. If such a string
- * already exists, the existing instance will be refered and returned.
+ * already exists, the existing instance will be referred and returned.
  *
  *
  * Since all NMRefString are shared and interned, you may use
diff --git a/shared/nm-glib-aux/nm-secret-utils.h b/shared/nm-glib-aux/nm-secret-utils.h
index 501e752071..de9f33eaa0 100644
--- a/shared/nm-glib-aux/nm-secret-utils.h
+++ b/shared/nm-glib-aux/nm-secret-utils.h
@@ -165,7 +165,7 @@ gboolean nm_utils_memeqzero_secret (gconstpointer data, gsize length);
  * Otherwise, this will allocate a new buffer of the desired size, copy over the
  * old data, and bzero the old buffer before freeing it. As such, it also behaves
  * similar to g_realloc(), with the overhead of nm_explicit_bzero() and using
- * malloc/free intead of realloc().
+ * malloc/free instead of realloc().
  *
  * Returns: the new allocated buffer. Think of it behaving like g_realloc().
  */
@@ -200,7 +200,7 @@ nm_secret_mem_realloc (gpointer m_old, gboolean do_bzero_mem, gsize cur_len, gsi
  * Otherwise, this will try to allocate a new buffer of the desired size, copy over the
  * old data, and bzero the old buffer before freeing it. As such, it also behaves
  * similar to g_try_realloc(), with the overhead of nm_explicit_bzero() and using
- * malloc/free intead of realloc().
+ * malloc/free instead of realloc().
  *
  * Returns: the new allocated buffer or NULL. Think of it behaving like g_try_realloc().
  */
diff --git a/shared/nm-glib-aux/nm-shared-utils.c b/shared/nm-glib-aux/nm-shared-utils.c
index 681b4dd14a..ee917fdf6e 100644
--- a/shared/nm-glib-aux/nm-shared-utils.c
+++ b/shared/nm-glib-aux/nm-shared-utils.c
@@ -23,6 +23,9 @@ G_STATIC_ASSERT (G_STRUCT_OFFSET (NMUtilsNamedValue, value_ptr) == sizeof (const
 
 /*****************************************************************************/
 
+const char _nm_hexchar_table_lower[16] = "0123456789abcdef";
+const char _nm_hexchar_table_upper[16] = "0123456789ABCDEF";
+
 const void *const _NM_PTRARRAY_EMPTY[1] = { NULL };
 
 /*****************************************************************************/
@@ -94,75 +97,6 @@ G_STATIC_ASSERT (ETH_ALEN == 6);
 
 /*****************************************************************************/
 
-gsize
-nm_utils_get_next_realloc_size (gboolean true_realloc, gsize requested)
-{
-	gsize n, x;
-
-	/* https://doc.qt.io/qt-5/containers.html#growth-strategies */
-
-	if (requested <= 40) {
-		/* small allocations. Increase in small steps of 8 bytes.
-		 *
-		 * We get thus sizes of 8, 16, 32, 40. */
-		if (requested <= 8)
-			return 8;
-		if (requested <= 16)
-			return 16;
-		if (requested <= 32)
-			return 32;
-
-		/* The return values for < 104 are essentially hard-coded, and the choice here is
-		 * made without very strong reasons.
-		 *
-		 * We want to stay 24 bytes below the power-of-two border 64. Hence, return 40 here.
-		 * However, the next step then is already 104 (128 - 24). It's a larger gap than in
-		 * the steps before.
-		 *
-		 * It's not clear whether some of the steps should be adjusted (or how exactly). */
-		return 40;
-	}
-
-	if (   requested <= 0x2000u - 24u
-	    || G_UNLIKELY (!true_realloc)) {
-		/* mid sized allocations. Return next power of two, minus 24 bytes extra space
-		 * at the beginning.
-		 * That means, we double the size as we grow.
-		 *
-		 * With !true_realloc, it means that the caller does not intend to call
-		 * realloc() but instead clone the buffer. This is for example the case, when we
-		 * want to nm_explicit_bzero() the old buffer. In that case we really want to grow
-		 * the buffer exponentially every time and not increment in page sizes of 4K (below).
-		 *
-		 * We get thus sizes of 104, 232, 488, 1000, 2024, 4072, 8168... */
-
-		if (G_UNLIKELY (requested > G_MAXSIZE / 2u - 24u))
-			return G_MAXSIZE;
-
-		x = requested + 24u;
-		n = 128u;
-		while (n < x) {
-			n <<= 1;
-			nm_assert (n > 128u);
-		}
-
-		nm_assert (n > 24u && n - 24u >= requested);
-		return n - 24u;
-	}
-
-	if (G_UNLIKELY (requested > G_MAXSIZE - 0x1000u - 24u))
-		return G_MAXSIZE;
-
-	/* For large allocations (with !true_realloc) we allocate memory in chunks of
-	 * 4K (- 24 bytes extra), assuming that the memory gets mmapped and thus
-	 * realloc() is efficient by just reordering pages. */
-	n = ((requested + (0x0FFFu + 24u)) & ~((gsize) 0x0FFFu)) - 24u;
-	nm_assert (n >= requested);
-	return n;
-}
-
-/*****************************************************************************/
-
 pid_t
 nm_utils_gettid (void)
 {
@@ -443,7 +377,7 @@ nm_utils_gbytes_equal_mem (GBytes *bytes,
 	gsize l;
 
 	if (!bytes) {
-		/* as a special case, let %NULL GBytes compare idential
+		/* as a special case, let %NULL GBytes compare identical
 		 * to an empty array. */
 		return (mem_len == 0);
 	}
@@ -478,50 +412,52 @@ nm_utils_gbytes_to_variant_ay (GBytes *bytes)
 GVariant *
 nm_utils_strdict_to_variant_ass (GHashTable *strdict)
 {
-	GHashTableIter iter;
-	const char *key, *value;
+	gs_free NMUtilsNamedValue *values_free = NULL;
+	NMUtilsNamedValue values_prepared[20];
+	const NMUtilsNamedValue *values;
 	GVariantBuilder builder;
-	guint i, len;
+	guint i;
+	guint n;
+
+	values = nm_utils_named_values_from_strdict (strdict,
+	                                             &n,
+	                                             values_prepared,
+	                                             &values_free);
 
 	g_variant_builder_init (&builder, G_VARIANT_TYPE ("a{ss}"));
-
-	if (!strdict)
-		goto out;
-	len = g_hash_table_size (strdict);
-	if (!len)
-		goto out;
-
-	g_hash_table_iter_init (&iter, strdict);
-	if (!g_hash_table_iter_next (&iter, (gpointer *) &key, (gpointer *) &value))
-		nm_assert_not_reached ();
-
-	if (len == 1)
-		g_variant_builder_add (&builder, "{ss}", key, value);
-	else {
-		gs_free NMUtilsNamedValue *idx_free = NULL;
-		NMUtilsNamedValue *idx;
-
-		if (len > 300 / sizeof (NMUtilsNamedValue)) {
-			idx_free = g_new (NMUtilsNamedValue, len);
-			idx = idx_free;
-		} else
-			idx = g_alloca (sizeof (NMUtilsNamedValue) * len);
-
-		i = 0;
-		do {
-			idx[i].name = key;
-			idx[i].value_str = value;
-			i++;
-		} while (g_hash_table_iter_next (&iter, (gpointer *) &key, (gpointer *) &value));
-		nm_assert (i == len);
-
-		nm_utils_named_value_list_sort (idx, len, NULL, NULL);
-
-		for (i = 0; i < len; i++)
-			g_variant_builder_add (&builder, "{ss}", idx[i].name, idx[i].value_str);
+	for (i = 0; i < n; i++) {
+		g_variant_builder_add (&builder,
+		                       "{ss}",
+		                       values[i].name,
+		                       values[i].value_str);
 	}
+	return g_variant_builder_end (&builder);
+}
 
-out:
+/*****************************************************************************/
+
+GVariant *
+nm_utils_strdict_to_variant_asv (GHashTable *strdict)
+{
+	gs_free NMUtilsNamedValue *values_free = NULL;
+	NMUtilsNamedValue values_prepared[20];
+	const NMUtilsNamedValue *values;
+	GVariantBuilder builder;
+	guint i;
+	guint n;
+
+	values = nm_utils_named_values_from_strdict (strdict,
+	                                             &n,
+	                                             values_prepared,
+	                                             &values_free);
+
+	g_variant_builder_init (&builder, G_VARIANT_TYPE ("a{sv}"));
+	for (i = 0; i < n; i++) {
+		g_variant_builder_add (&builder,
+		                       "{sv}",
+		                       values[i].name,
+		                       g_variant_new_string (values[i].value_str));
+	}
 	return g_variant_builder_end (&builder);
 }
 
@@ -1075,39 +1011,53 @@ nm_utils_parse_next_line (const char **inout_ptr,
                           const char **out_line,
                           gsize *out_line_len)
 {
+	gboolean eol_is_carriage_return;
 	const char *line_start;
-	const char *line_end;
+	gsize line_len;
 
-	g_return_val_if_fail (inout_ptr, FALSE);
-	g_return_val_if_fail (inout_len, FALSE);
-	g_return_val_if_fail (out_line, FALSE);
+	nm_assert (inout_ptr);
+	nm_assert (inout_len);
+	nm_assert (*inout_len == 0 || *inout_ptr);
+	nm_assert (out_line);
+	nm_assert (out_line_len);
 
-	if (*inout_len <= 0)
-		goto error;
+	if (G_UNLIKELY (*inout_len == 0))
+		return FALSE;
 
 	line_start = *inout_ptr;
-	line_end = memchr (line_start, '\n', *inout_len);
-	if (!line_end)
-		line_end = memchr (line_start, '\0', *inout_len);
-	if (!line_end) {
-		line_end = line_start + *inout_len;
-		NM_SET_OUT (inout_len, 0);
-	} else
-		NM_SET_OUT (inout_len, *inout_len - (line_end - line_start) - 1);
 
-	NM_SET_OUT (out_line, line_start);
-	NM_SET_OUT (out_line_len, (gsize) (line_end - line_start));
+	eol_is_carriage_return = FALSE;
+	for (line_len = 0; ; line_len++) {
+		if (line_len >= *inout_len) {
+			/* if we consumed the entire line, we place the pointer at
+			 * one character after the end. */
+			*inout_ptr = &line_start[line_len];
+			*inout_len = 0;
+			goto done;
+		}
+		switch (line_start[line_len]) {
+		case '\r':
+			eol_is_carriage_return = TRUE;
+			/* fall-through*/
+		case '\0':
+		case '\n':
+			*inout_ptr = &line_start[line_len + 1];
+			*inout_len = *inout_len - line_len - 1u;
+			if (   eol_is_carriage_return
+			    && *inout_len > 0
+			    && (*inout_ptr)[0] == '\n') {
+				/* also consume "\r\n" as one. */
+				(*inout_len)--;
+				(*inout_ptr)++;
+			}
+			goto done;
+		}
+	}
 
-	if (*inout_len > 0)
-		NM_SET_OUT (inout_ptr, line_end + 1);
-	else
-		NM_SET_OUT (inout_ptr, NULL);
+done:
+	*out_line = line_start;
+	*out_line_len = line_len;
 	return TRUE;
-
-error:
-	NM_SET_OUT (out_line, NULL);
-	NM_SET_OUT (out_line_len, 0);
-	return FALSE;
 }
 
 /*****************************************************************************/
@@ -1529,7 +1479,7 @@ nm_utils_dbus_path_cmp (const char *dbus_path_a, const char *dbus_path_b)
 	if (n_a == -1 && n_b == -1)
 		goto comp_l;
 
-	/* both components must be convertiable to a number. If they are not,
+	/* both components must be convertible to a number. If they are not,
 	 * (and only one of them is), then we must always strictly sort numeric parts
 	 * after non-numeric components. If we wouldn't, we wouldn't have
 	 * a total order.
@@ -3045,28 +2995,44 @@ nm_utils_fd_read_loop_exact (int fd, void *buf, size_t nbytes, bool do_poll)
 
 /*****************************************************************************/
 
+G_STATIC_ASSERT (G_STRUCT_OFFSET (NMUtilsNamedValue, name) == 0);
+
 NMUtilsNamedValue *
-nm_utils_named_values_from_str_dict_with_sort (GHashTable *hash,
-                                               guint *out_len,
-                                               GCompareDataFunc compare_func,
-                                               gpointer user_data)
+nm_utils_named_values_from_strdict_full (GHashTable *hash,
+                                         guint *out_len,
+                                         GCompareDataFunc compare_func,
+                                         gpointer user_data,
+                                         NMUtilsNamedValue *provided_buffer,
+                                         guint provided_buffer_len,
+                                         NMUtilsNamedValue **out_allocated_buffer)
 {
 	GHashTableIter iter;
 	NMUtilsNamedValue *values;
 	guint i, len;
 
+	nm_assert (provided_buffer_len == 0 || provided_buffer);
+	nm_assert (!out_allocated_buffer || !*out_allocated_buffer);
+
 	if (   !hash
 	    || !(len = g_hash_table_size (hash))) {
 		NM_SET_OUT (out_len, 0);
 		return NULL;
 	}
 
+	if (provided_buffer_len >= len + 1) {
+		/* the buffer provided by the caller is large enough. Use it. */
+		values = provided_buffer;
+	} else {
+		/* allocate a new buffer. */
+		values = g_new (NMUtilsNamedValue, len + 1);
+		NM_SET_OUT (out_allocated_buffer, values);
+	}
+
 	i = 0;
-	values = g_new (NMUtilsNamedValue, len + 1);
 	g_hash_table_iter_init (&iter, hash);
 	while (g_hash_table_iter_next (&iter,
 	                               (gpointer *) &values[i].name,
-	                               (gpointer *) &values[i].value_ptr))
+	                               &values[i].value_ptr))
 		i++;
 	nm_assert (i == len);
 	values[i].name = NULL;
@@ -3324,7 +3290,7 @@ nm_utils_strv_make_deep_copied_n (const char **strv, gsize len)
  *
  * Note that if @len is non-negative, then it still must not
  * contain any %NULL pointers within the first @len elements.
- * Otherwise you would leak elements if you try to free the
+ * Otherwise, you would leak elements if you try to free the
  * array with g_strfreev(). Allowing that would be error prone.
  *
  * Returns: (transfer full): a clone of the strv array. Always
@@ -3779,7 +3745,7 @@ nm_utils_g_slist_find_str (const GSList *list,
  * @b: the right #GSList of strings to compare.
  *
  * Compares two string lists. The data elements are compared with
- * strcmp(), alloing %NULL elements.
+ * strcmp(), allowing %NULL elements.
  *
  * Returns: 0, 1, or -1, depending on how the lists compare.
  */
@@ -4046,7 +4012,7 @@ nm_utils_memeqzero (gconstpointer data, gsize length)
  * Returns: the binary value converted to a hex string. If @out is given,
  *   this always returns @out. If @out is %NULL, a newly allocated string
  *   is returned. This never returns %NULL, for buffers of length zero
- *   an empty string is returend.
+ *   an empty string is returned.
  */
 char *
 nm_utils_bin2hexstr_full (gconstpointer addr,
@@ -4949,7 +4915,7 @@ _nm_str_buf_ensure_size (NMStrBuf *strbuf,
 {
 	_nm_str_buf_assert (strbuf);
 
-	/* Currently this only supports strictly growing the buffer. */
+	/* Currently, this only supports strictly growing the buffer. */
 	nm_assert (new_size > strbuf->_priv_allocated);
 
 	if (!reserve_exact) {
@@ -5056,9 +5022,11 @@ void
 _nm_utils_format_variant_attributes_full (GString *str,
                                           const NMUtilsNamedValue *values,
                                           guint num_values,
+                                          const NMVariantAttributeSpec *const *spec,
                                           char attr_separator,
                                           char key_value_separator)
 {
+	const NMVariantAttributeSpec *const *s;
 	const char *name, *value;
 	GVariant *variant;
 	char *escaped;
@@ -5068,8 +5036,19 @@ _nm_utils_format_variant_attributes_full (GString *str,
 
 	for (i = 0; i < num_values; i++) {
 		name = values[i].name;
-		variant = (GVariant *) values[i].value_ptr;
+		variant = values[i].value_ptr;
 		value = NULL;
+		s = NULL;
+
+		if (spec) {
+			for (s = spec; *s; s++) {
+				if (nm_streq0 ((*s)->name, name))
+					break;
+			}
+
+			if (!*s)
+				continue;
+		}
 
 		if (g_variant_is_of_type (variant, G_VARIANT_TYPE_UINT32))
 			value = nm_sprintf_buf (buf, "%u", g_variant_get_uint32 (variant));
@@ -5097,11 +5076,13 @@ _nm_utils_format_variant_attributes_full (GString *str,
 		g_string_append (str, escaped);
 		g_free (escaped);
 
-		g_string_append_c (str, key_value_separator);
+		if (!s || !*s || !(*s)->no_value) {
+			g_string_append_c (str, key_value_separator);
 
-		escaped = attribute_escape (value, attr_separator, key_value_separator);
-		g_string_append (str, escaped);
-		g_free (escaped);
+			escaped = attribute_escape (value, attr_separator, key_value_separator);
+			g_string_append (str, escaped);
+			g_free (escaped);
+		}
 
 		sep = attr_separator;
 	}
@@ -5109,25 +5090,34 @@ _nm_utils_format_variant_attributes_full (GString *str,
 
 char *
 _nm_utils_format_variant_attributes (GHashTable *attributes,
+                                     const NMVariantAttributeSpec *const *spec,
                                      char attr_separator,
                                      char key_value_separator)
 {
+	gs_free NMUtilsNamedValue *values_free = NULL;
+	NMUtilsNamedValue values_prepared[20];
+	const NMUtilsNamedValue *values;
 	GString *str = NULL;
-	gs_free NMUtilsNamedValue *values = NULL;
 	guint len;
 
 	g_return_val_if_fail (attr_separator, NULL);
 	g_return_val_if_fail (key_value_separator, NULL);
 
-	if (!attributes || !g_hash_table_size (attributes))
+	if (!attributes)
 		return NULL;
 
-	values = nm_utils_named_values_from_str_dict (attributes, &len);
+	values = nm_utils_named_values_from_strdict (attributes,
+	                                             &len,
+	                                             values_prepared,
+	                                             &values_free);
+	if (len == 0)
+		return NULL;
 
 	str = g_string_new ("");
 	_nm_utils_format_variant_attributes_full (str,
 	                                          values,
 	                                          len,
+	                                          spec,
 	                                          attr_separator,
 	                                          key_value_separator);
 	return g_string_free (str, FALSE);
diff --git a/shared/nm-glib-aux/nm-shared-utils.h b/shared/nm-glib-aux/nm-shared-utils.h
index b17c8d1a09..ac091d8230 100644
--- a/shared/nm-glib-aux/nm-shared-utils.h
+++ b/shared/nm-glib-aux/nm-shared-utils.h
@@ -422,6 +422,7 @@ gboolean nm_utils_gbytes_equal_mem (GBytes *bytes,
 GVariant *nm_utils_gbytes_to_variant_ay (GBytes *bytes);
 
 GVariant *nm_utils_strdict_to_variant_ass (GHashTable *strdict);
+GVariant *nm_utils_strdict_to_variant_asv (GHashTable *strdict);
 
 /*****************************************************************************/
 
@@ -630,23 +631,24 @@ nm_utils_escaped_tokens_escape (const char *str,
 	                                            out_to_free);
 }
 
-static inline GString *
-nm_utils_escaped_tokens_escape_gstr_assert (const char *str,
-                                            const char *delimiters,
-                                            GString *gstring)
+/**
+ * nm_utils_escaped_tokens_escape_unnecessary:
+ * @str: the string to check for "escape"
+ * @delimiters: the delimiters
+ *
+ * This asserts that calling nm_utils_escaped_tokens_escape()
+ * on @str has no effect and returns @str directly. This is only
+ * for asserting that @str is safe to not require any escaping.
+ *
+ * Returns: @str
+ */
+static inline const char *
+nm_utils_escaped_tokens_escape_unnecessary (const char *str,
+                                            const char *delimiters)
 {
 #if NM_MORE_ASSERTS > 0
 
-	/* Just appends @str to @gstring, but also assert that
-	 * no escaping is necessary.
-	 *
-	 * Use nm_utils_escaped_tokens_escape_gstr_assert() instead
-	 * of nm_utils_escaped_tokens_escape_gstr(), if you *know* that
-	 * @str contains no delimiters, no backslashes, and no trailing
-	 * whitespace that requires escaping. */
-
 	nm_assert (str);
-	nm_assert (gstring);
 	nm_assert (delimiters);
 
 	{
@@ -659,8 +661,16 @@ nm_utils_escaped_tokens_escape_gstr_assert (const char *str,
 	}
 #endif
 
-	g_string_append (gstring, str);
-	return gstring;
+	return str;
+}
+
+static inline void
+nm_utils_escaped_tokens_escape_gstr_assert (const char *str,
+                                            const char *delimiters,
+                                            GString *gstring)
+{
+	g_string_append (gstring,
+	                 nm_utils_escaped_tokens_escape_unnecessary (str, delimiters));
 }
 
 static inline GString *
@@ -996,7 +1006,7 @@ nm_g_set_error_take (GError **error, GError *error_take)
  * NMUtilsError:
  * @NM_UTILS_ERROR_UNKNOWN: unknown or unclassified error
  * @NM_UTILS_ERROR_CANCELLED_DISPOSING: when disposing an object that has
- *   pending aynchronous operations, the operation is cancelled with this
+ *   pending asynchronous operations, the operation is cancelled with this
  *   error reason. Depending on the usage, this might indicate a bug because
  *   usually the target object should stay alive as long as there are pending
  *   operations.
@@ -1455,24 +1465,22 @@ typedef struct {
 	};
 	union {
 		const char *value_str;
-		gconstpointer value_ptr;
+		gpointer value_ptr;
 	};
 } NMUtilsNamedValue;
 
 #define NM_UTILS_NAMED_VALUE_INIT(n, v)     { .name = (n), .value_ptr = (v) }
 
-NMUtilsNamedValue *nm_utils_named_values_from_str_dict_with_sort (GHashTable *hash,
-                                                                  guint *out_len,
-                                                                  GCompareDataFunc compare_func,
-                                                                  gpointer user_data);
+NMUtilsNamedValue *nm_utils_named_values_from_strdict_full (GHashTable *hash,
+                                                            guint *out_len,
+                                                            GCompareDataFunc compare_func,
+                                                            gpointer user_data,
+                                                            NMUtilsNamedValue *provided_buffer,
+                                                            guint provided_buffer_len,
+                                                            NMUtilsNamedValue **out_allocated_buffer);
 
-static inline NMUtilsNamedValue *
-nm_utils_named_values_from_str_dict (GHashTable *hash, guint *out_len)
-{
-	G_STATIC_ASSERT (G_STRUCT_OFFSET (NMUtilsNamedValue, name) == 0);
-
-	return nm_utils_named_values_from_str_dict_with_sort (hash, out_len, nm_strcmp_p_with_data, NULL);
-}
+#define nm_utils_named_values_from_strdict(hash, out_len, array, out_allocated_buffer) \
+	nm_utils_named_values_from_strdict_full ((hash), (out_len), nm_strcmp_p_with_data, NULL, (array), G_N_ELEMENTS (array), (out_allocated_buffer))
 
 gssize nm_utils_named_value_list_find (const NMUtilsNamedValue *arr,
                                        gsize len,
@@ -1734,7 +1742,7 @@ static inline gboolean
 nm_utils_process_state_is_dead (char pstate)
 {
 	/* "/proc/[pid]/stat" returns a state as the 3rd fields (see `man 5 proc`).
-	 * Some of these states indicate the the process is effectively dead (or a zombie).
+	 * Some of these states indicate the process is effectively dead (or a zombie).
 	 */
 	return NM_IN_SET (pstate, 'Z', 'x', 'X');
 }
@@ -1815,6 +1823,17 @@ int nm_utils_getpagesize (void);
 
 /*****************************************************************************/
 
+extern const char _nm_hexchar_table_lower[16];
+extern const char _nm_hexchar_table_upper[16];
+
+static inline char
+nm_hexchar (int x, gboolean upper_case)
+{
+	return   upper_case
+	       ? _nm_hexchar_table_upper[x & 15]
+	       : _nm_hexchar_table_lower[x & 15];
+}
+
 char *nm_utils_bin2hexstr_full (gconstpointer addr,
                                 gsize length,
                                 char delimiter,
@@ -1974,30 +1993,6 @@ void nm_indirect_g_free (gpointer arg);
 
 /*****************************************************************************/
 
-/* nm_utils_get_next_realloc_size() is used to grow buffers exponentially, when
- * the final size is unknown. As such, it has borders for which it allocates
- * certain buffer sizes.
- *
- * The use of these defines is to get favorable allocation sequences.
- * For example, nm_str_buf_init() asks for an initial allocation size. Note that
- * it reserves the exactly requested amount, under the assumption that the
- * user may know how many bytes will be required. However, often the caller
- * doesn't know in advance, and NMStrBuf grows exponentially by calling
- * nm_utils_get_next_realloc_size().
- * Imagine you call nm_str_buf_init() with an initial buffer size 100, and you
- * add one character at a time. Then the first reallocation will increase the
- * buffer size only from 100 to 104.
- * If you however start with an initial buffer size of 104, then the next reallocation
- * via nm_utils_get_next_realloc_size() gives you 232, and so on. By using
- * these sizes, it results in one less allocation, if you anyway don't know the
- * exact size in advance. */
-#define NM_UTILS_GET_NEXT_REALLOC_SIZE_104     ((gsize) 104)
-#define NM_UTILS_GET_NEXT_REALLOC_SIZE_1000    ((gsize) 1000)
-
-gsize nm_utils_get_next_realloc_size (gboolean true_realloc, gsize requested);
-
-/*****************************************************************************/
-
 typedef enum {
 	NMU_IFACE_ANY,
 	NMU_IFACE_KERNEL,
@@ -2073,13 +2068,27 @@ nm_strvarray_set_strv (GArray **array, const char *const*strv)
 
 /*****************************************************************************/
 
+struct _NMVariantAttributeSpec {
+	char *name;
+	const GVariantType *type;
+	bool v4:1;
+	bool v6:1;
+	bool no_value:1;
+	bool consumes_rest:1;
+	char str_type;
+};
+
+typedef struct _NMVariantAttributeSpec NMVariantAttributeSpec;
+
 void _nm_utils_format_variant_attributes_full (GString *str,
                                                const NMUtilsNamedValue *values,
                                                guint num_values,
+                                               const NMVariantAttributeSpec *const *spec,
                                                char attr_separator,
                                                char key_value_separator);
 
 char *_nm_utils_format_variant_attributes (GHashTable *attributes,
+                                           const NMVariantAttributeSpec *const *spec,
                                            char attr_separator,
                                            char key_value_separator);
 
diff --git a/shared/nm-glib-aux/nm-str-buf.h b/shared/nm-glib-aux/nm-str-buf.h
index da082abe67..79de2d738f 100644
--- a/shared/nm-glib-aux/nm-str-buf.h
+++ b/shared/nm-glib-aux/nm-str-buf.h
@@ -85,9 +85,9 @@ nm_str_buf_maybe_expand (NMStrBuf *strbuf,
  * nm_str_buf_set_size:
  * @strbuf: the initialized #NMStrBuf
  * @new_len: the new length
- * @honor_do_bzero_mem: if %TRUE, the shrinked memory will be cleared, if
+ * @honor_do_bzero_mem: if %TRUE, the shrunk memory will be cleared, if
  *   do_bzero_mem is set. This should be usually set to %TRUE, unless
- *   you know that the shrinked memory does not contain data that requires to be
+ *   you know that the shrunk memory does not contain data that requires to be
  *   cleared. When growing the size, this value has no effect.
  * @reserve_exact: when growing the buffer, reserve the exact amount of bytes.
  *   If %FALSE, the buffer may allocate more memory than requested to grow
@@ -211,6 +211,16 @@ nm_str_buf_append_c4 (NMStrBuf *strbuf,
 	strbuf->_priv_str[strbuf->_priv_len++] = ch3;
 }
 
+static inline void
+nm_str_buf_append_c_hex (NMStrBuf *strbuf,
+                         char ch,
+                         gboolean upper_case)
+{
+	nm_str_buf_maybe_expand (strbuf, 3, FALSE);
+	strbuf->_priv_str[strbuf->_priv_len++] = nm_hexchar (((guchar) ch) >> 4, upper_case);
+	strbuf->_priv_str[strbuf->_priv_len++] = nm_hexchar ((guchar) ch, upper_case);
+}
+
 static inline void
 nm_str_buf_append_len (NMStrBuf *strbuf,
                        const char *str,
@@ -225,6 +235,25 @@ nm_str_buf_append_len (NMStrBuf *strbuf,
 	}
 }
 
+static inline char *
+nm_str_buf_append_len0 (NMStrBuf *strbuf,
+                        const char *str,
+                        gsize len)
+{
+	_nm_str_buf_assert (strbuf);
+
+	/* this is basically like nm_str_buf_append_len() and
+	 * nm_str_buf_get_str() in one. */
+
+	nm_str_buf_maybe_expand (strbuf, len + 1u, FALSE);
+	if (len > 0) {
+		memcpy (&strbuf->_priv_str[strbuf->_priv_len], str, len);
+		strbuf->_priv_len += len;
+	}
+	strbuf->_priv_str[strbuf->_priv_len] = '\0';
+	return strbuf->_priv_str;
+}
+
 static inline void
 nm_str_buf_append (NMStrBuf *strbuf,
                    const char *str)
@@ -234,6 +263,15 @@ nm_str_buf_append (NMStrBuf *strbuf,
 	nm_str_buf_append_len (strbuf, str, strlen (str));
 }
 
+static inline char *
+nm_str_buf_append0 (NMStrBuf *strbuf,
+                    const char *str)
+{
+	nm_assert (str);
+
+	return nm_str_buf_append_len0 (strbuf, str, strlen (str));
+}
+
 void nm_str_buf_append_printf (NMStrBuf *strbuf,
                                const char *format,
                                ...) _nm_printf (2, 3);
@@ -248,6 +286,65 @@ nm_str_buf_ensure_trailing_c (NMStrBuf *strbuf, char ch)
 		nm_str_buf_append_c (strbuf, ch);
 }
 
+static inline NMStrBuf *
+nm_str_buf_append_required_delimiter (NMStrBuf *strbuf,
+                                      char delimiter)
+{
+	_nm_str_buf_assert (strbuf);
+
+	/* appends the @delimiter if it is required (that is, if the
+	 * string is not empty). */
+	if (strbuf->len > 0)
+		nm_str_buf_append_c (strbuf, delimiter);
+	return strbuf;
+}
+
+static inline void
+nm_str_buf_reset (NMStrBuf *strbuf,
+                  const char *str)
+{
+	_nm_str_buf_assert (strbuf);
+
+	if (strbuf->_priv_len > 0) {
+		if (strbuf->_priv_do_bzero_mem) {
+			/* we only clear the memory that we wrote to. */
+			nm_explicit_bzero (strbuf->_priv_str, strbuf->_priv_len);
+		}
+		strbuf->_priv_len = 0;
+	}
+
+	if (str)
+		nm_str_buf_append (strbuf, str);
+}
+
+/*****************************************************************************/
+
+/* Calls nm_utils_escaped_tokens_escape() on @str and appends the
+ * result to @strbuf. */
+static inline void
+nm_utils_escaped_tokens_escape_strbuf (const char *str,
+                                       const char *delimiters,
+                                       NMStrBuf *strbuf)
+{
+	gs_free char *str_to_free = NULL;
+
+	nm_assert (str);
+
+	nm_str_buf_append (strbuf,
+	                   nm_utils_escaped_tokens_escape (str, delimiters, &str_to_free));
+}
+
+/* Calls nm_utils_escaped_tokens_escape_unnecessary() on @str and appends the
+ * string to @strbuf. */
+static inline void
+nm_utils_escaped_tokens_escape_strbuf_assert (const char *str,
+                                              const char *delimiters,
+                                              NMStrBuf *strbuf)
+{
+	nm_str_buf_append (strbuf,
+	                   nm_utils_escaped_tokens_escape_unnecessary (str, delimiters));
+}
+
 /*****************************************************************************/
 
 static inline gboolean
@@ -332,6 +429,23 @@ nm_str_buf_finalize (NMStrBuf *strbuf,
 	return g_steal_pointer (&strbuf->_priv_str);
 }
 
+static inline GBytes *
+nm_str_buf_finalize_to_gbytes (NMStrBuf *strbuf)
+{
+	char *s;
+	gsize l;
+
+	/* this always returns a non-NULL, newly allocated GBytes instance.
+	 * The data buffer always has an additional NUL character after
+	 * the data, and the data is allocated with malloc.
+	 *
+	 * That means, the caller who takes ownership of the GBytes can
+	 * safely modify the content of the buffer (including the additional
+	 * NUL sentinel). */
+	s = nm_str_buf_finalize (strbuf, &l);
+	return g_bytes_new_take (s ?: g_new0 (char, 1), l);
+}
+
 /**
  * nm_str_buf_destroy:
  * @strbuf: an initialized #NMStrBuf
diff --git a/shared/nm-glib-aux/tests/meson.build b/shared/nm-glib-aux/tests/meson.build
index f6328db916..8136eff935 100644
--- a/shared/nm-glib-aux/tests/meson.build
+++ b/shared/nm-glib-aux/tests/meson.build
@@ -1,23 +1,43 @@
 # SPDX-License-Identifier: LGPL-2.1+
 
-test_unit = 'test-shared-general'
-
-c_flags = [
-  '-DNETWORKMANAGER_COMPILATION_TEST',
-  '-DNETWORKMANAGER_COMPILATION=(NM_NETWORKMANAGER_COMPILATION_GLIB|NM_NETWORKMANAGER_COMPILATION_WITH_GLIB_I18N_PROG)',
-]
-
 exe = executable(
-  test_unit,
-  test_unit + '.c',
-  c_args: c_flags,
+  'test-shared-general',
+  'test-shared-general.c',
+  c_args: [
+    '-DNETWORKMANAGER_COMPILATION_TEST',
+    '-DNETWORKMANAGER_COMPILATION=(NM_NETWORKMANAGER_COMPILATION_GLIB|NM_NETWORKMANAGER_COMPILATION_WITH_GLIB_I18N_PROG)',
+  ],
   dependencies: libnm_utils_base_dep,
   link_with: libnm_systemd_logging_stub,
 )
 
 test(
-  'shared/nm-glib-aux/' + test_unit,
+  'shared/nm-glib-aux/test-shared-general',
   test_script,
   args: test_args + [exe.full_path()],
   timeout: default_test_timeout,
 )
+
+if jansson_dep.found()
+  exe = executable(
+    'test-json-aux',
+    'test-json-aux.c',
+    c_args: [
+      '-DNETWORKMANAGER_COMPILATION_TEST',
+      '-DNETWORKMANAGER_COMPILATION=(NM_NETWORKMANAGER_COMPILATION_GLIB|NM_NETWORKMANAGER_COMPILATION_WITH_GLIB_I18N_PROG)',
+    ],
+    dependencies: [
+      libnm_utils_base_dep,
+      jansson_dep,
+      dl_dep,
+    ],
+    link_with: libnm_systemd_logging_stub,
+  )
+
+  test(
+    'shared/nm-glib-aux/test-json-aux',
+    test_script,
+    args: test_args + [exe.full_path()],
+    timeout: default_test_timeout,
+  )
+endif
diff --git a/shared/nm-glib-aux/tests/test-json-aux.c b/shared/nm-glib-aux/tests/test-json-aux.c
new file mode 100644
index 0000000000..cde1bef3b0
--- /dev/null
+++ b/shared/nm-glib-aux/tests/test-json-aux.c
@@ -0,0 +1,163 @@
+// SPDX-License-Identifier: LGPL-2.1+
+
+#define NM_TEST_UTILS_NO_LIBNM 1
+
+#include "nm-default.h"
+
+#include <jansson.h>
+
+#include "nm-glib-aux/nm-json-aux.h"
+
+#include "nm-utils/nm-test-utils.h"
+
+/*****************************************************************************/
+
+static void
+test_jansson (void)
+{
+	const NMJsonVt *vt;
+	nm_auto_decref_json nm_json_t *js1 = NULL;
+	nm_auto_decref_json nm_json_t *js2 = NULL;
+
+#define _ASSERT_FIELD(type1, type2, field) \
+	G_STMT_START { \
+		G_STATIC_ASSERT_EXPR (sizeof (((type1 *) NULL)->field) == sizeof (((type2 *) NULL)->field)); \
+		G_STATIC_ASSERT_EXPR (G_STRUCT_OFFSET (type1, field) == G_STRUCT_OFFSET (type2, field)); \
+	} G_STMT_END
+
+	G_STATIC_ASSERT_EXPR (NM_JSON_REJECT_DUPLICATES == JSON_REJECT_DUPLICATES);
+
+	G_STATIC_ASSERT_EXPR (sizeof (nm_json_type) == sizeof (json_type));
+
+	G_STATIC_ASSERT_EXPR ((int) NM_JSON_OBJECT == JSON_OBJECT);
+	G_STATIC_ASSERT_EXPR ((int) NM_JSON_ARRAY == JSON_ARRAY);
+	G_STATIC_ASSERT_EXPR ((int) NM_JSON_STRING == JSON_STRING);
+	G_STATIC_ASSERT_EXPR ((int) NM_JSON_INTEGER == JSON_INTEGER);
+	G_STATIC_ASSERT_EXPR ((int) NM_JSON_REAL == JSON_REAL);
+	G_STATIC_ASSERT_EXPR ((int) NM_JSON_TRUE == JSON_TRUE);
+	G_STATIC_ASSERT_EXPR ((int) NM_JSON_FALSE == JSON_FALSE);
+	G_STATIC_ASSERT_EXPR ((int) NM_JSON_NULL == JSON_NULL);
+
+	G_STATIC_ASSERT_EXPR (sizeof (nm_json_int_t) == sizeof (json_int_t));
+
+	G_STATIC_ASSERT_EXPR (sizeof (nm_json_t) == sizeof (json_t));
+	_ASSERT_FIELD (nm_json_t, json_t, refcount);
+	_ASSERT_FIELD (nm_json_t, json_t, type);
+
+	G_STATIC_ASSERT_EXPR (NM_JSON_ERROR_TEXT_LENGTH == JSON_ERROR_TEXT_LENGTH);
+	G_STATIC_ASSERT_EXPR (NM_JSON_ERROR_SOURCE_LENGTH == JSON_ERROR_SOURCE_LENGTH);
+
+	G_STATIC_ASSERT_EXPR (sizeof (nm_json_error_t) == sizeof (json_error_t));
+	_ASSERT_FIELD (nm_json_error_t, json_error_t, line);
+	_ASSERT_FIELD (nm_json_error_t, json_error_t, column);
+	_ASSERT_FIELD (nm_json_error_t, json_error_t, position);
+	_ASSERT_FIELD (nm_json_error_t, json_error_t, source);
+	_ASSERT_FIELD (nm_json_error_t, json_error_t, text);
+
+	vt = nm_json_vt ();
+
+	g_assert (vt);
+	g_assert (vt->loaded);
+
+	js1 = vt->nm_json_loads ("{ \"a\": 5 }", 0, NULL);
+	g_assert (js1);
+	nm_json_decref (vt, g_steal_pointer (&js1));
+
+	js2 = vt->nm_json_loads ("{ \"a\": 6 }", 0, NULL);
+	g_assert (js2);
+
+#define CHECK_FCN(vt, fcn, nm_type, js_type) \
+	G_STMT_START { \
+		const NMJsonVt *const _vt = (vt); \
+		_nm_unused nm_type = (_vt->nm_##fcn); \
+		_nm_unused js_type = (fcn); \
+		\
+		g_assert (_vt->nm_##fcn); \
+		g_assert (_f_nm); \
+		g_assert (_f_js); \
+		g_assert (_f_nm == _vt->nm_##fcn); \
+	} G_STMT_END
+
+	CHECK_FCN (vt, json_array,
+		nm_json_t *(*_f_nm) (void),
+		   json_t *(*_f_js) (void));
+	CHECK_FCN (vt, json_array_append_new,
+		int (*_f_nm) (nm_json_t *, nm_json_t *),
+		int (*_f_js) (   json_t *,    json_t *));
+	CHECK_FCN (vt, json_array_get,
+		nm_json_t *(*_f_nm) (const nm_json_t *, gsize ),
+		   json_t *(*_f_js) (const    json_t *, size_t));
+	CHECK_FCN (vt, json_array_size,
+		gsize  (*_f_nm) (const nm_json_t *),
+		size_t (*_f_js) (const    json_t *));
+	CHECK_FCN (vt, json_delete,
+		void (*_f_nm) (nm_json_t *),
+		void (*_f_js) (   json_t *));
+	CHECK_FCN (vt, json_dumps,
+		char *(*_f_nm) (const nm_json_t *, gsize ),
+		char *(*_f_js) (const    json_t *, size_t));
+	CHECK_FCN (vt, json_false,
+		nm_json_t *(*_f_nm) (void),
+		   json_t *(*_f_js) (void));
+	CHECK_FCN (vt, json_integer,
+		nm_json_t *(*_f_nm) (nm_json_int_t),
+		   json_t *(*_f_js) (   json_int_t));
+	CHECK_FCN (vt, json_integer_value,
+		nm_json_int_t (*_f_nm) (const nm_json_t *),
+		   json_int_t (*_f_js) (const    json_t *));
+	CHECK_FCN (vt, json_loads,
+		nm_json_t *(*_f_nm) (const char *, gsize , nm_json_error_t *),
+		   json_t *(*_f_js) (const char *, size_t,    json_error_t *));
+	CHECK_FCN (vt, json_object,
+		nm_json_t *(*_f_nm) (void),
+		   json_t *(*_f_js) (void));
+	CHECK_FCN (vt, json_object_del,
+		int (*_f_nm) (nm_json_t *, const char *),
+		int (*_f_js) (   json_t *, const char *));
+	CHECK_FCN (vt, json_object_get,
+		nm_json_t *(*_f_nm) (const nm_json_t *, const char *),
+		   json_t *(*_f_js) (const    json_t *, const char *));
+	CHECK_FCN (vt, json_object_iter,
+		void *(*_f_nm) (nm_json_t *),
+		void *(*_f_js) (   json_t *));
+	CHECK_FCN (vt, json_object_iter_key,
+		const char *(*_f_nm) (void *),
+		const char *(*_f_js) (void *));
+	CHECK_FCN (vt, json_object_iter_next,
+		void *(*_f_nm) (nm_json_t *, void *),
+		void *(*_f_js) (   json_t *, void *));
+	CHECK_FCN (vt, json_object_iter_value,
+		nm_json_t *(*_f_nm) (void *),
+		   json_t *(*_f_js) (void *));
+	CHECK_FCN (vt, json_object_key_to_iter,
+		void *(*_f_nm) (const char *),
+		void *(*_f_js) (const char *));
+	CHECK_FCN (vt, json_object_set_new,
+		int (*_f_nm) (nm_json_t *, const char *, nm_json_t *),
+		int (*_f_js) (   json_t *, const char *,    json_t *));
+	CHECK_FCN (vt, json_object_size,
+		gsize  (*_f_nm) (const nm_json_t *),
+		size_t (*_f_js) (const    json_t *));
+	CHECK_FCN (vt, json_string,
+		nm_json_t *(*_f_nm) (const char *),
+		   json_t *(*_f_js) (const char *));
+	CHECK_FCN (vt, json_string_value,
+		const char *(*_f_nm) (const nm_json_t *),
+		const char *(*_f_js) (const    json_t *));
+	CHECK_FCN (vt, json_true,
+		nm_json_t *(*_f_nm) (void),
+		   json_t *(*_f_js) (void));
+}
+
+/*****************************************************************************/
+
+NMTST_DEFINE ();
+
+int main (int argc, char **argv)
+{
+	nmtst_init (&argc, &argv, TRUE);
+
+	g_test_add_func ("/general/test_jansson", test_jansson);
+
+	return g_test_run ();
+}
diff --git a/shared/nm-glib-aux/tests/test-shared-general.c b/shared/nm-glib-aux/tests/test-shared-general.c
index 5c8bdf18e8..f389770a7a 100644
--- a/shared/nm-glib-aux/tests/test-shared-general.c
+++ b/shared/nm-glib-aux/tests/test-shared-general.c
@@ -636,6 +636,8 @@ test_nm_utils_get_next_realloc_size (void)
 		{  G_MAXSIZE - 24u,      G_MAXSIZE, G_MAXSIZE },
 		{  G_MAXSIZE - 1u,       G_MAXSIZE, G_MAXSIZE },
 		{  G_MAXSIZE,            G_MAXSIZE, G_MAXSIZE },
+		{  NM_UTILS_GET_NEXT_REALLOC_SIZE_32,   NM_UTILS_GET_NEXT_REALLOC_SIZE_32,   NM_UTILS_GET_NEXT_REALLOC_SIZE_32 },
+		{  NM_UTILS_GET_NEXT_REALLOC_SIZE_40,   NM_UTILS_GET_NEXT_REALLOC_SIZE_40,   NM_UTILS_GET_NEXT_REALLOC_SIZE_40 },
 		{  NM_UTILS_GET_NEXT_REALLOC_SIZE_104,  NM_UTILS_GET_NEXT_REALLOC_SIZE_104,  NM_UTILS_GET_NEXT_REALLOC_SIZE_104 },
 		{  NM_UTILS_GET_NEXT_REALLOC_SIZE_1000, NM_UTILS_GET_NEXT_REALLOC_SIZE_1000, NM_UTILS_GET_NEXT_REALLOC_SIZE_1000 },
 	};
@@ -771,6 +773,109 @@ test_nm_str_buf (void)
 
 /*****************************************************************************/
 
+static void
+test_nm_utils_parse_next_line (void)
+{
+	const char *data;
+	const char *data0;
+	gsize data_len;
+	const char *line_start;
+	gsize line_len;
+	int i_run;
+	gsize j, k;
+
+	data = NULL;
+	data_len = 0;
+	g_assert (!nm_utils_parse_next_line (&data, &data_len, &line_start, &line_len));
+
+	for (i_run = 0; i_run < 1000; i_run++) {
+		gs_unref_ptrarray GPtrArray *strv = g_ptr_array_new_with_free_func (g_free);
+		gs_unref_ptrarray GPtrArray *strv2 = g_ptr_array_new_with_free_func (g_free);
+		gsize strv_len = nmtst_get_rand_word_length (NULL);
+		nm_auto_str_buf NMStrBuf strbuf = NM_STR_BUF_INIT (0, nmtst_get_rand_bool ());
+
+		/* create a list of random words. */
+		for (j = 0; j < strv_len; j++) {
+			gsize w_len = nmtst_get_rand_word_length (NULL);
+			NMStrBuf w_buf = NM_STR_BUF_INIT (nmtst_get_rand_uint32 () % (w_len + 1), nmtst_get_rand_bool ());
+
+			for (k = 0; k < w_len; k++)
+				nm_str_buf_append_c (&w_buf, '0' + (k % 10));
+			nm_str_buf_maybe_expand (&w_buf, 1, TRUE);
+			g_ptr_array_add (strv, nm_str_buf_finalize (&w_buf, NULL));
+		}
+
+		/* join the list of random words with (random) line delimiters
+		 * ("\0", "\n", "\r" or EOF). */
+		for (j = 0; j < strv_len; j++) {
+			nm_str_buf_append (&strbuf, strv->pdata[j]);
+again:
+			switch (nmtst_get_rand_uint32 () % 5) {
+			case 0:
+				nm_str_buf_append_c (&strbuf, '\0');
+				break;
+			case 1:
+				if (   strbuf.len > 0
+				    && (nm_str_buf_get_str_unsafe (&strbuf))[strbuf.len - 1] == '\r') {
+					/* the previous line was empty and terminated by "\r". We
+					 * must not join with "\n". Retry. */
+					goto again;
+				}
+				nm_str_buf_append_c (&strbuf, '\n');
+				break;
+			case 2:
+				nm_str_buf_append_c (&strbuf, '\r');
+				break;
+			case 3:
+				nm_str_buf_append (&strbuf, "\r\n");
+				break;
+			case 4:
+				/* the last word randomly is delimited or not, but not if the last
+				 * word is "". */
+				if (j + 1 < strv_len) {
+					/* it's not the last word. Retry. */
+					goto again;
+				}
+				g_assert (j == strv_len - 1);
+				if (((const char *) strv->pdata[j])[0] == '\0') {
+					/* if the last word was "", we need a delimiter (to parse it back).
+					 * Retry. */
+					goto again;
+				}
+				/* The final delimiter gets omitted. It's EOF. */
+				break;
+			}
+		}
+
+		data0 = nm_str_buf_get_str_unsafe (&strbuf);
+		if (   !data0
+		    && nmtst_get_rand_bool ()) {
+			nm_str_buf_maybe_expand (&strbuf, 1, TRUE);
+			data0 = nm_str_buf_get_str_unsafe (&strbuf);
+			g_assert (data0);
+		}
+		data_len = strbuf.len;
+		g_assert ((data_len > 0 && data0) || data_len == 0);
+		data = data0;
+		while (nm_utils_parse_next_line (&data, &data_len, &line_start, &line_len)) {
+			g_assert (line_start);
+			g_assert (line_start >= data0);
+			g_assert (line_start < &data0[strbuf.len]);
+			g_assert (!memchr (line_start, '\0', line_len));
+			g_ptr_array_add (strv2, g_strndup (line_start, line_len));
+		}
+		g_assert (data_len == 0);
+		if (data0)
+			g_assert (data == &data0[strbuf.len]);
+		else
+			g_assert (!data);
+
+		g_assert (_nm_utils_strv_cmp_n ((const char *const*) strv->pdata, strv->len, (const char *const*) strv2->pdata, strv2->len) == 0);
+	}
+}
+
+/*****************************************************************************/
+
 NMTST_DEFINE ();
 
 int main (int argc, char **argv)
@@ -792,6 +897,7 @@ int main (int argc, char **argv)
 	g_test_add_func ("/general/test_string_table_lookup", test_string_table_lookup);
 	g_test_add_func ("/general/test_nm_utils_get_next_realloc_size", test_nm_utils_get_next_realloc_size);
 	g_test_add_func ("/general/test_nm_str_buf", test_nm_str_buf);
+	g_test_add_func ("/general/test_nm_utils_parse_next_line", test_nm_utils_parse_next_line);
 
 	return g_test_run ();
 }
diff --git a/shared/nm-std-aux/nm-std-aux.h b/shared/nm-std-aux/nm-std-aux.h
new file mode 100644
index 0000000000..26317c2c27
--- /dev/null
+++ b/shared/nm-std-aux/nm-std-aux.h
@@ -0,0 +1,621 @@
+// SPDX-License-Identifier: LGPL-2.1+
+
+#ifndef __NM_STD_AUX_H__
+#define __NM_STD_AUX_H__
+
+#include <assert.h>
+#include <string.h>
+#include <stdbool.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <errno.h>
+
+/*****************************************************************************/
+
+#define _nm_packed           __attribute__ ((__packed__))
+#define _nm_unused           __attribute__ ((__unused__))
+#define _nm_used             __attribute__ ((__used__))
+#define _nm_pure             __attribute__ ((__pure__))
+#define _nm_const            __attribute__ ((__const__))
+#define _nm_printf(a,b)      __attribute__ ((__format__ (__printf__, a, b)))
+#define _nm_align(s)         __attribute__ ((__aligned__ (s)))
+#define _nm_section(s)       __attribute__ ((__section__ (s)))
+#define _nm_alignof(type)    __alignof (type)
+#define _nm_alignas(type)    _nm_align (_nm_alignof (type))
+#define nm_auto(fcn)         __attribute__ ((__cleanup__(fcn)))
+
+/* This is required to make LTO working.
+ *
+ * See https://gitlab.freedesktop.org/NetworkManager/NetworkManager/merge_requests/76#note_112694
+ *     https://gcc.gnu.org/bugzilla/show_bug.cgi?id=48200#c28
+ */
+#ifndef __clang__
+#define _nm_externally_visible __attribute__ ((__externally_visible__))
+#else
+#define _nm_externally_visible
+#endif
+
+
+#if __GNUC__ >= 7
+#define _nm_fallthrough      __attribute__ ((__fallthrough__))
+#else
+#define _nm_fallthrough
+#endif
+
+/*****************************************************************************/
+
+#ifdef thread_local
+#define _nm_thread_local thread_local
+/*
+ * Don't break on glibc < 2.16 that doesn't define __STDC_NO_THREADS__
+ * see http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53769
+ */
+#elif __STDC_VERSION__ >= 201112L && !(defined(__STDC_NO_THREADS__) || (defined(__GNU_LIBRARY__) && __GLIBC__ == 2 && __GLIBC_MINOR__ < 16))
+#define _nm_thread_local _Thread_local
+#else
+#define _nm_thread_local __thread
+#endif
+
+/*****************************************************************************/
+
+#define NM_PASTE_ARGS(identifier1,identifier2) identifier1 ## identifier2
+#define NM_PASTE(identifier1,identifier2)      NM_PASTE_ARGS (identifier1, identifier2)
+
+/* Taken from systemd's UNIQ_T and UNIQ macros. */
+
+#define NM_UNIQ_T(x, uniq) NM_PASTE(__unique_prefix_, NM_PASTE(x, uniq))
+#define NM_UNIQ __COUNTER__
+
+/*****************************************************************************/
+
+#define _NM_BOOLEAN_EXPR_IMPL(v, expr) \
+	({ \
+		int NM_UNIQ_T(V, v); \
+		\
+		if (expr) \
+			NM_UNIQ_T(V, v) = 1; \
+		else \
+			NM_UNIQ_T(V, v) = 0; \
+		NM_UNIQ_T(V, v); \
+	})
+#define NM_BOOLEAN_EXPR(expr) _NM_BOOLEAN_EXPR_IMPL (NM_UNIQ, expr)
+
+#if defined(__GNUC__) && (__GNUC__ > 2) && defined(__OPTIMIZE__)
+#define NM_LIKELY(expr)   (__builtin_expect (NM_BOOLEAN_EXPR (expr), 1))
+#define NM_UNLIKELY(expr) (__builtin_expect (NM_BOOLEAN_EXPR (expr), 0))
+#else
+#define NM_LIKELY(expr)   NM_BOOLEAN_EXPR (expr)
+#define NM_UNLIKELY(expr) NM_BOOLEAN_EXPR (expr)
+#endif
+
+/*****************************************************************************/
+
+/* glib/C provides the following kind of assertions:
+ *   - assert() -- disable with NDEBUG
+ *   - g_return_if_fail() -- disable with G_DISABLE_CHECKS
+ *   - g_assert() -- disable with G_DISABLE_ASSERT
+ * but they are all enabled by default and usually even production builds have
+ * these kind of assertions enabled. It also means, that disabling assertions
+ * is an untested configuration, and might have bugs.
+ *
+ * Add our own assertion macro nm_assert(), which is disabled by default and must
+ * be explicitly enabled. They are useful for more expensive checks or checks that
+ * depend less on runtime conditions (that is, are generally expected to be true). */
+
+#ifndef NM_MORE_ASSERTS
+#define NM_MORE_ASSERTS 0
+#endif
+
+#ifndef _nm_assert_call
+#define _nm_assert_call(cond)             assert(cond)
+#define _nm_assert_call_not_reached()     assert(0)
+#endif
+
+#if NM_MORE_ASSERTS
+#define nm_assert(cond)         do { _nm_assert_call (cond); } while (0)
+#define nm_assert_se(cond)      do { if (NM_LIKELY (cond)) { ; } else { _nm_assert_call (0 && (cond)); } } while (0)
+#define nm_assert_not_reached() do { _nm_assert_call_not_reached (); } while (0)
+#else
+#define nm_assert(cond)         do { if (0) { if (cond) { } } } while (0)
+#define nm_assert_se(cond)      do { if (NM_LIKELY (cond)) { ; } } while (0)
+#define nm_assert_not_reached() do { ; } while (0)
+#endif
+
+#define NM_STATIC_ASSERT(cond)      static_assert(cond, "")
+#define NM_STATIC_ASSERT_EXPR(cond) ({ NM_STATIC_ASSERT (cond); 1; })
+
+/*****************************************************************************/
+
+#define NM_N_ELEMENTS(arr)  (sizeof (arr) / sizeof ((arr)[0]))
+
+/*****************************************************************************/
+
+/* glib's MIN()/MAX() macros don't have function-like behavior, in that they evaluate
+ * the argument possibly twice.
+ *
+ * Taken from systemd's MIN()/MAX() macros. */
+
+#define NM_MIN(a, b) __NM_MIN(NM_UNIQ, a, NM_UNIQ, b)
+#define __NM_MIN(aq, a, bq, b) \
+	({ \
+		typeof (a) NM_UNIQ_T(A, aq) = (a); \
+		typeof (b) NM_UNIQ_T(B, bq) = (b); \
+		((NM_UNIQ_T(A, aq) < NM_UNIQ_T(B, bq)) ? NM_UNIQ_T(A, aq) : NM_UNIQ_T(B, bq)); \
+	})
+
+#define NM_MAX(a, b) __NM_MAX(NM_UNIQ, a, NM_UNIQ, b)
+#define __NM_MAX(aq, a, bq, b) \
+	({ \
+		typeof (a) NM_UNIQ_T(A, aq) = (a); \
+		typeof (b) NM_UNIQ_T(B, bq) = (b); \
+		((NM_UNIQ_T(A, aq) > NM_UNIQ_T(B, bq)) ? NM_UNIQ_T(A, aq) : NM_UNIQ_T(B, bq)); \
+	})
+
+#define NM_CLAMP(x, low, high) __NM_CLAMP(NM_UNIQ, x, NM_UNIQ, low, NM_UNIQ, high)
+#define __NM_CLAMP(xq, x, lowq, low, highq, high) \
+	({ \
+		typeof(x)NM_UNIQ_T(X,xq) = (x); \
+		typeof(low) NM_UNIQ_T(LOW,lowq) = (low); \
+		typeof(high) NM_UNIQ_T(HIGH,highq) = (high); \
+		\
+		( (NM_UNIQ_T(X,xq) > NM_UNIQ_T(HIGH,highq)) \
+		  ? NM_UNIQ_T(HIGH,highq) \
+		  : (NM_UNIQ_T(X,xq) < NM_UNIQ_T(LOW,lowq)) \
+		     ? NM_UNIQ_T(LOW,lowq) \
+		     : NM_UNIQ_T(X,xq)); \
+	})
+
+#define NM_MAX_WITH_CMP(cmp, a, b) \
+	({ \
+		typeof (a) _a = (a); \
+		typeof (b) _b = (b); \
+		\
+		(  ((cmp (_a, _b)) >= 0) \
+		 ? _a \
+		 : _b); \
+	})
+
+/* evaluates to (void) if _A or _B are not constant or of different types */
+#define NM_CONST_MAX(_A, _B) \
+	(__builtin_choose_expr ((   __builtin_constant_p (_A) \
+	                         && __builtin_constant_p (_B) \
+	                         && __builtin_types_compatible_p (typeof (_A), typeof (_B))), \
+	                        ((_A) > (_B)) ? (_A) : (_B),                            \
+	                        ((void)  0)))
+
+/*****************************************************************************/
+
+#define NM_SWAP(a, b) \
+	do { \
+		typeof (a) _tmp; \
+		\
+		_tmp = (a); \
+		(a) = (b); \
+		(b) = _tmp; \
+	} while (0)
+
+/*****************************************************************************/
+
+/* macro to return strlen() of a compile time string. */
+#define NM_STRLEN(str)     ( sizeof (""str"") - 1u )
+
+/* returns the length of a NULL terminated array of pointers,
+ * like g_strv_length() does. The difference is:
+ *  - it operates on arrays of pointers (of any kind, requiring no cast).
+ *  - it accepts NULL to return zero. */
+#define NM_PTRARRAY_LEN(array) \
+	({ \
+		typeof (*(array)) *const _array = (array); \
+		size_t _n = 0; \
+		\
+		if (_array) { \
+			_nm_unused const void * _type_check_is_pointer = _array[0]; \
+			\
+			while (_array[_n]) \
+				_n++; \
+		} \
+		_n; \
+	})
+
+/*****************************************************************************/
+
+static inline int
+nm_strcmp0 (const char *s1, const char *s2)
+{
+	int c;
+
+	/* like g_strcmp0(), but this is inlinable.
+	 *
+	 * Also, it is guaranteed to return either -1, 0, or 1. */
+	if (s1 == s2)
+		return 0;
+	if (!s1)
+		return -1;
+	if (!s2)
+		return 1;
+	c = strcmp (s1, s2);
+	if (c < 0)
+		return -1;
+	if (c > 0)
+		return 1;
+	return 0;
+}
+
+static inline int
+nm_streq (const char *s1, const char *s2)
+{
+	return strcmp (s1, s2) == 0;
+}
+
+static inline int
+nm_streq0 (const char *s1, const char *s2)
+{
+	return    (s1 == s2)
+	       || (s1 && s2 && strcmp (s1, s2) == 0);
+}
+
+#define NM_STR_HAS_PREFIX(str, prefix) \
+	({ \
+		const char *const _str_has_prefix = (str); \
+		\
+		nm_assert (strlen (prefix) == NM_STRLEN (prefix)); \
+		\
+		   _str_has_prefix \
+		&& (strncmp (_str_has_prefix, ""prefix"", NM_STRLEN (prefix)) == 0); \
+	})
+
+#define NM_STR_HAS_SUFFIX(str, suffix) \
+	({ \
+		const char *const _str_has_suffix = (str); \
+		size_t _l; \
+		\
+		nm_assert (strlen (suffix) == NM_STRLEN (suffix)); \
+		\
+		(   _str_has_suffix \
+		 && ((_l = strlen (_str_has_suffix)) >= NM_STRLEN (suffix)) \
+		 && (memcmp (&_str_has_suffix[_l - NM_STRLEN (suffix)], \
+		             ""suffix"", \
+		             NM_STRLEN (suffix)) == 0)); \
+	})
+
+/* whether @str starts with the string literal @prefix and is followed by
+ * some other text. It is like NM_STR_HAS_PREFIX() && !nm_streq() together. */
+#define NM_STR_HAS_PREFIX_WITH_MORE(str, prefix) \
+	({ \
+		const char *const _str_has_prefix_with_more = (str); \
+		\
+		   NM_STR_HAS_PREFIX (_str_has_prefix_with_more, ""prefix"") \
+		&& _str_has_prefix_with_more[NM_STRLEN (prefix)] != '\0'; \
+	})
+
+/*****************************************************************************/
+
+#define _NM_IN_SET_EVAL_1( op, _x, y)           (_x == (y))
+#define _NM_IN_SET_EVAL_2( op, _x, y, ...)      (_x == (y)) op _NM_IN_SET_EVAL_1  (op, _x, __VA_ARGS__)
+#define _NM_IN_SET_EVAL_3( op, _x, y, ...)      (_x == (y)) op _NM_IN_SET_EVAL_2  (op, _x, __VA_ARGS__)
+#define _NM_IN_SET_EVAL_4( op, _x, y, ...)      (_x == (y)) op _NM_IN_SET_EVAL_3  (op, _x, __VA_ARGS__)
+#define _NM_IN_SET_EVAL_5( op, _x, y, ...)      (_x == (y)) op _NM_IN_SET_EVAL_4  (op, _x, __VA_ARGS__)
+#define _NM_IN_SET_EVAL_6( op, _x, y, ...)      (_x == (y)) op _NM_IN_SET_EVAL_5  (op, _x, __VA_ARGS__)
+#define _NM_IN_SET_EVAL_7( op, _x, y, ...)      (_x == (y)) op _NM_IN_SET_EVAL_6  (op, _x, __VA_ARGS__)
+#define _NM_IN_SET_EVAL_8( op, _x, y, ...)      (_x == (y)) op _NM_IN_SET_EVAL_7  (op, _x, __VA_ARGS__)
+#define _NM_IN_SET_EVAL_9( op, _x, y, ...)      (_x == (y)) op _NM_IN_SET_EVAL_8  (op, _x, __VA_ARGS__)
+#define _NM_IN_SET_EVAL_10(op, _x, y, ...)      (_x == (y)) op _NM_IN_SET_EVAL_9  (op, _x, __VA_ARGS__)
+#define _NM_IN_SET_EVAL_11(op, _x, y, ...)      (_x == (y)) op _NM_IN_SET_EVAL_10 (op, _x, __VA_ARGS__)
+#define _NM_IN_SET_EVAL_12(op, _x, y, ...)      (_x == (y)) op _NM_IN_SET_EVAL_11 (op, _x, __VA_ARGS__)
+#define _NM_IN_SET_EVAL_13(op, _x, y, ...)      (_x == (y)) op _NM_IN_SET_EVAL_12 (op, _x, __VA_ARGS__)
+#define _NM_IN_SET_EVAL_14(op, _x, y, ...)      (_x == (y)) op _NM_IN_SET_EVAL_13 (op, _x, __VA_ARGS__)
+#define _NM_IN_SET_EVAL_15(op, _x, y, ...)      (_x == (y)) op _NM_IN_SET_EVAL_14 (op, _x, __VA_ARGS__)
+#define _NM_IN_SET_EVAL_16(op, _x, y, ...)      (_x == (y)) op _NM_IN_SET_EVAL_15 (op, _x, __VA_ARGS__)
+
+#define _NM_IN_SET_EVAL_N2(op, _x, n, ...)      (_NM_IN_SET_EVAL_##n(op, _x, __VA_ARGS__))
+#define _NM_IN_SET_EVAL_N(op, type, x, n, ...)                      \
+    ({                                                              \
+        type _x = (x);                                              \
+                                                                    \
+        /* trigger a -Wenum-compare warning */                      \
+        nm_assert (true || _x == (x));                              \
+                                                                    \
+        !!_NM_IN_SET_EVAL_N2(op, _x, n, __VA_ARGS__);               \
+    })
+
+#define _NM_IN_SET(op, type, x, ...)        _NM_IN_SET_EVAL_N(op, type, x, NM_NARG (__VA_ARGS__), __VA_ARGS__)
+
+/* Beware that this does short-circuit evaluation (use "||" instead of "|")
+ * which has a possibly unexpected non-function-like behavior.
+ * Use NM_IN_SET_SE if you need all arguments to be evaluated. */
+#define NM_IN_SET(x, ...)                   _NM_IN_SET(||, typeof (x), x, __VA_ARGS__)
+
+/* "SE" stands for "side-effect". Contrary to NM_IN_SET(), this does not do
+ * short-circuit evaluation, which can make a difference if the arguments have
+ * side-effects. */
+#define NM_IN_SET_SE(x, ...)                _NM_IN_SET(|,  typeof (x), x, __VA_ARGS__)
+
+/* the *_TYPED forms allow to explicitly select the type of "x". This is useful
+ * if "x" doesn't support typeof (bitfields) or you want to gracefully convert
+ * a type using automatic type conversion rules (but not forcing the conversion
+ * with a cast). */
+#define NM_IN_SET_TYPED(type, x, ...)       _NM_IN_SET(||, type,       x, __VA_ARGS__)
+#define NM_IN_SET_SE_TYPED(type, x, ...)    _NM_IN_SET(|,  type,       x, __VA_ARGS__)
+
+/*****************************************************************************/
+
+static inline int
+_NM_IN_STRSET_streq (const char *x, const char *s)
+{
+	return s && strcmp (x, s) == 0;
+}
+
+#define _NM_IN_STRSET_EVAL_1( op, _x, y)        _NM_IN_STRSET_streq (_x, y)
+#define _NM_IN_STRSET_EVAL_2( op, _x, y, ...)   _NM_IN_STRSET_streq (_x, y) op _NM_IN_STRSET_EVAL_1  (op, _x, __VA_ARGS__)
+#define _NM_IN_STRSET_EVAL_3( op, _x, y, ...)   _NM_IN_STRSET_streq (_x, y) op _NM_IN_STRSET_EVAL_2  (op, _x, __VA_ARGS__)
+#define _NM_IN_STRSET_EVAL_4( op, _x, y, ...)   _NM_IN_STRSET_streq (_x, y) op _NM_IN_STRSET_EVAL_3  (op, _x, __VA_ARGS__)
+#define _NM_IN_STRSET_EVAL_5( op, _x, y, ...)   _NM_IN_STRSET_streq (_x, y) op _NM_IN_STRSET_EVAL_4  (op, _x, __VA_ARGS__)
+#define _NM_IN_STRSET_EVAL_6( op, _x, y, ...)   _NM_IN_STRSET_streq (_x, y) op _NM_IN_STRSET_EVAL_5  (op, _x, __VA_ARGS__)
+#define _NM_IN_STRSET_EVAL_7( op, _x, y, ...)   _NM_IN_STRSET_streq (_x, y) op _NM_IN_STRSET_EVAL_6  (op, _x, __VA_ARGS__)
+#define _NM_IN_STRSET_EVAL_8( op, _x, y, ...)   _NM_IN_STRSET_streq (_x, y) op _NM_IN_STRSET_EVAL_7  (op, _x, __VA_ARGS__)
+#define _NM_IN_STRSET_EVAL_9( op, _x, y, ...)   _NM_IN_STRSET_streq (_x, y) op _NM_IN_STRSET_EVAL_8  (op, _x, __VA_ARGS__)
+#define _NM_IN_STRSET_EVAL_10(op, _x, y, ...)   _NM_IN_STRSET_streq (_x, y) op _NM_IN_STRSET_EVAL_9  (op, _x, __VA_ARGS__)
+#define _NM_IN_STRSET_EVAL_11(op, _x, y, ...)   _NM_IN_STRSET_streq (_x, y) op _NM_IN_STRSET_EVAL_10 (op, _x, __VA_ARGS__)
+#define _NM_IN_STRSET_EVAL_12(op, _x, y, ...)   _NM_IN_STRSET_streq (_x, y) op _NM_IN_STRSET_EVAL_11 (op, _x, __VA_ARGS__)
+#define _NM_IN_STRSET_EVAL_13(op, _x, y, ...)   _NM_IN_STRSET_streq (_x, y) op _NM_IN_STRSET_EVAL_12 (op, _x, __VA_ARGS__)
+#define _NM_IN_STRSET_EVAL_14(op, _x, y, ...)   _NM_IN_STRSET_streq (_x, y) op _NM_IN_STRSET_EVAL_13 (op, _x, __VA_ARGS__)
+#define _NM_IN_STRSET_EVAL_15(op, _x, y, ...)   _NM_IN_STRSET_streq (_x, y) op _NM_IN_STRSET_EVAL_14 (op, _x, __VA_ARGS__)
+#define _NM_IN_STRSET_EVAL_16(op, _x, y, ...)   _NM_IN_STRSET_streq (_x, y) op _NM_IN_STRSET_EVAL_15 (op, _x, __VA_ARGS__)
+
+#define _NM_IN_STRSET_EVAL_N2(op, _x, n, ...)   (_NM_IN_STRSET_EVAL_##n(op, _x, __VA_ARGS__))
+#define _NM_IN_STRSET_EVAL_N(op, x, n, ...)                       \
+    ({                                                            \
+        const char *_x = (x);                                     \
+        (   ((_x == NULL) && _NM_IN_SET_EVAL_N2    (op, ((const char *) NULL), n, __VA_ARGS__)) \
+         || ((_x != NULL) && _NM_IN_STRSET_EVAL_N2 (op, _x,                    n, __VA_ARGS__)) \
+        ); \
+    })
+
+/* Beware that this does short-circuit evaluation (use "||" instead of "|")
+ * which has a possibly unexpected non-function-like behavior.
+ * Use NM_IN_STRSET_SE if you need all arguments to be evaluated. */
+#define NM_IN_STRSET(x, ...)               _NM_IN_STRSET_EVAL_N(||, x, NM_NARG (__VA_ARGS__), __VA_ARGS__)
+
+/* "SE" stands for "side-effect". Contrary to NM_IN_STRSET(), this does not do
+ * short-circuit evaluation, which can make a difference if the arguments have
+ * side-effects. */
+#define NM_IN_STRSET_SE(x, ...)            _NM_IN_STRSET_EVAL_N(|, x, NM_NARG (__VA_ARGS__), __VA_ARGS__)
+
+/*****************************************************************************/
+
+#define NM_STRCHAR_ALL(str, ch_iter, predicate) \
+	({ \
+		int _val = true; \
+		const char *_str = (str); \
+		\
+		if (_str) { \
+			for (;;) { \
+				const char ch_iter = _str[0]; \
+				\
+				if (ch_iter != '\0') { \
+					if (predicate) {\
+						_str++; \
+						continue; \
+					} \
+					_val = false; \
+				} \
+				break; \
+			} \
+		} \
+		_val; \
+	})
+
+#define NM_STRCHAR_ANY(str, ch_iter, predicate) \
+	({ \
+		int _val = false; \
+		const char *_str = (str); \
+		\
+		if (_str) { \
+			for (;;) { \
+				const char ch_iter = _str[0]; \
+				\
+				if (ch_iter != '\0') { \
+					if (predicate) { \
+						; \
+					} else { \
+						_str++; \
+						continue; \
+					} \
+					_val = true; \
+				} \
+				break; \
+			} \
+		} \
+		_val; \
+	})
+
+/*****************************************************************************/
+
+/**
+ * nm_close:
+ *
+ * Like close() but throws an assertion if the input fd is
+ * invalid.  Closing an invalid fd is a programming error, so
+ * it's better to catch it early.
+ */
+static inline int
+nm_close (int fd)
+{
+	int r;
+
+	r = close (fd);
+	nm_assert (r != -1 || fd < 0 || errno != EBADF);
+	return r;
+}
+
+/*****************************************************************************/
+
+/* Note: @value is only evaluated when *out_val is present.
+ * Thus,
+ *    NM_SET_OUT (out_str, g_strdup ("hallo"));
+ * does the right thing.
+ */
+#define NM_SET_OUT(out_val, value) \
+	({ \
+		typeof(*(out_val)) *_out_val = (out_val); \
+		\
+		if (_out_val) { \
+			*_out_val = (value); \
+		} \
+		\
+		(!!_out_val); \
+	})
+
+/*****************************************************************************/
+
+#define NM_AUTO_DEFINE_FCN_VOID(CastType, name, func) \
+static inline void name (void *v) \
+{ \
+	func (*((CastType *) v)); \
+}
+
+#define NM_AUTO_DEFINE_FCN_VOID0(CastType, name, func) \
+static inline void name (void *v) \
+{ \
+	if (*((CastType *) v)) \
+		func (*((CastType *) v)); \
+}
+
+#define NM_AUTO_DEFINE_FCN(Type, name, func) \
+static inline void name (Type *v) \
+{ \
+	func (*v); \
+}
+
+#define NM_AUTO_DEFINE_FCN0(Type, name, func) \
+static inline void name (Type *v) \
+{ \
+	if (*v) \
+		func (*v); \
+}
+
+/*****************************************************************************/
+
+/**
+ * nm_auto_free:
+ *
+ * Call free() on a variable location when it goes out of scope.
+ * This is for pointers that are allocated with malloc() instead of
+ * g_malloc().
+ *
+ * In practice, since glib 2.45, g_malloc()/g_free() always wraps malloc()/free().
+ * See bgo#751592. In that case, it would be safe to free pointers allocated with
+ * malloc() with gs_free or g_free().
+ *
+ * However, let's never mix them. To free malloc'ed memory, always use
+ * free() or nm_auto_free.
+ */
+NM_AUTO_DEFINE_FCN_VOID0 (void *, _nm_auto_free_impl, free)
+#define nm_auto_free nm_auto(_nm_auto_free_impl)
+
+/*****************************************************************************/
+
+static inline void
+_nm_auto_close (int *pfd)
+{
+	if (*pfd >= 0) {
+		int errsv = errno;
+
+		(void) nm_close (*pfd);
+		errno = errsv;
+	}
+}
+#define nm_auto_close nm_auto(_nm_auto_close)
+
+static inline void
+_nm_auto_fclose (FILE **pfd)
+{
+	if (*pfd) {
+		int errsv = errno;
+
+		(void) fclose (*pfd);
+		errno = errsv;
+	}
+}
+#define nm_auto_fclose nm_auto(_nm_auto_fclose)
+
+/*****************************************************************************/
+
+#define nm_clear_pointer(pp, destroy) \
+	({ \
+		typeof (*(pp)) *_pp = (pp); \
+		typeof (*_pp) _p; \
+		int _changed = false; \
+		\
+		if (   _pp \
+		    && (_p = *_pp)) { \
+			_nm_unused const void *_p_check_is_pointer = _p; \
+			\
+			*_pp = NULL; \
+			\
+			/* g_clear_pointer() assigns @destroy first to a local variable, so that
+			 * you can call "g_clear_pointer (pp, (GDestroyNotify) destroy);" without
+			 * gcc emitting a warning. We don't do that, hence, you cannot cast
+			 * "destroy" first.
+			 *
+			 * On the upside: you are not supposed to cast fcn, because the pointer
+			 * types are preserved. If you really need a cast, you should cast @pp.
+			 * But that is hardly ever necessary. */ \
+			(destroy) (_p); \
+			\
+			_changed = true; \
+		} \
+		_changed; \
+	})
+
+#define nm_clear_free(pp) nm_clear_pointer (pp, free)
+
+/*****************************************************************************/
+
+static inline void *
+_nm_steal_pointer (void *pp)
+{
+	void **ptr = (void **) pp;
+	void *ref;
+
+	ref = *ptr;
+	*ptr = NULL;
+	return ref;
+}
+
+#define nm_steal_pointer(pp) \
+	((typeof (*(pp))) _nm_steal_pointer (pp))
+
+/**
+ * nm_steal_int:
+ * @p_val: pointer to an int type.
+ *
+ * Returns: *p_val and sets *p_val to zero the same time.
+ *   Accepts %NULL, in which case also numeric 0 will be returned.
+ */
+#define nm_steal_int(p_val) \
+	({ \
+		typeof (p_val) const _p_val = (p_val); \
+		typeof (*_p_val) _val = 0; \
+		\
+		if (   _p_val \
+		    && (_val = *_p_val)) { \
+			*_p_val = 0; \
+		} \
+		_val; \
+	})
+
+static inline int
+nm_steal_fd (int *p_fd)
+{
+	int fd;
+
+	if (   p_fd
+	    && ((fd = *p_fd) >= 0)) {
+		*p_fd = -1;
+		return fd;
+	}
+	return -1;
+}
+
+#endif /* __NM_STD_AUX_H__ */
diff --git a/shared/nm-std-aux/nm-std-utils.c b/shared/nm-std-aux/nm-std-utils.c
new file mode 100644
index 0000000000..f6c2bc43ff
--- /dev/null
+++ b/shared/nm-std-aux/nm-std-utils.c
@@ -0,0 +1,76 @@
+// SPDX-License-Identifier: LGPL-2.1+
+
+#include "nm-default.h"
+
+#include "nm-std-utils.h"
+
+#include <stdint.h>
+
+/*****************************************************************************/
+
+size_t
+nm_utils_get_next_realloc_size (bool true_realloc, size_t requested)
+{
+	size_t n, x;
+
+	/* https://doc.qt.io/qt-5/containers.html#growth-strategies */
+
+	if (requested <= 40) {
+		/* small allocations. Increase in small steps of 8 bytes.
+		 *
+		 * We get thus sizes of 8, 16, 32, 40. */
+		if (requested <= 8)
+			return 8;
+		if (requested <= 16)
+			return 16;
+		if (requested <= 32)
+			return 32;
+
+		/* The return values for < 104 are essentially hard-coded, and the choice here is
+		 * made without very strong reasons.
+		 *
+		 * We want to stay 24 bytes below the power-of-two border 64. Hence, return 40 here.
+		 * However, the next step then is already 104 (128 - 24). It's a larger gap than in
+		 * the steps before.
+		 *
+		 * It's not clear whether some of the steps should be adjusted (or how exactly). */
+		return 40;
+	}
+
+	if (   requested <= 0x2000u - 24u
+	    || NM_UNLIKELY (!true_realloc)) {
+		/* mid sized allocations. Return next power of two, minus 24 bytes extra space
+		 * at the beginning.
+		 * That means, we double the size as we grow.
+		 *
+		 * With !true_realloc, it means that the caller does not intend to call
+		 * realloc() but instead clone the buffer. This is for example the case, when we
+		 * want to nm_explicit_bzero() the old buffer. In that case we really want to grow
+		 * the buffer exponentially every time and not increment in page sizes of 4K (below).
+		 *
+		 * We get thus sizes of 104, 232, 488, 1000, 2024, 4072, 8168... */
+
+		if (NM_UNLIKELY (requested > SIZE_MAX / 2u - 24u))
+			return SIZE_MAX;
+
+		x = requested + 24u;
+		n = 128u;
+		while (n < x) {
+			n <<= 1;
+			nm_assert (n > 128u);
+		}
+
+		nm_assert (n > 24u && n - 24u >= requested);
+		return n - 24u;
+	}
+
+	if (NM_UNLIKELY (requested > SIZE_MAX - 0x1000u - 24u))
+		return SIZE_MAX;
+
+	/* For large allocations (with !true_realloc) we allocate memory in chunks of
+	 * 4K (- 24 bytes extra), assuming that the memory gets mmapped and thus
+	 * realloc() is efficient by just reordering pages. */
+	n = ((requested + (0x0FFFu + 24u)) & ~((size_t) 0x0FFFu)) - 24u;
+	nm_assert (n >= requested);
+	return n;
+}
diff --git a/shared/nm-std-aux/nm-std-utils.h b/shared/nm-std-aux/nm-std-utils.h
new file mode 100644
index 0000000000..0945c8600f
--- /dev/null
+++ b/shared/nm-std-aux/nm-std-utils.h
@@ -0,0 +1,36 @@
+// SPDX-License-Identifier: LGPL-2.1+
+
+#ifndef __NM_STD_UTILS_H__
+#define __NM_STD_UTILS_H__
+
+#include <stdbool.h>
+
+#include "nm-std-aux.h"
+
+/*****************************************************************************/
+
+/* nm_utils_get_next_realloc_size() is used to grow buffers exponentially, when
+ * the final size is unknown. As such, it has borders for which it allocates
+ * certain buffer sizes.
+ *
+ * The use of these defines is to get favorable allocation sequences.
+ * For example, nm_str_buf_init() asks for an initial allocation size. Note that
+ * it reserves the exactly requested amount, under the assumption that the
+ * user may know how many bytes will be required. However, often the caller
+ * doesn't know in advance, and NMStrBuf grows exponentially by calling
+ * nm_utils_get_next_realloc_size().
+ * Imagine you call nm_str_buf_init() with an initial buffer size 100, and you
+ * add one character at a time. Then the first reallocation will increase the
+ * buffer size only from 100 to 104.
+ * If you however start with an initial buffer size of 104, then the next reallocation
+ * via nm_utils_get_next_realloc_size() gives you 232, and so on. By using
+ * these sizes, it results in one less allocation, if you anyway don't know the
+ * exact size in advance. */
+#define NM_UTILS_GET_NEXT_REALLOC_SIZE_32      ((size_t) 32)
+#define NM_UTILS_GET_NEXT_REALLOC_SIZE_40      ((size_t) 40)
+#define NM_UTILS_GET_NEXT_REALLOC_SIZE_104     ((size_t) 104)
+#define NM_UTILS_GET_NEXT_REALLOC_SIZE_1000    ((size_t) 1000)
+
+size_t nm_utils_get_next_realloc_size (bool true_realloc, size_t requested);
+
+#endif /* __NM_STD_UTILS_H__ */
diff --git a/shared/nm-test-utils-impl.c b/shared/nm-test-utils-impl.c
index ce7cc8d179..b63140c425 100644
--- a/shared/nm-test-utils-impl.c
+++ b/shared/nm-test-utils-impl.c
@@ -604,7 +604,7 @@ nmtstc_context_object_new_valist (GType gtype,
 		sync = TRUE;
 		inside_loop = FALSE;
 	} else {
-		/* The caller allows to iterate the main context. That that point,
+		/* The caller allows to iterate the main context. On that point,
 		 * we can both use the synchronous and the asynchronous initialization,
 		 * both should yield the same result. Choose one randomly. */
 		sync = nmtst_get_rand_bool ();
diff --git a/shared/nm-version-macros.h.in b/shared/nm-version-macros.h.in
index 83da86ce10..c4d6efbcbe 100644
--- a/shared/nm-version-macros.h.in
+++ b/shared/nm-version-macros.h.in
@@ -65,6 +65,7 @@
 #define NM_VERSION_1_22   (NM_ENCODE_VERSION (1, 22, 0))
 #define NM_VERSION_1_24   (NM_ENCODE_VERSION (1, 24, 0))
 #define NM_VERSION_1_26   (NM_ENCODE_VERSION (1, 26, 0))
+#define NM_VERSION_1_28   (NM_ENCODE_VERSION (1, 28, 0))
 
 /* For releases, NM_API_VERSION is equal to NM_VERSION.
  *
diff --git a/shared/systemd/nm-sd-utils-shared.c b/shared/systemd/nm-sd-utils-shared.c
index 4fe82ca053..2c72ba4d20 100644
--- a/shared/systemd/nm-sd-utils-shared.c
+++ b/shared/systemd/nm-sd-utils-shared.c
@@ -57,7 +57,7 @@ nm_sd_utils_unbase64char (char ch, gboolean accept_padding_equal)
  * @l: the length of @p. @p is not treated as NUL terminated string but
  *   merely as a buffer of ascii characters.
  * @secure: whether the temporary memory will be cleared to avoid leaving
- *   secrets in memory (see also nm_explict_bzero()).
+ *   secrets in memory (see also nm_explicit_bzero()).
  * @mem: (transfer full): the decoded buffer on success.
  * @len: the length of @mem on success.
  *
diff --git a/shared/systemd/sd-adapt-shared/nm-sd-adapt-shared.h b/shared/systemd/sd-adapt-shared/nm-sd-adapt-shared.h
index e2378c5b4d..5a28cdfc0d 100644
--- a/shared/systemd/sd-adapt-shared/nm-sd-adapt-shared.h
+++ b/shared/systemd/sd-adapt-shared/nm-sd-adapt-shared.h
@@ -91,7 +91,7 @@ G_STMT_START { \
 /*****************************************************************************/
 
 /* systemd cannot be compiled with "-Wdeclaration-after-statement". In particular
- * in combintation with assert_cc(). */
+ * in combination with assert_cc(). */
 NM_PRAGMA_WARNING_DISABLE ("-Wdeclaration-after-statement")
 
 /*****************************************************************************/
diff --git a/shared/systemd/src/basic/process-util.c b/shared/systemd/src/basic/process-util.c
index 6dcb26fb6b..03ca04e175 100644
--- a/shared/systemd/src/basic/process-util.c
+++ b/shared/systemd/src/basic/process-util.c
@@ -1344,7 +1344,7 @@ int safe_fork_full(
 
                 ppid = getppid();
                 if (ppid == 0)
-                        /* Parent is in a differn't PID namespace. */;
+                        /* Parent is in a different PID namespace. */;
                 else if (ppid != original_pid) {
                         log_debug("Parent died early, raising SIGTERM.");
                         (void) raise(SIGTERM);
diff --git a/shared/systemd/src/basic/random-util.c b/shared/systemd/src/basic/random-util.c
index 512e7af9cb..e68262359d 100644
--- a/shared/systemd/src/basic/random-util.c
+++ b/shared/systemd/src/basic/random-util.c
@@ -77,7 +77,7 @@ int rdrand(unsigned long *ret) {
          *           hash functions for its hash tables, with a seed generated randomly. The hash tables
          *           systemd employs watch the fill level closely and reseed if necessary. This allows use of
          *           a low quality RNG initially, as long as it improves should a hash table be under attack:
-         *           the attacker after all needs to to trigger many collisions to exploit it for the purpose
+         *           the attacker after all needs to trigger many collisions to exploit it for the purpose
          *           of DoS, but if doing so improves the seed the attack surface is reduced as the attack
          *           takes place.
          *
diff --git a/shared/systemd/src/basic/socket-util.c b/shared/systemd/src/basic/socket-util.c
index 9ced3a1291..cc592da870 100644
--- a/shared/systemd/src/basic/socket-util.c
+++ b/shared/systemd/src/basic/socket-util.c
@@ -110,7 +110,7 @@ int socket_address_verify(const SocketAddress *a, bool strict) {
                                 if (a->size != offsetof(struct sockaddr_un, sun_path) + (e - a->sockaddr.un.sun_path) + 1)
                                         return -EINVAL;
                         } else {
-                                /* If there's no embedded NUL byte, then then the size needs to match the whole
+                                /* If there's no embedded NUL byte, then the size needs to match the whole
                                  * structure or the structure with one extra NUL byte suffixed. (Yeah, Linux is awful,
                                  * and considers both equivalent: getsockname() even extends sockaddr_un beyond its
                                  * size if the path is non NUL terminated.)*/
diff --git a/src/NetworkManagerUtils.c b/src/NetworkManagerUtils.c
index bcb12a564d..7eaffb7dfc 100644
--- a/src/NetworkManagerUtils.c
+++ b/src/NetworkManagerUtils.c
@@ -96,7 +96,7 @@ get_new_connection_name (NMConnection *const*existing_connections,
 	if (preferred)
 		return g_strdup (preferred);
 
-	/* Otherwise find the next available unique connection name using the given
+	/* Otherwise, find the next available unique connection name using the given
 	 * connection name template.
 	 */
 	for (i = 1; TRUE; i++) {
@@ -1096,7 +1096,7 @@ nm_shutdown_wait_obj_unregister (NMShutdownWaitObjHandle *handle)
  * clearly a directory).
  *
  * Returns: if @abs_filename is a file inside @abs_path, returns the
- *   trailing part of @abs_filename which is the filename. Otherwise
+ *   trailing part of @abs_filename which is the filename. Otherwise,
  *   %NULL.
  */
 const char *
diff --git a/src/devices/bluetooth/nm-bluez-manager.c b/src/devices/bluetooth/nm-bluez-manager.c
index 0bbac4c435..ad6187140c 100644
--- a/src/devices/bluetooth/nm-bluez-manager.c
+++ b/src/devices/bluetooth/nm-bluez-manager.c
@@ -935,7 +935,7 @@ _conn_track_update (NMBluezManager *self,
 	}
 
 	if (!cdata_el) {
-		_LOGT ("connecton: track for %s, %s: %s (%s)",
+		_LOGT ("connection: track for %s, %s: %s (%s)",
 		       nm_bluetooth_capability_to_string (bt_type, sbuf_cap, sizeof (sbuf_cap)),
 		       bdaddr,
 		       nm_settings_connection_get_uuid (sett_conn),
@@ -962,7 +962,7 @@ out_remove:
 		GHashTableIter iter;
 		BzDBusObj *bzobj;
 
-		_LOGT ("connecton: untrack for %s, %s: %s (%s)",
+		_LOGT ("connection: untrack for %s, %s: %s (%s)",
 		       nm_bluetooth_capability_to_string (cdata_el_remove->cdata_hd->bt_type, sbuf_cap, sizeof (sbuf_cap)),
 		       cdata_el_remove->cdata_hd->bdaddr,
 		       nm_settings_connection_get_uuid (sett_conn),
@@ -1564,7 +1564,7 @@ _process_change_idle_cb (gpointer user_data)
 	_process_change_idle_all (self, &emit_device_availability_changed);
 
 	if (emit_device_availability_changed)
-		nm_manager_notify_device_availibility_maybe_changed (priv->manager);
+		nm_manager_notify_device_availability_maybe_changed (priv->manager);
 
 	return G_SOURCE_CONTINUE;
 }
@@ -2232,7 +2232,7 @@ _cleanup_for_name_owner (NMBluezManager *self)
 	nm_assert (g_hash_table_size (priv->bzobjs) == 0);
 
 	if (emit_device_availability_changed)
-		nm_manager_notify_device_availibility_maybe_changed (priv->manager);
+		nm_manager_notify_device_availability_maybe_changed (priv->manager);
 }
 
 static void
@@ -2481,7 +2481,7 @@ _connect_dun_step2_cb (NMBluez5DunContext *context,
 	bzobj = user_data;
 
 	if (rfcomm_dev) {
-		/* We want to early notifiy about the rfcomm path. That is because we might still delay
+		/* We want to early notify about the rfcomm path. That is because we might still delay
 		 * to signal full activation longer (asynchronously). But the earliest time the callback
 		 * is invoked with the rfcomm path, we just created the device synchronously.
 		 *
diff --git a/src/devices/bluetooth/nm-bluez5-dun.c b/src/devices/bluetooth/nm-bluez5-dun.c
index c253d4e28d..11f3b85784 100644
--- a/src/devices/bluetooth/nm-bluez5-dun.c
+++ b/src/devices/bluetooth/nm-bluez5-dun.c
@@ -256,7 +256,7 @@ _connect_create_rfcomm (NMBluez5DunContext *context)
 		 * not yet fully connected. However, we notify the caller about "what we learned
 		 * so far". Note that this happens synchronously.
 		 *
-		 * The purpose is that once we proceed synchrnously, modem-manager races with
+		 * The purpose is that once we proceed synchronously, modem-manager races with
 		 * the detection of the modem. We want to notify the caller first about the
 		 * device name. */
 		context->cdat->callback (NULL,
diff --git a/src/devices/bluetooth/nm-device-bt.c b/src/devices/bluetooth/nm-device-bt.c
index a02ce34fec..9ab3810f68 100644
--- a/src/devices/bluetooth/nm-device-bt.c
+++ b/src/devices/bluetooth/nm-device-bt.c
@@ -892,7 +892,7 @@ connect_bz_cb (NMBluezManager *bz_mgr,
 	}
 
 	if (!priv->is_connected) {
-		/* we got the callback from NMBluezManager with succes. We actually should be
+		/* we got the callback from NMBluezManager with success. We actually should be
 		 * connected and this line shouldn't be reached. */
 		nm_assert_not_reached ();
 		_LOGE (LOGD_BT, "bluetooth is unexpectedly not in connected state");
diff --git a/src/devices/nm-device-ethernet.c b/src/devices/nm-device-ethernet.c
index 9e7601f005..9d8207f73d 100644
--- a/src/devices/nm-device-ethernet.c
+++ b/src/devices/nm-device-ethernet.c
@@ -1007,10 +1007,10 @@ act_stage1_prepare (NMDevice *device, NMDeviceStateReason *out_failure_reason)
 
 	/* If we're re-activating a PPPoE connection a short while after
 	 * a previous PPPoE connection was torn down, wait a bit to allow the
-	 * remote side to handle the disconnection.  Otherwise the peer may
+	 * remote side to handle the disconnection.  Otherwise, the peer may
 	 * get confused and fail to negotiate the new connection. (rh #1023503)
 	 *
-	 * FIXME(shutdown): when exiting, we also need to wait before quiting,
+	 * FIXME(shutdown): when exiting, we also need to wait before quitting,
 	 * at least for additional NM_SHUTDOWN_TIMEOUT_MS seconds because
 	 * otherwise after restart the device won't work for the first seconds.
 	 */
diff --git a/src/devices/nm-device-factory.h b/src/devices/nm-device-factory.h
index 7a323d49b7..e044534dc3 100644
--- a/src/devices/nm-device-factory.h
+++ b/src/devices/nm-device-factory.h
@@ -72,7 +72,7 @@ typedef struct {
 	 * UUID, or parent device permanent hardware address for @connection.
 	 *
 	 * Returns: the parent interface name, parent connection UUID, parent
-	 *   device permenent hardware address, or %NULL
+	 *   device permanent hardware address, or %NULL
 	 */
 	const char * (*get_connection_parent) (NMDeviceFactory *factory,
 	                                       NMConnection *connection);
diff --git a/src/devices/nm-device-wireguard.c b/src/devices/nm-device-wireguard.c
index 9f01a76323..d6c6cb78e0 100644
--- a/src/devices/nm-device-wireguard.c
+++ b/src/devices/nm-device-wireguard.c
@@ -32,9 +32,9 @@ _LOG_DECLARE_SELF(NMDeviceWireGuard);
  *   prompt, as the secret is cached (good??). */
 
 /* TODO: unlike for other VPNs, we don't inject a direct route to the peers. That means,
- *   you might get a routing sceneraio where the peer (VPN server) is reachable via the VPN.
+ *   you might get a routing scenario where the peer (VPN server) is reachable via the VPN.
  *   How we handle adding routes to external gateway for other peers, has severe issues
- *   as well. We may use policy-routing like wg-quick does. See also disussions at
+ *   as well. We may use policy-routing like wg-quick does. See also discussions at
  *   https://www.wireguard.com/netns/#improving-the-classic-solutions */
 
 /* TODO: honor the TTL of DNS to determine when to retry resolving endpoints. */
@@ -62,7 +62,7 @@ G_STATIC_ASSERT (NM_WIREGUARD_SYMMETRIC_KEY_LEN == NMP_WIREGUARD_SYMMETRIC_KEY_L
 #define NEXT_TRY_AT_NSEC_PAST ((gint64) 1)
 
 /* like %NEXT_TRY_AT_NSEC_ASAP, but used for indicating to retry ASAP for a @retry_in_msec value.
- * That is a relative time duraction, contrary to @next_try_at_nsec which is an absolute
+ * That is a relative time duration, contrary to @next_try_at_nsec which is an absolute
  * timestamp. */
 #define RETRY_IN_MSEC_ASAP ((gint64) G_MAXINT64)
 
@@ -289,7 +289,7 @@ _auto_default_route_get_auto_priority (const char *uuid)
 	 * - use the connection's UUID as stable seed for the "random" number.
 	 * - have it smaller than RANGE_TOP (32766u - 1000u), where 32766u is the priority of the default
 	 *   rules
-	 * - we add 2 rules (PRIO_WIDTH). Hence only pick even priorites.
+	 * - we add 2 rules (PRIO_WIDTH). Hence only pick even priorities.
 	 * - pick one out of AUTO_RANDOM_RANGE. */
 
 	rnd_seed = c_siphash_hash (NM_HASH_SEED_16 (0x99, 0x22, 0x4d, 0x7c, 0x37, 0xda, 0x8e, 0x7b, 0x2f, 0x55, 0x16, 0x7b, 0x75, 0xda, 0x42, 0xdc),
diff --git a/src/devices/nm-device.c b/src/devices/nm-device.c
index de09e48072..9c8b593993 100644
--- a/src/devices/nm-device.c
+++ b/src/devices/nm-device.c
@@ -2225,7 +2225,7 @@ _stats_refresh_rate_real (guint refresh_rate_ms)
 		return 0;
 
 	if (refresh_rate_ms < STATS_REFRESH_RATE_MS_MIN) {
-		/* you cannot set the refresh-rate arbitrarly small. E.g.
+		/* you cannot set the refresh-rate arbitrarily small. E.g.
 		 * setting to 1ms is just killing. Have a lowest number. */
 		return STATS_REFRESH_RATE_MS_MIN;
 	}
@@ -3296,7 +3296,7 @@ concheck_update_state (NMDevice *self,
 		/* If the connectivity check is disabled and we obtain a fake
 		 * result, make an optimistic guess. */
 		if (priv->state == NM_DEVICE_STATE_ACTIVATED) {
-			/* FIXME: the fake connectivity state depends on the availablility of
+			/* FIXME: the fake connectivity state depends on the availability of
 			 * a default route. However, we have no mechanism that rechecks the
 			 * value if a device route appears/disappears after the device
 			 * was activated. */
@@ -3309,7 +3309,7 @@ concheck_update_state (NMDevice *self,
 	}
 
 	if (priv->concheck_x[IS_IPv4].state == state) {
-		/* we got a connectivty update, but the state didn't change. If we were probing,
+		/* we got a connectivity update, but the state didn't change. If we were probing,
 		 * we bump the probe frequency. */
 		if (allow_periodic_bump)
 			concheck_periodic_schedule_set (self, addr_family, CONCHECK_SCHEDULE_RETURNED_BUMP);
@@ -5052,7 +5052,7 @@ realize_start_setup (NMDevice *self,
 	                               is_unmanaged_external_down (self, TRUE));
 
 	/* Unmanaged the loopback device with an explicit NM_UNMANAGED_BY_TYPE flag.
-	 * Later we might want to manage 'lo' too. Currently that doesn't work because
+	 * Later we might want to manage 'lo' too. Currently, that doesn't work because
 	 * NetworkManager might down the interface or remove the 127.0.0.1 address. */
 	nm_device_set_unmanaged_flags (self,
 	                               NM_UNMANAGED_BY_TYPE,
@@ -5543,7 +5543,7 @@ nm_device_is_master (NMDevice *self)
  * @self: the device
  *
  * If @self has been enslaved by another device, this returns that
- * device. Otherwise it returns %NULL. (In particular, note that if
+ * device. Otherwise, it returns %NULL. (In particular, note that if
  * @self is in the process of activating as a slave, but has not yet
  * been enslaved by its master, this will return %NULL.)
  *
@@ -8930,7 +8930,7 @@ connection_requires_carrier (NMConnection *connection)
 	gboolean ip4_used = FALSE, ip6_used = FALSE;
 
 	/* We can progress to IP_CONFIG now, so that we're enslaved.
-	 * That may actually cause carrier to go up and thus continue acivation. */
+	 * That may actually cause carrier to go up and thus continue activation. */
 	s_con = nm_connection_get_setting_connection (connection);
 	if (nm_setting_connection_get_master (s_con))
 		return FALSE;
@@ -14928,7 +14928,7 @@ nm_device_update_metered (NMDevice *self)
 			value = NM_METERED_GUESS_YES;
 	}
 
-	/* Otherwise look at connection type. For Bluetooth, we look at the type of
+	/* Otherwise, look at connection type. For Bluetooth, we look at the type of
 	 * Bluetooth sharing: for PANU/DUN (where we are receiving internet from
 	 * another device) we set GUESS_YES; for NAP (where we are sharing internet
 	 * to another device) we set GUESS_NO. We ignore WiMAX here as it’s no
@@ -18428,6 +18428,7 @@ nm_device_class_init (NMDeviceClass *klass)
 /* Connection defaults from plugins */
 NM_CON_DEFAULT_NOP ("cdma.mtu");
 NM_CON_DEFAULT_NOP ("gsm.mtu");
+NM_CON_DEFAULT_NOP ("wifi.ap-isolation");
 NM_CON_DEFAULT_NOP ("wifi.powersave");
 NM_CON_DEFAULT_NOP ("wifi.wake-on-wlan");
 NM_CON_DEFAULT_NOP ("wifi-sec.pmf");
diff --git a/src/devices/ovs/nm-ovsdb.c b/src/devices/ovs/nm-ovsdb.c
index 0b3fa3fdb5..f162a49659 100644
--- a/src/devices/ovs/nm-ovsdb.c
+++ b/src/devices/ovs/nm-ovsdb.c
@@ -1052,7 +1052,7 @@ ovsdb_got_update (NMOvsdb *self, json_t *msg)
 				       ovs_interface->connection_uuid ? ", " : "",
 				       ovs_interface->connection_uuid ?: "");
 				if (g_strcmp0 (ovs_interface->type, "internal") == 0) {
-					/* Currently the factory only creates NMDevices for
+					/* Currently, the factory only creates NMDevices for
 					 * internal interfaces. Ignore the rest. */
 					g_signal_emit (self, signals[DEVICE_REMOVED], 0,
 					               ovs_interface->name, NM_DEVICE_TYPE_OVS_INTERFACE);
@@ -1077,7 +1077,7 @@ ovsdb_got_update (NMOvsdb *self, json_t *msg)
 				       ovs_interface->connection_uuid ? ", " : "",
 				       ovs_interface->connection_uuid ?: "");
 				if (g_strcmp0 (ovs_interface->type, "internal") == 0) {
-					/* Currently the factory only creates NMDevices for
+					/* Currently, the factory only creates NMDevices for
 					 * internal interfaces. Ignore the rest. */
 					g_signal_emit (self, signals[DEVICE_ADDED], 0,
 					               ovs_interface->name, NM_DEVICE_TYPE_OVS_INTERFACE);
@@ -1220,7 +1220,7 @@ ovsdb_got_echo (NMOvsdb *self, json_int_t id, json_t *data)
 /**
  * ovsdb_got_msg::
  *
- * Called when when a complete JSON object was seen and unmarshalled.
+ * Called when a complete JSON object was seen and unmarshalled.
  * Either finishes a method call or processes a method call.
  */
 static void
diff --git a/src/devices/wifi/nm-device-iwd.c b/src/devices/wifi/nm-device-iwd.c
index 4b57fa380b..83d2680c6d 100644
--- a/src/devices/wifi/nm-device-iwd.c
+++ b/src/devices/wifi/nm-device-iwd.c
@@ -1110,7 +1110,7 @@ check_scanning_prohibited (NMDeviceIwd *self, gboolean periodic)
  *
  * Check if the connection settings already have the secrets corresponding
  * to the IWD agent method that was invoked.  If they do, send the method reply
- * with the appropriate secrets.  Otherwise return the missing secret's setting
+ * with the appropriate secrets.  Otherwise, return the missing secret's setting
  * name and key so the caller can send a NM secrets request with this data.
  * Return TRUE in either case, return FALSE if an error is detected.
  */
@@ -1922,7 +1922,7 @@ schedule_periodic_scan (NMDeviceIwd *self, gboolean initial_scan)
 	 * (initial_scan && disconnected) override priv->scanning below
 	 * because of an IWD quirk where a device will often be in the
 	 * autoconnect state and scanning at the time of our initial_scan,
-	 * but our logic will the send it a Disconnect() causeing IWD to
+	 * but our logic will the send it a Disconnect() causing IWD to
 	 * exit autoconnect and interrupt the ongoing scan, meaning that
 	 * we still want a new scan ASAP.
 	 */
@@ -2140,7 +2140,7 @@ state_changed (NMDeviceIwd *self, const char *new_state)
 	if (NM_IN_STRSET (new_state, "connecting", "connected", "roaming")) {
 		/* If we were connecting, do nothing, the confirmation of
 		 * a connection success is handled in the Device.Connect
-		 * method return callback.  Otherwise IWD must have connected
+		 * method return callback.  Otherwise, IWD must have connected
 		 * without Network Manager's will so for simplicity force a
 		 * disconnect.
 		 */
diff --git a/src/devices/wifi/nm-device-wifi.c b/src/devices/wifi/nm-device-wifi.c
index 2d97f9b117..d6de33308a 100644
--- a/src/devices/wifi/nm-device-wifi.c
+++ b/src/devices/wifi/nm-device-wifi.c
@@ -2460,7 +2460,7 @@ supplicant_iface_state (NMDeviceWifi *self,
 				break;
 		}
 
-		/* Otherwise it might be a stupid driver or some transient error, so
+		/* Otherwise, it might be a stupid driver or some transient error, so
 		 * let the supplicant try to reconnect a few more times.  Give it more
 		 * time if a scan is in progress since the link might be dropped during
 		 * the scan but will be re-established when the scan is done.
@@ -2564,6 +2564,15 @@ supplicant_iface_notify_current_bss (NMSupplicantInterface *iface,
 		       new_bssid ?: "(none)",
 		       (new_ssid_s = _nm_utils_ssid_to_string (new_ssid)));
 
+		if (new_bssid) {
+			/* The new AP could be in a different layer 3 network
+			 * and so the old DHCP lease could be no longer valid.
+			 * Also, some APs (e.g. Cisco) can be configured to drop
+			 * all traffic until DHCP completes. To support such
+			 * cases, renew the lease when roaming to a new AP. */
+			nm_device_update_dynamic_ip_setup (NM_DEVICE (self));
+		}
+
 		set_current_ap (self, new_ap, TRUE);
 	}
 }
@@ -2801,6 +2810,7 @@ build_supplicant_config (NMDeviceWifi *self,
 	NMSettingWirelessSecurity *s_wireless_sec;
 	NMSettingWirelessSecurityPmf pmf;
 	NMSettingWirelessSecurityFils fils;
+	NMTernary ap_isolation;
 
 	g_return_val_if_fail (priv->sup_iface, NULL);
 
@@ -2828,6 +2838,17 @@ build_supplicant_config (NMDeviceWifi *self,
 		goto error;
 	}
 
+	ap_isolation = nm_setting_wireless_get_ap_isolation (s_wireless);
+	if (ap_isolation == NM_TERNARY_DEFAULT) {
+		ap_isolation = nm_config_data_get_connection_default_int64 (NM_CONFIG_GET_DATA,
+		                                                            "wifi.ap-isolation",
+		                                                            NM_DEVICE (self),
+		                                                            NM_TERNARY_FALSE,
+		                                                            NM_TERNARY_TRUE,
+		                                                            NM_TERNARY_FALSE);
+	}
+	nm_supplicant_config_set_ap_isolation (config, ap_isolation == NM_TERNARY_TRUE);
+
 	s_wireless_sec = nm_connection_get_setting_wireless_security (connection);
 	if (s_wireless_sec) {
 		NMSetting8021x *s_8021x;
diff --git a/src/dhcp/nm-dhcp-client.c b/src/dhcp/nm-dhcp-client.c
index f7324baf6e..1a41f1b343 100644
--- a/src/dhcp/nm-dhcp-client.c
+++ b/src/dhcp/nm-dhcp-client.c
@@ -824,7 +824,7 @@ maybe_add_option (NMDhcpClient *self,
 
 		/* dhclient has no special labels for private dhcp options: it uses "unknown_xyz"
 		 * labels for that. We need to identify those to alias them to our "private_xyz"
-		 * format unsed in the internal dchp plugins.
+		 * format unused in the internal dchp plugins.
 		 */
 		if ((priv_opt_num = label_is_unknown_xyz (key)) > 0) {
 			gs_free guint8 *check_val = NULL;
diff --git a/src/dhcp/nm-dhcp-dhclient-utils.c b/src/dhcp/nm-dhcp-dhclient-utils.c
index 76fc1a898d..1bd8d0ee71 100644
--- a/src/dhcp/nm-dhcp-dhclient-utils.c
+++ b/src/dhcp/nm-dhcp-dhclient-utils.c
@@ -404,7 +404,7 @@ nm_dhcp_dhclient_create_config (const char *interface,
 				if (client_id)
 					continue;
 
-				/* Otherwise capture and return the existing client id */
+				/* Otherwise, capture and return the existing client id */
 				if (out_new_client_id)
 					nm_clear_pointer (out_new_client_id, g_bytes_unref);
 				NM_SET_OUT (out_new_client_id, read_client_id (p));
diff --git a/src/dhcp/nm-dhcp-dhclient.c b/src/dhcp/nm-dhcp-dhclient.c
index 4ad056e548..ad8fc57bb1 100644
--- a/src/dhcp/nm-dhcp-dhclient.c
+++ b/src/dhcp/nm-dhcp-dhclient.c
@@ -627,7 +627,7 @@ get_duid (NMDhcpClient *client)
 			return duid;
 	}
 
-	/* Otherwise read the default machine-wide DUID */
+	/* Otherwise, read the default machine-wide DUID */
 	_LOGD ("looking for default DUID in '%s'", priv->def_leasefile);
 	duid = nm_dhcp_dhclient_read_duid (priv->def_leasefile, &error);
 	if (error) {
diff --git a/src/dhcp/nm-dhcp-manager.c b/src/dhcp/nm-dhcp-manager.c
index 7565bfc8c6..ec89377eec 100644
--- a/src/dhcp/nm-dhcp-manager.c
+++ b/src/dhcp/nm-dhcp-manager.c
@@ -94,7 +94,7 @@ _client_factory_get_gtype (const NMDhcpClientFactory *client_factory,
 	 * Supporting reloading the plugin would also require to re-evalate the decisions from
 	 * the "Device List Format". Likewise, having per-address family plugins would make the
 	 * "main.dhcp" setting and "dhcp-plugin:" match non-sensical because these configurations
-	 * currently are address family independet.
+	 * currently are address family independent.
 	 *
 	 * So actually, we don't want that complexity. We want to phase out all plugins in favor
 	 * of the internal plugin.
diff --git a/src/dhcp/nm-dhcp-nettools.c b/src/dhcp/nm-dhcp-nettools.c
index fe6a4582b8..a8127236c7 100644
--- a/src/dhcp/nm-dhcp-nettools.c
+++ b/src/dhcp/nm-dhcp-nettools.c
@@ -1304,7 +1304,7 @@ ip4_start (NMDhcpClient *client,
 
 	/*
 	 * FIXME:
-	 * Select, or configure, a reasonable start delay, to protect poor servers beeing flooded.
+	 * Select, or configure, a reasonable start delay, to protect poor servers being flooded.
 	 */
 	n_dhcp4_client_probe_config_set_start_delay (config, 1);
 
diff --git a/src/dns/nm-dns-dnsmasq.c b/src/dns/nm-dns-dnsmasq.c
index fdff3af16f..ccdb8baaf8 100644
--- a/src/dns/nm-dns-dnsmasq.c
+++ b/src/dns/nm-dns-dnsmasq.c
@@ -268,7 +268,7 @@ _gl_pid_spawn_register_for_termination (void)
 {
 	if (   gl_pid.pid > 0
 	    && !gl_pid.terminate_handle) {
-		/* Create a shtudown handle as a reminder that the currently running process must be terminated
+		/* Create a shutdown handle as a reminder that the currently running process must be terminated
 		 * first. This also happens to block shutdown... */
 		gl_pid.terminate_handle = nm_shutdown_wait_obj_register_handle_full (g_strdup_printf ("kill-dnsmasq-process-%"G_PID_FORMAT, gl_pid.pid), TRUE);
 	}
@@ -287,7 +287,7 @@ _gl_pid_spawn_register_for_termination (void)
  * for two purposes:
  *
  *  - signal that the dnsmasq process was spawned (or failed to be spawned).
- *  - signal that the dnsmasq process quit (if it was spawned sucessfully before).
+ *  - signal that the dnsmasq process quit (if it was spawned successfully before).
  *
  * Depending on the arguments, the callee can see what's the case.
  */
@@ -540,7 +540,7 @@ _gl_pid_spawn_next_step (void)
  * @dm_binary: the binary name for dnsmasq to spawn. We could
  *   detect it ad-hoc right when needing it. But that would be
  *   asynchronously, and if dnsmasq is not in $PATH, we want to
- *   fail right away (synchrounously). Hence, @dm_binary is
+ *   fail right away (synchronously). Hence, @dm_binary is
  *   an argument.
  * @cancellable: abort the operation. This will invoke the callback
  *   a last time. Also, if the dnsmasq process is currently running,
diff --git a/src/dns/nm-dns-manager.c b/src/dns/nm-dns-manager.c
index 666bad60ca..355d2ee445 100644
--- a/src/dns/nm-dns-manager.c
+++ b/src/dns/nm-dns-manager.c
@@ -625,7 +625,7 @@ create_resolv_conf (const char *const*searches,
 
 			if (search_base_idx > 0) {
 				if (str->len - search_base_idx + 1 + l > 254) {
-					/* this entry crosses the 256 character boundery. Older glibc versions
+					/* this entry crosses the 256 character boundary. Older glibc versions
 					 * would truncate the entry at this point.
 					 *
 					 * Fill the line with spaces to cross the 256 char boundary and continue
@@ -977,7 +977,7 @@ update_resolv_conf (NMDnsManager *self,
 		             RESOLV_CONF_TMP,
 		             nm_strerror_native (errsv));
 		_LOGT ("update-resolv-conf: write internal file %s succeeded "
-		       "but canot delete temporary file %s: %s",
+		       "but cannot delete temporary file %s: %s",
 		       MY_RESOLV_CONF, RESOLV_CONF_TMP, nm_strerror_native (errsv));
 		return SR_ERROR;
 	}
diff --git a/src/dnsmasq/nm-dnsmasq-utils.c b/src/dnsmasq/nm-dnsmasq-utils.c
index 2373b4220b..4f449cb99e 100644
--- a/src/dnsmasq/nm-dnsmasq-utils.c
+++ b/src/dnsmasq/nm-dnsmasq-utils.c
@@ -42,7 +42,7 @@ nm_dnsmasq_utils_get_range (const NMPlatformIP4Address *addr,
 		 *
 		 * In this case, only a /24 portion of the subnet is used.
 		 * No particular reason for that, but it's unlikely that a user
-		 * would use NetworkManager's shared method when having hundered
+		 * would use NetworkManager's shared method when having hundred
 		 * of DHCP clients. So, restrict the range to the same /24 in
 		 * which the host address lies.
 		 */
diff --git a/src/ndisc/nm-lndp-ndisc.c b/src/ndisc/nm-lndp-ndisc.c
index b10adc91f3..25666c2e45 100644
--- a/src/ndisc/nm-lndp-ndisc.c
+++ b/src/ndisc/nm-lndp-ndisc.c
@@ -122,7 +122,7 @@ receive_ra (struct ndp *ndp, struct ndp_msg *msg, gpointer user_data)
 	/* DHCP level:
 	 *
 	 * The problem with DHCP level is what to do if subsequent
-	 * router advertisements carry different flags. Currently we just
+	 * router advertisements carry different flags. Currently, we just
 	 * rewrite the flag with every inbound RA.
 	 */
 	{
diff --git a/src/ndisc/tests/test-ndisc-fake.c b/src/ndisc/tests/test-ndisc-fake.c
index b65511e01e..254110e4c7 100644
--- a/src/ndisc/tests/test-ndisc-fake.c
+++ b/src/ndisc/tests/test-ndisc-fake.c
@@ -61,8 +61,8 @@ match_gateway (const NMNDiscData *rdata, guint idx, const char *addr, guint32 ts
 		_a = &_rdata->addresses[_idx]; \
 		\
 		nmtst_assert_ip6_address (&_a->address, (addr)); \
-		g_assert_cmpint (_a->timestamp, >=, _ts); \
 		g_assert_cmpint (_a->timestamp, <=, _ts + 1); \
+		g_assert_cmpint ((int) _a->timestamp, >=, (int) _ts - 1); \
 		g_assert_cmpint (_a->timestamp + _a->lifetime, ==, _ts + (lt)); \
 		g_assert_cmpint (_a->timestamp + _a->preferred, ==, _ts + (pref)); \
 	} G_STMT_END
diff --git a/src/nm-act-request.c b/src/nm-act-request.c
index 1c252052bb..9398cd0d4a 100644
--- a/src/nm-act-request.c
+++ b/src/nm-act-request.c
@@ -135,7 +135,7 @@ get_secrets_cb (NMSettingsConnection *connection,
  * @callback:
  * @callback_data:
  *
- * Asnychronously starts the request for secrets. This function cannot
+ * Asynchronously starts the request for secrets. This function cannot
  * fail.
  *
  * The return call-id can be used to cancel the request. You are
diff --git a/src/nm-active-connection.c b/src/nm-active-connection.c
index 08037ebe71..a559cda23b 100644
--- a/src/nm-active-connection.c
+++ b/src/nm-active-connection.c
@@ -751,7 +751,7 @@ nm_active_connection_get_master (NMActiveConnection *self)
  * @self: the #NMActiveConnection
  *
  * Returns: %TRUE if the connection has a master connection, and that
- * master connection is ready to accept slaves.  Otherwise %FALSE.
+ * master connection is ready to accept slaves.  Otherwise, %FALSE.
  */
 gboolean
 nm_active_connection_get_master_ready (NMActiveConnection *self)
diff --git a/src/nm-auth-utils.c b/src/nm-auth-utils.c
index b9efff4805..d4728a7f33 100644
--- a/src/nm-auth-utils.c
+++ b/src/nm-auth-utils.c
@@ -280,7 +280,7 @@ nm_auth_chain_set_data_unsafe (NMAuthChain *self,
 	g_return_if_fail (self);
 	g_return_if_fail (tag);
 
-	/* The tag must not yet exist. Otherwise we'd have to first search the
+	/* The tag must not yet exist. Otherwise, we'd have to first search the
 	 * list for an existing entry. That usage pattern is not supported. */
 	nm_assert (!_get_data (self, tag));
 
diff --git a/src/nm-auth-utils.h b/src/nm-auth-utils.h
index a6c6d65965..e79c57be69 100644
--- a/src/nm-auth-utils.h
+++ b/src/nm-auth-utils.h
@@ -80,7 +80,7 @@ nm_auth_chain_parent_lst_list (NMAuthChain *self)
 
 /* Caller must free returned error description */
 gboolean nm_auth_is_subject_in_acl (NMConnection *connection,
-                                    NMAuthSubject *subect,
+                                    NMAuthSubject *subject,
                                     char **out_error_desc);
 
 gboolean nm_auth_is_subject_in_acl_set_error (NMConnection *connection,
diff --git a/src/nm-checkpoint.c b/src/nm-checkpoint.c
index 3a37266751..6851710c54 100644
--- a/src/nm-checkpoint.c
+++ b/src/nm-checkpoint.c
@@ -32,7 +32,7 @@ typedef struct {
 	NMDeviceState state;
 	bool is_software:1;
 	bool realized:1;
-	bool activation_lifetime_bound_to_profile_visiblity:1;
+	bool activation_lifetime_bound_to_profile_visibility:1;
 	NMUnmanFlagOp unmanaged_explicit;
 	NMActivationReason activation_reason;
 	gulong dev_exported_change_id;
@@ -292,7 +292,7 @@ restore_and_activate_connection (NMCheckpoint *self,
 		                                     subject,
 		                                     NM_ACTIVATION_TYPE_MANAGED,
 		                                     dev_checkpoint->activation_reason,
-		                                       dev_checkpoint->activation_lifetime_bound_to_profile_visiblity
+		                                       dev_checkpoint->activation_lifetime_bound_to_profile_visibility
 		                                     ? NM_ACTIVATION_STATE_FLAG_LIFETIME_BOUND_TO_PROFILE_VISIBILITY
 		                                     : NM_ACTIVATION_STATE_FLAG_NONE,
 		                                     &local_error)) {
@@ -550,7 +550,7 @@ device_checkpoint_create (NMCheckpoint *checkpoint, NMDevice *device)
 		dev_checkpoint->settings_connection = nm_simple_connection_new_clone (nm_settings_connection_get_connection (settings_connection));
 		dev_checkpoint->ac_version_id = nm_active_connection_version_id_get (NM_ACTIVE_CONNECTION (act_request));
 		dev_checkpoint->activation_reason = nm_active_connection_get_activation_reason (NM_ACTIVE_CONNECTION (act_request));
-		dev_checkpoint->activation_lifetime_bound_to_profile_visiblity = NM_FLAGS_HAS (nm_active_connection_get_state_flags (NM_ACTIVE_CONNECTION (act_request)),
+		dev_checkpoint->activation_lifetime_bound_to_profile_visibility = NM_FLAGS_HAS (nm_active_connection_get_state_flags (NM_ACTIVE_CONNECTION (act_request)),
 		                                                                               NM_ACTIVATION_STATE_FLAG_LIFETIME_BOUND_TO_PROFILE_VISIBILITY);
 	}
 
diff --git a/src/nm-config.c b/src/nm-config.c
index 4fa8531941..e0b9ce3ce7 100644
--- a/src/nm-config.c
+++ b/src/nm-config.c
@@ -1566,7 +1566,7 @@ intern_config_read (const char *filename,
 out:
 	/*
 	 * If user configuration specifies global DNS options, the DNS
-	 * options in internal configuration must be deleted. Otherwise a
+	 * options in internal configuration must be deleted. Otherwise, a
 	 * deletion of options from user configuration may cause the
 	 * internal options to appear again.
 	 */
diff --git a/src/nm-core-utils.c b/src/nm-core-utils.c
index 3950c3c3a9..66245ec0d6 100644
--- a/src/nm-core-utils.c
+++ b/src/nm-core-utils.c
@@ -266,7 +266,7 @@ nm_utils_array_remove_at_indexes (GArray *array, const guint *indexes_to_delete,
 			mm_len++;
 		else {
 			/* we require indexes_to_delete to contain non-repeated, ascending
-			 * indexes. Otherwise we would need to presort the indexes. */
+			 * indexes. Otherwise, we would need to presort the indexes. */
 			while (TRUE) {
 				guint dd;
 
@@ -631,7 +631,7 @@ _sleep_duration_convert_ms_to_us (guint32 sleep_duration_msec)
  * Set to zero, to use the default (meaning 20 wakeups per seconds).
  *
  * Kill a child process synchronously and wait. The function first checks if the child already terminated
- * and if it did, return the exit status. Otherwise send one @sig signal. @sig  will always be
+ * and if it did, return the exit status. Otherwise, send one @sig signal. @sig  will always be
  * sent unless the child already exited. If the child does not exit within @wait_before_kill_msec milliseconds,
  * the function will send %SIGKILL and waits for the child indefinitely. If @wait_before_kill_msec is zero, no
  * %SIGKILL signal will be sent.
@@ -2475,7 +2475,7 @@ again:
 			gsize seed_len;
 
 			if (!allow_fake) {
-				/* we don't allow generating (and memoizing) a fake key.
+				/* we don't allow generating (and memorizing) a fake key.
 				 * Signal that no valid machine-id exists. */
 				return NULL;
 			}
@@ -3322,14 +3322,14 @@ nm_utils_stable_id_parse (const char *stable_id,
 			_stable_id_append (str, hwaddr);
 		else if (g_str_has_prefix (&stable_id[i], "${RANDOM}")) {
 			/* RANDOM makes not so much sense for cloned-mac-address
-			 * as the result is similar to specyifing "cloned-mac-address=random".
+			 * as the result is similar to specifying "cloned-mac-address=random".
 			 * It makes however sense for RFC 7217 Stable Privacy IPv6 addresses
 			 * where this is effectively the only way to generate a different
 			 * (random) host identifier for each connect.
 			 *
 			 * With RANDOM, the user can switch the lifetime of the
 			 * generated cloned-mac-address and IPv6 host identifier
-			 * by toggeling only the stable-id property of the connection.
+			 * by toggling only the stable-id property of the connection.
 			 * With RANDOM being the most short-lived, ~non-stable~ variant.
 			 */
 			if (str)
@@ -3423,7 +3423,7 @@ _set_stable_privacy (NMUtilsStableType stable_type,
 		 * That is no real problem and it is still impossible to
 		 * force a collision here, because of how the remaining
 		 * fields are hashed. That is, as we also hash @host_id_len
-		 * and the terminating '\0' of @network_id, it is unambigiously
+		 * and the terminating '\0' of @network_id, it is unambiguously
 		 * possible to revert the process and deduce the @stable_type.
 		 */
 		g_checksum_update (sum, &stable_type_uint8, sizeof (stable_type_uint8));
@@ -4228,28 +4228,6 @@ nm_utils_parse_dns_domain (const char *domain, gboolean *is_routing)
 
 /*****************************************************************************/
 
-GVariant *
-nm_utils_strdict_to_variant (GHashTable *options)
-{
-	GVariantBuilder builder;
-	gs_free NMUtilsNamedValue *values = NULL;
-	guint i;
-	guint n;
-
-	values = nm_utils_named_values_from_str_dict (options, &n);
-
-	g_variant_builder_init (&builder, G_VARIANT_TYPE ("a{sv}"));
-	for (i = 0; i < n; i++) {
-		g_variant_builder_add (&builder,
-		                       "{sv}",
-		                       values[i].name,
-		                       g_variant_new_string (values[i].value_str));
-	}
-	return g_variant_builder_end (&builder);
-}
-
-/*****************************************************************************/
-
 static guint32
 get_max_rate_ht_20 (int mcs)
 {
diff --git a/src/nm-core-utils.h b/src/nm-core-utils.h
index 55792d5712..cb6b06208e 100644
--- a/src/nm-core-utils.h
+++ b/src/nm-core-utils.h
@@ -458,8 +458,6 @@ gboolean nm_utils_validate_plugin (const char *path, struct stat *stat, GError *
 char **nm_utils_read_plugin_paths (const char *dirname, const char *prefix);
 char *nm_utils_format_con_diff_for_audit (GHashTable *diff);
 
-GVariant *nm_utils_strdict_to_variant (GHashTable *options);
-
 /*****************************************************************************/
 
 /* this enum is compatible with ICMPV6_ROUTER_PREF_* (from <linux/icmpv6.h>,
diff --git a/src/nm-dbus-manager.c b/src/nm-dbus-manager.c
index 9849656ddd..da632d5e55 100644
--- a/src/nm-dbus-manager.c
+++ b/src/nm-dbus-manager.c
@@ -1003,8 +1003,8 @@ _obj_register (NMDBusManager *self,
 
 	nm_assert (!c_list_is_empty (&obj->internal.registration_lst_head));
 
-	/* Currently the interfaces of an object do not changed and strictly depend on the object glib type.
-	 * We don't need more flixibility, and it simplifies the code. Hence, now emit interface-added
+	/* Currently, the interfaces of an object do not changed and strictly depend on the object glib type.
+	 * We don't need more flexibility, and it simplifies the code. Hence, now emit interface-added
 	 * signal for the new object.
 	 *
 	 * Warning: note that if @obj's notify signal is currently blocked via g_object_freeze_notify(),
diff --git a/src/nm-dhcp-config.c b/src/nm-dhcp-config.c
index 3b9211df99..fd55c3ff43 100644
--- a/src/nm-dhcp-config.c
+++ b/src/nm-dhcp-config.c
@@ -75,7 +75,7 @@ nm_dhcp_config_set_options (NMDhcpConfig *self,
 	priv = NM_DHCP_CONFIG_GET_PRIVATE (self);
 
 	nm_g_variant_unref (priv->options);
-	priv->options = g_variant_ref_sink (nm_utils_strdict_to_variant (options));
+	priv->options = g_variant_ref_sink (nm_utils_strdict_to_variant_asv (options));
 	_notify (self, PROP_OPTIONS);
 }
 
diff --git a/src/nm-firewall-manager.c b/src/nm-firewall-manager.c
index 304b15f99a..6892ef0b3d 100644
--- a/src/nm-firewall-manager.c
+++ b/src/nm-firewall-manager.c
@@ -146,7 +146,7 @@ static gboolean
 _get_running (NMFirewallManagerPrivate *priv)
 {
 	/* when starting, we need to asynchronously check whether there is
-	 * a name owner. During that time we optimistially assume that the
+	 * a name owner. During that time we optimistically assume that the
 	 * service is indeed running. That is the time when we queue the
 	 * requests, and they will be started once the get-name-owner call
 	 * returns. */
diff --git a/src/nm-manager.c b/src/nm-manager.c
index 921125329e..286c9ef35b 100644
--- a/src/nm-manager.c
+++ b/src/nm-manager.c
@@ -700,7 +700,7 @@ initited:
 		/* on systems where a lot of devices are created and go away, the index contains
 		 * a lot of stale entries. We must from time to time clean them up.
 		 *
-		 * Do do this cleanup, whenever we have more enties then 2 times the number of links. */
+		 * Do do this cleanup, whenever we have more entries then 2 times the number of links. */
 		if (G_UNLIKELY (g_hash_table_size (priv->device_route_metrics) > NM_MAX (20, n_links * 2))) {
 			/* from time to time, we need to do some house-keeping and prune stale entries.
 			 * Otherwise, on a system where interfaces frequently come and go (docker), we
@@ -2364,7 +2364,7 @@ nm_manager_rfkill_update (NMManager *self, RfKillType rtype)
 	if (rtype != RFKILL_TYPE_UNKNOWN)
 		manager_rfkill_update_one_type (self, &priv->radio_states[rtype], rtype);
 	else {
-		/* Otherwise sync all radio types */
+		/* Otherwise, sync all radio types */
 		for (i = 0; i < RFKILL_TYPE_MAX; i++)
 			manager_rfkill_update_one_type (self, &priv->radio_states[i], i);
 	}
@@ -2817,7 +2817,7 @@ recheck_assume_connection (NMManager *self,
 			 * We've managed to steal the lease used by initramfs before it
 			 * killed off the dhclient. We need to take ownership of the configured
 			 * connection and act like the device was configured by us.
-			 * Otherwise the address would just expire.
+			 * Otherwise, the address would just expire.
 			 */
 			_LOG2I (LOGD_DEVICE, device, "assume: taking over an initramfs-configured connection");
 			activation_type_assume = TRUE;
@@ -3299,7 +3299,7 @@ _register_device_factory (NMDeviceFactory *factory, gpointer user_data)
 /*****************************************************************************/
 
 void
-nm_manager_notify_device_availibility_maybe_changed (NMManager *self)
+nm_manager_notify_device_availability_maybe_changed (NMManager *self)
 {
 	NMManagerPrivate *priv = NM_MANAGER_GET_PRIVATE (self);
 	NMDevice *device;
@@ -3773,7 +3773,7 @@ found_better:
 		    && g_hash_table_contains (unavailable_devices, device))
 			continue;
 
-		/* determine the priority of this device. Currently this priority is independent
+		/* determine the priority of this device. Currently, this priority is independent
 		 * of the profile (connection) and the device's details (aside the state).
 		 *
 		 * Maybe nm_device_check_connection_available() should instead return a priority,
@@ -5366,7 +5366,7 @@ impl_manager_activate_connection (NMDBusObject *obj,
 	device_path = nm_dbus_path_not_empty (device_path);
 
 	/* If the connection path is given and valid, that connection is activated.
-	 * Otherwise the "best" connection for the device is chosen and activated,
+	 * Otherwise, the "best" connection for the device is chosen and activated,
 	 * regardless of whether that connection is autoconnect-enabled or not
 	 * (since this is an explicit request, not an auto-activation request).
 	 */
diff --git a/src/nm-manager.h b/src/nm-manager.h
index ab08eaa839..ebb7600255 100644
--- a/src/nm-manager.h
+++ b/src/nm-manager.h
@@ -191,7 +191,7 @@ void nm_manager_dbus_set_property_handle (NMDBusObject *obj,
 
 NMMetered nm_manager_get_metered (NMManager *self);
 
-void nm_manager_notify_device_availibility_maybe_changed (NMManager *self);
+void nm_manager_notify_device_availability_maybe_changed (NMManager *self);
 
 /*****************************************************************************/
 
diff --git a/src/nm-policy.c b/src/nm-policy.c
index 62ead24253..148f5618ba 100644
--- a/src/nm-policy.c
+++ b/src/nm-policy.c
@@ -340,7 +340,7 @@ device_ip6_prefix_delegated (NMDevice *device,
 	}
 
 	if (i == priv->ip6_prefix_delegations->len) {
-		/* Allocate a delegation delegation for new prefix. */
+		/* Allocate a delegation for new prefix. */
 		g_array_set_size (priv->ip6_prefix_delegations, i + 1);
 		delegation = &g_array_index (priv->ip6_prefix_delegations, IP6PrefixDelegation, i);
 		delegation->subnets = g_hash_table_new (nm_direct_hash, NULL);
diff --git a/src/platform/nm-linux-platform.c b/src/platform/nm-linux-platform.c
index fbcc2b3136..2ee478cdcf 100644
--- a/src/platform/nm-linux-platform.c
+++ b/src/platform/nm-linux-platform.c
@@ -152,7 +152,7 @@ G_STATIC_ASSERT (RTA_MAX == (__RTA_MAX - 1));
 
 /*****************************************************************************/
 
-/* Appeared in in kernel prior to 3.13 dated 19 January, 2014 */
+/* Appeared in the kernel prior to 3.13 dated 19 January, 2014 */
 #ifndef ARPHRD_6LOWPAN
 #define ARPHRD_6LOWPAN 825
 #endif
@@ -271,7 +271,7 @@ struct _ifla_vf_vlan_info {
 
 /*****************************************************************************/
 
-/* Appeared in in kernel 4.0 dated April 12, 2015 */
+/* Appeared in the kernel 4.0 dated April 12, 2015 */
 #ifndef BRIDGE_VLAN_INFO_RANGE_BEGIN
 #define BRIDGE_VLAN_INFO_RANGE_BEGIN    (1 << 3) /* VLAN is start of vlan range */
 #define BRIDGE_VLAN_INFO_RANGE_END      (1 << 4) /* VLAN is end of vlan range */
@@ -514,7 +514,7 @@ G_DEFINE_TYPE (NMLinuxPlatform, nm_linux_platform, NM_TYPE_PLATFORM)
             /* The %m format specifier (GNU extension) would already allow you to specify the error
              * message conveniently (and nm_log would get that right too). But we don't want to depend
              * on that, so instead append the message at the end.
-             * Currently users are expected not to use %m in the format string. */ \
+             * Currently, users are expected not to use %m in the format string. */ \
             _LOG_print (__level, __domain, __errsv, self, \
                         _NM_UTILS_MACRO_FIRST (__VA_ARGS__) ": %s (%d)" \
                         _NM_UTILS_MACRO_REST (__VA_ARGS__), \
@@ -1050,12 +1050,12 @@ _linktype_get_type (NMPlatform *platform,
 		 * it means that their type may not have been determined correctly
 		 * due to race conditions while accessing sysfs.
 		 *
-		 * This way, we save edditional ethtool/sysctl lookups, but moreover,
+		 * This way, we save additional ethtool/sysctl lookups, but moreover,
 		 * we keep the linktype stable and don't change it as long as the link
 		 * exists.
 		 *
 		 * Note that kernel *can* reuse the ifindex (on integer overflow, and
-		 * when moving interfce to other netns). Thus here there is a tiny potential
+		 * when moving interface to other netns). Thus here there is a tiny potential
 		 * of messing stuff up. */
 		if (   obj
 		    && obj->_link.netlink.is_in_netlink
@@ -2602,7 +2602,7 @@ again:
 						             &p->endpoint) < 0)
 							goto toobig_peers;
 					} else {
-						/* I think there is no way to clear an endpoint, though there shold be. */
+						/* I think there is no way to clear an endpoint, though there should be. */
 						nm_assert (p->endpoint.sa.sa_family == AF_UNSPEC);
 					}
 				}
@@ -2839,7 +2839,7 @@ _new_from_nl_link (NMPlatform *platform, const NMPCache *cache, struct nlmsghdr
 	if (!tb[IFLA_MTU]) {
 		/* Kernel has two places that send RTM_GETLINK messages:
 		 * net/core/rtnetlink.c and net/wireless/ext-core.c.
-		 * Unfotunatelly ext-core.c sets only IFLA_WIRELESS and
+		 * Unfortunately ext-core.c sets only IFLA_WIRELESS and
 		 * IFLA_IFNAME. This confuses code in this function, because
 		 * it cannot get complete set of data for the interface and
 		 * later incomplete object this function creates is used to
@@ -3162,7 +3162,7 @@ _new_from_nl_addr (struct nlmsghdr *nlh, gboolean id_only)
 		 * If IFA_LOCAL is missing, IFA_ADDRESS is @address and @peer_address
 		 * is :: (all-zero).
 		 *
-		 * If unexpectely IFA_ADDRESS is missing, make the best of it -- but it _should_
+		 * If unexpectedly IFA_ADDRESS is missing, make the best of it -- but it _should_
 		 * actually be there. */
 		if (tb[IFA_ADDRESS] || tb[IFA_LOCAL]) {
 			if (tb[IFA_LOCAL]) {
@@ -4758,6 +4758,10 @@ _nl_msg_new_qdisc (int nlmsg_type,
 		NLA_PUT_U32 (msg, TCA_TBF_BURST, qdisc->tbf.burst);
 
 		nla_nest_end (msg, tc_options);
+	} else if (nm_streq (qdisc->kind, "prio")) {
+		struct tc_prio_qopt opt = {3, { 1, 2, 2, 2, 1, 2, 0, 0, 1, 1, 1, 1, 1, 1, 1, 1 } };
+
+		NLA_PUT (msg, TCA_OPTIONS, sizeof (opt), &opt);
 	} else {
 		if (!(tc_options = nla_nest_start (msg, TCA_OPTIONS)))
 			goto nla_put_failure;
@@ -8729,7 +8733,7 @@ continue_reading:
 			 * NL_PROCEED. */
 		} else if (hdr->nlmsg_type == NLMSG_OVERRUN) {
 			/* Data got lost, report back to user. The default action is to
-			 * quit parsing. The user may overrule this action by retuning
+			 * quit parsing. The user may overrule this action by returning
 			 * NL_SKIP or NL_PROCEED (dangerous) */
 			err = -NME_NL_MSG_OVERFLOW;
 			abort_parsing = TRUE;
diff --git a/src/platform/nm-netlink.c b/src/platform/nm-netlink.c
index d133d35166..fdb2becd03 100644
--- a/src/platform/nm-netlink.c
+++ b/src/platform/nm-netlink.c
@@ -526,7 +526,7 @@ _nest_end (struct nl_msg *msg, struct nlattr *start, int keep_empty)
 	if (pad > 0) {
 		/*
 		 * Data inside attribute does not end at a alignment boundary.
-		 * Pad accordingly and accoun for the additional space in
+		 * Pad accordingly and account for the additional space in
 		 * the message. nlmsg_reserve() may never fail in this situation,
 		 * the allocate message buffer must be a multiple of NLMSG_ALIGNTO.
 		 */
@@ -1184,7 +1184,7 @@ continue_reading:
 			goto skip;
 
 		/* Data got lost, report back to user. The default action is to
-		 * quit parsing. The user may overrule this action by retuning
+		 * quit parsing. The user may overrule this action by returning
 		 * NL_SKIP or NL_PROCEED (dangerous) */
 		else if (hdr->nlmsg_type == NLMSG_OVERRUN) {
 			nmerr = -NME_NL_MSG_OVERFLOW;
diff --git a/src/platform/nm-platform-utils.c b/src/platform/nm-platform-utils.c
index 6c14bc5c16..c8565f5d23 100644
--- a/src/platform/nm-platform-utils.c
+++ b/src/platform/nm-platform-utils.c
@@ -219,7 +219,7 @@ again:
 		 * calling it again should have no bad effect (just setting the same thing more than once).
 		 *
 		 * The only potential bad thing is if there was a race involving swapping names, and we just
-		 * set the ioctl option on the wrong device. But then the bad thing already happend and
+		 * set the ioctl option on the wrong device. But then the bad thing already happenned and
 		 * we cannot detect it (nor do anything about it). At least, we can retry and set the
 		 * option on the right interface. */
 		retry = (try_count < 5);
diff --git a/src/platform/nm-platform.c b/src/platform/nm-platform.c
index 4702ba9797..5c4a3abb55 100644
--- a/src/platform/nm-platform.c
+++ b/src/platform/nm-platform.c
@@ -2414,7 +2414,7 @@ nm_platform_link_tun_add (NMPlatform *self,
 	g_return_val_if_fail (props, -NME_BUG);
 	g_return_val_if_fail (NM_IN_SET (props->type, IFF_TUN, IFF_TAP), -NME_BUG);
 
-	/* creating a non-persistant device requires that the caller handles
+	/* creating a non-persistent device requires that the caller handles
 	 * the file descriptor. */
 	g_return_val_if_fail (props->persist || out_fd, -NME_BUG);
 
diff --git a/src/platform/nm-platform.h b/src/platform/nm-platform.h
index 2b5d491401..339ef5ba3b 100644
--- a/src/platform/nm-platform.h
+++ b/src/platform/nm-platform.h
@@ -115,7 +115,7 @@ typedef enum {
 	 * For the ID we can only recognize route fields that we actually implement.
 	 * However, kernel supports more routing options, some of them also part of
 	 * the ID. NetworkManager is oblivious to these options and will wrongly think
-	 * that two routes are idential, while they are not. That can lead to an
+	 * that two routes are identical, while they are not. That can lead to an
 	 * inconsistent platform cache. Not much what we can do about that, except
 	 * implementing all options that kernel supports *sigh*. See rh#1337860.
 	 */
@@ -414,7 +414,7 @@ typedef union {
 	/* RTA_METRICS:
 	 *
 	 * For IPv4 routes, these properties are part of their
-	 * ID (meaning: you can add otherwise idential IPv4 routes that
+	 * ID (meaning: you can add otherwise identical IPv4 routes that
 	 * only differ by the metric property).
 	 * On the other hand, for IPv6 you cannot add two IPv6 routes that only differ
 	 * by an RTA_METRICS property.
@@ -625,7 +625,7 @@ typedef struct {
 	guint32 quantum;
 	guint32 ce_threshold; /* TCA_FQ_CODEL_CE_THRESHOLD: kernel internally stores this value as
 	                       *   ((val64 * NSEC_PER_USEC) >> CODEL_SHIFT). The default value (in
-	                       *   the domain with this coersion) is CODEL_DISABLED_THRESHOLD (INT_MAX).
+	                       *   the domain with this coercion) is CODEL_DISABLED_THRESHOLD (INT_MAX).
 	                       *   That means, "disabled" is expressed on RTM_NEWQDISC netlink API by absence of the
 	                       *   netlink attribute but also as the special value 0x83126E97u
 	                       *   (NM_PLATFORM_FQ_CODEL_CE_THRESHOLD_DISABLED).
diff --git a/src/platform/nmp-object.c b/src/platform/nmp-object.c
index a6aa5e2239..1cd61a8e7d 100644
--- a/src/platform/nmp-object.c
+++ b/src/platform/nmp-object.c
@@ -1437,7 +1437,7 @@ _vt_cmd_plobj_id_cmp (ip4_address, NMPlatformIP4Address,
                       NM_CMP_FIELD (obj1, obj2, ifindex);
                       NM_CMP_FIELD (obj1, obj2, plen);
                       NM_CMP_FIELD (obj1, obj2, address);
-                      /* for IPv4 addresses, you can add the same local address with differing peer-adddress
+                      /* for IPv4 addresses, you can add the same local address with differing peer-address
                        * (IFA_ADDRESS), provided that their net-part differs. */
                       NM_CMP_DIRECT_IN4ADDR_SAME_PREFIX (obj1->peer_address, obj2->peer_address, obj1->plen);
 )
diff --git a/src/platform/nmp-object.h b/src/platform/nmp-object.h
index 44525ed05b..7866caa428 100644
--- a/src/platform/nmp-object.h
+++ b/src/platform/nmp-object.h
@@ -219,7 +219,7 @@ typedef struct {
 		 * "struct udev", but doesn't own it.
 		 *
 		 * Hence, the udev.device shall not be used after the library
-		 * context is is destroyed.
+		 * context is destroyed.
 		 *
 		 * In case of NMPObjectLink instances that you obtained from the
 		 * platform cache, that means that you shall no keep references
diff --git a/src/platform/tests/test-route.c b/src/platform/tests/test-route.c
index 42b5baf0f8..531c61dbdc 100644
--- a/src/platform/tests/test-route.c
+++ b/src/platform/tests/test-route.c
@@ -1309,7 +1309,7 @@ _rule_fuzzy_equal (const NMPObject *obj,
 		break;
 	case RTM_DELRULE:
 		/* when deleting a rule with RTM_DELRULE, kernel tries to find the
-		 * cadidate to delete. It might delete the wrong rule (rh#1685816). */
+		 * candidate to delete. It might delete the wrong rule (rh#1685816). */
 		if (rr->action == FR_ACT_UNSPEC)
 			rr_co.action = FR_ACT_UNSPEC;
 		if (rr->iifname[0] == '\0')
@@ -1510,7 +1510,7 @@ again:
 
 		objs_sync = g_ptr_array_new_with_free_func ((GDestroyNotify) nmp_object_unref);
 
-		/* ensure that priorities are unique. Otherwise it confuses the test, because
+		/* ensure that priorities are unique. Otherwise, it confuses the test, because
 		 * kernel may wrongly be unable to add/delete routes based on a wrong match
 		 * (rh#1685816, rh#1685816). */
 		for (i = 0; i < objs->len; i++) {
diff --git a/src/settings/nm-agent-manager.c b/src/settings/nm-agent-manager.c
index 363b117581..a3b99e94e7 100644
--- a/src/settings/nm-agent-manager.c
+++ b/src/settings/nm-agent-manager.c
@@ -1171,9 +1171,9 @@ _con_get_try_complete_early (Request *req)
  * Requests secrets for a connection.
  *
  * This function cannot fail. The callback will be invoked
- * asynchrnously, but it will always be invoked exactly once.
+ * asynchronously, but it will always be invoked exactly once.
  * Even for cancellation and disposing of @self. In those latter
- * cases, the callback is invoked synchrnously during the cancellation/
+ * cases, the callback is invoked synchronously during the cancellation/
  * disposal.
  *
  * Returns: a call-id to cancel the call.
diff --git a/src/settings/nm-settings-connection.h b/src/settings/nm-settings-connection.h
index 17573bbe05..dfd002efdf 100644
--- a/src/settings/nm-settings-connection.h
+++ b/src/settings/nm-settings-connection.h
@@ -80,7 +80,7 @@ typedef enum {
 
 	/* Update in-memory (i.e. persist to /run). If the profile is currently on disk,
 	 * then a reference to the profile is remembered as "shadowed-storage".
-	 * Later, when storing again to persistant storage, the shawowed-storage is
+	 * Later, when storing again to persistent storage, the shadowed-storage is
 	 * updated. When deleting the profile, the shadowed-storage is also deleted
 	 * from disk.
 	 *
@@ -90,7 +90,7 @@ typedef enum {
 	/* Update in-memory (i.e. persist to /run). This is almost like
 	 * %NM_SETTINGS_CONNECTION_PERSIST_MODE_IN_MEMORY, except the in-memory profile
 	 * remembers not to own the shadowed-storage ("shadowed-owned").
-	 * The diffrence is that when deleting the in-memory profile, the original
+	 * The difference is that when deleting the in-memory profile, the original
 	 * profile is not deleted but instead the nmmeta tombstone remembers the
 	 * shadowed-storage and re-used it when re-adding the profile.
 	 *
diff --git a/src/settings/nm-settings.c b/src/settings/nm-settings.c
index 0a1e7b47d6..82ab1b6c4e 100644
--- a/src/settings/nm-settings.c
+++ b/src/settings/nm-settings.c
@@ -1748,7 +1748,7 @@ nm_settings_add_connection (NMSettings *self,
 				/* We have a nmmeta tombstone that indicates that a storage is shadowed.
 				 *
 				 * This happens when deleting a in-memory profile that was decoupled from
-				 * the persitant storage with NM_SETTINGS_CONNECTION_PERSIST_MODE_IN_MEMORY_DETACHED.
+				 * the persistent storage with NM_SETTINGS_CONNECTION_PERSIST_MODE_IN_MEMORY_DETACHED.
 				 * We need to take over this storage again... */
 				break;
 			}
diff --git a/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-plugin.c b/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-plugin.c
index f5c9bb5e91..ad782e2c78 100644
--- a/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-plugin.c
+++ b/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-plugin.c
@@ -353,7 +353,7 @@ _storages_consolidate (NMSIfcfgRHPlugin *self,
 		storage = storages_modified->pdata[i];
 
 		if (!storage->dirty) {
-			/* the entry is no longer dirty. In the meantime we already emited
+			/* the entry is no longer dirty. In the meantime we already emitted
 			 * another signal for it. */
 			continue;
 		}
diff --git a/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-reader.c b/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-reader.c
index 1a9df92cee..4ac223c0c0 100644
--- a/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-reader.c
+++ b/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-reader.c
@@ -338,7 +338,7 @@ make_connection_name (shvarFile *ifcfg,
 	if (name)
 		return name;
 
-	/* Otherwise construct a new NAME */
+	/* Otherwise, construct a new NAME */
 	if (!prefix)
 		prefix = "System";
 
@@ -4021,6 +4021,7 @@ make_wireless_setting (shvarFile *ifcfg,
 	gint64 chan = 0;
 	NMSettingMacRandomization mac_randomization;
 	NMSettingWirelessPowersave powersave = NM_SETTING_WIRELESS_POWERSAVE_DEFAULT;
+	NMTernary ternary;
 
 	s_wireless = NM_SETTING_WIRELESS (nm_setting_wireless_new ());
 
@@ -4224,6 +4225,14 @@ make_wireless_setting (shvarFile *ifcfg,
 	              mac_randomization,
 	              NULL);
 
+	ternary = svGetValueTernary (ifcfg, "AP_ISOLATION");
+	if (ternary != NM_TERNARY_DEFAULT) {
+		g_object_set (s_wireless,
+		              NM_SETTING_WIRELESS_AP_ISOLATION,
+		              ternary,
+		              NULL);
+	}
+
 	return NM_SETTING (s_wireless);
 
 error:
diff --git a/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-utils.c b/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-utils.c
index d1500dbdb9..e967481500 100644
--- a/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-utils.c
+++ b/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-utils.c
@@ -805,6 +805,7 @@ nms_ifcfg_rh_utils_is_numbered_tag_impl (const char *key,
 const NMSIfcfgKeyTypeInfo nms_ifcfg_well_known_keys[] = {
 	_KEY_TYPE ("ACD_TIMEOUT",                                 NMS_IFCFG_KEY_TYPE_IS_PLAIN ),
 	_KEY_TYPE ("ADDRESS",                                     NMS_IFCFG_KEY_TYPE_IS_NUMBERED ),
+	_KEY_TYPE ("AP_ISOLATION",                                NMS_IFCFG_KEY_TYPE_IS_PLAIN ),
 	_KEY_TYPE ("ARPING_WAIT",                                 NMS_IFCFG_KEY_TYPE_IS_PLAIN ),
 	_KEY_TYPE ("AUTH_RETRIES",                                NMS_IFCFG_KEY_TYPE_IS_PLAIN ),
 	_KEY_TYPE ("AUTOCONNECT_PRIORITY",                        NMS_IFCFG_KEY_TYPE_IS_PLAIN ),
diff --git a/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-utils.h b/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-utils.h
index 459c5ae958..a864137ecd 100644
--- a/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-utils.h
+++ b/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-utils.h
@@ -33,7 +33,7 @@ typedef struct {
 	NMSIfcfgKeyTypeFlags key_flags;
 } NMSIfcfgKeyTypeInfo;
 
-extern const NMSIfcfgKeyTypeInfo nms_ifcfg_well_known_keys[240];
+extern const NMSIfcfgKeyTypeInfo nms_ifcfg_well_known_keys[241];
 
 const NMSIfcfgKeyTypeInfo *nms_ifcfg_well_known_key_find_info (const char *key, gssize *out_idx);
 
diff --git a/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-writer.c b/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-writer.c
index e6526944c7..67de73073a 100644
--- a/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-writer.c
+++ b/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-writer.c
@@ -114,10 +114,13 @@ write_secrets (shvarFile *ifcfg,
                GError **error)
 {
 	nm_auto_shvar_file_close shvarFile *keyfile = NULL;
-	gs_free const char **secrets_keys = NULL;
-	guint i, secrets_keys_n;
+	gs_free NMUtilsNamedValue *secrets_arr_free = NULL;
+	NMUtilsNamedValue secrets_arr_static[30];
+	const NMUtilsNamedValue *secrets_arr;
+	guint secrets_len;
 	GError *local = NULL;
 	gboolean any_secrets = FALSE;
+	guint i;
 
 	keyfile = utils_get_keys_ifcfg (svFileGetName (ifcfg), TRUE);
 	if (!keyfile) {
@@ -126,10 +129,13 @@ write_secrets (shvarFile *ifcfg,
 		return FALSE;
 	}
 
-	secrets_keys = nm_utils_strdict_get_keys (secrets, TRUE, &secrets_keys_n);
-	for (i = 0; i < secrets_keys_n; i++) {
-		const char *k = secrets_keys[i];
-		const char *v = g_hash_table_lookup (secrets, k);
+	secrets_arr = nm_utils_named_values_from_strdict (secrets,
+	                                                  &secrets_len,
+	                                                  secrets_arr_static,
+	                                                  &secrets_arr_free);
+	for (i = 0; i < secrets_len; i++) {
+		const char *k = secrets_arr[i].name;
+		const char *v = secrets_arr[i].value_str;
 
 		if (v) {
 			svSetValueStr (keyfile, k, v);
@@ -947,6 +953,8 @@ write_wireless_setting (NMConnection *connection,
 		break;
 	}
 
+	svSetValueTernary (ifcfg, "AP_ISOLATION", nm_setting_wireless_get_ap_isolation (s_wireless));
+
 	svSetValueStr (ifcfg, "TYPE", TYPE_WIRELESS);
 
 	return TRUE;
@@ -1415,23 +1423,29 @@ write_team_setting (NMConnection *connection, shvarFile *ifcfg, gboolean *wired,
 	return TRUE;
 }
 
-static gboolean
-get_setting_default_boolean (gpointer setting, const char *prop)
-{
-	return NM_G_PARAM_SPEC_GET_DEFAULT_BOOLEAN (g_object_class_find_property (G_OBJECT_GET_CLASS (setting), prop));
-}
+#define get_setting_default_checked_boolean(dflt, setting, prop) \
+	({ \
+		const gboolean _dflt = (dflt); \
+		\
+		nm_assert (NM_G_PARAM_SPEC_GET_DEFAULT_BOOLEAN (g_object_class_find_property (G_OBJECT_GET_CLASS (setting), prop)) == _dflt); \
+		_dflt; \
+	})
 
-static guint
-get_setting_default_uint (gpointer setting, const char *prop)
-{
-	return NM_G_PARAM_SPEC_GET_DEFAULT_UINT (g_object_class_find_property (G_OBJECT_GET_CLASS (setting), prop));
-}
+#define get_setting_default_checked_uint(dflt, setting, prop) \
+	({ \
+		const guint _dflt = (dflt); \
+		\
+		nm_assert (NM_G_PARAM_SPEC_GET_DEFAULT_UINT (g_object_class_find_property (G_OBJECT_GET_CLASS (setting), prop)) == _dflt); \
+		_dflt; \
+	})
 
-static guint64
-get_setting_default_uint64 (gpointer setting, const char *prop)
-{
-	return NM_G_PARAM_SPEC_GET_DEFAULT_UINT64 (g_object_class_find_property (G_OBJECT_GET_CLASS (setting), prop));
-}
+#define get_setting_default_checked_uint64(dflt, setting, prop) \
+	({ \
+		const guint64 _dflt = (dflt); \
+		\
+		nm_assert (NM_G_PARAM_SPEC_GET_DEFAULT_UINT64 (g_object_class_find_property (G_OBJECT_GET_CLASS (setting), prop)) == _dflt); \
+		_dflt; \
+	})
 
 static gboolean
 write_bridge_vlans (NMSetting *setting,
@@ -1475,6 +1489,7 @@ write_bridge_setting (NMConnection *connection, shvarFile *ifcfg, gboolean *wire
 	NMSettingBridge *s_bridge;
 	guint32 u32;
 	guint64 u64;
+	guint u;
 	gboolean b;
 	const char *s;
 	GString *opts;
@@ -1498,164 +1513,141 @@ write_bridge_setting (NMConnection *connection, shvarFile *ifcfg, gboolean *wire
 		svSetValueStr (ifcfg, "STP", "yes");
 
 		u32 = nm_setting_bridge_get_forward_delay (s_bridge);
-		if (u32 != get_setting_default_uint (s_bridge, NM_SETTING_BRIDGE_FORWARD_DELAY))
+		if (u32 != get_setting_default_checked_uint (NM_BRIDGE_FORWARD_DELAY_DEF, s_bridge, NM_SETTING_BRIDGE_FORWARD_DELAY))
 			svSetValueInt64 (ifcfg, "DELAY", u32);
 
 		g_string_append_printf (opts, "priority=%u", nm_setting_bridge_get_priority (s_bridge));
 
 		u32 = nm_setting_bridge_get_hello_time (s_bridge);
-		if (u32 != get_setting_default_uint (s_bridge, NM_SETTING_BRIDGE_HELLO_TIME)) {
-			if (opts->len)
-				g_string_append_c (opts, ' ');
+		if (u32 != get_setting_default_checked_uint (NM_BRIDGE_HELLO_TIME_DEF, s_bridge, NM_SETTING_BRIDGE_HELLO_TIME)) {
+			nm_gstring_add_space_delimiter (opts);
 			g_string_append_printf (opts, "hello_time=%u", u32);
 		}
 
 		u32 = nm_setting_bridge_get_max_age (s_bridge);
-		if (u32 != get_setting_default_uint (s_bridge, NM_SETTING_BRIDGE_MAX_AGE)) {
-			if (opts->len)
-				g_string_append_c (opts, ' ');
+		if (u32 != get_setting_default_checked_uint (NM_BRIDGE_MAX_AGE_DEF, s_bridge, NM_SETTING_BRIDGE_MAX_AGE)) {
+			nm_gstring_add_space_delimiter (opts);
 			g_string_append_printf (opts, "max_age=%u", u32);
 		}
 	}
 
-	u32 = nm_setting_bridge_get_ageing_time (s_bridge);
-	if (u32 != get_setting_default_uint (s_bridge, NM_SETTING_BRIDGE_AGEING_TIME)) {
-		if (opts->len)
-			g_string_append_c (opts, ' ');
-		g_string_append_printf (opts, "ageing_time=%u", u32);
+	u = nm_setting_bridge_get_ageing_time (s_bridge);
+	if (u != get_setting_default_checked_uint (NM_BRIDGE_AGEING_TIME_DEF, s_bridge, NM_SETTING_BRIDGE_AGEING_TIME)) {
+		nm_gstring_add_space_delimiter (opts);
+		g_string_append_printf (opts, "ageing_time=%u", u);
 	}
 
 	s = nm_setting_bridge_get_group_address (s_bridge);
 	if (s) {
-		if (opts->len)
-			g_string_append_c (opts, ' ');
+		nm_gstring_add_space_delimiter (opts);
 		g_string_append_printf (opts, "group_address=%s", s);
 	}
 
 	u32 = nm_setting_bridge_get_group_forward_mask (s_bridge);
-	if (u32 != get_setting_default_uint (s_bridge, NM_SETTING_BRIDGE_GROUP_FORWARD_MASK)) {
-		if (opts->len)
-			g_string_append_c (opts, ' ');
+	if (u32 != get_setting_default_checked_uint (0, s_bridge, NM_SETTING_BRIDGE_GROUP_FORWARD_MASK)) {
+		nm_gstring_add_space_delimiter (opts);
 		g_string_append_printf (opts, "group_fwd_mask=%u", u32);
 	}
 
-
 	u32 = nm_setting_bridge_get_multicast_hash_max (s_bridge);
-	if (u32 != get_setting_default_uint (s_bridge, NM_SETTING_BRIDGE_MULTICAST_HASH_MAX)) {
-		if (opts->len)
-			g_string_append_c (opts, ' ');
+	if (u32 != get_setting_default_checked_uint (NM_BRIDGE_MULTICAST_HASH_MAX_DEF, s_bridge, NM_SETTING_BRIDGE_MULTICAST_HASH_MAX)) {
+		nm_gstring_add_space_delimiter (opts);
 		g_string_append_printf (opts, "multicast_hash_max=%u", u32);
 	}
 
 	u32 = nm_setting_bridge_get_multicast_last_member_count (s_bridge);
-	if (u32 != get_setting_default_uint (s_bridge, NM_SETTING_BRIDGE_MULTICAST_LAST_MEMBER_COUNT)) {
-		if (opts->len)
-			g_string_append_c (opts, ' ');
+	if (u32 != get_setting_default_checked_uint (NM_BRIDGE_MULTICAST_LAST_MEMBER_COUNT_DEF, s_bridge, NM_SETTING_BRIDGE_MULTICAST_LAST_MEMBER_COUNT)) {
+		nm_gstring_add_space_delimiter (opts);
 		g_string_append_printf (opts, "multicast_last_member_count=%u", u32);
 	}
 
 	u64 = nm_setting_bridge_get_multicast_last_member_interval (s_bridge);
-	if (u64 != get_setting_default_uint64 (s_bridge, NM_SETTING_BRIDGE_MULTICAST_LAST_MEMBER_INTERVAL)) {
-		if (opts->len)
-			g_string_append_c (opts, ' ');
+	if (u64 != get_setting_default_checked_uint64 (NM_BRIDGE_MULTICAST_LAST_MEMBER_INTERVAL_DEF, s_bridge, NM_SETTING_BRIDGE_MULTICAST_LAST_MEMBER_INTERVAL)) {
+		nm_gstring_add_space_delimiter (opts);
 		g_string_append_printf (opts, "multicast_last_member_interval=%"G_GUINT64_FORMAT, u64);
 	}
 
 	u64 = nm_setting_bridge_get_multicast_membership_interval (s_bridge);
-	if (u64 != get_setting_default_uint64 (s_bridge, NM_SETTING_BRIDGE_MULTICAST_MEMBERSHIP_INTERVAL)) {
-		if (opts->len)
-			g_string_append_c (opts, ' ');
+	if (u64 != get_setting_default_checked_uint64 (NM_BRIDGE_MULTICAST_MEMBERSHIP_INTERVAL_DEF, s_bridge, NM_SETTING_BRIDGE_MULTICAST_MEMBERSHIP_INTERVAL)) {
+		nm_gstring_add_space_delimiter (opts);
 		g_string_append_printf (opts, "multicast_membership_interval=%"G_GUINT64_FORMAT, u64);
 	}
 
 	b = nm_setting_bridge_get_multicast_querier (s_bridge);
-	if (b != get_setting_default_boolean (s_bridge, NM_SETTING_BRIDGE_MULTICAST_QUERIER)) {
-		if (opts->len)
-			g_string_append_c (opts, ' ');
+	if (b != get_setting_default_checked_boolean (NM_BRIDGE_MULTICAST_QUERIER_DEF, s_bridge, NM_SETTING_BRIDGE_MULTICAST_QUERIER)) {
+		nm_gstring_add_space_delimiter (opts);
 		g_string_append_printf (opts, "multicast_querier=%u", (guint) b);
 	}
 
 	u64 = nm_setting_bridge_get_multicast_querier_interval (s_bridge);
-	if (u64 != get_setting_default_uint64 (s_bridge, NM_SETTING_BRIDGE_MULTICAST_QUERIER_INTERVAL)) {
-		if (opts->len)
-			g_string_append_c (opts, ' ');
+	if (u64 != get_setting_default_checked_uint64 (NM_BRIDGE_MULTICAST_QUERIER_INTERVAL_DEF, s_bridge, NM_SETTING_BRIDGE_MULTICAST_QUERIER_INTERVAL)) {
+		nm_gstring_add_space_delimiter (opts);
 		g_string_append_printf (opts, "multicast_querier_interval=%"G_GUINT64_FORMAT, u64);
 	}
 
 	u64 = nm_setting_bridge_get_multicast_query_interval (s_bridge);
-	if (u64 != get_setting_default_uint64 (s_bridge, NM_SETTING_BRIDGE_MULTICAST_QUERY_INTERVAL)) {
-		if (opts->len)
-			g_string_append_c (opts, ' ');
+	if (u64 != get_setting_default_checked_uint64 (NM_BRIDGE_MULTICAST_QUERY_INTERVAL_DEF, s_bridge, NM_SETTING_BRIDGE_MULTICAST_QUERY_INTERVAL)) {
+		nm_gstring_add_space_delimiter (opts);
 		g_string_append_printf (opts, "multicast_query_interval=%"G_GUINT64_FORMAT, u64);
 	}
 
 	u64 = nm_setting_bridge_get_multicast_query_response_interval (s_bridge);
-	if (u64 != get_setting_default_uint64 (s_bridge, NM_SETTING_BRIDGE_MULTICAST_QUERY_RESPONSE_INTERVAL)) {
-		if (opts->len)
-			g_string_append_c (opts, ' ');
+	if (u64 != get_setting_default_checked_uint64 (NM_BRIDGE_MULTICAST_QUERY_RESPONSE_INTERVAL_DEF, s_bridge, NM_SETTING_BRIDGE_MULTICAST_QUERY_RESPONSE_INTERVAL)) {
+		nm_gstring_add_space_delimiter (opts);
 		g_string_append_printf (opts, "multicast_query_response_interval=%"G_GUINT64_FORMAT, u64);
 	}
 
 	b = nm_setting_bridge_get_multicast_query_use_ifaddr (s_bridge);
-	if (b != get_setting_default_boolean (s_bridge, NM_SETTING_BRIDGE_MULTICAST_QUERY_USE_IFADDR)) {
-		if (opts->len)
-			g_string_append_c (opts, ' ');
+	if (b != get_setting_default_checked_boolean (NM_BRIDGE_MULTICAST_QUERY_USE_IFADDR_DEF, s_bridge, NM_SETTING_BRIDGE_MULTICAST_QUERY_USE_IFADDR)) {
+		nm_gstring_add_space_delimiter (opts);
 		g_string_append_printf (opts, "multicast_query_use_ifaddr=%u", (guint) b);
 	}
 
 	b = nm_setting_bridge_get_multicast_snooping (s_bridge);
-	if (b != get_setting_default_boolean (s_bridge, NM_SETTING_BRIDGE_MULTICAST_SNOOPING)) {
-		if (opts->len)
-			g_string_append_c (opts, ' ');
+	if (b != get_setting_default_checked_boolean (NM_BRIDGE_MULTICAST_SNOOPING_DEF, s_bridge, NM_SETTING_BRIDGE_MULTICAST_SNOOPING)) {
+		nm_gstring_add_space_delimiter (opts);
 		g_string_append_printf (opts, "multicast_snooping=%u", (guint32) b);
 	}
 
 	u32 = nm_setting_bridge_get_multicast_startup_query_count (s_bridge);
-	if (u32 != get_setting_default_uint (s_bridge, NM_SETTING_BRIDGE_MULTICAST_STARTUP_QUERY_COUNT)) {
-		if (opts->len)
-			g_string_append_c (opts, ' ');
+	if (u32 != get_setting_default_checked_uint (NM_BRIDGE_MULTICAST_STARTUP_QUERY_COUNT_DEF, s_bridge, NM_SETTING_BRIDGE_MULTICAST_STARTUP_QUERY_COUNT)) {
+		nm_gstring_add_space_delimiter (opts);
 		g_string_append_printf (opts, "multicast_startup_query_count=%u", u32);
 	}
 
 	u64 = nm_setting_bridge_get_multicast_startup_query_interval (s_bridge);
-	if (u64 != get_setting_default_uint64 (s_bridge, NM_SETTING_BRIDGE_MULTICAST_STARTUP_QUERY_INTERVAL)) {
-		if (opts->len)
-			g_string_append_c (opts, ' ');
+	if (u64 != get_setting_default_checked_uint64 (NM_BRIDGE_MULTICAST_STARTUP_QUERY_INTERVAL_DEF, s_bridge, NM_SETTING_BRIDGE_MULTICAST_STARTUP_QUERY_INTERVAL)) {
+		nm_gstring_add_space_delimiter (opts);
 		g_string_append_printf (opts, "multicast_startup_query_interval=%"G_GUINT64_FORMAT, u64);
 	}
 
 	s = nm_setting_bridge_get_multicast_router (s_bridge);
 	if (s) {
-		if (opts->len)
-			g_string_append_c (opts, ' ');
+		nm_gstring_add_space_delimiter (opts);
 		g_string_append_printf (opts, "multicast_router=%s", s);
 	}
 
 	b = nm_setting_bridge_get_vlan_filtering (s_bridge);
-	if (b != get_setting_default_boolean (s_bridge, NM_SETTING_BRIDGE_VLAN_FILTERING)) {
-		if (opts->len)
-			g_string_append_c (opts, ' ');
+	if (b != get_setting_default_checked_boolean (FALSE, s_bridge, NM_SETTING_BRIDGE_VLAN_FILTERING)) {
+		nm_gstring_add_space_delimiter (opts);
 		g_string_append_printf (opts, "vlan_filtering=%u", (guint32) b);
 	}
 
 	u32 = nm_setting_bridge_get_vlan_default_pvid (s_bridge);
-	if (u32 != get_setting_default_uint (s_bridge, NM_SETTING_BRIDGE_VLAN_DEFAULT_PVID)) {
-		if (opts->len)
-			g_string_append_c (opts, ' ');
+	if (u32 != get_setting_default_checked_uint (NM_BRIDGE_VLAN_DEFAULT_PVID_DEF, s_bridge, NM_SETTING_BRIDGE_VLAN_DEFAULT_PVID)) {
+		nm_gstring_add_space_delimiter (opts);
 		g_string_append_printf (opts, "default_pvid=%u", u32);
 	}
 
 	s = nm_setting_bridge_get_vlan_protocol (s_bridge);
 	if (s) {
-		if (opts->len)
-			g_string_append_c (opts, ' ');
+		nm_gstring_add_space_delimiter (opts);
 		g_string_append_printf (opts, "vlan_protocol=%s", s);
 	}
 
 	b = nm_setting_bridge_get_vlan_stats_enabled (s_bridge);
-	if (b != get_setting_default_boolean (s_bridge, NM_SETTING_BRIDGE_VLAN_STATS_ENABLED)) {
-		if (opts->len)
-			g_string_append_c (opts, ' ');
+	if (b != get_setting_default_checked_boolean (NM_BRIDGE_VLAN_STATS_ENABLED_DEF, s_bridge, NM_SETTING_BRIDGE_VLAN_STATS_ENABLED)) {
+		nm_gstring_add_space_delimiter (opts);
 		g_string_append_printf (opts, "vlan_stats_enabled=%u", (guint) b);
 	}
 
@@ -1692,11 +1684,11 @@ write_bridge_port_setting (NMConnection *connection, shvarFile *ifcfg, GError **
 	string = g_string_sized_new (32);
 
 	u32 = nm_setting_bridge_port_get_priority (s_port);
-	if (u32 != get_setting_default_uint (NM_SETTING (s_port), NM_SETTING_BRIDGE_PORT_PRIORITY))
+	if (u32 != get_setting_default_checked_uint (NM_BRIDGE_PORT_PRIORITY_DEF, s_port, NM_SETTING_BRIDGE_PORT_PRIORITY))
 		g_string_append_printf (string, "priority=%u", u32);
 
 	u32 = nm_setting_bridge_port_get_path_cost (s_port);
-	if (u32 != get_setting_default_uint (NM_SETTING (s_port), NM_SETTING_BRIDGE_PORT_PATH_COST)) {
+	if (u32 != get_setting_default_checked_uint (NM_BRIDGE_PORT_PATH_COST_DEF, s_port, NM_SETTING_BRIDGE_PORT_PATH_COST)) {
 		if (string->len)
 			g_string_append_c (string, ' ');
 		g_string_append_printf (string, "path_cost=%u", u32);
diff --git a/src/settings/plugins/ifcfg-rh/shvar.c b/src/settings/plugins/ifcfg-rh/shvar.c
index cd63661d9a..a447720690 100644
--- a/src/settings/plugins/ifcfg-rh/shvar.c
+++ b/src/settings/plugins/ifcfg-rh/shvar.c
@@ -1214,6 +1214,20 @@ svGetValueBoolean (shvarFile *s, const char *key, int fallback)
 	return svParseBoolean (value, fallback);
 }
 
+/* svGetValueTernary:
+ * @s: fhe file
+ * @key: the name of the key to read
+ *
+ * Reads a value @key and converts it to a NMTernary value.
+ *
+ * Returns: the parsed NMTernary
+ */
+NMTernary
+svGetValueTernary (shvarFile *s, const char *key)
+{
+	return svGetValueBoolean (s, key, NM_TERNARY_DEFAULT);
+}
+
 /* svGetValueInt64:
  * @s: fhe file
  * @key: the name of the key to read
@@ -1428,6 +1442,15 @@ svSetValueBoolean (shvarFile *s, const char *key, gboolean value)
 	return svSetValue (s, key, value ? "yes" : "no");
 }
 
+gboolean
+svSetValueTernary (shvarFile *s, const char *key, NMTernary value)
+{
+	if (NM_IN_SET (value, NM_TERNARY_TRUE, NM_TERNARY_FALSE))
+		return svSetValueBoolean (s, key, (gboolean) value);
+	else
+		return svUnsetValue (s, key);
+}
+
 gboolean
 svSetValueBoolean_cond_true (shvarFile *s, const char *key, gboolean value)
 {
diff --git a/src/settings/plugins/ifcfg-rh/shvar.h b/src/settings/plugins/ifcfg-rh/shvar.h
index 410284f8cb..852dd4c1de 100644
--- a/src/settings/plugins/ifcfg-rh/shvar.h
+++ b/src/settings/plugins/ifcfg-rh/shvar.h
@@ -66,6 +66,8 @@ const char **svGetKeysSorted (shvarFile *s,
  */
 int svGetValueBoolean (shvarFile *s, const char *key, int def);
 
+NMTernary svGetValueTernary (shvarFile *s, const char *key);
+
 gint64 svGetValueInt64 (shvarFile *s, const char *key, guint base, gint64 min, gint64 max, gint64 fallback);
 
 gboolean svGetValueEnum (shvarFile *s, const char *key,
@@ -84,6 +86,7 @@ gboolean svSetValueBoolean_cond_true (shvarFile *s, const char *key, gboolean va
 gboolean svSetValueInt64 (shvarFile *s, const char *key, gint64 value);
 gboolean svSetValueInt64_cond (shvarFile *s, const char *key, gboolean do_set, gint64 value);
 gboolean svSetValueEnum (shvarFile *s, const char *key, GType gtype, int value);
+gboolean svSetValueTernary (shvarFile *s, const char *key, NMTernary value);
 
 gboolean svUnsetValue (shvarFile *s, const char *key);
 gboolean svUnsetAll (shvarFile *s, SvKeyType match_key_type);
diff --git a/src/settings/plugins/ifcfg-rh/tests/network-scripts/ifcfg-Test_Write_WiFi_AP_Mode.cexpected b/src/settings/plugins/ifcfg-rh/tests/network-scripts/ifcfg-Test_Write_WiFi_AP_Mode.cexpected
new file mode 100644
index 0000000000..ccec2b81ae
--- /dev/null
+++ b/src/settings/plugins/ifcfg-rh/tests/network-scripts/ifcfg-Test_Write_WiFi_AP_Mode.cexpected
@@ -0,0 +1,19 @@
+ESSID=MySSID
+MODE=Ap
+CHANNEL=196
+MAC_ADDRESS_RANDOMIZATION=default
+AP_ISOLATION=yes
+TYPE=Wireless
+PROXY_METHOD=none
+BROWSER_ONLY=no
+BOOTPROTO=dhcp
+DEFROUTE=yes
+IPV4_FAILURE_FATAL=no
+IPV6INIT=yes
+IPV6_AUTOCONF=yes
+IPV6_DEFROUTE=yes
+IPV6_FAILURE_FATAL=no
+IPV6_ADDR_GEN_MODE=stable-privacy
+NAME="Test Write Wi-Fi AP Mode"
+UUID=${UUID}
+ONBOOT=yes
diff --git a/src/settings/plugins/ifcfg-rh/tests/test-ifcfg-rh.c b/src/settings/plugins/ifcfg-rh/tests/test-ifcfg-rh.c
index 40d1bb8c53..935ea9fdf8 100644
--- a/src/settings/plugins/ifcfg-rh/tests/test-ifcfg-rh.c
+++ b/src/settings/plugins/ifcfg-rh/tests/test-ifcfg-rh.c
@@ -15,6 +15,7 @@
 #include <sys/types.h>
 #include <sys/stat.h>
 
+#include "nm-glib-aux/nm-json-aux.h"
 #include "nm-utils.h"
 #include "nm-setting-connection.h"
 #include "nm-setting-wired.h"
@@ -96,7 +97,7 @@ _assert_reread_same_FIXME (NMConnection *connection, NMConnection *reread)
 	/* FIXME: these assertion failures should not happen as we expect
 	 * that re-reading a connection after write yields the same result.
 	 *
-	 * Needs investation and fixing. */
+	 * Needs investigation and fixing. */
 	nmtst_assert_connection_verifies_without_normalization (reread);
 
 	connection_normalized = nmtst_connection_duplicate_and_normalize (connection);
@@ -3966,6 +3967,54 @@ test_write_wifi_band_a (void)
 	nmtst_assert_connection_equals (connection, TRUE, reread, FALSE);
 }
 
+static void
+test_write_wifi_ap_mode (void)
+{
+	nmtst_auto_unlinkfile char *testfile = NULL;
+	gs_unref_object NMConnection *connection = NULL;
+	gs_unref_object NMConnection *reread = NULL;
+	NMSettingConnection *s_con;
+	NMSettingWireless *s_wifi;
+	gs_unref_bytes GBytes *ssid = NULL;
+
+	connection = nm_simple_connection_new ();
+
+	/* Connection setting */
+	s_con = (NMSettingConnection *) nm_setting_connection_new ();
+	nm_connection_add_setting (connection, NM_SETTING (s_con));
+
+	g_object_set (s_con,
+	              NM_SETTING_CONNECTION_ID, "Test Write Wi-Fi AP Mode",
+	              NM_SETTING_CONNECTION_UUID, nm_utils_uuid_generate_a (),
+	              NM_SETTING_CONNECTION_TYPE, NM_SETTING_WIRELESS_SETTING_NAME,
+	              NULL);
+
+	/* Wifi setting */
+	s_wifi = (NMSettingWireless *) nm_setting_wireless_new ();
+	nm_connection_add_setting (connection, NM_SETTING (s_wifi));
+
+	ssid = g_bytes_new ("MySSID", NM_STRLEN ("MySSID"));
+
+	g_object_set (s_wifi,
+	              NM_SETTING_WIRELESS_SSID, ssid,
+	              NM_SETTING_WIRELESS_MODE, "ap",
+	              NM_SETTING_WIRELESS_BAND, "a",
+	              NM_SETTING_WIRELESS_CHANNEL, (guint) 196,
+	              NM_SETTING_WIRELESS_AP_ISOLATION, NM_TERNARY_TRUE,
+	              NULL);
+
+	nmtst_assert_connection_verifies (connection);
+
+	_writer_new_connec_exp (connection,
+	                        TEST_SCRATCH_DIR,
+	                        TEST_IFCFG_DIR"/ifcfg-Test_Write_WiFi_AP_Mode.cexpected",
+	                        &testfile);
+
+	reread = _connection_from_file (testfile, NULL, TYPE_WIRELESS, NULL);
+
+	nmtst_assert_connection_equals (connection, TRUE, reread, FALSE);
+}
+
 static void
 test_read_wifi_band_a_channel_mismatch (void)
 {
@@ -9081,7 +9130,7 @@ test_read_team_master_invalid (gconstpointer user_data)
 	gs_free_error GError *error = NULL;
 	gs_unref_object NMConnection *connection = NULL;
 
-	if (WITH_JSON_VALIDATION) {
+	if (nm_json_vt ()) {
 		_connection_from_file_fail (PATH_NAME, NULL, TYPE_ETHERNET, &error);
 
 		g_assert_error (error, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_INVALID_PROPERTY);
@@ -9528,7 +9577,7 @@ do_svUnescape_combine_ansi_append (GString *str_val, GString *str_exp, const Une
 	if (honor_needs_ascii_separator && data->needs_ascii_separator) {
 		/* the string has an open escape sequence. We must ensure that when
 		 * combining it with another sequence, that they don't merge into
-		 * something diffent. for example "\xa" + "a" must not result in
+		 * something different. for example "\xa" + "a" must not result in
 		 * "\xaa". Instead, we add a space in between to get "\xa a". */
 		g_string_append (str_val, " ");
 		g_string_append (str_exp, " ");
@@ -10645,6 +10694,7 @@ int main (int argc, char **argv)
 	g_test_add_func (TPATH "wifi/write-wpa-then-wep-with-perms", test_write_wifi_wpa_then_wep_with_perms);
 	g_test_add_func (TPATH "wifi/write-hidden", test_write_wifi_hidden);
 	g_test_add_func (TPATH "wifi/write-band-a", test_write_wifi_band_a);
+	g_test_add_func (TPATH "wifi/write-ap-mode", test_write_wifi_ap_mode);
 
 	g_test_add_func (TPATH "s390/read-qeth-static", test_read_wired_qeth_static);
 	g_test_add_func (TPATH "s390/write-qeth-dhcp", test_write_wired_qeth_dhcp);
diff --git a/src/settings/plugins/ifupdown/tests/test-ifupdown.c b/src/settings/plugins/ifupdown/tests/test-ifupdown.c
index 6a7b5ecc76..497a1caa10 100644
--- a/src/settings/plugins/ifupdown/tests/test-ifupdown.c
+++ b/src/settings/plugins/ifupdown/tests/test-ifupdown.c
@@ -190,7 +190,7 @@ dump_blocks (if_parser *parser)
 		g_print("'%s' '%s'\n", n->type, n->name);
 
 		// each key-value pair within a block is indented & separated by a tab
-		// (single quotes used to show typ & name baoundaries)
+		// (single quotes used to show type & name boundaries)
 		c_list_for_each_entry (m, &n->data_lst_head, data_lst)
 			g_print("\t'%s'\t'%s'\n", m->key, m->data);
 
diff --git a/src/settings/plugins/keyfile/nms-keyfile-plugin.c b/src/settings/plugins/keyfile/nms-keyfile-plugin.c
index c84bd78d0d..09023dbb29 100644
--- a/src/settings/plugins/keyfile/nms-keyfile-plugin.c
+++ b/src/settings/plugins/keyfile/nms-keyfile-plugin.c
@@ -529,7 +529,7 @@ _storages_consolidate (NMSKeyfilePlugin *self,
 		storage = storages_modified->pdata[i];
 
 		if (!storage->is_dirty) {
-			/* the entry is no longer is_dirty. In the meantime we already emited
+			/* the entry is no longer is_dirty. In the meantime we already emitted
 			 * another signal for it. */
 			continue;
 		}
diff --git a/src/settings/plugins/keyfile/nms-keyfile-utils.c b/src/settings/plugins/keyfile/nms-keyfile-utils.c
index bc8dfd12c2..e3c3969146 100644
--- a/src/settings/plugins/keyfile/nms-keyfile-utils.c
+++ b/src/settings/plugins/keyfile/nms-keyfile-utils.c
@@ -266,7 +266,7 @@ nms_keyfile_nmmeta_write (const char *dirname,
 		}
 	} else {
 		/* we only have the "loaded_path" to store. That is commonly used for the tombstones to
-		 * link to /dev/null. A symlink is sufficient to store that ammount of information.
+		 * link to /dev/null. A symlink is sufficient to store that amount of information.
 		 * No need to bother with a keyfile. */
 		if (symlink (loaded_path, full_filename_tmp) != 0) {
 			errsv = -NM_ERRNO_NATIVE (errno);
diff --git a/src/supplicant/nm-supplicant-config.c b/src/supplicant/nm-supplicant-config.c
index 058792d026..f37798d97a 100644
--- a/src/supplicant/nm-supplicant-config.c
+++ b/src/supplicant/nm-supplicant-config.c
@@ -10,8 +10,8 @@
 
 #include <stdlib.h>
 
+#include "nm-glib-aux/nm-str-buf.h"
 #include "nm-core-internal.h"
-
 #include "nm-supplicant-settings-verify.h"
 #include "nm-setting.h"
 #include "nm-libnm-core-intern/nm-auth-subject.h"
@@ -34,6 +34,7 @@ typedef struct {
 	guint32 ap_scan;
 	bool fast_required:1;
 	bool dispose_has_run:1;
+	bool ap_isolation:1;
 } NMSupplicantConfigPrivate;
 
 struct _NMSupplicantConfig {
@@ -342,26 +343,39 @@ wifi_freqs_to_string (gboolean bg_band)
 {
 	static const char *str_2ghz = NULL;
 	static const char *str_5ghz = NULL;
-	const char *str;
+	const char **f_p;
+	const char *f;
 
-	str = bg_band ? str_2ghz : str_5ghz;
+	f_p =   bg_band
+	      ? &str_2ghz
+	      : &str_5ghz;
 
-	if (G_UNLIKELY (str == NULL)) {
-		GString *tmp;
+again:
+	f = g_atomic_pointer_get (f_p);
+
+	if (G_UNLIKELY (!f)) {
+		nm_auto_str_buf NMStrBuf strbuf = NM_STR_BUF_INIT (400, FALSE);
 		const guint *freqs;
 		int i;
 
-		freqs = bg_band ? nm_utils_wifi_2ghz_freqs () : nm_utils_wifi_5ghz_freqs ();
-		tmp = g_string_sized_new (bg_band ? 70 : 225);
-		for (i = 0; freqs[i]; i++)
-			g_string_append_printf (tmp, i == 0 ? "%d" : " %d", freqs[i]);
-		str = g_string_free (tmp, FALSE);
-		if (bg_band)
-			str_2ghz = str;
-		else
-			str_5ghz = str;
+		freqs =   bg_band
+		        ? nm_utils_wifi_2ghz_freqs ()
+		        : nm_utils_wifi_5ghz_freqs ();
+		for (i = 0; freqs[i]; i++) {
+			if (i > 0)
+				nm_str_buf_append_c (&strbuf, ' ');
+			nm_str_buf_append_printf (&strbuf, "%u", freqs[i]);
+		}
+
+		f = g_strdup (nm_str_buf_get_str (&strbuf));
+
+		if (!g_atomic_pointer_compare_and_exchange (f_p, NULL, f)) {
+			g_free ((char *) f);
+			goto again;
+		}
 	}
-	return str;
+
+	return f;
 }
 
 gboolean
@@ -464,9 +478,9 @@ nm_supplicant_config_add_setting_wireless (NMSupplicantConfig * self,
 	priv = NM_SUPPLICANT_CONFIG_GET_PRIVATE (self);
 
 	mode = nm_setting_wireless_get_mode (setting);
-	is_adhoc = (mode && !strcmp (mode, "adhoc")) ? TRUE : FALSE;
-	is_ap = (mode && !strcmp (mode, "ap")) ? TRUE : FALSE;
-	is_mesh = (mode && !strcmp (mode, "mesh")) ? TRUE : FALSE;
+	is_adhoc = nm_streq0 (mode, "adhoc");
+	is_ap = nm_streq0 (mode, "ap");
+	is_mesh = nm_streq0 (mode, "mesh");
 	if (is_adhoc || is_ap)
 		priv->ap_scan = 2;
 	else
@@ -540,9 +554,9 @@ nm_supplicant_config_add_setting_wireless (NMSupplicantConfig * self,
 		} else {
 			const char *freqs = NULL;
 
-			if (!strcmp (band, "a"))
+			if (nm_streq (band, "a"))
 				freqs = wifi_freqs_to_string (FALSE);
-			else if (!strcmp (band, "bg"))
+			else if (nm_streq (band, "bg"))
 				freqs = wifi_freqs_to_string (TRUE);
 
 			if (freqs && !nm_supplicant_config_add_option (self, "freq_list", freqs, strlen (freqs), NULL, error))
@@ -716,7 +730,7 @@ add_wep_key (NMSupplicantConfig *self,
 			                               sizeof (buffer),
 			                               NULL)) {
 				g_set_error (error, NM_SUPPLICANT_ERROR, NM_SUPPLICANT_ERROR_CONFIG,
-				             "cannot add wep-key %s to suplicant config because key is not hex",
+				             "cannot add wep-key %s to supplicant config because key is not hex",
 				             name);
 				return FALSE;
 			}
@@ -732,7 +746,7 @@ add_wep_key (NMSupplicantConfig *self,
 				return FALSE;
 		} else {
 			g_set_error (error, NM_SUPPLICANT_ERROR, NM_SUPPLICANT_ERROR_CONFIG,
-			             "Cannot add wep-key %s to suplicant config because key-length %u is invalid",
+			             "Cannot add wep-key %s to supplicant config because key-length %u is invalid",
 			             name, (guint) key_len);
 			return FALSE;
 		}
@@ -888,10 +902,10 @@ nm_supplicant_config_add_setting_wireless_security (NMSupplicantConfig *self,
 	}
 
 	/* Only WPA-specific things when using WPA */
-	if (   !strcmp (key_mgmt, "wpa-psk")
-	    || !strcmp (key_mgmt, "wpa-eap")
-	    || !strcmp (key_mgmt, "sae")
-	    || !strcmp (key_mgmt, "owe")) {
+	if (NM_IN_STRSET (key_mgmt, "wpa-psk",
+	                            "wpa-eap",
+	                            "sae",
+	                            "owe")) {
 		if (!ADD_STRING_LIST_VAL (self, setting, wireless_security, proto, protos, "proto", ' ', TRUE, NULL, error))
 			return FALSE;
 		if (!ADD_STRING_LIST_VAL (self, setting, wireless_security, pairwise, pairwise, "pairwise", ' ', TRUE, NULL, error))
@@ -914,7 +928,7 @@ nm_supplicant_config_add_setting_wireless_security (NMSupplicantConfig *self,
 	}
 
 	/* WEP keys if required */
-	if (!strcmp (key_mgmt, "none")) {
+	if (nm_streq (key_mgmt, "none")) {
 		NMWepKeyType wep_type = nm_setting_wireless_security_get_wep_key_type (setting);
 		const char *wep0 = nm_setting_wireless_security_get_wep_key (setting, 0);
 		const char *wep1 = nm_setting_wireless_security_get_wep_key (setting, 1);
@@ -939,9 +953,9 @@ nm_supplicant_config_add_setting_wireless_security (NMSupplicantConfig *self,
 		}
 	}
 
-	if (auth_alg && !strcmp (auth_alg, "leap")) {
+	if (nm_streq0 (auth_alg, "leap")) {
 		/* LEAP */
-		if (!strcmp (key_mgmt, "ieee8021x")) {
+		if (nm_streq (key_mgmt, "ieee8021x")) {
 			const char *tmp;
 
 			tmp = nm_setting_wireless_security_get_leap_username (setting);
@@ -961,7 +975,8 @@ nm_supplicant_config_add_setting_wireless_security (NMSupplicantConfig *self,
 		}
 	} else {
 		/* 802.1x for Dynamic WEP and WPA-Enterprise */
-		if (!strcmp (key_mgmt, "ieee8021x") || !strcmp (key_mgmt, "wpa-eap")) {
+		if (NM_IN_STRSET (key_mgmt, "ieee8021x",
+		                            "wpa-eap")) {
 			if (!setting_8021x) {
 				g_set_error (error, NM_SUPPLICANT_ERROR, NM_SUPPLICANT_ERROR_CONFIG,
 				             "Cannot set key-mgmt %s with missing 8021x setting", key_mgmt);
@@ -971,7 +986,7 @@ nm_supplicant_config_add_setting_wireless_security (NMSupplicantConfig *self,
 				return FALSE;
 		}
 
-		if (!strcmp (key_mgmt, "wpa-eap")) {
+		if (nm_streq (key_mgmt, "wpa-eap")) {
 			/* When using WPA-Enterprise, we want to use Proactive Key Caching (also
 			 * called Opportunistic Key Caching) to avoid full EAP exchanges when
 			 * roaming between access points in the same mobility group.
@@ -1135,9 +1150,9 @@ nm_supplicant_config_add_setting_8021x (NMSupplicantConfig *self,
 	phase1 = g_string_new (NULL);
 	peapver = nm_setting_802_1x_get_phase1_peapver (setting);
 	if (peapver) {
-		if (!strcmp (peapver, "0"))
+		if (nm_streq (peapver, "0"))
 			g_string_append (phase1, "peapver=0");
-		else if (!strcmp (peapver, "1"))
+		else if (nm_streq (peapver, "1"))
 			g_string_append (phase1, "peapver=1");
 	}
 
@@ -1153,7 +1168,7 @@ nm_supplicant_config_add_setting_8021x (NMSupplicantConfig *self,
 			g_string_append_c (phase1, ' ');
 		g_string_append_printf (phase1, "fast_provisioning=%s", value);
 
-		if (strcmp (value, "0") != 0)
+		if (!nm_streq (value, "0"))
 			fast_provisoning_allowed = TRUE;
 	}
 
@@ -1507,3 +1522,14 @@ nm_supplicant_config_add_no_security (NMSupplicantConfig *self, GError **error)
 	return nm_supplicant_config_add_option (self, "key_mgmt", "NONE", -1, NULL, error);
 }
 
+gboolean
+nm_supplicant_config_get_ap_isolation (NMSupplicantConfig *self)
+{
+	return self->_priv.ap_isolation;
+}
+
+void
+nm_supplicant_config_set_ap_isolation (NMSupplicantConfig *self, gboolean ap_isolation)
+{
+	self->_priv.ap_isolation = ap_isolation;
+}
diff --git a/src/supplicant/nm-supplicant-config.h b/src/supplicant/nm-supplicant-config.h
index e1da9a1eca..530c2cdd0b 100644
--- a/src/supplicant/nm-supplicant-config.h
+++ b/src/supplicant/nm-supplicant-config.h
@@ -69,4 +69,8 @@ gboolean nm_supplicant_config_add_setting_macsec (NMSupplicantConfig *self,
 
 gboolean nm_supplicant_config_enable_pmf_akm (NMSupplicantConfig *self,
                                               GError **error);
+
+void     nm_supplicant_config_set_ap_isolation (NMSupplicantConfig *self, gboolean ap_isolation);
+gboolean nm_supplicant_config_get_ap_isolation (NMSupplicantConfig *self);
+
 #endif /* __NETWORKMANAGER_SUPPLICANT_CONFIG_H__ */
diff --git a/src/supplicant/nm-supplicant-interface.c b/src/supplicant/nm-supplicant-interface.c
index 3dda0fbf25..93dbc59641 100644
--- a/src/supplicant/nm-supplicant-interface.c
+++ b/src/supplicant/nm-supplicant-interface.c
@@ -44,6 +44,7 @@ typedef struct {
 	gpointer user_data;
 	guint fail_on_idle_id;
 	guint blobs_left;
+	guint calls_left;
 	struct _AddNetworkData *add_network_data;
 } AssocData;
 
@@ -157,6 +158,8 @@ typedef struct _NMSupplicantInterfacePrivate {
 	bool           prop_scan_active:1;
 	bool           prop_scan_ssid:1;
 
+	bool           ap_isolate_supported:1;
+	bool           ap_isolate_needs_reset:1;
 } NMSupplicantInterfacePrivate;
 
 struct _NMSupplicantInterfaceClass {
@@ -436,6 +439,20 @@ _remove_network (NMSupplicantInterface *self)
 	                              g_variant_new ("(o)", net_path),
 	                              G_VARIANT_TYPE ("()"),
 	                              "remove-network");
+
+	if (   priv->ap_isolate_supported
+	    && priv->ap_isolate_needs_reset) {
+		_dbus_connection_call_simple (self,
+		                              DBUS_INTERFACE_PROPERTIES,
+		                              "Set",
+		                              g_variant_new ("(ssv)",
+		                                             NM_WPAS_DBUS_IFACE_INTERFACE,
+		                                             "ApIsolate",
+		                                             g_variant_new_string ("0")),
+		                              G_VARIANT_TYPE ("()"),
+		                              "reset-ap-isolation");
+	}
+	priv->ap_isolate_needs_reset = FALSE;
 }
 
 /*****************************************************************************/
@@ -1218,7 +1235,7 @@ parse_capabilities (NMSupplicantInterface *self, GVariant *capabilities)
 		const gint32 WPAS_MAX_SCAN_SSIDS = 16;
 
 		/* Even if supplicant claims that 20 SSIDs are supported, the Scan request
-		 * still only accepts WPAS_MAX_SCAN_SSIDS SSIDs. Otherwise the D-Bus
+		 * still only accepts WPAS_MAX_SCAN_SSIDS SSIDs. Otherwise, the D-Bus
 		 * request will be rejected with "fi.w1.wpa_supplicant1.InvalidArgs"
 		 * Body: ('Did not receive correct message arguments.', 'Too many ssids specified. Specify at most four')
 		 * */
@@ -1868,6 +1885,9 @@ _properties_changed_main (NMSupplicantInterface *self,
 		}
 	}
 
+	if (nm_g_variant_lookup (properties, "ApIsolate", "&s", &v_s))
+		priv->ap_isolate_supported = TRUE;
+
 	if (do_log_driver_info) {
 		_LOGD ("supplicant interface for ifindex=%d, ifname=%s%s%s, driver=%s%s%s (requested %s)",
 		       priv->ifindex,
@@ -2227,27 +2247,13 @@ assoc_add_network_cb (GObject *source, GAsyncResult *result, gpointer user_data)
 }
 
 static void
-assoc_set_ap_scan_cb (GVariant *ret, GError *error, gpointer user_data)
+add_network (NMSupplicantInterface *self)
 {
-	NMSupplicantInterface *self;
 	NMSupplicantInterfacePrivate *priv;
 	AddNetworkData *add_network_data;
 
-	if (nm_utils_error_is_cancelled (error))
-		return;
-
-	self = NM_SUPPLICANT_INTERFACE (user_data);
 	priv = NM_SUPPLICANT_INTERFACE_GET_PRIVATE (self);
 
-	if (error) {
-		assoc_return (self, error, "failure to set AP scan mode");
-		return;
-	}
-
-	_LOGT ("assoc["NM_HASH_OBFUSCATE_PTR_FMT"]: interface ap_scan set to %d",
-	       NM_HASH_OBFUSCATE_PTR (priv->assoc_data),
-	       nm_supplicant_config_get_ap_scan (priv->assoc_data->cfg));
-
 	/* the association does not keep @self alive. We want to be able to remove
 	 * the network again, even if @self is already gone. Hence, track the data
 	 * separately.
@@ -2276,6 +2282,62 @@ assoc_set_ap_scan_cb (GVariant *ret, GError *error, gpointer user_data)
 	                       add_network_data);
 }
 
+static void
+assoc_set_ap_isolation (GVariant *ret, GError *error, gpointer user_data)
+{
+	NMSupplicantInterface *self;
+	NMSupplicantInterfacePrivate *priv;
+	gboolean value;
+
+	if (nm_utils_error_is_cancelled (error))
+		return;
+
+	self = NM_SUPPLICANT_INTERFACE (user_data);
+	priv = NM_SUPPLICANT_INTERFACE_GET_PRIVATE (self);
+
+	if (error) {
+		assoc_return (self, error, "failure to set AP isolation");
+		return;
+	}
+
+	value = nm_supplicant_config_get_ap_isolation (priv->assoc_data->cfg);
+	_LOGT ("assoc["NM_HASH_OBFUSCATE_PTR_FMT"]: interface AP isolation set to %d",
+	       NM_HASH_OBFUSCATE_PTR (priv->assoc_data),
+	       value);
+
+	priv->ap_isolate_needs_reset = value;
+
+	nm_assert (priv->assoc_data->calls_left > 0);
+	if (--priv->assoc_data->calls_left == 0)
+		add_network (self);
+}
+
+static void
+assoc_set_ap_scan_cb (GVariant *ret, GError *error, gpointer user_data)
+{
+	NMSupplicantInterface *self;
+	NMSupplicantInterfacePrivate *priv;
+
+	if (nm_utils_error_is_cancelled (error))
+		return;
+
+	self = NM_SUPPLICANT_INTERFACE (user_data);
+	priv = NM_SUPPLICANT_INTERFACE_GET_PRIVATE (self);
+
+	if (error) {
+		assoc_return (self, error, "failure to set AP scan mode");
+		return;
+	}
+
+	_LOGT ("assoc["NM_HASH_OBFUSCATE_PTR_FMT"]: interface ap_scan set to %d",
+	       NM_HASH_OBFUSCATE_PTR (priv->assoc_data),
+	       nm_supplicant_config_get_ap_scan (priv->assoc_data->cfg));
+
+	nm_assert (priv->assoc_data->calls_left > 0);
+	if (--priv->assoc_data->calls_left == 0)
+		add_network (self);
+}
+
 static gboolean
 assoc_fail_on_idle_cb (gpointer user_data)
 {
@@ -2301,7 +2363,7 @@ assoc_fail_on_idle_cb (gpointer user_data)
  *
  * The callback is invoked exactly once (always) and always asynchronously.
  * The pending association can be aborted via nm_supplicant_interface_disconnect()
- * or by destroying @self. In that case, the @callback is invoked synchornously with
+ * or by destroying @self. In that case, the @callback is invoked synchronously with
  * an error reason indicating cancellation/disposing (see nm_utils_error_is_cancelled()).
  */
 void
@@ -2312,6 +2374,7 @@ nm_supplicant_interface_assoc (NMSupplicantInterface *self,
 {
 	NMSupplicantInterfacePrivate *priv;
 	AssocData *assoc_data;
+	gboolean ap_isolation;
 
 	g_return_if_fail (NM_IS_SUPPLICANT_INTERFACE (self));
 	g_return_if_fail (NM_IS_SUPPLICANT_CONFIG (cfg));
@@ -2343,6 +2406,7 @@ nm_supplicant_interface_assoc (NMSupplicantInterface *self,
 	}
 
 	assoc_data->cancellable = g_cancellable_new();
+	assoc_data->calls_left++;
 	nm_dbus_connection_call_set (priv->dbus_connection,
 	                             priv->name_owner->str,
 	                             priv->object_path->str,
@@ -2353,6 +2417,31 @@ nm_supplicant_interface_assoc (NMSupplicantInterface *self,
 	                             assoc_data->cancellable,
 	                             assoc_set_ap_scan_cb,
 	                             self);
+
+	ap_isolation = nm_supplicant_config_get_ap_isolation (priv->assoc_data->cfg);
+	if (!priv->ap_isolate_supported) {
+		if (ap_isolation) {
+			_LOGW ("assoc["NM_HASH_OBFUSCATE_PTR_FMT"]: requested AP isolation but the supplicant doesn't support it",
+			       NM_HASH_OBFUSCATE_PTR (assoc_data));
+		}
+	} else {
+		assoc_data->calls_left++;
+		/* It would be smarter to change the property only when necessary.
+		 * However, wpa_supplicant doesn't send the PropertiesChanged
+		 * signal for ApIsolate, and so to know the current value we would
+		 * need first a Get call. It seems simpler to just set the value
+		 * we want. */
+		nm_dbus_connection_call_set (priv->dbus_connection,
+		                             priv->name_owner->str,
+		                             priv->object_path->str,
+		                             NM_WPAS_DBUS_IFACE_INTERFACE,
+		                             "ApIsolate",
+		                             g_variant_new_string (ap_isolation ? "1" : "0"),
+		                             DBUS_TIMEOUT_MSEC,
+		                             assoc_data->cancellable,
+		                             assoc_set_ap_isolation,
+		                             self);
+	}
 }
 
 /*****************************************************************************/
diff --git a/src/supplicant/nm-supplicant-manager.c b/src/supplicant/nm-supplicant-manager.c
index b1a2dea898..b736079875 100644
--- a/src/supplicant/nm-supplicant-manager.c
+++ b/src/supplicant/nm-supplicant-manager.c
@@ -738,7 +738,7 @@ nm_supplicant_manager_create_interface (NMSupplicantManager *self,
 	c_list_link_tail (&priv->create_iface_lst_head, &handle->create_iface_lst);
 
 	if (!priv->dbus_connection) {
-		_LOGT ("create-iface["NM_HASH_OBFUSCATE_PTR_FMT"]: new request interface %d (driver %s). Fail bacause no D-Bus connection to talk to wpa_supplicant...",
+		_LOGT ("create-iface["NM_HASH_OBFUSCATE_PTR_FMT"]: new request interface %d (driver %s). Fail because no D-Bus connection to talk to wpa_supplicant...",
 		       NM_HASH_OBFUSCATE_PTR (handle),
 		       ifindex,
 		       nm_supplicant_driver_to_string (driver));
diff --git a/src/systemd/src/libsystemd-network/sd-dhcp-client.c b/src/systemd/src/libsystemd-network/sd-dhcp-client.c
index 70821ac279..334cd6565b 100644
--- a/src/systemd/src/libsystemd-network/sd-dhcp-client.c
+++ b/src/systemd/src/libsystemd-network/sd-dhcp-client.c
@@ -379,7 +379,7 @@ int sd_dhcp_client_set_client_id(
         /* For hardware types, log debug message about unexpected data length.
          *
          * Note that infiniband's INFINIBAND_ALEN is 20 bytes long, but only
-         * last last 8 bytes of the address are stable and suitable to put into
+         * the last 8 bytes of the address are stable and suitable to put into
          * the client-id. The caller is advised to account for that. */
         if ((type == ARPHRD_ETHER && data_len != ETH_ALEN) ||
             (type == ARPHRD_INFINIBAND && data_len != 8))
diff --git a/src/systemd/src/libsystemd-network/sd-dhcp6-client.c b/src/systemd/src/libsystemd-network/sd-dhcp6-client.c
index d653b2571c..a68089261c 100644
--- a/src/systemd/src/libsystemd-network/sd-dhcp6-client.c
+++ b/src/systemd/src/libsystemd-network/sd-dhcp6-client.c
@@ -1495,7 +1495,7 @@ static int client_receive_message(
                         break;
                 }
 
-                _fallthrough_; /* for Soliciation Rapid Commit option check */
+                _fallthrough_; /* for Solicitation Rapid Commit option check */
         case DHCP6_STATE_REQUEST:
         case DHCP6_STATE_RENEW:
         case DHCP6_STATE_REBIND:
diff --git a/src/systemd/src/systemd/sd-lldp.h b/src/systemd/src/systemd/sd-lldp.h
index 2dc9f63246..c2abc20121 100644
--- a/src/systemd/src/systemd/sd-lldp.h
+++ b/src/systemd/src/systemd/sd-lldp.h
@@ -176,7 +176,7 @@ int sd_lldp_neighbor_get_mud_url(sd_lldp_neighbor *n, const char **ret);
 int sd_lldp_neighbor_get_system_capabilities(sd_lldp_neighbor *n, uint16_t *ret);
 int sd_lldp_neighbor_get_enabled_capabilities(sd_lldp_neighbor *n, uint16_t *ret);
 
-/* Low-level, iterative TLV access. This is for evertyhing else, it iteratively goes through all available TLVs
+/* Low-level, iterative TLV access. This is for everything else, it iteratively goes through all available TLVs
  * (including the ones covered with the calls above), and allows multiple TLVs for the same fields. */
 int sd_lldp_neighbor_tlv_rewind(sd_lldp_neighbor *n);
 int sd_lldp_neighbor_tlv_next(sd_lldp_neighbor *n);
diff --git a/src/vpn/nm-vpn-connection.c b/src/vpn/nm-vpn-connection.c
index 6d995dc489..b5d79c7fb9 100644
--- a/src/vpn/nm-vpn-connection.c
+++ b/src/vpn/nm-vpn-connection.c
@@ -300,7 +300,7 @@ _get_settings_connection (NMVpnConnection *self, gboolean allow_missing)
 {
 	NMSettingsConnection *con;
 
-	/* Currently we operate on the assumption, that the settings-connection
+	/* Currently, we operate on the assumption, that the settings-connection
 	 * never changes after it is set (though initially, it might be unset).
 	 * Later we might want to change that, but then we need fixes here too. */