Rebase patches

13 files changed, 10 insertions, 716 deletions

diff --git a/debian/changelog b/debian/changelog
index 01ae2d72..ac396652 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -4,6 +4,7 @@ network-manager (1.4.2-1) UNRELEASED; urgency=medium
     - Fix emission of NM-style PropertiesChanged signals and deprecate them
       for PropertiesChanged on "org.freedesktop.DBus.Properties" interface.
       (Closes: #836270)
+  * Rebase patches.
 
  -- Michael Biebl <biebl@debian.org>  Sat, 01 Oct 2016 00:39:59 +0200
 
diff --git a/debian/patches/Don-t-make-NetworkManager-D-Bus-activatable.patch b/debian/patches/Don-t-make-NetworkManager-D-Bus-activatable.patch
index 4ef2fc47..380b33be 100644
--- a/debian/patches/Don-t-make-NetworkManager-D-Bus-activatable.patch
+++ b/debian/patches/Don-t-make-NetworkManager-D-Bus-activatable.patch
@@ -28,10 +28,10 @@ index ce059fc..4ab4106 100644
  	install -d $(DESTDIR)$(systemdsystemunitdir)/network-online.target.wants
  	ln -sf $(systemdsystemunitdir)/NetworkManager-wait-online.service $(DESTDIR)$(systemdsystemunitdir)/network-online.target.wants
 diff --git a/data/NetworkManager.service.in b/data/NetworkManager.service.in
-index 95128a6..7a4cede 100644
+index a9e8731..e6cd392 100644
 --- a/data/NetworkManager.service.in
 +++ b/data/NetworkManager.service.in
-@@ -20,6 +20,5 @@ ProtectHome=read-only
+@@ -24,6 +24,5 @@ ProtectHome=read-only
  
  [Install]
  WantedBy=multi-user.target
diff --git a/debian/patches/Export-_IO_stdin_used-symbol-in-NetworkManager.ver.patch b/debian/patches/Export-_IO_stdin_used-symbol-in-NetworkManager.ver.patch
deleted file mode 100644
index 999494d4..00000000
--- a/debian/patches/Export-_IO_stdin_used-symbol-in-NetworkManager.ver.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From: Michael Biebl <biebl@debian.org>
-Date: Sat, 27 Aug 2016 23:40:42 +0200
-Subject: Export _IO_stdin_used symbol in NetworkManager.ver
-
-This symbol is required to decide which version of certain IO functions
-to use on various architectures. So we can't strip away the symbol from
-the NetworkManager binary as this will lead to segfaults on those
-architectures.
-
-Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=835550
-Bug: https://bugzilla.gnome.org/show_bug.cgi?id=770515
----
- src/NetworkManager.ver | 10 ++++++++++
- 1 file changed, 10 insertions(+)
-
-diff --git a/src/NetworkManager.ver b/src/NetworkManager.ver
-index c91affc..d5358e5 100644
---- a/src/NetworkManager.ver
-+++ b/src/NetworkManager.ver
-@@ -5,6 +5,16 @@ global:
- 	_nm*;
- 	NM*;
- 	_NM*;
-+
-+	/* The _IO_stdin_used symbol is used by the GNU libc to determine
-+	   which version of the I/O function should be used.  Not
-+	   exporting it means that the "old" version is used, causing
-+	   crashes or other issues on some architectures.  It should be
-+	   exported as an anonymous tag, but ld does not support mixing
-+	   anonymous version tags with other version tags.  Fortunately
-+	   the GNU libc is able to cope with the symbol having the wrong
-+	   version tag. */
-+	_IO_stdin_used;
- local:
- 	*;
- };
diff --git a/debian/patches/Force-online-state-with-unmanaged-devices.patch b/debian/patches/Force-online-state-with-unmanaged-devices.patch
index dc528e3e..d4ef920a 100644
--- a/debian/patches/Force-online-state-with-unmanaged-devices.patch
+++ b/debian/patches/Force-online-state-with-unmanaged-devices.patch
@@ -12,7 +12,7 @@ Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=512286
  1 file changed, 120 insertions(+)
 
 diff --git a/src/nm-manager.c b/src/nm-manager.c
-index 5794bb9..18d9de8 100644
+index 836ab76..4d222b6 100644
 --- a/src/nm-manager.c
 +++ b/src/nm-manager.c
 @@ -60,6 +60,8 @@
@@ -35,7 +35,7 @@ index 5794bb9..18d9de8 100644
  	guint timestamp_update_id;
  
  	gboolean startup;
-@@ -810,6 +816,29 @@ find_best_device_state (NMManager *manager)
+@@ -799,6 +805,29 @@ find_best_device_state (NMManager *manager)
  	return best_state;
  }
  
@@ -65,7 +65,7 @@ index 5794bb9..18d9de8 100644
  static void
  nm_manager_update_metered (NMManager *self)
  {
-@@ -848,6 +877,9 @@ nm_manager_update_state (NMManager *manager)
+@@ -837,6 +866,9 @@ nm_manager_update_state (NMManager *manager)
  	else
  		new_state = find_best_device_state (manager);
  
@@ -75,7 +75,7 @@ index 5794bb9..18d9de8 100644
  	nm_connectivity_set_online (priv->connectivity, new_state >= NM_STATE_CONNECTED_LOCAL);
  
  	if (new_state == NM_STATE_CONNECTED_SITE) {
-@@ -4587,6 +4619,65 @@ impl_manager_check_connectivity (NMManager *self,
+@@ -4578,6 +4610,65 @@ impl_manager_check_connectivity (NMManager *self,
  }
  
  static void
@@ -141,7 +141,7 @@ index 5794bb9..18d9de8 100644
  start_factory (NMDeviceFactory *factory, gpointer user_data)
  {
  	nm_device_factory_start (factory);
-@@ -4657,6 +4748,9 @@ nm_manager_start (NMManager *self, GError **error)
+@@ -4648,6 +4739,9 @@ nm_manager_start (NMManager *self, GError **error)
  
  	check_if_startup_complete (self);
  
@@ -151,7 +151,7 @@ index 5794bb9..18d9de8 100644
  	return TRUE;
  }
  
-@@ -5625,6 +5719,22 @@ nm_manager_init (NMManager *self)
+@@ -5616,6 +5710,22 @@ nm_manager_init (NMManager *self)
  		       KERNEL_FIRMWARE_DIR);
  	}
  
@@ -174,7 +174,7 @@ index 5794bb9..18d9de8 100644
  	/* Update timestamps in active connections */
  	priv->timestamp_update_id = g_timeout_add_seconds (300, (GSourceFunc) periodic_update_active_connection_timestamps, self);
  
-@@ -5859,6 +5969,16 @@ dispose (GObject *object)
+@@ -5850,6 +5960,16 @@ dispose (GObject *object)
  		g_clear_object (&priv->fw_monitor);
  	}
  
diff --git a/debian/patches/crypto-don-t-try-to-decrypt-PKCS-8-key-if-no-password-is-.patch b/debian/patches/crypto-don-t-try-to-decrypt-PKCS-8-key-if-no-password-is-.patch
deleted file mode 100644
index 66fb8fa2..00000000
--- a/debian/patches/crypto-don-t-try-to-decrypt-PKCS-8-key-if-no-password-is-.patch
+++ /dev/null
@@ -1,102 +0,0 @@
-From: Beniamino Galvani <bgalvani@redhat.com>
-Date: Mon, 19 Sep 2016 09:35:23 +0200
-Subject: crypto: don't try to decrypt PKCS#8 key if no password is supplied
-
-crypto_verify_private_key_data() must try to decrypt the key only when
-a password is supplied.
-
-Previously the decrypt test always passed because we detected an
-unsupported cipher and faked success. Now since version 3.5.4 gnutls
-supports PBES1-DES-CBC-MD5 and the key is actually decrypted when a
-password is supplied.
-
-Also, don't assert that a wrong password works because we're now able
-to actually verify it (only with recent gnutls).
-
-https://bugzilla.gnome.org/show_bug.cgi?id=771623
-(cherry picked from commit 0e96d2373393f0bafc50001cfc2a3049c0454f72)
-(cherry picked from commit 626eb5df2921eecfdc75baf46df32ae69d25c44f)
----
- libnm-core/crypto.c            | 2 +-
- libnm-core/crypto_gnutls.c     | 2 +-
- libnm-core/tests/test-crypto.c | 9 ++++-----
- libnm-util/crypto.c            | 2 +-
- libnm-util/tests/test-crypto.c | 5 -----
- 5 files changed, 7 insertions(+), 13 deletions(-)
-
-diff --git a/libnm-core/crypto.c b/libnm-core/crypto.c
-index c27f5c0..e734f40 100644
---- a/libnm-core/crypto.c
-+++ b/libnm-core/crypto.c
-@@ -712,7 +712,7 @@ crypto_verify_private_key_data (const guint8 *data,
- 		/* Maybe it's PKCS#8 */
- 		tmp = parse_pkcs8_key_file (data, data_len, &is_encrypted, NULL);
- 		if (tmp) {
--			if (crypto_verify_pkcs8 (tmp->data, tmp->len, is_encrypted, password, error))
-+			if (!password || crypto_verify_pkcs8 (tmp->data, tmp->len, is_encrypted, password, error))
- 				format = NM_CRYPTO_FILE_FORMAT_RAW_KEY;
- 		} else {
- 			char *cipher, *iv;
-diff --git a/libnm-core/crypto_gnutls.c b/libnm-core/crypto_gnutls.c
-index d09c937..53a3ba4 100644
---- a/libnm-core/crypto_gnutls.c
-+++ b/libnm-core/crypto_gnutls.c
-@@ -394,7 +394,7 @@ crypto_verify_pkcs8 (const guint8 *data,
- 
- 	if (err < 0) {
- 		if (err == GNUTLS_E_UNKNOWN_CIPHER_TYPE) {
--			/* HACK: gnutls doesn't support all the cipher types that openssl
-+			/* HACK: gnutls < 3.5.4 doesn't support all the cipher types that openssl
- 			 * can use with PKCS#8, so if we encounter one, we have to assume
- 			 * the given password works.  gnutls needs to unsuckify, apparently.
- 			 * Specifically, by default openssl uses pbeWithMD5AndDES-CBC
-diff --git a/libnm-core/tests/test-crypto.c b/libnm-core/tests/test-crypto.c
-index 9bab985..0c2ef48 100644
---- a/libnm-core/tests/test-crypto.c
-+++ b/libnm-core/tests/test-crypto.c
-@@ -364,12 +364,11 @@ test_pkcs8 (gconstpointer test_data)
- 	password = parts[1];
- 
- 	test_is_pkcs12 (path, TRUE);
--	test_load_pkcs8 (path, password, -1);
--	/* Until gnutls and NSS grow support for all the ciphers that openssl
--	 * can use with PKCS#8, we can't actually verify the password.  So we
--	 * expect a bad password to work for the time being.
-+	/* Note: NSS and gnutls < 3.5.4 don't support all the ciphers that openssl
-+	 * can use with PKCS#8 and thus the password can't be actually verified with
-+	 * such libraries.
- 	 */
--	test_load_pkcs8 (path, "blahblahblah", -1);
-+	test_load_pkcs8 (path, password, -1);
- 
- 	g_free (path);
- 	g_strfreev (parts);
-diff --git a/libnm-util/crypto.c b/libnm-util/crypto.c
-index 3dd89f9..9778ede 100644
---- a/libnm-util/crypto.c
-+++ b/libnm-util/crypto.c
-@@ -708,7 +708,7 @@ crypto_verify_private_key_data (const GByteArray *contents,
- 		/* Maybe it's PKCS#8 */
- 		tmp = parse_pkcs8_key_file (contents, &is_encrypted, error);
- 		if (tmp) {
--			if (crypto_verify_pkcs8 (tmp, is_encrypted, password, error))
-+			if (!password || crypto_verify_pkcs8 (tmp, is_encrypted, password, error))
- 				format = NM_CRYPTO_FILE_FORMAT_RAW_KEY;
- 		} else {
- 			g_clear_error (error);
-diff --git a/libnm-util/tests/test-crypto.c b/libnm-util/tests/test-crypto.c
-index 643418d..83a183d 100644
---- a/libnm-util/tests/test-crypto.c
-+++ b/libnm-util/tests/test-crypto.c
-@@ -334,11 +334,6 @@ test_pkcs8 (gconstpointer test_data)
- 
- 	test_is_pkcs12 (path, TRUE, "not-pkcs12");
- 	test_load_pkcs8 (path, password, FALSE, "pkcs8-private-key");
--	/* Until gnutls and NSS grow support for all the ciphers that openssl
--	 * can use with PKCS#8, we can't actually verify the password.  So we
--	 * expect a bad password to work for the time being.
--	 */
--	test_load_pkcs8 (path, "blahblahblah", FALSE, "pkcs8-private-key-bad-password");
- 
- 	g_free (path);
- 	g_strfreev (parts);
diff --git a/debian/patches/device-add-hack-to-wait-after-changing-MAC-address.patch b/debian/patches/device-add-hack-to-wait-after-changing-MAC-address.patch
deleted file mode 100644
index 94ae6a72..00000000
--- a/debian/patches/device-add-hack-to-wait-after-changing-MAC-address.patch
+++ /dev/null
@@ -1,72 +0,0 @@
-From: Thomas Haller <thaller@redhat.com>
-Date: Mon, 29 Aug 2016 18:28:34 +0200
-Subject: device: add hack to wait after changing MAC address
-
-It seems some drivers return success for nm_platform_link_set_address(),
-but at that point the address did not yet actually change *sigh*.
-It changes a bit later, possibly after setting the device up.
-
-Add a workaround to retry reading the MAC address when platform indicates
-success but the address still differs at first.
-
-https://bugzilla.gnome.org/show_bug.cgi?id=770456
-(cherry picked from commit 67b685235847ac49712d77023e23ef5c38e82a9e)
-(cherry picked from commit 3b51959f48f2b40a4d85e1d36fd69a46548369cb)
----
- src/devices/nm-device.c | 28 +++++++++++++++++++++++++---
- 1 file changed, 25 insertions(+), 3 deletions(-)
-
-diff --git a/src/devices/nm-device.c b/src/devices/nm-device.c
-index 305a1bb..6939332 100644
---- a/src/devices/nm-device.c
-+++ b/src/devices/nm-device.c
-@@ -11774,6 +11774,7 @@ _hw_addr_set (NMDevice *self,
- {
- 	NMDevicePrivate *priv;
- 	gboolean success = FALSE;
-+	gboolean needs_refresh = FALSE;
- 	NMPlatformError plerr;
- 	const char *cur_addr;
- 	guint8 addr_bytes[NM_UTILS_HWADDR_LEN_MAX];
-@@ -11819,10 +11820,10 @@ _hw_addr_set (NMDevice *self,
- 			_LOGI (LOGD_DEVICE, "set-hw-addr: %s MAC address to %s (%s)",
- 			       operation, addr, detail);
- 		} else {
--			_LOGW (LOGD_DEVICE,
--			       "set-hw-addr: new MAC address %s not successfully %s (%s)",
-+			_LOGD (LOGD_DEVICE,
-+			       "set-hw-addr: new MAC address %s not successfully %s (%s) (refresh link)",
- 			       addr, operation, detail);
--			success = FALSE;
-+			needs_refresh = TRUE;
- 		}
- 	} else {
- 		_NMLOG (plerr == NM_PLATFORM_ERROR_NOT_FOUND ? LOGL_DEBUG : LOGL_WARN,
-@@ -11836,6 +11837,27 @@ _hw_addr_set (NMDevice *self,
- 			return FALSE;
- 	}
- 
-+	if (needs_refresh) {
-+		/* The platform call indicated success, however the address is not
-+		 * as expected. May be a kernel issue and the MAC address takes
-+		 * a moment to change (bgo#770456).
-+		 *
-+		 * Try to reload the link and check again. */
-+		nm_platform_link_refresh (NM_PLATFORM_GET, nm_device_get_ip_ifindex (self));
-+
-+		nm_device_update_hw_address (self);
-+		cur_addr = nm_device_get_hw_address (self);
-+		if (cur_addr && nm_utils_hwaddr_matches (cur_addr, -1, addr, -1)) {
-+			_LOGI (LOGD_DEVICE, "set-hw-addr: %s MAC address to %s (%s)",
-+			       operation, addr, detail);
-+		} else {
-+			_LOGW (LOGD_DEVICE,
-+			       "set-hw-addr: new MAC address %s not successfully %s (%s)",
-+			       addr, operation, detail);
-+			return FALSE;
-+		}
-+	}
-+
- 	return success;
- }
- 
diff --git a/debian/patches/device-fix-spelling-in-logging.patch b/debian/patches/device-fix-spelling-in-logging.patch
deleted file mode 100644
index b6b1f50b..00000000
--- a/debian/patches/device-fix-spelling-in-logging.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-From: Thomas Haller <thaller@redhat.com>
-Date: Mon, 29 Aug 2016 17:14:04 +0200
-Subject: device: fix spelling in logging
-
-(cherry picked from commit d51f2c2a4e99799739e2adbeaf578144b556c4b9)
-(cherry picked from commit b1f5d3d798498c53fe65257490b2df3e3f71e364)
----
- src/devices/nm-device.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/devices/nm-device.c b/src/devices/nm-device.c
-index 199acc6..305a1bb 100644
---- a/src/devices/nm-device.c
-+++ b/src/devices/nm-device.c
-@@ -11820,7 +11820,7 @@ _hw_addr_set (NMDevice *self,
- 			       operation, addr, detail);
- 		} else {
- 			_LOGW (LOGD_DEVICE,
--			       "set-hw-addr: new MAC address %s not successfully set to %s (%s)",
-+			       "set-hw-addr: new MAC address %s not successfully %s (%s)",
- 			       addr, operation, detail);
- 			success = FALSE;
- 		}
diff --git a/debian/patches/device-wait-for-MAC-address-change-to-complete-before-set.patch b/debian/patches/device-wait-for-MAC-address-change-to-complete-before-set.patch
deleted file mode 100644
index 8e5f29f4..00000000
--- a/debian/patches/device-wait-for-MAC-address-change-to-complete-before-set.patch
+++ /dev/null
@@ -1,75 +0,0 @@
-From: Thomas Haller <thaller@redhat.com>
-Date: Sun, 11 Sep 2016 09:48:56 +0200
-Subject: device: wait for MAC address change to complete before setting
- interface up
-
-Some drivers (brcmfmac) don't change the MAC address right away.
-NetworkManager works around that by waiting synchronously until
-the address changes (commit 1a85103765d4eaa0acab6b03658a4f9cfe684a64).
-
-wpa_supplicant on the other hand, only re-reads the MAC address
-when changing state from DISABLED to ENABLED, which happens when
-the interface comes up.
-
-That is a bug in wpa_supplicant and the driver, but we can work-around by
-waiting until the MAC address actually changed before setting the interface
-IFF_UP. Also note, that there is still a race in wpa_supplicant which might
-miss a change to DISABLED state altogether.
-
-https://bugzilla.gnome.org/show_bug.cgi?id=770504
-https://bugzilla.redhat.com/show_bug.cgi?id=1374023
-(cherry picked from commit 32f7c1d4b9aba597a99128631f07c2985149f303)
-(cherry picked from commit cd8f2ecc617a896d8007e6fe825c676a626a3b8d)
----
- src/devices/nm-device.c | 27 ++++++++++++++++-----------
- 1 file changed, 16 insertions(+), 11 deletions(-)
-
-diff --git a/src/devices/nm-device.c b/src/devices/nm-device.c
-index 6c720bb..dd77ccf 100644
---- a/src/devices/nm-device.c
-+++ b/src/devices/nm-device.c
-@@ -11840,12 +11840,8 @@ _hw_addr_set (NMDevice *self,
- 		        nm_platform_error_to_string (plerr));
- 	}
- 
--	if (was_up) {
--		if (!nm_device_bring_up (self, TRUE, NULL))
--			return FALSE;
--	}
--
- 	if (needs_refresh) {
-+		success = TRUE;
- 		if (_hw_addr_matches (self, addr)) {
- 			/* the MAC address already changed during nm_device_bring_up() above. */
- 		} else {
-@@ -11882,15 +11878,24 @@ handle_wait:
- 					continue;
- 				}
- handle_fail:
--				_LOGW (LOGD_DEVICE,
--				       "set-hw-addr: new MAC address %s not successfully %s (%s)",
--				       addr, operation, detail);
--				return FALSE;
-+				success = FALSE;
-+				break;
- 			}
- 		}
- 
--		_LOGI (LOGD_DEVICE, "set-hw-addr: %s MAC address to %s (%s)",
--		       operation, addr, detail);
-+		if (success) {
-+			_LOGI (LOGD_DEVICE, "set-hw-addr: %s MAC address to %s (%s)",
-+			       operation, addr, detail);
-+		} else {
-+			_LOGW (LOGD_DEVICE,
-+			       "set-hw-addr: new MAC address %s not successfully %s (%s)",
-+			       addr, operation, detail);
-+		}
-+	}
-+
-+	if (was_up) {
-+		if (!nm_device_bring_up (self, TRUE, NULL))
-+			return FALSE;
- 	}
- 
- 	return success;
diff --git a/debian/patches/device-workaround-driver-issue-with-delayed-change-of-MAC.patch b/debian/patches/device-workaround-driver-issue-with-delayed-change-of-MAC.patch
deleted file mode 100644
index e7648390..00000000
--- a/debian/patches/device-workaround-driver-issue-with-delayed-change-of-MAC.patch
+++ /dev/null
@@ -1,194 +0,0 @@
-From: Thomas Haller <thaller@redhat.com>
-Date: Wed, 7 Sep 2016 23:47:14 +0200
-Subject: device: workaround driver issue with delayed change of MAC address
-
-brcmfmac and possibly other drivers don't change the MAC address
-right away, but instead the result is delayed. That is problematic
-because we cannot continue activation before the MAC address is
-settled.
-
-Add a hack to workaround the issue by waiting until the MAC address
-changed.
-
-The previous attempt to workaround this was less intrusive: we would
-just refresh the link once and check the result. But that turns out
-not to be sufficent for all cases. Now, wait and poll.
-
-https://bugzilla.gnome.org/show_bug.cgi?id=770456
-https://bugzilla.redhat.com/show_bug.cgi?id=1374023
-(cherry picked from commit 1a85103765d4eaa0acab6b03658a4f9cfe684a64)
-(cherry picked from commit 8d575403685208aad75f918484ae7adbc1a46085)
----
- src/devices/nm-device.c | 85 ++++++++++++++++++++++++++++++++++---------------
- src/devices/nm-device.h |  2 +-
- 2 files changed, 61 insertions(+), 26 deletions(-)
-
-diff --git a/src/devices/nm-device.c b/src/devices/nm-device.c
-index 6939332..6c720bb 100644
---- a/src/devices/nm-device.c
-+++ b/src/devices/nm-device.c
-@@ -11560,16 +11560,17 @@ nm_device_get_hw_address (NMDevice *self)
- 	return priv->hw_addr;
- }
- 
--void
-+gboolean
- nm_device_update_hw_address (NMDevice *self)
- {
- 	NMDevicePrivate *priv;
- 	const guint8 *hwaddr;
- 	gsize hwaddrlen = 0;
-+	gboolean changed = FALSE;
- 
- 	priv = NM_DEVICE_GET_PRIVATE (self);
- 	if (priv->ifindex <= 0)
--		return;
-+		return FALSE;
- 
- 	hwaddr = nm_platform_link_get_address (NM_PLATFORM_GET, priv->ifindex, &hwaddrlen);
- 
-@@ -11596,6 +11597,7 @@ nm_device_update_hw_address (NMDevice *self)
- 				 * update our inital hw-address as well. */
- 				nm_device_update_initial_hw_address (self);
- 			}
-+			changed = TRUE;
- 		}
- 	} else {
- 		/* Invalid or no hardware address */
-@@ -11608,6 +11610,7 @@ nm_device_update_hw_address (NMDevice *self)
- 			       "hw-addr: failed reading current MAC address");
- 		}
- 	}
-+	return changed;
- }
- 
- void
-@@ -11767,6 +11770,15 @@ nm_device_hw_addr_is_explict (NMDevice *self)
- }
- 
- static gboolean
-+_hw_addr_matches (NMDevice *self, const char *addr)
-+{
-+	const char *cur_addr;
-+
-+	cur_addr = nm_device_get_hw_address (self);
-+	return cur_addr && nm_utils_hwaddr_matches (cur_addr, -1, addr, -1);
-+}
-+
-+static gboolean
- _hw_addr_set (NMDevice *self,
-               const char *addr,
-               const char *operation,
-@@ -11776,7 +11788,6 @@ _hw_addr_set (NMDevice *self,
- 	gboolean success = FALSE;
- 	gboolean needs_refresh = FALSE;
- 	NMPlatformError plerr;
--	const char *cur_addr;
- 	guint8 addr_bytes[NM_UTILS_HWADDR_LEN_MAX];
- 	guint hw_addr_len;
- 	gboolean was_up;
-@@ -11787,11 +11798,9 @@ _hw_addr_set (NMDevice *self,
- 
- 	priv = NM_DEVICE_GET_PRIVATE (self);
- 
--	cur_addr = nm_device_get_hw_address (self);
--
- 	/* Do nothing if current MAC is same */
--	if (cur_addr && nm_utils_hwaddr_matches (cur_addr, -1, addr, -1)) {
--		_LOGT (LOGD_DEVICE, "set-hw-addr: no MAC address change needed (%s)", cur_addr);
-+	if (_hw_addr_matches (self, addr)) {
-+		_LOGT (LOGD_DEVICE, "set-hw-addr: no MAC address change needed (%s)", addr);
- 		return TRUE;
- 	}
- 
-@@ -11815,8 +11824,7 @@ _hw_addr_set (NMDevice *self,
- 	if (success) {
- 		/* MAC address succesfully changed; update the current MAC to match */
- 		nm_device_update_hw_address (self);
--		cur_addr = nm_device_get_hw_address (self);
--		if (cur_addr && nm_utils_hwaddr_matches (cur_addr, -1, addr, -1)) {
-+		if (_hw_addr_matches (self, addr)) {
- 			_LOGI (LOGD_DEVICE, "set-hw-addr: %s MAC address to %s (%s)",
- 			       operation, addr, detail);
- 		} else {
-@@ -11838,24 +11846,51 @@ _hw_addr_set (NMDevice *self,
- 	}
- 
- 	if (needs_refresh) {
--		/* The platform call indicated success, however the address is not
--		 * as expected. May be a kernel issue and the MAC address takes
--		 * a moment to change (bgo#770456).
--		 *
--		 * Try to reload the link and check again. */
--		nm_platform_link_refresh (NM_PLATFORM_GET, nm_device_get_ip_ifindex (self));
--
--		nm_device_update_hw_address (self);
--		cur_addr = nm_device_get_hw_address (self);
--		if (cur_addr && nm_utils_hwaddr_matches (cur_addr, -1, addr, -1)) {
--			_LOGI (LOGD_DEVICE, "set-hw-addr: %s MAC address to %s (%s)",
--			       operation, addr, detail);
-+		if (_hw_addr_matches (self, addr)) {
-+			/* the MAC address already changed during nm_device_bring_up() above. */
- 		} else {
--			_LOGW (LOGD_DEVICE,
--			       "set-hw-addr: new MAC address %s not successfully %s (%s)",
--			       addr, operation, detail);
--			return FALSE;
-+			gint64 poll_end, now;
-+
-+			/* The platform call indicated success, however the address is not
-+			 * as expected. That is either due to a driver issue (brcmfmac, bgo#770456,
-+			 * rh#1374023) or a race where externally the MAC address was reset.
-+			 * The race is rather unlikely.
-+			 *
-+			 * The alternative would be to postpone the activation in case the
-+			 * MAC address is not yet ready and poll without blocking. However,
-+			 * that is rather complicated and it is not expected that this case
-+			 * happens for regular drivers.
-+			 * Note that brcmfmac can block NetworkManager for 500 msec while
-+			 * taking down the device. Let's add annother 100 msec to that.
-+			 *
-+			 * wait/poll up to 100 msec until it changes. */
-+
-+			poll_end = nm_utils_get_monotonic_timestamp_us () + (100 * 1000);
-+			for (;;) {
-+				if (!nm_platform_link_refresh (NM_PLATFORM_GET, nm_device_get_ip_ifindex (self)))
-+					goto handle_fail;
-+				if (!nm_device_update_hw_address (self))
-+					goto handle_wait;
-+				if (!_hw_addr_matches (self, addr))
-+					goto handle_fail;
-+
-+				break;
-+handle_wait:
-+				now = nm_utils_get_monotonic_timestamp_us ();
-+				if (now < poll_end) {
-+					g_usleep (NM_MIN (poll_end - now, 500));
-+					continue;
-+				}
-+handle_fail:
-+				_LOGW (LOGD_DEVICE,
-+				       "set-hw-addr: new MAC address %s not successfully %s (%s)",
-+				       addr, operation, detail);
-+				return FALSE;
-+			}
- 		}
-+
-+		_LOGI (LOGD_DEVICE, "set-hw-addr: %s MAC address to %s (%s)",
-+		       operation, addr, detail);
- 	}
- 
- 	return success;
-diff --git a/src/devices/nm-device.h b/src/devices/nm-device.h
-index 34d31ca..0f91b21 100644
---- a/src/devices/nm-device.h
-+++ b/src/devices/nm-device.h
-@@ -588,7 +588,7 @@ void nm_device_reactivate_ip6_config (NMDevice *device,
-                                       NMSettingIPConfig *s_ip6_old,
-                                       NMSettingIPConfig *s_ip6_new);
- 
--void nm_device_update_hw_address (NMDevice *self);
-+gboolean nm_device_update_hw_address (NMDevice *self);
- void nm_device_update_initial_hw_address (NMDevice *self);
- void nm_device_update_permanent_hw_address (NMDevice *self);
- void nm_device_update_dynamic_ip_setup (NMDevice *self);
diff --git a/debian/patches/platform-split-processing-result-from-do_change_link.patch b/debian/patches/platform-split-processing-result-from-do_change_link.patch
deleted file mode 100644
index d8c14494..00000000
--- a/debian/patches/platform-split-processing-result-from-do_change_link.patch
+++ /dev/null
@@ -1,74 +0,0 @@
-From: Thomas Haller <thaller@redhat.com>
-Date: Sun, 28 Aug 2016 13:52:32 +0200
-Subject: platform: split processing result from do_change_link()
-
-(cherry picked from commit 3dc09446771a3434ed948bdd5e6ca9f6ef9a9e76)
-(cherry picked from commit 471521ca84187cd32afcd20aebe5a369fe7368dc)
----
- src/platform/nm-linux-platform.c | 35 +++++++++++++++++++++++++++--------
- 1 file changed, 27 insertions(+), 8 deletions(-)
-
-diff --git a/src/platform/nm-linux-platform.c b/src/platform/nm-linux-platform.c
-index 98c4e46..eeb24ca 100644
---- a/src/platform/nm-linux-platform.c
-+++ b/src/platform/nm-linux-platform.c
-@@ -4060,18 +4060,14 @@ out:
- 	return !!nmp_cache_lookup_obj (priv->cache, obj_id);
- }
- 
--static NMPlatformError
--do_change_link (NMPlatform *platform,
--                int ifindex,
--                struct nl_msg *nlmsg)
-+static WaitForNlResponseResult
-+do_change_link_request (NMPlatform *platform,
-+                        int ifindex,
-+                        struct nl_msg *nlmsg)
- {
- 	nm_auto_pop_netns NMPNetns *netns = NULL;
- 	WaitForNlResponseResult seq_result = WAIT_FOR_NL_RESPONSE_RESULT_UNKNOWN;
- 	int nle;
--	char s_buf[256];
--	NMPlatformError result = NM_PLATFORM_ERROR_SUCCESS;
--	NMLogLevel log_level = LOGL_DEBUG;
--	const char *log_result = "failure", *log_detail = "";
- 
- 	if (!nm_platform_netns_push (platform, &netns))
- 		return NM_PLATFORM_ERROR_UNSPECIFIED;
-@@ -4098,6 +4094,18 @@ retry:
- 		nlmsg_hdr (nlmsg)->nlmsg_type = RTM_SETLINK;
- 		goto retry;
- 	}
-+	return seq_result;
-+}
-+
-+static NMPlatformError
-+do_change_link_result (NMPlatform *platform,
-+                       int ifindex,
-+                       WaitForNlResponseResult seq_result)
-+{
-+	char s_buf[256];
-+	NMPlatformError result = NM_PLATFORM_ERROR_SUCCESS;
-+	NMLogLevel log_level = LOGL_DEBUG;
-+	const char *log_result = "failure", *log_detail = "";
- 
- 	if (seq_result == WAIT_FOR_NL_RESPONSE_RESULT_RESPONSE_OK) {
- 		log_result = "success";
-@@ -4123,6 +4131,17 @@ retry:
- 	return result;
- }
- 
-+static NMPlatformError
-+do_change_link (NMPlatform *platform,
-+                int ifindex,
-+                struct nl_msg *nlmsg)
-+{
-+	WaitForNlResponseResult seq_result;
-+
-+	seq_result = do_change_link_request (platform, ifindex, nlmsg);
-+	return do_change_link_result (platform, ifindex, seq_result);
-+}
-+
- static gboolean
- link_add (NMPlatform *platform,
-           const char *name,
diff --git a/debian/patches/platform-workaround-kernel-wrongly-returning-ENFILE-when-.patch b/debian/patches/platform-workaround-kernel-wrongly-returning-ENFILE-when-.patch
deleted file mode 100644
index bcf4c0bb..00000000
--- a/debian/patches/platform-workaround-kernel-wrongly-returning-ENFILE-when-.patch
+++ /dev/null
@@ -1,57 +0,0 @@
-From: Thomas Haller <thaller@redhat.com>
-Date: Sun, 28 Aug 2016 14:08:42 +0200
-Subject: platform: workaround kernel wrongly returning ENFILE when changing
- MAC address
-
-https://bugzilla.gnome.org/show_bug.cgi?id=770456
-(cherry picked from commit 2bef71611bd9fd2e333a7522205f0262ac25680f)
-(cherry picked from commit 06d1679aa9867682297316e7b2cfac6fc8f67c2a)
----
- src/platform/nm-linux-platform.c | 27 ++++++++++++++++++++++++++-
- 1 file changed, 26 insertions(+), 1 deletion(-)
-
-diff --git a/src/platform/nm-linux-platform.c b/src/platform/nm-linux-platform.c
-index eeb24ca..c36e967 100644
---- a/src/platform/nm-linux-platform.c
-+++ b/src/platform/nm-linux-platform.c
-@@ -4449,6 +4449,8 @@ link_set_address (NMPlatform *platform, int ifindex, gconstpointer address, size
- {
- 	nm_auto_nlmsg struct nl_msg *nlmsg = NULL;
- 	gs_free char *mac = NULL;
-+	WaitForNlResponseResult seq_result;
-+	char s_buf[256];
- 
- 	if (!address || !length)
- 		g_return_val_if_reached (NM_PLATFORM_ERROR_BUG);
-@@ -4468,7 +4470,30 @@ link_set_address (NMPlatform *platform, int ifindex, gconstpointer address, size
- 
- 	NLA_PUT (nlmsg, IFLA_ADDRESS, length, address);
- 
--	return do_change_link (platform, ifindex, nlmsg);
-+	seq_result = do_change_link_request (platform, ifindex, nlmsg);
-+
-+	if (NM_IN_SET (-((int) seq_result), ENFILE)) {
-+		const NMPObject *obj_cache;
-+
-+		/* workaround ENFILE which may be wrongly returned (bgo #770456).
-+		 * If the MAC address is as expected, assume success? */
-+
-+		obj_cache = nmp_cache_lookup_link (NM_LINUX_PLATFORM_GET_PRIVATE (platform)->cache, ifindex);
-+		if (   obj_cache
-+		    && obj_cache->link.addr.len == length
-+		    && memcmp (obj_cache->link.addr.data, address, length) == 0) {
-+			_NMLOG (LOGL_DEBUG,
-+			        "do-change-link[%d]: %s changing link: %s%s",
-+			        ifindex,
-+			        "success",
-+			        wait_for_nl_response_to_string (seq_result, s_buf, sizeof (s_buf)),
-+			        " (assume success changing address)");
-+			return NM_PLATFORM_ERROR_SUCCESS;
-+		}
-+	}
-+
-+	return do_change_link_result (platform, ifindex, seq_result);
-+
- nla_put_failure:
- 	g_return_val_if_reached (NM_PLATFORM_ERROR_UNSPECIFIED);
- }
diff --git a/debian/patches/series b/debian/patches/series
index 5fbcbc0e..140a0339 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -4,12 +4,3 @@ fix-arping-path.patch
 Don-t-make-NetworkManager-D-Bus-activatable.patch
 systemd-Don-t-enable-NetworkManager-wait-online.service-s.patch
 Fix-iscsiadm-path.patch
-Export-_IO_stdin_used-symbol-in-NetworkManager.ver.patch
-platform-split-processing-result-from-do_change_link.patch
-platform-workaround-kernel-wrongly-returning-ENFILE-when-.patch
-device-fix-spelling-in-logging.patch
-device-add-hack-to-wait-after-changing-MAC-address.patch
-shared-add-NM_MIN-NM_MAX-macros-to-replace-glib-s-MIN-MAX.patch
-device-workaround-driver-issue-with-delayed-change-of-MAC.patch
-device-wait-for-MAC-address-change-to-complete-before-set.patch
-crypto-don-t-try-to-decrypt-PKCS-8-key-if-no-password-is-.patch
diff --git a/debian/patches/shared-add-NM_MIN-NM_MAX-macros-to-replace-glib-s-MIN-MAX.patch b/debian/patches/shared-add-NM_MIN-NM_MAX-macros-to-replace-glib-s-MIN-MAX.patch
deleted file mode 100644
index d8a6c63e..00000000
--- a/debian/patches/shared-add-NM_MIN-NM_MAX-macros-to-replace-glib-s-MIN-MAX.patch
+++ /dev/null
@@ -1,65 +0,0 @@
-From: Thomas Haller <thaller@redhat.com>
-Date: Mon, 5 Sep 2016 14:12:41 +0200
-Subject: shared: add NM_MIN()/NM_MAX() macros to replace glib's MIN()/MAX()
-
-(cherry picked from commit b2016fd2a52b82d45324526c965e7545d026cebe)
-(cherry picked from commit 811aaead4ca6f2f815f49b7353fa7a88554dca42)
----
- shared/nm-utils/nm-macros-internal.h | 44 ++++++++++++++++++++++++++++++++++++
- 1 file changed, 44 insertions(+)
-
-diff --git a/shared/nm-utils/nm-macros-internal.h b/shared/nm-utils/nm-macros-internal.h
-index 73075c6..8811c91 100644
---- a/shared/nm-utils/nm-macros-internal.h
-+++ b/shared/nm-utils/nm-macros-internal.h
-@@ -526,6 +526,50 @@ nm_strcmp_p_with_data (gconstpointer a, gconstpointer b, gpointer user_data)
- 
- /*****************************************************************************/
- 
-+/* Taken from systemd's UNIQ_T and UNIQ macros. */
-+
-+#define NM_UNIQ_T(x, uniq) G_PASTE(__unique_prefix_, G_PASTE(x, uniq))
-+#define NM_UNIQ __COUNTER__
-+
-+/*****************************************************************************/
-+
-+/* glib's MIN()/MAX() macros don't have function-like behavior, in that they evaluate
-+ * the argument possibly twice.
-+ *
-+ * Taken from systemd's MIN()/MAX() macros. */
-+
-+#define NM_MIN(a, b) __NM_MIN(NM_UNIQ, a, NM_UNIQ, b)
-+#define __NM_MIN(aq, a, bq, b) \
-+	({ \
-+		typeof (a) NM_UNIQ_T(A, aq) = (a); \
-+		typeof (b) NM_UNIQ_T(B, bq) = (b); \
-+		((NM_UNIQ_T(A, aq) < NM_UNIQ_T(B, bq)) ? NM_UNIQ_T(A, aq) : NM_UNIQ_T(B, bq)); \
-+	})
-+
-+#define NM_MAX(a, b) __NM_MAX(NM_UNIQ, a, NM_UNIQ, b)
-+#define __NM_MAX(aq, a, bq, b) \
-+	({ \
-+		typeof (a) NM_UNIQ_T(A, aq) = (a); \
-+		typeof (b) NM_UNIQ_T(B, bq) = (b); \
-+		((NM_UNIQ_T(A, aq) > NM_UNIQ_T(B, bq)) ? NM_UNIQ_T(A, aq) : NM_UNIQ_T(B, bq)); \
-+	})
-+
-+#define NM_CLAMP(x, low, high) __NM_CLAMP(NM_UNIQ, x, NM_UNIQ, low, NM_UNIQ, high)
-+#define __NM_CLAMP(xq, x, lowq, low, highq, high) \
-+	({ \
-+		typeof(x)NM_UNIQ_T(X,xq) = (x); \
-+		typeof(low) NM_UNIQ_T(LOW,lowq) = (low); \
-+		typeof(high) NM_UNIQ_T(HIGH,highq) = (high); \
-+		\
-+		( (NM_UNIQ_T(X,xq) > NM_UNIQ_T(HIGH,highq)) \
-+		  ? NM_UNIQ_T(HIGH,highq) \
-+		  : (NM_UNIQ_T(X,xq) < NM_UNIQ_T(LOW,lowq)) \
-+		     ? NM_UNIQ_T(LOW,lowq) \
-+		     : NM_UNIQ_T(X,xq)); \
-+	})
-+
-+/*****************************************************************************/
-+
- static inline guint
- nm_encode_version (guint major, guint minor, guint micro) {
- 	/* analog to the preprocessor macro NM_ENCODE_VERSION(). */