New upstream version 1.42.6 upstream/1.42.6

author: Michael Biebl <biebl@debian.org> 2023-06-12 11:25:29 +0200
committer: Michael Biebl <biebl@debian.org> 2023-06-12 11:25:29 +0200
commit: 150fe9eef8dd22307ee16687509acde616663982 (patch)
tree: 200fa1178c9aeee2ff874bb63afe93623da4be0d
parent: dfaaf221cfee4ffcc507d793dae051d402646679 (diff)
96 files changed, 1003 insertions, 606 deletions
diff --git a/NEWS b/NEWS
index 92268885..cb98c7ae 100644
--- a/NEWS
+++ b/NEWS
@@ -1,4 +1,20 @@
 ===============================================
+NetworkManager-1.42.6
+Overview of changes since NetworkManager-1.42.4
+===============================================
+
+* Emit the dhcp-change dispatcher event also after a lease renewal.
+* Fix assertion failure on DHCP renewal.
+* Add support for EC2 IMDSv2 in nm-cloud-setup.
+* Allow setting tunnel flags for ip6gre & ip6gretap connection
+  profiles.
+* Improve the Wi-Fi hotspot functionality.
+* Fix setting the Wi-Fi roaming policy based on the number of seen
+  BSSIDs.
+* Support the "no-aaaa" resolv.conf option.
+* Some oFono fixes.
+
+===============================================
 NetworkManager-1.42.4
 Overview of changes since NetworkManager-1.42.2
 ===============================================
diff --git a/configure b/configure
index 93531e9c..a784497c 100755
--- a/configure
+++ b/configure
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.71 for NetworkManager 1.42.4.
+# Generated by GNU Autoconf 2.71 for NetworkManager 1.42.6.
 #
 # Report bugs to <http://bugzilla.gnome.org/enter_bug.cgi?product=NetworkManager>.
 #
@@ -622,8 +622,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='NetworkManager'
 PACKAGE_TARNAME='NetworkManager'
-PACKAGE_VERSION='1.42.4'
-PACKAGE_STRING='NetworkManager 1.42.4'
+PACKAGE_VERSION='1.42.6'
+PACKAGE_STRING='NetworkManager 1.42.6'
 PACKAGE_BUGREPORT='http://bugzilla.gnome.org/enter_bug.cgi?product=NetworkManager'
 PACKAGE_URL=''
 
@@ -1744,7 +1744,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures NetworkManager 1.42.4 to adapt to many kinds of systems.
+\`configure' configures NetworkManager 1.42.6 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1816,7 +1816,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of NetworkManager 1.42.4:";;
+     short | recursive ) echo "Configuration of NetworkManager 1.42.6:";;
    esac
   cat <<\_ACEOF
 
@@ -2171,7 +2171,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-NetworkManager configure 1.42.4
+NetworkManager configure 1.42.6
 generated by GNU Autoconf 2.71
 
 Copyright (C) 2021 Free Software Foundation, Inc.
@@ -2892,7 +2892,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by NetworkManager $as_me 1.42.4, which was
+It was created by NetworkManager $as_me 1.42.6, which was
 generated by GNU Autoconf 2.71.  Invocation command line was
 
   $ $0$ac_configure_args_raw
@@ -4388,7 +4388,7 @@ fi
 
 # Define the identity of the package.
  PACKAGE='NetworkManager'
- VERSION='1.42.4'
+ VERSION='1.42.6'
 
 
 printf "%s\n" "#define PACKAGE \"$PACKAGE\"" >>confdefs.h
@@ -19328,8 +19328,8 @@ ac_compiler_gnu=$ac_cv_c_compiler_gnu
 
 NM_MAJOR_VERSION=1
 NM_MINOR_VERSION=42
-NM_MICRO_VERSION=4
-NM_VERSION=1.42.4
+NM_MICRO_VERSION=6
+NM_VERSION=1.42.6
 
 
 
@@ -19337,7 +19337,7 @@ NM_VERSION=1.42.4
 
 
 
-NM_GIT_SHA=a17d50be63958da590a46ba84032265d78636106
+NM_GIT_SHA=b6cc7c7e695ba3b1f2a5c95b0d6df418b8556e57
 
 if test """" != "no-config-h" ; then
 
@@ -32795,7 +32795,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by NetworkManager $as_me 1.42.4, which was
+This file was extended by NetworkManager $as_me 1.42.6, which was
 generated by GNU Autoconf 2.71.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -32863,7 +32863,7 @@ ac_cs_config_escaped=`printf "%s\n" "$ac_cs_config" | sed "s/^ //; s/'/'\\\\\\\\
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config='$ac_cs_config_escaped'
 ac_cs_version="\\
-NetworkManager config.status 1.42.4
+NetworkManager config.status 1.42.6
 configured by $0, generated by GNU Autoconf 2.71,
   with options \\"\$ac_cs_config\\"
 
diff --git a/configure.ac b/configure.ac
index 32926215..d7186678 100644
--- a/configure.ac
+++ b/configure.ac
@@ -8,7 +8,7 @@ dnl    "shared/nm-version-macros.h.in"
 dnl  - update number in meson.build
 m4_define([nm_major_version], [1])
 m4_define([nm_minor_version], [42])
-m4_define([nm_micro_version], [4])
+m4_define([nm_micro_version], [6])
 m4_define([nm_version],
           [nm_major_version.nm_minor_version.nm_micro_version])
 
diff --git a/docs/api/html/index.html b/docs/api/html/index.html
index b8815102..3ce39694 100644
--- a/docs/api/html/index.html
+++ b/docs/api/html/index.html
@@ -16,7 +16,7 @@
 <div>
 <div><table class="navigation" id="top" width="100%" cellpadding="2" cellspacing="0"><tr><th valign="middle"><p class="title">NetworkManager Reference Manual</p></th></tr></table></div>
 <div><p class="releaseinfo">
-      for NetworkManager 1.42.4
+      for NetworkManager 1.42.6
 
       The latest version of this documentation can be found on-line at
       <a class="ulink" href="https://networkmanager.dev/docs/api/latest/" target="_top">https://networkmanager.dev/docs/api/latest/</a>.
diff --git a/docs/api/html/nm-settings-dbus.html b/docs/api/html/nm-settings-dbus.html
index 1ce7840d..f78c2612 100644
--- a/docs/api/html/nm-settings-dbus.html
+++ b/docs/api/html/nm-settings-dbus.html
@@ -1791,7 +1791,7 @@ Set to 2147483647 (MAXINT32) for infinity.</td>
 
 NULL means that the options are unset and left at the default. In this case NetworkManager will use default options. This is distinct from an empty list of properties.
 
-The currently supported options are "attempts", "debug", "edns0", "inet6", "ip6-bytestring", "ip6-dotint", "ndots", "no-check-names", "no-ip6-dotint", "no-reload", "no-tld-query", "rotate", "single-request", "single-request-reopen", "timeout", "trust-ad", "use-vc".
+The currently supported options are "attempts", "debug", "edns0", "inet6", "ip6-bytestring", "ip6-dotint", "ndots", "no-aaaa", "no-check-names", "no-ip6-dotint", "no-reload", "no-tld-query", "rotate", "single-request", "single-request-reopen", "timeout", "trust-ad", "use-vc".
 
 The "trust-ad" setting is only honored if the profile contributes name servers to resolv.conf, and if all contributing profiles have "trust-ad" enabled.
 
@@ -2121,7 +2121,7 @@ Set to 2147483647 (MAXINT32) for infinity.</td>
 
 NULL means that the options are unset and left at the default. In this case NetworkManager will use default options. This is distinct from an empty list of properties.
 
-The currently supported options are "attempts", "debug", "edns0", "inet6", "ip6-bytestring", "ip6-dotint", "ndots", "no-check-names", "no-ip6-dotint", "no-reload", "no-tld-query", "rotate", "single-request", "single-request-reopen", "timeout", "trust-ad", "use-vc".
+The currently supported options are "attempts", "debug", "edns0", "inet6", "ip6-bytestring", "ip6-dotint", "ndots", "no-aaaa", "no-check-names", "no-ip6-dotint", "no-reload", "no-tld-query", "rotate", "single-request", "single-request-reopen", "timeout", "trust-ad", "use-vc".
 
 The "trust-ad" setting is only honored if the profile contributes name servers to resolv.conf, and if all contributing profiles have "trust-ad" enabled.
 
@@ -2337,7 +2337,7 @@ Array of IPv6 route structures.  Each IPv6 route structure is composed of an IPv
 <a name="nm-settings-dbus.property.ip-tunnel.encapsulation-limit"></a>encapsulation-limit</td>
 <td align="left">uint32</td>
 <td align="left">0</td>
-<td>How many additional levels of encapsulation are permitted to be prepended to packets. This property applies only to IPv6 tunnels.</td>
+<td>How many additional levels of encapsulation are permitted to be prepended to packets. This property applies only to IPv6 tunnels. To disable this option, add NM_IP_TUNNEL_FLAG_IP6_IGN_ENCAP_LIMIT (0x1) to ip-tunnel flags.</td>
 </tr>
 <tr>
 <td align="left">
diff --git a/docs/api/html/nm-settings-nmcli.html b/docs/api/html/nm-settings-nmcli.html
index 69b51835..0f6798b4 100644
--- a/docs/api/html/nm-settings-nmcli.html
+++ b/docs/api/html/nm-settings-nmcli.html
@@ -2143,7 +2143,7 @@
 <td>
 <p>Array of DNS options as described in man 5 resolv.conf.</p>
 <p>NULL means that the options are unset and left at the default. In this case NetworkManager will use default options. This is distinct from an empty list of properties.</p>
-<p>The currently supported options are "attempts", "debug", "edns0", "inet6", "ip6-bytestring", "ip6-dotint", "ndots", "no-check-names", "no-ip6-dotint", "no-reload", "no-tld-query", "rotate", "single-request", "single-request-reopen", "timeout", "trust-ad", "use-vc".</p>
+<p>The currently supported options are "attempts", "debug", "edns0", "inet6", "ip6-bytestring", "ip6-dotint", "ndots", "no-aaaa", "no-check-names", "no-ip6-dotint", "no-reload", "no-tld-query", "rotate", "single-request", "single-request-reopen", "timeout", "trust-ad", "use-vc".</p>
 <p>The "trust-ad" setting is only honored if the profile contributes name servers to resolv.conf, and if all contributing profiles have "trust-ad" enabled.</p>
 <p>When using a caching DNS plugin (dnsmasq or systemd-resolved in NetworkManager.conf) then "edns0" and "trust-ad" are automatically added.</p>
 <p>
@@ -2476,7 +2476,7 @@ Example: <code class="literal">priority 5 from 192.167.4.0/24 table 45</code>
 <td>
 <p>Array of DNS options as described in man 5 resolv.conf.</p>
 <p>NULL means that the options are unset and left at the default. In this case NetworkManager will use default options. This is distinct from an empty list of properties.</p>
-<p>The currently supported options are "attempts", "debug", "edns0", "inet6", "ip6-bytestring", "ip6-dotint", "ndots", "no-check-names", "no-ip6-dotint", "no-reload", "no-tld-query", "rotate", "single-request", "single-request-reopen", "timeout", "trust-ad", "use-vc".</p>
+<p>The currently supported options are "attempts", "debug", "edns0", "inet6", "ip6-bytestring", "ip6-dotint", "ndots", "no-aaaa", "no-check-names", "no-ip6-dotint", "no-reload", "no-tld-query", "rotate", "single-request", "single-request-reopen", "timeout", "trust-ad", "use-vc".</p>
 <p>The "trust-ad" setting is only honored if the profile contributes name servers to resolv.conf, and if all contributing profiles have "trust-ad" enabled.</p>
 <p>When using a caching DNS plugin (dnsmasq or systemd-resolved in NetworkManager.conf) then "edns0" and "trust-ad" are automatically added.</p>
 <p>
@@ -2717,7 +2717,7 @@ Example: <code class="literal">priority 5 from 1:2:3::5/128 table 45</code>
 <tr>
 <td><p><span class="term"><code class="option"><a name="nm-settings-nmcli.property.ip-tunnel.encapsulation-limit"></a>encapsulation-limit</code></span></p></td>
 <td>
-<p>How many additional levels of encapsulation are permitted to be prepended to packets. This property applies only to IPv6 tunnels.</p>
+<p>How many additional levels of encapsulation are permitted to be prepended to packets. This property applies only to IPv6 tunnels. To disable this option, add NM_IP_TUNNEL_FLAG_IP6_IGN_ENCAP_LIMIT (0x1) to ip-tunnel flags.</p>
 <p>
             Format: uint32</p>
 </td>
diff --git a/docs/api/version.xml b/docs/api/version.xml
index 6f7c8cda..5f1d262b 100644
--- a/docs/api/version.xml
+++ b/docs/api/version.xml
@@ -1 +1 @@
-1.42.4
+1.42.6
diff --git a/docs/libnm/html/NMSettingIPConfig.html b/docs/libnm/html/NMSettingIPConfig.html
index a10f391d..c10c68a0 100644
--- a/docs/libnm/html/NMSettingIPConfig.html
+++ b/docs/libnm/html/NMSettingIPConfig.html
@@ -1477,6 +1477,10 @@ addressing, routing, and name service properties</p>
 <td class="function_name"><a class="link" href="NMSettingIPConfig.html#NM-SETTING-DNS-OPTION-TRUST-AD:CAPS" title="NM_SETTING_DNS_OPTION_TRUST_AD">NM_SETTING_DNS_OPTION_TRUST_AD</a></td>
 </tr>
 <tr>
+<td class="define_keyword">#define</td>
+<td class="function_name"><a class="link" href="NMSettingIPConfig.html#NM-SETTING-DNS-OPTION-NO-AAAA:CAPS" title="NM_SETTING_DNS_OPTION_NO_AAAA">NM_SETTING_DNS_OPTION_NO_AAAA</a></td>
+</tr>
+<tr>
 <td class="datatype_keyword">enum</td>
 <td class="function_name"><a class="link" href="NMSettingIPConfig.html#NMDhcpHostnameFlags" title="enum NMDhcpHostnameFlags">NMDhcpHostnameFlags</a></td>
 </tr>
@@ -6630,6 +6634,12 @@ rule verfies or fail.</p>
 </div>
 <hr>
 <div class="refsect2">
+<a name="NM-SETTING-DNS-OPTION-NO-AAAA:CAPS"></a><h3>NM_SETTING_DNS_OPTION_NO_AAAA</h3>
+<pre class="programlisting">#define NM_SETTING_DNS_OPTION_NO_AAAA               "no-aaaa"
+</pre>
+</div>
+<hr>
+<div class="refsect2">
 <a name="NMDhcpHostnameFlags"></a><h3>enum NMDhcpHostnameFlags</h3>
 <p><a class="link" href="NMSettingIPConfig.html#NMDhcpHostnameFlags" title="enum NMDhcpHostnameFlags"><span class="type">NMDhcpHostnameFlags</span></a> describe flags related to the DHCP hostname and
 FQDN.</p>
diff --git a/docs/libnm/html/NMVpnEditor.html b/docs/libnm/html/NMVpnEditor.html
index d49edda0..ce6d9daf 100644
--- a/docs/libnm/html/NMVpnEditor.html
+++ b/docs/libnm/html/NMVpnEditor.html
@@ -138,7 +138,7 @@ nm_vpn_editor_update_connection (<em class="parameter"><code><a class="link" hre
 <tbody>
 <tr>
 <td class="struct_member_name"><p><em class="structfield"><code><a name="NMVpnEditorInterface.get-widget"></a>get_widget</code></em> ()</p></td>
-<td class="struct_member_description"><p>return the <a href="https://developer.gnome.org/gtk3/GtkWidget.html#GtkWidget-struct"><span class="type">GtkWidget</span></a> for the VPN editor's UI</p></td>
+<td class="struct_member_description"><p>return the <span class="type">GtkWidget</span> for the VPN editor's UI</p></td>
 <td class="struct_member_annotations"> </td>
 </tr>
 <tr>
diff --git a/docs/libnm/html/api-index-full.html b/docs/libnm/html/api-index-full.html
index a2de49f7..4f1b04f4 100644
--- a/docs/libnm/html/api-index-full.html
+++ b/docs/libnm/html/api-index-full.html
@@ -9937,6 +9937,10 @@ NMUtilsPredicateStr, user_function in NMSettingOvs
 </dt>
 <dd></dd>
 <dt>
+<a class="link" href="NMSettingIPConfig.html#NM-SETTING-DNS-OPTION-NO-AAAA:CAPS" title="NM_SETTING_DNS_OPTION_NO_AAAA">NM_SETTING_DNS_OPTION_NO_AAAA</a>, macro in <a class="link" href="NMSettingIPConfig.html" title="NMSettingIPConfig">NMSettingIPConfig</a>
+</dt>
+<dd></dd>
+<dt>
 <a class="link" href="NMSettingIPConfig.html#NM-SETTING-DNS-OPTION-NO-CHECK-NAMES:CAPS" title="NM_SETTING_DNS_OPTION_NO_CHECK_NAMES">NM_SETTING_DNS_OPTION_NO_CHECK_NAMES</a>, macro in <a class="link" href="NMSettingIPConfig.html" title="NMSettingIPConfig">NMSettingIPConfig</a>
 </dt>
 <dd></dd>
diff --git a/docs/libnm/html/index.html b/docs/libnm/html/index.html
index 7821f35f..074a6ac5 100644
--- a/docs/libnm/html/index.html
+++ b/docs/libnm/html/index.html
@@ -15,7 +15,7 @@
 <div>
 <div><table class="navigation" id="top" width="100%" cellpadding="2" cellspacing="0"><tr><th valign="middle"><p class="title">libnm Reference Manual</p></th></tr></table></div>
 <div><p class="releaseinfo">
-      for libnm 1.42.4
+      for libnm 1.42.6
 
       The latest version of this documentation can be found on-line at
       <a class="ulink" href="https://networkmanager.dev/docs/libnm/latest/" target="_top">https://networkmanager.dev/docs/libnm/latest/</a>.
diff --git a/docs/libnm/html/libnm-nm-version-macros.html b/docs/libnm/html/libnm-nm-version-macros.html
index 0639b68a..6e3dfc84 100644
--- a/docs/libnm/html/libnm-nm-version-macros.html
+++ b/docs/libnm/html/libnm-nm-version-macros.html
@@ -261,7 +261,7 @@ is compiled against.</p>
 <hr>
 <div class="refsect2">
 <a name="NM-MICRO-VERSION:CAPS"></a><h3>NM_MICRO_VERSION</h3>
-<pre class="programlisting">#define NM_MICRO_VERSION (4)
+<pre class="programlisting">#define NM_MICRO_VERSION (6)
 </pre>
 <p>Evaluates to the micro version number of NetworkManager which this source
 compiled against.</p>
diff --git a/docs/libnm/html/libnm.devhelp2 b/docs/libnm/html/libnm.devhelp2
index 4c38fb7f..82f88a93 100644
--- a/docs/libnm/html/libnm.devhelp2
+++ b/docs/libnm/html/libnm.devhelp2
@@ -1451,6 +1451,7 @@
     <keyword type="macro" name="NM_SETTING_DNS_OPTION_USE_VC" link="NMSettingIPConfig.html#NM-SETTING-DNS-OPTION-USE-VC:CAPS"/>
     <keyword type="macro" name="NM_SETTING_DNS_OPTION_NO_RELOAD" link="NMSettingIPConfig.html#NM-SETTING-DNS-OPTION-NO-RELOAD:CAPS"/>
     <keyword type="macro" name="NM_SETTING_DNS_OPTION_TRUST_AD" link="NMSettingIPConfig.html#NM-SETTING-DNS-OPTION-TRUST-AD:CAPS"/>
+    <keyword type="macro" name="NM_SETTING_DNS_OPTION_NO_AAAA" link="NMSettingIPConfig.html#NM-SETTING-DNS-OPTION-NO-AAAA:CAPS"/>
     <keyword type="enum" name="enum NMDhcpHostnameFlags" link="NMSettingIPConfig.html#NMDhcpHostnameFlags" since="1.22"/>
     <keyword type="function" name="nm_setting_ip_tunnel_new ()" link="NMSettingIPTunnel.html#nm-setting-ip-tunnel-new" since="1.2"/>
     <keyword type="function" name="nm_setting_ip_tunnel_get_parent ()" link="NMSettingIPTunnel.html#nm-setting-ip-tunnel-get-parent" since="1.2"/>
diff --git a/docs/libnm/html/usage.html b/docs/libnm/html/usage.html
index 96c21470..eccb5408 100644
--- a/docs/libnm/html/usage.html
+++ b/docs/libnm/html/usage.html
@@ -96,7 +96,7 @@
         </p>
 <pre class="screen"><code class="prompt">$ </code><strong class="userinput"><code>cc $(pkg-config --libs --cflags libnm) -o hello-nm hello-nm.c</code></strong>
   <code class="prompt">$ </code><strong class="userinput"><code>./hello-nm</code></strong>
-  NetworkManager version: 1.42.4
+  NetworkManager version: 1.42.6
 
   <code class="prompt">$ </code></pre>
 <p>
diff --git a/docs/libnm/libnm-sections.txt b/docs/libnm/libnm-sections.txt
index da7f15e6..6eff992b 100644
--- a/docs/libnm/libnm-sections.txt
+++ b/docs/libnm/libnm-sections.txt
@@ -2806,6 +2806,7 @@ NM_SETTING_DNS_OPTION_NO_TLD_QUERY
 NM_SETTING_DNS_OPTION_USE_VC
 NM_SETTING_DNS_OPTION_NO_RELOAD
 NM_SETTING_DNS_OPTION_TRUST_AD
+NM_SETTING_DNS_OPTION_NO_AAAA
 NMDhcpHostnameFlags
 nm_setting_ip_config_get_method
 nm_setting_ip_config_get_num_dns
diff --git a/docs/libnm/version.xml b/docs/libnm/version.xml
index 6f7c8cda..5f1d262b 100644
--- a/docs/libnm/version.xml
+++ b/docs/libnm/version.xml
@@ -1 +1 @@
-1.42.4
+1.42.6
diff --git a/man/NetworkManager-dispatcher.8 b/man/NetworkManager-dispatcher.8
index f56114c2..52d2b0c0 100644
--- a/man/NetworkManager-dispatcher.8
+++ b/man/NetworkManager-dispatcher.8
@@ -2,9 +2,9 @@
 .\"     Title: NetworkManager-dispatcher
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
-.\"      Date: 03/09/2023
+.\"      Date: 04/20/2023
 .\"    Manual: Network management daemons
-.\"    Source: NetworkManager-dispatcher 1.42.4
+.\"    Source: NetworkManager-dispatcher 1.42.6
 .\"  Language: English
 .\"
 .TH "NETWORKMANAGER\-DISPATCHER" "8" "" "NetworkManager\-dispatcher 1\&" "Network management daemons"
diff --git a/man/NetworkManager-wait-online.service.8 b/man/NetworkManager-wait-online.service.8
index d1ca0eb6..542a0876 100644
--- a/man/NetworkManager-wait-online.service.8
+++ b/man/NetworkManager-wait-online.service.8
@@ -2,9 +2,9 @@
 .\"     Title: NetworkManager-wait-online.service
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
-.\"      Date: 03/09/2023
+.\"      Date: 04/20/2023
 .\"    Manual: Network management daemons
-.\"    Source: NetworkManager-wait-online.service 1.42.4
+.\"    Source: NetworkManager-wait-online.service 1.42.6
 .\"  Language: English
 .\"
 .TH "NETWORKMANAGER\-WAIT\-ONLINE\&" "8" "" "NetworkManager\-wait\-online\&" "Network management daemons"
diff --git a/man/NetworkManager.8 b/man/NetworkManager.8
index 14eda221..82d59289 100644
--- a/man/NetworkManager.8
+++ b/man/NetworkManager.8
@@ -2,12 +2,12 @@
 .\"     Title: NetworkManager
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
-.\"      Date: 03/09/2023
+.\"      Date: 04/20/2023
 .\"    Manual: Network management daemons
-.\"    Source: NetworkManager 1.42.4
+.\"    Source: NetworkManager 1.42.6
 .\"  Language: English
 .\"
-.TH "NETWORKMANAGER" "8" "" "NetworkManager 1\&.42\&.4" "Network management daemons"
+.TH "NETWORKMANAGER" "8" "" "NetworkManager 1\&.42\&.6" "Network management daemons"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
diff --git a/man/NetworkManager.conf.5 b/man/NetworkManager.conf.5
index 5cdb15ff..c7d80186 100644
--- a/man/NetworkManager.conf.5
+++ b/man/NetworkManager.conf.5
@@ -2,12 +2,12 @@
 .\"     Title: NetworkManager.conf
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
-.\"      Date: 03/09/2023
+.\"      Date: 04/20/2023
 .\"    Manual: Configuration
-.\"    Source: NetworkManager 1.42.4
+.\"    Source: NetworkManager 1.42.6
 .\"  Language: English
 .\"
-.TH "NETWORKMANAGER\&.CONF" "5" "" "NetworkManager 1\&.42\&.4" "Configuration"
+.TH "NETWORKMANAGER\&.CONF" "5" "" "NetworkManager 1\&.42\&.6" "Configuration"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
diff --git a/man/nm-cloud-setup.8 b/man/nm-cloud-setup.8
index 9b851e33..90a8b8c2 100644
--- a/man/nm-cloud-setup.8
+++ b/man/nm-cloud-setup.8
@@ -2,12 +2,12 @@
 .\"     Title: nm-cloud-setup
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
-.\"      Date: 03/09/2023
+.\"      Date: 04/20/2023
 .\"    Manual: Automatic Network Configuration in Cloud with NetworkManager
-.\"    Source: NetworkManager 1.42.4
+.\"    Source: NetworkManager 1.42.6
 .\"  Language: English
 .\"
-.TH "NM\-CLOUD\-SETUP" "8" "" "NetworkManager 1\&.42\&.4" "Automatic Network Configuratio"
+.TH "NM\-CLOUD\-SETUP" "8" "" "NetworkManager 1\&.42\&.6" "Automatic Network Configuratio"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
diff --git a/man/nm-initrd-generator.8 b/man/nm-initrd-generator.8
index c9fc3411..a2d91374 100644
--- a/man/nm-initrd-generator.8
+++ b/man/nm-initrd-generator.8
@@ -2,12 +2,12 @@
 .\"     Title: nm-initrd-generator
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
-.\"      Date: 03/09/2023
+.\"      Date: 04/20/2023
 .\"    Manual: System Administration
-.\"    Source: NetworkManager 1.42.4
+.\"    Source: NetworkManager 1.42.6
 .\"  Language: English
 .\"
-.TH "NM\-INITRD\-GENERATOR" "8" "" "NetworkManager 1\&.42\&.4" "System Administration"
+.TH "NM\-INITRD\-GENERATOR" "8" "" "NetworkManager 1\&.42\&.6" "System Administration"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
diff --git a/man/nm-online.1 b/man/nm-online.1
index 4676c956..a3d87696 100644
--- a/man/nm-online.1
+++ b/man/nm-online.1
@@ -2,12 +2,12 @@
 .\"     Title: nm-online
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
-.\"      Date: 03/09/2023
+.\"      Date: 04/20/2023
 .\"    Manual: General Commands Manual
-.\"    Source: NetworkManager 1.42.4
+.\"    Source: NetworkManager 1.42.6
 .\"  Language: English
 .\"
-.TH "NM\-ONLINE" "1" "" "NetworkManager 1\&.42\&.4" "General Commands Manual"
+.TH "NM\-ONLINE" "1" "" "NetworkManager 1\&.42\&.6" "General Commands Manual"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
diff --git a/man/nm-openvswitch.7 b/man/nm-openvswitch.7
index 2a1eddaa..36e617cb 100644
--- a/man/nm-openvswitch.7
+++ b/man/nm-openvswitch.7
@@ -2,12 +2,12 @@
 .\"     Title: nm-openvswitch
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
-.\"      Date: 03/09/2023
+.\"      Date: 04/20/2023
 .\"    Manual: Open vSwitch support overview
-.\"    Source: NetworkManager 1.42.4
+.\"    Source: NetworkManager 1.42.6
 .\"  Language: English
 .\"
-.TH "NM\-OPENVSWITCH" "7" "" "NetworkManager 1\&.42\&.4" "Open vSwitch support overview"
+.TH "NM\-OPENVSWITCH" "7" "" "NetworkManager 1\&.42\&.6" "Open vSwitch support overview"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
diff --git a/man/nm-settings-dbus.5 b/man/nm-settings-dbus.5
index 48b070ba..74bb6dc2 100644
--- a/man/nm-settings-dbus.5
+++ b/man/nm-settings-dbus.5
@@ -2,12 +2,12 @@
 .\"     Title: nm-settings-dbus
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
-.\"      Date: 03/09/2023
+.\"      Date: 04/20/2023
 .\"    Manual: Configuration
-.\"    Source: NetworkManager 1.42.4
+.\"    Source: NetworkManager 1.42.6
 .\"  Language: English
 .\"
-.TH "NM\-SETTINGS\-DBUS" "5" "" "NetworkManager 1\&.42\&.4" "Configuration"
+.TH "NM\-SETTINGS\-DBUS" "5" "" "NetworkManager 1\&.42\&.6" "Configuration"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -2256,7 +2256,7 @@ Array of DNS options as described in man 5 resolv\&.conf\&.
 
 NULL means that the options are unset and left at the default\&. In this case NetworkManager will use default options\&. This is distinct from an empty list of properties\&.
 
-The currently supported options are "attempts", "debug", "edns0", "inet6", "ip6\-bytestring", "ip6\-dotint", "ndots", "no\-check\-names", "no\-ip6\-dotint", "no\-reload", "no\-tld\-query", "rotate", "single\-request", "single\-request\-reopen", "timeout", "trust\-ad", "use\-vc"\&.
+The currently supported options are "attempts", "debug", "edns0", "inet6", "ip6\-bytestring", "ip6\-dotint", "ndots", "no\-aaaa", "no\-check\-names", "no\-ip6\-dotint", "no\-reload", "no\-tld\-query", "rotate", "single\-request", "single\-request\-reopen", "timeout", "trust\-ad", "use\-vc"\&.
 
 The "trust\-ad" setting is only honored if the profile contributes name servers to resolv\&.conf, and if all contributing profiles have "trust\-ad" enabled\&.
 
@@ -2679,7 +2679,7 @@ Array of DNS options as described in man 5 resolv\&.conf\&.
 
 NULL means that the options are unset and left at the default\&. In this case NetworkManager will use default options\&. This is distinct from an empty list of properties\&.
 
-The currently supported options are "attempts", "debug", "edns0", "inet6", "ip6\-bytestring", "ip6\-dotint", "ndots", "no\-check\-names", "no\-ip6\-dotint", "no\-reload", "no\-tld\-query", "rotate", "single\-request", "single\-request\-reopen", "timeout", "trust\-ad", "use\-vc"\&.
+The currently supported options are "attempts", "debug", "edns0", "inet6", "ip6\-bytestring", "ip6\-dotint", "ndots", "no\-aaaa", "no\-check\-names", "no\-ip6\-dotint", "no\-reload", "no\-tld\-query", "rotate", "single\-request", "single\-request\-reopen", "timeout", "trust\-ad", "use\-vc"\&.
 
 The "trust\-ad" setting is only honored if the profile contributes name servers to resolv\&.conf, and if all contributing profiles have "trust\-ad" enabled\&.
 
@@ -2946,7 +2946,7 @@ uint32
 T}:T{
 0
 T}:T{
-How many additional levels of encapsulation are permitted to be prepended to packets\&. This property applies only to IPv6 tunnels\&.
+How many additional levels of encapsulation are permitted to be prepended to packets\&. This property applies only to IPv6 tunnels\&. To disable this option, add NM_IP_TUNNEL_FLAG_IP6_IGN_ENCAP_LIMIT (0x1) to ip\-tunnel flags\&.
 T}
 T{
 flags
diff --git a/man/nm-settings-dbus.xml b/man/nm-settings-dbus.xml
index 85a0ccc5..b129a47d 100644
--- a/man/nm-settings-dbus.xml
+++ b/man/nm-settings-dbus.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0"?>
 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.3//EN" "http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd">
-<refentry id="nm-settings-dbus"><refentryinfo><title>nm-settings-dbus</title><author>NetworkManager developers</author></refentryinfo><refmeta><refentrytitle>nm-settings-dbus</refentrytitle><manvolnum>5</manvolnum><refmiscinfo class="source">NetworkManager</refmiscinfo><refmiscinfo class="manual">Configuration</refmiscinfo><refmiscinfo class="version">1.42.4</refmiscinfo></refmeta><refnamediv><refname>nm-settings-dbus</refname><refpurpose>Description of settings and properties of NetworkManager connection profiles on the D-Bus API</refpurpose></refnamediv><refsect1 id="description"><title>Description</title><para>
+<refentry id="nm-settings-dbus"><refentryinfo><title>nm-settings-dbus</title><author>NetworkManager developers</author></refentryinfo><refmeta><refentrytitle>nm-settings-dbus</refentrytitle><manvolnum>5</manvolnum><refmiscinfo class="source">NetworkManager</refmiscinfo><refmiscinfo class="manual">Configuration</refmiscinfo><refmiscinfo class="version">1.42.6</refmiscinfo></refmeta><refnamediv><refname>nm-settings-dbus</refname><refpurpose>Description of settings and properties of NetworkManager connection profiles on the D-Bus API</refpurpose></refnamediv><refsect1 id="description"><title>Description</title><para>
           NetworkManager is based on a concept of connection profiles, sometimes referred to as
           connections only. These connection profiles contain a network configuration. When
           NetworkManager activates a connection profile on a network device the configuration will
@@ -187,7 +187,7 @@ Set to 2147483647 (MAXINT32) for infinity.</entry></row><row><entry align="left"
 
 NULL means that the options are unset and left at the default. In this case NetworkManager will use default options. This is distinct from an empty list of properties.
 
-The currently supported options are "attempts", "debug", "edns0", "inet6", "ip6-bytestring", "ip6-dotint", "ndots", "no-check-names", "no-ip6-dotint", "no-reload", "no-tld-query", "rotate", "single-request", "single-request-reopen", "timeout", "trust-ad", "use-vc".
+The currently supported options are "attempts", "debug", "edns0", "inet6", "ip6-bytestring", "ip6-dotint", "ndots", "no-aaaa", "no-check-names", "no-ip6-dotint", "no-reload", "no-tld-query", "rotate", "single-request", "single-request-reopen", "timeout", "trust-ad", "use-vc".
 
 The "trust-ad" setting is only honored if the profile contributes name servers to resolv.conf, and if all contributing profiles have "trust-ad" enabled.
 
@@ -279,7 +279,7 @@ Set to 2147483647 (MAXINT32) for infinity.</entry></row><row><entry align="left"
 
 NULL means that the options are unset and left at the default. In this case NetworkManager will use default options. This is distinct from an empty list of properties.
 
-The currently supported options are "attempts", "debug", "edns0", "inet6", "ip6-bytestring", "ip6-dotint", "ndots", "no-check-names", "no-ip6-dotint", "no-reload", "no-tld-query", "rotate", "single-request", "single-request-reopen", "timeout", "trust-ad", "use-vc".
+The currently supported options are "attempts", "debug", "edns0", "inet6", "ip6-bytestring", "ip6-dotint", "ndots", "no-aaaa", "no-check-names", "no-ip6-dotint", "no-reload", "no-tld-query", "rotate", "single-request", "single-request-reopen", "timeout", "trust-ad", "use-vc".
 
 The "trust-ad" setting is only honored if the profile contributes name servers to resolv.conf, and if all contributing profiles have "trust-ad" enabled.
 
@@ -334,7 +334,7 @@ This affects all routes, including device-routes, IPv4LL, DHCP, SLAAC, default-r
 If the table setting is left at zero, it is eligible to be overwritten via global configuration. If the property is zero even after applying the global configuration value, policy routing is disabled for the address family of this connection.
 
 Policy routing disabled means that NetworkManager will add all routes to the main table (except static routes that explicitly configure a different table). Additionally, NetworkManager will not delete any extraneous routes from tables except the main table. This is to preserve backward compatibility for users who manage routing tables outside of NetworkManager.</entry></row><row><entry align="left" id="nm-settings-dbus.property.ipv6.routes">routes</entry><entry align="left">array of legacy IPv6 route struct (a(ayuayu))</entry><entry align="left"/><entry>Deprecated in favor of the 'route-data' property, but this can be used for backward-compatibility with older daemons. Note that if you send this property the daemon will ignore 'route-data'.
-Array of IPv6 route structures.  Each IPv6 route structure is composed of an IPv6 address, a prefix length (0 - 128), an IPv6 next hop address (which may be zeroed out if there is no next hop), and a metric. If the metric is 0, NM will choose an appropriate default metric for the device.</entry></row><row><entry align="left" id="nm-settings-dbus.property.ipv6.routing-rules">routing-rules</entry><entry align="left">array of 'a{sv}'</entry><entry align="left"/><entry>Array of dictionaries for routing rules. Each routing rule supports the following options: action (y), dport-end (q), dport-start (q), family (i), from (s), from-len (y), fwmark (u), fwmask (u), iifname (s), invert (b), ipproto (s), oifname (s), priority (u), sport-end (q), sport-start (q), supress-prefixlength (i), table (u), to (s), tos (y), to-len (y), range-end (u), range-start (u).</entry></row><row><entry align="left" id="nm-settings-dbus.property.ipv6.token">token</entry><entry align="left">string</entry><entry align="left"/><entry>Configure the token for draft-chown-6man-tokenised-ipv6-identifiers-02 IPv6 tokenized interface identifiers. Useful with eui64 addr-gen-mode.</entry></row></tbody></tgroup></informaltable></refsect2><refsect2><title>ip-tunnel setting</title><para>IP Tunneling Settings.</para><informaltable><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody><row><entry align="left" id="nm-settings-dbus.property.ip-tunnel.encapsulation-limit">encapsulation-limit</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>How many additional levels of encapsulation are permitted to be prepended to packets. This property applies only to IPv6 tunnels.</entry></row><row><entry align="left" id="nm-settings-dbus.property.ip-tunnel.flags">flags</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>Tunnel flags. Currently, the following values are supported: NM_IP_TUNNEL_FLAG_IP6_IGN_ENCAP_LIMIT (0x1), NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_TCLASS (0x2), NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_FLOWLABEL (0x4), NM_IP_TUNNEL_FLAG_IP6_MIP6_DEV (0x8), NM_IP_TUNNEL_FLAG_IP6_RCV_DSCP_COPY (0x10), NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_FWMARK (0x20). They are valid only for IPv6 tunnels.</entry></row><row><entry align="left" id="nm-settings-dbus.property.ip-tunnel.flow-label">flow-label</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>The flow label to assign to tunnel packets. This property applies only to IPv6 tunnels.</entry></row><row><entry align="left" id="nm-settings-dbus.property.ip-tunnel.fwmark">fwmark</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>The fwmark value to assign to tunnel packets. This property can be set to a non zero value only on VTI and VTI6 tunnels.</entry></row><row><entry align="left" id="nm-settings-dbus.property.ip-tunnel.input-key">input-key</entry><entry align="left">string</entry><entry align="left"/><entry>The key used for tunnel input packets; the property is valid only for certain tunnel modes (GRE, IP6GRE). If empty, no key is used.</entry></row><row><entry align="left" id="nm-settings-dbus.property.ip-tunnel.local">local</entry><entry align="left">string</entry><entry align="left"/><entry>The local endpoint of the tunnel; the value can be empty, otherwise it must contain an IPv4 or IPv6 address.</entry></row><row><entry align="left" id="nm-settings-dbus.property.ip-tunnel.mode">mode</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>The tunneling mode, for example NM_IP_TUNNEL_MODE_IPIP (1) or NM_IP_TUNNEL_MODE_GRE (2).</entry></row><row><entry align="left" id="nm-settings-dbus.property.ip-tunnel.mtu">mtu</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>If non-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple fragments.</entry></row><row><entry align="left" id="nm-settings-dbus.property.ip-tunnel.output-key">output-key</entry><entry align="left">string</entry><entry align="left"/><entry>The key used for tunnel output packets; the property is valid only for certain tunnel modes (GRE, IP6GRE). If empty, no key is used.</entry></row><row><entry align="left" id="nm-settings-dbus.property.ip-tunnel.parent">parent</entry><entry align="left">string</entry><entry align="left"/><entry>If given, specifies the parent interface name or parent connection UUID the new device will be bound to so that tunneled packets will only be routed via that interface.</entry></row><row><entry align="left" id="nm-settings-dbus.property.ip-tunnel.path-mtu-discovery">path-mtu-discovery</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>Whether to enable Path MTU Discovery on this tunnel.</entry></row><row><entry align="left" id="nm-settings-dbus.property.ip-tunnel.remote">remote</entry><entry align="left">string</entry><entry align="left"/><entry>The remote endpoint of the tunnel; the value must contain an IPv4 or IPv6 address.</entry></row><row><entry align="left" id="nm-settings-dbus.property.ip-tunnel.tos">tos</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>The type of service (IPv4) or traffic class (IPv6) field to be set on tunneled packets.</entry></row><row><entry align="left" id="nm-settings-dbus.property.ip-tunnel.ttl">ttl</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>The TTL to assign to tunneled packets. 0 is a special value meaning that packets inherit the TTL value.</entry></row></tbody></tgroup></informaltable></refsect2><refsect2><title>macsec setting</title><para>MACSec Settings.</para><informaltable><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody><row><entry align="left" id="nm-settings-dbus.property.macsec.encrypt">encrypt</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>Whether the transmitted traffic must be encrypted.</entry></row><row><entry align="left" id="nm-settings-dbus.property.macsec.mka-cak">mka-cak</entry><entry align="left">string</entry><entry align="left"/><entry>The pre-shared CAK (Connectivity Association Key) for MACsec Key Agreement. Must be a string of 32 hexadecimal characters.</entry></row><row><entry align="left" id="nm-settings-dbus.property.macsec.mka-cak-flags">mka-cak-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "mka-cak" property.</entry></row><row><entry align="left" id="nm-settings-dbus.property.macsec.mka-ckn">mka-ckn</entry><entry align="left">string</entry><entry align="left"/><entry>The pre-shared CKN (Connectivity-association Key Name) for MACsec Key Agreement. Must be a string of hexadecimal characters with a even length between 2 and 64.</entry></row><row><entry align="left" id="nm-settings-dbus.property.macsec.mode">mode</entry><entry align="left">int32</entry><entry align="left">0</entry><entry>Specifies how the CAK (Connectivity Association Key) for MKA (MACsec Key Agreement) is obtained.</entry></row><row><entry align="left" id="nm-settings-dbus.property.macsec.parent">parent</entry><entry align="left">string</entry><entry align="left"/><entry>If given, specifies the parent interface name or parent connection UUID from which this MACSEC interface should be created.  If this property is not specified, the connection must contain an "802-3-ethernet" setting with a "mac-address" property.</entry></row><row><entry align="left" id="nm-settings-dbus.property.macsec.port">port</entry><entry align="left">int32</entry><entry align="left">1</entry><entry>The port component of the SCI (Secure Channel Identifier), between 1 and 65534.</entry></row><row><entry align="left" id="nm-settings-dbus.property.macsec.send-sci">send-sci</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>Specifies whether the SCI (Secure Channel Identifier) is included in every packet.</entry></row><row><entry align="left" id="nm-settings-dbus.property.macsec.validation">validation</entry><entry align="left">int32</entry><entry align="left">2</entry><entry>Specifies the validation mode for incoming frames.</entry></row></tbody></tgroup></informaltable></refsect2><refsect2><title>macvlan setting</title><para>MAC VLAN Settings.</para><informaltable><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody><row><entry align="left" id="nm-settings-dbus.property.macvlan.mode">mode</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>The macvlan mode, which specifies the communication mechanism between multiple macvlans on the same lower device.</entry></row><row><entry align="left" id="nm-settings-dbus.property.macvlan.parent">parent</entry><entry align="left">string</entry><entry align="left"/><entry>If given, specifies the parent interface name or parent connection UUID from which this MAC-VLAN interface should be created.  If this property is not specified, the connection must contain an "802-3-ethernet" setting with a "mac-address" property.</entry></row><row><entry align="left" id="nm-settings-dbus.property.macvlan.promiscuous">promiscuous</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>Whether the interface should be put in promiscuous mode.</entry></row><row><entry align="left" id="nm-settings-dbus.property.macvlan.tap">tap</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>Whether the interface should be a MACVTAP.</entry></row></tbody></tgroup></informaltable></refsect2><refsect2><title>match setting</title><para>Match settings.</para><informaltable><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody><row><entry align="left" id="nm-settings-dbus.property.match.driver">driver</entry><entry align="left">array of string</entry><entry align="left"/><entry>A list of driver names to match. Each element is a shell wildcard pattern.
+Array of IPv6 route structures.  Each IPv6 route structure is composed of an IPv6 address, a prefix length (0 - 128), an IPv6 next hop address (which may be zeroed out if there is no next hop), and a metric. If the metric is 0, NM will choose an appropriate default metric for the device.</entry></row><row><entry align="left" id="nm-settings-dbus.property.ipv6.routing-rules">routing-rules</entry><entry align="left">array of 'a{sv}'</entry><entry align="left"/><entry>Array of dictionaries for routing rules. Each routing rule supports the following options: action (y), dport-end (q), dport-start (q), family (i), from (s), from-len (y), fwmark (u), fwmask (u), iifname (s), invert (b), ipproto (s), oifname (s), priority (u), sport-end (q), sport-start (q), supress-prefixlength (i), table (u), to (s), tos (y), to-len (y), range-end (u), range-start (u).</entry></row><row><entry align="left" id="nm-settings-dbus.property.ipv6.token">token</entry><entry align="left">string</entry><entry align="left"/><entry>Configure the token for draft-chown-6man-tokenised-ipv6-identifiers-02 IPv6 tokenized interface identifiers. Useful with eui64 addr-gen-mode.</entry></row></tbody></tgroup></informaltable></refsect2><refsect2><title>ip-tunnel setting</title><para>IP Tunneling Settings.</para><informaltable><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody><row><entry align="left" id="nm-settings-dbus.property.ip-tunnel.encapsulation-limit">encapsulation-limit</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>How many additional levels of encapsulation are permitted to be prepended to packets. This property applies only to IPv6 tunnels. To disable this option, add NM_IP_TUNNEL_FLAG_IP6_IGN_ENCAP_LIMIT (0x1) to ip-tunnel flags.</entry></row><row><entry align="left" id="nm-settings-dbus.property.ip-tunnel.flags">flags</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>Tunnel flags. Currently, the following values are supported: NM_IP_TUNNEL_FLAG_IP6_IGN_ENCAP_LIMIT (0x1), NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_TCLASS (0x2), NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_FLOWLABEL (0x4), NM_IP_TUNNEL_FLAG_IP6_MIP6_DEV (0x8), NM_IP_TUNNEL_FLAG_IP6_RCV_DSCP_COPY (0x10), NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_FWMARK (0x20). They are valid only for IPv6 tunnels.</entry></row><row><entry align="left" id="nm-settings-dbus.property.ip-tunnel.flow-label">flow-label</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>The flow label to assign to tunnel packets. This property applies only to IPv6 tunnels.</entry></row><row><entry align="left" id="nm-settings-dbus.property.ip-tunnel.fwmark">fwmark</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>The fwmark value to assign to tunnel packets. This property can be set to a non zero value only on VTI and VTI6 tunnels.</entry></row><row><entry align="left" id="nm-settings-dbus.property.ip-tunnel.input-key">input-key</entry><entry align="left">string</entry><entry align="left"/><entry>The key used for tunnel input packets; the property is valid only for certain tunnel modes (GRE, IP6GRE). If empty, no key is used.</entry></row><row><entry align="left" id="nm-settings-dbus.property.ip-tunnel.local">local</entry><entry align="left">string</entry><entry align="left"/><entry>The local endpoint of the tunnel; the value can be empty, otherwise it must contain an IPv4 or IPv6 address.</entry></row><row><entry align="left" id="nm-settings-dbus.property.ip-tunnel.mode">mode</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>The tunneling mode, for example NM_IP_TUNNEL_MODE_IPIP (1) or NM_IP_TUNNEL_MODE_GRE (2).</entry></row><row><entry align="left" id="nm-settings-dbus.property.ip-tunnel.mtu">mtu</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>If non-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple fragments.</entry></row><row><entry align="left" id="nm-settings-dbus.property.ip-tunnel.output-key">output-key</entry><entry align="left">string</entry><entry align="left"/><entry>The key used for tunnel output packets; the property is valid only for certain tunnel modes (GRE, IP6GRE). If empty, no key is used.</entry></row><row><entry align="left" id="nm-settings-dbus.property.ip-tunnel.parent">parent</entry><entry align="left">string</entry><entry align="left"/><entry>If given, specifies the parent interface name or parent connection UUID the new device will be bound to so that tunneled packets will only be routed via that interface.</entry></row><row><entry align="left" id="nm-settings-dbus.property.ip-tunnel.path-mtu-discovery">path-mtu-discovery</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>Whether to enable Path MTU Discovery on this tunnel.</entry></row><row><entry align="left" id="nm-settings-dbus.property.ip-tunnel.remote">remote</entry><entry align="left">string</entry><entry align="left"/><entry>The remote endpoint of the tunnel; the value must contain an IPv4 or IPv6 address.</entry></row><row><entry align="left" id="nm-settings-dbus.property.ip-tunnel.tos">tos</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>The type of service (IPv4) or traffic class (IPv6) field to be set on tunneled packets.</entry></row><row><entry align="left" id="nm-settings-dbus.property.ip-tunnel.ttl">ttl</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>The TTL to assign to tunneled packets. 0 is a special value meaning that packets inherit the TTL value.</entry></row></tbody></tgroup></informaltable></refsect2><refsect2><title>macsec setting</title><para>MACSec Settings.</para><informaltable><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody><row><entry align="left" id="nm-settings-dbus.property.macsec.encrypt">encrypt</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>Whether the transmitted traffic must be encrypted.</entry></row><row><entry align="left" id="nm-settings-dbus.property.macsec.mka-cak">mka-cak</entry><entry align="left">string</entry><entry align="left"/><entry>The pre-shared CAK (Connectivity Association Key) for MACsec Key Agreement. Must be a string of 32 hexadecimal characters.</entry></row><row><entry align="left" id="nm-settings-dbus.property.macsec.mka-cak-flags">mka-cak-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "mka-cak" property.</entry></row><row><entry align="left" id="nm-settings-dbus.property.macsec.mka-ckn">mka-ckn</entry><entry align="left">string</entry><entry align="left"/><entry>The pre-shared CKN (Connectivity-association Key Name) for MACsec Key Agreement. Must be a string of hexadecimal characters with a even length between 2 and 64.</entry></row><row><entry align="left" id="nm-settings-dbus.property.macsec.mode">mode</entry><entry align="left">int32</entry><entry align="left">0</entry><entry>Specifies how the CAK (Connectivity Association Key) for MKA (MACsec Key Agreement) is obtained.</entry></row><row><entry align="left" id="nm-settings-dbus.property.macsec.parent">parent</entry><entry align="left">string</entry><entry align="left"/><entry>If given, specifies the parent interface name or parent connection UUID from which this MACSEC interface should be created.  If this property is not specified, the connection must contain an "802-3-ethernet" setting with a "mac-address" property.</entry></row><row><entry align="left" id="nm-settings-dbus.property.macsec.port">port</entry><entry align="left">int32</entry><entry align="left">1</entry><entry>The port component of the SCI (Secure Channel Identifier), between 1 and 65534.</entry></row><row><entry align="left" id="nm-settings-dbus.property.macsec.send-sci">send-sci</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>Specifies whether the SCI (Secure Channel Identifier) is included in every packet.</entry></row><row><entry align="left" id="nm-settings-dbus.property.macsec.validation">validation</entry><entry align="left">int32</entry><entry align="left">2</entry><entry>Specifies the validation mode for incoming frames.</entry></row></tbody></tgroup></informaltable></refsect2><refsect2><title>macvlan setting</title><para>MAC VLAN Settings.</para><informaltable><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody><row><entry align="left" id="nm-settings-dbus.property.macvlan.mode">mode</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>The macvlan mode, which specifies the communication mechanism between multiple macvlans on the same lower device.</entry></row><row><entry align="left" id="nm-settings-dbus.property.macvlan.parent">parent</entry><entry align="left">string</entry><entry align="left"/><entry>If given, specifies the parent interface name or parent connection UUID from which this MAC-VLAN interface should be created.  If this property is not specified, the connection must contain an "802-3-ethernet" setting with a "mac-address" property.</entry></row><row><entry align="left" id="nm-settings-dbus.property.macvlan.promiscuous">promiscuous</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>Whether the interface should be put in promiscuous mode.</entry></row><row><entry align="left" id="nm-settings-dbus.property.macvlan.tap">tap</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>Whether the interface should be a MACVTAP.</entry></row></tbody></tgroup></informaltable></refsect2><refsect2><title>match setting</title><para>Match settings.</para><informaltable><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody><row><entry align="left" id="nm-settings-dbus.property.match.driver">driver</entry><entry align="left">array of string</entry><entry align="left"/><entry>A list of driver names to match. Each element is a shell wildcard pattern.
 
 See NMSettingMatch:interface-name for how special characters '|', '&amp;', '!' and '\\' are used for optional and mandatory matches and inverting the pattern.</entry></row><row><entry align="left" id="nm-settings-dbus.property.match.interface-name">interface-name</entry><entry align="left">array of string</entry><entry align="left"/><entry>A list of interface names to match. Each element is a shell wildcard pattern.
 
diff --git a/man/nm-settings-ifcfg-rh.5 b/man/nm-settings-ifcfg-rh.5
index e96e1e3f..49d97776 100644
--- a/man/nm-settings-ifcfg-rh.5
+++ b/man/nm-settings-ifcfg-rh.5
@@ -2,12 +2,12 @@
 .\"     Title: nm-settings-ifcfg-rh
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
-.\"      Date: 03/09/2023
+.\"      Date: 04/20/2023
 .\"    Manual: Configuration
-.\"    Source: NetworkManager 1.42.4
+.\"    Source: NetworkManager 1.42.6
 .\"  Language: English
 .\"
-.TH "NM\-SETTINGS\-IFCFG\-RH" "5" "" "NetworkManager 1\&.42\&.4" "Configuration"
+.TH "NM\-SETTINGS\-IFCFG\-RH" "5" "" "NetworkManager 1\&.42\&.6" "Configuration"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
diff --git a/man/nm-settings-ifcfg-rh.xml b/man/nm-settings-ifcfg-rh.xml
index 37a46ab3..61ae224d 100644
--- a/man/nm-settings-ifcfg-rh.xml
+++ b/man/nm-settings-ifcfg-rh.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0"?>
 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.3//EN" "http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd">
-<refentry id="nm-settings-ifcfg-rh"><refentryinfo><title>nm-settings-ifcfg-rh</title><author>NetworkManager developers</author></refentryinfo><refmeta><refentrytitle>nm-settings-ifcfg-rh</refentrytitle><manvolnum>5</manvolnum><refmiscinfo class="source">NetworkManager</refmiscinfo><refmiscinfo class="manual">Configuration</refmiscinfo><refmiscinfo class="version">1.42.4</refmiscinfo></refmeta><refnamediv><refname>nm-settings-ifcfg-rh</refname><refpurpose>Description of <emphasis>ifcfg-rh</emphasis> settings plugin</refpurpose></refnamediv><refsect1 id="description"><title>Description</title><para>
+<refentry id="nm-settings-ifcfg-rh"><refentryinfo><title>nm-settings-ifcfg-rh</title><author>NetworkManager developers</author></refentryinfo><refmeta><refentrytitle>nm-settings-ifcfg-rh</refentrytitle><manvolnum>5</manvolnum><refmiscinfo class="source">NetworkManager</refmiscinfo><refmiscinfo class="manual">Configuration</refmiscinfo><refmiscinfo class="version">1.42.6</refmiscinfo></refmeta><refnamediv><refname>nm-settings-ifcfg-rh</refname><refpurpose>Description of <emphasis>ifcfg-rh</emphasis> settings plugin</refpurpose></refnamediv><refsect1 id="description"><title>Description</title><para>
           NetworkManager is based on the concept of connection profiles that contain
           network configuration (see <citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum></citerefentry> for details). The profiles can be
           stored in various formats. NetworkManager uses plugins for reading and writing
diff --git a/man/nm-settings-keyfile.5 b/man/nm-settings-keyfile.5
index fc30ddb8..2f1f9ff4 100644
--- a/man/nm-settings-keyfile.5
+++ b/man/nm-settings-keyfile.5
@@ -2,12 +2,12 @@
 .\"     Title: nm-settings-keyfile
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
-.\"      Date: 03/09/2023
+.\"      Date: 04/20/2023
 .\"    Manual: Configuration
-.\"    Source: NetworkManager 1.42.4
+.\"    Source: NetworkManager 1.42.6
 .\"  Language: English
 .\"
-.TH "NM\-SETTINGS\-KEYFILE" "5" "" "NetworkManager 1\&.42\&.4" "Configuration"
+.TH "NM\-SETTINGS\-KEYFILE" "5" "" "NetworkManager 1\&.42\&.6" "Configuration"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
diff --git a/man/nm-settings-keyfile.xml b/man/nm-settings-keyfile.xml
index 07e45da2..e8e2caac 100644
--- a/man/nm-settings-keyfile.xml
+++ b/man/nm-settings-keyfile.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0"?>
 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.3//EN" "http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd">
-<refentry id="nm-settings-keyfile"><refentryinfo><title>nm-settings-keyfile</title><author>NetworkManager developers</author></refentryinfo><refmeta><refentrytitle>nm-settings-keyfile</refentrytitle><manvolnum>5</manvolnum><refmiscinfo class="source">NetworkManager</refmiscinfo><refmiscinfo class="manual">Configuration</refmiscinfo><refmiscinfo class="version">1.42.4</refmiscinfo></refmeta><refnamediv><refname>nm-settings-keyfile</refname><refpurpose>Description of <emphasis>keyfile</emphasis> settings plugin</refpurpose></refnamediv><refsect1 id="description"><title>Description</title><para>
+<refentry id="nm-settings-keyfile"><refentryinfo><title>nm-settings-keyfile</title><author>NetworkManager developers</author></refentryinfo><refmeta><refentrytitle>nm-settings-keyfile</refentrytitle><manvolnum>5</manvolnum><refmiscinfo class="source">NetworkManager</refmiscinfo><refmiscinfo class="manual">Configuration</refmiscinfo><refmiscinfo class="version">1.42.6</refmiscinfo></refmeta><refnamediv><refname>nm-settings-keyfile</refname><refpurpose>Description of <emphasis>keyfile</emphasis> settings plugin</refpurpose></refnamediv><refsect1 id="description"><title>Description</title><para>
           NetworkManager is based on the concept of connection profiles that contain
           network configuration (see <citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum></citerefentry> for details). The profiles can be
           stored in various formats. NetworkManager uses plugins for reading and writing
diff --git a/man/nm-settings-nmcli.5 b/man/nm-settings-nmcli.5
index c14b6a52..0fb4219b 100644
--- a/man/nm-settings-nmcli.5
+++ b/man/nm-settings-nmcli.5
@@ -2,12 +2,12 @@
 .\"     Title: nm-settings-nmcli
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
-.\"      Date: 03/09/2023
+.\"      Date: 04/20/2023
 .\"    Manual: Configuration
-.\"    Source: NetworkManager 1.42.4
+.\"    Source: NetworkManager 1.42.6
 .\"  Language: English
 .\"
-.TH "NM\-SETTINGS\-NMCLI" "5" "" "NetworkManager 1\&.42\&.4" "Configuration"
+.TH "NM\-SETTINGS\-NMCLI" "5" "" "NetworkManager 1\&.42\&.6" "Configuration"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -1894,7 +1894,7 @@ Array of DNS options as described in man 5 resolv\&.conf\&.
 .sp
 NULL means that the options are unset and left at the default\&. In this case NetworkManager will use default options\&. This is distinct from an empty list of properties\&.
 .sp
-The currently supported options are "attempts", "debug", "edns0", "inet6", "ip6\-bytestring", "ip6\-dotint", "ndots", "no\-check\-names", "no\-ip6\-dotint", "no\-reload", "no\-tld\-query", "rotate", "single\-request", "single\-request\-reopen", "timeout", "trust\-ad", "use\-vc"\&.
+The currently supported options are "attempts", "debug", "edns0", "inet6", "ip6\-bytestring", "ip6\-dotint", "ndots", "no\-aaaa", "no\-check\-names", "no\-ip6\-dotint", "no\-reload", "no\-tld\-query", "rotate", "single\-request", "single\-request\-reopen", "timeout", "trust\-ad", "use\-vc"\&.
 .sp
 The "trust\-ad" setting is only honored if the profile contributes name servers to resolv\&.conf, and if all contributing profiles have "trust\-ad" enabled\&.
 .sp
@@ -2441,7 +2441,7 @@ Array of DNS options as described in man 5 resolv\&.conf\&.
 .sp
 NULL means that the options are unset and left at the default\&. In this case NetworkManager will use default options\&. This is distinct from an empty list of properties\&.
 .sp
-The currently supported options are "attempts", "debug", "edns0", "inet6", "ip6\-bytestring", "ip6\-dotint", "ndots", "no\-check\-names", "no\-ip6\-dotint", "no\-reload", "no\-tld\-query", "rotate", "single\-request", "single\-request\-reopen", "timeout", "trust\-ad", "use\-vc"\&.
+The currently supported options are "attempts", "debug", "edns0", "inet6", "ip6\-bytestring", "ip6\-dotint", "ndots", "no\-aaaa", "no\-check\-names", "no\-ip6\-dotint", "no\-reload", "no\-tld\-query", "rotate", "single\-request", "single\-request\-reopen", "timeout", "trust\-ad", "use\-vc"\&.
 .sp
 The "trust\-ad" setting is only honored if the profile contributes name servers to resolv\&.conf, and if all contributing profiles have "trust\-ad" enabled\&.
 .sp
@@ -2879,7 +2879,7 @@ Properties:
 .PP
 \fBencapsulation\-limit\fR
 .RS 4
-How many additional levels of encapsulation are permitted to be prepended to packets\&. This property applies only to IPv6 tunnels\&.
+How many additional levels of encapsulation are permitted to be prepended to packets\&. This property applies only to IPv6 tunnels\&. To disable this option, add NM_IP_TUNNEL_FLAG_IP6_IGN_ENCAP_LIMIT (0x1) to ip\-tunnel flags\&.
 .sp
 Format: uint32
 .RE
diff --git a/man/nm-settings-nmcli.xml b/man/nm-settings-nmcli.xml
index 6154468e..3ecb4103 100644
--- a/man/nm-settings-nmcli.xml
+++ b/man/nm-settings-nmcli.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0"?>
 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.3//EN" "http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd">
-<refentry id="nm-settings-nmcli"><refentryinfo><title>nm-settings-nmcli</title><author>NetworkManager developers</author></refentryinfo><refmeta><refentrytitle>nm-settings-nmcli</refentrytitle><manvolnum>5</manvolnum><refmiscinfo class="source">NetworkManager</refmiscinfo><refmiscinfo class="manual">Configuration</refmiscinfo><refmiscinfo class="version">1.42.4</refmiscinfo></refmeta><refnamediv><refname>nm-settings-nmcli</refname><refpurpose>Description of settings and properties of NetworkManager connection profiles for nmcli</refpurpose></refnamediv><refsect1 id="description"><title>Description</title><para>
+<refentry id="nm-settings-nmcli"><refentryinfo><title>nm-settings-nmcli</title><author>NetworkManager developers</author></refentryinfo><refmeta><refentrytitle>nm-settings-nmcli</refentrytitle><manvolnum>5</manvolnum><refmiscinfo class="source">NetworkManager</refmiscinfo><refmiscinfo class="manual">Configuration</refmiscinfo><refmiscinfo class="version">1.42.6</refmiscinfo></refmeta><refnamediv><refname>nm-settings-nmcli</refname><refpurpose>Description of settings and properties of NetworkManager connection profiles for nmcli</refpurpose></refnamediv><refsect1 id="description"><title>Description</title><para>
           NetworkManager is based on a concept of connection profiles, sometimes referred to as
           connections only. These connection profiles contain a network configuration. When
           NetworkManager activates a connection profile on a network device the configuration will
@@ -272,7 +272,7 @@
             Format: boolean</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.ipv4.dhcp-timeout">dhcp-timeout</option></term><listitem><para>A timeout for a DHCP transaction in seconds. If zero (the default), a globally configured default is used. If still unspecified, a device specific timeout is used (usually 45 seconds).</para><para>Set to 2147483647 (MAXINT32) for infinity.</para><para>
             Format: int32</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.ipv4.dhcp-vendor-class-identifier">dhcp-vendor-class-identifier</option></term><listitem><para>The Vendor Class Identifier DHCP option (60). Special characters in the data string may be escaped using C-style escapes, nevertheless this property cannot contain nul bytes. If the per-profile value is unspecified (the default), a global connection default gets consulted. If still unspecified, the DHCP option is not sent to the server.</para><para>
             Format: string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.ipv4.dns">dns</option></term><listitem><para>Array of IP addresses of DNS servers.</para><para>For DoT (DNS over TLS), the SNI server name can be specified by appending "#example.com" to the IP address of the DNS server. This currently only has effect when using systemd-resolved.</para><para>
-            Format: array of uint32</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.ipv4.dns-options">dns-options</option></term><listitem><para>Array of DNS options as described in man 5 resolv.conf.</para><para>NULL means that the options are unset and left at the default. In this case NetworkManager will use default options. This is distinct from an empty list of properties.</para><para>The currently supported options are "attempts", "debug", "edns0", "inet6", "ip6-bytestring", "ip6-dotint", "ndots", "no-check-names", "no-ip6-dotint", "no-reload", "no-tld-query", "rotate", "single-request", "single-request-reopen", "timeout", "trust-ad", "use-vc".</para><para>The "trust-ad" setting is only honored if the profile contributes name servers to resolv.conf, and if all contributing profiles have "trust-ad" enabled.</para><para>When using a caching DNS plugin (dnsmasq or systemd-resolved in NetworkManager.conf) then "edns0" and "trust-ad" are automatically added.</para><para>
+            Format: array of uint32</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.ipv4.dns-options">dns-options</option></term><listitem><para>Array of DNS options as described in man 5 resolv.conf.</para><para>NULL means that the options are unset and left at the default. In this case NetworkManager will use default options. This is distinct from an empty list of properties.</para><para>The currently supported options are "attempts", "debug", "edns0", "inet6", "ip6-bytestring", "ip6-dotint", "ndots", "no-aaaa", "no-check-names", "no-ip6-dotint", "no-reload", "no-tld-query", "rotate", "single-request", "single-request-reopen", "timeout", "trust-ad", "use-vc".</para><para>The "trust-ad" setting is only honored if the profile contributes name servers to resolv.conf, and if all contributing profiles have "trust-ad" enabled.</para><para>When using a caching DNS plugin (dnsmasq or systemd-resolved in NetworkManager.conf) then "edns0" and "trust-ad" are automatically added.</para><para>
             Format: array of string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.ipv4.dns-priority">dns-priority</option></term><listitem><para>DNS servers priority.</para><para>The relative priority for DNS servers specified by this setting.  A lower numerical value is better (higher priority).</para><para>Negative values have the special effect of excluding other configurations with a greater numerical priority value; so in presence of at least one negative priority, only DNS servers from connections with the lowest priority value will be used. To avoid all DNS leaks, set the priority of the profile that should be used to the most negative value of all active connections profiles.</para><para>Zero selects a globally configured default value. If the latter is missing or zero too, it defaults to 50 for VPNs (including WireGuard) and 100 for other connections.</para><para>Note that the priority is to order DNS settings for multiple active connections.  It does not disambiguate multiple DNS servers within the same connection profile.</para><para>When multiple devices have configurations with the same priority, VPNs will be considered first, then devices with the best (lowest metric) default route and then all other devices.</para><para>When using dns=default, servers with higher priority will be on top of resolv.conf. To prioritize a given server over another one within the same connection, just specify them in the desired order. Note that commonly the resolver tries name servers in /etc/resolv.conf in the order listed, proceeding with the next server in the list on failure. See for example the "rotate" option of the dns-options setting. If there are any negative DNS priorities, then only name servers from the devices with that lowest priority will be considered.</para><para>When using a DNS resolver that supports Conditional Forwarding or Split DNS (with dns=dnsmasq or dns=systemd-resolved settings), each connection is used to query domains in its search list. The search domains determine which name servers to ask, and the DNS priority is used to prioritize name servers based on the domain.  Queries for domains not present in any search list are routed through connections having the '~.' special wildcard domain, which is added automatically to connections with the default route (or can be added manually).  When multiple connections specify the same domain, the one with the best priority (lowest numerical value) wins.  If a sub domain is configured on another interface it will be accepted regardless the priority, unless parent domain on the other interface has a negative priority, which causes the sub domain to be shadowed. With Split DNS one can avoid undesired DNS leaks by properly configuring DNS priorities and the search domains, so that only name servers of the desired interface are configured.</para><para>
             Format: int32</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.ipv4.dns-search">dns-search</option></term><listitem><para>List of DNS search domains. Domains starting with a tilde ('~') are considered 'routing' domains and are used only to decide the interface over which a query must be forwarded; they are not used to complete unqualified host names.</para><para>When using a DNS plugin that supports Conditional Forwarding or Split DNS, then the search domains specify which name servers to query. This makes the behavior different from running with plain /etc/resolv.conf. For more information see also the dns-priority setting.</para><para>When set on a profile that also enabled DHCP, the DNS search list received automatically (option 119 for DHCPv4 and option 24 for DHCPv6) gets merged with the manual list. This can be prevented by setting "ignore-auto-dns". Note that if no DNS searches are configured, the fallback will be derived from the domain from DHCP (option 15).</para><para>
             Format: array of string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.ipv4.gateway">gateway</option></term><listitem><para>
@@ -398,7 +398,7 @@ Example: <literal>priority 5 from 192.167.4.0/24 table 45</literal>
             Format: string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.ipv6.dhcp-send-hostname">dhcp-send-hostname</option></term><listitem><para>If TRUE, a hostname is sent to the DHCP server when acquiring a lease. Some DHCP servers use this hostname to update DNS databases, essentially providing a static hostname for the computer.  If the "dhcp-hostname" property is NULL and this property is TRUE, the current persistent hostname of the computer is sent.</para><para>
             Format: boolean</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.ipv6.dhcp-timeout">dhcp-timeout</option></term><listitem><para>A timeout for a DHCP transaction in seconds. If zero (the default), a globally configured default is used. If still unspecified, a device specific timeout is used (usually 45 seconds).</para><para>Set to 2147483647 (MAXINT32) for infinity.</para><para>
             Format: int32</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.ipv6.dns">dns</option></term><listitem><para>Array of IP addresses of DNS servers.</para><para>For DoT (DNS over TLS), the SNI server name can be specified by appending "#example.com" to the IP address of the DNS server. This currently only has effect when using systemd-resolved.</para><para>
-            Format: array of byte array</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.ipv6.dns-options">dns-options</option></term><listitem><para>Array of DNS options as described in man 5 resolv.conf.</para><para>NULL means that the options are unset and left at the default. In this case NetworkManager will use default options. This is distinct from an empty list of properties.</para><para>The currently supported options are "attempts", "debug", "edns0", "inet6", "ip6-bytestring", "ip6-dotint", "ndots", "no-check-names", "no-ip6-dotint", "no-reload", "no-tld-query", "rotate", "single-request", "single-request-reopen", "timeout", "trust-ad", "use-vc".</para><para>The "trust-ad" setting is only honored if the profile contributes name servers to resolv.conf, and if all contributing profiles have "trust-ad" enabled.</para><para>When using a caching DNS plugin (dnsmasq or systemd-resolved in NetworkManager.conf) then "edns0" and "trust-ad" are automatically added.</para><para>
+            Format: array of byte array</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.ipv6.dns-options">dns-options</option></term><listitem><para>Array of DNS options as described in man 5 resolv.conf.</para><para>NULL means that the options are unset and left at the default. In this case NetworkManager will use default options. This is distinct from an empty list of properties.</para><para>The currently supported options are "attempts", "debug", "edns0", "inet6", "ip6-bytestring", "ip6-dotint", "ndots", "no-aaaa", "no-check-names", "no-ip6-dotint", "no-reload", "no-tld-query", "rotate", "single-request", "single-request-reopen", "timeout", "trust-ad", "use-vc".</para><para>The "trust-ad" setting is only honored if the profile contributes name servers to resolv.conf, and if all contributing profiles have "trust-ad" enabled.</para><para>When using a caching DNS plugin (dnsmasq or systemd-resolved in NetworkManager.conf) then "edns0" and "trust-ad" are automatically added.</para><para>
             Format: array of string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.ipv6.dns-priority">dns-priority</option></term><listitem><para>DNS servers priority.</para><para>The relative priority for DNS servers specified by this setting.  A lower numerical value is better (higher priority).</para><para>Negative values have the special effect of excluding other configurations with a greater numerical priority value; so in presence of at least one negative priority, only DNS servers from connections with the lowest priority value will be used. To avoid all DNS leaks, set the priority of the profile that should be used to the most negative value of all active connections profiles.</para><para>Zero selects a globally configured default value. If the latter is missing or zero too, it defaults to 50 for VPNs (including WireGuard) and 100 for other connections.</para><para>Note that the priority is to order DNS settings for multiple active connections.  It does not disambiguate multiple DNS servers within the same connection profile.</para><para>When multiple devices have configurations with the same priority, VPNs will be considered first, then devices with the best (lowest metric) default route and then all other devices.</para><para>When using dns=default, servers with higher priority will be on top of resolv.conf. To prioritize a given server over another one within the same connection, just specify them in the desired order. Note that commonly the resolver tries name servers in /etc/resolv.conf in the order listed, proceeding with the next server in the list on failure. See for example the "rotate" option of the dns-options setting. If there are any negative DNS priorities, then only name servers from the devices with that lowest priority will be considered.</para><para>When using a DNS resolver that supports Conditional Forwarding or Split DNS (with dns=dnsmasq or dns=systemd-resolved settings), each connection is used to query domains in its search list. The search domains determine which name servers to ask, and the DNS priority is used to prioritize name servers based on the domain.  Queries for domains not present in any search list are routed through connections having the '~.' special wildcard domain, which is added automatically to connections with the default route (or can be added manually).  When multiple connections specify the same domain, the one with the best priority (lowest numerical value) wins.  If a sub domain is configured on another interface it will be accepted regardless the priority, unless parent domain on the other interface has a negative priority, which causes the sub domain to be shadowed. With Split DNS one can avoid undesired DNS leaks by properly configuring DNS priorities and the search domains, so that only name servers of the desired interface are configured.</para><para>
             Format: int32</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.ipv6.dns-search">dns-search</option></term><listitem><para>List of DNS search domains. Domains starting with a tilde ('~') are considered 'routing' domains and are used only to decide the interface over which a query must be forwarded; they are not used to complete unqualified host names.</para><para>When using a DNS plugin that supports Conditional Forwarding or Split DNS, then the search domains specify which name servers to query. This makes the behavior different from running with plain /etc/resolv.conf. For more information see also the dns-priority setting.</para><para>When set on a profile that also enabled DHCP, the DNS search list received automatically (option 119 for DHCPv4 and option 24 for DHCPv6) gets merged with the manual list. This can be prevented by setting "ignore-auto-dns". Note that if no DNS searches are configured, the fallback will be derived from the domain from DHCP (option 15).</para><para>
             Format: array of string</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.ipv6.gateway">gateway</option></term><listitem><para>
@@ -497,7 +497,7 @@ Example: <literal>priority 5 from 1:2:3::5/128 table 45</literal>
             Format: a comma separated list of routing rules</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.ipv6.token">token</option></term><listitem><para>Configure the token for draft-chown-6man-tokenised-ipv6-identifiers-02 IPv6 tokenized interface identifiers. Useful with eui64 addr-gen-mode.</para><para>
             Format: string</para></listitem></varlistentry></variablelist></para></refsect2><refsect2><title>ip-tunnel setting</title><para>IP Tunneling Settings.</para><para>
         Properties:
-        <variablelist><varlistentry><term><option id="nm-settings-nmcli.property.ip-tunnel.encapsulation-limit">encapsulation-limit</option></term><listitem><para>How many additional levels of encapsulation are permitted to be prepended to packets. This property applies only to IPv6 tunnels.</para><para>
+        <variablelist><varlistentry><term><option id="nm-settings-nmcli.property.ip-tunnel.encapsulation-limit">encapsulation-limit</option></term><listitem><para>How many additional levels of encapsulation are permitted to be prepended to packets. This property applies only to IPv6 tunnels. To disable this option, add NM_IP_TUNNEL_FLAG_IP6_IGN_ENCAP_LIMIT (0x1) to ip-tunnel flags.</para><para>
             Format: uint32</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.ip-tunnel.flags">flags</option></term><listitem><para>Tunnel flags. Currently, the following values are supported: NM_IP_TUNNEL_FLAG_IP6_IGN_ENCAP_LIMIT (0x1), NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_TCLASS (0x2), NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_FLOWLABEL (0x4), NM_IP_TUNNEL_FLAG_IP6_MIP6_DEV (0x8), NM_IP_TUNNEL_FLAG_IP6_RCV_DSCP_COPY (0x10), NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_FWMARK (0x20). They are valid only for IPv6 tunnels.</para><para>
             Format: uint32</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.ip-tunnel.flow-label">flow-label</option></term><listitem><para>The flow label to assign to tunnel packets. This property applies only to IPv6 tunnels.</para><para>
             Format: uint32</para></listitem></varlistentry><varlistentry><term><option id="nm-settings-nmcli.property.ip-tunnel.fwmark">fwmark</option></term><listitem><para>The fwmark value to assign to tunnel packets. This property can be set to a non zero value only on VTI and VTI6 tunnels.</para><para>
diff --git a/man/nmcli-examples.7 b/man/nmcli-examples.7
index 055716bd..df330439 100644
--- a/man/nmcli-examples.7
+++ b/man/nmcli-examples.7
@@ -2,12 +2,12 @@
 .\"     Title: nmcli-examples
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
-.\"      Date: 03/09/2023
+.\"      Date: 04/20/2023
 .\"    Manual: Examples
-.\"    Source: NetworkManager 1.42.4
+.\"    Source: NetworkManager 1.42.6
 .\"  Language: English
 .\"
-.TH "NMCLI\-EXAMPLES" "7" "" "NetworkManager 1\&.42\&.4" "Examples"
+.TH "NMCLI\-EXAMPLES" "7" "" "NetworkManager 1\&.42\&.6" "Examples"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
diff --git a/man/nmcli.1 b/man/nmcli.1
index 374593ce..ec25c6fd 100644
--- a/man/nmcli.1
+++ b/man/nmcli.1
@@ -2,12 +2,12 @@
 .\"     Title: nmcli
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
-.\"      Date: 03/09/2023
+.\"      Date: 04/20/2023
 .\"    Manual: General Commands Manual
-.\"    Source: NetworkManager 1.42.4
+.\"    Source: NetworkManager 1.42.6
 .\"  Language: English
 .\"
-.TH "NMCLI" "1" "" "NetworkManager 1\&.42\&.4" "General Commands Manual"
+.TH "NMCLI" "1" "" "NetworkManager 1\&.42\&.6" "General Commands Manual"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
diff --git a/man/nmtui.1 b/man/nmtui.1
index ebf235f6..6b151419 100644
--- a/man/nmtui.1
+++ b/man/nmtui.1
@@ -2,12 +2,12 @@
 .\"     Title: nmtui
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
-.\"      Date: 03/09/2023
+.\"      Date: 04/20/2023
 .\"    Manual: General Commands Manual
-.\"    Source: NetworkManager 1.42.4
+.\"    Source: NetworkManager 1.42.6
 .\"  Language: English
 .\"
-.TH "NMTUI" "1" "" "NetworkManager 1\&.42\&.4" "General Commands Manual"
+.TH "NMTUI" "1" "" "NetworkManager 1\&.42\&.6" "General Commands Manual"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
diff --git a/meson.build b/meson.build
index 4651739a..f494bf33 100644
--- a/meson.build
+++ b/meson.build
@@ -6,7 +6,7 @@ project(
 #  - add corresponding NM_VERSION_x_y_z macros in
 #    "src/libnm-core-public/nm-version-macros.h.in"
 #  - update number in configure.ac
-  version: '1.42.4',
+  version: '1.42.6',
   license: 'GPL2+',
   default_options: [
     'buildtype=debugoptimized',
diff --git a/po/NetworkManager.pot b/po/NetworkManager.pot
index f9ac8f02..238b8ab8 100644
--- a/po/NetworkManager.pot
+++ b/po/NetworkManager.pot
@@ -6,10 +6,10 @@
 #, fuzzy
 msgid ""
 msgstr ""
-"Project-Id-Version: NetworkManager 1.42.4\n"
+"Project-Id-Version: NetworkManager 1.42.6\n"
 "Report-Msgid-Bugs-To: https://gitlab.freedesktop.org/NetworkManager/"
 "NetworkManager/issues\n"
-"POT-Creation-Date: 2023-03-09 09:02+0100\n"
+"POT-Creation-Date: 2023-04-20 08:45+0200\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -305,7 +305,7 @@ msgstr ""
 msgid "Team connection"
 msgstr ""
 
-#: src/core/devices/wifi/nm-device-olpc-mesh.c:112 src/nmcli/devices.c:1395
+#: src/core/devices/wifi/nm-device-olpc-mesh.c:112 src/nmcli/devices.c:1396
 msgid "Mesh"
 msgstr ""
 
@@ -598,7 +598,7 @@ msgstr ""
 msgid "Show NetworkManager options"
 msgstr ""
 
-#: src/core/nm-manager.c:6193 src/libnmc-setting/nm-meta-setting-desc.c:8448
+#: src/core/nm-manager.c:6185 src/libnmc-setting/nm-meta-setting-desc.c:8448
 msgid "VPN connection"
 msgstr ""
 
@@ -1181,7 +1181,7 @@ msgstr ""
 #: src/libnm-core-impl/nm-setting-connection.c:1149
 #: src/libnm-core-impl/nm-setting-connection.c:1187
 #: src/libnm-core-impl/nm-setting-connection.c:1516
-#: src/libnm-core-impl/nm-setting-ip-config.c:5499
+#: src/libnm-core-impl/nm-setting-ip-config.c:5500
 #: src/libnm-core-impl/nm-setting-ip-tunnel.c:407
 #: src/libnm-core-impl/nm-setting-olpc-mesh.c:99
 #: src/libnm-core-impl/nm-setting-ovs-patch.c:75
@@ -1522,7 +1522,7 @@ msgstr ""
 #: src/libnm-core-impl/nm-setting-gsm.c:353
 #: src/libnm-core-impl/nm-setting-gsm.c:396
 #: src/libnm-core-impl/nm-setting-gsm.c:405
-#: src/libnm-core-impl/nm-setting-ip-config.c:5508
+#: src/libnm-core-impl/nm-setting-ip-config.c:5509
 #: src/libnm-core-impl/nm-setting-ip4-config.c:286
 #: src/libnm-core-impl/nm-setting-ip4-config.c:298
 #: src/libnm-core-impl/nm-setting-pppoe.c:151
@@ -1976,320 +1976,320 @@ msgstr ""
 msgid "mtu can be at most %u but it is %u"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:80
+#: src/libnm-core-impl/nm-setting-ip-config.c:81
 msgid "Missing IPv4 address"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:80
+#: src/libnm-core-impl/nm-setting-ip-config.c:81
 msgid "Missing IPv6 address"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:87
+#: src/libnm-core-impl/nm-setting-ip-config.c:88
 #, c-format
 msgid "Invalid IPv4 address '%s'"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:88
+#: src/libnm-core-impl/nm-setting-ip-config.c:89
 #, c-format
 msgid "Invalid IPv6 address '%s'"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:105
+#: src/libnm-core-impl/nm-setting-ip-config.c:106
 #, c-format
 msgid "Invalid IPv4 address prefix '%u'"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:106
+#: src/libnm-core-impl/nm-setting-ip-config.c:107
 #, c-format
 msgid "Invalid IPv6 address prefix '%u'"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:123
+#: src/libnm-core-impl/nm-setting-ip-config.c:124
 #, c-format
 msgid "Invalid routing metric '%s'"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:1336
+#: src/libnm-core-impl/nm-setting-ip-config.c:1337
 #: src/libnm-core-impl/nm-setting-sriov.c:400
 msgid "unknown attribute"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:1346
+#: src/libnm-core-impl/nm-setting-ip-config.c:1347
 #: src/libnm-core-impl/nm-setting-sriov.c:410
 #, c-format
 msgid "invalid attribute type '%s'"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:1355
+#: src/libnm-core-impl/nm-setting-ip-config.c:1356
 msgid "attribute is not valid for a IPv4 route"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:1356
+#: src/libnm-core-impl/nm-setting-ip-config.c:1357
 msgid "attribute is not valid for a IPv6 route"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:1367
-#: src/libnm-core-impl/nm-setting-ip-config.c:1399
+#: src/libnm-core-impl/nm-setting-ip-config.c:1368
+#: src/libnm-core-impl/nm-setting-ip-config.c:1400
 #, c-format
 msgid "'%s' is not a valid IPv4 address"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:1368
-#: src/libnm-core-impl/nm-setting-ip-config.c:1400
+#: src/libnm-core-impl/nm-setting-ip-config.c:1369
+#: src/libnm-core-impl/nm-setting-ip-config.c:1401
 #, c-format
 msgid "'%s' is not a valid IPv6 address"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:1390
+#: src/libnm-core-impl/nm-setting-ip-config.c:1391
 #, c-format
 msgid "invalid prefix %s"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:1422
+#: src/libnm-core-impl/nm-setting-ip-config.c:1423
 #, c-format
 msgid "%s is not a valid route type"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:1441
+#: src/libnm-core-impl/nm-setting-ip-config.c:1442
 msgid "route weight cannot be larger than 256"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:1528
+#: src/libnm-core-impl/nm-setting-ip-config.c:1529
 msgid "route scope is invalid for local route"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:1540
+#: src/libnm-core-impl/nm-setting-ip-config.c:1541
 #, c-format
 msgid "a %s route cannot have a next-hop"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:1552
+#: src/libnm-core-impl/nm-setting-ip-config.c:1553
 #, c-format
 msgid "a %s route cannot have a ECMP multi-hop \"weight\""
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:2740
+#: src/libnm-core-impl/nm-setting-ip-config.c:2741
 msgid "missing priority"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:2753
+#: src/libnm-core-impl/nm-setting-ip-config.c:2754
 msgid "missing table"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:2763
+#: src/libnm-core-impl/nm-setting-ip-config.c:2764
 msgid "invalid action type"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:2772
+#: src/libnm-core-impl/nm-setting-ip-config.c:2773
 msgid "has from/src but the prefix-length is zero"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:2780
+#: src/libnm-core-impl/nm-setting-ip-config.c:2781
 msgid "missing from/src for a non zero prefix-length"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:2787
+#: src/libnm-core-impl/nm-setting-ip-config.c:2788
 msgid "invalid from/src"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:2794
+#: src/libnm-core-impl/nm-setting-ip-config.c:2795
 msgid "invalid prefix length for from/src"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:2803
+#: src/libnm-core-impl/nm-setting-ip-config.c:2804
 msgid "has to/dst but the prefix-length is zero"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:2811
+#: src/libnm-core-impl/nm-setting-ip-config.c:2812
 msgid "missing to/dst for a non zero prefix-length"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:2818
+#: src/libnm-core-impl/nm-setting-ip-config.c:2819
 msgid "invalid to/dst"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:2825
+#: src/libnm-core-impl/nm-setting-ip-config.c:2826
 msgid "invalid prefix length for to/dst"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:2835
+#: src/libnm-core-impl/nm-setting-ip-config.c:2836
 msgid "invalid iifname"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:2845
+#: src/libnm-core-impl/nm-setting-ip-config.c:2846
 msgid "invalid oifname"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:2853
+#: src/libnm-core-impl/nm-setting-ip-config.c:2854
 msgid "invalid source port range"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:2861
+#: src/libnm-core-impl/nm-setting-ip-config.c:2862
 msgid "invalid destination port range"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:2871
+#: src/libnm-core-impl/nm-setting-ip-config.c:2872
 msgid "suppress_prefixlength out of range"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:2879
+#: src/libnm-core-impl/nm-setting-ip-config.c:2880
 msgid "suppress_prefixlength is only allowed with the to-table action"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:3022
+#: src/libnm-core-impl/nm-setting-ip-config.c:3023
 #, c-format
 msgid "invalid key \"%s\""
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:3034
+#: src/libnm-core-impl/nm-setting-ip-config.c:3035
 #, c-format
 msgid "duplicate key %s"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:3050
+#: src/libnm-core-impl/nm-setting-ip-config.c:3051
 #, c-format
 msgid "invalid variant type '%s' for \"%s\""
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:3061
+#: src/libnm-core-impl/nm-setting-ip-config.c:3062
 msgid "missing \"family\""
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:3069
+#: src/libnm-core-impl/nm-setting-ip-config.c:3070
 msgid "invalid \"family\""
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:3126
+#: src/libnm-core-impl/nm-setting-ip-config.c:3127
 msgid "\"uid-range-start\" is greater than \"uid-range-end\""
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:3320
+#: src/libnm-core-impl/nm-setting-ip-config.c:3321
 msgid "Unsupported to-string-flags argument"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:3328
+#: src/libnm-core-impl/nm-setting-ip-config.c:3329
 msgid "Unsupported extra-argument"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:3630
+#: src/libnm-core-impl/nm-setting-ip-config.c:3631
 #, c-format
 msgid "unsupported key \"%s\""
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:3637
+#: src/libnm-core-impl/nm-setting-ip-config.c:3638
 #, c-format
 msgid "duplicate key \"%s\""
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:3644
+#: src/libnm-core-impl/nm-setting-ip-config.c:3645
 #, c-format
 msgid "invalid value for \"%s\""
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:3656
+#: src/libnm-core-impl/nm-setting-ip-config.c:3657
 msgid "empty text does not describe a rule"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:3664
+#: src/libnm-core-impl/nm-setting-ip-config.c:3665
 #, c-format
 msgid "missing argument for \"%s\""
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:3678
+#: src/libnm-core-impl/nm-setting-ip-config.c:3679
 msgid "invalid \"from\" part"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:3694
+#: src/libnm-core-impl/nm-setting-ip-config.c:3695
 msgid "invalid \"to\" part"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:3705
+#: src/libnm-core-impl/nm-setting-ip-config.c:3706
 msgid "cannot detect address family for rule"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:3772
-#: src/libnm-core-impl/nm-setting-ip-config.c:3862
+#: src/libnm-core-impl/nm-setting-ip-config.c:3773
+#: src/libnm-core-impl/nm-setting-ip-config.c:3863
 #, c-format
 msgid "rule is invalid: %s"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:3843
+#: src/libnm-core-impl/nm-setting-ip-config.c:3844
 msgid "invalid address family"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:5124
+#: src/libnm-core-impl/nm-setting-ip-config.c:5125
 #, c-format
 msgid "rule #%u is invalid: %s"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:5529
+#: src/libnm-core-impl/nm-setting-ip-config.c:5530
 #, c-format
 msgid "%u. DNS server address is invalid"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:5549
+#: src/libnm-core-impl/nm-setting-ip-config.c:5550
 #, c-format
 msgid "%d. IP address is invalid"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:5564
+#: src/libnm-core-impl/nm-setting-ip-config.c:5565
 #, c-format
 msgid "%d. IP address has 'label' property with invalid type"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:5576
+#: src/libnm-core-impl/nm-setting-ip-config.c:5577
 #, c-format
 msgid "%d. IP address has invalid label '%s'"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:5594
+#: src/libnm-core-impl/nm-setting-ip-config.c:5595
 msgid "gateway cannot be set if there are no addresses configured"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:5606
+#: src/libnm-core-impl/nm-setting-ip-config.c:5607
 msgid "gateway is invalid"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:5624
+#: src/libnm-core-impl/nm-setting-ip-config.c:5625
 #, c-format
 msgid "%d. route is invalid"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:5637
+#: src/libnm-core-impl/nm-setting-ip-config.c:5638
 #, c-format
 msgid "invalid attribute: %s"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:5657
+#: src/libnm-core-impl/nm-setting-ip-config.c:5658
 #, c-format
 msgid "%u. rule has wrong address-family"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:5669
+#: src/libnm-core-impl/nm-setting-ip-config.c:5670
 #, c-format
 msgid "%u. rule is invalid: %s"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:5685
+#: src/libnm-core-impl/nm-setting-ip-config.c:5686
 #, c-format
 msgid "'%s' is not a valid IAID"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:5699
+#: src/libnm-core-impl/nm-setting-ip-config.c:5700
 #, c-format
 msgid "the property cannot be set when '%s' is disabled"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:5725
+#: src/libnm-core-impl/nm-setting-ip-config.c:5726
 msgid "the property is currently supported only for DHCPv4"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:5742
+#: src/libnm-core-impl/nm-setting-ip-config.c:5743
 #, c-format
 msgid "'%s' is not a valid IP or subnet"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-config.c:5758
+#: src/libnm-core-impl/nm-setting-ip-config.c:5759
 #, c-format
 msgid "a gateway is incompatible with '%s'"
 msgstr ""
@@ -2319,16 +2319,16 @@ msgstr ""
 msgid "a fixed TTL is allowed only when path MTU discovery is enabled"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-tunnel.c:500
+#: src/libnm-core-impl/nm-setting-ip-tunnel.c:504
 #, c-format
 msgid "some flags are invalid for the select mode: %s"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-tunnel.c:513
+#: src/libnm-core-impl/nm-setting-ip-tunnel.c:517
 msgid "can be set only on VTI tunnels"
 msgstr ""
 
-#: src/libnm-core-impl/nm-setting-ip-tunnel.c:525
+#: src/libnm-core-impl/nm-setting-ip-tunnel.c:529
 #, c-format
 msgid "wired setting not allowed for mode %s"
 msgstr ""
@@ -3837,7 +3837,7 @@ msgstr ""
 #: src/libnmc-setting/nm-meta-setting-desc.c:2891
 #: src/libnmc-setting/nm-meta-setting-desc.c:2949 src/nmcli/common.c:1654
 #: src/nmcli/connections.c:79 src/nmcli/connections.c:89
-#: src/nmcli/devices.c:484 src/nmcli/devices.c:591 src/nmcli/devices.c:597
+#: src/nmcli/devices.c:485 src/nmcli/devices.c:592 src/nmcli/devices.c:598
 #: src/nmcli/general.c:30 src/nmcli/general.c:85 src/nmcli/general.c:91
 msgid "unknown"
 msgstr ""
@@ -3908,7 +3908,7 @@ msgstr ""
 #: src/libnmc-setting/nm-meta-setting-desc.c:881
 #: src/libnmc-setting/nm-meta-setting-desc.c:2883 src/nmcli/connections.c:5537
 #: src/nmcli/connections.c:7515 src/nmcli/connections.c:7516
-#: src/nmcli/devices.c:590 src/nmcli/devices.c:596 src/nmcli/devices.c:1406
+#: src/nmcli/devices.c:591 src/nmcli/devices.c:597 src/nmcli/devices.c:1407
 #: src/nmcli/general.c:92 src/nmcli/utils.h:313
 msgid "yes"
 msgstr ""
@@ -3917,7 +3917,7 @@ msgstr ""
 #: src/libnmc-setting/nm-meta-setting-desc.c:881
 #: src/libnmc-setting/nm-meta-setting-desc.c:2886 src/nmcli/connections.c:5536
 #: src/nmcli/connections.c:7515 src/nmcli/connections.c:7516
-#: src/nmcli/devices.c:590 src/nmcli/devices.c:596 src/nmcli/devices.c:1406
+#: src/nmcli/devices.c:591 src/nmcli/devices.c:597 src/nmcli/devices.c:1407
 #: src/nmcli/general.c:93 src/nmcli/utils.h:313
 msgid "no"
 msgstr ""
@@ -6961,14 +6961,14 @@ msgid ""
 "options are unset and left at the default. In this case NetworkManager will "
 "use default options. This is distinct from an empty list of properties. The "
 "currently supported options are \"attempts\", \"debug\", \"edns0\", "
-"\"inet6\", \"ip6-bytestring\", \"ip6-dotint\", \"ndots\", \"no-check-"
-"names\", \"no-ip6-dotint\", \"no-reload\", \"no-tld-query\", \"rotate\", "
-"\"single-request\", \"single-request-reopen\", \"timeout\", \"trust-ad\", "
-"\"use-vc\". The \"trust-ad\" setting is only honored if the profile "
-"contributes name servers to resolv.conf, and if all contributing profiles "
-"have \"trust-ad\" enabled. When using a caching DNS plugin (dnsmasq or "
-"systemd-resolved in NetworkManager.conf) then \"edns0\" and \"trust-ad\" are "
-"automatically added."
+"\"inet6\", \"ip6-bytestring\", \"ip6-dotint\", \"ndots\", \"no-aaaa\", \"no-"
+"check-names\", \"no-ip6-dotint\", \"no-reload\", \"no-tld-query\", "
+"\"rotate\", \"single-request\", \"single-request-reopen\", \"timeout\", "
+"\"trust-ad\", \"use-vc\". The \"trust-ad\" setting is only honored if the "
+"profile contributes name servers to resolv.conf, and if all contributing "
+"profiles have \"trust-ad\" enabled. When using a caching DNS plugin (dnsmasq "
+"or systemd-resolved in NetworkManager.conf) then \"edns0\" and \"trust-ad\" "
+"are automatically added."
 msgstr ""
 
 #: src/libnmc-setting/settings-docs.h.in:173
@@ -7285,7 +7285,8 @@ msgstr ""
 #: src/libnmc-setting/settings-docs.h.in:219
 msgid ""
 "How many additional levels of encapsulation are permitted to be prepended to "
-"packets. This property applies only to IPv6 tunnels."
+"packets. This property applies only to IPv6 tunnels. To disable this option, "
+"add NM_IP_TUNNEL_FLAG_IP6_IGN_ENCAP_LIMIT (0x1) to ip-tunnel flags."
 msgstr ""
 
 #: src/libnmc-setting/settings-docs.h.in:220
@@ -9528,9 +9529,9 @@ msgstr ""
 msgid "Active connection details"
 msgstr ""
 
-#: src/nmcli/connections.c:1798 src/nmcli/devices.c:1662
-#: src/nmcli/devices.c:1679 src/nmcli/devices.c:1697 src/nmcli/devices.c:1716
-#: src/nmcli/devices.c:1780 src/nmcli/devices.c:1909
+#: src/nmcli/connections.c:1798 src/nmcli/devices.c:1663
+#: src/nmcli/devices.c:1680 src/nmcli/devices.c:1698 src/nmcli/devices.c:1717
+#: src/nmcli/devices.c:1781 src/nmcli/devices.c:1910
 msgid "NAME"
 msgstr ""
 
@@ -9583,12 +9584,12 @@ msgstr ""
 #: src/nmcli/connections.c:2435 src/nmcli/connections.c:3156
 #: src/nmcli/connections.c:3168 src/nmcli/connections.c:3180
 #: src/nmcli/connections.c:3416 src/nmcli/connections.c:9662
-#: src/nmcli/connections.c:9681 src/nmcli/devices.c:3372
-#: src/nmcli/devices.c:3385 src/nmcli/devices.c:3397 src/nmcli/devices.c:3701
-#: src/nmcli/devices.c:3712 src/nmcli/devices.c:3731 src/nmcli/devices.c:3740
-#: src/nmcli/devices.c:3762 src/nmcli/devices.c:3773 src/nmcli/devices.c:3794
-#: src/nmcli/devices.c:4359 src/nmcli/devices.c:4370 src/nmcli/devices.c:4379
-#: src/nmcli/devices.c:4393 src/nmcli/devices.c:4411 src/nmcli/devices.c:4420
+#: src/nmcli/connections.c:9681 src/nmcli/devices.c:3373
+#: src/nmcli/devices.c:3386 src/nmcli/devices.c:3398 src/nmcli/devices.c:3702
+#: src/nmcli/devices.c:3713 src/nmcli/devices.c:3732 src/nmcli/devices.c:3741
+#: src/nmcli/devices.c:3763 src/nmcli/devices.c:3774 src/nmcli/devices.c:3795
+#: src/nmcli/devices.c:4366 src/nmcli/devices.c:4377 src/nmcli/devices.c:4386
+#: src/nmcli/devices.c:4400 src/nmcli/devices.c:4418 src/nmcli/devices.c:4427
 #: src/nmcli/devices.c:4576 src/nmcli/devices.c:4587 src/nmcli/devices.c:4806
 #: src/nmcli/devices.c:4985 src/nmcli/devices.c:5206
 #, c-format
@@ -9603,8 +9604,8 @@ msgstr ""
 #: src/nmcli/connections.c:2562 src/nmcli/connections.c:3142
 #: src/nmcli/connections.c:3216 src/nmcli/connections.c:9168
 #: src/nmcli/connections.c:9252 src/nmcli/connections.c:9786
-#: src/nmcli/devices.c:2009 src/nmcli/devices.c:2311 src/nmcli/devices.c:2478
-#: src/nmcli/devices.c:2604 src/nmcli/devices.c:2789 src/nmcli/devices.c:3572
+#: src/nmcli/devices.c:2010 src/nmcli/devices.c:2312 src/nmcli/devices.c:2479
+#: src/nmcli/devices.c:2605 src/nmcli/devices.c:2790 src/nmcli/devices.c:3573
 #: src/nmcli/devices.c:4540 src/nmcli/devices.c:4992 src/nmcli/general.c:1069
 #, c-format
 msgid "Error: %s."
@@ -9685,9 +9686,9 @@ msgid "invalid passwd-file '%s': %s"
 msgstr ""
 
 #: src/nmcli/connections.c:3190 src/nmcli/connections.c:9690
-#: src/nmcli/devices.c:1966 src/nmcli/devices.c:2015 src/nmcli/devices.c:2484
-#: src/nmcli/devices.c:2677 src/nmcli/devices.c:2744 src/nmcli/devices.c:2944
-#: src/nmcli/devices.c:3432 src/nmcli/devices.c:3810 src/nmcli/devices.c:4430
+#: src/nmcli/devices.c:1967 src/nmcli/devices.c:2016 src/nmcli/devices.c:2485
+#: src/nmcli/devices.c:2678 src/nmcli/devices.c:2745 src/nmcli/devices.c:2945
+#: src/nmcli/devices.c:3433 src/nmcli/devices.c:3811 src/nmcli/devices.c:4437
 #: src/nmcli/devices.c:4593 src/nmcli/devices.c:4814 src/nmcli/devices.c:4997
 #, c-format
 msgid "Error: invalid extra argument '%s'."
@@ -9817,7 +9818,7 @@ msgstr ""
 msgid "Error: invalid <setting>.<property> '%s'."
 msgstr ""
 
-#: src/nmcli/connections.c:5433 src/nmcli/devices.c:2198
+#: src/nmcli/connections.c:5433 src/nmcli/devices.c:2199
 #, c-format
 msgid "Warning: %s.\n"
 msgstr ""
@@ -10635,33 +10636,33 @@ msgid "Error: cannot migrate unknown connection(s): %s."
 msgstr ""
 
 #. define some prompts
-#: src/nmcli/devices.c:28
+#: src/nmcli/devices.c:29
 msgid "Interface: "
 msgstr ""
 
-#: src/nmcli/devices.c:29
+#: src/nmcli/devices.c:30
 msgid "Interface(s): "
 msgstr ""
 
-#: src/nmcli/devices.c:71 src/nmcli/devices.c:1440
+#: src/nmcli/devices.c:72 src/nmcli/devices.c:1441
 msgid "(none)"
 msgstr ""
 
-#: src/nmcli/devices.c:373
+#: src/nmcli/devices.c:374
 #, c-format
 msgid "<invisible> | %s"
 msgstr ""
 
-#: src/nmcli/devices.c:374
+#: src/nmcli/devices.c:375
 msgid "<invisible>"
 msgstr ""
 
-#: src/nmcli/devices.c:481
+#: src/nmcli/devices.c:482
 #, c-format
 msgid "%u Mb/s"
 msgstr ""
 
-#: src/nmcli/devices.c:841
+#: src/nmcli/devices.c:842
 msgid ""
 "Usage: nmcli device { COMMAND | help }\n"
 "\n"
@@ -10704,7 +10705,7 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/nmcli/devices.c:869
+#: src/nmcli/devices.c:870
 msgid ""
 "Usage: nmcli device status { help }\n"
 "\n"
@@ -10721,7 +10722,7 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/nmcli/devices.c:884
+#: src/nmcli/devices.c:885
 msgid ""
 "Usage: nmcli device show { ARGUMENTS | help }\n"
 "\n"
@@ -10732,7 +10733,7 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/nmcli/devices.c:895
+#: src/nmcli/devices.c:896
 msgid ""
 "Usage: nmcli device connect { ARGUMENTS | help }\n"
 "\n"
@@ -10745,7 +10746,7 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/nmcli/devices.c:907
+#: src/nmcli/devices.c:908
 msgid ""
 "Usage: nmcli device reapply { ARGUMENTS | help }\n"
 "\n"
@@ -10756,7 +10757,7 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/nmcli/devices.c:919
+#: src/nmcli/devices.c:920
 msgid ""
 "Usage: nmcli device modify { ARGUMENTS | help }\n"
 "\n"
@@ -10777,7 +10778,7 @@ msgid ""
 "nmcli dev mod em1 -ipv6.addr \"abbe::cafe/56\"\n"
 msgstr ""
 
-#: src/nmcli/devices.c:939
+#: src/nmcli/devices.c:940
 msgid ""
 "Usage: nmcli device disconnect { ARGUMENTS | help }\n"
 "\n"
@@ -10789,7 +10790,7 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/nmcli/devices.c:951
+#: src/nmcli/devices.c:952
 msgid ""
 "Usage: nmcli device delete { ARGUMENTS | help }\n"
 "\n"
@@ -10802,7 +10803,7 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/nmcli/devices.c:964
+#: src/nmcli/devices.c:965
 msgid ""
 "Usage: nmcli device set { ARGUMENTS | help }\n"
 "\n"
@@ -10815,7 +10816,7 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/nmcli/devices.c:977
+#: src/nmcli/devices.c:978
 msgid ""
 "Usage: nmcli device monitor { ARGUMENTS | help }\n"
 "\n"
@@ -10827,7 +10828,7 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/nmcli/devices.c:990
+#: src/nmcli/devices.c:991
 msgid ""
 "Usage: nmcli device wifi { ARGUMENTS | help }\n"
 "\n"
@@ -10880,7 +10881,7 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/nmcli/devices.c:1038
+#: src/nmcli/devices.c:1039
 msgid ""
 "Usage: nmcli device lldp { ARGUMENTS | help }\n"
 "\n"
@@ -10892,7 +10893,7 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/nmcli/devices.c:1049
+#: src/nmcli/devices.c:1050
 msgid ""
 "Usage: nmcli device checkpoint { ARGUMENTS | help }\n"
 "\n"
@@ -10904,327 +10905,327 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/nmcli/devices.c:1151
+#: src/nmcli/devices.c:1152
 msgid "Error: No interface specified."
 msgstr ""
 
-#: src/nmcli/devices.c:1181
+#: src/nmcli/devices.c:1182
 #, c-format
 msgid "Warning: argument '%s' is duplicated.\n"
 msgstr ""
 
-#: src/nmcli/devices.c:1184
+#: src/nmcli/devices.c:1185
 #, c-format
 msgid "Error: Device '%s' not found.\n"
 msgstr ""
 
-#: src/nmcli/devices.c:1185 src/nmcli/devices.c:5230
+#: src/nmcli/devices.c:1186 src/nmcli/devices.c:5230
 msgid "Error: not all devices found."
 msgstr ""
 
-#: src/nmcli/devices.c:1214
+#: src/nmcli/devices.c:1215
 msgid "No interface specified"
 msgstr ""
 
-#: src/nmcli/devices.c:1235
+#: src/nmcli/devices.c:1236
 #, c-format
 msgid "Device '%s' not found"
 msgstr ""
 
-#: src/nmcli/devices.c:1347
+#: src/nmcli/devices.c:1348
 #, c-format
 msgid "%u MHz"
 msgstr ""
 
-#: src/nmcli/devices.c:1348
+#: src/nmcli/devices.c:1349
 #, c-format
 msgid "%u Mbit/s"
 msgstr ""
 
-#: src/nmcli/devices.c:1393
+#: src/nmcli/devices.c:1394
 msgid "Ad-Hoc"
 msgstr ""
 
-#: src/nmcli/devices.c:1394
+#: src/nmcli/devices.c:1395
 msgid "Infra"
 msgstr ""
 
-#: src/nmcli/devices.c:1396
+#: src/nmcli/devices.c:1397
 msgid "N/A"
 msgstr ""
 
-#: src/nmcli/devices.c:1588
+#: src/nmcli/devices.c:1589
 msgid "Device details"
 msgstr ""
 
-#: src/nmcli/devices.c:1605
+#: src/nmcli/devices.c:1606
 #, c-format
 msgid "Error: 'device show': %s"
 msgstr ""
 
-#: src/nmcli/devices.c:1983
+#: src/nmcli/devices.c:1984
 msgid "Status of devices"
 msgstr ""
 
-#: src/nmcli/devices.c:1987
+#: src/nmcli/devices.c:1988
 #, c-format
 msgid "Error: 'device status': %s"
 msgstr ""
 
-#: src/nmcli/devices.c:2050 src/nmcli/general.c:528
+#: src/nmcli/devices.c:2051 src/nmcli/general.c:528
 #, c-format
 msgid "Error: Timeout %d sec expired."
 msgstr ""
 
-#: src/nmcli/devices.c:2127
+#: src/nmcli/devices.c:2128
 #, c-format
 msgid "Device '%s' successfully activated with '%s'.\n"
 msgstr ""
 
-#: src/nmcli/devices.c:2133
+#: src/nmcli/devices.c:2134
 msgid ""
 "Hint: \"nmcli dev wifi show-password\" shows the Wi-Fi name and password.\n"
 msgstr ""
 
-#: src/nmcli/devices.c:2137
+#: src/nmcli/devices.c:2138
 #, c-format
 msgid "Error: Connection activation failed: %s."
 msgstr ""
 
-#: src/nmcli/devices.c:2179
+#: src/nmcli/devices.c:2180
 #, c-format
 msgid "Error: Failed to setup a Wi-Fi hotspot: %s"
 msgstr ""
 
-#: src/nmcli/devices.c:2183
+#: src/nmcli/devices.c:2184
 #, c-format
 msgid "Error: Failed to add/activate new connection: %s"
 msgstr ""
 
-#: src/nmcli/devices.c:2187
+#: src/nmcli/devices.c:2188
 #, c-format
 msgid "Error: Failed to activate connection: %s"
 msgstr ""
 
-#: src/nmcli/devices.c:2261
+#: src/nmcli/devices.c:2262
 #, c-format
 msgid "Error: Device activation failed: %s"
 msgstr ""
 
-#: src/nmcli/devices.c:2317
+#: src/nmcli/devices.c:2318
 #, c-format
 msgid "Error: extra argument not allowed: '%s'."
 msgstr ""
 
-#: src/nmcli/devices.c:2386 src/nmcli/devices.c:2399 src/nmcli/devices.c:2654
+#: src/nmcli/devices.c:2387 src/nmcli/devices.c:2400 src/nmcli/devices.c:2655
 #, c-format
 msgid "Device '%s' successfully disconnected.\n"
 msgstr ""
 
-#: src/nmcli/devices.c:2388 src/nmcli/devices.c:2725
+#: src/nmcli/devices.c:2389 src/nmcli/devices.c:2726
 #, c-format
 msgid "Device '%s' successfully removed.\n"
 msgstr ""
 
-#: src/nmcli/devices.c:2448 src/nmcli/devices.c:2530
+#: src/nmcli/devices.c:2449 src/nmcli/devices.c:2531
 #, c-format
 msgid "Error: Reapplying connection to device '%s' (%s) failed: %s"
 msgstr ""
 
-#: src/nmcli/devices.c:2458 src/nmcli/devices.c:2539
+#: src/nmcli/devices.c:2459 src/nmcli/devices.c:2540
 #, c-format
 msgid "Connection successfully reapplied to device '%s'.\n"
 msgstr ""
 
-#: src/nmcli/devices.c:2561
+#: src/nmcli/devices.c:2562
 #, c-format
 msgid "Error: Reading applied connection from device '%s' (%s) failed: %s"
 msgstr ""
 
-#: src/nmcli/devices.c:2638
+#: src/nmcli/devices.c:2639
 msgid "Error: not all devices disconnected."
 msgstr ""
 
-#: src/nmcli/devices.c:2639
+#: src/nmcli/devices.c:2640
 #, c-format
 msgid "Error: Device '%s' (%s) disconnecting failed: %s\n"
 msgstr ""
 
-#: src/nmcli/devices.c:2716
+#: src/nmcli/devices.c:2717
 msgid "Error: not all devices deleted."
 msgstr ""
 
-#: src/nmcli/devices.c:2717
+#: src/nmcli/devices.c:2718
 #, c-format
 msgid "Error: Device '%s' (%s) deletion failed: %s\n"
 msgstr ""
 
-#: src/nmcli/devices.c:2795
+#: src/nmcli/devices.c:2796
 msgid "Error: No property specified."
 msgstr ""
 
-#: src/nmcli/devices.c:2812 src/nmcli/devices.c:2831 src/nmcli/general.c:798
+#: src/nmcli/devices.c:2813 src/nmcli/devices.c:2832 src/nmcli/general.c:798
 #: src/nmcli/general.c:820
 #, c-format
 msgid "Error: '%s' argument is missing."
 msgstr ""
 
-#: src/nmcli/devices.c:2820
+#: src/nmcli/devices.c:2821
 #, c-format
 msgid "Error: 'managed': %s."
 msgstr ""
 
-#: src/nmcli/devices.c:2839
+#: src/nmcli/devices.c:2840
 #, c-format
 msgid "Error: 'autoconnect': %s."
 msgstr ""
 
-#: src/nmcli/devices.c:2846 src/nmcli/general.c:870
+#: src/nmcli/devices.c:2847 src/nmcli/general.c:870
 #, c-format
 msgid "Error: property '%s' is not known."
 msgstr ""
 
-#: src/nmcli/devices.c:2893
+#: src/nmcli/devices.c:2894
 #, c-format
 msgid "%s: using connection '%s'\n"
 msgstr ""
 
-#: src/nmcli/devices.c:2919
+#: src/nmcli/devices.c:2920
 #, c-format
 msgid "%s: device created\n"
 msgstr ""
 
-#: src/nmcli/devices.c:2926
+#: src/nmcli/devices.c:2927
 #, c-format
 msgid "%s: device removed\n"
 msgstr ""
 
-#: src/nmcli/devices.c:3106
+#: src/nmcli/devices.c:3107
 msgid "Wi-Fi scan list"
 msgstr ""
 
-#: src/nmcli/devices.c:3223 src/nmcli/devices.c:3504
+#: src/nmcli/devices.c:3224 src/nmcli/devices.c:3505
 #, c-format
 msgid "Error: Access point with bssid '%s' not found."
 msgstr ""
 
-#: src/nmcli/devices.c:3425
+#: src/nmcli/devices.c:3426
 #, c-format
 msgid "Error: 'device wifi': %s"
 msgstr ""
 
-#: src/nmcli/devices.c:3445
+#: src/nmcli/devices.c:3446
 #, c-format
 msgid "Error: invalid rescan argument: '%s' not among [auto, no, yes]"
 msgstr ""
 
-#: src/nmcli/devices.c:3484
+#: src/nmcli/devices.c:3485
 #, c-format
 msgid "Error: Device '%s' not found."
 msgstr ""
 
-#: src/nmcli/devices.c:3488
+#: src/nmcli/devices.c:3489
 #, c-format
 msgid ""
 "Error: Device '%s' was not recognized as a Wi-Fi device, check "
 "NetworkManager Wi-Fi plugin."
 msgstr ""
 
-#: src/nmcli/devices.c:3493 src/nmcli/devices.c:3845 src/nmcli/devices.c:4475
+#: src/nmcli/devices.c:3494 src/nmcli/devices.c:3846 src/nmcli/devices.c:4475
 #: src/nmcli/devices.c:4610 src/nmcli/devices.c:4745
 #, c-format
 msgid "Error: Device '%s' is not a Wi-Fi device."
 msgstr ""
 
-#: src/nmcli/devices.c:3673
+#: src/nmcli/devices.c:3674
 msgid "SSID or BSSID: "
 msgstr ""
 
-#: src/nmcli/devices.c:3678
+#: src/nmcli/devices.c:3679
 msgid "Error: SSID or BSSID are missing."
 msgstr ""
 
-#: src/nmcli/devices.c:3722
+#: src/nmcli/devices.c:3723
 #, c-format
 msgid "Error: bssid argument value '%s' is not a valid BSSID."
 msgstr ""
 
-#: src/nmcli/devices.c:3753
+#: src/nmcli/devices.c:3754
 #, c-format
 msgid ""
 "Error: wep-key-type argument value '%s' is invalid, use 'key' or 'phrase'."
 msgstr ""
 
-#: src/nmcli/devices.c:3781 src/nmcli/devices.c:3802
+#: src/nmcli/devices.c:3782 src/nmcli/devices.c:3803
 #, c-format
 msgid "Error: %s: %s."
 msgstr ""
 
-#: src/nmcli/devices.c:3824
+#: src/nmcli/devices.c:3825
 #, c-format
 msgid "Error: BSSID to connect to (%s) differs from bssid argument (%s)."
 msgstr ""
 
-#: src/nmcli/devices.c:3832
+#: src/nmcli/devices.c:3833
 #, c-format
 msgid "Error: Parameter '%s' is neither SSID nor BSSID."
 msgstr ""
 
-#: src/nmcli/devices.c:3848 src/nmcli/devices.c:4478 src/nmcli/devices.c:4613
+#: src/nmcli/devices.c:3849 src/nmcli/devices.c:4478 src/nmcli/devices.c:4613
 #: src/nmcli/devices.c:4845
 msgid "Error: No Wi-Fi device found."
 msgstr ""
 
-#: src/nmcli/devices.c:3870
+#: src/nmcli/devices.c:3871
 #, c-format
 msgid "Error: Failed to scan hidden SSID: %s."
 msgstr ""
 
-#: src/nmcli/devices.c:3902
+#: src/nmcli/devices.c:3903
 #, c-format
 msgid "Error: No network with SSID '%s' found."
 msgstr ""
 
-#: src/nmcli/devices.c:3906
+#: src/nmcli/devices.c:3907
 #, c-format
 msgid "Error: No access point with BSSID '%s' found."
 msgstr ""
 
-#: src/nmcli/devices.c:3935
+#: src/nmcli/devices.c:3936
 #, c-format
 msgid "Error: Connection '%s' exists but properties don't match."
 msgstr ""
 
-#: src/nmcli/devices.c:3985
+#: src/nmcli/devices.c:3986
 #, c-format
 msgid ""
 "Warning: '%s' should be SSID for hidden APs; but it looks like a BSSID.\n"
 msgstr ""
 
-#: src/nmcli/devices.c:4027
+#: src/nmcli/devices.c:4028
 msgid "Password: "
 msgstr ""
 
-#: src/nmcli/devices.c:4165
+#: src/nmcli/devices.c:4168
 #, c-format
 msgid "'%s' is not valid WPA PSK"
 msgstr ""
 
-#: src/nmcli/devices.c:4186
+#: src/nmcli/devices.c:4189
 #, c-format
 msgid "'%s' is not valid WEP key (it should be 5 or 13 ASCII chars)"
 msgstr ""
 
-#: src/nmcli/devices.c:4205
+#: src/nmcli/devices.c:4208
 #, c-format
 msgid "Hotspot password: %s\n"
 msgstr ""
 
-#: src/nmcli/devices.c:4384
+#: src/nmcli/devices.c:4391
 msgid "Error: ssid is too long."
 msgstr ""
 
-#: src/nmcli/devices.c:4402
+#: src/nmcli/devices.c:4409
 #, c-format
 msgid "Error: band argument value '%s' is invalid; use 'a' or 'bg'."
 msgstr ""
diff --git a/po/de.gmo b/po/de.gmo
index 2b3ece00..ba64ec9f 100644
--- a/po/de.gmo
+++ b/po/de.gmo
Binary files differdiff --git a/po/es.gmo b/po/es.gmo
index 710c7d4f..59d80075 100644
--- a/po/es.gmo
+++ b/po/es.gmo
Binary files differdiff --git a/po/fr.gmo b/po/fr.gmo
index 1669a62d..cee895ac 100644
--- a/po/fr.gmo
+++ b/po/fr.gmo
Binary files differdiff --git a/po/hr.gmo b/po/hr.gmo
index 3ae8350d..1626f185 100644
--- a/po/hr.gmo
+++ b/po/hr.gmo
Binary files differdiff --git a/po/id.gmo b/po/id.gmo
index 909364f9..c59a8d31 100644
--- a/po/id.gmo
+++ b/po/id.gmo
Binary files differdiff --git a/po/it.gmo b/po/it.gmo
index 1222f954..c95974cb 100644
--- a/po/it.gmo
+++ b/po/it.gmo
Binary files differdiff --git a/po/ja.gmo b/po/ja.gmo
index 8e02251d..fc582df6 100644
--- a/po/ja.gmo
+++ b/po/ja.gmo
Binary files differdiff --git a/po/ko.gmo b/po/ko.gmo
index 2c3ce6ae..14166869 100644
--- a/po/ko.gmo
+++ b/po/ko.gmo
Binary files differdiff --git a/po/pt_BR.gmo b/po/pt_BR.gmo
index 3ec2bf7f..15c87be6 100644
--- a/po/pt_BR.gmo
+++ b/po/pt_BR.gmo
Binary files differdiff --git a/po/ru.gmo b/po/ru.gmo
index d31ca0a1..50b92520 100644
--- a/po/ru.gmo
+++ b/po/ru.gmo
Binary files differdiff --git a/po/sv.gmo b/po/sv.gmo
index a2e431cb..9cc90d32 100644
--- a/po/sv.gmo
+++ b/po/sv.gmo
Binary files differdiff --git a/po/uk.gmo b/po/uk.gmo
index 03f02e65..9da2f2ad 100644
--- a/po/uk.gmo
+++ b/po/uk.gmo
Binary files differdiff --git a/po/zh_CN.gmo b/po/zh_CN.gmo
index b841c72b..ef4b7408 100644
--- a/po/zh_CN.gmo
+++ b/po/zh_CN.gmo
Binary files differdiff --git a/po/zh_TW.gmo b/po/zh_TW.gmo
index c0b4ecdf..7490e314 100644
--- a/po/zh_TW.gmo
+++ b/po/zh_TW.gmo
Binary files differdiff --git a/src/core/devices/nm-device.c b/src/core/devices/nm-device.c
index 3565c04d..d080b540 100644
--- a/src/core/devices/nm-device.c
+++ b/src/core/devices/nm-device.c
@@ -10339,14 +10339,14 @@ _dev_ipdhcpx_notify(NMDhcpClient *client, const NMDhcpClientNotifyData *notify_d
 
         if (notify_data->lease_update.accepted) {
             nm_manager_write_device_state(priv->manager, self, NULL);
+            nm_dispatcher_call_device(NM_DISPATCHER_ACTION_DHCP_CHANGE_X(IS_IPv4),
+                                      self,
+                                      NULL,
+                                      NULL,
+                                      NULL,
+                                      NULL);
             if (priv->ipdhcp_data_x[IS_IPv4].state != NM_DEVICE_IP_STATE_READY) {
                 _dev_ipdhcpx_set_state(self, addr_family, NM_DEVICE_IP_STATE_READY);
-                nm_dispatcher_call_device(NM_DISPATCHER_ACTION_DHCP_CHANGE_X(IS_IPv4),
-                                          self,
-                                          NULL,
-                                          NULL,
-                                          NULL,
-                                          NULL);
                 _dev_ip_state_check_async(self, addr_family);
             }
         }
@@ -14542,6 +14542,9 @@ _set_unmanaged_flags(NMDevice           *self,
 
     if (transition_state) {
         new_state = was_managed ? NM_DEVICE_STATE_UNMANAGED : NM_DEVICE_STATE_UNAVAILABLE;
+        if (new_state == NM_DEVICE_STATE_UNMANAGED) {
+            _cancel_activation(self);
+        }
         if (now)
             nm_device_state_changed(self, new_state, reason);
         else
diff --git a/src/core/devices/wifi/nm-device-wifi.c b/src/core/devices/wifi/nm-device-wifi.c
index 171743d0..03625f8d 100644
--- a/src/core/devices/wifi/nm-device-wifi.c
+++ b/src/core/devices/wifi/nm-device-wifi.c
@@ -2912,10 +2912,11 @@ supplicant_connection_timeout_cb(gpointer user_data)
 }
 
 static NMSupplicantConfig *
-build_supplicant_config(NMDeviceWifi *self,
-                        NMConnection *connection,
-                        guint32       fixed_freq,
-                        GError      **error)
+build_supplicant_config(NMDeviceWifi         *self,
+                        NMSettingsConnection *sett_conn,
+                        NMConnection         *connection,
+                        guint32               fixed_freq,
+                        GError              **error)
 {
     NMDeviceWifiPrivate          *priv   = NM_DEVICE_WIFI_GET_PRIVATE(self);
     NMSupplicantConfig           *config = NULL;
@@ -2944,7 +2945,10 @@ build_supplicant_config(NMDeviceWifi *self,
         goto error;
     }
 
-    if (!nm_supplicant_config_add_bgscan(config, connection, error)) {
+    if (!nm_supplicant_config_add_bgscan(config,
+                                         connection,
+                                         nm_settings_connection_get_num_seen_bssids(sett_conn),
+                                         error)) {
         g_prefix_error(error, "bgscan: ");
         goto error;
     }
@@ -3227,7 +3231,8 @@ ensure_hotspot_frequency(NMDeviceWifi *self, NMSettingWireless *s_wifi, NMWifiAP
 
     freq = nm_platform_wifi_find_frequency(nm_device_get_platform(device),
                                            nm_device_get_ifindex(device),
-                                           rnd_freqs);
+                                           rnd_freqs,
+                                           TRUE);
     if (freq == 0)
         freq = rnd_freqs[0];
 
@@ -3278,6 +3283,7 @@ act_stage2_config(NMDevice *device, NMDeviceStateReason *out_failure_reason)
     NMActRequest                       *req;
     NMWifiAP                           *ap;
     NMConnection                       *connection;
+    NMSettingsConnection               *sett_conn;
     const char                         *setting_name;
     NMSettingWireless                  *s_wireless;
     GError                             *error = NULL;
@@ -3301,6 +3307,9 @@ act_stage2_config(NMDevice *device, NMDeviceStateReason *out_failure_reason)
 
     ap_mode = nm_wifi_ap_get_mode(ap);
 
+    sett_conn = nm_act_request_get_settings_connection(req);
+    nm_assert(sett_conn);
+
     connection = nm_act_request_get_applied_connection(req);
     s_wireless = nm_connection_get_setting_wireless(connection);
     nm_assert(s_wireless);
@@ -3349,7 +3358,7 @@ act_stage2_config(NMDevice *device, NMDeviceStateReason *out_failure_reason)
         set_powersave(device);
 
     /* Build up the supplicant configuration */
-    config = build_supplicant_config(self, connection, nm_wifi_ap_get_freq(ap), &error);
+    config = build_supplicant_config(self, sett_conn, connection, nm_wifi_ap_get_freq(ap), &error);
     if (!config) {
         _LOGE(LOGD_DEVICE | LOGD_WIFI,
               "Activation: (wifi) couldn't build wireless configuration: %s",
diff --git a/src/core/devices/wwan/nm-modem-ofono.c b/src/core/devices/wwan/nm-modem-ofono.c
index 33a19e93..de105bbd 100644
--- a/src/core/devices/wwan/nm-modem-ofono.c
+++ b/src/core/devices/wwan/nm-modem-ofono.c
@@ -1320,9 +1320,18 @@ handle_settings(NMModemOfono *self, GVariant *v_dict)
         }
     }
 
-    if (g_variant_lookup(v_dict, "MessageProxy", "&s", &s)) {
-        _LOGI("MessageProxy: %s", s);
-        if (s && nm_inet_parse_bin(AF_INET, s, NULL, &address_network)) {
+    if (g_variant_lookup(v_dict, "Proxy", "&s", &s) && s) {
+        gs_free char *proxy = g_strdup(s);
+        char         *colon;
+
+        _LOGI("(MMS) Proxy: %s", s);
+
+        /* Strip the port out. We can do this as we know this is IPv4. */
+        colon = strchr(proxy, ':');
+        if (colon)
+            *colon = '\0';
+
+        if (nm_inet_parse_bin(AF_INET, proxy, NULL, &address_network)) {
             const NMPlatformIP4Route mms_route = {
                 .network       = address_network,
                 .plen          = 32,
@@ -1335,7 +1344,7 @@ handle_settings(NMModemOfono *self, GVariant *v_dict)
 
             nm_l3_config_data_add_route_4(priv->l3cd_4, &mms_route);
         } else
-            _LOGW("invalid MessageProxy: %s", s);
+            _LOGW("invalid (MMS) Proxy: %s", s);
     }
 
     ret = TRUE;
diff --git a/src/core/dhcp/nm-dhcp-client.c b/src/core/dhcp/nm-dhcp-client.c
index 1fc2d944..b10ce410 100644
--- a/src/core/dhcp/nm-dhcp-client.c
+++ b/src/core/dhcp/nm-dhcp-client.c
@@ -871,6 +871,7 @@ _nm_dhcp_client_notify(NMDhcpClient         *self,
         nm_clear_g_source_inst(&priv->previous_lease_timeout_source);
 
     nm_l3_config_data_reset(&priv->l3cd_curr, priv->l3cd_next);
+    priv->l3cfg_notify.wait_ipv6_dad = FALSE;
 
     if (client_event_type == NM_DHCP_CLIENT_EVENT_TYPE_BOUND && priv->l3cd_curr
         && nm_l3_config_data_get_num_addresses(priv->l3cd_curr, priv->config.addr_family) > 0)
diff --git a/src/core/ndisc/nm-ndisc.c b/src/core/ndisc/nm-ndisc.c
index 39a4df48..20dd2121 100644
--- a/src/core/ndisc/nm-ndisc.c
+++ b/src/core/ndisc/nm-ndisc.c
@@ -10,6 +10,7 @@
 #include <arpa/inet.h>
 #include <stdlib.h>
 
+#include "libnm-glib-aux/nm-random-utils.h"
 #include "libnm-platform/nm-platform-utils.h"
 #include "libnm-platform/nm-platform.h"
 #include "libnm-platform/nmp-netns.h"
@@ -858,7 +859,7 @@ solicit_retransmit_time_jitter(gint32 solicit_retransmit_time_msec)
     ten_percent = NM_MAX(1, solicit_retransmit_time_msec / 10);
 
     return solicit_retransmit_time_msec - ten_percent
-           + ((gint32) (g_random_int() % (2u * ((guint32) ten_percent))));
+           + ((gint32) (nm_random_u32() % (2u * ((guint32) ten_percent))));
 }
 
 static gboolean
@@ -936,7 +937,7 @@ solicit_timer_start(NMNDisc *ndisc)
      * a suitable delay in 2021. Wait only up to 250 msec instead. */
 
     delay_msec =
-        g_random_int() % ((guint32) (NM_NDISC_RFC4861_MAX_RTR_SOLICITATION_DELAY * 1000 / 4));
+        nm_random_u32() % ((guint32) (NM_NDISC_RFC4861_MAX_RTR_SOLICITATION_DELAY * 1000 / 4));
 
     _LOGD("solicit: schedule sending first solicitation (of %d) in %.3f seconds",
           priv->config.router_solicitations,
@@ -974,8 +975,9 @@ announce_router(NMNDisc *ndisc)
 
         /* Schedule next initial announcement retransmit. */
         priv->send_ra_id =
-            g_timeout_add_seconds(g_random_int_range(NM_NDISC_ROUTER_ADVERT_DELAY,
-                                                     NM_NDISC_ROUTER_ADVERT_INITIAL_INTERVAL),
+            g_timeout_add_seconds(nm_random_u64_range_full(NM_NDISC_ROUTER_ADVERT_DELAY,
+                                                           NM_NDISC_ROUTER_ADVERT_INITIAL_INTERVAL,
+                                                           FALSE),
                                   (GSourceFunc) announce_router,
                                   ndisc);
     } else {
@@ -1009,10 +1011,9 @@ announce_router_initial(NMNDisc *ndisc)
     /* Schedule the initial send rather early. Clamp the delay by minimal
      * delay and not the initial advert internal so that we start fast. */
     if (G_LIKELY(!priv->send_ra_id)) {
-        priv->send_ra_id =
-            g_timeout_add_seconds(g_random_int_range(0, NM_NDISC_ROUTER_ADVERT_DELAY),
-                                  (GSourceFunc) announce_router,
-                                  ndisc);
+        priv->send_ra_id = g_timeout_add_seconds(nm_random_u64_range(NM_NDISC_ROUTER_ADVERT_DELAY),
+                                                 (GSourceFunc) announce_router,
+                                                 ndisc);
     }
 }
 
@@ -1028,7 +1029,7 @@ announce_router_solicited(NMNDisc *ndisc)
         nm_clear_g_source(&priv->send_ra_id);
 
     if (!priv->send_ra_id) {
-        priv->send_ra_id = g_timeout_add(g_random_int_range(0, NM_NDISC_ROUTER_ADVERT_DELAY_MS),
+        priv->send_ra_id = g_timeout_add(nm_random_u64_range(NM_NDISC_ROUTER_ADVERT_DELAY_MS),
                                          (GSourceFunc) announce_router,
                                          ndisc);
     }
diff --git a/src/core/nm-core-utils.c b/src/core/nm-core-utils.c
index 500bffb9..28d9a788 100644
--- a/src/core/nm-core-utils.c
+++ b/src/core/nm-core-utils.c
@@ -3673,9 +3673,7 @@ _hw_addr_eth_complete(struct ether_addr *addr,
 
     nm_assert((ouis == NULL) ^ (ouis_len != 0));
     if (ouis) {
-        /* g_random_int() is good enough here. It uses a static GRand instance
-         * that is seeded from /dev/urandom. */
-        oui = ouis[g_random_int() % ouis_len];
+        oui = ouis[nm_random_u64_range(ouis_len)];
         g_free(ouis);
     } else {
         if (!nm_utils_hwaddr_aton(current_mac_address, &oui, ETH_ALEN))
@@ -5156,11 +5154,11 @@ nm_utils_spawn_helper(const char *const  *args,
     g_source_attach(info->timeout_source, g_main_context_get_thread_default());
 
     /* Set file descriptors as non-blocking */
-    fd_flags = fcntl(info->child_stdin, F_GETFD, 0);
+    fd_flags = fcntl(info->child_stdin, F_GETFL, 0);
     fcntl(info->child_stdin, F_SETFL, fd_flags | O_NONBLOCK);
-    fd_flags = fcntl(info->child_stdout, F_GETFD, 0);
+    fd_flags = fcntl(info->child_stdout, F_GETFL, 0);
     fcntl(info->child_stdout, F_SETFL, fd_flags | O_NONBLOCK);
-    fd_flags = fcntl(info->child_stderr, F_GETFD, 0);
+    fd_flags = fcntl(info->child_stderr, F_GETFL, 0);
     fcntl(info->child_stderr, F_SETFL, fd_flags | O_NONBLOCK);
 
     /* Watch process stdin */
diff --git a/src/core/nm-l3-config-data.c b/src/core/nm-l3-config-data.c
index 17bb9db8..d5dedb9c 100644
--- a/src/core/nm-l3-config-data.c
+++ b/src/core/nm-l3-config-data.c
@@ -2297,35 +2297,37 @@ nm_l3_config_data_cmp_full(const NML3ConfigData *a,
         const NMPObject *def_route_a = a->best_default_route_x[IS_IPv4];
         const NMPObject *def_route_b = b->best_default_route_x[IS_IPv4];
 
-        NM_CMP_SELF(def_route_a, def_route_b);
-
-        if (NM_FLAGS_HAS(flags, NM_L3_CONFIG_CMP_FLAGS_ROUTES)) {
-            NM_CMP_RETURN(nmp_object_cmp_full(def_route_a,
-                                              def_route_b,
-                                              NM_FLAGS_HAS(flags, NM_L3_CONFIG_CMP_FLAGS_IFINDEX)
-                                                  ? NMP_OBJECT_CMP_FLAGS_NONE
-                                                  : NMP_OBJECT_CMP_FLAGS_IGNORE_IFINDEX));
-        } else if (NM_FLAGS_HAS(flags, NM_L3_CONFIG_CMP_FLAGS_ROUTES_ID)) {
-            if (NM_FLAGS_HAS(flags, NM_L3_CONFIG_CMP_FLAGS_IFINDEX)) {
-                NM_CMP_DIRECT(def_route_a->obj_with_ifindex.ifindex,
-                              def_route_b->obj_with_ifindex.ifindex);
-            }
+        if (def_route_a != def_route_b) {
+            if (NM_FLAGS_HAS(flags, NM_L3_CONFIG_CMP_FLAGS_ROUTES)) {
+                NM_CMP_RETURN(
+                    nmp_object_cmp_full(def_route_a,
+                                        def_route_b,
+                                        NM_FLAGS_HAS(flags, NM_L3_CONFIG_CMP_FLAGS_IFINDEX)
+                                            ? NMP_OBJECT_CMP_FLAGS_NONE
+                                            : NMP_OBJECT_CMP_FLAGS_IGNORE_IFINDEX));
+            } else if (NM_FLAGS_HAS(flags, NM_L3_CONFIG_CMP_FLAGS_ROUTES_ID)) {
+                if (NM_FLAGS_HAS(flags, NM_L3_CONFIG_CMP_FLAGS_IFINDEX)) {
+                    NM_CMP_DIRECT(def_route_a->obj_with_ifindex.ifindex,
+                                  def_route_b->obj_with_ifindex.ifindex);
+                }
 
-            if (IS_IPv4) {
-                NMPlatformIP4Route ra = def_route_a->ip4_route;
-                NMPlatformIP4Route rb = def_route_b->ip4_route;
+                if (IS_IPv4) {
+                    NMPlatformIP4Route ra = def_route_a->ip4_route;
+                    NMPlatformIP4Route rb = def_route_b->ip4_route;
 
-                NM_CMP_DIRECT(ra.metric, rb.metric);
-                NM_CMP_DIRECT(ra.plen, rb.plen);
-                NM_CMP_RETURN_DIRECT(nm_ip4_addr_same_prefix_cmp(ra.network, rb.network, ra.plen));
-            } else {
-                NMPlatformIP6Route ra = def_route_a->ip6_route;
-                NMPlatformIP6Route rb = def_route_b->ip6_route;
+                    NM_CMP_DIRECT(ra.metric, rb.metric);
+                    NM_CMP_DIRECT(ra.plen, rb.plen);
+                    NM_CMP_RETURN_DIRECT(
+                        nm_ip4_addr_same_prefix_cmp(ra.network, rb.network, ra.plen));
+                } else {
+                    NMPlatformIP6Route ra = def_route_a->ip6_route;
+                    NMPlatformIP6Route rb = def_route_b->ip6_route;
 
-                NM_CMP_DIRECT(ra.metric, rb.metric);
-                NM_CMP_DIRECT(ra.plen, rb.plen);
-                NM_CMP_RETURN_DIRECT(
-                    nm_ip6_addr_same_prefix_cmp(&ra.network, &rb.network, ra.plen));
+                    NM_CMP_DIRECT(ra.metric, rb.metric);
+                    NM_CMP_DIRECT(ra.plen, rb.plen);
+                    NM_CMP_RETURN_DIRECT(
+                        nm_ip6_addr_same_prefix_cmp(&ra.network, &rb.network, ra.plen));
+                }
             }
         }
 
diff --git a/src/core/nm-manager.c b/src/core/nm-manager.c
index 66547294..19ca1d1e 100644
--- a/src/core/nm-manager.c
+++ b/src/core/nm-manager.c
@@ -2582,7 +2582,7 @@ _rfkill_update_system(NMManager *self, NMRfkillType rtype, gboolean enabled)
 
     nm_assert(NM_IN_SET(rtype, NM_RFKILL_TYPE_WLAN, NM_RFKILL_TYPE_WWAN));
 
-    fd = open("/dev/rfkill", O_RDWR | O_CLOEXEC);
+    fd = open("/dev/rfkill", O_RDWR | O_NONBLOCK | O_CLOEXEC);
     if (fd < 0) {
         if (errno == EACCES)
             _LOGW(LOGD_RFKILL,
@@ -2591,14 +2591,6 @@ _rfkill_update_system(NMManager *self, NMRfkillType rtype, gboolean enabled)
         return;
     }
 
-    if (fcntl(fd, F_SETFL, O_NONBLOCK) < 0) {
-        _LOGW(LOGD_RFKILL,
-              "rfkill: (%s): failed to set killswitch device for "
-              "non-blocking operation",
-              nm_rfkill_type_to_string(rtype));
-        return;
-    }
-
     memset(&event, 0, sizeof(event));
     event.op = KERN_RFKILL_OP_CHANGE_ALL;
     switch (rtype) {
diff --git a/src/core/platform/nm-fake-platform.c b/src/core/platform/nm-fake-platform.c
index c92d9aef..86d6bc5f 100644
--- a/src/core/platform/nm-fake-platform.c
+++ b/src/core/platform/nm-fake-platform.c
@@ -835,7 +835,7 @@ wifi_set_mode(NMPlatform *platform, int ifindex, _NM80211Mode mode)
 }
 
 static guint32
-wifi_find_frequency(NMPlatform *platform, int ifindex, const guint32 *freqs)
+wifi_find_frequency(NMPlatform *platform, int ifindex, const guint32 *freqs, gboolean ap)
 {
     return freqs[0];
 }
diff --git a/src/core/platform/tests/test-common.c b/src/core/platform/tests/test-common.c
index 571fedfe..65bdfeae 100644
--- a/src/core/platform/tests/test-common.c
+++ b/src/core/platform/tests/test-common.c
@@ -2520,7 +2520,9 @@ nmtstp_link_ip6gre_add(NMPlatform                *platform,
     gboolean              success;
     char                  b1[NM_INET_ADDRSTRLEN];
     char                  b2[NM_INET_ADDRSTRLEN];
+    char                  encap[100];
     char                  tclass[20];
+    gboolean              encap_ignore;
     gboolean              tclass_inherit;
 
     g_assert(nm_utils_ifname_valid_kernel(name, NULL));
@@ -2530,6 +2532,7 @@ nmtstp_link_ip6gre_add(NMPlatform                *platform,
 
     _init_platform(&platform, external_command);
 
+again:
     if (external_command) {
         gs_free char *dev = NULL;
 
@@ -2538,9 +2541,11 @@ nmtstp_link_ip6gre_add(NMPlatform                *platform,
                 g_strdup_printf("dev %s", nm_platform_link_get_name(platform, lnk->parent_ifindex));
 
         tclass_inherit = NM_FLAGS_HAS(lnk->flags, IP6_TNL_F_USE_ORIG_TCLASS);
+        encap_ignore   = NM_FLAGS_HAS(lnk->flags, IP6_TNL_F_IGN_ENCAP_LIMIT);
 
         success = !nmtstp_run_command(
-            "ip link add %s type %s%s%s local %s remote %s ttl %u tclass %s flowlabel %x",
+            "ip link add %s type %s%s%s local %s remote %s ttl %u tclass %s%s "
+            "flowlabel %x",
             name,
             lnk->is_tap ? "ip6gretap" : "ip6gre",
             NM_PRINT_FMT_QUOTED2(dev, " ", dev, ""),
@@ -2548,7 +2553,19 @@ nmtstp_link_ip6gre_add(NMPlatform                *platform,
             nm_inet6_ntop(&lnk->remote, b2),
             lnk->ttl,
             tclass_inherit ? "inherit" : nm_sprintf_buf(tclass, "%02x", lnk->tclass),
+            encap_ignore
+                ? "encaplimit none"
+                : (lnk->encap_limit != 4 ? nm_sprintf_buf(encap, "encaplimit %u", lnk->encap_limit)
+                                         : ""),
             lnk->flow_label);
+
+        if (!success && (encap_ignore || lnk->encap_limit != 4)) {
+            /* The command failed. That might be because iproute2 does not support the
+             * encaplimit parameter yet. Retry, now with platform code. */
+            external_command = FALSE;
+            goto again;
+        }
+
         if (success) {
             pllink = nmtstp_assert_wait_for_link(platform,
                                                  name,
diff --git a/src/core/platform/tests/test-link.c b/src/core/platform/tests/test-link.c
index cc1ec6d1..9a1eaf89 100644
--- a/src/core/platform/tests/test-link.c
+++ b/src/core/platform/tests/test-link.c
@@ -1439,12 +1439,25 @@ test_software_detect(gconstpointer user_data)
 
         module_loaded = nmtstp_ensure_module("ip6_gre");
 
-        lnk_ip6tnl.local          = nmtst_inet6_from_string("fd01::42");
-        lnk_ip6tnl.remote         = nmtst_inet6_from_string("fd01::aaaa");
-        lnk_ip6tnl.parent_ifindex = ifindex_parent;
-        lnk_ip6tnl.tclass         = 21;
-        lnk_ip6tnl.flow_label     = 1338;
-        lnk_ip6tnl.is_gre         = TRUE;
+        switch (test_data->test_mode) {
+        case 0:
+            lnk_ip6tnl.local          = nmtst_inet6_from_string("fd01::43");
+            lnk_ip6tnl.remote         = nmtst_inet6_from_string("fd01::aaaa");
+            lnk_ip6tnl.parent_ifindex = ifindex_parent;
+            lnk_ip6tnl.tclass         = 21;
+            lnk_ip6tnl.flow_label     = 1338;
+            lnk_ip6tnl.is_gre         = TRUE;
+            break;
+        case 1:
+            lnk_ip6tnl.local          = nmtst_inet6_from_string("fd01::44");
+            lnk_ip6tnl.remote         = nmtst_inet6_from_string("fd01::aaab");
+            lnk_ip6tnl.parent_ifindex = ifindex_parent;
+            lnk_ip6tnl.tclass         = 0;
+            lnk_ip6tnl.flow_label     = 1339;
+            lnk_ip6tnl.is_gre         = TRUE;
+            lnk_ip6tnl.flags          = IP6_TNL_F_IGN_ENCAP_LIMIT | IP6_TNL_F_USE_ORIG_TCLASS;
+            break;
+        }
 
         if (!nmtstp_link_ip6gre_add(NULL, ext, DEVICE_NAME, &lnk_ip6tnl)) {
             if (!module_loaded) {
@@ -1463,14 +1476,30 @@ test_software_detect(gconstpointer user_data)
 
         module_loaded = nmtstp_ensure_module("ip6_gre");
 
-        lnk_ip6tnl.local          = nmtst_inet6_from_string("fe80::abcd");
-        lnk_ip6tnl.remote         = nmtst_inet6_from_string("fc01::bbbb");
-        lnk_ip6tnl.parent_ifindex = ifindex_parent;
-        lnk_ip6tnl.ttl            = 10;
-        lnk_ip6tnl.tclass         = 22;
-        lnk_ip6tnl.flow_label     = 1339;
-        lnk_ip6tnl.is_gre         = TRUE;
-        lnk_ip6tnl.is_tap         = TRUE;
+        switch (test_data->test_mode) {
+        case 0:
+            lnk_ip6tnl.local          = nmtst_inet6_from_string("fe80::abcd");
+            lnk_ip6tnl.remote         = nmtst_inet6_from_string("fc01::bbbb");
+            lnk_ip6tnl.parent_ifindex = ifindex_parent;
+            lnk_ip6tnl.ttl            = 10;
+            lnk_ip6tnl.tclass         = 23;
+            lnk_ip6tnl.flow_label     = 1340;
+            lnk_ip6tnl.is_gre         = TRUE;
+            lnk_ip6tnl.is_tap         = TRUE;
+            break;
+        case 1:
+            lnk_ip6tnl.local          = nmtst_inet6_from_string("fe80::abce");
+            lnk_ip6tnl.remote         = nmtst_inet6_from_string("fc01::bbbc");
+            lnk_ip6tnl.parent_ifindex = ifindex_parent;
+            lnk_ip6tnl.ttl            = 10;
+            lnk_ip6tnl.tclass         = 0;
+            lnk_ip6tnl.flow_label     = 1341;
+            lnk_ip6tnl.is_gre         = TRUE;
+            lnk_ip6tnl.is_tap         = TRUE;
+            lnk_ip6tnl.encap_limit    = 4;
+            lnk_ip6tnl.flags          = IP6_TNL_F_IGN_ENCAP_LIMIT | IP6_TNL_F_USE_ORIG_TCLASS;
+            break;
+        }
 
         if (!nmtstp_link_ip6gre_add(NULL, ext, DEVICE_NAME, &lnk_ip6tnl)) {
             if (!module_loaded) {
@@ -1851,29 +1880,65 @@ test_software_detect(gconstpointer user_data)
         {
             const NMPlatformLnkIp6Tnl *plnk = &lnk->lnk_ip6tnl;
 
-            g_assert(plnk == nm_platform_link_get_lnk_ip6gre(NM_PLATFORM_GET, ifindex, NULL));
-            g_assert_cmpint(plnk->parent_ifindex, ==, ifindex_parent);
-            nmtst_assert_ip6_address(&plnk->local, "fd01::42");
-            nmtst_assert_ip6_address(&plnk->remote, "fd01::aaaa");
-            g_assert_cmpint(plnk->tclass, ==, 21);
-            g_assert_cmpint(plnk->flow_label, ==, 1338);
-            g_assert_cmpint(plnk->is_gre, ==, TRUE);
-            g_assert_cmpint(plnk->is_tap, ==, FALSE);
+            switch (test_data->test_mode) {
+            case 0:
+                g_assert(plnk == nm_platform_link_get_lnk_ip6gre(NM_PLATFORM_GET, ifindex, NULL));
+                g_assert_cmpint(plnk->parent_ifindex, ==, ifindex_parent);
+                nmtst_assert_ip6_address(&plnk->local, "fd01::43");
+                nmtst_assert_ip6_address(&plnk->remote, "fd01::aaaa");
+                g_assert_cmpint(plnk->tclass, ==, 21);
+                g_assert_cmpint(plnk->flow_label, ==, 1338);
+                g_assert_cmpint(plnk->is_gre, ==, TRUE);
+                g_assert_cmpint(plnk->is_tap, ==, FALSE);
+                break;
+            case 1:
+                g_assert(plnk == nm_platform_link_get_lnk_ip6gre(NM_PLATFORM_GET, ifindex, NULL));
+                g_assert_cmpint(plnk->parent_ifindex, ==, ifindex_parent);
+                nmtst_assert_ip6_address(&plnk->local, "fd01::44");
+                nmtst_assert_ip6_address(&plnk->remote, "fd01::aaab");
+                g_assert_cmpint(plnk->flow_label, ==, 1339);
+                g_assert_cmpint(plnk->is_gre, ==, TRUE);
+                g_assert_cmpint(plnk->is_tap, ==, FALSE);
+                g_assert_cmpint(plnk->flags & 0xFFFF, /* ignore kernel internal flags */
+                                ==,
+                                IP6_TNL_F_IGN_ENCAP_LIMIT | IP6_TNL_F_USE_ORIG_TCLASS);
+                break;
+            }
+
             break;
         }
         case NM_LINK_TYPE_IP6GRETAP:
         {
             const NMPlatformLnkIp6Tnl *plnk = &lnk->lnk_ip6tnl;
 
-            g_assert(plnk == nm_platform_link_get_lnk_ip6gretap(NM_PLATFORM_GET, ifindex, NULL));
-            g_assert_cmpint(plnk->parent_ifindex, ==, ifindex_parent);
-            nmtst_assert_ip6_address(&plnk->local, "fe80::abcd");
-            nmtst_assert_ip6_address(&plnk->remote, "fc01::bbbb");
-            g_assert_cmpint(plnk->ttl, ==, 10);
-            g_assert_cmpint(plnk->tclass, ==, 22);
-            g_assert_cmpint(plnk->flow_label, ==, 1339);
-            g_assert_cmpint(plnk->is_gre, ==, TRUE);
-            g_assert_cmpint(plnk->is_tap, ==, TRUE);
+            switch (test_data->test_mode) {
+            case 0:
+                g_assert(plnk
+                         == nm_platform_link_get_lnk_ip6gretap(NM_PLATFORM_GET, ifindex, NULL));
+                g_assert_cmpint(plnk->parent_ifindex, ==, ifindex_parent);
+                nmtst_assert_ip6_address(&plnk->local, "fe80::abcd");
+                nmtst_assert_ip6_address(&plnk->remote, "fc01::bbbb");
+                g_assert_cmpint(plnk->ttl, ==, 10);
+                g_assert_cmpint(plnk->tclass, ==, 23);
+                g_assert_cmpint(plnk->flow_label, ==, 1340);
+                g_assert_cmpint(plnk->is_gre, ==, TRUE);
+                g_assert_cmpint(plnk->is_tap, ==, TRUE);
+                break;
+            case 1:
+                g_assert(plnk
+                         == nm_platform_link_get_lnk_ip6gretap(NM_PLATFORM_GET, ifindex, NULL));
+                g_assert_cmpint(plnk->parent_ifindex, ==, ifindex_parent);
+                nmtst_assert_ip6_address(&plnk->local, "fe80::abce");
+                nmtst_assert_ip6_address(&plnk->remote, "fc01::bbbc");
+                g_assert_cmpint(plnk->ttl, ==, 10);
+                g_assert_cmpint(plnk->flow_label, ==, 1341);
+                g_assert_cmpint(plnk->is_gre, ==, TRUE);
+                g_assert_cmpint(plnk->is_tap, ==, TRUE);
+                g_assert_cmpint(plnk->flags & 0xFFFF, /* ignore kernel internal flags */
+                                ==,
+                                IP6_TNL_F_IGN_ENCAP_LIMIT | IP6_TNL_F_USE_ORIG_TCLASS);
+                break;
+            }
             break;
         }
         case NM_LINK_TYPE_IPIP:
@@ -3888,8 +3953,10 @@ _nmtstp_setup_tests(void)
         test_software_detect_add("/link/software/detect/gretap", NM_LINK_TYPE_GRETAP, 0);
         test_software_detect_add("/link/software/detect/ip6tnl/0", NM_LINK_TYPE_IP6TNL, 0);
         test_software_detect_add("/link/software/detect/ip6tnl/1", NM_LINK_TYPE_IP6TNL, 1);
-        test_software_detect_add("/link/software/detect/ip6gre", NM_LINK_TYPE_IP6GRE, 0);
-        test_software_detect_add("/link/software/detect/ip6gretap", NM_LINK_TYPE_IP6GRETAP, 0);
+        test_software_detect_add("/link/software/detect/ip6gre/0", NM_LINK_TYPE_IP6GRE, 0);
+        test_software_detect_add("/link/software/detect/ip6gre/1", NM_LINK_TYPE_IP6GRE, 1);
+        test_software_detect_add("/link/software/detect/ip6gretap/0", NM_LINK_TYPE_IP6GRETAP, 0);
+        test_software_detect_add("/link/software/detect/ip6gretap/1", NM_LINK_TYPE_IP6GRETAP, 1);
         test_software_detect_add("/link/software/detect/ipip", NM_LINK_TYPE_IPIP, 0);
         test_software_detect_add("/link/software/detect/macvlan", NM_LINK_TYPE_MACVLAN, 0);
         test_software_detect_add("/link/software/detect/macvtap", NM_LINK_TYPE_MACVTAP, 0);
diff --git a/src/core/settings/nm-settings-connection.c b/src/core/settings/nm-settings-connection.c
index 1638efcd..024c0009 100644
--- a/src/core/settings/nm-settings-connection.c
+++ b/src/core/settings/nm-settings-connection.c
@@ -2532,6 +2532,14 @@ nm_settings_connection_add_seen_bssid(NMSettingsConnection *self, const char *se
     nm_key_file_db_set_string_list(priv->kf_db_seen_bssids, connection_uuid, seen_bssids_strv, i);
 }
 
+guint
+nm_settings_connection_get_num_seen_bssids(NMSettingsConnection *self)
+{
+    g_return_val_if_fail(NM_IS_SETTINGS_CONNECTION(self), 0);
+
+    return nm_g_hash_table_size(NM_SETTINGS_CONNECTION_GET_PRIVATE(self)->seen_bssids_hash);
+}
+
 /*****************************************************************************/
 
 /**
diff --git a/src/core/settings/nm-settings-connection.h b/src/core/settings/nm-settings-connection.h
index 47599c3d..fce7497c 100644
--- a/src/core/settings/nm-settings-connection.h
+++ b/src/core/settings/nm-settings-connection.h
@@ -345,6 +345,8 @@ gboolean nm_settings_connection_has_seen_bssid(NMSettingsConnection *self, const
 
 void nm_settings_connection_add_seen_bssid(NMSettingsConnection *self, const char *seen_bssid);
 
+guint nm_settings_connection_get_num_seen_bssids(NMSettingsConnection *self);
+
 int  nm_settings_connection_autoconnect_retries_get(NMSettingsConnection *self);
 void nm_settings_connection_autoconnect_retries_set(NMSettingsConnection *self, int retries);
 void nm_settings_connection_autoconnect_retries_reset(NMSettingsConnection *self);
diff --git a/src/core/supplicant/nm-supplicant-config.c b/src/core/supplicant/nm-supplicant-config.c
index c63a0058..1d9372e0 100644
--- a/src/core/supplicant/nm-supplicant-config.c
+++ b/src/core/supplicant/nm-supplicant-config.c
@@ -592,7 +592,10 @@ nm_supplicant_config_add_setting_wireless(NMSupplicantConfig *self,
 }
 
 gboolean
-nm_supplicant_config_add_bgscan(NMSupplicantConfig *self, NMConnection *connection, GError **error)
+nm_supplicant_config_add_bgscan(NMSupplicantConfig *self,
+                                NMConnection       *connection,
+                                guint               num_seen_bssids,
+                                GError            **error)
 {
     NMSettingWireless         *s_wifi;
     NMSettingWirelessSecurity *s_wsec;
@@ -629,7 +632,7 @@ nm_supplicant_config_add_bgscan(NMSupplicantConfig *self, NMConnection *connecti
      * when the signal is still somewhat OK so we have an up-to-date roam
      * candidate list when the signal gets bad.
      */
-    if (nm_setting_wireless_get_num_seen_bssids(s_wifi) > 1
+    if (num_seen_bssids > 1u
         || ((s_wsec = nm_connection_get_setting_wireless_security(connection))
             && NM_IN_STRSET(nm_setting_wireless_security_get_key_mgmt(s_wsec),
                             "ieee8021x",
diff --git a/src/core/supplicant/nm-supplicant-config.h b/src/core/supplicant/nm-supplicant-config.h
index 063f7f55..585cf958 100644
--- a/src/core/supplicant/nm-supplicant-config.h
+++ b/src/core/supplicant/nm-supplicant-config.h
@@ -44,8 +44,10 @@ gboolean nm_supplicant_config_add_setting_wireless(NMSupplicantConfig *self,
                                                    guint32             fixed_freq,
                                                    GError            **error);
 
-gboolean
-nm_supplicant_config_add_bgscan(NMSupplicantConfig *self, NMConnection *connection, GError **error);
+gboolean nm_supplicant_config_add_bgscan(NMSupplicantConfig *self,
+                                         NMConnection       *connection,
+                                         guint               num_seen_bssids,
+                                         GError            **error);
 
 gboolean nm_supplicant_config_add_setting_wireless_security(NMSupplicantConfig        *self,
                                                             NMSettingWirelessSecurity *setting,
diff --git a/src/core/supplicant/tests/test-supplicant-config.c b/src/core/supplicant/tests/test-supplicant-config.c
index 237b1a96..1ca5b26e 100644
--- a/src/core/supplicant/tests/test-supplicant-config.c
+++ b/src/core/supplicant/tests/test-supplicant-config.c
@@ -127,7 +127,7 @@ build_supplicant_config(NMConnection  *connection,
     g_assert_no_error(error);
     g_assert(success);
 
-    success = nm_supplicant_config_add_bgscan(config, connection, &error);
+    success = nm_supplicant_config_add_bgscan(config, connection, 0, &error);
     g_assert_no_error(error);
     g_assert(success);
 
diff --git a/src/libnm-client-aux-extern/nm-libnm-aux.c b/src/libnm-client-aux-extern/nm-libnm-aux.c
index 82a75de6..5855bc29 100644
--- a/src/libnm-client-aux-extern/nm-libnm-aux.c
+++ b/src/libnm-client-aux-extern/nm-libnm-aux.c
@@ -4,6 +4,8 @@
 
 #include "nm-libnm-aux.h"
 
+#include "libnm-glib-aux/nm-random-utils.h"
+
 /*****************************************************************************/
 
 NMClient *
@@ -101,7 +103,7 @@ nmc_client_new_waitsync(GCancellable *cancellable,
      * code no longer uses that, we hardly test those code paths. But they should
      * work just the same. Randomly use instead the sync initialization in a debug
      * build... */
-    if ((g_random_int() % 2) == 0) {
+    if (nm_random_bool()) {
         gboolean success;
 
         va_start(ap, first_property_name);
diff --git a/src/libnm-core-impl/nm-setting-ip-config.c b/src/libnm-core-impl/nm-setting-ip-config.c
index 5d947e29..3e49eb15 100644
--- a/src/libnm-core-impl/nm-setting-ip-config.c
+++ b/src/libnm-core-impl/nm-setting-ip-config.c
@@ -51,6 +51,7 @@ const NMUtilsDNSOptionDesc _nm_utils_dns_option_descs[] = {
     {NM_SETTING_DNS_OPTION_USE_VC, FALSE, FALSE},
     {NM_SETTING_DNS_OPTION_NO_RELOAD, FALSE, FALSE},
     {NM_SETTING_DNS_OPTION_TRUST_AD, FALSE, FALSE},
+    {NM_SETTING_DNS_OPTION_NO_AAAA, FALSE, FALSE},
     {NULL, FALSE, FALSE}};
 
 static char *
@@ -6370,9 +6371,10 @@ nm_setting_ip_config_class_init(NMSettingIPConfigClass *klass)
      * distinct from an empty list of properties.
      *
      * The currently supported options are "attempts", "debug", "edns0",
-     * "inet6", "ip6-bytestring", "ip6-dotint", "ndots", "no-check-names",
-     * "no-ip6-dotint", "no-reload", "no-tld-query", "rotate", "single-request",
-     * "single-request-reopen", "timeout", "trust-ad", "use-vc".
+     * "inet6", "ip6-bytestring", "ip6-dotint", "ndots", "no-aaaa",
+     * "no-check-names", "no-ip6-dotint", "no-reload", "no-tld-query",
+     * "rotate", "single-request", "single-request-reopen", "timeout",
+     * "trust-ad", "use-vc".
      *
      * The "trust-ad" setting is only honored if the profile contributes
      * name servers to resolv.conf, and if all contributing profiles have
diff --git a/src/libnm-core-impl/nm-setting-ip-tunnel.c b/src/libnm-core-impl/nm-setting-ip-tunnel.c
index 7fb8b017..d28eb73f 100644
--- a/src/libnm-core-impl/nm-setting-ip-tunnel.c
+++ b/src/libnm-core-impl/nm-setting-ip-tunnel.c
@@ -491,7 +491,11 @@ verify(NMSetting *setting, NMConnection *connection, GError **error)
     }
 
     flags = priv->flags;
-    if (NM_IN_SET(priv->mode, NM_IP_TUNNEL_MODE_IPIP6, NM_IP_TUNNEL_MODE_IP6IP6))
+    if (NM_IN_SET(priv->mode,
+                  NM_IP_TUNNEL_MODE_IPIP6,
+                  NM_IP_TUNNEL_MODE_IP6IP6,
+                  NM_IP_TUNNEL_MODE_IP6GRE,
+                  NM_IP_TUNNEL_MODE_IP6GRETAP))
         flags &= (guint32) (~_NM_IP_TUNNEL_FLAG_ALL_IP6TNL);
     if (flags) {
         g_set_error(error,
@@ -727,7 +731,7 @@ nm_setting_ip_tunnel_class_init(NMSettingIPTunnelClass *klass)
      * NMSettingIPTunnel:encapsulation-limit:
      *
      * How many additional levels of encapsulation are permitted to be prepended
-     * to packets. This property applies only to IPv6 tunnels.
+     * to packets. This property applies only to IPv6 tunnels. To disable this option, add %NM_IP_TUNNEL_FLAG_IP6_IGN_ENCAP_LIMIT to ip-tunnel flags.
      *
      * Since: 1.2
      **/
diff --git a/src/libnm-core-impl/tests/test-keyfile.c b/src/libnm-core-impl/tests/test-keyfile.c
index c163c429..2b21e583 100644
--- a/src/libnm-core-impl/tests/test-keyfile.c
+++ b/src/libnm-core-impl/tests/test-keyfile.c
@@ -901,8 +901,8 @@ _invalid_option_write_handler(NMConnection         *connection,
                               NMKeyfileHandlerData *handler_data,
                               void                 *user_data)
 {
-    InvalidOptionWriteData *data = user_data;
-    const char             *message;
+    InvalidOptionWriteData *data    = user_data;
+    const char             *message = NULL;
     NMKeyfileWarnSeverity   severity;
 
     g_assert(data);
diff --git a/src/libnm-core-public/nm-setting-ip-config.h b/src/libnm-core-public/nm-setting-ip-config.h
index f3bdc796..7e1d3889 100644
--- a/src/libnm-core-public/nm-setting-ip-config.h
+++ b/src/libnm-core-public/nm-setting-ip-config.h
@@ -362,6 +362,7 @@ char *nm_ip_routing_rule_to_string(const NMIPRoutingRule       *self,
 #define NM_SETTING_DNS_OPTION_USE_VC                "use-vc"
 #define NM_SETTING_DNS_OPTION_NO_RELOAD             "no-reload"
 #define NM_SETTING_DNS_OPTION_TRUST_AD              "trust-ad"
+#define NM_SETTING_DNS_OPTION_NO_AAAA               "no-aaaa"
 
 typedef struct _NMSettingIPConfigClass NMSettingIPConfigClass;
 
diff --git a/src/libnm-core-public/nm-version-macros.h b/src/libnm-core-public/nm-version-macros.h
index 159d3bd8..80e7f251 100644
--- a/src/libnm-core-public/nm-version-macros.h
+++ b/src/libnm-core-public/nm-version-macros.h
@@ -30,7 +30,7 @@
  * Evaluates to the micro version number of NetworkManager which this source
  * compiled against.
  */
-#define NM_MICRO_VERSION (4)
+#define NM_MICRO_VERSION (6)
 
 /**
  * NM_CHECK_VERSION:
diff --git a/src/libnm-glib-aux/nm-random-utils.c b/src/libnm-glib-aux/nm-random-utils.c
index 93eee7c4..2050d2f9 100644
--- a/src/libnm-glib-aux/nm-random-utils.c
+++ b/src/libnm-glib-aux/nm-random-utils.c
@@ -187,9 +187,9 @@ _bad_random_init_seed(BadRandSeed *seed)
     int           seed_idx;
     GRand        *rand;
 
-    /* g_rand_new() reads /dev/urandom, but we already noticed that
+    /* g_rand_new() reads /dev/urandom too, but we already know that
      * /dev/urandom fails to give us good randomness (which is why
-     * we hit the "bad randomness" code path). So this may not be as
+     * we hit the "bad random" code path). So this may not be as
      * good as we wish, but let's hope that it it does something smart
      * to give some extra entropy... */
     rand = g_rand_new();
@@ -231,14 +231,14 @@ _bad_random_bytes(guint8 *buf, gsize n)
      * to give us good randomness. Try our best.
      *
      * Our ability to get entropy for the CPRNG is very limited and thus the overall
-     * result will not be good randomness. See _bad_random_init_seed().
+     * result will be bad randomness.
      *
      * Once we have some seed material, we combine GRand (which is not a cryptographically
      * secure PRNG) with some iterative sha256 hashing. It would be nice if we had
      * easy access to chacha20, but it's probably more cumbersome to fork those
      * implementations than hack a bad CPRNG by using sha256 hashing. After all, this
-     * is fallback code to get *some* randomness. And with the inability to get a good
-     * seed, the CPRNG is not going to give us truly good randomness. */
+     * is fallback code to get *some* bad randomness. And with the inability to get a good
+     * seed, any CPRNG can only give us bad randomness. */
 
     {
         static BadRandState gl_state;
@@ -277,11 +277,11 @@ _bad_random_bytes(guint8 *buf, gsize n)
             nm_utils_checksum_get_digest(sum, gl_state.sha_digest.full);
 
             /* gl_state.sha_digest.full and gl_state.rand_vals contain now our
-             * random values, but they are also the state for the next iteration.
+             * bad random values, but they are also the state for the next iteration.
              * We must not directly expose that state to the caller, so XOR the values.
              *
-             * That means, per iteration we can generate 16 bytes of randomness. That
-             * is for example required to generate a random UUID. */
+             * That means, per iteration we can generate 16 bytes of bad randomness. That
+             * is suitable to initialize a random UUID. */
             for (i = 0; i < (int) (NM_UTILS_CHECKSUM_LENGTH_SHA256 / 2); i++) {
                 nm_assert(n > 0);
                 buf[0] = gl_state.sha_digest.half_1[i] ^ gl_state.sha_digest.half_2[i]
@@ -447,3 +447,55 @@ again_getrandom:
 
     return nm_utils_fd_read_loop_exact(fd, p, n, FALSE);
 }
+
+/*****************************************************************************/
+
+guint64
+nm_random_u64_range_full(guint64 begin, guint64 end, gboolean crypto_bytes)
+{
+    gboolean bad_crypto_bytes = FALSE;
+    guint64  remainder;
+    guint64  maxvalue;
+    guint64  x;
+    guint64  m;
+
+    /* Returns a random #guint64 equally distributed in the range [@begin..@end-1].
+     *
+     * The function always set errno. It either sets it to zero or to EAGAIN
+     * (if crypto_bytes were requested but not obtained). In any case, the function
+     * will always return a random number in the requested range (worst case, it's
+     * not crypto_bytes despite being requested). Check errno if you care. */
+
+    if (begin >= end) {
+        /* systemd's random_u64_range(0) is an alias for nm_random_u64().
+         * Not for us. It's a caller error to request an element from an empty range. */
+        return nm_assert_unreachable_val(begin);
+    }
+
+    m = end - begin;
+
+    if (m == 1) {
+        x = 0;
+        goto out;
+    }
+
+    remainder = G_MAXUINT64 % m;
+    maxvalue  = G_MAXUINT64 - remainder;
+
+    do
+        if (crypto_bytes) {
+            if (nm_random_get_crypto_bytes(&x, sizeof(x)) < 0) {
+                /* Cannot get good crypto numbers. We will try our best, but fail
+                 * and set errno below. */
+                crypto_bytes     = FALSE;
+                bad_crypto_bytes = TRUE;
+                continue;
+            }
+        } else
+            nm_random_get_bytes(&x, sizeof(x));
+    while (x >= maxvalue);
+
+out:
+    errno = bad_crypto_bytes ? EAGAIN : 0;
+    return begin + (x % m);
+}
diff --git a/src/libnm-glib-aux/nm-random-utils.h b/src/libnm-glib-aux/nm-random-utils.h
index ab8aee1b..729d71a4 100644
--- a/src/libnm-glib-aux/nm-random-utils.h
+++ b/src/libnm-glib-aux/nm-random-utils.h
@@ -16,4 +16,39 @@ nm_random_get_bytes(void *p, size_t n)
 
 int nm_random_get_crypto_bytes(void *p, size_t n);
 
+static inline guint32
+nm_random_u32(void)
+{
+    guint32 v;
+
+    nm_random_get_bytes(&v, sizeof(v));
+    return v;
+}
+
+static inline guint64
+nm_random_u64(void)
+{
+    guint64 v;
+
+    nm_random_get_bytes(&v, sizeof(v));
+    return v;
+}
+
+static inline bool
+nm_random_bool(void)
+{
+    guint8 ch;
+
+    nm_random_get_bytes(&ch, sizeof(ch));
+    return ch % 2u;
+}
+
+guint64 nm_random_u64_range_full(guint64 begin, guint64 end, gboolean crypto_bytes);
+
+static inline guint64
+nm_random_u64_range(guint64 end)
+{
+    return nm_random_u64_range_full(0, end, FALSE);
+}
+
 #endif /* __NM_RANDOM_UTILS_H__ */
diff --git a/src/libnm-glib-aux/tests/test-shared-general.c b/src/libnm-glib-aux/tests/test-shared-general.c
index 7503dc9b..3eaca547 100644
--- a/src/libnm-glib-aux/tests/test-shared-general.c
+++ b/src/libnm-glib-aux/tests/test-shared-general.c
@@ -137,6 +137,55 @@ test_nmhash(void)
 
 /*****************************************************************************/
 
+static void
+test_nm_random(void)
+{
+    int i_run;
+
+    for (i_run = 0; i_run < 1000; i_run++) {
+        guint64 begin;
+        guint64 end;
+        guint64 m;
+        guint64 x;
+
+        m = nmtst_get_rand_uint64();
+        m = m >> (nmtst_get_rand_uint32() % 64);
+
+        if (m == 0)
+            continue;
+
+        switch (nmtst_get_rand_uint32() % 4) {
+        case 0:
+            begin = 0;
+            break;
+        case 1:
+            begin = nmtst_get_rand_uint64() % 1000;
+            break;
+        case 2:
+            begin = ((G_MAXUINT64 - m) - 500) + (nmtst_get_rand_uint64() % 1000);
+            break;
+        default:
+            begin = nmtst_get_rand_uint64() % (G_MAXUINT64 - m);
+            break;
+        }
+
+        end = (begin + m) - 10 + (nmtst_get_rand_uint64() % 5);
+
+        if (begin >= end)
+            continue;
+
+        if (begin == 0 && nmtst_get_rand_bool())
+            x = nm_random_u64_range(end);
+        else
+            x = nm_random_u64_range_full(begin, end, nmtst_get_rand_bool());
+
+        g_assert_cmpuint(x, >=, begin);
+        g_assert_cmpuint(x, <, end);
+    }
+}
+
+/*****************************************************************************/
+
 static const char *
 _make_strv_foo(void)
 {
@@ -2417,6 +2466,7 @@ main(int argc, char **argv)
     g_test_add_func("/general/test_inet_utils", test_inet_utils);
     g_test_add_func("/general/test_garray", test_garray);
     g_test_add_func("/general/test_nm_prioq", test_nm_prioq);
+    g_test_add_func("/general/test_nm_random", test_nm_random);
 
     return g_test_run();
 }
diff --git a/src/libnm-platform/nm-linux-platform.c b/src/libnm-platform/nm-linux-platform.c
index 30ad1275..049095b2 100644
--- a/src/libnm-platform/nm-linux-platform.c
+++ b/src/libnm-platform/nm-linux-platform.c
@@ -9291,11 +9291,11 @@ wifi_set_powersave(NMPlatform *platform, int ifindex, guint32 powersave)
 }
 
 static guint32
-wifi_find_frequency(NMPlatform *platform, int ifindex, const guint32 *freqs)
+wifi_find_frequency(NMPlatform *platform, int ifindex, const guint32 *freqs, gboolean ap)
 {
     WIFI_GET_WIFI_DATA_NETNS(wifi_data, platform, ifindex, 0);
 
-    return nm_wifi_utils_find_freq(wifi_data, freqs);
+    return nm_wifi_utils_find_freq(wifi_data, freqs, ap);
 }
 
 static void
diff --git a/src/libnm-platform/nm-platform.c b/src/libnm-platform/nm-platform.c
index 2e9e940c..dc643ed2 100644
--- a/src/libnm-platform/nm-platform.c
+++ b/src/libnm-platform/nm-platform.c
@@ -3192,14 +3192,14 @@ nm_platform_wifi_set_powersave(NMPlatform *self, int ifindex, guint32 powersave)
 }
 
 guint32
-nm_platform_wifi_find_frequency(NMPlatform *self, int ifindex, const guint32 *freqs)
+nm_platform_wifi_find_frequency(NMPlatform *self, int ifindex, const guint32 *freqs, gboolean ap)
 {
     _CHECK_SELF(self, klass, 0);
 
     g_return_val_if_fail(ifindex > 0, 0);
     g_return_val_if_fail(freqs != NULL, 0);
 
-    return klass->wifi_find_frequency(self, ifindex, freqs);
+    return klass->wifi_find_frequency(self, ifindex, freqs, ap);
 }
 
 void
diff --git a/src/libnm-platform/nm-platform.h b/src/libnm-platform/nm-platform.h
index 1cd9c6c6..ca6cdff8 100644
--- a/src/libnm-platform/nm-platform.h
+++ b/src/libnm-platform/nm-platform.h
@@ -1183,7 +1183,10 @@ typedef struct {
     _NM80211Mode (*wifi_get_mode)(NMPlatform *self, int ifindex);
     void (*wifi_set_mode)(NMPlatform *self, int ifindex, _NM80211Mode mode);
     void (*wifi_set_powersave)(NMPlatform *self, int ifindex, guint32 powersave);
-    guint32 (*wifi_find_frequency)(NMPlatform *self, int ifindex, const guint32 *freqs);
+    guint32 (*wifi_find_frequency)(NMPlatform    *self,
+                                   int            ifindex,
+                                   const guint32 *freqs,
+                                   gboolean       ap);
     void (*wifi_indicate_addressing_running)(NMPlatform *self, int ifindex, gboolean running);
     _NMSettingWirelessWakeOnWLan (*wifi_get_wake_on_wlan)(NMPlatform *self, int ifindex);
     gboolean (*wifi_set_wake_on_wlan)(NMPlatform                  *self,
@@ -2063,7 +2066,8 @@ gboolean     nm_platform_wifi_get_station(NMPlatform  *self,
 _NM80211Mode nm_platform_wifi_get_mode(NMPlatform *self, int ifindex);
 void         nm_platform_wifi_set_mode(NMPlatform *self, int ifindex, _NM80211Mode mode);
 void         nm_platform_wifi_set_powersave(NMPlatform *self, int ifindex, guint32 powersave);
-guint32      nm_platform_wifi_find_frequency(NMPlatform *self, int ifindex, const guint32 *freqs);
+guint32
+nm_platform_wifi_find_frequency(NMPlatform *self, int ifindex, const guint32 *freqs, gboolean ap);
 void nm_platform_wifi_indicate_addressing_running(NMPlatform *self, int ifindex, gboolean running);
 _NMSettingWirelessWakeOnWLan nm_platform_wifi_get_wake_on_wlan(NMPlatform *self, int ifindex);
 gboolean
diff --git a/src/libnm-platform/wifi/nm-wifi-utils-nl80211.c b/src/libnm-platform/wifi/nm-wifi-utils-nl80211.c
index c7ee0473..beddaf22 100644
--- a/src/libnm-platform/wifi/nm-wifi-utils-nl80211.c
+++ b/src/libnm-platform/wifi/nm-wifi-utils-nl80211.c
@@ -42,9 +42,15 @@
     G_STMT_END
 
 typedef struct {
+    guint32 freq;
+    bool    disabled : 1;
+    bool    no_ir : 1;
+} Nl80211Freq;
+
+typedef struct {
     NMWifiUtils     parent;
     struct nl_sock *nl_sock;
-    guint32        *freqs;
+    Nl80211Freq    *freqs;
     int             num_freqs;
     int             phy;
     guint16         genl_family_id;
@@ -379,7 +385,7 @@ wifi_nl80211_get_freq(NMWifiUtils *data)
 }
 
 static guint32
-wifi_nl80211_find_freq(NMWifiUtils *data, const guint32 *freqs)
+wifi_nl80211_find_freq(NMWifiUtils *data, const guint32 *freqs, gboolean ap)
 {
     NMWifiUtilsNl80211 *self = (NMWifiUtilsNl80211 *) data;
     int                 i;
@@ -389,7 +395,11 @@ wifi_nl80211_find_freq(NMWifiUtils *data, const guint32 *freqs)
      * that array might be sorted to contain preferred frequencies first. */
     for (j = 0; freqs[j] != 0; j++) {
         for (i = 0; i < self->num_freqs; i++) {
-            if (self->freqs[i] == freqs[j])
+            if (self->freqs[i].disabled)
+                continue;
+            if (ap && self->freqs[i].no_ir)
+                continue;
+            if (self->freqs[i].freq == freqs[j])
                 return freqs[j];
         }
     }
@@ -555,7 +565,7 @@ nla_put_failure:
 struct nl80211_device_info {
     NMWifiUtilsNl80211 *self;
     int                 phy;
-    guint32            *freqs;
+    Nl80211Freq        *freqs;
     int                 num_freqs;
     guint32             freq;
     guint32             caps;
@@ -657,40 +667,45 @@ nl80211_wiphy_info_handler(const struct nl_msg *msg, void *arg)
     /* Read supported frequencies */
     num_alloc       = 32;
     info->num_freqs = 0;
-    info->freqs     = g_new(guint32, num_alloc);
+    info->freqs     = g_new(Nl80211Freq, num_alloc);
 
     nla_for_each_nested (nl_band, tb[NL80211_ATTR_WIPHY_BANDS], rem_band) {
         if (nla_parse_nested_arr(tb_band, nl_band, NULL) < 0)
             return NL_SKIP;
 
         nla_for_each_nested (nl_freq, tb_band[NL80211_BAND_ATTR_FREQS], rem_freq) {
+            Nl80211Freq *f;
+
             if (nla_parse_nested_arr(tb_freq, nl_freq, freq_policy) < 0)
                 continue;
 
             if (!tb_freq[NL80211_FREQUENCY_ATTR_FREQ])
                 continue;
 
-            if (tb_freq[NL80211_FREQUENCY_ATTR_DISABLED])
-                continue;
-
             if (info->num_freqs >= num_alloc) {
                 num_alloc *= 2;
-                info->freqs = g_renew(guint32, info->freqs, num_alloc);
+                info->freqs = g_renew(Nl80211Freq, info->freqs, num_alloc);
             }
 
-            info->freqs[info->num_freqs] = nla_get_u32(tb_freq[NL80211_FREQUENCY_ATTR_FREQ]);
+            f  = &info->freqs[info->num_freqs];
+            *f = (Nl80211Freq){
+                .freq     = nla_get_u32(tb_freq[NL80211_FREQUENCY_ATTR_FREQ]),
+                .disabled = !!tb_freq[NL80211_FREQUENCY_ATTR_DISABLED],
+                .no_ir    = !!tb_freq[NL80211_FREQUENCY_ATTR_NO_IR],
+            };
+
             info->caps |= _NM_WIFI_DEVICE_CAP_FREQ_VALID;
 
-            if (info->freqs[info->num_freqs] > 2400 && info->freqs[info->num_freqs] < 2500)
+            if (f->freq > 2400 && f->freq < 2500)
                 info->caps |= _NM_WIFI_DEVICE_CAP_FREQ_2GHZ;
-            if (info->freqs[info->num_freqs] > 4900 && info->freqs[info->num_freqs] < 6000)
+            if (f->freq > 4900 && f->freq < 6000)
                 info->caps |= _NM_WIFI_DEVICE_CAP_FREQ_5GHZ;
 
             info->num_freqs++;
         }
     }
 
-    info->freqs = g_renew(guint32, info->freqs, info->num_freqs);
+    info->freqs = g_renew(Nl80211Freq, info->freqs, info->num_freqs);
 
     /* Read security/encryption support */
     if (tb[NL80211_ATTR_CIPHER_SUITES]) {
@@ -769,7 +784,7 @@ wifi_nl80211_get_mesh_channel(NMWifiUtils *data)
     }
 
     for (i = 0; i < self->num_freqs; i++) {
-        if (device_info.freq == self->freqs[i])
+        if (device_info.freq == self->freqs[i].freq)
             return i + 1;
     }
     return 0;
@@ -786,7 +801,7 @@ wifi_nl80211_set_mesh_channel(NMWifiUtils *data, guint32 channel)
         return FALSE;
 
     msg = nl80211_alloc_msg(self, NL80211_CMD_SET_WIPHY, 0);
-    NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, self->freqs[channel - 1]);
+    NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, self->freqs[channel - 1].freq);
     err = nl80211_send_and_recv(self, msg, NULL, NULL);
     return err >= 0;
 
diff --git a/src/libnm-platform/wifi/nm-wifi-utils-private.h b/src/libnm-platform/wifi/nm-wifi-utils-private.h
index 7fe157f2..8fa593c0 100644
--- a/src/libnm-platform/wifi/nm-wifi-utils-private.h
+++ b/src/libnm-platform/wifi/nm-wifi-utils-private.h
@@ -28,8 +28,9 @@ typedef struct {
     /* Return current frequency in MHz (really associated BSS frequency) */
     guint32 (*get_freq)(NMWifiUtils *data);
 
-    /* Return first supported frequency in the zero-terminated list */
-    guint32 (*find_freq)(NMWifiUtils *data, const guint32 *freqs);
+    /* Return first supported frequency in the zero-terminated list. @ap
+     * indicates that the frequency must be suited for AP mode. */
+    guint32 (*find_freq)(NMWifiUtils *data, const guint32 *freqs, gboolean ap);
 
     /*
      * @out_bssid: must be NULL or an ETH_ALEN-byte buffer
diff --git a/src/libnm-platform/wifi/nm-wifi-utils-wext.c b/src/libnm-platform/wifi/nm-wifi-utils-wext.c
index eac3c929..0cc8b6a6 100644
--- a/src/libnm-platform/wifi/nm-wifi-utils-wext.c
+++ b/src/libnm-platform/wifi/nm-wifi-utils-wext.c
@@ -249,7 +249,7 @@ wifi_wext_get_freq(NMWifiUtils *data)
 }
 
 static guint32
-wifi_wext_find_freq(NMWifiUtils *data, const guint32 *freqs)
+wifi_wext_find_freq(NMWifiUtils *data, const guint32 *freqs, gboolean ap)
 {
     NMWifiUtilsWext *wext = (NMWifiUtilsWext *) data;
     guint            i;
diff --git a/src/libnm-platform/wifi/nm-wifi-utils.c b/src/libnm-platform/wifi/nm-wifi-utils.c
index 0238b74a..6f87e8c0 100644
--- a/src/libnm-platform/wifi/nm-wifi-utils.c
+++ b/src/libnm-platform/wifi/nm-wifi-utils.c
@@ -124,12 +124,12 @@ nm_wifi_utils_get_freq(NMWifiUtils *data)
 }
 
 guint32
-nm_wifi_utils_find_freq(NMWifiUtils *data, const guint32 *freqs)
+nm_wifi_utils_find_freq(NMWifiUtils *data, const guint32 *freqs, gboolean ap)
 {
     g_return_val_if_fail(data != NULL, 0);
     g_return_val_if_fail(freqs != NULL, 0);
 
-    return NM_WIFI_UTILS_GET_CLASS(data)->find_freq(data, freqs);
+    return NM_WIFI_UTILS_GET_CLASS(data)->find_freq(data, freqs, ap);
 }
 
 gboolean
diff --git a/src/libnm-platform/wifi/nm-wifi-utils.h b/src/libnm-platform/wifi/nm-wifi-utils.h
index aa5a34cd..84d724a5 100644
--- a/src/libnm-platform/wifi/nm-wifi-utils.h
+++ b/src/libnm-platform/wifi/nm-wifi-utils.h
@@ -39,7 +39,7 @@ guint32 nm_wifi_utils_get_freq(NMWifiUtils *data);
 
 /* Return the first supported frequency in the zero-terminated list.
  * Frequencies are specified in MHz. */
-guint32 nm_wifi_utils_find_freq(NMWifiUtils *data, const guint32 *freqs);
+guint32 nm_wifi_utils_find_freq(NMWifiUtils *data, const guint32 *freqs, gboolean ap);
 
 /*
  * @out_bssid: must be NULL or an ETH_ALEN-byte buffer
diff --git a/src/libnmc-base/nm-polkit-listener.c b/src/libnmc-base/nm-polkit-listener.c
index e7972faa..fbc2c704 100644
--- a/src/libnmc-base/nm-polkit-listener.c
+++ b/src/libnmc-base/nm-polkit-listener.c
@@ -534,10 +534,10 @@ begin_authentication(AuthRequest *request)
         return;
     }
 
-    fd_flags = fcntl(request->child_stdin, F_GETFD, 0);
+    fd_flags = fcntl(request->child_stdin, F_GETFL, 0);
     fcntl(request->child_stdin, F_SETFL, fd_flags | O_NONBLOCK);
 
-    fd_flags = fcntl(request->child_stdout, F_GETFD, 0);
+    fd_flags = fcntl(request->child_stdout, F_GETFL, 0);
     fcntl(request->child_stdout, F_SETFL, fd_flags | O_NONBLOCK);
 
     request->child_stdout_watch_source = nm_g_unix_fd_source_new(request->child_stdout,
diff --git a/src/libnmc-setting/settings-docs.h b/src/libnmc-setting/settings-docs.h
index cd5b231b..c10ece6a 100644
--- a/src/libnmc-setting/settings-docs.h
+++ b/src/libnmc-setting/settings-docs.h
@@ -169,7 +169,7 @@
 #define DESCRIBE_DOC_NM_SETTING_IP4_CONFIG_DHCP_TIMEOUT N_("A timeout for a DHCP transaction in seconds. If zero (the default), a globally configured default is used. If still unspecified, a device specific timeout is used (usually 45 seconds). Set to 2147483647 (MAXINT32) for infinity.")
 #define DESCRIBE_DOC_NM_SETTING_IP4_CONFIG_DHCP_VENDOR_CLASS_IDENTIFIER N_("The Vendor Class Identifier DHCP option (60). Special characters in the data string may be escaped using C-style escapes, nevertheless this property cannot contain nul bytes. If the per-profile value is unspecified (the default), a global connection default gets consulted. If still unspecified, the DHCP option is not sent to the server.")
 #define DESCRIBE_DOC_NM_SETTING_IP4_CONFIG_DNS N_("Array of IP addresses of DNS servers. For DoT (DNS over TLS), the SNI server name can be specified by appending \"#example.com\" to the IP address of the DNS server. This currently only has effect when using systemd-resolved.")
-#define DESCRIBE_DOC_NM_SETTING_IP4_CONFIG_DNS_OPTIONS N_("Array of DNS options as described in man 5 resolv.conf. NULL means that the options are unset and left at the default. In this case NetworkManager will use default options. This is distinct from an empty list of properties. The currently supported options are \"attempts\", \"debug\", \"edns0\", \"inet6\", \"ip6-bytestring\", \"ip6-dotint\", \"ndots\", \"no-check-names\", \"no-ip6-dotint\", \"no-reload\", \"no-tld-query\", \"rotate\", \"single-request\", \"single-request-reopen\", \"timeout\", \"trust-ad\", \"use-vc\". The \"trust-ad\" setting is only honored if the profile contributes name servers to resolv.conf, and if all contributing profiles have \"trust-ad\" enabled. When using a caching DNS plugin (dnsmasq or systemd-resolved in NetworkManager.conf) then \"edns0\" and \"trust-ad\" are automatically added.")
+#define DESCRIBE_DOC_NM_SETTING_IP4_CONFIG_DNS_OPTIONS N_("Array of DNS options as described in man 5 resolv.conf. NULL means that the options are unset and left at the default. In this case NetworkManager will use default options. This is distinct from an empty list of properties. The currently supported options are \"attempts\", \"debug\", \"edns0\", \"inet6\", \"ip6-bytestring\", \"ip6-dotint\", \"ndots\", \"no-aaaa\", \"no-check-names\", \"no-ip6-dotint\", \"no-reload\", \"no-tld-query\", \"rotate\", \"single-request\", \"single-request-reopen\", \"timeout\", \"trust-ad\", \"use-vc\". The \"trust-ad\" setting is only honored if the profile contributes name servers to resolv.conf, and if all contributing profiles have \"trust-ad\" enabled. When using a caching DNS plugin (dnsmasq or systemd-resolved in NetworkManager.conf) then \"edns0\" and \"trust-ad\" are automatically added.")
 #define DESCRIBE_DOC_NM_SETTING_IP4_CONFIG_DNS_PRIORITY N_("DNS servers priority. The relative priority for DNS servers specified by this setting.  A lower numerical value is better (higher priority). Negative values have the special effect of excluding other configurations with a greater numerical priority value; so in presence of at least one negative priority, only DNS servers from connections with the lowest priority value will be used. To avoid all DNS leaks, set the priority of the profile that should be used to the most negative value of all active connections profiles. Zero selects a globally configured default value. If the latter is missing or zero too, it defaults to 50 for VPNs (including WireGuard) and 100 for other connections. Note that the priority is to order DNS settings for multiple active connections.  It does not disambiguate multiple DNS servers within the same connection profile. When multiple devices have configurations with the same priority, VPNs will be considered first, then devices with the best (lowest metric) default route and then all other devices. When using dns=default, servers with higher priority will be on top of resolv.conf. To prioritize a given server over another one within the same connection, just specify them in the desired order. Note that commonly the resolver tries name servers in /etc/resolv.conf in the order listed, proceeding with the next server in the list on failure. See for example the \"rotate\" option of the dns-options setting. If there are any negative DNS priorities, then only name servers from the devices with that lowest priority will be considered. When using a DNS resolver that supports Conditional Forwarding or Split DNS (with dns=dnsmasq or dns=systemd-resolved settings), each connection is used to query domains in its search list. The search domains determine which name servers to ask, and the DNS priority is used to prioritize name servers based on the domain.  Queries for domains not present in any search list are routed through connections having the '~.' special wildcard domain, which is added automatically to connections with the default route (or can be added manually).  When multiple connections specify the same domain, the one with the best priority (lowest numerical value) wins.  If a sub domain is configured on another interface it will be accepted regardless the priority, unless parent domain on the other interface has a negative priority, which causes the sub domain to be shadowed. With Split DNS one can avoid undesired DNS leaks by properly configuring DNS priorities and the search domains, so that only name servers of the desired interface are configured.")
 #define DESCRIBE_DOC_NM_SETTING_IP4_CONFIG_DNS_SEARCH N_("List of DNS search domains. Domains starting with a tilde ('~') are considered 'routing' domains and are used only to decide the interface over which a query must be forwarded; they are not used to complete unqualified host names. When using a DNS plugin that supports Conditional Forwarding or Split DNS, then the search domains specify which name servers to query. This makes the behavior different from running with plain /etc/resolv.conf. For more information see also the dns-priority setting. When set on a profile that also enabled DHCP, the DNS search list received automatically (option 119 for DHCPv4 and option 24 for DHCPv6) gets merged with the manual list. This can be prevented by setting \"ignore-auto-dns\". Note that if no DNS searches are configured, the fallback will be derived from the domain from DHCP (option 15).")
 #define DESCRIBE_DOC_NM_SETTING_IP4_CONFIG_GATEWAY N_("The gateway associated with this configuration. This is only meaningful if \"addresses\" is also set. Setting the gateway causes NetworkManager to configure a standard default route with the gateway as next hop. This is ignored if \"never-default\" is set. An alternative is to configure the default route explicitly with a manual route and /0 as prefix length. Note that the gateway usually conflicts with routing that NetworkManager configures for WireGuard interfaces, so usually it should not be set in that case. See \"ip4-auto-default-route\".")
@@ -197,7 +197,7 @@
 #define DESCRIBE_DOC_NM_SETTING_IP6_CONFIG_DHCP_SEND_HOSTNAME N_("If TRUE, a hostname is sent to the DHCP server when acquiring a lease. Some DHCP servers use this hostname to update DNS databases, essentially providing a static hostname for the computer.  If the \"dhcp-hostname\" property is NULL and this property is TRUE, the current persistent hostname of the computer is sent.")
 #define DESCRIBE_DOC_NM_SETTING_IP6_CONFIG_DHCP_TIMEOUT N_("A timeout for a DHCP transaction in seconds. If zero (the default), a globally configured default is used. If still unspecified, a device specific timeout is used (usually 45 seconds). Set to 2147483647 (MAXINT32) for infinity.")
 #define DESCRIBE_DOC_NM_SETTING_IP6_CONFIG_DNS N_("Array of IP addresses of DNS servers. For DoT (DNS over TLS), the SNI server name can be specified by appending \"#example.com\" to the IP address of the DNS server. This currently only has effect when using systemd-resolved.")
-#define DESCRIBE_DOC_NM_SETTING_IP6_CONFIG_DNS_OPTIONS N_("Array of DNS options as described in man 5 resolv.conf. NULL means that the options are unset and left at the default. In this case NetworkManager will use default options. This is distinct from an empty list of properties. The currently supported options are \"attempts\", \"debug\", \"edns0\", \"inet6\", \"ip6-bytestring\", \"ip6-dotint\", \"ndots\", \"no-check-names\", \"no-ip6-dotint\", \"no-reload\", \"no-tld-query\", \"rotate\", \"single-request\", \"single-request-reopen\", \"timeout\", \"trust-ad\", \"use-vc\". The \"trust-ad\" setting is only honored if the profile contributes name servers to resolv.conf, and if all contributing profiles have \"trust-ad\" enabled. When using a caching DNS plugin (dnsmasq or systemd-resolved in NetworkManager.conf) then \"edns0\" and \"trust-ad\" are automatically added.")
+#define DESCRIBE_DOC_NM_SETTING_IP6_CONFIG_DNS_OPTIONS N_("Array of DNS options as described in man 5 resolv.conf. NULL means that the options are unset and left at the default. In this case NetworkManager will use default options. This is distinct from an empty list of properties. The currently supported options are \"attempts\", \"debug\", \"edns0\", \"inet6\", \"ip6-bytestring\", \"ip6-dotint\", \"ndots\", \"no-aaaa\", \"no-check-names\", \"no-ip6-dotint\", \"no-reload\", \"no-tld-query\", \"rotate\", \"single-request\", \"single-request-reopen\", \"timeout\", \"trust-ad\", \"use-vc\". The \"trust-ad\" setting is only honored if the profile contributes name servers to resolv.conf, and if all contributing profiles have \"trust-ad\" enabled. When using a caching DNS plugin (dnsmasq or systemd-resolved in NetworkManager.conf) then \"edns0\" and \"trust-ad\" are automatically added.")
 #define DESCRIBE_DOC_NM_SETTING_IP6_CONFIG_DNS_PRIORITY N_("DNS servers priority. The relative priority for DNS servers specified by this setting.  A lower numerical value is better (higher priority). Negative values have the special effect of excluding other configurations with a greater numerical priority value; so in presence of at least one negative priority, only DNS servers from connections with the lowest priority value will be used. To avoid all DNS leaks, set the priority of the profile that should be used to the most negative value of all active connections profiles. Zero selects a globally configured default value. If the latter is missing or zero too, it defaults to 50 for VPNs (including WireGuard) and 100 for other connections. Note that the priority is to order DNS settings for multiple active connections.  It does not disambiguate multiple DNS servers within the same connection profile. When multiple devices have configurations with the same priority, VPNs will be considered first, then devices with the best (lowest metric) default route and then all other devices. When using dns=default, servers with higher priority will be on top of resolv.conf. To prioritize a given server over another one within the same connection, just specify them in the desired order. Note that commonly the resolver tries name servers in /etc/resolv.conf in the order listed, proceeding with the next server in the list on failure. See for example the \"rotate\" option of the dns-options setting. If there are any negative DNS priorities, then only name servers from the devices with that lowest priority will be considered. When using a DNS resolver that supports Conditional Forwarding or Split DNS (with dns=dnsmasq or dns=systemd-resolved settings), each connection is used to query domains in its search list. The search domains determine which name servers to ask, and the DNS priority is used to prioritize name servers based on the domain.  Queries for domains not present in any search list are routed through connections having the '~.' special wildcard domain, which is added automatically to connections with the default route (or can be added manually).  When multiple connections specify the same domain, the one with the best priority (lowest numerical value) wins.  If a sub domain is configured on another interface it will be accepted regardless the priority, unless parent domain on the other interface has a negative priority, which causes the sub domain to be shadowed. With Split DNS one can avoid undesired DNS leaks by properly configuring DNS priorities and the search domains, so that only name servers of the desired interface are configured.")
 #define DESCRIBE_DOC_NM_SETTING_IP6_CONFIG_DNS_SEARCH N_("List of DNS search domains. Domains starting with a tilde ('~') are considered 'routing' domains and are used only to decide the interface over which a query must be forwarded; they are not used to complete unqualified host names. When using a DNS plugin that supports Conditional Forwarding or Split DNS, then the search domains specify which name servers to query. This makes the behavior different from running with plain /etc/resolv.conf. For more information see also the dns-priority setting. When set on a profile that also enabled DHCP, the DNS search list received automatically (option 119 for DHCPv4 and option 24 for DHCPv6) gets merged with the manual list. This can be prevented by setting \"ignore-auto-dns\". Note that if no DNS searches are configured, the fallback will be derived from the domain from DHCP (option 15).")
 #define DESCRIBE_DOC_NM_SETTING_IP6_CONFIG_GATEWAY N_("The gateway associated with this configuration. This is only meaningful if \"addresses\" is also set. Setting the gateway causes NetworkManager to configure a standard default route with the gateway as next hop. This is ignored if \"never-default\" is set. An alternative is to configure the default route explicitly with a manual route and /0 as prefix length. Note that the gateway usually conflicts with routing that NetworkManager configures for WireGuard interfaces, so usually it should not be set in that case. See \"ip4-auto-default-route\".")
@@ -216,7 +216,7 @@
 #define DESCRIBE_DOC_NM_SETTING_IP6_CONFIG_ROUTES N_("Array of IP routes.")
 #define DESCRIBE_DOC_NM_SETTING_IP6_CONFIG_ROUTING_RULES N_("A comma separated list of routing rules for policy routing.")
 #define DESCRIBE_DOC_NM_SETTING_IP6_CONFIG_TOKEN N_("Configure the token for draft-chown-6man-tokenised-ipv6-identifiers-02 IPv6 tokenized interface identifiers. Useful with eui64 addr-gen-mode.")
-#define DESCRIBE_DOC_NM_SETTING_IP_TUNNEL_ENCAPSULATION_LIMIT N_("How many additional levels of encapsulation are permitted to be prepended to packets. This property applies only to IPv6 tunnels.")
+#define DESCRIBE_DOC_NM_SETTING_IP_TUNNEL_ENCAPSULATION_LIMIT N_("How many additional levels of encapsulation are permitted to be prepended to packets. This property applies only to IPv6 tunnels. To disable this option, add NM_IP_TUNNEL_FLAG_IP6_IGN_ENCAP_LIMIT (0x1) to ip-tunnel flags.")
 #define DESCRIBE_DOC_NM_SETTING_IP_TUNNEL_FLAGS N_("Tunnel flags. Currently, the following values are supported: NM_IP_TUNNEL_FLAG_IP6_IGN_ENCAP_LIMIT (0x1), NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_TCLASS (0x2), NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_FLOWLABEL (0x4), NM_IP_TUNNEL_FLAG_IP6_MIP6_DEV (0x8), NM_IP_TUNNEL_FLAG_IP6_RCV_DSCP_COPY (0x10), NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_FWMARK (0x20). They are valid only for IPv6 tunnels.")
 #define DESCRIBE_DOC_NM_SETTING_IP_TUNNEL_FLOW_LABEL N_("The flow label to assign to tunnel packets. This property applies only to IPv6 tunnels.")
 #define DESCRIBE_DOC_NM_SETTING_IP_TUNNEL_FWMARK N_("The fwmark value to assign to tunnel packets. This property can be set to a non zero value only on VTI and VTI6 tunnels.")
diff --git a/src/libnmc-setting/settings-docs.h.in b/src/libnmc-setting/settings-docs.h.in
index cd5b231b..c10ece6a 100644
--- a/src/libnmc-setting/settings-docs.h.in
+++ b/src/libnmc-setting/settings-docs.h.in
@@ -169,7 +169,7 @@
 #define DESCRIBE_DOC_NM_SETTING_IP4_CONFIG_DHCP_TIMEOUT N_("A timeout for a DHCP transaction in seconds. If zero (the default), a globally configured default is used. If still unspecified, a device specific timeout is used (usually 45 seconds). Set to 2147483647 (MAXINT32) for infinity.")
 #define DESCRIBE_DOC_NM_SETTING_IP4_CONFIG_DHCP_VENDOR_CLASS_IDENTIFIER N_("The Vendor Class Identifier DHCP option (60). Special characters in the data string may be escaped using C-style escapes, nevertheless this property cannot contain nul bytes. If the per-profile value is unspecified (the default), a global connection default gets consulted. If still unspecified, the DHCP option is not sent to the server.")
 #define DESCRIBE_DOC_NM_SETTING_IP4_CONFIG_DNS N_("Array of IP addresses of DNS servers. For DoT (DNS over TLS), the SNI server name can be specified by appending \"#example.com\" to the IP address of the DNS server. This currently only has effect when using systemd-resolved.")
-#define DESCRIBE_DOC_NM_SETTING_IP4_CONFIG_DNS_OPTIONS N_("Array of DNS options as described in man 5 resolv.conf. NULL means that the options are unset and left at the default. In this case NetworkManager will use default options. This is distinct from an empty list of properties. The currently supported options are \"attempts\", \"debug\", \"edns0\", \"inet6\", \"ip6-bytestring\", \"ip6-dotint\", \"ndots\", \"no-check-names\", \"no-ip6-dotint\", \"no-reload\", \"no-tld-query\", \"rotate\", \"single-request\", \"single-request-reopen\", \"timeout\", \"trust-ad\", \"use-vc\". The \"trust-ad\" setting is only honored if the profile contributes name servers to resolv.conf, and if all contributing profiles have \"trust-ad\" enabled. When using a caching DNS plugin (dnsmasq or systemd-resolved in NetworkManager.conf) then \"edns0\" and \"trust-ad\" are automatically added.")
+#define DESCRIBE_DOC_NM_SETTING_IP4_CONFIG_DNS_OPTIONS N_("Array of DNS options as described in man 5 resolv.conf. NULL means that the options are unset and left at the default. In this case NetworkManager will use default options. This is distinct from an empty list of properties. The currently supported options are \"attempts\", \"debug\", \"edns0\", \"inet6\", \"ip6-bytestring\", \"ip6-dotint\", \"ndots\", \"no-aaaa\", \"no-check-names\", \"no-ip6-dotint\", \"no-reload\", \"no-tld-query\", \"rotate\", \"single-request\", \"single-request-reopen\", \"timeout\", \"trust-ad\", \"use-vc\". The \"trust-ad\" setting is only honored if the profile contributes name servers to resolv.conf, and if all contributing profiles have \"trust-ad\" enabled. When using a caching DNS plugin (dnsmasq or systemd-resolved in NetworkManager.conf) then \"edns0\" and \"trust-ad\" are automatically added.")
 #define DESCRIBE_DOC_NM_SETTING_IP4_CONFIG_DNS_PRIORITY N_("DNS servers priority. The relative priority for DNS servers specified by this setting.  A lower numerical value is better (higher priority). Negative values have the special effect of excluding other configurations with a greater numerical priority value; so in presence of at least one negative priority, only DNS servers from connections with the lowest priority value will be used. To avoid all DNS leaks, set the priority of the profile that should be used to the most negative value of all active connections profiles. Zero selects a globally configured default value. If the latter is missing or zero too, it defaults to 50 for VPNs (including WireGuard) and 100 for other connections. Note that the priority is to order DNS settings for multiple active connections.  It does not disambiguate multiple DNS servers within the same connection profile. When multiple devices have configurations with the same priority, VPNs will be considered first, then devices with the best (lowest metric) default route and then all other devices. When using dns=default, servers with higher priority will be on top of resolv.conf. To prioritize a given server over another one within the same connection, just specify them in the desired order. Note that commonly the resolver tries name servers in /etc/resolv.conf in the order listed, proceeding with the next server in the list on failure. See for example the \"rotate\" option of the dns-options setting. If there are any negative DNS priorities, then only name servers from the devices with that lowest priority will be considered. When using a DNS resolver that supports Conditional Forwarding or Split DNS (with dns=dnsmasq or dns=systemd-resolved settings), each connection is used to query domains in its search list. The search domains determine which name servers to ask, and the DNS priority is used to prioritize name servers based on the domain.  Queries for domains not present in any search list are routed through connections having the '~.' special wildcard domain, which is added automatically to connections with the default route (or can be added manually).  When multiple connections specify the same domain, the one with the best priority (lowest numerical value) wins.  If a sub domain is configured on another interface it will be accepted regardless the priority, unless parent domain on the other interface has a negative priority, which causes the sub domain to be shadowed. With Split DNS one can avoid undesired DNS leaks by properly configuring DNS priorities and the search domains, so that only name servers of the desired interface are configured.")
 #define DESCRIBE_DOC_NM_SETTING_IP4_CONFIG_DNS_SEARCH N_("List of DNS search domains. Domains starting with a tilde ('~') are considered 'routing' domains and are used only to decide the interface over which a query must be forwarded; they are not used to complete unqualified host names. When using a DNS plugin that supports Conditional Forwarding or Split DNS, then the search domains specify which name servers to query. This makes the behavior different from running with plain /etc/resolv.conf. For more information see also the dns-priority setting. When set on a profile that also enabled DHCP, the DNS search list received automatically (option 119 for DHCPv4 and option 24 for DHCPv6) gets merged with the manual list. This can be prevented by setting \"ignore-auto-dns\". Note that if no DNS searches are configured, the fallback will be derived from the domain from DHCP (option 15).")
 #define DESCRIBE_DOC_NM_SETTING_IP4_CONFIG_GATEWAY N_("The gateway associated with this configuration. This is only meaningful if \"addresses\" is also set. Setting the gateway causes NetworkManager to configure a standard default route with the gateway as next hop. This is ignored if \"never-default\" is set. An alternative is to configure the default route explicitly with a manual route and /0 as prefix length. Note that the gateway usually conflicts with routing that NetworkManager configures for WireGuard interfaces, so usually it should not be set in that case. See \"ip4-auto-default-route\".")
@@ -197,7 +197,7 @@
 #define DESCRIBE_DOC_NM_SETTING_IP6_CONFIG_DHCP_SEND_HOSTNAME N_("If TRUE, a hostname is sent to the DHCP server when acquiring a lease. Some DHCP servers use this hostname to update DNS databases, essentially providing a static hostname for the computer.  If the \"dhcp-hostname\" property is NULL and this property is TRUE, the current persistent hostname of the computer is sent.")
 #define DESCRIBE_DOC_NM_SETTING_IP6_CONFIG_DHCP_TIMEOUT N_("A timeout for a DHCP transaction in seconds. If zero (the default), a globally configured default is used. If still unspecified, a device specific timeout is used (usually 45 seconds). Set to 2147483647 (MAXINT32) for infinity.")
 #define DESCRIBE_DOC_NM_SETTING_IP6_CONFIG_DNS N_("Array of IP addresses of DNS servers. For DoT (DNS over TLS), the SNI server name can be specified by appending \"#example.com\" to the IP address of the DNS server. This currently only has effect when using systemd-resolved.")
-#define DESCRIBE_DOC_NM_SETTING_IP6_CONFIG_DNS_OPTIONS N_("Array of DNS options as described in man 5 resolv.conf. NULL means that the options are unset and left at the default. In this case NetworkManager will use default options. This is distinct from an empty list of properties. The currently supported options are \"attempts\", \"debug\", \"edns0\", \"inet6\", \"ip6-bytestring\", \"ip6-dotint\", \"ndots\", \"no-check-names\", \"no-ip6-dotint\", \"no-reload\", \"no-tld-query\", \"rotate\", \"single-request\", \"single-request-reopen\", \"timeout\", \"trust-ad\", \"use-vc\". The \"trust-ad\" setting is only honored if the profile contributes name servers to resolv.conf, and if all contributing profiles have \"trust-ad\" enabled. When using a caching DNS plugin (dnsmasq or systemd-resolved in NetworkManager.conf) then \"edns0\" and \"trust-ad\" are automatically added.")
+#define DESCRIBE_DOC_NM_SETTING_IP6_CONFIG_DNS_OPTIONS N_("Array of DNS options as described in man 5 resolv.conf. NULL means that the options are unset and left at the default. In this case NetworkManager will use default options. This is distinct from an empty list of properties. The currently supported options are \"attempts\", \"debug\", \"edns0\", \"inet6\", \"ip6-bytestring\", \"ip6-dotint\", \"ndots\", \"no-aaaa\", \"no-check-names\", \"no-ip6-dotint\", \"no-reload\", \"no-tld-query\", \"rotate\", \"single-request\", \"single-request-reopen\", \"timeout\", \"trust-ad\", \"use-vc\". The \"trust-ad\" setting is only honored if the profile contributes name servers to resolv.conf, and if all contributing profiles have \"trust-ad\" enabled. When using a caching DNS plugin (dnsmasq or systemd-resolved in NetworkManager.conf) then \"edns0\" and \"trust-ad\" are automatically added.")
 #define DESCRIBE_DOC_NM_SETTING_IP6_CONFIG_DNS_PRIORITY N_("DNS servers priority. The relative priority for DNS servers specified by this setting.  A lower numerical value is better (higher priority). Negative values have the special effect of excluding other configurations with a greater numerical priority value; so in presence of at least one negative priority, only DNS servers from connections with the lowest priority value will be used. To avoid all DNS leaks, set the priority of the profile that should be used to the most negative value of all active connections profiles. Zero selects a globally configured default value. If the latter is missing or zero too, it defaults to 50 for VPNs (including WireGuard) and 100 for other connections. Note that the priority is to order DNS settings for multiple active connections.  It does not disambiguate multiple DNS servers within the same connection profile. When multiple devices have configurations with the same priority, VPNs will be considered first, then devices with the best (lowest metric) default route and then all other devices. When using dns=default, servers with higher priority will be on top of resolv.conf. To prioritize a given server over another one within the same connection, just specify them in the desired order. Note that commonly the resolver tries name servers in /etc/resolv.conf in the order listed, proceeding with the next server in the list on failure. See for example the \"rotate\" option of the dns-options setting. If there are any negative DNS priorities, then only name servers from the devices with that lowest priority will be considered. When using a DNS resolver that supports Conditional Forwarding or Split DNS (with dns=dnsmasq or dns=systemd-resolved settings), each connection is used to query domains in its search list. The search domains determine which name servers to ask, and the DNS priority is used to prioritize name servers based on the domain.  Queries for domains not present in any search list are routed through connections having the '~.' special wildcard domain, which is added automatically to connections with the default route (or can be added manually).  When multiple connections specify the same domain, the one with the best priority (lowest numerical value) wins.  If a sub domain is configured on another interface it will be accepted regardless the priority, unless parent domain on the other interface has a negative priority, which causes the sub domain to be shadowed. With Split DNS one can avoid undesired DNS leaks by properly configuring DNS priorities and the search domains, so that only name servers of the desired interface are configured.")
 #define DESCRIBE_DOC_NM_SETTING_IP6_CONFIG_DNS_SEARCH N_("List of DNS search domains. Domains starting with a tilde ('~') are considered 'routing' domains and are used only to decide the interface over which a query must be forwarded; they are not used to complete unqualified host names. When using a DNS plugin that supports Conditional Forwarding or Split DNS, then the search domains specify which name servers to query. This makes the behavior different from running with plain /etc/resolv.conf. For more information see also the dns-priority setting. When set on a profile that also enabled DHCP, the DNS search list received automatically (option 119 for DHCPv4 and option 24 for DHCPv6) gets merged with the manual list. This can be prevented by setting \"ignore-auto-dns\". Note that if no DNS searches are configured, the fallback will be derived from the domain from DHCP (option 15).")
 #define DESCRIBE_DOC_NM_SETTING_IP6_CONFIG_GATEWAY N_("The gateway associated with this configuration. This is only meaningful if \"addresses\" is also set. Setting the gateway causes NetworkManager to configure a standard default route with the gateway as next hop. This is ignored if \"never-default\" is set. An alternative is to configure the default route explicitly with a manual route and /0 as prefix length. Note that the gateway usually conflicts with routing that NetworkManager configures for WireGuard interfaces, so usually it should not be set in that case. See \"ip4-auto-default-route\".")
@@ -216,7 +216,7 @@
 #define DESCRIBE_DOC_NM_SETTING_IP6_CONFIG_ROUTES N_("Array of IP routes.")
 #define DESCRIBE_DOC_NM_SETTING_IP6_CONFIG_ROUTING_RULES N_("A comma separated list of routing rules for policy routing.")
 #define DESCRIBE_DOC_NM_SETTING_IP6_CONFIG_TOKEN N_("Configure the token for draft-chown-6man-tokenised-ipv6-identifiers-02 IPv6 tokenized interface identifiers. Useful with eui64 addr-gen-mode.")
-#define DESCRIBE_DOC_NM_SETTING_IP_TUNNEL_ENCAPSULATION_LIMIT N_("How many additional levels of encapsulation are permitted to be prepended to packets. This property applies only to IPv6 tunnels.")
+#define DESCRIBE_DOC_NM_SETTING_IP_TUNNEL_ENCAPSULATION_LIMIT N_("How many additional levels of encapsulation are permitted to be prepended to packets. This property applies only to IPv6 tunnels. To disable this option, add NM_IP_TUNNEL_FLAG_IP6_IGN_ENCAP_LIMIT (0x1) to ip-tunnel flags.")
 #define DESCRIBE_DOC_NM_SETTING_IP_TUNNEL_FLAGS N_("Tunnel flags. Currently, the following values are supported: NM_IP_TUNNEL_FLAG_IP6_IGN_ENCAP_LIMIT (0x1), NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_TCLASS (0x2), NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_FLOWLABEL (0x4), NM_IP_TUNNEL_FLAG_IP6_MIP6_DEV (0x8), NM_IP_TUNNEL_FLAG_IP6_RCV_DSCP_COPY (0x10), NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_FWMARK (0x20). They are valid only for IPv6 tunnels.")
 #define DESCRIBE_DOC_NM_SETTING_IP_TUNNEL_FLOW_LABEL N_("The flow label to assign to tunnel packets. This property applies only to IPv6 tunnels.")
 #define DESCRIBE_DOC_NM_SETTING_IP_TUNNEL_FWMARK N_("The fwmark value to assign to tunnel packets. This property can be set to a non zero value only on VTI and VTI6 tunnels.")
diff --git a/src/nm-cloud-setup/nm-http-client.c b/src/nm-cloud-setup/nm-http-client.c
index a0964e21..db123f10 100644
--- a/src/nm-cloud-setup/nm-http-client.c
+++ b/src/nm-cloud-setup/nm-http-client.c
@@ -104,12 +104,12 @@ typedef struct {
 } GetResult;
 
 static void
-_get_result_free(gpointer data)
+_req_result_free(gpointer data)
 {
-    GetResult *get_result = data;
+    GetResult *req_result = data;
 
-    g_bytes_unref(get_result->response_data);
-    nm_g_slice_free(get_result);
+    g_bytes_unref(req_result->response_data);
+    nm_g_slice_free(req_result);
 }
 
 typedef struct {
@@ -154,7 +154,7 @@ _ehandle_free(EHandleData *edata)
 static void
 _ehandle_complete(EHandleData *edata, GError *error_take)
 {
-    GetResult    *get_result;
+    GetResult    *req_result;
     gs_free char *str_tmp_1     = NULL;
     long          response_code = -1;
 
@@ -200,15 +200,15 @@ _ehandle_complete(EHandleData *edata, GError *error_take)
 
     _ehandle_free_ehandle(edata);
 
-    get_result  = g_slice_new(GetResult);
-    *get_result = (GetResult){
+    req_result  = g_slice_new(GetResult);
+    *req_result = (GetResult){
         .response_code = response_code,
         /* This ensures that response_data is always NUL terminated. This is an important guarantee
          * that NMHttpClient makes. */
         .response_data = nm_str_buf_finalize_to_gbytes(&edata->recv_data),
     };
 
-    g_task_return_pointer(edata->task, get_result, _get_result_free);
+    g_task_return_pointer(edata->task, req_result, _req_result_free);
 
     _ehandle_free(edata);
 }
@@ -256,12 +256,13 @@ _get_cancelled_cb(GObject *object, gpointer user_data)
     _ehandle_complete(edata, error);
 }
 
-void
-nm_http_client_get(NMHttpClient       *self,
+static void
+nm_http_client_req(NMHttpClient       *self,
                    const char         *url,
                    int                 timeout_msec,
                    gssize              max_data,
                    const char *const  *http_headers,
+                   const char         *http_method,
                    GCancellable       *cancellable,
                    GAsyncReadyCallback callback,
                    gpointer            user_data)
@@ -280,7 +281,7 @@ nm_http_client_get(NMHttpClient       *self,
 
     edata  = g_slice_new(EHandleData);
     *edata = (EHandleData){
-        .task      = nm_g_task_new(self, cancellable, nm_http_client_get, callback, user_data),
+        .task      = nm_g_task_new(self, cancellable, nm_http_client_req, callback, user_data),
         .recv_data = NM_STR_BUF_INIT(0, FALSE),
         .max_data  = max_data,
         .url       = g_strdup(url),
@@ -289,7 +290,7 @@ nm_http_client_get(NMHttpClient       *self,
 
     nmcs_wait_for_objects_register(edata->task);
 
-    _LOG2D(edata, "start get ...");
+    _LOG2D(edata, "start %s ...", http_method ?: "get");
 
     edata->ehandle = curl_easy_init();
     if (!edata->ehandle) {
@@ -328,6 +329,9 @@ nm_http_client_get(NMHttpClient       *self,
         curl_easy_setopt(edata->ehandle, CURLOPT_HTTPHEADER, edata->headers);
     }
 
+    if (http_method)
+        curl_easy_setopt(edata->ehandle, CURLOPT_CUSTOMREQUEST, http_method);
+
     if (timeout_msec > 0) {
         edata->timeout_source = _source_attach(self,
                                                nm_g_timeout_source_new(timeout_msec,
@@ -352,7 +356,7 @@ nm_http_client_get(NMHttpClient       *self,
 }
 
 /**
- * nm_http_client_get_finish:
+ * nm_http_client_req_finish:
  * @self: the #NMHttpClient instance
  * @result: the #GAsyncResult which to complete.
  * @out_response_code: (allow-none) (out): the HTTP response code or -1 on other error.
@@ -366,34 +370,34 @@ nm_http_client_get(NMHttpClient       *self,
  *
  * Returns: %TRUE on success or %FALSE with an error code.
  */
-gboolean
-nm_http_client_get_finish(NMHttpClient *self,
+static gboolean
+nm_http_client_req_finish(NMHttpClient *self,
                           GAsyncResult *result,
                           long         *out_response_code,
                           GBytes      **out_response_data,
                           GError      **error)
 {
-    GetResult *get_result;
+    GetResult *req_result;
 
     g_return_val_if_fail(NM_IS_HTTP_CLIENT(self), FALSE);
-    g_return_val_if_fail(nm_g_task_is_valid(result, self, nm_http_client_get), FALSE);
+    g_return_val_if_fail(nm_g_task_is_valid(result, self, nm_http_client_req), FALSE);
 
-    get_result = g_task_propagate_pointer(G_TASK(result), error);
+    req_result = g_task_propagate_pointer(G_TASK(result), error);
 
-    nm_assert(!error || (!!get_result) == (!*error));
+    nm_assert(!error || (!!req_result) == (!*error));
 
-    if (!get_result) {
+    if (!req_result) {
         NM_SET_OUT(out_response_code, -1);
         NM_SET_OUT(out_response_data, NULL);
         return FALSE;
     }
 
-    NM_SET_OUT(out_response_code, get_result->response_code);
+    NM_SET_OUT(out_response_code, req_result->response_code);
 
     /* response_data is binary, but is also guaranteed to be NUL terminated! */
-    NM_SET_OUT(out_response_data, g_steal_pointer(&get_result->response_data));
+    NM_SET_OUT(out_response_data, g_steal_pointer(&req_result->response_data));
 
-    _get_result_free(get_result);
+    _req_result_free(req_result);
     return TRUE;
 }
 
@@ -403,63 +407,65 @@ typedef struct {
     GTask                      *task;
     char                       *uri;
     const char *const          *http_headers;
-    NMHttpClientPollGetCheckFcn check_fcn;
+    const char                 *http_method;
+    NMHttpClientPollReqCheckFcn check_fcn;
     gpointer                    check_user_data;
     GBytes                     *response_data;
     gsize                       request_max_data;
     long                        response_code;
     int                         request_timeout_ms;
-} PollGetData;
+} PollReqData;
 
 static void
-_poll_get_data_free(gpointer data)
+_poll_req_data_free(gpointer data)
 {
-    PollGetData *poll_get_data = data;
+    PollReqData *poll_req_data = data;
 
-    g_free(poll_get_data->uri);
+    g_free(poll_req_data->uri);
 
-    nm_clear_pointer(&poll_get_data->response_data, g_bytes_unref);
-    g_strfreev((char **) poll_get_data->http_headers);
+    nm_clear_pointer(&poll_req_data->response_data, g_bytes_unref);
+    g_free((gpointer) poll_req_data->http_headers);
 
-    nm_g_slice_free(poll_get_data);
+    nm_g_slice_free(poll_req_data);
 }
 
 static void
-_poll_get_probe_start_fcn(GCancellable       *cancellable,
+_poll_req_probe_start_fcn(GCancellable       *cancellable,
                           gpointer            probe_user_data,
                           GAsyncReadyCallback callback,
                           gpointer            user_data)
 {
-    PollGetData *poll_get_data = probe_user_data;
+    PollReqData *poll_req_data = probe_user_data;
 
-    /* balanced by _poll_get_probe_finish_fcn() */
-    g_object_ref(poll_get_data->task);
+    /* balanced by _poll_req_probe_finish_fcn() */
+    g_object_ref(poll_req_data->task);
 
-    nm_http_client_get(g_task_get_source_object(poll_get_data->task),
-                       poll_get_data->uri,
-                       poll_get_data->request_timeout_ms,
-                       poll_get_data->request_max_data,
-                       poll_get_data->http_headers,
+    nm_http_client_req(g_task_get_source_object(poll_req_data->task),
+                       poll_req_data->uri,
+                       poll_req_data->request_timeout_ms,
+                       poll_req_data->request_max_data,
+                       poll_req_data->http_headers,
+                       poll_req_data->http_method,
                        cancellable,
                        callback,
                        user_data);
 }
 
 static gboolean
-_poll_get_probe_finish_fcn(GObject      *source,
+_poll_req_probe_finish_fcn(GObject      *source,
                            GAsyncResult *result,
                            gpointer      probe_user_data,
                            GError      **error)
 {
-    PollGetData                      *poll_get_data = probe_user_data;
+    PollReqData                      *poll_req_data = probe_user_data;
     _nm_unused gs_unref_object GTask *task =
-        poll_get_data->task; /* balance ref from _poll_get_probe_start_fcn() */
+        poll_req_data->task; /* balance ref from _poll_req_probe_start_fcn() */
     gboolean               success;
     gs_free_error GError  *local_error   = NULL;
     gs_unref_bytes GBytes *response_data = NULL;
     long                   response_code = -1;
 
-    success = nm_http_client_get_finish(g_task_get_source_object(poll_get_data->task),
+    success = nm_http_client_req_finish(g_task_get_source_object(poll_req_data->task),
                                         result,
                                         &response_code,
                                         &response_data,
@@ -476,10 +482,10 @@ _poll_get_probe_finish_fcn(GObject      *source,
         return FALSE;
     }
 
-    if (poll_get_data->check_fcn) {
-        success = poll_get_data->check_fcn(response_code,
+    if (poll_req_data->check_fcn) {
+        success = poll_req_data->check_fcn(response_code,
                                            response_data,
-                                           poll_get_data->check_user_data,
+                                           poll_req_data->check_user_data,
                                            &local_error);
     } else
         success = (response_code == 200);
@@ -494,15 +500,15 @@ _poll_get_probe_finish_fcn(GObject      *source,
         return FALSE;
     }
 
-    poll_get_data->response_code = response_code;
-    poll_get_data->response_data = g_steal_pointer(&response_data);
+    poll_req_data->response_code = response_code;
+    poll_req_data->response_data = g_steal_pointer(&response_data);
     return TRUE;
 }
 
 static void
-_poll_get_done_cb(GObject *source, GAsyncResult *result, gpointer user_data)
+_poll_req_done_cb(GObject *source, GAsyncResult *result, gpointer user_data)
 {
-    PollGetData          *poll_get_data = user_data;
+    PollReqData          *poll_req_data = user_data;
     gs_free_error GError *error         = NULL;
     gboolean              success;
 
@@ -511,29 +517,30 @@ _poll_get_done_cb(GObject *source, GAsyncResult *result, gpointer user_data)
     nm_assert((!!success) == (!error));
 
     if (error)
-        g_task_return_error(poll_get_data->task, g_steal_pointer(&error));
+        g_task_return_error(poll_req_data->task, g_steal_pointer(&error));
     else
-        g_task_return_boolean(poll_get_data->task, TRUE);
+        g_task_return_boolean(poll_req_data->task, TRUE);
 
-    g_object_unref(poll_get_data->task);
+    g_object_unref(poll_req_data->task);
 }
 
 void
-nm_http_client_poll_get(NMHttpClient               *self,
+nm_http_client_poll_req(NMHttpClient               *self,
                         const char                 *uri,
                         int                         request_timeout_ms,
                         gssize                      request_max_data,
                         int                         poll_timeout_ms,
                         int                         ratelimit_timeout_ms,
                         const char *const          *http_headers,
+                        const char                 *http_method,
                         GCancellable               *cancellable,
-                        NMHttpClientPollGetCheckFcn check_fcn,
+                        NMHttpClientPollReqCheckFcn check_fcn,
                         gpointer                    check_user_data,
                         GAsyncReadyCallback         callback,
                         gpointer                    user_data)
 {
     nm_auto_pop_gmaincontext GMainContext *context = NULL;
-    PollGetData                           *poll_get_data;
+    PollReqData                           *poll_req_data;
 
     g_return_if_fail(NM_IS_HTTP_CLIENT(self));
     g_return_if_fail(uri && uri[0]);
@@ -543,21 +550,27 @@ nm_http_client_poll_get(NMHttpClient               *self,
     g_return_if_fail(ratelimit_timeout_ms >= -1);
     g_return_if_fail(!cancellable || G_CANCELLABLE(cancellable));
 
-    poll_get_data  = g_slice_new(PollGetData);
-    *poll_get_data = (PollGetData){
-        .task = nm_g_task_new(self, cancellable, nm_http_client_poll_get, callback, user_data),
+    poll_req_data  = g_slice_new(PollReqData);
+    *poll_req_data = (PollReqData){
+        .task = nm_g_task_new(self, cancellable, nm_http_client_poll_req, callback, user_data),
         .uri  = g_strdup(uri),
         .request_timeout_ms = request_timeout_ms,
         .request_max_data   = request_max_data,
         .check_fcn          = check_fcn,
         .check_user_data    = check_user_data,
         .response_code      = -1,
-        .http_headers       = NM_CAST_STRV_CC(g_strdupv((char **) http_headers)),
+        .http_headers       = NULL,
+        .http_method        = http_method,
     };
 
-    nmcs_wait_for_objects_register(poll_get_data->task);
+    if (http_headers) {
+        poll_req_data->http_headers =
+            nm_strv_dup_packed(http_headers, -1) ?: g_new(const char *, 1);
+    }
+
+    nmcs_wait_for_objects_register(poll_req_data->task);
 
-    g_task_set_task_data(poll_get_data->task, poll_get_data, _poll_get_data_free);
+    g_task_set_task_data(poll_req_data->task, poll_req_data, _poll_req_data_free);
 
     context =
         nm_g_main_context_push_thread_default_if_necessary(nm_http_client_get_main_context(self));
@@ -565,28 +578,28 @@ nm_http_client_poll_get(NMHttpClient               *self,
     nmcs_utils_poll(poll_timeout_ms,
                     ratelimit_timeout_ms,
                     0,
-                    _poll_get_probe_start_fcn,
-                    _poll_get_probe_finish_fcn,
-                    poll_get_data,
+                    _poll_req_probe_start_fcn,
+                    _poll_req_probe_finish_fcn,
+                    poll_req_data,
                     cancellable,
-                    _poll_get_done_cb,
-                    poll_get_data);
+                    _poll_req_done_cb,
+                    poll_req_data);
 }
 
 gboolean
-nm_http_client_poll_get_finish(NMHttpClient *self,
+nm_http_client_poll_req_finish(NMHttpClient *self,
                                GAsyncResult *result,
                                long         *out_response_code,
                                GBytes      **out_response_data,
                                GError      **error)
 {
-    PollGetData          *poll_get_data;
+    PollReqData          *poll_req_data;
     GTask                *task;
     gboolean              success;
     gs_free_error GError *local_error = NULL;
 
     g_return_val_if_fail(NM_HTTP_CLIENT(self), FALSE);
-    g_return_val_if_fail(nm_g_task_is_valid(result, self, nm_http_client_poll_get), FALSE);
+    g_return_val_if_fail(nm_g_task_is_valid(result, self, nm_http_client_poll_req), FALSE);
 
     task = G_TASK(result);
 
@@ -601,10 +614,10 @@ nm_http_client_poll_get_finish(NMHttpClient *self,
         return FALSE;
     }
 
-    poll_get_data = g_task_get_task_data(task);
+    poll_req_data = g_task_get_task_data(task);
 
-    NM_SET_OUT(out_response_code, poll_get_data->response_code);
-    NM_SET_OUT(out_response_data, g_steal_pointer(&poll_get_data->response_data));
+    NM_SET_OUT(out_response_code, poll_req_data->response_code);
+    NM_SET_OUT(out_response_data, g_steal_pointer(&poll_req_data->response_data));
     return TRUE;
 }
 
diff --git a/src/nm-cloud-setup/nm-http-client.h b/src/nm-cloud-setup/nm-http-client.h
index b041e99f..60310340 100644
--- a/src/nm-cloud-setup/nm-http-client.h
+++ b/src/nm-cloud-setup/nm-http-client.h
@@ -28,40 +28,26 @@ GMainContext *nm_http_client_get_main_context(NMHttpClient *self);
 
 /*****************************************************************************/
 
-void nm_http_client_get(NMHttpClient       *self,
-                        const char         *uri,
-                        int                 timeout_msec,
-                        gssize              max_data,
-                        const char *const  *http_headers,
-                        GCancellable       *cancellable,
-                        GAsyncReadyCallback callback,
-                        gpointer            user_data);
-
-gboolean nm_http_client_get_finish(NMHttpClient *self,
-                                   GAsyncResult *result,
-                                   long         *out_response_code,
-                                   GBytes      **out_response_data,
-                                   GError      **error);
-
-typedef gboolean (*NMHttpClientPollGetCheckFcn)(long     response_code,
+typedef gboolean (*NMHttpClientPollReqCheckFcn)(long     response_code,
                                                 GBytes  *response_data,
                                                 gpointer check_user_data,
                                                 GError **error);
 
-void nm_http_client_poll_get(NMHttpClient               *self,
+void nm_http_client_poll_req(NMHttpClient               *self,
                              const char                 *uri,
                              int                         request_timeout_ms,
                              gssize                      request_max_data,
                              int                         poll_timeout_ms,
                              int                         ratelimit_timeout_ms,
                              const char *const          *http_headers,
+                             const char                 *http_method,
                              GCancellable               *cancellable,
-                             NMHttpClientPollGetCheckFcn check_fcn,
+                             NMHttpClientPollReqCheckFcn check_fcn,
                              gpointer                    check_user_data,
                              GAsyncReadyCallback         callback,
                              gpointer                    user_data);
 
-gboolean nm_http_client_poll_get_finish(NMHttpClient *self,
+gboolean nm_http_client_poll_req_finish(NMHttpClient *self,
                                         GAsyncResult *result,
                                         long         *out_response_code,
                                         GBytes      **out_response_data,
diff --git a/src/nm-cloud-setup/nmcs-provider-aliyun.c b/src/nm-cloud-setup/nmcs-provider-aliyun.c
index 4b109609..86ecd76b 100644
--- a/src/nm-cloud-setup/nmcs-provider-aliyun.c
+++ b/src/nm-cloud-setup/nmcs-provider-aliyun.c
@@ -77,7 +77,7 @@ _detect_get_meta_data_done_cb(GObject *source, GAsyncResult *result, gpointer us
     gs_free_error GError  *get_error = NULL;
     gs_free_error GError  *error     = NULL;
 
-    nm_http_client_poll_get_finish(NM_HTTP_CLIENT(source), result, NULL, NULL, &get_error);
+    nm_http_client_poll_req_finish(NM_HTTP_CLIENT(source), result, NULL, NULL, &get_error);
 
     if (nm_utils_error_is_cancelled(get_error)) {
         g_task_return_error(task, g_steal_pointer(&get_error));
@@ -104,13 +104,14 @@ detect(NMCSProvider *provider, GTask *task)
 
     http_client = nmcs_provider_get_http_client(provider);
 
-    nm_http_client_poll_get(http_client,
+    nm_http_client_poll_req(http_client,
                             (uri = _aliyun_uri_concat(NM_ALIYUN_API_VERSION "/meta-data/")),
                             HTTP_TIMEOUT_MS,
                             256 * 1024,
                             7000,
                             1000,
                             NULL,
+                            NULL,
                             g_task_get_cancellable(task),
                             NULL,
                             NULL,
@@ -144,7 +145,7 @@ _get_config_fetch_done_cb(NMHttpClient                   *http_client,
     gsize                  i;
     gsize                  len;
 
-    nm_http_client_poll_get_finish(http_client, result, NULL, &response, &error);
+    nm_http_client_poll_req_finish(http_client, result, NULL, &response, &error);
 
     if (nm_utils_error_is_cancelled(error))
         return;
@@ -302,7 +303,7 @@ _get_config_metadata_ready_cb(GObject *source, GAsyncResult *result, gpointer us
     GHashTableIter                 h_iter;
     NMHttpClient                  *http_client;
 
-    nm_http_client_poll_get_finish(NM_HTTP_CLIENT(source), result, NULL, NULL, &error);
+    nm_http_client_poll_req_finish(NM_HTTP_CLIENT(source), result, NULL, NULL, &error);
 
     if (nm_utils_error_is_cancelled(error))
         return;
@@ -356,7 +357,7 @@ _get_config_metadata_ready_cb(GObject *source, GAsyncResult *result, gpointer us
               v_mac_data->path);
 
         get_config_data->n_pending++;
-        nm_http_client_poll_get(
+        nm_http_client_poll_req(
             http_client,
             (uri1 = _aliyun_uri_interfaces(v_mac_data->path,
                                            NM_STR_HAS_SUFFIX(v_mac_data->path, "/") ? "" : "/",
@@ -366,6 +367,7 @@ _get_config_metadata_ready_cb(GObject *source, GAsyncResult *result, gpointer us
             10000,
             1000,
             NULL,
+            NULL,
             get_config_data->intern_cancellable,
             NULL,
             NULL,
@@ -373,7 +375,7 @@ _get_config_metadata_ready_cb(GObject *source, GAsyncResult *result, gpointer us
             config_iface_data);
 
         get_config_data->n_pending++;
-        nm_http_client_poll_get(
+        nm_http_client_poll_req(
             http_client,
             (uri2 = _aliyun_uri_interfaces(v_mac_data->path,
                                            NM_STR_HAS_SUFFIX(v_mac_data->path, "/") ? "" : "/",
@@ -383,6 +385,7 @@ _get_config_metadata_ready_cb(GObject *source, GAsyncResult *result, gpointer us
             10000,
             1000,
             NULL,
+            NULL,
             get_config_data->intern_cancellable,
             NULL,
             NULL,
@@ -390,7 +393,7 @@ _get_config_metadata_ready_cb(GObject *source, GAsyncResult *result, gpointer us
             config_iface_data);
 
         get_config_data->n_pending++;
-        nm_http_client_poll_get(
+        nm_http_client_poll_req(
             http_client,
             (uri3 = _aliyun_uri_interfaces(v_mac_data->path,
                                            NM_STR_HAS_SUFFIX(v_mac_data->path, "/") ? "" : "/",
@@ -400,6 +403,7 @@ _get_config_metadata_ready_cb(GObject *source, GAsyncResult *result, gpointer us
             10000,
             1000,
             NULL,
+            NULL,
             get_config_data->intern_cancellable,
             NULL,
             NULL,
@@ -407,7 +411,7 @@ _get_config_metadata_ready_cb(GObject *source, GAsyncResult *result, gpointer us
             config_iface_data);
 
         get_config_data->n_pending++;
-        nm_http_client_poll_get(
+        nm_http_client_poll_req(
             http_client,
             (uri4 = _aliyun_uri_interfaces(v_mac_data->path,
                                            NM_STR_HAS_SUFFIX(v_mac_data->path, "/") ? "" : "/",
@@ -417,6 +421,7 @@ _get_config_metadata_ready_cb(GObject *source, GAsyncResult *result, gpointer us
             10000,
             1000,
             NULL,
+            NULL,
             get_config_data->intern_cancellable,
             NULL,
             NULL,
@@ -424,7 +429,7 @@ _get_config_metadata_ready_cb(GObject *source, GAsyncResult *result, gpointer us
             config_iface_data);
 
         get_config_data->n_pending++;
-        nm_http_client_poll_get(
+        nm_http_client_poll_req(
             http_client,
             (uri5 = _aliyun_uri_interfaces(v_mac_data->path,
                                            NM_STR_HAS_SUFFIX(v_mac_data->path, "/") ? "" : "/",
@@ -434,6 +439,7 @@ _get_config_metadata_ready_cb(GObject *source, GAsyncResult *result, gpointer us
             10000,
             1000,
             NULL,
+            NULL,
             get_config_data->intern_cancellable,
             NULL,
             NULL,
@@ -524,13 +530,14 @@ get_config(NMCSProvider *provider, NMCSProviderGetConfigTaskData *get_config_dat
      * MAC addresses, then we poll until we see them. They might not yet be
      * around from the start...
      */
-    nm_http_client_poll_get(nmcs_provider_get_http_client(provider),
+    nm_http_client_poll_req(nmcs_provider_get_http_client(provider),
                             (uri = _aliyun_uri_interfaces()),
                             HTTP_TIMEOUT_MS,
                             256 * 1024,
                             15000,
                             1000,
                             NULL,
+                            NULL,
                             get_config_data->intern_cancellable,
                             _get_config_metadata_ready_check,
                             get_config_data,
diff --git a/src/nm-cloud-setup/nmcs-provider-azure.c b/src/nm-cloud-setup/nmcs-provider-azure.c
index b59235bf..69946f5c 100644
--- a/src/nm-cloud-setup/nmcs-provider-azure.c
+++ b/src/nm-cloud-setup/nmcs-provider-azure.c
@@ -42,7 +42,7 @@ _detect_get_meta_data_done_cb(GObject *source, GAsyncResult *result, gpointer us
     gs_free_error GError  *get_error = NULL;
     gs_free_error GError  *error     = NULL;
 
-    nm_http_client_poll_get_finish(NM_HTTP_CLIENT(source), result, NULL, NULL, &get_error);
+    nm_http_client_poll_req_finish(NM_HTTP_CLIENT(source), result, NULL, NULL, &get_error);
 
     if (nm_utils_error_is_cancelled(get_error)) {
         g_task_return_error(task, g_steal_pointer(&get_error));
@@ -69,13 +69,14 @@ detect(NMCSProvider *provider, GTask *task)
 
     http_client = nmcs_provider_get_http_client(provider);
 
-    nm_http_client_poll_get(http_client,
+    nm_http_client_poll_req(http_client,
                             (uri = _azure_uri_concat("/metadata/instance")),
                             HTTP_TIMEOUT_MS,
                             256 * 1024,
                             7000,
                             1000,
                             NM_MAKE_STRV(NM_AZURE_METADATA_HEADER),
+                            NULL,
                             g_task_get_cancellable(task),
                             NULL,
                             NULL,
@@ -121,7 +122,7 @@ _get_config_fetch_done_cb(NMHttpClient      *http_client,
     in_addr_t                       tmp_addr;
     int                             tmp_prefix = -1;
 
-    nm_http_client_poll_get_finish(http_client, result, NULL, &response, &error);
+    nm_http_client_poll_req_finish(http_client, result, NULL, &response, &error);
 
     if (nm_utils_error_is_cancelled(error))
         return;
@@ -241,7 +242,7 @@ _get_config_ips_prefix_list_cb(GObject *source, GAsyncResult *result, gpointer u
     gsize                          line_len;
     char                           iface_idx_str[30];
 
-    nm_http_client_poll_get_finish(NM_HTTP_CLIENT(source), result, NULL, &response, &error);
+    nm_http_client_poll_req_finish(NM_HTTP_CLIENT(source), result, NULL, &response, &error);
 
     if (nm_utils_error_is_cancelled(error))
         return;
@@ -283,7 +284,7 @@ _get_config_ips_prefix_list_cb(GObject *source, GAsyncResult *result, gpointer u
 
         iface_data->n_iface_data_pending++;
 
-        nm_http_client_poll_get(
+        nm_http_client_poll_req(
             NM_HTTP_CLIENT(source),
             (uri = _azure_uri_interfaces(iface_idx_str,
                                          "/ipv4/ipAddress/",
@@ -294,6 +295,7 @@ _get_config_ips_prefix_list_cb(GObject *source, GAsyncResult *result, gpointer u
             10000,
             1000,
             NM_MAKE_STRV(NM_AZURE_METADATA_HEADER),
+            NULL,
             get_config_data->intern_cancellable,
             NULL,
             NULL,
@@ -308,7 +310,7 @@ _get_config_ips_prefix_list_cb(GObject *source, GAsyncResult *result, gpointer u
         gs_free char *uri = NULL;
 
         iface_data->n_iface_data_pending++;
-        nm_http_client_poll_get(
+        nm_http_client_poll_req(
             NM_HTTP_CLIENT(source),
             (uri = _azure_uri_interfaces(iface_idx_str, "/ipv4/subnet/0/address/")),
             HTTP_TIMEOUT_MS,
@@ -316,6 +318,7 @@ _get_config_ips_prefix_list_cb(GObject *source, GAsyncResult *result, gpointer u
             10000,
             1000,
             NM_MAKE_STRV(NM_AZURE_METADATA_HEADER),
+            NULL,
             get_config_data->intern_cancellable,
             NULL,
             NULL,
@@ -325,7 +328,7 @@ _get_config_ips_prefix_list_cb(GObject *source, GAsyncResult *result, gpointer u
         nm_clear_g_free(&uri);
 
         iface_data->n_iface_data_pending++;
-        nm_http_client_poll_get(
+        nm_http_client_poll_req(
             NM_HTTP_CLIENT(source),
             (uri = _azure_uri_interfaces(iface_idx_str, "/ipv4/subnet/0/prefix/")),
             HTTP_TIMEOUT_MS,
@@ -333,6 +336,7 @@ _get_config_ips_prefix_list_cb(GObject *source, GAsyncResult *result, gpointer u
             10000,
             1000,
             NM_MAKE_STRV(NM_AZURE_METADATA_HEADER),
+            NULL,
             get_config_data->intern_cancellable,
             NULL,
             NULL,
@@ -357,7 +361,7 @@ _get_config_iface_cb(GObject *source, GAsyncResult *result, gpointer user_data)
     gs_free const char            *uri        = NULL;
     char                           buf[100];
 
-    nm_http_client_poll_get_finish(NM_HTTP_CLIENT(source), result, NULL, &response, &error);
+    nm_http_client_poll_req_finish(NM_HTTP_CLIENT(source), result, NULL, &response, &error);
 
     if (nm_utils_error_is_cancelled(error))
         return;
@@ -408,13 +412,14 @@ _get_config_iface_cb(GObject *source, GAsyncResult *result, gpointer user_data)
 
     nm_sprintf_buf(buf, "%" G_GSSIZE_FORMAT "/ipv4/ipAddress/", iface_data->intern_iface_idx);
 
-    nm_http_client_poll_get(NM_HTTP_CLIENT(source),
+    nm_http_client_poll_req(NM_HTTP_CLIENT(source),
                             (uri = _azure_uri_interfaces(buf)),
                             HTTP_TIMEOUT_MS,
                             512 * 1024,
                             10000,
                             1000,
                             NM_MAKE_STRV(NM_AZURE_METADATA_HEADER),
+                            NULL,
                             get_config_data->intern_cancellable,
                             NULL,
                             NULL,
@@ -441,7 +446,7 @@ _get_net_ifaces_list_cb(GObject *source, GAsyncResult *result, gpointer user_dat
     guint                          i;
     gssize                         extern_iface_idx_cnt = 0;
 
-    nm_http_client_poll_get_finish(NM_HTTP_CLIENT(source), result, NULL, &response, &error);
+    nm_http_client_poll_req_finish(NM_HTTP_CLIENT(source), result, NULL, &response, &error);
 
     if (nm_utils_error_is_cancelled(error))
         return;
@@ -508,13 +513,14 @@ _get_net_ifaces_list_cb(GObject *source, GAsyncResult *result, gpointer user_dat
         nm_sprintf_buf(buf, "%" G_GSSIZE_FORMAT "/macAddress", iface_data->intern_iface_idx);
 
         get_config_data->n_pending++;
-        nm_http_client_poll_get(NM_HTTP_CLIENT(source),
+        nm_http_client_poll_req(NM_HTTP_CLIENT(source),
                                 (uri = _azure_uri_interfaces(buf)),
                                 HTTP_TIMEOUT_MS,
                                 512 * 1024,
                                 10000,
                                 1000,
                                 NM_MAKE_STRV(NM_AZURE_METADATA_HEADER),
+                                NULL,
                                 get_config_data->intern_cancellable,
                                 NULL,
                                 NULL,
@@ -531,13 +537,14 @@ get_config(NMCSProvider *provider, NMCSProviderGetConfigTaskData *get_config_dat
 {
     gs_free const char *uri = NULL;
 
-    nm_http_client_poll_get(nmcs_provider_get_http_client(provider),
+    nm_http_client_poll_req(nmcs_provider_get_http_client(provider),
                             (uri = _azure_uri_interfaces()),
                             HTTP_TIMEOUT_MS,
                             256 * 1024,
                             15000,
                             1000,
                             NM_MAKE_STRV(NM_AZURE_METADATA_HEADER),
+                            NULL,
                             get_config_data->intern_cancellable,
                             NULL,
                             NULL,
diff --git a/src/nm-cloud-setup/nmcs-provider-ec2.c b/src/nm-cloud-setup/nmcs-provider-ec2.c
index 58d691c7..65a8f629 100644
--- a/src/nm-cloud-setup/nmcs-provider-ec2.c
+++ b/src/nm-cloud-setup/nmcs-provider-ec2.c
@@ -16,6 +16,11 @@
 #define NM_EC2_METADATA_URL_BASE /* $NM_EC2_BASE/$NM_EC2_API_VERSION */ \
     "/meta-data/network/interfaces/macs/"
 
+/* Token TTL of 180 seconds is chosen abitrarily, in hope that it is
+ * surely more than enough to read all relevant metadata. */
+#define NM_EC2_TOKEN_TTL_HEADER "X-aws-ec2-metadata-token-ttl-seconds: 180"
+#define NM_EC2_TOKEN_HEADER     "X-aws-ec2-metadata-token: "
+
 static const char *
 _ec2_base(void)
 {
@@ -44,8 +49,15 @@ again:
 
 /*****************************************************************************/
 
+enum {
+    NM_EC2_HTTP_HEADER_TOKEN,
+    NM_EC2_HTTP_HEADER_SENTINEL,
+    _NM_EC2_HTTP_HEADER_NUM,
+};
+
 struct _NMCSProviderEC2 {
     NMCSProvider parent;
+    char        *token;
 };
 
 struct _NMCSProviderEC2Class {
@@ -56,23 +68,18 @@ G_DEFINE_TYPE(NMCSProviderEC2, nmcs_provider_ec2, NMCS_TYPE_PROVIDER);
 
 /*****************************************************************************/
 
-static gboolean
-_detect_get_meta_data_check_cb(long     response_code,
-                               GBytes  *response,
-                               gpointer check_user_data,
-                               GError **error)
-{
-    return response_code == 200 && nmcs_utils_parse_get_full_line(response, "ami-id");
-}
-
 static void
-_detect_get_meta_data_done_cb(GObject *source, GAsyncResult *result, gpointer user_data)
+_detect_get_token_done_cb(GObject *source, GAsyncResult *result, gpointer user_data)
 {
     gs_unref_object GTask *task      = user_data;
+    NMCSProviderEC2       *self      = NMCS_PROVIDER_EC2(g_task_get_source_object(task));
+    gs_unref_bytes GBytes *response  = NULL;
     gs_free_error GError  *get_error = NULL;
     gs_free_error GError  *error     = NULL;
 
-    nm_http_client_poll_get_finish(NM_HTTP_CLIENT(source), result, NULL, NULL, &get_error);
+    nm_clear_g_free(&self->token);
+
+    nm_http_client_poll_req_finish(NM_HTTP_CLIENT(source), result, NULL, &response, &get_error);
 
     if (nm_utils_error_is_cancelled(get_error)) {
         g_task_return_error(task, g_steal_pointer(&get_error));
@@ -88,6 +95,12 @@ _detect_get_meta_data_done_cb(GObject *source, GAsyncResult *result, gpointer us
         return;
     }
 
+    /* We use the token as-is. Special characters can cause confusion (e.g.
+     * response splitting), but we're not crossing a security boundary.
+     * None of the examples in AWS documentation does any sort of
+     * sanitization either.  */
+    self->token = g_strconcat(NM_EC2_TOKEN_HEADER, g_bytes_get_data(response, NULL), NULL);
+
     g_task_return_boolean(task, TRUE);
 }
 
@@ -99,17 +112,18 @@ detect(NMCSProvider *provider, GTask *task)
 
     http_client = nmcs_provider_get_http_client(provider);
 
-    nm_http_client_poll_get(http_client,
-                            (uri = _ec2_uri_concat("latest/meta-data/")),
+    nm_http_client_poll_req(http_client,
+                            (uri = _ec2_uri_concat("latest/api/token")),
                             HTTP_TIMEOUT_MS,
                             256 * 1024,
                             7000,
                             1000,
-                            NULL,
+                            NM_MAKE_STRV(NM_EC2_TOKEN_TTL_HEADER),
+                            "PUT",
                             g_task_get_cancellable(task),
-                            _detect_get_meta_data_check_cb,
                             NULL,
-                            _detect_get_meta_data_done_cb,
+                            NULL,
+                            _detect_get_token_done_cb,
                             task);
 }
 
@@ -126,7 +140,7 @@ _get_config_fetch_done_cb(NMHttpClient                   *http_client,
     in_addr_t              tmp_addr;
     int                    tmp_prefix;
 
-    nm_http_client_poll_get_finish(http_client, result, NULL, &response, &error);
+    nm_http_client_poll_req_finish(http_client, result, NULL, &response, &error);
 
     if (nm_utils_error_is_cancelled(error))
         return;
@@ -197,6 +211,7 @@ static void
 _get_config_metadata_ready_cb(GObject *source, GAsyncResult *result, gpointer user_data)
 {
     NMCSProviderGetConfigTaskData *get_config_data;
+    NMCSProviderEC2               *self;
     gs_unref_hashtable GHashTable *response_parsed = NULL;
     gs_free_error GError          *error           = NULL;
     GetConfigMetadataMac          *v_mac_data;
@@ -204,12 +219,13 @@ _get_config_metadata_ready_cb(GObject *source, GAsyncResult *result, gpointer us
     GHashTableIter                 h_iter;
     NMHttpClient                  *http_client;
 
-    nm_http_client_poll_get_finish(NM_HTTP_CLIENT(source), result, NULL, NULL, &error);
+    nm_http_client_poll_req_finish(NM_HTTP_CLIENT(source), result, NULL, NULL, &error);
 
     if (nm_utils_error_is_cancelled(error))
         return;
 
     get_config_data = user_data;
+    self            = NMCS_PROVIDER_EC2(get_config_data->self);
 
     response_parsed                     = g_steal_pointer(&get_config_data->extra_data);
     get_config_data->extra_data_destroy = NULL;
@@ -254,7 +270,7 @@ _get_config_metadata_ready_cb(GObject *source, GAsyncResult *result, gpointer us
               v_mac_data->path);
 
         get_config_data->n_pending++;
-        nm_http_client_poll_get(
+        nm_http_client_poll_req(
             http_client,
             (uri1 = _ec2_uri_interfaces(v_mac_data->path,
                                         NM_STR_HAS_SUFFIX(v_mac_data->path, "/") ? "" : "/",
@@ -263,6 +279,7 @@ _get_config_metadata_ready_cb(GObject *source, GAsyncResult *result, gpointer us
             512 * 1024,
             10000,
             1000,
+            NM_MAKE_STRV(self->token),
             NULL,
             get_config_data->intern_cancellable,
             NULL,
@@ -271,7 +288,7 @@ _get_config_metadata_ready_cb(GObject *source, GAsyncResult *result, gpointer us
             config_iface_data);
 
         get_config_data->n_pending++;
-        nm_http_client_poll_get(
+        nm_http_client_poll_req(
             http_client,
             (uri2 = _ec2_uri_interfaces(v_mac_data->path,
                                         NM_STR_HAS_SUFFIX(v_mac_data->path, "/") ? "" : "/",
@@ -280,6 +297,7 @@ _get_config_metadata_ready_cb(GObject *source, GAsyncResult *result, gpointer us
             512 * 1024,
             10000,
             1000,
+            NM_MAKE_STRV(self->token),
             NULL,
             get_config_data->intern_cancellable,
             NULL,
@@ -365,18 +383,25 @@ _get_config_metadata_ready_check(long     response_code,
 static void
 get_config(NMCSProvider *provider, NMCSProviderGetConfigTaskData *get_config_data)
 {
-    gs_free char *uri = NULL;
+    NMCSProviderEC2 *self = NMCS_PROVIDER_EC2(provider);
+    gs_free char    *uri  = NULL;
+
+    /* This can be called only if detect() succeeded, which implies
+     * there must be a token.
+     */
+    nm_assert(self->token);
 
     /* First we fetch the "macs/". If the caller requested some particular
      * MAC addresses, then we poll until we see them. They might not yet be
      * around from the start...
      */
-    nm_http_client_poll_get(nmcs_provider_get_http_client(provider),
+    nm_http_client_poll_req(nmcs_provider_get_http_client(provider),
                             (uri = _ec2_uri_interfaces()),
                             HTTP_TIMEOUT_MS,
                             256 * 1024,
                             15000,
                             1000,
+                            NM_MAKE_STRV(self->token),
                             NULL,
                             get_config_data->intern_cancellable,
                             _get_config_metadata_ready_check,
@@ -392,10 +417,23 @@ nmcs_provider_ec2_init(NMCSProviderEC2 *self)
 {}
 
 static void
+dispose(GObject *object)
+{
+    NMCSProviderEC2 *self = NMCS_PROVIDER_EC2(object);
+
+    nm_clear_g_free(&self->token);
+
+    G_OBJECT_CLASS(nmcs_provider_ec2_parent_class)->dispose(object);
+}
+
+static void
 nmcs_provider_ec2_class_init(NMCSProviderEC2Class *klass)
 {
+    GObjectClass      *object_class   = G_OBJECT_CLASS(klass);
     NMCSProviderClass *provider_class = NMCS_PROVIDER_CLASS(klass);
 
+    object_class->dispose = dispose;
+
     provider_class->_name                 = "ec2";
     provider_class->_env_provider_enabled = NMCS_ENV_VARIABLE("NM_CLOUD_SETUP_EC2");
     provider_class->detect                = detect;
diff --git a/src/nm-cloud-setup/nmcs-provider-gcp.c b/src/nm-cloud-setup/nmcs-provider-gcp.c
index a325f31a..ca354865 100644
--- a/src/nm-cloud-setup/nmcs-provider-gcp.c
+++ b/src/nm-cloud-setup/nmcs-provider-gcp.c
@@ -45,7 +45,7 @@ _detect_get_meta_data_done_cb(GObject *source, GAsyncResult *result, gpointer us
     gs_free_error GError  *get_error = NULL;
     gs_free_error GError  *error     = NULL;
 
-    nm_http_client_poll_get_finish(NM_HTTP_CLIENT(source), result, NULL, NULL, &get_error);
+    nm_http_client_poll_req_finish(NM_HTTP_CLIENT(source), result, NULL, NULL, &get_error);
 
     if (nm_utils_error_is_cancelled(get_error)) {
         g_task_return_error(task, g_steal_pointer(&get_error));
@@ -72,13 +72,14 @@ detect(NMCSProvider *provider, GTask *task)
 
     http_client = nmcs_provider_get_http_client(provider);
 
-    nm_http_client_poll_get(http_client,
+    nm_http_client_poll_req(http_client,
                             (uri = _gcp_uri_concat("id")),
                             HTTP_TIMEOUT_MS,
                             256 * 1024,
                             7000,
                             1000,
                             NM_MAKE_STRV(NM_GCP_METADATA_HEADER),
+                            NULL,
                             g_task_get_cancellable(task),
                             NULL,
                             NULL,
@@ -114,7 +115,7 @@ _get_config_fip_cb(GObject *source, GAsyncResult *result, gpointer user_data)
     NMIPRoute                     **routes_arr;
     NMIPRoute                      *route_new;
 
-    nm_http_client_poll_get_finish(NM_HTTP_CLIENT(source), result, NULL, &response, &error);
+    nm_http_client_poll_req_finish(NM_HTTP_CLIENT(source), result, NULL, &response, &error);
 
     if (nm_utils_error_is_cancelled(error))
         return;
@@ -171,7 +172,7 @@ _get_config_ips_list_cb(GObject *source, GAsyncResult *result, gpointer user_dat
     gsize                          line_len;
     guint                          i;
 
-    nm_http_client_poll_get_finish(NM_HTTP_CLIENT(source), result, NULL, &response, &error);
+    nm_http_client_poll_req_finish(NM_HTTP_CLIENT(source), result, NULL, &response, &error);
 
     if (nm_utils_error_is_cancelled(error))
         return;
@@ -220,13 +221,14 @@ _get_config_ips_list_cb(GObject *source, GAsyncResult *result, gpointer user_dat
         const char         *str = uri_arr->pdata[i];
         gs_free const char *uri = NULL;
 
-        nm_http_client_poll_get(NM_HTTP_CLIENT(source),
+        nm_http_client_poll_req(NM_HTTP_CLIENT(source),
                                 (uri = _gcp_uri_interfaces(str)),
                                 HTTP_TIMEOUT_MS,
                                 HTTP_REQ_MAX_DATA,
                                 HTTP_POLL_TIMEOUT_MS,
                                 HTTP_RATE_LIMIT_MS,
                                 NM_MAKE_STRV(NM_GCP_METADATA_HEADER),
+                                NULL,
                                 get_config_data->intern_cancellable,
                                 NULL,
                                 NULL,
@@ -252,7 +254,7 @@ _get_config_iface_cb(GObject *source, GAsyncResult *result, gpointer user_data)
     NMCSProviderGetConfigTaskData *get_config_data;
     gboolean                       is_requested;
 
-    nm_http_client_poll_get_finish(NM_HTTP_CLIENT(source), result, NULL, &response, &error);
+    nm_http_client_poll_req_finish(NM_HTTP_CLIENT(source), result, NULL, &response, &error);
 
     if (nm_utils_error_is_cancelled(error))
         return;
@@ -306,13 +308,14 @@ _get_config_iface_cb(GObject *source, GAsyncResult *result, gpointer user_data)
 
     nm_sprintf_buf(sbuf, "%" G_GSSIZE_FORMAT "/forwarded-ips/", iface_data->intern_iface_idx);
 
-    nm_http_client_poll_get(NM_HTTP_CLIENT(source),
+    nm_http_client_poll_req(NM_HTTP_CLIENT(source),
                             (uri = _gcp_uri_interfaces(sbuf)),
                             HTTP_TIMEOUT_MS,
                             HTTP_REQ_MAX_DATA,
                             HTTP_POLL_TIMEOUT_MS,
                             HTTP_RATE_LIMIT_MS,
                             NM_MAKE_STRV(NM_GCP_METADATA_HEADER),
+                            NULL,
                             get_config_data->intern_cancellable,
                             NULL,
                             NULL,
@@ -339,7 +342,7 @@ _get_net_ifaces_list_cb(GObject *source, GAsyncResult *result, gpointer user_dat
     guint                          i;
     gssize                         extern_iface_idx_cnt = 0;
 
-    nm_http_client_poll_get_finish(NM_HTTP_CLIENT(source), result, NULL, &response, &error);
+    nm_http_client_poll_req_finish(NM_HTTP_CLIENT(source), result, NULL, &response, &error);
 
     if (nm_utils_error_is_cancelled(error))
         return;
@@ -405,13 +408,14 @@ _get_net_ifaces_list_cb(GObject *source, GAsyncResult *result, gpointer user_dat
         nm_sprintf_buf(sbuf, "%" G_GSSIZE_FORMAT "/mac", data->intern_iface_idx);
 
         get_config_data->n_pending++;
-        nm_http_client_poll_get(NM_HTTP_CLIENT(source),
+        nm_http_client_poll_req(NM_HTTP_CLIENT(source),
                                 (uri = _gcp_uri_interfaces(sbuf)),
                                 HTTP_TIMEOUT_MS,
                                 HTTP_REQ_MAX_DATA,
                                 HTTP_POLL_TIMEOUT_MS,
                                 HTTP_RATE_LIMIT_MS,
                                 NM_MAKE_STRV(NM_GCP_METADATA_HEADER),
+                                NULL,
                                 get_config_data->intern_cancellable,
                                 NULL,
                                 NULL,
@@ -428,13 +432,14 @@ get_config(NMCSProvider *provider, NMCSProviderGetConfigTaskData *get_config_dat
 {
     gs_free const char *uri = NULL;
 
-    nm_http_client_poll_get(nmcs_provider_get_http_client(provider),
+    nm_http_client_poll_req(nmcs_provider_get_http_client(provider),
                             (uri = _gcp_uri_interfaces()),
                             HTTP_TIMEOUT_MS,
                             HTTP_REQ_MAX_DATA,
                             HTTP_POLL_TIMEOUT_MS,
                             HTTP_RATE_LIMIT_MS,
                             NM_MAKE_STRV(NM_GCP_METADATA_HEADER),
+                            NULL,
                             get_config_data->intern_cancellable,
                             NULL,
                             NULL,
diff --git a/src/nm-cloud-setup/nmcs-provider.h b/src/nm-cloud-setup/nmcs-provider.h
index 994b1e24..09cdb414 100644
--- a/src/nm-cloud-setup/nmcs-provider.h
+++ b/src/nm-cloud-setup/nmcs-provider.h
@@ -152,8 +152,36 @@ typedef struct {
     const char  *_name;
     const char  *_env_provider_enabled;
 
+    /**
+     * detect:
+     * @self: the #NMCSProvider
+     * @task: a #GTask that's completed when the detection finishes.
+     *
+     * Checks whether the metadata of a particular cloud provider is
+     * accessible on the host machine. The check runs asynchronously.
+     *
+     * When the check finishes, @task is completed. If the check was
+     * successful, @task returns a gboolean of %TRUE. Otherwise
+     * a %FALSE value or an error is returned.
+     *
+     * The routine has to be called before the get_config() can be
+     * used.
+     */
     void (*detect)(NMCSProvider *self, GTask *task);
 
+    /**
+     * get_config:
+     * @self: the #NMCSProvider
+     * @get_config_data: encapsulates a #GTask and network configuration data
+     *
+     * Collects the network configuration from metadata service of a
+     * particular cloud provider. The metadata is traversed and checked
+     * asynchronously, completing a task encapsulated in @get_config_data
+     * upon finishing.
+     *
+     * Call to detect() with a successful result is necessary before
+     * using this routine.
+     */
     void (*get_config)(NMCSProvider *self, NMCSProviderGetConfigTaskData *get_config_data);
 
 } NMCSProviderClass;
diff --git a/src/nmcli/devices.c b/src/nmcli/devices.c
index c160fff6..d408b47f 100644
--- a/src/nmcli/devices.c
+++ b/src/nmcli/devices.c
@@ -17,6 +17,7 @@
 #include <linux/if_ether.h>
 
 #include "libnm-glib-aux/nm-secret-utils.h"
+#include "libnm-glib-aux/nm-random-utils.h"
 #include "common.h"
 #include "connections.h"
 #include "libnmc-base/nm-client-utils.h"
@@ -4090,7 +4091,7 @@ generate_ssid_for_hotspot(void)
     return ssid_bytes;
 }
 
-#define WPA_PASSKEY_SIZE 8
+#define WPA_PASSKEY_SIZE 12
 static void
 generate_wpa_key(char *key, size_t len)
 {
@@ -4099,13 +4100,14 @@ generate_wpa_key(char *key, size_t len)
     g_return_if_fail(key);
     g_return_if_fail(len > WPA_PASSKEY_SIZE);
 
-    /* generate a 8-chars ASCII WPA key */
     for (i = 0; i < WPA_PASSKEY_SIZE; i++) {
         int c;
-        c = g_random_int_range(33, 126);
-        /* too many non alphanumeric characters are hard to remember for humans */
-        while (!g_ascii_isalnum(c))
-            c = g_random_int_range(33, 126);
+
+        do {
+            c = nm_random_u64_range_full(48, 122, TRUE);
+            /* skip characters that look similar */
+        } while (NM_IN_SET(c, '1', 'l', 'I', '0', 'O', 'Q', '8', 'B', '5', 'S')
+                 || !g_ascii_isalnum(c));
 
         key[i] = (char) c;
     }
@@ -4124,7 +4126,8 @@ generate_wep_key(char *key, size_t len)
     /* generate a 10-digit hex WEP key */
     for (i = 0; i < 10; i++) {
         int digit;
-        digit  = g_random_int_range(0, 16);
+
+        digit  = nm_random_u64_range_full(0, 16, TRUE);
         key[i] = hexdigits[digit];
     }
     key[10] = '\0';
@@ -4138,7 +4141,7 @@ set_wireless_security_for_hotspot(NMSettingWirelessSecurity *s_wsec,
                                   gboolean                   show_password,
                                   GError                   **error)
 {
-    char        generated_key[11];
+    char        generated_key[20];
     const char *key;
     const char *key_mgmt;
 
@@ -4264,6 +4267,8 @@ create_hotspot_conn(const GPtrArray *connections,
     NMSettingIPConfig         *s_ip4, *s_ip6;
     NMSettingProxy            *s_proxy;
 
+    nm_assert(channel_int == -1 || band);
+
     connection = nm_simple_connection_new();
     s_con      = (NMSettingConnection *) nm_setting_connection_new();
     nm_connection_add_setting(connection, NM_SETTING(s_con));
@@ -4294,6 +4299,8 @@ create_hotspot_conn(const GPtrArray *connections,
                      NM_SETTING_WIRELESS_BAND,
                      band,
                      NULL);
+    } else if (band) {
+        g_object_set(s_wifi, NM_SETTING_WIRELESS_BAND, band, NULL);
     }
 
     s_wsec = (NMSettingWirelessSecurity *) nm_setting_wireless_security_new();
@@ -4439,13 +4446,6 @@ do_device_wifi_hotspot(const NMCCommand *cmd, NmCli *nmc, int argc, const char *
     if (nmc->complete)
         return;
 
-    /* Verify band and channel parameters */
-    if (!channel) {
-        if (g_strcmp0(band, "bg") == 0)
-            channel = "1";
-        if (g_strcmp0(band, "a") == 0)
-            channel = "7";
-    }
     if (channel) {
         unsigned long int value;
 
diff --git a/src/nmcli/gen-metadata-nm-settings-nmcli.xml.in b/src/nmcli/gen-metadata-nm-settings-nmcli.xml.in
index dfea3c34..a3409afb 100644
--- a/src/nmcli/gen-metadata-nm-settings-nmcli.xml.in
+++ b/src/nmcli/gen-metadata-nm-settings-nmcli.xml.in
@@ -640,7 +640,7 @@
         <property name="output-key"
                   description="The key used for tunnel output packets; the property is valid only for certain tunnel modes (GRE, IP6GRE). If empty, no key is used." />
         <property name="encapsulation-limit"
-                  description="How many additional levels of encapsulation are permitted to be prepended to packets. This property applies only to IPv6 tunnels." />
+                  description="How many additional levels of encapsulation are permitted to be prepended to packets. This property applies only to IPv6 tunnels. To disable this option, add NM_IP_TUNNEL_FLAG_IP6_IGN_ENCAP_LIMIT (0x1) to ip-tunnel flags." />
         <property name="flow-label"
                   description="The flow label to assign to tunnel packets. This property applies only to IPv6 tunnels." />
         <property name="fwmark"
@@ -658,7 +658,7 @@
         <property name="dns-search"
                   description="List of DNS search domains. Domains starting with a tilde (&apos;~&apos;) are considered &apos;routing&apos; domains and are used only to decide the interface over which a query must be forwarded; they are not used to complete unqualified host names. When using a DNS plugin that supports Conditional Forwarding or Split DNS, then the search domains specify which name servers to query. This makes the behavior different from running with plain /etc/resolv.conf. For more information see also the dns-priority setting. When set on a profile that also enabled DHCP, the DNS search list received automatically (option 119 for DHCPv4 and option 24 for DHCPv6) gets merged with the manual list. This can be prevented by setting &quot;ignore-auto-dns&quot;. Note that if no DNS searches are configured, the fallback will be derived from the domain from DHCP (option 15)." />
         <property name="dns-options"
-                  description="Array of DNS options as described in man 5 resolv.conf. NULL means that the options are unset and left at the default. In this case NetworkManager will use default options. This is distinct from an empty list of properties. The currently supported options are &quot;attempts&quot;, &quot;debug&quot;, &quot;edns0&quot;, &quot;inet6&quot;, &quot;ip6-bytestring&quot;, &quot;ip6-dotint&quot;, &quot;ndots&quot;, &quot;no-check-names&quot;, &quot;no-ip6-dotint&quot;, &quot;no-reload&quot;, &quot;no-tld-query&quot;, &quot;rotate&quot;, &quot;single-request&quot;, &quot;single-request-reopen&quot;, &quot;timeout&quot;, &quot;trust-ad&quot;, &quot;use-vc&quot;. The &quot;trust-ad&quot; setting is only honored if the profile contributes name servers to resolv.conf, and if all contributing profiles have &quot;trust-ad&quot; enabled. When using a caching DNS plugin (dnsmasq or systemd-resolved in NetworkManager.conf) then &quot;edns0&quot; and &quot;trust-ad&quot; are automatically added." />
+                  description="Array of DNS options as described in man 5 resolv.conf. NULL means that the options are unset and left at the default. In this case NetworkManager will use default options. This is distinct from an empty list of properties. The currently supported options are &quot;attempts&quot;, &quot;debug&quot;, &quot;edns0&quot;, &quot;inet6&quot;, &quot;ip6-bytestring&quot;, &quot;ip6-dotint&quot;, &quot;ndots&quot;, &quot;no-aaaa&quot;, &quot;no-check-names&quot;, &quot;no-ip6-dotint&quot;, &quot;no-reload&quot;, &quot;no-tld-query&quot;, &quot;rotate&quot;, &quot;single-request&quot;, &quot;single-request-reopen&quot;, &quot;timeout&quot;, &quot;trust-ad&quot;, &quot;use-vc&quot;. The &quot;trust-ad&quot; setting is only honored if the profile contributes name servers to resolv.conf, and if all contributing profiles have &quot;trust-ad&quot; enabled. When using a caching DNS plugin (dnsmasq or systemd-resolved in NetworkManager.conf) then &quot;edns0&quot; and &quot;trust-ad&quot; are automatically added." />
         <property name="dns-priority"
                   description="DNS servers priority. The relative priority for DNS servers specified by this setting.  A lower numerical value is better (higher priority). Negative values have the special effect of excluding other configurations with a greater numerical priority value; so in presence of at least one negative priority, only DNS servers from connections with the lowest priority value will be used. To avoid all DNS leaks, set the priority of the profile that should be used to the most negative value of all active connections profiles. Zero selects a globally configured default value. If the latter is missing or zero too, it defaults to 50 for VPNs (including WireGuard) and 100 for other connections. Note that the priority is to order DNS settings for multiple active connections.  It does not disambiguate multiple DNS servers within the same connection profile. When multiple devices have configurations with the same priority, VPNs will be considered first, then devices with the best (lowest metric) default route and then all other devices. When using dns=default, servers with higher priority will be on top of resolv.conf. To prioritize a given server over another one within the same connection, just specify them in the desired order. Note that commonly the resolver tries name servers in /etc/resolv.conf in the order listed, proceeding with the next server in the list on failure. See for example the &quot;rotate&quot; option of the dns-options setting. If there are any negative DNS priorities, then only name servers from the devices with that lowest priority will be considered. When using a DNS resolver that supports Conditional Forwarding or Split DNS (with dns=dnsmasq or dns=systemd-resolved settings), each connection is used to query domains in its search list. The search domains determine which name servers to ask, and the DNS priority is used to prioritize name servers based on the domain.  Queries for domains not present in any search list are routed through connections having the &apos;~.&apos; special wildcard domain, which is added automatically to connections with the default route (or can be added manually).  When multiple connections specify the same domain, the one with the best priority (lowest numerical value) wins.  If a sub domain is configured on another interface it will be accepted regardless the priority, unless parent domain on the other interface has a negative priority, which causes the sub domain to be shadowed. With Split DNS one can avoid undesired DNS leaks by properly configuring DNS priorities and the search domains, so that only name servers of the desired interface are configured." />
         <property name="addresses"
@@ -719,7 +719,7 @@
         <property name="dns-search"
                   description="List of DNS search domains. Domains starting with a tilde (&apos;~&apos;) are considered &apos;routing&apos; domains and are used only to decide the interface over which a query must be forwarded; they are not used to complete unqualified host names. When using a DNS plugin that supports Conditional Forwarding or Split DNS, then the search domains specify which name servers to query. This makes the behavior different from running with plain /etc/resolv.conf. For more information see also the dns-priority setting. When set on a profile that also enabled DHCP, the DNS search list received automatically (option 119 for DHCPv4 and option 24 for DHCPv6) gets merged with the manual list. This can be prevented by setting &quot;ignore-auto-dns&quot;. Note that if no DNS searches are configured, the fallback will be derived from the domain from DHCP (option 15)." />
         <property name="dns-options"
-                  description="Array of DNS options as described in man 5 resolv.conf. NULL means that the options are unset and left at the default. In this case NetworkManager will use default options. This is distinct from an empty list of properties. The currently supported options are &quot;attempts&quot;, &quot;debug&quot;, &quot;edns0&quot;, &quot;inet6&quot;, &quot;ip6-bytestring&quot;, &quot;ip6-dotint&quot;, &quot;ndots&quot;, &quot;no-check-names&quot;, &quot;no-ip6-dotint&quot;, &quot;no-reload&quot;, &quot;no-tld-query&quot;, &quot;rotate&quot;, &quot;single-request&quot;, &quot;single-request-reopen&quot;, &quot;timeout&quot;, &quot;trust-ad&quot;, &quot;use-vc&quot;. The &quot;trust-ad&quot; setting is only honored if the profile contributes name servers to resolv.conf, and if all contributing profiles have &quot;trust-ad&quot; enabled. When using a caching DNS plugin (dnsmasq or systemd-resolved in NetworkManager.conf) then &quot;edns0&quot; and &quot;trust-ad&quot; are automatically added." />
+                  description="Array of DNS options as described in man 5 resolv.conf. NULL means that the options are unset and left at the default. In this case NetworkManager will use default options. This is distinct from an empty list of properties. The currently supported options are &quot;attempts&quot;, &quot;debug&quot;, &quot;edns0&quot;, &quot;inet6&quot;, &quot;ip6-bytestring&quot;, &quot;ip6-dotint&quot;, &quot;ndots&quot;, &quot;no-aaaa&quot;, &quot;no-check-names&quot;, &quot;no-ip6-dotint&quot;, &quot;no-reload&quot;, &quot;no-tld-query&quot;, &quot;rotate&quot;, &quot;single-request&quot;, &quot;single-request-reopen&quot;, &quot;timeout&quot;, &quot;trust-ad&quot;, &quot;use-vc&quot;. The &quot;trust-ad&quot; setting is only honored if the profile contributes name servers to resolv.conf, and if all contributing profiles have &quot;trust-ad&quot; enabled. When using a caching DNS plugin (dnsmasq or systemd-resolved in NetworkManager.conf) then &quot;edns0&quot; and &quot;trust-ad&quot; are automatically added." />
         <property name="dns-priority"
                   description="DNS servers priority. The relative priority for DNS servers specified by this setting.  A lower numerical value is better (higher priority). Negative values have the special effect of excluding other configurations with a greater numerical priority value; so in presence of at least one negative priority, only DNS servers from connections with the lowest priority value will be used. To avoid all DNS leaks, set the priority of the profile that should be used to the most negative value of all active connections profiles. Zero selects a globally configured default value. If the latter is missing or zero too, it defaults to 50 for VPNs (including WireGuard) and 100 for other connections. Note that the priority is to order DNS settings for multiple active connections.  It does not disambiguate multiple DNS servers within the same connection profile. When multiple devices have configurations with the same priority, VPNs will be considered first, then devices with the best (lowest metric) default route and then all other devices. When using dns=default, servers with higher priority will be on top of resolv.conf. To prioritize a given server over another one within the same connection, just specify them in the desired order. Note that commonly the resolver tries name servers in /etc/resolv.conf in the order listed, proceeding with the next server in the list on failure. See for example the &quot;rotate&quot; option of the dns-options setting. If there are any negative DNS priorities, then only name servers from the devices with that lowest priority will be considered. When using a DNS resolver that supports Conditional Forwarding or Split DNS (with dns=dnsmasq or dns=systemd-resolved settings), each connection is used to query domains in its search list. The search domains determine which name servers to ask, and the DNS priority is used to prioritize name servers based on the domain.  Queries for domains not present in any search list are routed through connections having the &apos;~.&apos; special wildcard domain, which is added automatically to connections with the default route (or can be added manually).  When multiple connections specify the same domain, the one with the best priority (lowest numerical value) wins.  If a sub domain is configured on another interface it will be accepted regardless the priority, unless parent domain on the other interface has a negative priority, which causes the sub domain to be shadowed. With Split DNS one can avoid undesired DNS leaks by properly configuring DNS priorities and the search domains, so that only name servers of the desired interface are configured." />
         <property name="addresses"
author	Michael Biebl <biebl@debian.org>	2023-06-12 11:25:29 +0200
committer	Michael Biebl <biebl@debian.org>	2023-06-12 11:25:29 +0200
commit	150fe9eef8dd22307ee16687509acde616663982 (patch)
tree	200fa1178c9aeee2ff874bb63afe93623da4be0d
parent	dfaaf221cfee4ffcc507d793dae051d402646679 (diff)