Imported Upstream version 1.1.91 upstream/1.1.91

62 files changed, 667 insertions, 639 deletions

diff --git a/libnm-core/crypto.c b/libnm-core/crypto.c
index 559ac52b..ecbe6c6e 100644
--- a/libnm-core/crypto.c
+++ b/libnm-core/crypto.c
@@ -21,14 +21,13 @@
  * Copyright 2007 - 2011 Red Hat, Inc.
  */
 
-#include "config.h"
+#include "nm-default.h"
 
 #include <string.h>
 #include <strings.h>
 #include <unistd.h>
 #include <stdlib.h>
 
-#include "nm-default.h"
 #include "crypto.h"
 #include "nm-errors.h"
 
diff --git a/libnm-core/crypto_gnutls.c b/libnm-core/crypto_gnutls.c
index 3f90c77d..d09c9379 100644
--- a/libnm-core/crypto_gnutls.c
+++ b/libnm-core/crypto_gnutls.c
@@ -21,14 +21,13 @@
  * Copyright 2007 - 2015 Red Hat, Inc.
  */
 
-#include "config.h"
+#include "nm-default.h"
 
 #include <gnutls/gnutls.h>
 #include <gnutls/crypto.h>
 #include <gnutls/x509.h>
 #include <gnutls/pkcs12.h>
 
-#include "nm-default.h"
 #include "crypto.h"
 #include "nm-errors.h"
 
diff --git a/libnm-core/crypto_nss.c b/libnm-core/crypto_nss.c
index 7f61ad7c..b5d7e630 100644
--- a/libnm-core/crypto_nss.c
+++ b/libnm-core/crypto_nss.c
@@ -21,7 +21,7 @@
  * Copyright 2007 - 2009 Red Hat, Inc.
  */
 
-#include "config.h"
+#include "nm-default.h"
 
 #include <prinit.h>
 #include <nss.h>
@@ -33,7 +33,6 @@
 #include <ciferfam.h>
 #include <p12plcy.h>
 
-#include "nm-default.h"
 #include "crypto.h"
 #include "nm-errors.h"
 
diff --git a/libnm-core/nm-connection.c b/libnm-core/nm-connection.c
index 5a491b40..04e601ce 100644
--- a/libnm-core/nm-connection.c
+++ b/libnm-core/nm-connection.c
@@ -20,10 +20,10 @@
  * Copyright 2007 - 2008 Novell, Inc.
  */
 
-#include "config.h"
+#include "nm-default.h"
 
 #include <string.h>
-#include "nm-default.h"
+
 #include "nm-connection.h"
 #include "nm-connection-private.h"
 #include "nm-utils.h"
diff --git a/libnm-core/nm-core-enum-types.c b/libnm-core/nm-core-enum-types.c
index 4c580984..7d0f68ff 100644
--- a/libnm-core/nm-core-enum-types.c
+++ b/libnm-core/nm-core-enum-types.c
@@ -146,6 +146,7 @@ nm_device_type_get_type (void)
         { NM_DEVICE_TYPE_IP_TUNNEL, "NM_DEVICE_TYPE_IP_TUNNEL", "ip-tunnel" },
         { NM_DEVICE_TYPE_MACVLAN, "NM_DEVICE_TYPE_MACVLAN", "macvlan" },
         { NM_DEVICE_TYPE_VXLAN, "NM_DEVICE_TYPE_VXLAN", "vxlan" },
+        { NM_DEVICE_TYPE_VETH, "NM_DEVICE_TYPE_VETH", "veth" },
         { 0, NULL, NULL }
       };
       GType g_define_type_id =
@@ -520,7 +521,7 @@ nm_ip_tunnel_mode_get_type (void)
   if (g_once_init_enter (&g_define_type_id__volatile))
     {
       static const GEnumValue values[] = {
-        { NM_IP_TUNNEL_MODE_UKNOWN, "NM_IP_TUNNEL_MODE_UKNOWN", "uknown" },
+        { NM_IP_TUNNEL_MODE_UNKNOWN, "NM_IP_TUNNEL_MODE_UNKNOWN", "unknown" },
         { NM_IP_TUNNEL_MODE_IPIP, "NM_IP_TUNNEL_MODE_IPIP", "ipip" },
         { NM_IP_TUNNEL_MODE_GRE, "NM_IP_TUNNEL_MODE_GRE", "gre" },
         { NM_IP_TUNNEL_MODE_SIT, "NM_IP_TUNNEL_MODE_SIT", "sit" },
@@ -626,6 +627,7 @@ nm_device_error_get_type (void)
         { NM_DEVICE_ERROR_NOT_SOFTWARE, "NM_DEVICE_ERROR_NOT_SOFTWARE", "NotSoftware" },
         { NM_DEVICE_ERROR_NOT_ALLOWED, "NM_DEVICE_ERROR_NOT_ALLOWED", "NotAllowed" },
         { NM_DEVICE_ERROR_SPECIFIC_OBJECT_NOT_FOUND, "NM_DEVICE_ERROR_SPECIFIC_OBJECT_NOT_FOUND", "SpecificObjectNotFound" },
+        { NM_DEVICE_ERROR_VERSION_ID_MISMATCH, "NM_DEVICE_ERROR_VERSION_ID_MISMATCH", "VersionIdMismatch" },
         { 0, NULL, NULL }
       };
       GType g_define_type_id =
@@ -1030,6 +1032,27 @@ nm_wep_key_type_get_type (void)
   return g_define_type_id__volatile;
 }
 GType
+nm_setting_wireless_powersave_get_type (void)
+{
+  static volatile gsize g_define_type_id__volatile = 0;
+
+  if (g_once_init_enter (&g_define_type_id__volatile))
+    {
+      static const GEnumValue values[] = {
+        { NM_SETTING_WIRELESS_POWERSAVE_DEFAULT, "NM_SETTING_WIRELESS_POWERSAVE_DEFAULT", "default" },
+        { NM_SETTING_WIRELESS_POWERSAVE_IGNORE, "NM_SETTING_WIRELESS_POWERSAVE_IGNORE", "ignore" },
+        { NM_SETTING_WIRELESS_POWERSAVE_DISABLE, "NM_SETTING_WIRELESS_POWERSAVE_DISABLE", "disable" },
+        { NM_SETTING_WIRELESS_POWERSAVE_ENABLE, "NM_SETTING_WIRELESS_POWERSAVE_ENABLE", "enable" },
+        { 0, NULL, NULL }
+      };
+      GType g_define_type_id =
+        g_enum_register_static (g_intern_static_string ("NMSettingWirelessPowersave"), values);
+      g_once_init_leave (&g_define_type_id__volatile, g_define_type_id);
+    }
+
+  return g_define_type_id__volatile;
+}
+GType
 nm_setting_secret_flags_get_type (void)
 {
   static volatile gsize g_define_type_id__volatile = 0;
diff --git a/libnm-core/nm-core-enum-types.h b/libnm-core/nm-core-enum-types.h
index 1c16cb21..be038761 100644
--- a/libnm-core/nm-core-enum-types.h
+++ b/libnm-core/nm-core-enum-types.h
@@ -89,6 +89,8 @@ GType nm_setting_wired_wake_on_lan_get_type (void) G_GNUC_CONST;
 #define NM_TYPE_SETTING_WIRED_WAKE_ON_LAN (nm_setting_wired_wake_on_lan_get_type ())
 GType nm_wep_key_type_get_type (void) G_GNUC_CONST;
 #define NM_TYPE_WEP_KEY_TYPE (nm_wep_key_type_get_type ())
+GType nm_setting_wireless_powersave_get_type (void) G_GNUC_CONST;
+#define NM_TYPE_SETTING_WIRELESS_POWERSAVE (nm_setting_wireless_powersave_get_type ())
 GType nm_setting_secret_flags_get_type (void) G_GNUC_CONST;
 #define NM_TYPE_SETTING_SECRET_FLAGS (nm_setting_secret_flags_get_type ())
 GType nm_setting_compare_flags_get_type (void) G_GNUC_CONST;
diff --git a/libnm-core/nm-dbus-interface.h b/libnm-core/nm-dbus-interface.h
index b32aabc2..1b16cce5 100644
--- a/libnm-core/nm-dbus-interface.h
+++ b/libnm-core/nm-dbus-interface.h
@@ -152,6 +152,7 @@ typedef enum {
  * @NM_DEVICE_TYPE_IP_TUNNEL: a IP tunnel interface
  * @NM_DEVICE_TYPE_MACVLAN: a MACVLAN interface
  * @NM_DEVICE_TYPE_VXLAN: a VXLAN interface
+ * @NM_DEVICE_TYPE_VETH: a VETH interface
  *
  * #NMDeviceType values indicate the type of hardware represented by
  * an #NMDevice.
@@ -179,6 +180,7 @@ typedef enum {
 	NM_DEVICE_TYPE_IP_TUNNEL  = 17,
 	NM_DEVICE_TYPE_MACVLAN    = 18,
 	NM_DEVICE_TYPE_VXLAN      = 19,
+	NM_DEVICE_TYPE_VETH       = 20,
 } NMDeviceType;
 
 /**
@@ -692,7 +694,7 @@ typedef enum /*< flags >*/ {
  * Since: 1.2
  */
 typedef enum {
-	NM_IP_TUNNEL_MODE_UKNOWN      = 0,
+	NM_IP_TUNNEL_MODE_UNKNOWN     = 0,
 	NM_IP_TUNNEL_MODE_IPIP        = 1,
 	NM_IP_TUNNEL_MODE_GRE         = 2,
 	NM_IP_TUNNEL_MODE_SIT         = 3,
diff --git a/libnm-core/nm-dbus-utils.c b/libnm-core/nm-dbus-utils.c
index 86272786..79020b2d 100644
--- a/libnm-core/nm-dbus-utils.c
+++ b/libnm-core/nm-dbus-utils.c
@@ -18,11 +18,10 @@
  * Copyright 2015 Red Hat, Inc.
  */
 
-#include "config.h"
+#include "nm-default.h"
 
 #include <string.h>
 
-#include "nm-default.h"
 #include "nm-core-internal.h"
 
 typedef struct {
diff --git a/libnm-core/nm-errors.c b/libnm-core/nm-errors.c
index 4c950f69..e9da8d3f 100644
--- a/libnm-core/nm-errors.c
+++ b/libnm-core/nm-errors.c
@@ -18,11 +18,10 @@
  * Copyright 2004 - 2014 Red Hat, Inc.
  */
 
-#include "config.h"
+#include "nm-default.h"
 
 #include <string.h>
 
-#include "nm-default.h"
 #include "nm-errors.h"
 #include "nm-vpn-dbus-interface.h"
 #include "nm-core-internal.h"
diff --git a/libnm-core/nm-errors.h b/libnm-core/nm-errors.h
index a9857445..f5e08f9a 100644
--- a/libnm-core/nm-errors.h
+++ b/libnm-core/nm-errors.h
@@ -142,6 +142,7 @@ GQuark nm_crypto_error_quark (void);
  * @NM_DEVICE_ERROR_SPECIFIC_OBJECT_NOT_FOUND: the "specific object" in the
  *   activation request (eg, the #NMAccessPoint or #NMWimaxNsp) was not
  *   found.
+ * @NM_DEVICE_ERROR_VERSION_ID_MISMATCH: the version id did not match.
  *
  * Device-related errors.
  *
@@ -158,6 +159,7 @@ typedef enum {
 	NM_DEVICE_ERROR_NOT_SOFTWARE,              /*< nick=NotSoftware >*/
 	NM_DEVICE_ERROR_NOT_ALLOWED,               /*< nick=NotAllowed >*/
 	NM_DEVICE_ERROR_SPECIFIC_OBJECT_NOT_FOUND, /*< nick=SpecificObjectNotFound >*/
+	NM_DEVICE_ERROR_VERSION_ID_MISMATCH,       /*< nick=VersionIdMismatch >*/
 } NMDeviceError;
 
 #define NM_DEVICE_ERROR nm_device_error_quark ()
diff --git a/libnm-core/nm-keyfile-reader.c b/libnm-core/nm-keyfile-reader.c
index 6a0584a5..4a17d2c4 100644
--- a/libnm-core/nm-keyfile-reader.c
+++ b/libnm-core/nm-keyfile-reader.c
@@ -19,7 +19,9 @@
  * Copyright (C) 2008 - 2015 Red Hat, Inc.
  */
 
-#include "config.h"
+#include "nm-default.h"
+
+#include "nm-keyfile-internal.h"
 
 #include <errno.h>
 #include <stdlib.h>
@@ -29,10 +31,7 @@
 #include <arpa/inet.h>
 #include <string.h>
 
-#include "nm-default.h"
 #include "nm-core-internal.h"
-#include "nm-macros-internal.h"
-#include "nm-keyfile-internal.h"
 #include "nm-keyfile-utils.h"
 
 typedef struct {
@@ -874,17 +873,17 @@ handle_as_scheme (KeyfileReaderInfo *info, GBytes *bytes, NMSetting *setting, co
 
 	/* It's the PATH scheme, can just set plain data.
 	 * In this case, @data_len includes */
-	if (   data_len >= STRLEN (NM_KEYFILE_CERT_SCHEME_PREFIX_PATH)
+	if (   data_len >= NM_STRLEN (NM_KEYFILE_CERT_SCHEME_PREFIX_PATH)
 	    && g_str_has_prefix (data, NM_KEYFILE_CERT_SCHEME_PREFIX_PATH)) {
 		if (nm_setting_802_1x_check_cert_scheme (data, data_len + 1, NULL) == NM_SETTING_802_1X_CK_SCHEME_PATH) {
-			const char *path = &data[STRLEN (NM_KEYFILE_CERT_SCHEME_PREFIX_PATH)];
+			const char *path = &data[NM_STRLEN (NM_KEYFILE_CERT_SCHEME_PREFIX_PATH)];
 			gs_free char *path_free = NULL;
 
 			if (path[0] != '/') {
 				/* we want to read absolute paths because we use keyfile as exchange
 				 * between different processes which might not have the same cwd. */
 				path = path_free = get_cert_path (info->base_dir, (const guint8 *) path,
-				                                  data_len - STRLEN (NM_KEYFILE_CERT_SCHEME_PREFIX_PATH));
+				                                  data_len - NM_STRLEN (NM_KEYFILE_CERT_SCHEME_PREFIX_PATH));
 			}
 
 			g_object_set (setting, key, bytes, NULL);
@@ -899,15 +898,15 @@ handle_as_scheme (KeyfileReaderInfo *info, GBytes *bytes, NMSetting *setting, co
 		}
 		return TRUE;
 	}
-	if (   data_len > STRLEN (NM_KEYFILE_CERT_SCHEME_PREFIX_BLOB)
+	if (   data_len > NM_STRLEN (NM_KEYFILE_CERT_SCHEME_PREFIX_BLOB)
 	    && g_str_has_prefix (data, NM_KEYFILE_CERT_SCHEME_PREFIX_BLOB)) {
-		const char *cdata = data + STRLEN (NM_KEYFILE_CERT_SCHEME_PREFIX_BLOB);
+		const char *cdata = data + NM_STRLEN (NM_KEYFILE_CERT_SCHEME_PREFIX_BLOB);
 		guchar *bin;
 		GBytes *bytes2;
 		gsize i;
 		gboolean valid_base64;
 
-		data_len -= STRLEN (NM_KEYFILE_CERT_SCHEME_PREFIX_BLOB);
+		data_len -= NM_STRLEN (NM_KEYFILE_CERT_SCHEME_PREFIX_BLOB);
 
 		/* Let's be strict here. We expect valid base64, no funny stuff!!
 		 * We didn't write such invalid data ourselfes and refuse to read it as blob. */
@@ -1279,10 +1278,7 @@ set_default_for_missing_key (NMSetting *setting, const char *property)
 {
 	/* Set a value different from the default value of the property's spec */
 
-	if (NM_IS_SETTING_VLAN (setting)) {
-		if (!strcmp (property, NM_SETTING_VLAN_FLAGS))
-			g_object_set (setting, property, (NMVlanFlags) 0, NULL);
-	} else if (NM_IS_SETTING_WIRELESS (setting)) {
+	if (NM_IS_SETTING_WIRELESS (setting)) {
 		if (!strcmp (property, NM_SETTING_WIRELESS_MAC_ADDRESS_RANDOMIZATION))
 			g_object_set (setting, property, (NMSettingMacRandomization) NM_SETTING_MAC_RANDOMIZATION_NEVER, NULL);
 	}
@@ -1538,11 +1534,11 @@ read_vpn_secrets (KeyfileReaderInfo *info, NMSettingVpn *s_vpn)
 {
 	char **keys, **iter;
 
-	keys = nm_keyfile_plugin_kf_get_keys (info->keyfile, VPN_SECRETS_GROUP, NULL, NULL);
+	keys = nm_keyfile_plugin_kf_get_keys (info->keyfile, NM_KEYFILE_GROUP_VPN_SECRETS, NULL, NULL);
 	for (iter = keys; *iter; iter++) {
 		char *secret;
 
-		secret = nm_keyfile_plugin_kf_get_string (info->keyfile, VPN_SECRETS_GROUP, *iter, NULL);
+		secret = nm_keyfile_plugin_kf_get_string (info->keyfile, NM_KEYFILE_GROUP_VPN_SECRETS, *iter, NULL);
 		if (secret) {
 			nm_setting_vpn_add_secret (s_vpn, *iter, secret);
 			g_free (secret);
@@ -1620,7 +1616,7 @@ nm_keyfile_read (GKeyFile *keyfile,
 		length = 0;
 	for (i = 0; i < length; i++) {
 		/* Only read out secrets when needed */
-		if (!strcmp (groups[i], VPN_SECRETS_GROUP)) {
+		if (!strcmp (groups[i], NM_KEYFILE_GROUP_VPN_SECRETS)) {
 			vpn_secrets = TRUE;
 			continue;
 		}
@@ -1690,18 +1686,6 @@ nm_keyfile_read (GKeyFile *keyfile,
 		}
 	}
 
-	/* Make sure that if [vlan] group was missing we set vlan.flags to 0
-	 * for backwards compatibility */
-	if (nm_connection_is_type (connection, NM_SETTING_VLAN_SETTING_NAME)) {
-		if (!nm_connection_get_setting_vlan (connection)) {
-			NMSettingVlan *s_vlan;
-
-			s_vlan = NM_SETTING_VLAN (nm_setting_vlan_new ());
-			g_object_set (s_vlan, NM_SETTING_VLAN_FLAGS, 0, NULL);
-			nm_connection_add_setting (connection, NM_SETTING (s_vlan));
-		}
-	}
-
 	return connection;
 out_error:
 	g_propagate_error (error, info.error);
diff --git a/libnm-core/nm-keyfile-utils.c b/libnm-core/nm-keyfile-utils.c
index 15b14a3e..bdd18bab 100644
--- a/libnm-core/nm-keyfile-utils.c
+++ b/libnm-core/nm-keyfile-utils.c
@@ -18,12 +18,11 @@
  * (C) Copyright 2010 Red Hat, Inc.
  */
 
-#include "config.h"
+#include "nm-default.h"
 
 #include <stdlib.h>
 #include <string.h>
 
-#include "nm-default.h"
 #include "nm-keyfile-utils.h"
 #include "nm-keyfile-internal.h"
 #include "nm-setting-wired.h"
diff --git a/libnm-core/nm-keyfile-utils.h b/libnm-core/nm-keyfile-utils.h
index fd4334d1..faa027db 100644
--- a/libnm-core/nm-keyfile-utils.h
+++ b/libnm-core/nm-keyfile-utils.h
@@ -23,7 +23,7 @@
 
 #include <glib.h>
 
-#define VPN_SECRETS_GROUP "vpn-secrets"
+#define NM_KEYFILE_GROUP_VPN_SECRETS "vpn-secrets"
 
 const char *nm_keyfile_plugin_get_alias_for_setting_name (const char *setting_name);
 
diff --git a/libnm-core/nm-keyfile-writer.c b/libnm-core/nm-keyfile-writer.c
index ba1736b9..0ce7641c 100644
--- a/libnm-core/nm-keyfile-writer.c
+++ b/libnm-core/nm-keyfile-writer.c
@@ -19,7 +19,9 @@
  * Copyright (C) 2008 - 2015 Red Hat, Inc.
  */
 
-#include "config.h"
+#include "nm-default.h"
+
+#include "nm-keyfile-internal.h"
 
 #include <stdlib.h>
 #include <sys/stat.h>
@@ -30,7 +32,6 @@
 #include <string.h>
 
 #include "nm-core-internal.h"
-#include "nm-keyfile-internal.h"
 #include "nm-keyfile-utils.h"
 
 typedef struct {
@@ -245,7 +246,7 @@ write_hash_of_string (GKeyFile *file,
 
 	/* Write VPN secrets out to a different group to keep them separate */
 	if (NM_IS_SETTING_VPN (setting) && !strcmp (key, NM_SETTING_VPN_SECRETS)) {
-		group_name = VPN_SECRETS_GROUP;
+		group_name = NM_KEYFILE_GROUP_VPN_SECRETS;
 		vpn_secrets = TRUE;
 	}
 
diff --git a/libnm-core/nm-property-compare.c b/libnm-core/nm-property-compare.c
index d244f745..ab19cd71 100644
--- a/libnm-core/nm-property-compare.c
+++ b/libnm-core/nm-property-compare.c
@@ -20,14 +20,13 @@
  * Copyright 2007 - 2008 Novell, Inc.
  */
 
-#include "config.h"
+#include "nm-default.h"
 
 #include <string.h>
 #include <math.h>
 #include <netinet/in.h>
 
 #include "nm-property-compare.h"
-#include "nm-default.h"
 
 static gint
 _nm_property_compare_collection (GVariant *value1, GVariant *value2)
diff --git a/libnm-core/nm-setting-8021x.c b/libnm-core/nm-setting-8021x.c
index cd0d4e66..0ecb988a 100644
--- a/libnm-core/nm-setting-8021x.c
+++ b/libnm-core/nm-setting-8021x.c
@@ -20,18 +20,17 @@
  * Copyright 2007 - 2008 Novell, Inc.
  */
 
-#include "config.h"
+#include "nm-default.h"
+
+#include "nm-setting-8021x.h"
 
 #include <string.h>
 
-#include "nm-default.h"
-#include "nm-setting-8021x.h"
 #include "nm-utils.h"
 #include "crypto.h"
 #include "nm-utils-private.h"
 #include "nm-setting-private.h"
 #include "nm-core-enum-types.h"
-#include "nm-macros-internal.h"
 
 /**
  * SECTION:nm-setting-8021x
@@ -447,8 +446,8 @@ nm_setting_802_1x_check_cert_scheme (gconstpointer pdata, gsize length, GError *
 	}
 
 	/* interpret the blob as PATH if it starts with "file://". */
-	if (   length >= STRLEN (NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PATH)
-	    && !memcmp (data, NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PATH, STRLEN (NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PATH))) {
+	if (   length >= NM_STRLEN (NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PATH)
+	    && !memcmp (data, NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PATH, NM_STRLEN (NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PATH))) {
 		/* But it must also be NUL terminated, contain at least
 		 * one non-NUL character, and contain only one trailing NUL
 		 * chracter.
@@ -464,7 +463,7 @@ nm_setting_802_1x_check_cert_scheme (gconstpointer pdata, gsize length, GError *
 		}
 		length--;
 
-		if (length <= STRLEN (NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PATH)) {
+		if (length <= NM_STRLEN (NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PATH)) {
 			g_set_error_literal (error,
 			                     NM_CONNECTION_ERROR,
 			                     NM_CONNECTION_ERROR_INVALID_PROPERTY,
@@ -472,7 +471,7 @@ nm_setting_802_1x_check_cert_scheme (gconstpointer pdata, gsize length, GError *
 			return NM_SETTING_802_1X_CK_SCHEME_UNKNOWN;
 		}
 
-		if (!g_utf8_validate (data + STRLEN (NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PATH), length - STRLEN (NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PATH), NULL)) {
+		if (!g_utf8_validate (data + NM_STRLEN (NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PATH), length - NM_STRLEN (NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PATH), NULL)) {
 			g_set_error_literal (error,
 			                     NM_CONNECTION_ERROR,
 			                     NM_CONNECTION_ERROR_INVALID_PROPERTY,
diff --git a/libnm-core/nm-setting-adsl.c b/libnm-core/nm-setting-adsl.c
index 0cf386d8..8198a72a 100644
--- a/libnm-core/nm-setting-adsl.c
+++ b/libnm-core/nm-setting-adsl.c
@@ -19,7 +19,7 @@
  * Copyright 2011 - 2013 Red Hat, Inc.
  */
 
-#include "config.h"
+#include "nm-default.h"
 
 #include <string.h>
 
diff --git a/libnm-core/nm-setting-bluetooth.c b/libnm-core/nm-setting-bluetooth.c
index 864a91cc..837b06c0 100644
--- a/libnm-core/nm-setting-bluetooth.c
+++ b/libnm-core/nm-setting-bluetooth.c
@@ -20,7 +20,7 @@
  * Copyright 2007 - 2008 Novell, Inc.
  */
 
-#include "config.h"
+#include "nm-default.h"
 
 #include <string.h>
 #include <net/ethernet.h>
diff --git a/libnm-core/nm-setting-bond.c b/libnm-core/nm-setting-bond.c
index 1c377584..4d40de00 100644
--- a/libnm-core/nm-setting-bond.c
+++ b/libnm-core/nm-setting-bond.c
@@ -19,7 +19,7 @@
  * Copyright 2011 - 2013 Red Hat, Inc.
  */
 
-#include "config.h"
+#include "nm-default.h"
 
 #include <string.h>
 #include <stdlib.h>
diff --git a/libnm-core/nm-setting-bridge-port.c b/libnm-core/nm-setting-bridge-port.c
index a02b8de1..df2e7bd3 100644
--- a/libnm-core/nm-setting-bridge-port.c
+++ b/libnm-core/nm-setting-bridge-port.c
@@ -19,7 +19,7 @@
  * Copyright 2012 - 2013 Red Hat, Inc.
  */
 
-#include "config.h"
+#include "nm-default.h"
 
 #include <string.h>
 #include <ctype.h>
diff --git a/libnm-core/nm-setting-bridge.c b/libnm-core/nm-setting-bridge.c
index 7915e730..fa934c46 100644
--- a/libnm-core/nm-setting-bridge.c
+++ b/libnm-core/nm-setting-bridge.c
@@ -19,7 +19,7 @@
  * Copyright 2011 - 2013 Red Hat, Inc.
  */
 
-#include "config.h"
+#include "nm-default.h"
 
 #include <string.h>
 #include <ctype.h>
diff --git a/libnm-core/nm-setting-cdma.c b/libnm-core/nm-setting-cdma.c
index 3c01b43f..31b02d7f 100644
--- a/libnm-core/nm-setting-cdma.c
+++ b/libnm-core/nm-setting-cdma.c
@@ -19,7 +19,7 @@
  * Copyright 2007 - 2013 Red Hat, Inc.
  */
 
-#include "config.h"
+#include "nm-default.h"
 
 #include <string.h>
 
diff --git a/libnm-core/nm-setting-connection.c b/libnm-core/nm-setting-connection.c
index f341a398..44237d98 100644
--- a/libnm-core/nm-setting-connection.c
+++ b/libnm-core/nm-setting-connection.c
@@ -20,20 +20,20 @@
  * Copyright 2007 - 2008 Novell, Inc.
  */
 
-#include "config.h"
+#include "nm-default.h"
+
+#include "nm-setting-connection.h"
 
 #include <string.h>
 
 #include "nm-utils.h"
 #include "nm-utils-private.h"
 #include "nm-core-enum-types.h"
-#include "nm-setting-connection.h"
 #include "nm-connection-private.h"
 #include "nm-setting-bond.h"
 #include "nm-setting-bridge.h"
 #include "nm-setting-team.h"
 #include "nm-setting-vlan.h"
-#include "nm-macros-internal.h"
 
 /**
  * SECTION:nm-setting-connection
diff --git a/libnm-core/nm-setting-dcb.c b/libnm-core/nm-setting-dcb.c
index 89675810..751904b5 100644
--- a/libnm-core/nm-setting-dcb.c
+++ b/libnm-core/nm-setting-dcb.c
@@ -19,7 +19,7 @@
  * Copyright 2013 Red Hat, Inc.
  */
 
-#include "config.h"
+#include "nm-default.h"
 
 #include <string.h>
 
diff --git a/libnm-core/nm-setting-generic.c b/libnm-core/nm-setting-generic.c
index 35deb2de..a44f83cb 100644
--- a/libnm-core/nm-setting-generic.c
+++ b/libnm-core/nm-setting-generic.c
@@ -19,7 +19,7 @@
  * Copyright 2013 Red Hat, Inc.
  */
 
-#include "config.h"
+#include "nm-default.h"
 
 #include "nm-setting-generic.h"
 #include "nm-setting-private.h"
diff --git a/libnm-core/nm-setting-gsm.c b/libnm-core/nm-setting-gsm.c
index 4bb5ba9f..86166df2 100644
--- a/libnm-core/nm-setting-gsm.c
+++ b/libnm-core/nm-setting-gsm.c
@@ -20,7 +20,7 @@
  * Copyright 2007 - 2008 Novell, Inc.
  */
 
-#include "config.h"
+#include "nm-default.h"
 
 #include <string.h>
 
diff --git a/libnm-core/nm-setting-infiniband.c b/libnm-core/nm-setting-infiniband.c
index 1cffdd79..3a71879d 100644
--- a/libnm-core/nm-setting-infiniband.c
+++ b/libnm-core/nm-setting-infiniband.c
@@ -19,7 +19,7 @@
  * Copyright 2011 - 2013 Red Hat, Inc.
  */
 
-#include "config.h"
+#include "nm-default.h"
 
 #include <stdlib.h>
 
diff --git a/libnm-core/nm-setting-ip-config.c b/libnm-core/nm-setting-ip-config.c
index 7e719aae..bbdb19ff 100644
--- a/libnm-core/nm-setting-ip-config.c
+++ b/libnm-core/nm-setting-ip-config.c
@@ -20,12 +20,11 @@
  * Copyright 2007 - 2008 Novell, Inc.
  */
 
-#include "config.h"
+#include "nm-default.h"
 
 #include <string.h>
 #include <arpa/inet.h>
 
-#include "nm-default.h"
 #include "nm-setting-ip-config.h"
 #include "nm-setting-ip4-config.h"
 #include "nm-setting-ip6-config.h"
@@ -63,6 +62,19 @@ const NMUtilsDNSOptionDesc _nm_utils_dns_option_descs[] = {
 	{ NULL,                                        FALSE,   FALSE }
 };
 
+static int
+_addr_size (int family)
+{
+	switch (family) {
+	case AF_INET:
+		return sizeof (in_addr_t);
+	case AF_INET6:
+		return sizeof (struct in6_addr);
+	default:
+		g_return_val_if_reached (0);
+	}
+}
+
 static char *
 canonicalize_ip (int family, const char *ip, gboolean null_any)
 {
@@ -70,22 +82,48 @@ canonicalize_ip (int family, const char *ip, gboolean null_any)
 	char addr_str[NM_UTILS_INET_ADDRSTRLEN];
 	int ret;
 
-	if (!ip)
-		return NULL;
+	if (!ip) {
+		if (null_any)
+			return NULL;
+		if (family == AF_INET)
+			return g_strdup ("0.0.0.0");
+		if (family == AF_INET6)
+			return g_strdup ("::");
+		g_return_val_if_reached (NULL);
+	}
 
 	ret = inet_pton (family, ip, addr_bytes);
 	g_return_val_if_fail (ret == 1, NULL);
 
 	if (null_any) {
-		int addrlen = (family == AF_INET ? sizeof (struct in_addr) : sizeof (struct in6_addr));
-
-		if (!memcmp (addr_bytes, &in6addr_any, addrlen))
+		if (!memcmp (addr_bytes, &in6addr_any, _addr_size (family)))
 			return NULL;
 	}
 
 	return g_strdup (inet_ntop (family, addr_bytes, addr_str, sizeof (addr_str)));
 }
 
+static char *
+canonicalize_ip_binary (int family, gconstpointer ip, gboolean null_any)
+{
+	char string[NM_UTILS_INET_ADDRSTRLEN];
+
+	if (!ip) {
+		if (null_any)
+			return NULL;
+		if (family == AF_INET)
+			return g_strdup ("0.0.0.0");
+		if (family == AF_INET6)
+			return g_strdup ("::");
+		g_return_val_if_reached (NULL);
+	}
+	if (null_any) {
+		if (!memcmp (ip, &in6addr_any, _addr_size (family)))
+			return NULL;
+	}
+	return g_strdup (inet_ntop (family, ip, string, sizeof (string)));
+}
+
 static gboolean
 valid_ip (int family, const char *ip, GError **error)
 {
@@ -567,6 +605,7 @@ nm_ip_route_new (int family,
 	NMIPRoute *route;
 
 	g_return_val_if_fail (family == AF_INET || family == AF_INET6, NULL);
+	g_return_val_if_fail (dest, NULL);
 
 	if (!valid_ip (family, dest, error))
 		return NULL;
@@ -613,9 +652,9 @@ nm_ip_route_new_binary (int family,
                         GError **error)
 {
 	NMIPRoute *route;
-	char string[NM_UTILS_INET_ADDRSTRLEN];
 
 	g_return_val_if_fail (family == AF_INET || family == AF_INET6, NULL);
+	g_return_val_if_fail (dest, NULL);
 
 	if (!valid_prefix (family, prefix, error, TRUE))
 		return NULL;
@@ -626,10 +665,9 @@ nm_ip_route_new_binary (int family,
 	route->refcount = 1;
 
 	route->family = family;
-	route->dest = g_strdup (inet_ntop (family, dest, string, sizeof (string)));
+	route->dest = canonicalize_ip_binary (family, dest, FALSE);
 	route->prefix = prefix;
-	if (next_hop)
-		route->next_hop = g_strdup (inet_ntop (family, next_hop, string, sizeof (string)));
+	route->next_hop = canonicalize_ip_binary (family, next_hop, TRUE);
 	route->metric = metric;
 
 	return route;
@@ -783,7 +821,6 @@ nm_ip_route_set_dest (NMIPRoute *route,
                       const char *dest)
 {
 	g_return_if_fail (route != NULL);
-	g_return_if_fail (dest != NULL);
 	g_return_if_fail (nm_utils_ipaddr_valid (route->family, dest));
 
 	g_free (route->dest);
@@ -928,8 +965,7 @@ nm_ip_route_get_next_hop_binary (NMIPRoute *route,
 		inet_pton (route->family, route->next_hop, next_hop);
 		return TRUE;
 	} else {
-		memset (next_hop, 0,
-		        route->family == AF_INET ? sizeof (struct in_addr) : sizeof (struct in6_addr));
+		memset (next_hop, 0, _addr_size (route->family));
 		return FALSE;
 	}
 }
@@ -948,15 +984,10 @@ void
 nm_ip_route_set_next_hop_binary (NMIPRoute *route,
                                  gconstpointer next_hop)
 {
-	char string[NM_UTILS_INET_ADDRSTRLEN];
-
 	g_return_if_fail (route != NULL);
 
 	g_free (route->next_hop);
-	if (next_hop)
-		route->next_hop = g_strdup (inet_ntop (route->family, next_hop, string, sizeof (string)));
-	else
-		route->next_hop = NULL;
+	route->next_hop = canonicalize_ip_binary (route->family, next_hop, TRUE);
 }
 
 /**
@@ -1093,6 +1124,8 @@ typedef struct {
 	gboolean dhcp_send_hostname;
 	gboolean never_default;
 	gboolean may_fail;
+	gint dad_timeout;
+	gint dhcp_timeout;
 } NMSettingIPConfigPrivate;
 
 enum {
@@ -1111,6 +1144,8 @@ enum {
 	PROP_DHCP_SEND_HOSTNAME,
 	PROP_NEVER_DEFAULT,
 	PROP_MAY_FAIL,
+	PROP_DAD_TIMEOUT,
+	PROP_DHCP_TIMEOUT,
 
 	LAST_PROP
 };
@@ -2055,6 +2090,42 @@ nm_setting_ip_config_get_may_fail (NMSettingIPConfig *setting)
 	return NM_SETTING_IP_CONFIG_GET_PRIVATE (setting)->may_fail;
 }
 
+/**
+ * nm_setting_ip_config_get_dad_timeout:
+ * @setting: the #NMSettingIPConfig
+ *
+ * Returns: the #NMSettingIPConfig:dad-timeout property.
+ *
+ * Since: 1.2
+ **/
+gint
+nm_setting_ip_config_get_dad_timeout (NMSettingIPConfig *setting)
+{
+	g_return_val_if_fail (NM_IS_SETTING_IP_CONFIG (setting), 0);
+
+	return NM_SETTING_IP_CONFIG_GET_PRIVATE (setting)->dad_timeout;
+}
+
+/**
+ * nm_setting_ip_config_get_dhcp_timeout:
+ * @setting: the #NMSettingIPConfig
+ *
+ * Returns the value contained in the #NMSettingIPConfig:dhcp-timeout
+ * property.
+ *
+ * Returns: the configured DHCP timeout in seconds. 0 = default for
+ * the particular kind of device.
+ *
+ * Since: 1.2
+ **/
+gint
+nm_setting_ip_config_get_dhcp_timeout (NMSettingIPConfig *setting)
+{
+	g_return_val_if_fail (NM_IS_SETTING_IP_CONFIG (setting), 0);
+
+	return NM_SETTING_IP_CONFIG_GET_PRIVATE (setting)->dhcp_timeout;
+}
+
 static gboolean
 verify_label (const char *label)
 {
@@ -2285,7 +2356,7 @@ set_property (GObject *object, guint prop_id,
 		gateway = g_value_get_string (value);
 		g_return_if_fail (!gateway || nm_utils_ipaddr_valid (NM_SETTING_IP_CONFIG_GET_FAMILY (setting), gateway));
 		g_free (priv->gateway);
-		priv->gateway = canonicalize_ip (NM_SETTING_IP_CONFIG_GET_FAMILY (setting), gateway, FALSE);
+		priv->gateway = canonicalize_ip (NM_SETTING_IP_CONFIG_GET_FAMILY (setting), gateway, TRUE);
 		break;
 	case PROP_ROUTES:
 		g_ptr_array_unref (priv->routes);
@@ -2315,6 +2386,12 @@ set_property (GObject *object, guint prop_id,
 	case PROP_MAY_FAIL:
 		priv->may_fail = g_value_get_boolean (value);
 		break;
+	case PROP_DAD_TIMEOUT:
+		priv->dad_timeout = g_value_get_int (value);
+		break;
+	case PROP_DHCP_TIMEOUT:
+		priv->dhcp_timeout = g_value_get_int (value);
+		break;
 	default:
 		G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
 		break;
@@ -2375,6 +2452,12 @@ get_property (GObject *object, guint prop_id,
 	case PROP_MAY_FAIL:
 		g_value_set_boolean (value, priv->may_fail);
 		break;
+	case PROP_DAD_TIMEOUT:
+		g_value_set_int (value, nm_setting_ip_config_get_dad_timeout (setting));
+		break;
+	case PROP_DHCP_TIMEOUT:
+		g_value_set_int (value, nm_setting_ip_config_get_dhcp_timeout (setting));
+		break;
 	default:
 		G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
 		break;
@@ -2656,4 +2739,37 @@ nm_setting_ip_config_class_init (NMSettingIPConfigClass *setting_class)
 		                       G_PARAM_READWRITE |
 		                       G_PARAM_CONSTRUCT |
 		                       G_PARAM_STATIC_STRINGS));
+
+	/**
+	 * NMSettingIPConfig:dad-timeout:
+	 *
+	 * Timeout in milliseconds used to check for the presence of duplicate IP
+	 * addresses on the network.  If an address conflict is detected, the
+	 * activation will fail.  A zero value means that no duplicate address
+	 * detection is performed, -1 means the default value (either configuration
+	 * ipvx.dad-timeout override or 3 seconds).  A value greater than zero is a
+	 * timeout in milliseconds.
+	 *
+	 * Since: 1.2
+	 **/
+	g_object_class_install_property
+		(object_class, PROP_DAD_TIMEOUT,
+		 g_param_spec_int (NM_SETTING_IP_CONFIG_DAD_TIMEOUT, "", "",
+		                    -1, NM_SETTING_IP_CONFIG_DAD_TIMEOUT_MAX, -1,
+		                    G_PARAM_READWRITE |
+		                    G_PARAM_CONSTRUCT |
+		                    NM_SETTING_PARAM_FUZZY_IGNORE |
+		                    G_PARAM_STATIC_STRINGS));
+	/**
+	 * NMSettingIPConfig:dhcp-timeout:
+	 *
+	 * A timeout for a DHCP transaction in seconds.
+	 **/
+	g_object_class_install_property
+		(object_class, PROP_DHCP_TIMEOUT,
+		 g_param_spec_int (NM_SETTING_IP_CONFIG_DHCP_TIMEOUT, "", "",
+		                   0, G_MAXINT32, 0,
+		                   G_PARAM_READWRITE |
+		                   NM_SETTING_PARAM_FUZZY_IGNORE |
+		                   G_PARAM_STATIC_STRINGS));
 }
diff --git a/libnm-core/nm-setting-ip-config.h b/libnm-core/nm-setting-ip-config.h
index 6e8c0202..6d182338 100644
--- a/libnm-core/nm-setting-ip-config.h
+++ b/libnm-core/nm-setting-ip-config.h
@@ -130,6 +130,8 @@ void         nm_ip_route_set_attribute       (NMIPRoute   *route,
 #define NM_IS_SETTING_IP_CONFIG_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE ((klass), NM_TYPE_SETTING_IP_CONFIG))
 #define NM_SETTING_IP_CONFIG_GET_CLASS(obj)  (G_TYPE_INSTANCE_GET_CLASS ((obj), NM_TYPE_SETTING_IP_CONFIG, NMSettingIPConfigClass))
 
+#define NM_SETTING_IP_CONFIG_DAD_TIMEOUT_MAX     30000
+
 #define NM_SETTING_IP_CONFIG_METHOD             "method"
 #define NM_SETTING_IP_CONFIG_DNS                "dns"
 #define NM_SETTING_IP_CONFIG_DNS_SEARCH         "dns-search"
@@ -144,6 +146,8 @@ void         nm_ip_route_set_attribute       (NMIPRoute   *route,
 #define NM_SETTING_IP_CONFIG_DHCP_SEND_HOSTNAME "dhcp-send-hostname"
 #define NM_SETTING_IP_CONFIG_NEVER_DEFAULT      "never-default"
 #define NM_SETTING_IP_CONFIG_MAY_FAIL           "may-fail"
+#define NM_SETTING_IP_CONFIG_DAD_TIMEOUT        "dad-timeout"
+#define NM_SETTING_IP_CONFIG_DHCP_TIMEOUT       "dhcp-timeout"
 
 #define NM_SETTING_DNS_OPTION_DEBUG                     "debug"
 #define NM_SETTING_DNS_OPTION_NDOTS                     "ndots"
@@ -245,6 +249,10 @@ gboolean      nm_setting_ip_config_get_dhcp_send_hostname     (NMSettingIPConfig
 
 gboolean      nm_setting_ip_config_get_never_default          (NMSettingIPConfig *setting);
 gboolean      nm_setting_ip_config_get_may_fail               (NMSettingIPConfig *setting);
+NM_AVAILABLE_IN_1_2
+gint          nm_setting_ip_config_get_dad_timeout            (NMSettingIPConfig *setting);
+NM_AVAILABLE_IN_1_2
+gint          nm_setting_ip_config_get_dhcp_timeout           (NMSettingIPConfig *setting);
 
 G_END_DECLS
 
diff --git a/libnm-core/nm-setting-ip-tunnel.c b/libnm-core/nm-setting-ip-tunnel.c
index cd63aa11..fa193d75 100644
--- a/libnm-core/nm-setting-ip-tunnel.c
+++ b/libnm-core/nm-setting-ip-tunnel.c
@@ -18,12 +18,11 @@
  * Copyright 2015 Red Hat, Inc.
  */
 
-#include "nm-setting-ip-tunnel.h"
+#include "nm-default.h"
 
-#include "config.h"
+#include "nm-setting-ip-tunnel.h"
 
 #include "nm-setting-private.h"
-#include "nm-macros-internal.h"
 #include "nm-utils.h"
 
 /**
diff --git a/libnm-core/nm-setting-ip4-config.c b/libnm-core/nm-setting-ip4-config.c
index 7708b6c5..b0308e71 100644
--- a/libnm-core/nm-setting-ip4-config.c
+++ b/libnm-core/nm-setting-ip4-config.c
@@ -19,7 +19,7 @@
  * Copyright 2014 Red Hat, Inc.
  */
 
-#include "config.h"
+#include "nm-default.h"
 
 #include <string.h>
 
@@ -58,14 +58,12 @@ NM_SETTING_REGISTER_TYPE (NM_TYPE_SETTING_IP4_CONFIG)
 
 typedef struct {
 	char *dhcp_client_id;
-	int dhcp_timeout;
 	char *dhcp_fqdn;
 } NMSettingIP4ConfigPrivate;
 
 enum {
 	PROP_0,
 	PROP_DHCP_CLIENT_ID,
-	PROP_DHCP_TIMEOUT,
 	PROP_DHCP_FQDN,
 
 	LAST_PROP
@@ -103,26 +101,6 @@ nm_setting_ip4_config_get_dhcp_client_id (NMSettingIP4Config *setting)
 }
 
 /**
- * nm_setting_ip4_config_get_dhcp_timeout:
- * @setting: the #NMSettingIP4Config
- *
- * Returns the value contained in the #NMSettingIP4Config:dhcp-timeout
- * property.
- *
- * Returns: the configured DHCP timeout in seconds. 0 = default for
- * the particular kind of device.
- *
- * Since: 1.2
- **/
-int
-nm_setting_ip4_config_get_dhcp_timeout (NMSettingIP4Config *setting)
-{
-	g_return_val_if_fail (NM_IS_SETTING_IP4_CONFIG (setting), 0);
-
-	return NM_SETTING_IP4_CONFIG_GET_PRIVATE (setting)->dhcp_timeout;
-}
-
-/**
  * nm_setting_ip4_config_get_dhcp_fqdn:
  * @setting: the #NMSettingIP4Config
  *
@@ -277,9 +255,6 @@ set_property (GObject *object, guint prop_id,
 		g_free (priv->dhcp_client_id);
 		priv->dhcp_client_id = g_value_dup_string (value);
 		break;
-	case PROP_DHCP_TIMEOUT:
-		priv->dhcp_timeout = g_value_get_uint (value);
-		break;
 	case PROP_DHCP_FQDN:
 		g_free (priv->dhcp_fqdn);
 		priv->dhcp_fqdn = g_value_dup_string (value);
@@ -300,9 +275,6 @@ get_property (GObject *object, guint prop_id,
 	case PROP_DHCP_CLIENT_ID:
 		g_value_set_string (value, nm_setting_ip4_config_get_dhcp_client_id (s_ip4));
 		break;
-	case PROP_DHCP_TIMEOUT:
-		g_value_set_uint (value, nm_setting_ip4_config_get_dhcp_timeout (s_ip4));
-		break;
 	case PROP_DHCP_FQDN:
 		g_value_set_string (value, nm_setting_ip4_config_get_dhcp_fqdn (s_ip4));
 		break;
@@ -682,25 +654,23 @@ nm_setting_ip4_config_class_init (NMSettingIP4ConfigClass *ip4_class)
 		                      G_PARAM_READWRITE |
 		                      G_PARAM_STATIC_STRINGS));
 
-	/**
-	 * NMSettingIP4Config:dhcp-timeout:
-	 *
-	 * A timeout for a DHCP transaction in seconds.
-	 **/
+	/* ---ifcfg-rh---
+	 * property: dad-timeout
+	 * variable: ARPING_WAIT
+	 * default: missing variable means global default (config override or 3)
+	 * description: Timeout (in seconds) for performing DAD before configuring
+	 * IPv4 addresses. 0 turns off the DAD completely, -1 means default value.
+	 * example: ARPING_WAIT=2
+	 * ---end---
+	 */
+
 	/* ---ifcfg-rh---
 	 * property: dhcp-timeout
-	 * variable: DHCP_TIMEOUT(+)
+	 * variable: IPV4_DHCP_TIMEOUT(+)
 	 * description: A timeout after which the DHCP transaction fails in case of no response.
-	 * example: DHCP_TIMEOUT=10
+	 * example: IPV4_DHCP_TIMEOUT=10
 	 * ---end---
 	 */
-	g_object_class_install_property
-		(object_class, PROP_DHCP_TIMEOUT,
-                 g_param_spec_uint (NM_SETTING_IP4_CONFIG_DHCP_TIMEOUT, "", "",
-                                    0, G_MAXUINT32, 0,
-                                    G_PARAM_READWRITE |
-                                    NM_SETTING_PARAM_FUZZY_IGNORE |
-                                    G_PARAM_STATIC_STRINGS));
 
 	/**
 	 * NMSettingIP4Config:dhcp-fqdn:
diff --git a/libnm-core/nm-setting-ip4-config.h b/libnm-core/nm-setting-ip4-config.h
index a78df703..8e6524cb 100644
--- a/libnm-core/nm-setting-ip4-config.h
+++ b/libnm-core/nm-setting-ip4-config.h
@@ -41,7 +41,6 @@ G_BEGIN_DECLS
 #define NM_SETTING_IP4_CONFIG_SETTING_NAME "ipv4"
 
 #define NM_SETTING_IP4_CONFIG_DHCP_CLIENT_ID     "dhcp-client-id"
-#define NM_SETTING_IP4_CONFIG_DHCP_TIMEOUT       "dhcp-timeout"
 #define NM_SETTING_IP4_CONFIG_DHCP_FQDN          "dhcp-fqdn"
 
 /**
@@ -105,8 +104,6 @@ NMSetting *nm_setting_ip4_config_new (void);
 
 const char *nm_setting_ip4_config_get_dhcp_client_id     (NMSettingIP4Config *setting);
 NM_AVAILABLE_IN_1_2
-int nm_setting_ip4_config_get_dhcp_timeout               (NMSettingIP4Config *setting);
-NM_AVAILABLE_IN_1_2
 const char *nm_setting_ip4_config_get_dhcp_fqdn          (NMSettingIP4Config *setting);
 
 G_END_DECLS
diff --git a/libnm-core/nm-setting-ip6-config.c b/libnm-core/nm-setting-ip6-config.c
index bc516d6e..f2d85084 100644
--- a/libnm-core/nm-setting-ip6-config.c
+++ b/libnm-core/nm-setting-ip6-config.c
@@ -19,14 +19,14 @@
  * Copyright 2007 - 2014 Red Hat, Inc.
  */
 
-#include "config.h"
+#include "nm-default.h"
+
+#include "nm-setting-ip6-config.h"
 
 #include <string.h>
 
-#include "nm-setting-ip6-config.h"
 #include "nm-setting-private.h"
 #include "nm-core-enum-types.h"
-#include "nm-macros-internal.h"
 
 /**
  * SECTION:nm-setting-ip6-config
diff --git a/libnm-core/nm-setting-macvlan.c b/libnm-core/nm-setting-macvlan.c
index 7bedf514..00341acc 100644
--- a/libnm-core/nm-setting-macvlan.c
+++ b/libnm-core/nm-setting-macvlan.c
@@ -19,7 +19,7 @@
  * Copyright 2015 Red Hat, Inc.
  */
 
-#include "config.h"
+#include "nm-default.h"
 
 #include <stdlib.h>
 #include <string.h>
diff --git a/libnm-core/nm-setting-olpc-mesh.c b/libnm-core/nm-setting-olpc-mesh.c
index 4b42c365..eba29c92 100644
--- a/libnm-core/nm-setting-olpc-mesh.c
+++ b/libnm-core/nm-setting-olpc-mesh.c
@@ -20,7 +20,7 @@
  * Copyright 2009 One Laptop per Child
  */
 
-#include "config.h"
+#include "nm-default.h"
 
 #include <string.h>
 
@@ -79,6 +79,7 @@ nm_setting_olpc_mesh_init (NMSettingOlpcMesh *setting)
 
 /**
  * nm_setting_olpc_mesh_get_ssid:
+ * @setting: the #NMSettingOlpcMesh
  *
  * Returns: (transfer none):
  */
diff --git a/libnm-core/nm-setting-ppp.c b/libnm-core/nm-setting-ppp.c
index 2cc5a209..3519117c 100644
--- a/libnm-core/nm-setting-ppp.c
+++ b/libnm-core/nm-setting-ppp.c
@@ -20,7 +20,7 @@
  * Copyright 2007 - 2008 Novell, Inc.
  */
 
-#include "config.h"
+#include "nm-default.h"
 
 #include "nm-setting-ppp.h"
 #include "nm-setting-private.h"
diff --git a/libnm-core/nm-setting-pppoe.c b/libnm-core/nm-setting-pppoe.c
index e2466eb3..c7fbd56d 100644
--- a/libnm-core/nm-setting-pppoe.c
+++ b/libnm-core/nm-setting-pppoe.c
@@ -20,7 +20,7 @@
  * Copyright 2007 - 2008 Novell, Inc.
  */
 
-#include "config.h"
+#include "nm-default.h"
 
 #include <string.h>
 
diff --git a/libnm-core/nm-setting-serial.c b/libnm-core/nm-setting-serial.c
index b8589cd2..fd251b7d 100644
--- a/libnm-core/nm-setting-serial.c
+++ b/libnm-core/nm-setting-serial.c
@@ -20,11 +20,10 @@
  * Copyright 2007 - 2008 Novell, Inc.
  */
 
-#include "config.h"
+#include "nm-default.h"
 
 #include <string.h>
 
-#include "nm-default.h"
 #include "nm-setting-serial.h"
 #include "nm-setting-private.h"
 
diff --git a/libnm-core/nm-setting-team-port.c b/libnm-core/nm-setting-team-port.c
index 78cb3cb7..9671f1d9 100644
--- a/libnm-core/nm-setting-team-port.c
+++ b/libnm-core/nm-setting-team-port.c
@@ -18,7 +18,7 @@
  * Copyright 2013 Jiri Pirko <jiri@resnulli.us>
  */
 
-#include "config.h"
+#include "nm-default.h"
 
 #include <string.h>
 #include <ctype.h>
diff --git a/libnm-core/nm-setting-team.c b/libnm-core/nm-setting-team.c
index 2dfffaac..d47b1e72 100644
--- a/libnm-core/nm-setting-team.c
+++ b/libnm-core/nm-setting-team.c
@@ -18,7 +18,7 @@
  * Copyright 2013 Jiri Pirko <jiri@resnulli.us>
  */
 
-#include "config.h"
+#include "nm-default.h"
 
 #include <string.h>
 #include <stdlib.h>
diff --git a/libnm-core/nm-setting-tun.c b/libnm-core/nm-setting-tun.c
index b3c11860..fe14eec2 100644
--- a/libnm-core/nm-setting-tun.c
+++ b/libnm-core/nm-setting-tun.c
@@ -19,7 +19,7 @@
  * Copyright 2015 Red Hat, Inc.
  */
 
-#include "config.h"
+#include "nm-default.h"
 
 #include <stdlib.h>
 #include <string.h>
diff --git a/libnm-core/nm-setting-vlan.c b/libnm-core/nm-setting-vlan.c
index 8428a369..39587d59 100644
--- a/libnm-core/nm-setting-vlan.c
+++ b/libnm-core/nm-setting-vlan.c
@@ -19,14 +19,13 @@
  * Copyright 2011 - 2014 Red Hat, Inc.
  */
 
-#include "config.h"
+#include "nm-default.h"
+
+#include "nm-setting-vlan.h"
 
 #include <stdlib.h>
 #include <string.h>
 
-#include "nm-setting-vlan.h"
-#include "nm-default.h"
-#include "nm-macros-internal.h"
 #include "nm-utils.h"
 #include "nm-core-types-internal.h"
 #include "nm-setting-connection.h"
@@ -666,6 +665,15 @@ verify (NMSetting *setting, NMConnection *connection, GError **error)
 		}
 	}
 
+	if (priv->id >= 4095) {
+		g_set_error (error,
+		             NM_CONNECTION_ERROR,
+		             NM_CONNECTION_ERROR_INVALID_PROPERTY,
+		             _("the vlan id must be in range 0-4094 but is %u"),
+		             priv->id);
+		g_prefix_error (error, "%s.%s: ", NM_SETTING_VLAN_SETTING_NAME, NM_SETTING_VLAN_ID);
+	}
+
 	if (priv->flags & ~NM_VLAN_FLAGS_ALL) {
 		g_set_error_literal (error,
 		                     NM_CONNECTION_ERROR,
@@ -851,7 +859,7 @@ nm_setting_vlan_class_init (NMSettingVlanClass *setting_class)
 	 * NMSettingVlan:id:
 	 *
 	 * The VLAN identifier that the interface created by this connection should
-	 * be assigned.
+	 * be assigned. The valid range is from 0 to 4094, without the reserved id 4095.
 	 **/
 	/* ---ifcfg-rh---
 	 * property: id
@@ -885,8 +893,8 @@ nm_setting_vlan_class_init (NMSettingVlanClass *setting_class)
 	 **/
 	/* ---ifcfg-rh---
 	 * property: flags
-	 * variable: REORDER_HDR, GVRP, MVRP, VLAN_FLAGS
-	 * values: "yes or "no" for REORDER_HDR, GVRP and MVRP; "LOOSE_BINDING" for VLAN_FLAGS
+	 * variable: GVRP, MVRP, VLAN_FLAGS
+	 * values: "yes or "no" for GVRP and MVRP; "LOOSE_BINDING" and "NO_REORDER_HDR" for VLAN_FLAGS
 	 * description: VLAN flags.
 	 * ---end---
 	 */
diff --git a/libnm-core/nm-setting-vpn.c b/libnm-core/nm-setting-vpn.c
index aae8ae13..c9a1e20b 100644
--- a/libnm-core/nm-setting-vpn.c
+++ b/libnm-core/nm-setting-vpn.c
@@ -19,7 +19,7 @@
  * Copyright 2007 - 2008 Novell, Inc.
  */
 
-#include "config.h"
+#include "nm-default.h"
 
 #include <string.h>
 #include <errno.h>
diff --git a/libnm-core/nm-setting-vxlan.c b/libnm-core/nm-setting-vxlan.c
index 814623b7..57fbfd79 100644
--- a/libnm-core/nm-setting-vxlan.c
+++ b/libnm-core/nm-setting-vxlan.c
@@ -19,7 +19,7 @@
  * Copyright 2015 Red Hat, Inc.
  */
 
-#include "config.h"
+#include "nm-default.h"
 
 #include <stdlib.h>
 #include <string.h>
@@ -707,7 +707,7 @@ nm_setting_vxlan_class_init (NMSettingVxlanClass *setting_class)
 	g_object_class_install_property
 		(object_class, PROP_AGEING,
 		 g_param_spec_uint (NM_SETTING_VXLAN_AGEING, "", "",
-		                    0, G_MAXINT32, 300,
+		                    0, G_MAXUINT32, 300,
 		                    G_PARAM_READWRITE |
 		                    G_PARAM_CONSTRUCT |
 		                    NM_SETTING_PARAM_INFERRABLE |
@@ -722,9 +722,9 @@ nm_setting_vxlan_class_init (NMSettingVxlanClass *setting_class)
 	 * Since: 1.2
 	 **/
 	g_object_class_install_property
-		(object_class, PROP_AGEING,
+		(object_class, PROP_LIMIT,
 		 g_param_spec_uint (NM_SETTING_VXLAN_LIMIT, "", "",
-		                    0, G_MAXINT32, 0,
+		                    0, G_MAXUINT32, 0,
 		                    G_PARAM_READWRITE |
 		                    G_PARAM_CONSTRUCT |
 		                    NM_SETTING_PARAM_INFERRABLE |
diff --git a/libnm-core/nm-setting-wimax.c b/libnm-core/nm-setting-wimax.c
index 95a09952..f893cbdc 100644
--- a/libnm-core/nm-setting-wimax.c
+++ b/libnm-core/nm-setting-wimax.c
@@ -20,7 +20,7 @@
  * Copyright 2009 Novell, Inc.
  */
 
-#include "config.h"
+#include "nm-default.h"
 
 #include <string.h>
 #include <net/ethernet.h>
diff --git a/libnm-core/nm-setting-wired.c b/libnm-core/nm-setting-wired.c
index 64b66971..149ddb91 100644
--- a/libnm-core/nm-setting-wired.c
+++ b/libnm-core/nm-setting-wired.c
@@ -20,16 +20,16 @@
  * Copyright 2007 - 2008 Novell, Inc.
  */
 
-#include "config.h"
+#include "nm-default.h"
+
+#include "nm-setting-wired.h"
 
 #include <string.h>
 #include <net/ethernet.h>
 
-#include "nm-setting-wired.h"
 #include "nm-utils.h"
 #include "nm-utils-private.h"
 #include "nm-setting-private.h"
-#include "nm-macros-internal.h"
 
 /**
  * SECTION:nm-setting-wired
diff --git a/libnm-core/nm-setting-wireless-security.c b/libnm-core/nm-setting-wireless-security.c
index 7c5e3932..64e2aa45 100644
--- a/libnm-core/nm-setting-wireless-security.c
+++ b/libnm-core/nm-setting-wireless-security.c
@@ -20,7 +20,7 @@
  * Copyright 2007 - 2008 Novell, Inc.
  */
 
-#include "config.h"
+#include "nm-default.h"
 
 #include <string.h>
 
diff --git a/libnm-core/nm-setting-wireless.c b/libnm-core/nm-setting-wireless.c
index 2a148293..72fd77e4 100644
--- a/libnm-core/nm-setting-wireless.c
+++ b/libnm-core/nm-setting-wireless.c
@@ -20,7 +20,7 @@
  * Copyright 2007 - 2008 Novell, Inc.
  */
 
-#include "config.h"
+#include "nm-default.h"
 
 #include <string.h>
 #include <net/ethernet.h>
@@ -1365,25 +1365,26 @@ nm_setting_wireless_class_init (NMSettingWirelessClass *setting_class)
 	/**
 	 * NMSettingWireless:powersave:
 	 *
-	 * If set to %FALSE, Wi-Fi power saving behavior is disabled.  If set to
-	 * %TRUE, Wi-Fi power saving behavior is enabled.  All other values are
-	 * reserved.  Note that even though only boolean values are allowed, the
-	 * property type is an unsigned integer to allow for future expansion.
+	 * One of %NM_SETTING_WIRELESS_POWERSAVE_DISABLE (disable Wi-Fi power
+	 * saving), %NM_SETTING_WIRELESS_POWERSAVE_ENABLE (enable Wi-Fi power
+	 * saving), %NM_SETTING_WIRELESS_POWERSAVE_IGNORE (don't touch currently
+	 * configure setting) or %NM_SETTING_WIRELESS_POWERSAVE_DEFAULT (use the
+	 * globally configured value). All other values are reserved.
 	 *
 	 * Since: 1.2
 	 **/
 	/* ---ifcfg-rh---
 	 * property: powersave
 	 * variable: POWERSAVE(+)
-	 * default: no
+	 * values: default, ignore, enable, disable
 	 * description: Enables or disables Wi-Fi power saving.
-	 * example: POWERSAVE=yes
+	 * example: POWERSAVE=enable
 	 * ---end---
 	 */
 	g_object_class_install_property
 		(object_class, PROP_POWERSAVE,
 		 g_param_spec_uint (NM_SETTING_WIRELESS_POWERSAVE, "", "",
-		                    0, G_MAXUINT32, 0,
+		                    0, G_MAXUINT32, NM_SETTING_WIRELESS_POWERSAVE_DEFAULT,
 		                    G_PARAM_READWRITE |
 		                    G_PARAM_STATIC_STRINGS));
 
@@ -1401,10 +1402,9 @@ nm_setting_wireless_class_init (NMSettingWirelessClass *setting_class)
 	/* ---ifcfg-rh---
 	 * property: mac-address-randomization
 	 * variable: MAC_ADDRESS_RANDOMIZATION(+)
-	 * values: 0 (default), (1) never, (2) always
-	 * default: 1
+	 * values: default, never, always
 	 * description: Enables or disables Wi-Fi MAC address randomization.
-	 * example: MAC_ADDRESS_RANDOMIZATION=2
+	 * example: MAC_ADDRESS_RANDOMIZATION=always
 	 * ---end---
 	 */
 	g_object_class_install_property
diff --git a/libnm-core/nm-setting-wireless.h b/libnm-core/nm-setting-wireless.h
index a4c0147f..606733fa 100644
--- a/libnm-core/nm-setting-wireless.h
+++ b/libnm-core/nm-setting-wireless.h
@@ -80,6 +80,25 @@ G_BEGIN_DECLS
  */
 #define NM_SETTING_WIRELESS_MODE_INFRA  "infrastructure"
 
+/**
+ * NMSettingWirelessPowersave:
+ * @NM_SETTING_WIRELESS_POWERSAVE_DEFAULT: use the default value
+ * @NM_SETTING_WIRELESS_POWERSAVE_IGNORE: don't touch existing setting
+ * @NM_SETTING_WIRELESS_POWERSAVE_DISABLE: disable powersave
+ * @NM_SETTING_WIRELESS_POWERSAVE_ENABLE: enable powersave
+ *
+ * These flags indicate whether wireless powersave must be enabled.
+ **/
+typedef enum {
+	NM_SETTING_WIRELESS_POWERSAVE_DEFAULT       = 0,
+	NM_SETTING_WIRELESS_POWERSAVE_IGNORE        = 1,
+	NM_SETTING_WIRELESS_POWERSAVE_DISABLE       = 2,
+	NM_SETTING_WIRELESS_POWERSAVE_ENABLE        = 3,
+	_NM_SETTING_WIRELESS_POWERSAVE_NUM, /*< skip >*/
+	NM_SETTING_WIRELESS_POWERSAVE_LAST          =  _NM_SETTING_WIRELESS_POWERSAVE_NUM - 1, /*< skip >*/
+} NMSettingWirelessPowersave;
+
+
 struct _NMSettingWireless {
 	NMSetting parent;
 };
diff --git a/libnm-core/nm-setting.c b/libnm-core/nm-setting.c
index b08eea10..fec645b2 100644
--- a/libnm-core/nm-setting.c
+++ b/libnm-core/nm-setting.c
@@ -20,18 +20,17 @@
  * Copyright 2007 - 2008 Novell, Inc.
  */
 
-#include "config.h"
+#include "nm-default.h"
+
+#include "nm-setting.h"
 
 #include <string.h>
 
-#include "nm-default.h"
-#include "nm-setting.h"
 #include "nm-setting-private.h"
 #include "nm-utils.h"
 #include "nm-core-internal.h"
 #include "nm-utils-private.h"
 #include "nm-property-compare.h"
-#include "nm-macros-internal.h"
 
 #include "nm-setting-connection.h"
 #include "nm-setting-bond.h"
diff --git a/libnm-core/nm-simple-connection.c b/libnm-core/nm-simple-connection.c
index c67f6244..1036c8ec 100644
--- a/libnm-core/nm-simple-connection.c
+++ b/libnm-core/nm-simple-connection.c
@@ -19,7 +19,7 @@
  * Copyright 2007 - 2014 Red Hat, Inc.
  */
 
-#include "config.h"
+#include "nm-default.h"
 
 #include "nm-simple-connection.h"
 #include "nm-setting-private.h"
diff --git a/libnm-core/nm-utils.c b/libnm-core/nm-utils.c
index 930f528e..52d4e8b8 100644
--- a/libnm-core/nm-utils.c
+++ b/libnm-core/nm-utils.c
@@ -19,7 +19,9 @@
  * Copyright 2005 - 2014 Red Hat, Inc.
  */
 
-#include "config.h"
+#include "nm-default.h"
+
+#include "nm-utils.h"
 
 #include <string.h>
 #include <errno.h>
@@ -31,13 +33,9 @@
 #include <gmodule.h>
 #include <sys/stat.h>
 
-#include "nm-default.h"
-#include "nm-utils.h"
 #include "nm-utils-private.h"
 #include "nm-setting-private.h"
 #include "crypto.h"
-#include "nm-macros-internal.h"
-
 #include "nm-setting-bond.h"
 #include "nm-setting-bridge.h"
 #include "nm-setting-infiniband.h"
@@ -48,7 +46,7 @@
 #include "nm-setting-wireless.h"
 
 /* Embed the commit id in the build binary */
-static const char *const __nm_git_sha = STRLEN (NM_GIT_SHA) > 0 ? "NM_GIT_SHA:"NM_GIT_SHA : "";
+static const char *const __nm_git_sha = NM_STRLEN (NM_GIT_SHA) > 0 ? "NM_GIT_SHA:"NM_GIT_SHA : "";
 
 /**
  * SECTION:nm-utils
diff --git a/libnm-core/nm-vpn-editor-plugin.c b/libnm-core/nm-vpn-editor-plugin.c
index 2d4fdf9c..5a1eed88 100644
--- a/libnm-core/nm-vpn-editor-plugin.c
+++ b/libnm-core/nm-vpn-editor-plugin.c
@@ -20,14 +20,10 @@
  * Copyright 2015 Red Hat, Inc.
  */
 
-#include "config.h"
+#include "nm-default.h"
 
 #include "nm-vpn-editor-plugin.h"
 
-#include <gio/gio.h>
-
-#include "nm-macros-internal.h"
-#include "gsystem-local-alloc.h"
 #include "nm-core-internal.h"
 
 static void nm_vpn_editor_plugin_default_init (NMVpnEditorPluginInterface *iface);
@@ -209,8 +205,11 @@ nm_vpn_editor_plugin_load_from_file  (const char *plugin_filename,
 
 /**
  * nm_vpn_editor_plugin_get_editor:
+ * @plugin: the #NMVpnEditorPlugin
+ * @connection: the #NMConnection to be edited
+ * @error: on return, an error or %NULL
  *
- * Returns: (transfer full):
+ * Returns: (transfer full): a new #NMVpnEditor or %NULL on error
  */
 NMVpnEditor *
 nm_vpn_editor_plugin_get_editor (NMVpnEditorPlugin *plugin,
@@ -232,8 +231,12 @@ nm_vpn_editor_plugin_get_capabilities (NMVpnEditorPlugin *plugin)
 
 /**
  * nm_vpn_editor_plugin_import:
+ * @plugin: the #NMVpnEditorPlugin
+ * @path: full path to the file to attempt to read into a new #NMConnection
+ * @error: on return, an error or %NULL
  *
- * Returns: (transfer full):
+ * Returns: (transfer full): a new #NMConnection imported from @path, or %NULL
+ * on error or if the file at @path was not recognized by this plugin
  */
 NMConnection *
 nm_vpn_editor_plugin_import (NMVpnEditorPlugin *plugin,
diff --git a/libnm-core/nm-vpn-plugin-info.c b/libnm-core/nm-vpn-plugin-info.c
index 3a4796b9..53278fca 100644
--- a/libnm-core/nm-vpn-plugin-info.c
+++ b/libnm-core/nm-vpn-plugin-info.c
@@ -18,18 +18,15 @@
  * Copyright 2015 Red Hat, Inc.
  */
 
-#include "config.h"
+#include "nm-default.h"
 
 #include "nm-vpn-plugin-info.h"
 
-#include <gio/gio.h>
 #include <string.h>
 #include <errno.h>
 #include <sys/stat.h>
 
-#include "gsystem-local-alloc.h"
 #include "nm-errors.h"
-#include "nm-macros-internal.h"
 #include "nm-core-internal.h"
 
 #define DEFAULT_DIR_ETC     NMCONFDIR"/VPN"
@@ -140,7 +137,7 @@ nm_vpn_plugin_info_check_file_full (const char *filename,
 
 /**
  * _nm_vpn_plugin_info_check_file:
- * @filename:
+ * @filename: the file to check
  * @check_absolute: if %TRUE, only allow absolute path names.
  * @do_validate_filename: if %TRUE, only accept the filename if
  *   nm_vpn_plugin_info_validate_filename() succeeds.
diff --git a/libnm-core/tests/test-compare.c b/libnm-core/tests/test-compare.c
index 914330fe..dca5c7d3 100644
--- a/libnm-core/tests/test-compare.c
+++ b/libnm-core/tests/test-compare.c
@@ -19,12 +19,11 @@
  * Copyright 2007 - 2008 Novell, Inc.
  */
 
-#include "config.h"
+#include "nm-default.h"
 
 #include <arpa/inet.h>
 #include <netinet/in.h>
 
-#include "nm-default.h"
 #include "nm-property-compare.h"
 
 #include "nm-test-utils.h"
diff --git a/libnm-core/tests/test-crypto.c b/libnm-core/tests/test-crypto.c
index 926cddb0..bd87c710 100644
--- a/libnm-core/tests/test-crypto.c
+++ b/libnm-core/tests/test-crypto.c
@@ -21,14 +21,13 @@
  * Copyright 2007 - 2011 Red Hat, Inc.
  */
 
-#include "config.h"
+#include "nm-default.h"
 
 #include <unistd.h>
 #include <stdlib.h>
 #include <stdio.h>
 #include <string.h>
 
-#include "nm-default.h"
 #include "crypto.h"
 #include "nm-utils.h"
 #include "nm-errors.h"
@@ -439,12 +438,14 @@ int
 main (int argc, char **argv)
 {
 	GError *error = NULL;
+	gboolean success;
 	int ret;
 
 	nmtst_init (&argc, &argv, TRUE);
 
-	if (!crypto_init (&error))
-		FAIL ("crypto-init", "failed to initialize crypto: %s", error->message);
+	success = crypto_init (&error);
+	g_assert_no_error (error);
+	g_assert (success);
 
 	g_test_add_data_func ("/libnm/crypto/cert/pem",
 	                      "test_ca_cert.pem",
diff --git a/libnm-core/tests/test-general.c b/libnm-core/tests/test-general.c
index e8eb0baf..82af4140 100644
--- a/libnm-core/tests/test-general.c
+++ b/libnm-core/tests/test-general.c
@@ -21,13 +21,11 @@
 
 #define NM_GLIB_COMPAT_H_TEST
 
-#include "config.h"
+#include "nm-default.h"
 
 #include <string.h>
 
-#include <nm-utils.h>
-#include "nm-default.h"
-
+#include "nm-utils.h"
 #include "nm-setting-private.h"
 #include "nm-utils.h"
 #include "nm-utils-private.h"
@@ -62,9 +60,10 @@
 #include "nm-simple-connection.h"
 #include "nm-keyfile-internal.h"
 
-#include "nm-test-utils.h"
 #include "test-general-enums.h"
 
+#include "nm-test-utils.h"
+
 /* When passing a "bool" typed argument to a variadic function that
  * expects a gboolean, the compiler will promote the integer type
  * to have at least size (int). That way:
@@ -73,56 +72,47 @@
 G_STATIC_ASSERT (sizeof (gboolean) == sizeof (int));
 G_STATIC_ASSERT (sizeof (bool) <= sizeof (int));
 
+/*****************************************************************************/
+
 static void
 vpn_check_func (const char *key, const char *value, gpointer user_data)
 {
-	const char *test = user_data;
-
 	if (!strcmp (key, "foobar1")) {
-		ASSERT (strcmp (value, "blahblah1") == 0,
-				test, "unexpected vpn item '%s' / '%s'", key, value);
+		g_assert_cmpstr (value, ==, "blahblah1");
 		return;
 	}
 
 	if (!strcmp (key, "foobar2")) {
-		ASSERT (strcmp (value, "blahblah2") == 0,
-				test, "unexpected vpn item '%s' / '%s'", key, value);
+		g_assert_cmpstr (value, ==, "blahblah2");
 		return;
 	}
 
 	if (!strcmp (key, "foobar3")) {
-		ASSERT (strcmp (value, "blahblah3") == 0,
-				test, "unexpected vpn item '%s' / '%s'", key, value);
+		g_assert_cmpstr (value, ==, "blahblah3");
 		return;
 	}
 
 	if (!strcmp (key, "foobar4")) {
-		ASSERT (strcmp (value, "blahblah4") == 0,
-				test, "unexpected vpn item '%s' / '%s'", key, value);
+		g_assert_cmpstr (value, ==, "blahblah4");
 		return;
 	}
 
-	ASSERT (FALSE, test, "unexpected vpn item '%s'", key);
+	g_assert_not_reached ();
 }
 
 static void
 vpn_check_empty_func (const char *key, const char *value, gpointer user_data)
 {
-	const char *test = user_data;
-
-	/* We don't expect any values */
-	ASSERT (FALSE, test, "unexpected vpn item '%s'", key);
+	g_assert_not_reached ();
 }
 
 static void
 test_setting_vpn_items (void)
 {
-	NMSettingVpn *s_vpn;
+	gs_unref_object NMSettingVpn *s_vpn = NULL;
 
 	s_vpn = (NMSettingVpn *) nm_setting_vpn_new ();
-	ASSERT (s_vpn != NULL,
-	        "vpn-items",
-	        "error creating vpn setting");
+	g_assert (s_vpn);
 
 	nm_setting_vpn_add_data_item (s_vpn, "foobar1", "blahblah1");
 	nm_setting_vpn_add_data_item (s_vpn, "foobar2", "blahblah2");
@@ -130,7 +120,7 @@ test_setting_vpn_items (void)
 	nm_setting_vpn_add_data_item (s_vpn, "foobar4", "blahblah4");
 
 	/* Ensure that added values are all present */
-	nm_setting_vpn_foreach_data_item (s_vpn, vpn_check_func, "vpn-data");
+	nm_setting_vpn_foreach_data_item (s_vpn, vpn_check_func, NULL);
 	nm_setting_vpn_remove_data_item (s_vpn, "foobar1");
 	nm_setting_vpn_remove_data_item (s_vpn, "foobar2");
 	nm_setting_vpn_remove_data_item (s_vpn, "foobar3");
@@ -142,7 +132,7 @@ test_setting_vpn_items (void)
 	nm_setting_vpn_add_secret (s_vpn, "foobar4", "blahblah4");
 
 	/* Ensure that added values are all present */
-	nm_setting_vpn_foreach_secret (s_vpn, vpn_check_func, "vpn-secrets");
+	nm_setting_vpn_foreach_secret (s_vpn, vpn_check_func, NULL);
 	nm_setting_vpn_remove_secret (s_vpn, "foobar1");
 	nm_setting_vpn_remove_secret (s_vpn, "foobar2");
 	nm_setting_vpn_remove_secret (s_vpn, "foobar3");
@@ -173,7 +163,7 @@ test_setting_vpn_items (void)
 	nm_setting_vpn_add_data_item (s_vpn, "", "blahblah1");
 	g_test_assert_expected_messages ();
 
-	nm_setting_vpn_foreach_data_item (s_vpn, vpn_check_empty_func, "vpn-data-empty");
+	nm_setting_vpn_foreach_data_item (s_vpn, vpn_check_empty_func, NULL);
 
 	/* Try to add some blank secrets and make sure they are rejected */
 	g_test_expect_message ("libnm", G_LOG_LEVEL_CRITICAL, "*key != NULL*");
@@ -200,9 +190,7 @@ test_setting_vpn_items (void)
 	nm_setting_vpn_add_secret (s_vpn, "", "blahblah1");
 	g_test_assert_expected_messages ();
 
-	nm_setting_vpn_foreach_secret (s_vpn, vpn_check_empty_func, "vpn-secrets-empty");
-
-	g_object_unref (s_vpn);
+	nm_setting_vpn_foreach_secret (s_vpn, vpn_check_empty_func, NULL);
 }
 
 static void
@@ -221,14 +209,7 @@ test_setting_vpn_update_secrets (void)
 	const char *val2 = "value2";
 
 	connection = nm_simple_connection_new ();
-	ASSERT (connection != NULL,
-	        "vpn-update-secrets",
-	        "error creating connection");
-
 	s_vpn = (NMSettingVpn *) nm_setting_vpn_new ();
-	ASSERT (s_vpn != NULL,
-	        "vpn-update-secrets",
-	        "error creating vpn setting");
 	nm_connection_add_setting (connection, NM_SETTING (s_vpn));
 
 	g_variant_builder_init (&settings_builder, NM_VARIANT_TYPE_CONNECTION);
@@ -247,21 +228,17 @@ test_setting_vpn_update_secrets (void)
 	settings = g_variant_builder_end (&settings_builder);
 
 	success = nm_connection_update_secrets (connection, NM_SETTING_VPN_SETTING_NAME, settings, &error);
-	ASSERT (success == TRUE,
-	        "vpn-update-secrets", "failed to update VPN secrets: %s", error->message);
+	g_assert_no_error (error);
+	g_assert (success);
 
 	/* Read the secrets back out */
 	tmp = nm_setting_vpn_get_secret (s_vpn, key1);
-	ASSERT (tmp != NULL,
-	        "vpn-update-secrets", "unexpected failure getting key #1");
-	ASSERT (strcmp (tmp, val1) == 0,
-	        "vpn-update-secrets", "unexpected key #1 value");
+	g_assert (tmp);
+	g_assert_cmpstr (tmp, ==, val1);
 
 	tmp = nm_setting_vpn_get_secret (s_vpn, key2);
-	ASSERT (tmp != NULL,
-	        "vpn-update-secrets", "unexpected failure getting key #2");
-	ASSERT (strcmp (tmp, val2) == 0,
-	        "vpn-update-secrets", "unexpected key #2 value");
+	g_assert (tmp);
+	g_assert_cmpstr (tmp, ==, val2);
 
 	g_variant_unref (settings);
 	g_object_unref (connection);
@@ -666,25 +643,17 @@ test_setting_gsm_apn_spaces (void)
 	const char *tmp;
 
 	s_gsm = (NMSettingGsm *) nm_setting_gsm_new ();
-	ASSERT (s_gsm != NULL,
-	        "gsm-apn-spaces",
-	        "error creating GSM setting");
+	g_assert (s_gsm);
 
 	/* Trailing space */
 	g_object_set (s_gsm, NM_SETTING_GSM_APN, "foobar ", NULL);
 	tmp = nm_setting_gsm_get_apn (s_gsm);
-	ASSERT (tmp != NULL,
-	        "gsm-apn-spaces", "empty APN");
-	ASSERT (strcmp (tmp, "foobar") == 0,
-	        "gsm-apn-spaces", "unexpected APN");
+	g_assert_cmpstr (tmp, ==, "foobar");
 
 	/* Leading space */
 	g_object_set (s_gsm, NM_SETTING_GSM_APN, " foobar", NULL);
 	tmp = nm_setting_gsm_get_apn (s_gsm);
-	ASSERT (tmp != NULL,
-	        "gsm-apn-spaces", "empty APN");
-	ASSERT (strcmp (tmp, "foobar") == 0,
-	        "gsm-apn-spaces", "unexpected APN");
+	g_assert_cmpstr (tmp, ==, "foobar");
 }
 
 static void
@@ -693,36 +662,29 @@ test_setting_gsm_apn_bad_chars (void)
 	gs_unref_object NMSettingGsm *s_gsm = NULL;
 
 	s_gsm = (NMSettingGsm *) nm_setting_gsm_new ();
-	ASSERT (s_gsm != NULL,
-	        "gsm-apn-bad-chars",
-	        "error creating GSM setting");
+	g_assert (s_gsm);
 
 	g_object_set (s_gsm, NM_SETTING_GSM_NUMBER, "*99#", NULL);
 
 	/* Make sure a valid APN works */
 	g_object_set (s_gsm, NM_SETTING_GSM_APN, "foobar123.-baz", NULL);
-	ASSERT (nm_setting_verify (NM_SETTING (s_gsm), NULL, NULL) == TRUE,
-	        "gsm-apn-bad-chars", "unexpectedly invalid GSM setting");
+	g_assert (nm_setting_verify (NM_SETTING (s_gsm), NULL, NULL));
 
 	/* Random invalid chars */
 	g_object_set (s_gsm, NM_SETTING_GSM_APN, "@#%$@#%@#%", NULL);
-	ASSERT (nm_setting_verify (NM_SETTING (s_gsm), NULL, NULL) == FALSE,
-	        "gsm-apn-bad-chars", "unexpectedly valid GSM setting");
+	g_assert (!nm_setting_verify (NM_SETTING (s_gsm), NULL, NULL));
 
 	/* Spaces */
 	g_object_set (s_gsm, NM_SETTING_GSM_APN, "foobar baz", NULL);
-	ASSERT (nm_setting_verify (NM_SETTING (s_gsm), NULL, NULL) == FALSE,
-	        "gsm-apn-bad-chars", "unexpectedly valid GSM setting");
+	g_assert (!nm_setting_verify (NM_SETTING (s_gsm), NULL, NULL));
 
 	/* 0 characters long */
 	g_object_set (s_gsm, NM_SETTING_GSM_APN, "", NULL);
-	ASSERT (nm_setting_verify (NM_SETTING (s_gsm), NULL, NULL) == FALSE,
-	        "gsm-apn-bad-chars", "unexpectedly valid GSM setting");
+	g_assert (!nm_setting_verify (NM_SETTING (s_gsm), NULL, NULL));
 
 	/* 65-character long */
 	g_object_set (s_gsm, NM_SETTING_GSM_APN, "abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijkl1", NULL);
-	ASSERT (nm_setting_verify (NM_SETTING (s_gsm), NULL, NULL) == FALSE,
-	        "gsm-apn-bad-chars", "unexpectedly valid GSM setting");
+	g_assert (!nm_setting_verify (NM_SETTING (s_gsm), NULL, NULL));
 }
 
 static void
@@ -791,7 +753,7 @@ make_test_wsec_setting (const char *detail)
 	NMSettingWirelessSecurity *s_wsec;
 
 	s_wsec = (NMSettingWirelessSecurity *) nm_setting_wireless_security_new ();
-	ASSERT (s_wsec != NULL, detail, "error creating setting");
+	g_assert (s_wsec);
 
 	g_object_set (s_wsec,
 	              NM_SETTING_WIRELESS_SECURITY_KEY_MGMT, "wpa-psk",
@@ -800,24 +762,17 @@ make_test_wsec_setting (const char *detail)
 	              NM_SETTING_WIRELESS_SECURITY_PSK_FLAGS, NM_SETTING_SECRET_FLAG_NOT_SAVED,
 	              NM_SETTING_WIRELESS_SECURITY_WEP_KEY0, "aaaaaaaaaa",
 	              NULL);
-
 	return s_wsec;
 }
 
-#define ASSERT_CONTAINS(vardict, key, test_name, msg) \
-	{ \
-		GVariant *value; \
-		value = g_variant_lookup_value (vardict, key, NULL); \
-		ASSERT (value != NULL, test_name, msg); \
-		g_variant_unref (value); \
-	}
+static gboolean
+_variant_contains (GVariant *vardict, const char *key)
+{
+	gs_unref_variant GVariant *value = NULL;
 
-#define ASSERT_NOT_CONTAINS(vardict, key, test_name, msg) \
-	{ \
-		GVariant *value; \
-		value = g_variant_lookup_value (vardict, key, NULL); \
-		ASSERT (value == NULL, test_name, msg); \
-	}
+	value = g_variant_lookup_value (vardict, key, NULL);
+	return !!value;
+}
 
 static void
 test_setting_to_dbus_all (void)
@@ -830,14 +785,10 @@ test_setting_to_dbus_all (void)
 	dict = _nm_setting_to_dbus (NM_SETTING (s_wsec), NULL, NM_CONNECTION_SERIALIZE_ALL);
 
 	/* Make sure all keys are there */
-	ASSERT_CONTAINS (dict, NM_SETTING_WIRELESS_SECURITY_KEY_MGMT,
-	        "setting-to-dbus-all", "unexpectedly missing " NM_SETTING_WIRELESS_SECURITY_KEY_MGMT);
-	ASSERT_CONTAINS (dict, NM_SETTING_WIRELESS_SECURITY_LEAP_USERNAME,
-	        "setting-to-dbus-all", "unexpectedly missing " NM_SETTING_WIRELESS_SECURITY_LEAP_USERNAME);
-	ASSERT_CONTAINS (dict, NM_SETTING_WIRELESS_SECURITY_PSK,
-	        "setting-to-dbus-all", "unexpectedly missing " NM_SETTING_WIRELESS_SECURITY_PSK);
-	ASSERT_CONTAINS (dict, NM_SETTING_WIRELESS_SECURITY_WEP_KEY0,
-	        "setting-to-dbus-all", "unexpectedly missing " NM_SETTING_WIRELESS_SECURITY_WEP_KEY0);
+	g_assert (_variant_contains (dict, NM_SETTING_WIRELESS_SECURITY_KEY_MGMT));
+	g_assert (_variant_contains (dict, NM_SETTING_WIRELESS_SECURITY_LEAP_USERNAME));
+	g_assert (_variant_contains (dict, NM_SETTING_WIRELESS_SECURITY_PSK));
+	g_assert (_variant_contains (dict, NM_SETTING_WIRELESS_SECURITY_WEP_KEY0));
 
 	g_variant_unref (dict);
 	g_object_unref (s_wsec);
@@ -854,16 +805,12 @@ test_setting_to_dbus_no_secrets (void)
 	dict = _nm_setting_to_dbus (NM_SETTING (s_wsec), NULL, NM_CONNECTION_SERIALIZE_NO_SECRETS);
 
 	/* Make sure non-secret keys are there */
-	ASSERT_CONTAINS (dict, NM_SETTING_WIRELESS_SECURITY_KEY_MGMT,
-	                 "setting-to-dbus-no-secrets", "unexpectedly missing " NM_SETTING_WIRELESS_SECURITY_KEY_MGMT);
-	ASSERT_CONTAINS (dict, NM_SETTING_WIRELESS_SECURITY_LEAP_USERNAME,
-	                 "setting-to-dbus-no-secrets", "unexpectedly missing " NM_SETTING_WIRELESS_SECURITY_LEAP_USERNAME);
+	g_assert (_variant_contains (dict, NM_SETTING_WIRELESS_SECURITY_KEY_MGMT));
+	g_assert (_variant_contains (dict, NM_SETTING_WIRELESS_SECURITY_LEAP_USERNAME));
 
 	/* Make sure secrets are not there */
-	ASSERT_NOT_CONTAINS (dict, NM_SETTING_WIRELESS_SECURITY_PSK,
-	                     "setting-to-dbus-no-secrets", "unexpectedly present " NM_SETTING_WIRELESS_SECURITY_PSK);
-	ASSERT_NOT_CONTAINS (dict, NM_SETTING_WIRELESS_SECURITY_WEP_KEY0,
-	                     "setting-to-dbus-no-secrets", "unexpectedly present " NM_SETTING_WIRELESS_SECURITY_WEP_KEY0);
+	g_assert (!_variant_contains (dict, NM_SETTING_WIRELESS_SECURITY_PSK));
+	g_assert (!_variant_contains (dict, NM_SETTING_WIRELESS_SECURITY_WEP_KEY0));
 
 	g_variant_unref (dict);
 	g_object_unref (s_wsec);
@@ -880,16 +827,12 @@ test_setting_to_dbus_only_secrets (void)
 	dict = _nm_setting_to_dbus (NM_SETTING (s_wsec), NULL, NM_CONNECTION_SERIALIZE_ONLY_SECRETS);
 
 	/* Make sure non-secret keys are not there */
-	ASSERT_NOT_CONTAINS (dict, NM_SETTING_WIRELESS_SECURITY_KEY_MGMT,
-	                     "setting-to-dbus-only-secrets", "unexpectedly present " NM_SETTING_WIRELESS_SECURITY_KEY_MGMT);
-	ASSERT_NOT_CONTAINS (dict, NM_SETTING_WIRELESS_SECURITY_LEAP_USERNAME,
-	                     "setting-to-dbus-only-secrets", "unexpectedly present " NM_SETTING_WIRELESS_SECURITY_LEAP_USERNAME);
+	g_assert (!_variant_contains (dict, NM_SETTING_WIRELESS_SECURITY_KEY_MGMT));
+	g_assert (!_variant_contains (dict, NM_SETTING_WIRELESS_SECURITY_LEAP_USERNAME));
 
 	/* Make sure secrets are there */
-	ASSERT_CONTAINS (dict, NM_SETTING_WIRELESS_SECURITY_PSK,
-	                 "setting-to-dbus-only-secrets", "unexpectedly missing " NM_SETTING_WIRELESS_SECURITY_PSK);
-	ASSERT_CONTAINS (dict, NM_SETTING_WIRELESS_SECURITY_WEP_KEY0,
-	                 "setting-to-dbus-only-secrets", "unexpectedly missing " NM_SETTING_WIRELESS_SECURITY_WEP_KEY0);
+	g_assert (_variant_contains (dict, NM_SETTING_WIRELESS_SECURITY_PSK));
+	g_assert (_variant_contains (dict, NM_SETTING_WIRELESS_SECURITY_WEP_KEY0));
 
 	g_variant_unref (dict);
 	g_object_unref (s_wsec);
@@ -1011,8 +954,7 @@ test_connection_to_dbus_setting_name (void)
 	/* Make sure the keys of the first level dict are setting names, not
 	 * the GType name of the setting objects.
 	 */
-	ASSERT_CONTAINS (dict, NM_SETTING_WIRELESS_SECURITY_SETTING_NAME,
-	                 "connection-to-dbus-setting-name", "unexpectedly missing " NM_SETTING_WIRELESS_SECURITY_SETTING_NAME);
+	g_assert (_variant_contains (dict, NM_SETTING_WIRELESS_SECURITY_SETTING_NAME));
 
 	g_variant_unref (dict);
 	g_object_unref (connection);
@@ -1643,24 +1585,20 @@ test_connection_new_from_dbus (void)
 static void
 check_permission (NMSettingConnection *s_con,
                   guint32 idx,
-                  const char *expected_uname,
-                  const char *tag)
+                  const char *expected_uname)
 {
 	gboolean success;
 	const char *ptype = NULL, *pitem = NULL, *detail = NULL;
 
 	success = nm_setting_connection_get_permission (s_con, 0, &ptype, &pitem, &detail);
-	ASSERT (success == TRUE, tag, "unexpected failure getting added permission");
+	g_assert (success);
 
-	/* Permission type */
-	ASSERT (ptype != NULL, tag, "unexpected failure getting permission type");
-	ASSERT (strcmp (ptype, "user") == 0, tag, "retrieved unexpected permission type");
+	g_assert_cmpstr (ptype, ==, "user");
 
-	/* Permission item */
-	ASSERT (pitem != NULL, tag, "unexpected failure getting permission item");
-	ASSERT (strcmp (pitem, expected_uname) == 0, tag, "retrieved unexpected permission item");
+	g_assert (pitem);
+	g_assert_cmpstr (pitem, ==, expected_uname);
 
-	ASSERT (detail == NULL, tag, "unexpected success getting permission detail");
+	g_assert (!detail);
 }
 
 #define TEST_UNAME "asdfasfasdf"
@@ -1680,79 +1618,66 @@ test_setting_connection_permissions_helpers (void)
 	g_test_expect_message ("libnm", G_LOG_LEVEL_CRITICAL, "*strcmp (ptype, \"user\") == 0*");
 	success = nm_setting_connection_add_permission (s_con, "foobar", "blah", NULL);
 	g_test_assert_expected_messages ();
-	ASSERT (success == FALSE,
-	        "setting-connection-permissions-helpers", "unexpected success adding bad permission type #1");
+	g_assert (!success);
 
 	/* Ensure a bad [type] is rejected */
 	g_test_expect_message ("libnm", G_LOG_LEVEL_CRITICAL, "*ptype*");
 	success = nm_setting_connection_add_permission (s_con, NULL, "blah", NULL);
 	g_test_assert_expected_messages ();
-	ASSERT (success == FALSE,
-	        "setting-connection-permissions-helpers", "unexpected success adding bad permission type #2");
+	g_assert (!success);
 
 	/* Ensure a bad [item] is rejected */
 	g_test_expect_message ("libnm", G_LOG_LEVEL_CRITICAL, "*uname*");
 	g_test_expect_message ("libnm", G_LOG_LEVEL_CRITICAL, "*p != NULL*");
 	success = nm_setting_connection_add_permission (s_con, "user", NULL, NULL);
 	g_test_assert_expected_messages ();
-	ASSERT (success == FALSE,
-	        "setting-connection-permissions-helpers", "unexpected success adding bad permission item #1");
+	g_assert (!success);
 
 	/* Ensure a bad [item] is rejected */
 	g_test_expect_message ("libnm", G_LOG_LEVEL_CRITICAL, "*uname[0] != '\\0'*");
 	g_test_expect_message ("libnm", G_LOG_LEVEL_CRITICAL, "*p != NULL*");
 	success = nm_setting_connection_add_permission (s_con, "user", "", NULL);
 	g_test_assert_expected_messages ();
-	ASSERT (success == FALSE,
-	        "setting-connection-permissions-helpers", "unexpected success adding bad permission item #2");
+	g_assert (!success);
 
 	/* Ensure an [item] with ':' is rejected */
 	g_test_expect_message ("libnm", G_LOG_LEVEL_CRITICAL, "*strchr (uname, ':')*");
 	g_test_expect_message ("libnm", G_LOG_LEVEL_CRITICAL, "*p != NULL*");
 	success = nm_setting_connection_add_permission (s_con, "user", "ad:asdf", NULL);
 	g_test_assert_expected_messages ();
-	ASSERT (success == FALSE,
-	        "setting-connection-permissions-helpers", "unexpected success adding bad permission item #3");
+	g_assert (!success);
 
 	/* Ensure a non-UTF-8 [item] is rejected */
 	g_test_expect_message ("libnm", G_LOG_LEVEL_CRITICAL, "*g_utf8_validate (uname, -1, NULL)*");
 	g_test_expect_message ("libnm", G_LOG_LEVEL_CRITICAL, "*p != NULL*");
 	success = nm_setting_connection_add_permission (s_con, "user", buf, NULL);
 	g_test_assert_expected_messages ();
-	ASSERT (success == FALSE,
-	        "setting-connection-permissions-helpers", "unexpected success adding bad permission item #4");
+	g_assert (!success);
 
 	/* Ensure a non-NULL [detail] is rejected */
 	g_test_expect_message ("libnm", G_LOG_LEVEL_CRITICAL, "*detail == NULL*");
 	success = nm_setting_connection_add_permission (s_con, "user", "dafasdf", "asdf");
 	g_test_assert_expected_messages ();
-	ASSERT (success == FALSE,
-	        "setting-connection-permissions-helpers", "unexpected success adding bad detail");
+	g_assert (!success);
 
 	/* Ensure a valid call results in success */
 	success = nm_setting_connection_add_permission (s_con, "user", TEST_UNAME, NULL);
-	ASSERT (success == TRUE,
-	        "setting-connection-permissions-helpers", "unexpected failure adding valid user permisson");
+	g_assert (success);
 
-	ASSERT (nm_setting_connection_get_num_permissions (s_con) == 1,
-	        "setting-connection-permissions-helpers", "unexpected failure getting number of permissions");
+	g_assert_cmpint (nm_setting_connection_get_num_permissions (s_con), ==, 1);
 
-	check_permission (s_con, 0, TEST_UNAME, "setting-connection-permissions-helpers");
+	check_permission (s_con, 0, TEST_UNAME);
 
 	/* Check the actual GObject property just to be paranoid */
 	g_object_get (G_OBJECT (s_con), NM_SETTING_CONNECTION_PERMISSIONS, &perms, NULL);
-	ASSERT (perms != NULL,
-	        "setting-connection-permissions-helpers", "unexpected failure getting permissions");
-	ASSERT (g_strv_length (perms) == 1,
-	        "setting-connection-permissions-helpers", "unexpected failure getting number of permissions");
-	ASSERT (strcmp (perms[0], expected_perm) == 0,
-	        "setting-connection-permissions-helpers", "unexpected permission property data");
+	g_assert (perms);
+	g_assert_cmpint (g_strv_length (perms), ==, 1);
+	g_assert_cmpstr (perms[0], ==, expected_perm);
 	g_strfreev (perms);
 
 	/* Now remove that permission and ensure we have 0 permissions */
 	nm_setting_connection_remove_permission (s_con, 0);
-	ASSERT (nm_setting_connection_get_num_permissions (s_con) == 0,
-	        "setting-connection-permissions-helpers", "unexpected failure removing permission");
+	g_assert_cmpint (nm_setting_connection_get_num_permissions (s_con), ==, 0);
 
 	g_object_unref (s_con);
 }
@@ -1804,69 +1729,59 @@ test_setting_connection_permissions_property (void)
 	g_test_expect_message ("libnm", G_LOG_LEVEL_CRITICAL, "*strncmp (str, PERM_USER_PREFIX, strlen (PERM_USER_PREFIX)) == 0*");
 	add_permission_property (s_con, "foobar", "blah", -1, NULL);
 	g_test_assert_expected_messages ();
-	ASSERT (nm_setting_connection_get_num_permissions (s_con) == 0,
-	        "setting-connection-permissions-property", "unexpected success adding bad permission type #1");
+	g_assert_cmpint (nm_setting_connection_get_num_permissions (s_con), ==, 0);
 
 	/* Ensure a bad [type] is rejected */
 	g_test_expect_message ("libnm", G_LOG_LEVEL_CRITICAL, "*strncmp (str, PERM_USER_PREFIX, strlen (PERM_USER_PREFIX)) == 0*");
 	add_permission_property (s_con, NULL, "blah", -1, NULL);
 	g_test_assert_expected_messages ();
-	ASSERT (nm_setting_connection_get_num_permissions (s_con) == 0,
-	        "setting-connection-permissions-property", "unexpected success adding bad permission type #2");
+	g_assert_cmpint (nm_setting_connection_get_num_permissions (s_con), ==, 0);
 
 	/* Ensure a bad [item] is rejected */
 	g_test_expect_message ("libnm", G_LOG_LEVEL_CRITICAL, "*last_colon > str*");
 	add_permission_property (s_con, "user", NULL, -1, NULL);
 	g_test_assert_expected_messages ();
-	ASSERT (nm_setting_connection_get_num_permissions (s_con) == 0,
-	        "setting-connection-permissions-property", "unexpected success adding bad permission item #1");
+	g_assert_cmpint (nm_setting_connection_get_num_permissions (s_con), ==, 0);
 
 	/* Ensure a bad [item] is rejected */
 	g_test_expect_message ("libnm", G_LOG_LEVEL_CRITICAL, "*last_colon > str*");
 	add_permission_property (s_con, "user", "", -1, NULL);
 	g_test_assert_expected_messages ();
-	ASSERT (nm_setting_connection_get_num_permissions (s_con) == 0,
-	        "setting-connection-permissions-property", "unexpected success adding bad permission item #2");
+	g_assert_cmpint (nm_setting_connection_get_num_permissions (s_con), ==, 0);
 
 	/* Ensure an [item] with ':' in the middle is rejected */
 	g_test_expect_message ("libnm", G_LOG_LEVEL_CRITICAL, "*str[i] != ':'*");
 	add_permission_property (s_con, "user", "ad:asdf", -1, NULL);
 	g_test_assert_expected_messages ();
-	ASSERT (nm_setting_connection_get_num_permissions (s_con) == 0,
-	        "setting-connection-permissions-property", "unexpected success adding bad permission item #3");
+	g_assert_cmpint (nm_setting_connection_get_num_permissions (s_con), ==, 0);
 
 	/* Ensure an [item] with ':' at the end is rejected */
 	g_test_expect_message ("libnm", G_LOG_LEVEL_CRITICAL, "*str[i] != ':'*");
 	add_permission_property (s_con, "user", "adasdfaf:", -1, NULL);
 	g_test_assert_expected_messages ();
-	ASSERT (nm_setting_connection_get_num_permissions (s_con) == 0,
-	        "setting-connection-permissions-property", "unexpected success adding bad permission item #4");
+	g_assert_cmpint (nm_setting_connection_get_num_permissions (s_con), ==, 0);
 
 	/* Ensure a non-UTF-8 [item] is rejected */
 	g_test_expect_message ("libnm", G_LOG_LEVEL_CRITICAL, "*g_utf8_validate (str, -1, NULL)*");
 	add_permission_property (s_con, "user", buf, (int) sizeof (buf), NULL);
 	g_test_assert_expected_messages ();
-	ASSERT (nm_setting_connection_get_num_permissions (s_con) == 0,
-	        "setting-connection-permissions-property", "unexpected success adding bad permission item #5");
+	g_assert_cmpint (nm_setting_connection_get_num_permissions (s_con), ==, 0);
 
 	/* Ensure a non-NULL [detail] is rejected */
 	g_test_expect_message ("libnm", G_LOG_LEVEL_CRITICAL, "*(last_colon + 1) == '\\0'*");
 	add_permission_property (s_con, "user", "dafasdf", -1, "asdf");
 	g_test_assert_expected_messages ();
-	ASSERT (nm_setting_connection_get_num_permissions (s_con) == 0,
-	        "setting-connection-permissions-property", "unexpected success adding bad detail");
+	g_assert_cmpint (nm_setting_connection_get_num_permissions (s_con), ==, 0);
 
 	/* Ensure a valid call results in success */
 	success = nm_setting_connection_add_permission (s_con, "user", TEST_UNAME, NULL);
-	ASSERT (nm_setting_connection_get_num_permissions (s_con) == 1,
-	        "setting-connection-permissions-property", "unexpected failure adding valid user permisson");
+	g_assert_cmpint (nm_setting_connection_get_num_permissions (s_con), ==, 1);
 
-	check_permission (s_con, 0, TEST_UNAME, "setting-connection-permissions-property");
+	check_permission (s_con, 0, TEST_UNAME);
 
 	/* Now remove that permission and ensure we have 0 permissions */
 	nm_setting_connection_remove_permission (s_con, 0);
-	ASSERT (nm_setting_connection_get_num_permissions (s_con) == 0,
-	        "setting-connection-permissions-property", "unexpected failure removing permission");
+	g_assert_cmpint (nm_setting_connection_get_num_permissions (s_con), ==, 0);
 
 	g_object_unref (s_con);
 }
@@ -2040,12 +1955,13 @@ test_connection_diff_a_only (void)
 			{ NM_SETTING_IP_CONFIG_IGNORE_AUTO_ROUTES, NM_SETTING_DIFF_RESULT_IN_A },
 			{ NM_SETTING_IP_CONFIG_IGNORE_AUTO_DNS,    NM_SETTING_DIFF_RESULT_IN_A },
 			{ NM_SETTING_IP4_CONFIG_DHCP_CLIENT_ID,    NM_SETTING_DIFF_RESULT_IN_A },
-			{ NM_SETTING_IP4_CONFIG_DHCP_TIMEOUT,      NM_SETTING_DIFF_RESULT_IN_A },
+			{ NM_SETTING_IP_CONFIG_DHCP_TIMEOUT,       NM_SETTING_DIFF_RESULT_IN_A },
 			{ NM_SETTING_IP_CONFIG_DHCP_SEND_HOSTNAME, NM_SETTING_DIFF_RESULT_IN_A },
 			{ NM_SETTING_IP_CONFIG_DHCP_HOSTNAME,      NM_SETTING_DIFF_RESULT_IN_A },
 			{ NM_SETTING_IP4_CONFIG_DHCP_FQDN,         NM_SETTING_DIFF_RESULT_IN_A },
 			{ NM_SETTING_IP_CONFIG_NEVER_DEFAULT,      NM_SETTING_DIFF_RESULT_IN_A },
 			{ NM_SETTING_IP_CONFIG_MAY_FAIL,           NM_SETTING_DIFF_RESULT_IN_A },
+			{ NM_SETTING_IP_CONFIG_DAD_TIMEOUT,        NM_SETTING_DIFF_RESULT_IN_A },
 			{ NULL, NM_SETTING_DIFF_RESULT_UNKNOWN },
 		} },
 	};
@@ -2773,18 +2689,18 @@ test_ip4_netmask_to_prefix (void)
 }
 
 #define ASSERT_CHANGED(statement) \
-{ \
+G_STMT_START { \
 	changed = FALSE; \
 	statement; \
 	g_assert (changed); \
-}
+} G_STMT_END
 
 #define ASSERT_UNCHANGED(statement) \
-{ \
+G_STMT_START { \
 	changed = FALSE; \
 	statement; \
 	g_assert (!changed); \
-}
+} G_STMT_END
 
 static void
 test_connection_changed_signal (void)
@@ -3389,6 +3305,7 @@ _test_connection_normalize_type_normalizable_setting (const char *type,
 
 	g_assert (!nm_connection_get_setting_by_name (con, type));
 	nmtst_assert_connection_verifies_after_normalization (con, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_MISSING_SETTING);
+	nmtst_connection_normalize (con);
 
 	s_base = nm_connection_get_setting_by_name (con, type);
 	g_assert (s_base);
@@ -3445,6 +3362,7 @@ _test_connection_normalize_type_normalizable_type (const char *type,
 	g_assert (nm_connection_get_setting_by_name (con, type) == s_base);
 
 	nmtst_assert_connection_verifies_after_normalization (con, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_MISSING_PROPERTY);
+	nmtst_connection_normalize (con);
 
 	g_assert_cmpstr (nm_connection_get_connection_type (con), ==, type);
 	g_assert (nm_connection_get_setting_by_name (con, type) == s_base);
@@ -3709,6 +3627,7 @@ test_connection_normalize_slave_type_1 (void)
 
 	g_assert (!nm_connection_get_setting_by_name (con, NM_SETTING_BRIDGE_PORT_SETTING_NAME));
 	nmtst_assert_connection_verifies_after_normalization (con, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_MISSING_SETTING);
+	nmtst_connection_normalize (con);
 	g_assert (nm_connection_get_setting_by_name (con, NM_SETTING_BRIDGE_PORT_SETTING_NAME));
 	g_assert_cmpstr (nm_setting_connection_get_slave_type (s_con), ==, NM_SETTING_BRIDGE_SETTING_NAME);
 }
@@ -3739,6 +3658,7 @@ test_connection_normalize_slave_type_2 (void)
 	g_assert (nm_connection_get_setting_by_name (con, NM_SETTING_BRIDGE_PORT_SETTING_NAME));
 	g_assert_cmpstr (nm_setting_connection_get_slave_type (s_con), ==, NULL);
 	nmtst_assert_connection_verifies_after_normalization (con, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_MISSING_PROPERTY);
+	nmtst_connection_normalize (con);
 	g_assert (nm_connection_get_setting_by_name (con, NM_SETTING_BRIDGE_PORT_SETTING_NAME));
 	g_assert_cmpstr (nm_setting_connection_get_slave_type (s_con), ==, NM_SETTING_BRIDGE_SETTING_NAME);
 }
@@ -3762,7 +3682,8 @@ test_connection_normalize_infiniband_mtu (void)
 	              NM_SETTING_INFINIBAND_TRANSPORT_MODE, "datagram",
 	              NM_SETTING_INFINIBAND_MTU, (guint) 2044,
 	              NULL);
-	nmtst_assert_connection_verifies_without_normalization (con);
+	nmtst_assert_connection_verifies_and_normalizable (con);
+	nmtst_connection_normalize (con);
 	g_assert_cmpint (2044, ==, nm_setting_infiniband_get_mtu (s_infini));
 
 	g_object_set (s_infini,
@@ -3770,6 +3691,7 @@ test_connection_normalize_infiniband_mtu (void)
 	              NM_SETTING_INFINIBAND_MTU, (guint) 2045,
 	              NULL);
 	nmtst_assert_connection_verifies_after_normalization (con, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_INVALID_PROPERTY);
+	nmtst_connection_normalize (con);
 	g_assert_cmpint (2044, ==, nm_setting_infiniband_get_mtu (s_infini));
 
 	g_object_set (s_infini,
@@ -3784,6 +3706,7 @@ test_connection_normalize_infiniband_mtu (void)
 	              NM_SETTING_INFINIBAND_MTU, (guint) 65521,
 	              NULL);
 	nmtst_assert_connection_verifies_after_normalization (con, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_INVALID_PROPERTY);
+	nmtst_connection_normalize (con);
 	g_assert_cmpint (65520, ==, nm_setting_infiniband_get_mtu (s_infini));
 }
 
@@ -4023,6 +3946,7 @@ test_setting_compare_default_strv (void)
 	c1 = nmtst_create_minimal_connection ("test_compare_default_strv", NULL,
 	                                      NM_SETTING_WIRED_SETTING_NAME, NULL);
 	nmtst_assert_connection_verifies_and_normalizable (c1);
+	nmtst_connection_normalize (c1);
 
 	c2 = nm_simple_connection_new_clone (c1);
 	nmtst_assert_connection_verifies_without_normalization (c2);
@@ -4863,6 +4787,8 @@ test_nm_in_set (void)
 	_ASSERT (4,  NM_IN_SET (-1, G( 1), G( 2), G( 3), G(-1)));
 
 	_ASSERT (4,  NM_IN_SET (-1, G( 1), G( 2), G( 3), G(-1), G( 5)));
+	_ASSERT (5,  NM_IN_SET (-1, G( 1), G( 2), G( 3), G( 4), G(-1)));
+	_ASSERT (6,  NM_IN_SET (-1, G( 1), G( 2), G( 3), G( 4), G( 5), G( -1)));
 
 	_ASSERT (1, !NM_IN_SET_SE (-1, G( 1)));
 	_ASSERT (1,  NM_IN_SET_SE (-1, G(-1)));
@@ -4888,6 +4814,133 @@ test_nm_in_set (void)
 	_ASSERT (4,  NM_IN_SET_SE (-1, G( 1), G( 2), G( 3), G(-1)));
 
 	_ASSERT (5,  NM_IN_SET_SE (-1, G( 1), G( 2), G( 3), G(-1), G( 5)));
+	_ASSERT (6,  NM_IN_SET_SE (-1, G( 1), G( 2), G( 3), G( 4), G( 5), G(-1)));
+#undef G
+#undef N
+#undef _ASSERT
+}
+
+/******************************************************************************/
+
+static const char *
+_test_nm_in_set_getstr (int *call_counter, gboolean allow_called, const char *value)
+{
+	g_assert (call_counter);
+	*call_counter += 1;
+	if (!allow_called)
+		g_assert_not_reached ();
+	return value;
+}
+
+static void
+test_nm_in_strset (void)
+{
+	int call_counter = 0;
+
+#define G(x) _test_nm_in_set_getstr (&call_counter, TRUE,  x)
+#define N(x) _test_nm_in_set_getstr (&call_counter, FALSE,  x)
+#define _ASSERT(expected, expr) \
+	G_STMT_START { \
+		_test_nm_in_set_assert (&call_counter, 0); \
+		g_assert (expr); \
+		_test_nm_in_set_assert (&call_counter, (expected)); \
+	} G_STMT_END
+	_ASSERT (1,  NM_IN_STRSET (NULL, G(NULL)));
+	_ASSERT (1, !NM_IN_STRSET ("a",  G(NULL)));
+	_ASSERT (1, !NM_IN_STRSET (NULL, G("a")));
+
+	_ASSERT (1,  NM_IN_STRSET_SE (NULL, G(NULL)));
+	_ASSERT (1, !NM_IN_STRSET_SE ("a",  G(NULL)));
+	_ASSERT (1, !NM_IN_STRSET_SE (NULL, G("a")));
+
+	_ASSERT (1,  NM_IN_STRSET (NULL, G(NULL), N(NULL)));
+	_ASSERT (2, !NM_IN_STRSET ("a",  G(NULL), G(NULL)));
+	_ASSERT (2,  NM_IN_STRSET (NULL, G("a"),  G(NULL)));
+	_ASSERT (1,  NM_IN_STRSET (NULL, G(NULL), N("a")));
+	_ASSERT (2,  NM_IN_STRSET ("a",  G(NULL), G("a")));
+	_ASSERT (2, !NM_IN_STRSET (NULL, G("a"),  G("a")));
+	_ASSERT (1,  NM_IN_STRSET (NULL, G(NULL), N("b")));
+	_ASSERT (2, !NM_IN_STRSET ("a",  G(NULL), G("b")));
+	_ASSERT (2, !NM_IN_STRSET (NULL, G("a"),  G("b")));
+
+	_ASSERT (2,  NM_IN_STRSET_SE (NULL, G(NULL), G(NULL)));
+	_ASSERT (2, !NM_IN_STRSET_SE ("a",  G(NULL), G(NULL)));
+	_ASSERT (2,  NM_IN_STRSET_SE (NULL, G("a"),  G(NULL)));
+	_ASSERT (2,  NM_IN_STRSET_SE (NULL, G(NULL), G("a")));
+	_ASSERT (2,  NM_IN_STRSET_SE ("a",  G(NULL), G("a")));
+	_ASSERT (2, !NM_IN_STRSET_SE (NULL, G("a"),  G("a")));
+	_ASSERT (2,  NM_IN_STRSET_SE (NULL, G(NULL), G("b")));
+	_ASSERT (2, !NM_IN_STRSET_SE ("a",  G(NULL), G("b")));
+	_ASSERT (2, !NM_IN_STRSET_SE (NULL, G("a"),  G("b")));
+
+	_ASSERT (1,  NM_IN_STRSET (NULL, G(NULL), N(NULL), N(NULL)));
+	_ASSERT (3, !NM_IN_STRSET ("a",  G(NULL), G(NULL), G(NULL)));
+	_ASSERT (2,  NM_IN_STRSET (NULL, G("a"),  G(NULL), N(NULL)));
+	_ASSERT (1,  NM_IN_STRSET (NULL, G(NULL), N("a"),  N(NULL)));
+	_ASSERT (2,  NM_IN_STRSET ("a",  G(NULL), G("a"),  N(NULL)));
+	_ASSERT (3,  NM_IN_STRSET (NULL, G("a"),  G("a"),  G(NULL)));
+	_ASSERT (1,  NM_IN_STRSET (NULL, G(NULL), N("b"),  N(NULL)));
+	_ASSERT (3, !NM_IN_STRSET ("a",  G(NULL), G("b"),  G(NULL)));
+	_ASSERT (3,  NM_IN_STRSET (NULL, G("a"),  G("b"),  G(NULL)));
+	_ASSERT (1,  NM_IN_STRSET (NULL, G(NULL), N(NULL), N("a")));
+	_ASSERT (3,  NM_IN_STRSET ("a",  G(NULL), G(NULL), G("a")));
+	_ASSERT (2,  NM_IN_STRSET (NULL, G("a"),  G(NULL), N("a")));
+	_ASSERT (1,  NM_IN_STRSET (NULL, G(NULL), N("a"),  N("a")));
+	_ASSERT (2,  NM_IN_STRSET ("a",  G(NULL), G("a"),  N("a")));
+	_ASSERT (3, !NM_IN_STRSET (NULL, G("a"),  G("a"),  G("a")));
+	_ASSERT (1,  NM_IN_STRSET (NULL, G(NULL), N("b"),  N("a")));
+	_ASSERT (3,  NM_IN_STRSET ("a",  G(NULL), G("b"),  G("a")));
+	_ASSERT (3, !NM_IN_STRSET (NULL, G("a"),  G("b"),  G("a")));
+	_ASSERT (1,  NM_IN_STRSET (NULL, G(NULL), N(NULL), N("b")));
+	_ASSERT (3, !NM_IN_STRSET ("a",  G(NULL), G(NULL), G("b")));
+	_ASSERT (2,  NM_IN_STRSET (NULL, G("a"),  G(NULL), N("b")));
+	_ASSERT (1,  NM_IN_STRSET (NULL, G(NULL), N("a"),  N("b")));
+	_ASSERT (2,  NM_IN_STRSET ("a",  G(NULL), G("a"),  N("b")));
+	_ASSERT (3, !NM_IN_STRSET (NULL, G("a"),  G("a"),  G("b")));
+	_ASSERT (1,  NM_IN_STRSET (NULL, G(NULL), N("b"),  N("b")));
+	_ASSERT (3, !NM_IN_STRSET ("a",  G(NULL), G("b"),  G("b")));
+	_ASSERT (3, !NM_IN_STRSET (NULL, G("a"),  G("b"),  G("b")));
+
+	_ASSERT (3,  NM_IN_STRSET_SE (NULL, G(NULL), G(NULL), G(NULL)));
+	_ASSERT (3, !NM_IN_STRSET_SE ("a",  G(NULL), G(NULL), G(NULL)));
+	_ASSERT (3,  NM_IN_STRSET_SE (NULL, G("a"),  G(NULL), G(NULL)));
+	_ASSERT (3,  NM_IN_STRSET_SE (NULL, G(NULL), G("a"),  G(NULL)));
+	_ASSERT (3,  NM_IN_STRSET_SE ("a",  G(NULL), G("a"),  G(NULL)));
+	_ASSERT (3,  NM_IN_STRSET_SE (NULL, G("a"),  G("a"),  G(NULL)));
+	_ASSERT (3,  NM_IN_STRSET_SE (NULL, G(NULL), G("b"),  G(NULL)));
+	_ASSERT (3, !NM_IN_STRSET_SE ("a",  G(NULL), G("b"),  G(NULL)));
+	_ASSERT (3,  NM_IN_STRSET_SE (NULL, G("a"),  G("b"),  G(NULL)));
+	_ASSERT (3,  NM_IN_STRSET_SE (NULL, G(NULL), G(NULL), G("a")));
+	_ASSERT (3,  NM_IN_STRSET_SE ("a",  G(NULL), G(NULL), G("a")));
+	_ASSERT (3,  NM_IN_STRSET_SE (NULL, G("a"),  G(NULL), G("a")));
+	_ASSERT (3,  NM_IN_STRSET_SE (NULL, G(NULL), G("a"),  G("a")));
+	_ASSERT (3,  NM_IN_STRSET_SE ("a",  G(NULL), G("a"),  G("a")));
+	_ASSERT (3, !NM_IN_STRSET_SE (NULL, G("a"),  G("a"),  G("a")));
+	_ASSERT (3,  NM_IN_STRSET_SE (NULL, G(NULL), G("b"),  G("a")));
+	_ASSERT (3,  NM_IN_STRSET_SE ("a",  G(NULL), G("b"),  G("a")));
+	_ASSERT (3, !NM_IN_STRSET_SE (NULL, G("a"),  G("b"),  G("a")));
+	_ASSERT (3,  NM_IN_STRSET_SE (NULL, G(NULL), G(NULL), G("b")));
+	_ASSERT (3, !NM_IN_STRSET_SE ("a",  G(NULL), G(NULL), G("b")));
+	_ASSERT (3,  NM_IN_STRSET_SE (NULL, G("a"),  G(NULL), G("b")));
+	_ASSERT (3,  NM_IN_STRSET_SE (NULL, G(NULL), G("a"),  G("b")));
+	_ASSERT (3,  NM_IN_STRSET_SE ("a",  G(NULL), G("a"),  G("b")));
+	_ASSERT (3, !NM_IN_STRSET_SE (NULL, G("a"),  G("a"),  G("b")));
+	_ASSERT (3,  NM_IN_STRSET_SE (NULL, G(NULL), G("b"),  G("b")));
+	_ASSERT (3, !NM_IN_STRSET_SE ("a",  G(NULL), G("b"),  G("b")));
+	_ASSERT (3, !NM_IN_STRSET_SE (NULL, G("a"),  G("b"),  G("b")));
+
+
+	_ASSERT (3,  NM_IN_STRSET ("a",  G(NULL), G("b"),  G("a"),  N("a")));
+	_ASSERT (4,  NM_IN_STRSET ("a",  G(NULL), G("b"),  G("c"),  G("a")));
+	_ASSERT (4, !NM_IN_STRSET ("a",  G(NULL), G("b"),  G("c"),  G("d")));
+
+	_ASSERT (4,  NM_IN_STRSET ("a",  G(NULL), G("b"),  G("c"),  G("a"),  N("a")));
+	_ASSERT (5,  NM_IN_STRSET ("a",  G(NULL), G("b"),  G("c"),  G("d"),  G("a")));
+	_ASSERT (5, !NM_IN_STRSET ("a",  G(NULL), G("b"),  G("c"),  G("d"),  G("e")));
+
+	_ASSERT (5,  NM_IN_STRSET ("a",  G(NULL), G("b"),  G("c"),  G("d"),  G("a"),  N("a")));
+	_ASSERT (6,  NM_IN_STRSET ("a",  G(NULL), G("b"),  G("c"),  G("d"),  G("e"),  G("a")));
+	_ASSERT (6, !NM_IN_STRSET ("a",  G(NULL), G("b"),  G("c"),  G("d"),  G("e"),  G("f")));
 #undef G
 #undef N
 #undef _ASSERT
@@ -4903,6 +4956,7 @@ int main (int argc, char **argv)
 
 	/* The tests */
 	g_test_add_func ("/core/general/test_nm_in_set", test_nm_in_set);
+	g_test_add_func ("/core/general/test_nm_in_strset", test_nm_in_strset);
 	g_test_add_func ("/core/general/test_setting_vpn_items", test_setting_vpn_items);
 	g_test_add_func ("/core/general/test_setting_vpn_update_secrets", test_setting_vpn_update_secrets);
 	g_test_add_func ("/core/general/test_setting_vpn_modify_during_foreach", test_setting_vpn_modify_during_foreach);
diff --git a/libnm-core/tests/test-keyfile.c b/libnm-core/tests/test-keyfile.c
index 99f88ac5..92b6c1f5 100644
--- a/libnm-core/tests/test-keyfile.c
+++ b/libnm-core/tests/test-keyfile.c
@@ -19,12 +19,10 @@
  *
  */
 
-#include "config.h"
+#include "nm-default.h"
 
-#include "nm-macros-internal.h"
 #include "nm-keyfile-utils.h"
 #include "nm-keyfile-internal.h"
-
 #include "nm-simple-connection.h"
 #include "nm-setting-connection.h"
 #include "nm-setting-wired.h"
@@ -113,9 +111,10 @@ _nm_keyfile_read (GKeyFile *keyfile,
 	con = nm_keyfile_read (keyfile, keyfile_name, base_dir, read_handler, read_data, &error);
 	g_assert_no_error (error);
 	g_assert (NM_IS_CONNECTION (con));
-	if (needs_normalization)
+	if (needs_normalization) {
 		nmtst_assert_connection_verifies_after_normalization (con, 0, 0);
-	else
+		nmtst_connection_normalize (con);
+	} else
 		nmtst_assert_connection_verifies_without_normalization (con);
 	return con;
 }
@@ -287,7 +286,7 @@ _test_8021x_cert_check_blob_full (NMConnection *con, const void *data, gsize len
 	_test_8021x_cert_check (con, NM_SETTING_802_1X_CK_SCHEME_BLOB, g_bytes_get_data (bytes, NULL), g_bytes_get_size (bytes));
 	g_bytes_unref (bytes);
 }
-#define _test_8021x_cert_check_blob(con, data) _test_8021x_cert_check_blob_full(con, data, STRLEN (data))
+#define _test_8021x_cert_check_blob(con, data) _test_8021x_cert_check_blob_full(con, data, NM_STRLEN (data))
 
 static void
 test_8021x_cert (void)
@@ -334,6 +333,7 @@ test_8021x_cert (void)
 
 	nm_connection_add_setting (con, NM_SETTING (s_8021x));
 	nmtst_assert_connection_verifies_and_normalizable (con);
+	nmtst_connection_normalize (con);
 
 
 	_test_8021x_cert_check (con, scheme, full_TEST_WIRED_TLS_CA_CERT, -1);
@@ -352,7 +352,7 @@ test_8021x_cert (void)
 	_test_8021x_cert_check_blob (con, "\0");
 	_test_8021x_cert_check_blob (con, "10");
 	_test_8021x_cert_check_blob (con, "data:;base64,a");
-	_test_8021x_cert_check_blob_full (con, "data:;base64,a", STRLEN ("data:;base64,a") + 1);
+	_test_8021x_cert_check_blob_full (con, "data:;base64,a", NM_STRLEN ("data:;base64,a") + 1);
 	_test_8021x_cert_check_blob (con, "data:;base64,file://a");
 	_test_8021x_cert_check_blob (con, "123");
 
diff --git a/libnm-core/tests/test-secrets.c b/libnm-core/tests/test-secrets.c
index 4c0c7f5d..a32ed4f1 100644
--- a/libnm-core/tests/test-secrets.c
+++ b/libnm-core/tests/test-secrets.c
@@ -19,11 +19,10 @@
  *
  */
 
-#include "config.h"
+#include "nm-default.h"
 
 #include <string.h>
 
-#include "nm-default.h"
 #include "nm-setting-8021x.h"
 #include "nm-setting-cdma.h"
 #include "nm-setting-connection.h"
@@ -37,6 +36,7 @@
 #include "nm-setting-wireless.h"
 #include "nm-simple-connection.h"
 #include "nm-utils.h"
+#include "nm-core-internal.h"
 
 #include "nm-test-utils.h"
 
@@ -44,16 +44,20 @@
 #define TEST_NEED_SECRETS_EAP_TLS_CLIENT_CERT TEST_CERT_DIR "/test_key_and_cert.pem"
 #define TEST_NEED_SECRETS_EAP_TLS_PRIVATE_KEY TEST_CERT_DIR "/test_key_and_cert.pem"
 
-static gboolean
-find_hints_item (GPtrArray *hints, const char *item)
+static void
+_assert_hints_has (GPtrArray *hints, const char *item)
 {
-	int i;
+	guint i;
+	guint found = 0;
 
+	g_assert (hints);
+	g_assert (item);
 	for (i = 0; i < hints->len; i++) {
-		if (!strcmp (item, (const char *) g_ptr_array_index (hints, i)))
-			return TRUE;
+		g_assert (hints->pdata[i]);
+		if (strcmp (hints->pdata[i], item) == 0)
+			found++;
 	}
-	return FALSE;
+	g_assert_cmpint (found, ==, 1);
 }
 
 static NMConnection *
@@ -100,18 +104,14 @@ make_tls_connection (const char *detail, NMSetting8021xCKScheme scheme)
 	                                         scheme,
 	                                         NULL,
 	                                         &error);
-	ASSERT (success == TRUE,
-	        detail, "failed to set CA certificate '%s': %s",
-	        TEST_NEED_SECRETS_EAP_TLS_CA_CERT, error->message);
+	nmtst_assert_success (success, error);
 
 	success = nm_setting_802_1x_set_client_cert (s_8021x,
 	                                             TEST_NEED_SECRETS_EAP_TLS_CLIENT_CERT,
 	                                             scheme,
 	                                             NULL,
 	                                             &error);
-	ASSERT (success == TRUE,
-	        detail, "failed to set client certificate '%s': %s",
-	        TEST_NEED_SECRETS_EAP_TLS_CLIENT_CERT, error->message);
+	nmtst_assert_success (success, error);
 
 	success = nm_setting_802_1x_set_private_key (s_8021x,
 	                                             TEST_NEED_SECRETS_EAP_TLS_PRIVATE_KEY,
@@ -119,9 +119,7 @@ make_tls_connection (const char *detail, NMSetting8021xCKScheme scheme)
 	                                             scheme,
 	                                             NULL,
 	                                             &error);
-	ASSERT (success == TRUE,
-	        detail, "failed to set private key '%s': %s",
-	        TEST_NEED_SECRETS_EAP_TLS_PRIVATE_KEY, error->message);
+	nmtst_assert_success (success, error);
 
 	/* IP4 setting */
 	s_ip4 = (NMSettingIP4Config *) nm_setting_ip4_config_new ();
@@ -129,9 +127,7 @@ make_tls_connection (const char *detail, NMSetting8021xCKScheme scheme)
 
 	g_object_set (s_ip4, NM_SETTING_IP_CONFIG_METHOD, NM_SETTING_IP4_CONFIG_METHOD_AUTO, NULL);
 
-	ASSERT (nm_connection_verify (connection, &error) == TRUE,
-	        detail, "failed to verify connection: %s",
-	        (error && error->message) ? error->message : "(unknown)");
+	nmtst_assert_connection_verifies_and_normalizable (connection);
 
 	return connection;
 }
@@ -144,37 +140,19 @@ test_need_tls_secrets_path (void)
 	GPtrArray *hints = NULL;
 
 	connection = make_tls_connection ("need-tls-secrets-path-key", NM_SETTING_802_1X_CK_SCHEME_PATH);
-	ASSERT (connection != NULL,
-	        "need-tls-secrets-path-key",
-	        "error creating test connection");
 
 	/* Ensure we don't need any secrets since we just set up the connection */
 	setting_name = nm_connection_need_secrets (connection, &hints);
-	ASSERT (setting_name == NULL,
-	        "need-tls-secrets-path-key",
-	        "secrets are unexpectedly required");
-	ASSERT (hints == NULL,
-	        "need-tls-secrets-path-key",
-	        "hints should be NULL since no secrets were required");
+	g_assert (!setting_name);
+	g_assert (!hints);
 
 	/* Connection is good; clear secrets and ensure private key password is then required */
 	nm_connection_clear_secrets (connection);
 
 	hints = NULL;
 	setting_name = nm_connection_need_secrets (connection, &hints);
-	ASSERT (setting_name != NULL,
-	        "need-tls-secrets-path-key-password",
-	        "unexpected secrets success");
-	ASSERT (strcmp (setting_name, NM_SETTING_802_1X_SETTING_NAME) == 0,
-			"need-tls-secrets-path-key-password",
-			"unexpected setting secrets required");
-
-	ASSERT (hints != NULL,
-	        "need-tls-secrets-path-key-password",
-	        "expected returned secrets hints");
-	ASSERT (find_hints_item (hints, NM_SETTING_802_1X_PRIVATE_KEY_PASSWORD),
-			"need-tls-secrets-path-key-password",
-			"expected to require private key password, but it wasn't");
+	g_assert_cmpstr (setting_name, ==, NM_SETTING_802_1X_SETTING_NAME);
+	_assert_hints_has (hints, NM_SETTING_802_1X_PRIVATE_KEY_PASSWORD);
 
 	g_ptr_array_free (hints, TRUE);
 	g_object_unref (connection);
@@ -188,37 +166,19 @@ test_need_tls_secrets_blob (void)
 	GPtrArray *hints = NULL;
 
 	connection = make_tls_connection ("need-tls-secrets-blob-key", NM_SETTING_802_1X_CK_SCHEME_BLOB);
-	ASSERT (connection != NULL,
-	        "need-tls-secrets-blob-key",
-	        "error creating test connection");
 
 	/* Ensure we don't need any secrets since we just set up the connection */
 	setting_name = nm_connection_need_secrets (connection, &hints);
-	ASSERT (setting_name == NULL,
-	        "need-tls-secrets-blob-key",
-	        "secrets are unexpectedly required");
-	ASSERT (hints == NULL,
-	        "need-tls-secrets-blob-key",
-	        "hints should be NULL since no secrets were required");
+	g_assert (!setting_name);
+	g_assert (!hints);
 
 	/* Clear secrets and ensure password is again required */
 	nm_connection_clear_secrets (connection);
 
 	hints = NULL;
 	setting_name = nm_connection_need_secrets (connection, &hints);
-	ASSERT (setting_name != NULL,
-	        "need-tls-secrets-blob-key-password",
-	        "unexpected secrets success");
-	ASSERT (strcmp (setting_name, NM_SETTING_802_1X_SETTING_NAME) == 0,
-			"need-tls-secrets-blob-key-password",
-			"unexpected setting secrets required");
-
-	ASSERT (hints != NULL,
-	        "need-tls-secrets-blob-key-password",
-	        "expected returned secrets hints");
-	ASSERT (find_hints_item (hints, NM_SETTING_802_1X_PRIVATE_KEY_PASSWORD),
-			"need-tls-secrets-blob-key-password",
-			"expected to require private key password, but it wasn't");
+	g_assert_cmpstr (setting_name, ==, NM_SETTING_802_1X_SETTING_NAME);
+	_assert_hints_has (hints, NM_SETTING_802_1X_PRIVATE_KEY_PASSWORD);
 
 	g_ptr_array_free (hints, TRUE);
 	g_object_unref (connection);
@@ -270,18 +230,14 @@ make_tls_phase2_connection (const char *detail, NMSetting8021xCKScheme scheme)
 	                                                scheme,
 	                                                NULL,
 	                                                &error);
-	ASSERT (success == TRUE,
-	        detail, "failed to set phase2 CA certificate '%s': %s",
-	        TEST_NEED_SECRETS_EAP_TLS_CA_CERT, error->message);
+	nmtst_assert_success (success, error);
 
 	success = nm_setting_802_1x_set_phase2_client_cert (s_8021x,
 	                                                    TEST_NEED_SECRETS_EAP_TLS_CLIENT_CERT,
 	                                                    scheme,
 	                                                    NULL,
 	                                                    &error);
-	ASSERT (success == TRUE,
-	        detail, "failed to set phase2 client certificate '%s': %s",
-	        TEST_NEED_SECRETS_EAP_TLS_CLIENT_CERT, error->message);
+	nmtst_assert_success (success, error);
 
 	success = nm_setting_802_1x_set_phase2_private_key (s_8021x,
 	                                                    TEST_NEED_SECRETS_EAP_TLS_PRIVATE_KEY,
@@ -289,9 +245,7 @@ make_tls_phase2_connection (const char *detail, NMSetting8021xCKScheme scheme)
 	                                                    scheme,
 	                                                    NULL,
 	                                                    &error);
-	ASSERT (success == TRUE,
-	        detail, "failed to set phase2 private key '%s': %s",
-	        TEST_NEED_SECRETS_EAP_TLS_PRIVATE_KEY, error->message);
+	nmtst_assert_success (success, error);
 
 	/* IP4 setting */
 	s_ip4 = (NMSettingIP4Config *) nm_setting_ip4_config_new ();
@@ -299,10 +253,7 @@ make_tls_phase2_connection (const char *detail, NMSetting8021xCKScheme scheme)
 
 	g_object_set (s_ip4, NM_SETTING_IP_CONFIG_METHOD, NM_SETTING_IP4_CONFIG_METHOD_AUTO, NULL);
 
-	ASSERT (nm_connection_verify (connection, &error) == TRUE,
-	        detail, "failed to verify connection: %s",
-	        (error && error->message) ? error->message : "(unknown)");
-
+	nmtst_assert_connection_verifies_and_normalizable (connection);
 	return connection;
 }
 
@@ -315,37 +266,19 @@ test_need_tls_phase2_secrets_path (void)
 
 	connection = make_tls_phase2_connection ("need-tls-phase2-secrets-path-key",
 	                                         NM_SETTING_802_1X_CK_SCHEME_PATH);
-	ASSERT (connection != NULL,
-	        "need-tls-phase2-secrets-path-key",
-	        "error creating test connection");
 
 	/* Ensure we don't need any secrets since we just set up the connection */
 	setting_name = nm_connection_need_secrets (connection, &hints);
-	ASSERT (setting_name == NULL,
-	        "need-tls-phase2-secrets-path-key",
-	        "secrets are unexpectedly required");
-	ASSERT (hints == NULL,
-	        "need-tls-phase2-secrets-path-key",
-	        "hints should be NULL since no secrets were required");
+	g_assert (!setting_name);
+	g_assert (!hints);
 
 	/* Connection is good; clear secrets and ensure private key password is then required */
 	nm_connection_clear_secrets (connection);
 
 	hints = NULL;
 	setting_name = nm_connection_need_secrets (connection, &hints);
-	ASSERT (setting_name != NULL,
-	        "need-tls-phase2-secrets-path-key-password",
-	        "unexpected secrets success");
-	ASSERT (strcmp (setting_name, NM_SETTING_802_1X_SETTING_NAME) == 0,
-			"need-tls-phase2-secrets-path-key-password",
-			"unexpected setting secrets required");
-
-	ASSERT (hints != NULL,
-	        "need-tls-phase2-secrets-path-key-password",
-	        "expected returned secrets hints");
-	ASSERT (find_hints_item (hints, NM_SETTING_802_1X_PHASE2_PRIVATE_KEY_PASSWORD),
-			"need-tls-phase2-secrets-path-key-password",
-			"expected to require private key password, but it wasn't");
+	g_assert_cmpstr (setting_name, ==, NM_SETTING_802_1X_SETTING_NAME);
+	_assert_hints_has (hints, NM_SETTING_802_1X_PHASE2_PRIVATE_KEY_PASSWORD);
 
 	g_ptr_array_free (hints, TRUE);
 	g_object_unref (connection);
@@ -360,37 +293,19 @@ test_need_tls_phase2_secrets_blob (void)
 
 	connection = make_tls_phase2_connection ("need-tls-phase2-secrets-blob-key",
 	                                         NM_SETTING_802_1X_CK_SCHEME_BLOB);
-	ASSERT (connection != NULL,
-	        "need-tls-phase2-secrets-blob-key",
-	        "error creating test connection");
 
 	/* Ensure we don't need any secrets since we just set up the connection */
 	setting_name = nm_connection_need_secrets (connection, &hints);
-	ASSERT (setting_name == NULL,
-	        "need-tls-phase2-secrets-blob-key",
-	        "secrets are unexpectedly required");
-	ASSERT (hints == NULL,
-	        "need-tls-phase2-secrets-blob-key",
-	        "hints should be NULL since no secrets were required");
+	g_assert (!setting_name);
+	g_assert (!hints);
 
 	/* Connection is good; clear secrets and ensure private key password is then required */
 	nm_connection_clear_secrets (connection);
 
 	hints = NULL;
 	setting_name = nm_connection_need_secrets (connection, &hints);
-	ASSERT (setting_name != NULL,
-	        "need-tls-phase2-secrets-blob-key-password",
-	        "unexpected secrets success");
-	ASSERT (strcmp (setting_name, NM_SETTING_802_1X_SETTING_NAME) == 0,
-			"need-tls-phase2-secrets-blob-key-password",
-			"unexpected setting secrets required");
-
-	ASSERT (hints != NULL,
-	        "need-tls-phase2-secrets-blob-key-password",
-	        "expected returned secrets hints");
-	ASSERT (find_hints_item (hints, NM_SETTING_802_1X_PHASE2_PRIVATE_KEY_PASSWORD),
-			"need-tls-phase2-secrets-blob-key-password",
-			"expected to require private key password, but it wasn't");
+	g_assert_cmpstr (setting_name, ==, NM_SETTING_802_1X_SETTING_NAME);
+	_assert_hints_has (hints, NM_SETTING_802_1X_PHASE2_PRIVATE_KEY_PASSWORD);
 
 	g_ptr_array_free (hints, TRUE);
 	g_object_unref (connection);
diff --git a/libnm-core/tests/test-setting-8021x.c b/libnm-core/tests/test-setting-8021x.c
index 49d7448e..56563a6f 100644
--- a/libnm-core/tests/test-setting-8021x.c
+++ b/libnm-core/tests/test-setting-8021x.c
@@ -19,13 +19,11 @@
  *
  */
 
-#include "config.h"
+#include "nm-default.h"
 
 #include <string.h>
 
-#include <nm-utils.h>
-
-#include "nm-default.h"
+#include "nm-utils.h"
 #include "nm-setting-connection.h"
 #include "nm-setting-8021x.h"
 
@@ -41,18 +39,12 @@ compare_blob_data (const char *test,
 	GError *error = NULL;
 	gboolean success;
 
-	success = g_file_get_contents (key_path, &contents, &len, &error);
-	ASSERT (success == TRUE,
-	        test, "failed to read blob key file: %s", error->message);
+	g_assert (key && g_bytes_get_size (key) > 0);
 
-	ASSERT (len > 0, test, "blob key file invalid (size 0)");
-
-	ASSERT (len == g_bytes_get_size (key),
-	        test, "blob key file (%d) and setting key data (%d) lengths don't match",
-	        len, g_bytes_get_size (key));
+	success = g_file_get_contents (key_path, &contents, &len, &error);
+	nmtst_assert_success (success, error);
 
-	ASSERT (memcmp (contents, g_bytes_get_data (key, NULL), len) == 0,
-	        test, "blob key file and blob key data don't match");
+	g_assert_cmpmem (contents, len, g_bytes_get_data (key, NULL), g_bytes_get_size (key));
 
 	g_free (contents);
 }
@@ -60,8 +52,11 @@ compare_blob_data (const char *test,
 static void
 check_scheme_path (GBytes *value, const char *path)
 {
-	const guint8 *p = g_bytes_get_data (value, NULL);
+	const guint8 *p;
+
+	g_assert (value);
 
+	p = g_bytes_get_data (value, NULL);
 	g_assert (memcmp (p, NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PATH, strlen (NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PATH)) == 0);
 	p += strlen (NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PATH);
 	g_assert (memcmp (p, path, strlen (path)) == 0);
@@ -83,7 +78,7 @@ test_private_key_import (const char *path,
 	const char *pw;
 
 	s_8021x = (NMSetting8021x *) nm_setting_802_1x_new ();
-	ASSERT (s_8021x != NULL, "private-key-import", "setting was NULL");
+	g_assert (s_8021x);
 
 	success = nm_setting_802_1x_set_private_key (s_8021x,
 	                                             path,
@@ -91,29 +86,21 @@ test_private_key_import (const char *path,
 	                                             scheme,
 	                                             &format,
 	                                             &error);
-	ASSERT (success == TRUE,
-	        "private-key-import", "error reading private key: %s", error->message);
-	ASSERT (format != NM_SETTING_802_1X_CK_FORMAT_UNKNOWN,
-	        "private-key-import", "unexpected private key format (got %d)", format);
+	nmtst_assert_success (success, error);
+	g_assert (format != NM_SETTING_802_1X_CK_FORMAT_UNKNOWN);
 	tmp_fmt = nm_setting_802_1x_get_private_key_format (s_8021x);
-	ASSERT (tmp_fmt == format,
-	        "private-key-import", "unexpected re-read private key format (expected %d, got %d)",
-	        format, tmp_fmt);
+	g_assert (tmp_fmt == format);
 
 	/* Make sure the password is what we expect */
 	pw = nm_setting_802_1x_get_private_key_password (s_8021x);
-	ASSERT (pw != NULL,
-	        "private-key-import", "failed to get previous private key password");
-	ASSERT (strcmp (pw, password) == 0,
-	        "private-key-import", "failed to compare private key password");
+	g_assert (pw != NULL);
+	g_assert_cmpstr (pw, ==, password);
 
 	if (scheme == NM_SETTING_802_1X_CK_SCHEME_BLOB) {
 		tmp_key = nm_setting_802_1x_get_private_key_blob (s_8021x);
-		ASSERT (tmp_key != NULL, "private-key-import", "missing private key blob");
 		compare_blob_data ("private-key-import", path, tmp_key);
 	} else if (scheme == NM_SETTING_802_1X_CK_SCHEME_PATH) {
 		g_object_get (s_8021x, NM_SETTING_802_1X_PRIVATE_KEY, &tmp_key, NULL);
-		ASSERT (tmp_key != NULL, "private-key-import", "missing private key value");
 		check_scheme_path (tmp_key, path);
 		g_bytes_unref (tmp_key);
 	} else
@@ -122,14 +109,13 @@ test_private_key_import (const char *path,
 	/* If it's PKCS#12 ensure the client cert is the same value */
 	if (format == NM_SETTING_802_1X_CK_FORMAT_PKCS12) {
 		g_object_get (s_8021x, NM_SETTING_802_1X_PRIVATE_KEY, &tmp_key, NULL);
-		ASSERT (tmp_key != NULL, "private-key-import", "missing private key value");
+		g_assert (tmp_key);
 
 		g_object_get (s_8021x, NM_SETTING_802_1X_CLIENT_CERT, &client_cert, NULL);
-		ASSERT (client_cert != NULL, "private-key-import", "missing client certificate value");
+		g_assert (client_cert);
 
 		/* make sure they are the same */
-		ASSERT (g_bytes_equal (tmp_key, client_cert),
-		        "private-key-import", "unexpected different private key and client cert data");
+		g_assert (g_bytes_equal (tmp_key, client_cert));
 
 		g_bytes_unref (tmp_key);
 		g_bytes_unref (client_cert);
@@ -152,7 +138,7 @@ test_phase2_private_key_import (const char *path,
 	const char *pw;
 
 	s_8021x = (NMSetting8021x *) nm_setting_802_1x_new ();
-	ASSERT (s_8021x != NULL, "phase2-private-key-import", "setting was NULL");
+	g_assert (s_8021x);
 
 	success = nm_setting_802_1x_set_phase2_private_key (s_8021x,
 	                                                    path,
@@ -160,29 +146,21 @@ test_phase2_private_key_import (const char *path,
 	                                                    scheme,
 	                                                    &format,
 	                                                    &error);
-	ASSERT (success == TRUE,
-	        "phase2-private-key-import", "error reading private key: %s", error->message);
-	ASSERT (format != NM_SETTING_802_1X_CK_FORMAT_UNKNOWN,
-	        "phase2-private-key-import", "unexpected private key format");
+	nmtst_assert_success (success, error);
+	g_assert (format != NM_SETTING_802_1X_CK_FORMAT_UNKNOWN);
 	tmp_fmt = nm_setting_802_1x_get_phase2_private_key_format (s_8021x);
-	ASSERT (tmp_fmt == format,
-	        "phase2-private-key-import", "unexpected re-read private key format (expected %d, got %d)",
-	        format, tmp_fmt);
+	g_assert (tmp_fmt == format);
 
 	/* Make sure the password is what we expect */
 	pw = nm_setting_802_1x_get_phase2_private_key_password (s_8021x);
-	ASSERT (pw != NULL,
-	        "phase2-private-key-import", "failed to get previous private key password");
-	ASSERT (strcmp (pw, password) == 0,
-	        "phase2-private-key-import", "failed to compare private key password");
+	g_assert (pw);
+	g_assert_cmpstr (pw, ==, password);
 
 	if (scheme == NM_SETTING_802_1X_CK_SCHEME_BLOB) {
 		tmp_key = nm_setting_802_1x_get_phase2_private_key_blob (s_8021x);
-		ASSERT (tmp_key != NULL, "phase2-private-key-import", "missing private key blob");
 		compare_blob_data ("phase2-private-key-import", path, tmp_key);
 	} else if (scheme == NM_SETTING_802_1X_CK_SCHEME_PATH) {
 		g_object_get (s_8021x, NM_SETTING_802_1X_PHASE2_PRIVATE_KEY, &tmp_key, NULL);
-		ASSERT (tmp_key != NULL, "phase2-private-key-import", "missing private key value");
 		check_scheme_path (tmp_key, path);
 		g_bytes_unref (tmp_key);
 	} else
@@ -191,14 +169,13 @@ test_phase2_private_key_import (const char *path,
 	/* If it's PKCS#12 ensure the client cert is the same value */
 	if (format == NM_SETTING_802_1X_CK_FORMAT_PKCS12) {
 		g_object_get (s_8021x, NM_SETTING_802_1X_PHASE2_PRIVATE_KEY, &tmp_key, NULL);
-		ASSERT (tmp_key != NULL, "private-key-import", "missing private key value");
+		g_assert (tmp_key);
 
 		g_object_get (s_8021x, NM_SETTING_802_1X_PHASE2_CLIENT_CERT, &client_cert, NULL);
-		ASSERT (client_cert != NULL, "private-key-import", "missing client certificate value");
+		g_assert (client_cert);
 
 		/* make sure they are the same */
-		ASSERT (g_bytes_equal (tmp_key, client_cert),
-		        "private-key-import", "unexpected different private key and client cert data");
+		g_assert (g_bytes_equal (tmp_key, client_cert));
 
 		g_bytes_unref (tmp_key);
 		g_bytes_unref (client_cert);
@@ -217,7 +194,7 @@ test_wrong_password_keeps_data (const char *path, const char *password)
 	const char *pw;
 
 	s_8021x = (NMSetting8021x *) nm_setting_802_1x_new ();
-	ASSERT (s_8021x != NULL, "wrong-password-keeps-data", "setting was NULL");
+	g_assert (s_8021x);
 
 	success = nm_setting_802_1x_set_private_key (s_8021x,
 	                                             path,
@@ -225,10 +202,8 @@ test_wrong_password_keeps_data (const char *path, const char *password)
 	                                             NM_SETTING_802_1X_CK_SCHEME_BLOB,
 	                                             &format,
 	                                             &error);
-	ASSERT (success == TRUE,
-	        "wrong-password-keeps-data", "error reading private key: %s", error->message);
-	ASSERT (format != NM_SETTING_802_1X_CK_FORMAT_UNKNOWN,
-	        "wrong-password-keeps-data", "unexpected private key format (got %d)", format);
+	nmtst_assert_success (success, error);
+	g_assert (format != NM_SETTING_802_1X_CK_FORMAT_UNKNOWN);
 
 	/* Now try to set it to something that's not a certificate */
 	format = NM_SETTING_802_1X_CK_FORMAT_UNKNOWN;
@@ -238,20 +213,14 @@ test_wrong_password_keeps_data (const char *path, const char *password)
 	                                             NM_SETTING_802_1X_CK_SCHEME_BLOB,
 	                                             &format,
 	                                             &error);
-	ASSERT (success == FALSE,
-	        "wrong-password-keeps-data", "unexpected success reading private key");
-	ASSERT (error != NULL,
-	        "wrong-password-keeps-data", "unexpected missing error");
-	ASSERT (format == NM_SETTING_802_1X_CK_FORMAT_UNKNOWN,
-	        "wrong-password-keeps-data", "unexpected success reading private key format");
+	nmtst_assert_no_success (success, error);
+	g_assert (format == NM_SETTING_802_1X_CK_FORMAT_UNKNOWN);
 	g_clear_error (&error);
 
 	/* Make sure the password hasn't changed */
 	pw = nm_setting_802_1x_get_private_key_password (s_8021x);
-	ASSERT (pw != NULL,
-	        "wrong-password-keeps-data", "failed to get previous private key password");
-	ASSERT (strcmp (pw, password) == 0,
-	        "wrong-password-keeps-data", "failed to compare private key password");
+	g_assert (pw);
+	g_assert_cmpstr (pw, ==, password);
 
 	g_object_unref (s_8021x);
 }
@@ -266,7 +235,7 @@ test_clear_private_key (const char *path, const char *password)
 	const char *pw;
 
 	s_8021x = (NMSetting8021x *) nm_setting_802_1x_new ();
-	ASSERT (s_8021x != NULL, "clear-private-key", "setting was NULL");
+	g_assert (s_8021x);
 
 	success = nm_setting_802_1x_set_private_key (s_8021x,
 	                                             path,
@@ -274,17 +243,13 @@ test_clear_private_key (const char *path, const char *password)
 	                                             NM_SETTING_802_1X_CK_SCHEME_BLOB,
 	                                             &format,
 	                                             &error);
-	ASSERT (success == TRUE,
-	        "clear-private-key", "error reading private key: %s", error->message);
-	ASSERT (format != NM_SETTING_802_1X_CK_FORMAT_UNKNOWN,
-	        "clear-private-key", "unexpected private key format (got %d)", format);
+	nmtst_assert_success (success, error);
+	g_assert (format != NM_SETTING_802_1X_CK_FORMAT_UNKNOWN);
 
 	/* Make sure the password is what we expect */
 	pw = nm_setting_802_1x_get_private_key_password (s_8021x);
-	ASSERT (pw != NULL,
-	        "clear-private-key", "failed to get previous private key password");
-	ASSERT (strcmp (pw, password) == 0,
-	        "clear-private-key", "failed to compare private key password");
+	g_assert (pw);
+	g_assert_cmpstr (pw, ==, password);
 
 	/* Now clear it */
 	success = nm_setting_802_1x_set_private_key (s_8021x,
@@ -293,14 +258,10 @@ test_clear_private_key (const char *path, const char *password)
 	                                             NM_SETTING_802_1X_CK_SCHEME_BLOB,
 	                                             NULL,
 	                                             &error);
-	ASSERT (success == TRUE,
-	        "clear-private-key", "unexpected failure clearing private key");
-	ASSERT (error == NULL,
-	        "clear-private-key", "unexpected error clearing private key");
+	nmtst_assert_success (success, error);
 
 	/* Ensure the password is also now clear */
-	ASSERT (nm_setting_802_1x_get_private_key_password (s_8021x) == NULL,
-	        "clear-private-key", "unexpected private key password");
+	g_assert (!nm_setting_802_1x_get_private_key_password (s_8021x));
 
 	g_object_unref (s_8021x);
 }
@@ -315,7 +276,7 @@ test_wrong_phase2_password_keeps_data (const char *path, const char *password)
 	const char *pw;
 
 	s_8021x = (NMSetting8021x *) nm_setting_802_1x_new ();
-	ASSERT (s_8021x != NULL, "wrong-phase2-password-keeps-data", "setting was NULL");
+	g_assert (s_8021x);
 
 	success = nm_setting_802_1x_set_phase2_private_key (s_8021x,
 	                                                    path,
@@ -323,10 +284,8 @@ test_wrong_phase2_password_keeps_data (const char *path, const char *password)
 	                                                    NM_SETTING_802_1X_CK_SCHEME_BLOB,
 	                                                    &format,
 	                                                    &error);
-	ASSERT (success == TRUE,
-	        "wrong-phase2-password-keeps-data", "error reading private key: %s", error->message);
-	ASSERT (format != NM_SETTING_802_1X_CK_FORMAT_UNKNOWN,
-	        "wrong-phase2-password-keeps-data", "unexpected private key format (got %d)", format);
+	nmtst_assert_success (success, error);
+	g_assert (format != NM_SETTING_802_1X_CK_FORMAT_UNKNOWN);
 
 	/* Now try to set it to something that's not a certificate */
 	format = NM_SETTING_802_1X_CK_FORMAT_UNKNOWN;
@@ -336,20 +295,14 @@ test_wrong_phase2_password_keeps_data (const char *path, const char *password)
 	                                                    NM_SETTING_802_1X_CK_SCHEME_BLOB,
 	                                                    &format,
 	                                                    &error);
-	ASSERT (success == FALSE,
-	        "wrong-phase2-password-keeps-data", "unexpected success reading private key");
-	ASSERT (error != NULL,
-	        "wrong-phase2-password-keeps-data", "unexpected missing error");
-	ASSERT (format == NM_SETTING_802_1X_CK_FORMAT_UNKNOWN,
-	        "wrong-phase2-password-keeps-data", "unexpected success reading private key format");
+	nmtst_assert_no_success (success, error);
+	g_assert (format == NM_SETTING_802_1X_CK_FORMAT_UNKNOWN);
 	g_clear_error (&error);
 
 	/* Make sure the password hasn't changed */
 	pw = nm_setting_802_1x_get_phase2_private_key_password (s_8021x);
-	ASSERT (pw != NULL,
-	        "wrong-phase2-password-keeps-data", "failed to get previous private key password");
-	ASSERT (strcmp (pw, password) == 0,
-	        "wrong-phase2-password-keeps-data", "failed to compare private key password");
+	g_assert (pw);
+	g_assert_cmpstr (pw, ==, password);
 
 	g_object_unref (s_8021x);
 }
@@ -364,7 +317,7 @@ test_clear_phase2_private_key (const char *path, const char *password)
 	const char *pw;
 
 	s_8021x = (NMSetting8021x *) nm_setting_802_1x_new ();
-	ASSERT (s_8021x != NULL, "clear-phase2-private-key", "setting was NULL");
+	g_assert (s_8021x);
 
 	success = nm_setting_802_1x_set_phase2_private_key (s_8021x,
 	                                                    path,
@@ -372,17 +325,13 @@ test_clear_phase2_private_key (const char *path, const char *password)
 	                                                    NM_SETTING_802_1X_CK_SCHEME_BLOB,
 	                                                    &format,
 	                                                    &error);
-	ASSERT (success == TRUE,
-	        "clear-phase2-private-key", "error reading private key: %s", error->message);
-	ASSERT (format != NM_SETTING_802_1X_CK_FORMAT_UNKNOWN,
-	        "clear-phase2-private-key", "unexpected private key format (got %d)", format);
+	nmtst_assert_success (success, error);
+	g_assert (format != NM_SETTING_802_1X_CK_FORMAT_UNKNOWN);
 
 	/* Make sure the password is what we expect */
 	pw = nm_setting_802_1x_get_phase2_private_key_password (s_8021x);
-	ASSERT (pw != NULL,
-	        "clear-phase2-private-key", "failed to get previous private key password");
-	ASSERT (strcmp (pw, password) == 0,
-	        "clear-phase2-private-key", "failed to compare private key password");
+	g_assert (pw);
+	g_assert_cmpstr (pw, ==, password);
 
 	/* Now clear it */
 	success = nm_setting_802_1x_set_phase2_private_key (s_8021x,
@@ -391,14 +340,10 @@ test_clear_phase2_private_key (const char *path, const char *password)
 	                                                    NM_SETTING_802_1X_CK_SCHEME_BLOB,
 	                                                    NULL,
 	                                                    &error);
-	ASSERT (success == TRUE,
-	        "clear-phase2-private-key", "unexpected failure clearing private key");
-	ASSERT (error == NULL,
-	        "clear-phase2-private-key", "unexpected error clearing private key");
+	nmtst_assert_success (success, error);
 
 	/* Ensure the password is also now clear */
-	ASSERT (nm_setting_802_1x_get_phase2_private_key_password (s_8021x) == NULL,
-	        "clear-phase2-private-key", "unexpected private key password");
+	g_assert (!nm_setting_802_1x_get_phase2_private_key_password (s_8021x));
 
 	g_object_unref (s_8021x);
 }
diff --git a/libnm-core/tests/test-setting-dcb.c b/libnm-core/tests/test-setting-dcb.c
index f8b789c1..09cf8d98 100644
--- a/libnm-core/tests/test-setting-dcb.c
+++ b/libnm-core/tests/test-setting-dcb.c
@@ -19,11 +19,11 @@
  *
  */
 
-#include "config.h"
+#include "nm-default.h"
 
 #include <string.h>
-#include <nm-utils.h>
-#include "nm-default.h"
+
+#include "nm-utils.h"
 #include "nm-setting-dcb.h"
 #include "nm-connection.h"
 #include "nm-errors.h"
diff --git a/libnm-core/tests/test-settings-defaults.c b/libnm-core/tests/test-settings-defaults.c
index 21e16f3d..366910ac 100644
--- a/libnm-core/tests/test-settings-defaults.c
+++ b/libnm-core/tests/test-settings-defaults.c
@@ -19,13 +19,11 @@
  *
  */
 
-#include "config.h"
+#include "nm-default.h"
 
 #include <string.h>
 
-#include <nm-utils.h>
-
-#include "nm-default.h"
+#include "nm-utils.h"
 #include "nm-setting-8021x.h"
 #include "nm-setting-cdma.h"
 #include "nm-setting-connection.h"
@@ -53,9 +51,7 @@ test_defaults (GType type, const char *name)
 	setting = g_object_new (type, NULL);
 
 	property_specs = g_object_class_list_properties (G_OBJECT_GET_CLASS (setting), &n_property_specs);
-	ASSERT (property_specs != NULL,
-	        name, "couldn't find property specs for object of type '%s'",
-	        g_type_name (G_OBJECT_TYPE (setting)));
+	g_assert (property_specs);
 
 	for (i = 0; i < n_property_specs; i++) {
 		GParamSpec *prop_spec = property_specs[i];
@@ -87,9 +83,7 @@ test_defaults (GType type, const char *name)
 		} else
 			ok = g_param_value_defaults (prop_spec, &value);
 
-		ASSERT (ok,
-		        name, "property '%s' value '%s' not the expected default value '%s'",
-		        prop_spec->name, actual, expected);
+		g_assert (ok);
 
 		g_free (actual);
 		g_free (expected);