New upstream version 1.16.0 upstream/1.16.0

22 files changed, 810 insertions, 362 deletions

diff --git a/man/NetworkManager.8 b/man/NetworkManager.8
index 4d82097c..98a62766 100644
--- a/man/NetworkManager.8
+++ b/man/NetworkManager.8
@@ -2,12 +2,12 @@
 .\"     Title: NetworkManager
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
-.\"      Date: 02/23/2019
+.\"      Date: 03/15/2019
 .\"    Manual: Network management daemons
-.\"    Source: NetworkManager 1.14.6
+.\"    Source: NetworkManager 1.16.0
 .\"  Language: English
 .\"
-.TH "NETWORKMANAGER" "8" "" "NetworkManager 1\&.14\&.6" "Network management daemons"
+.TH "NETWORKMANAGER" "8" "" "NetworkManager 1\&.16\&.0" "Network management daemons"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -34,7 +34,7 @@ NetworkManager \- network management daemon
 \fBNetworkManager \fR\fB[OPTIONS...]\fR
 .SH "DESCRIPTION"
 .PP
-The NetworkManager daemon attempts to make networking configuration and operation as painless and automatic as possible by managing the primary network connection and other network interfaces, like Ethernet, WiFi, and Mobile Broadband devices\&. NetworkManager will connect any network device when a connection for that device becomes available, unless that behavior is disabled\&. Information about networking is exported via a D\-Bus interface to any interested application, providing a rich API with which to inspect and control network settings and operation\&.
+The NetworkManager daemon attempts to make networking configuration and operation as painless and automatic as possible by managing the primary network connection and other network interfaces, like Ethernet, Wi\-Fi, and Mobile Broadband devices\&. NetworkManager will connect any network device when a connection for that device becomes available, unless that behavior is disabled\&. Information about networking is exported via a D\-Bus interface to any interested application, providing a rich API with which to inspect and control network settings and operation\&.
 .SH "DISPATCHER SCRIPTS"
 .PP
 NetworkManager will execute scripts in the
@@ -305,9 +305,14 @@ device manager is used for the network device discovery\&. The following propert
 .PP
 \fINM_UNMANAGED\fR
 .RS 4
-No default connection will be created and automatic activation will not be attempted when this property of a device is set to a true value ("1" or "true")\&. You will still be able to attach a connection to the device manually or observe externally added configuration such as addresses or routes\&.
-.sp
-Create an udev rule that sets this property to prevent NetworkManager from interfering with virtual Ethernet device interfaces that are managed by virtualization tools\&.
+If set to
+"1"
+or
+"true", the device is configured as unmanaged by NetworkManager\&. Note that the user still can explicitly overrule this configuration via means like
+\fBnmcli device set "$DEVICE" managed yes\fR
+or
+"device*\&.managed=1"
+in NetworkManager\&.conf\&.
 .RE
 .SH "SIGNALS"
 .PP
diff --git a/man/NetworkManager.conf.5 b/man/NetworkManager.conf.5
index 13efa991..63e8dea2 100644
--- a/man/NetworkManager.conf.5
+++ b/man/NetworkManager.conf.5
@@ -2,12 +2,12 @@
 .\"     Title: NetworkManager.conf
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
-.\"      Date: 02/23/2019
+.\"      Date: 03/15/2019
 .\"    Manual: Configuration
-.\"    Source: NetworkManager 1.14.6
+.\"    Source: NetworkManager 1.16.0
 .\"  Language: English
 .\"
-.TH "NETWORKMANAGER\&.CONF" "5" "" "NetworkManager 1\&.14\&.6" "Configuration"
+.TH "NETWORKMANAGER\&.CONF" "5" "" "NetworkManager 1\&.16\&.0" "Configuration"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -121,6 +121,16 @@ plugin is always appended to the end of this list (if it doesn\*(Aqt already app
 \fImonitor\-connection\-files\fR
 .RS 4
 Whether the configured settings plugin(s) should set up file monitors and immediately pick up changes made to connection files while NetworkManager is running\&. This is disabled by default; NetworkManager will only read the connection files at startup, and when explicitly requested via the ReloadConnections D\-Bus call\&. If this key is set to \*(Aqtrue\*(Aq, then NetworkManager will reload connection files any time they changed\&. Automatic reloading is not advised because there are race conditions involved and it depends on the way how the editor updates the file\&. In some situations, NetworkManager might first delete and add the connection anew, instead of updating the existing one\&. Also, NetworkManager might pick up incomplete settings while the user is still editing the files\&.
+.sp
+Note that neither this setting nor restarting the NetworkManager daemon is the advised way to reload connection profiles from disk\&. Instead, after modifying the files reload them with
+\fBnmcli connection reload\fR
+or
+\fBnmcli connection load "$FILENAME"\fR\&. Even better, instead of modifying files directly, use NetworkManager tools like
+\fBnmcli\fR,
+\fBnmtui\fR
+or the GUI\&.
+.sp
+This setting is deprecated and will have no effect in the future\&.
 .RE
 .PP
 \fIauth\-polkit\fR
@@ -158,7 +168,7 @@ Specify devices for which NetworkManager shouldn\*(Aqt create default wired conn
 to apply to all devices\&.
 .sp
 When the default wired connection is deleted or saved to a new persistent connection by a plugin, the device is added to a list in the file
-/run/NetworkManager/no\-auto\-default\&.state
+/var/lib/NetworkManager/no\-auto\-default\&.state
 to prevent creating the default connection for that device again\&.
 .sp
 See
@@ -203,7 +213,7 @@ for the syntax how to specify a device\&.
 \fIconfigure\-and\-quit\fR
 .RS 4
 When set to \*(Aqtrue\*(Aq, NetworkManager quits after performing initial network configuration but spawns small helpers to preserve DHCP leases and IPv6 addresses\&. This is useful in environments where network setup is more or less static or it is desirable to save process time but still handle some dynamic configurations\&. When this option is
-true, network configuration for WiFi, WWAN, Bluetooth, ADSL, and PPPoE interfaces cannot be preserved due to their use of external services, and these devices will be deconfigured when NetworkManager quits even though other interface\*(Aqs configuration may be preserved\&. Also, to preserve DHCP addresses the \*(Aqdhcp\*(Aq option must be set to \*(Aqinternal\*(Aq\&. The default value of the \*(Aqconfigure\-and\-quit\*(Aq option is \*(Aqfalse\*(Aq, meaning that NetworkManager will continue running after initial network configuration and continue responding to system and hardware events, D\-Bus requests, and user commands\&.
+true, network configuration for Wi\-Fi, WWAN, Bluetooth, ADSL, and PPPoE interfaces cannot be preserved due to their use of external services, and these devices will be deconfigured when NetworkManager quits even though other interface\*(Aqs configuration may be preserved\&. Also, to preserve DHCP addresses the \*(Aqdhcp\*(Aq option must be set to \*(Aqinternal\*(Aq\&. The default value of the \*(Aqconfigure\-and\-quit\*(Aq option is \*(Aqfalse\*(Aq, meaning that NetworkManager will continue running after initial network configuration and continue responding to system and hardware events, D\-Bus requests, and user commands\&.
 .RE
 .PP
 \fIhostname\-mode\fR
@@ -219,7 +229,9 @@ none: NetworkManager will not manage the transient hostname and will never set i
 .PP
 \fIdns\fR
 .RS 4
-Set the DNS (resolv\&.conf) processing mode\&. If the key is unspecified,
+Set the DNS processing mode\&.
+.sp
+If the key is unspecified,
 default
 is used, unless
 /etc/resolv\&.conf
@@ -240,14 +252,29 @@ dnsmasq: NetworkManager will run dnsmasq as a local caching nameserver, using a
 resolv\&.conf
 to point to the local nameserver\&. It is possible to pass custom options to the dnsmasq instance by adding them to files in the "/etc/NetworkManager/dnsmasq\&.d/" directory\&. Note that when multiple upstream servers are available, dnsmasq will initially contact them in parallel and then use the fastest to respond, probing again other servers after some time\&. This behavior can be modified passing the \*(Aqall\-servers\*(Aq or \*(Aqstrict\-order\*(Aq options to dnsmasq (see the manual page for more details)\&.
 .sp
+systemd\-resolved: NetworkManager will push the DNS configuration to systemd\-resolved
+.sp
 unbound: NetworkManager will talk to unbound and dnssec\-triggerd, providing a "split DNS" configuration with DNSSEC support\&.
 /etc/resolv\&.conf
 will be managed by dnssec\-trigger daemon\&.
 .sp
-systemd\-resolved: NetworkManager will push the DNS configuration to systemd\-resolved
-.sp
 none: NetworkManager will not modify resolv\&.conf\&. This implies
 rc\-manager\ \&unmanaged
+.sp
+Note that the plugins
+dnsmasq,
+systemd\-resolved
+and
+unbound
+are caching local nameservers\&. Hence, when NetworkManager writes
+/var/run/NetworkManager/resolv\&.conf
+and
+/etc/resolv\&.conf
+(according to
+rc\-manager
+setting below), the name server there will be localhost only\&. NetworkManager also writes a file
+/var/run/NetworkManager/no\-stub\-resolv\&.conf
+that contains the original name servers pushed to the DNS plugin\&.
 .RE
 .PP
 \fIrc\-manager\fR
@@ -281,6 +308,26 @@ none: deprecated alias for
 symlink\&.
 .RE
 .PP
+\fIsystemd\-resolved\fR
+.RS 4
+Send the connection DNS configuration to
+systemd\-resolved\&. Defaults to "true"\&.
+.sp
+Note that this setting is complementary to the
+\fIdns\fR
+setting\&. You can keep this enabled while using
+\fIdns\fR
+set to another DNS plugin alongside
+systemd\-resolved, or
+\fIdns\fR
+set to
+systemd\-resolved
+to configure the system resolver to use
+systemd\-resolved\&.
+.sp
+If systemd\-resolved is enabled, the connectivity check resolves the hostname per\-device\&.
+.RE
+.PP
 \fIdebug\fR
 .RS 4
 Comma separated list of options to aid debugging\&. This value will be combined with the environment variable
@@ -583,6 +630,8 @@ ipv6\&.ip6\-privacy=0
 Not all properties can be overwritten, only the following properties are supported to have their default values configured (see
 \fBnm-settings\fR(5)
 for details)\&. A default value is only consulted if the corresponding per\-connection value explicitly allows for that\&.
+
+
 .PP
 \fI802\-1x\&.auth\-timeout\fR
 .RS 4
@@ -662,6 +711,11 @@ If configured explicitly to 0, the MTU is not reconfigured during device activat
 If left unspecified, the default value for the interface type is used\&.
 .RE
 .PP
+\fIipv4\&.dns\-priority\fR
+.RS 4
+If unspecified or zero, use 50 for VPN profiles and 100 for other profiles\&.
+.RE
+.PP
 \fIipv4\&.route\-metric\fR
 .RS 4
 .RE
@@ -681,6 +735,11 @@ If left unspecified, it defaults to "lease"\&.
 If left unspecified, the default value for the interface type is used\&.
 .RE
 .PP
+\fIipv6\&.dns\-priority\fR
+.RS 4
+If unspecified or zero, use 50 for VPN profiles and 100 for other profiles\&.
+.RE
+.PP
 \fIipv6\&.ip6\-privacy\fR
 .RS 4
 If
@@ -745,6 +804,11 @@ If left unspecified, the default value "optional" will be used\&.
 \fIwifi\&.wake\-on\-wlan\fR
 .RS 4
 .RE
+.PP
+\fIwireguard\&.mtu\fR
+.RS 4
+.RE
+
 .SS "Sections"
 .PP
 You can configure multiple
@@ -902,6 +966,12 @@ for details\&.
 .PP
 This section controls NetworkManager\*(Aqs optional connectivity checking functionality\&. This allows NetworkManager to detect whether or not the system can actually access the internet or whether it is behind a captive portal\&.
 .PP
+Connectivity checking serves two purposes\&. For one, it exposes a connectivity state on D\-Bus, which other applications may use\&. For example, Gnome\*(Aqs portal helper uses this as signal to show a captive portal login page\&. The other use is that default\-route of devices without global connectivity get a penalty of +20000 to the route\-metric\&. This has the purpose to give a better default\-route to devices that have global connectivity\&. For example, when being connected to WWAN and to a Wi\-Fi network which is behind a captive portal, WWAN still gets preferred until login\&.
+.PP
+Note that your distribution might set
+/proc/sys/net/ipv4/conf/*/rp_filter
+to strict filtering\&. That works badly with per\-device connectivity checking, which uses SO_BINDDEVICE to send requests on all devices\&. A strict rp_filter setting will reject any response and the connectivity check on all but the best route will fail\&.
+.PP
 .PP
 \fIuri\fR
 .RS 4
@@ -917,7 +987,7 @@ Specified in seconds; controls how often connectivity is checked when a network
 .PP
 \fIresponse\fR
 .RS 4
-If set controls what body content NetworkManager checks for when requesting the URI for connectivity checking\&. If missing, defaults to "NetworkManager is online"
+If set, controls what body content NetworkManager checks for when requesting the URI for connectivity checking\&. Note that this only compares that the HTTP response starts with the specifid text, it does not compare the exact string\&. This behavior might change in the future, so avoid relying on it\&. If missing, the response defaults to "NetworkManager is online"\&. If set to empty, the HTTP server is expected to answer with status code 204 or send no data\&.
 .RE
 .SH "GLOBAL\-DNS SECTION"
 .PP
@@ -931,7 +1001,7 @@ A list of search domains to be used during hostname lookup\&.
 .PP
 \fIoptions\fR
 .RS 4
-A list of of options to be passed to the hostname resolver\&.
+A list of options to be passed to the hostname resolver\&.
 .RE
 .SH "GLOBAL\-DNS\-DOMAIN SECTIONS"
 .PP
diff --git a/man/NetworkManager.conf.xml b/man/NetworkManager.conf.xml
index 94a23fe8..28934247 100644
--- a/man/NetworkManager.conf.xml
+++ b/man/NetworkManager.conf.xml
@@ -166,6 +166,15 @@ plugins-=remove-me
         In some situations, NetworkManager might first delete and add the
         connection anew, instead of updating the existing one. Also, NetworkManager
         might pick up incomplete settings while the user is still editing the files.
+        </para><para>
+        Note that neither this setting nor restarting the NetworkManager daemon
+        is the advised way to reload connection profiles from disk. Instead, after
+        modifying the files reload them with <command>nmcli connection reload</command>
+        or <command>nmcli connection load "$FILENAME"</command>. Even better,
+        instead of modifying files directly, use NetworkManager tools like
+        <command>nmcli</command>, <command>nmtui</command> or the GUI.
+        </para><para>
+        This setting is deprecated and will have no effect in the future.
         </para></listitem>
       </varlistentry>
       <varlistentry>
@@ -204,7 +213,7 @@ plugins-=remove-me
         <para>When the default wired connection is deleted or saved
         to a new persistent connection by a plugin, the device is
         added to a list in the file
-        <filename>/run/NetworkManager/no-auto-default.state</filename>
+        <filename>&nmstatedir;/no-auto-default.state</filename>
         to prevent creating the default connection for that device
         again.</para>
         <para>See <xref linkend="device-spec"/> for the syntax how to
@@ -262,7 +271,7 @@ no-auto-default=*
             environments where network setup is more or less static or it is
             desirable to save process time but still handle some dynamic
             configurations.  When this option is <literal>true</literal>,
-            network configuration for WiFi, WWAN, Bluetooth, ADSL, and PPPoE
+            network configuration for Wi-Fi, WWAN, Bluetooth, ADSL, and PPPoE
             interfaces cannot be preserved due to their use of external
             services, and these devices will be deconfigured when NetworkManager
             quits even though other interface's configuration may be preserved.
@@ -306,8 +315,8 @@ no-auto-default=*
       </varlistentry>
       <varlistentry>
         <term><varname>dns</varname></term>
-        <listitem><para>Set the DNS (<filename>resolv.conf</filename>) processing mode.
-        If the key is unspecified, <literal>default</literal> is used,
+        <listitem><para>Set the DNS processing mode.</para>
+        <para>If the key is unspecified, <literal>default</literal> is used,
         unless <filename>/etc/resolv.conf</filename> is a symlink to
         <filename>/run/systemd/resolve/stub-resolv.conf</filename>,
         <filename>/run/systemd/resolve/resolv.conf</filename>,
@@ -331,15 +340,23 @@ no-auto-default=*
         after some time. This behavior can be modified passing the
         'all-servers' or 'strict-order' options to dnsmasq (see the
         manual page for more details).</para>
+        <para><literal>systemd-resolved</literal>: NetworkManager will
+        push the DNS configuration to systemd-resolved</para>
         <para><literal>unbound</literal>: NetworkManager will talk
         to unbound and dnssec-triggerd, providing a "split DNS"
         configuration with DNSSEC support. <filename>/etc/resolv.conf</filename>
         will be managed by dnssec-trigger daemon.</para>
-        <para><literal>systemd-resolved</literal>: NetworkManager will
-        push the DNS configuration to systemd-resolved</para>
         <para><literal>none</literal>: NetworkManager will not
         modify resolv.conf. This implies
         <literal>rc-manager</literal>&nbsp;<literal>unmanaged</literal></para>
+
+        <para>Note that the plugins <literal>dnsmasq</literal>, <literal>systemd-resolved</literal>
+        and <literal>unbound</literal> are caching local nameservers.
+        Hence, when NetworkManager writes <filename>&nmrundir;/resolv.conf</filename>
+        and <filename>/etc/resolv.conf</filename> (according to <literal>rc-manager</literal>
+        setting below), the name server there will be localhost only.
+        NetworkManager also writes a file <filename>&nmrundir;/no-stub-resolv.conf</filename>
+        that contains the original name servers pushed to the DNS plugin.</para>
         </listitem>
       </varlistentry>
 
@@ -380,6 +397,22 @@ no-auto-default=*
       </varlistentry>
 
       <varlistentry>
+        <term><varname>systemd-resolved</varname></term>
+        <listitem><para>Send the connection DNS configuration to
+        <literal>systemd-resolved</literal>. Defaults to "<literal>true</literal>".
+        </para>
+        <para>Note that this setting is complementary to the
+        <varname>dns</varname> setting. You can keep this enabled while using
+        <varname>dns</varname> set to another DNS plugin alongside
+        <literal>systemd-resolved</literal>, or <varname>dns</varname> set to
+        <literal>systemd-resolved</literal> to configure the system resolver to use
+        <literal>systemd-resolved</literal>.</para>
+        <para>If systemd-resolved is enabled, the connectivity check resolves the
+        hostname per-device.</para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
         <term><varname>debug</varname></term>
         <listitem><para>Comma separated list of options to aid
         debugging. This value will be combined with the environment
@@ -641,6 +674,8 @@ ipv6.ip6-privacy=0
       (see <link linkend='nm-settings'><citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum></citerefentry></link> for details).
       A default value is only consulted if the corresponding per-connection value
       explicitly allows for that.
+      <!-- The following comment is used by check-config-options.sh, don't remove it. -->
+      <!-- start connection defaults -->
       <variablelist>
         <varlistentry>
           <term><varname>802-1x.auth-timeout</varname></term>
@@ -705,6 +740,11 @@ ipv6.ip6-privacy=0
            the interface type is used.</para></listitem>
         </varlistentry>
         <varlistentry>
+          <term><varname>ipv4.dns-priority</varname></term>
+          <listitem><para>If unspecified or zero, use 50 for VPN profiles
+           and 100 for other profiles.</para></listitem>
+        </varlistentry>
+        <varlistentry>
           <term><varname>ipv4.route-metric</varname></term>
         </varlistentry>
         <varlistentry>
@@ -724,6 +764,11 @@ ipv6.ip6-privacy=0
            the interface type is used.</para></listitem>
         </varlistentry>
         <varlistentry>
+          <term><varname>ipv6.dns-priority</varname></term>
+          <listitem><para>If unspecified or zero, use 50 for VPN profiles
+           and 100 for other profiles.</para></listitem>
+        </varlistentry>
+        <varlistentry>
           <term><varname>ipv6.ip6-privacy</varname></term>
           <listitem><para>If <literal>ipv6.ip6-privacy</literal> is unset, use the content of
             "/proc/sys/net/ipv6/conf/default/use_tempaddr" as last fallback.
@@ -782,7 +827,12 @@ ipv6.ip6-privacy=0
         <varlistentry>
           <term><varname>wifi.wake-on-wlan</varname></term>
         </varlistentry>
+        <varlistentry>
+          <term><varname>wireguard.mtu</varname></term>
+        </varlistentry>
       </variablelist>
+      <!-- The following comment is used by check-config-options.sh, don't remove it. -->
+      <!-- end connection defaults -->
     </para>
     </refsect2>
 
@@ -1009,11 +1059,28 @@ managed=1
 
   <refsect1>
     <title><literal>connectivity</literal> section</title>
+
     <para>This section controls NetworkManager's optional connectivity
     checking functionality.  This allows NetworkManager to detect
     whether or not the system can actually access the internet or
     whether it is behind a captive portal.</para>
 
+    <para>Connectivity checking serves two purposes. For one, it exposes
+    a connectivity state on D-Bus, which other applications may use. For example,
+    Gnome's portal helper uses this as signal to show a captive portal login
+    page.
+    The other use is that default-route of devices without global connectivity
+    get a penalty of +20000 to the route-metric. This has the purpose to give a
+    better default-route to devices that have global connectivity. For example,
+    when being connected to WWAN and to a Wi-Fi network which is behind a captive
+    portal, WWAN still gets preferred until login.</para>
+
+    <para>Note that your distribution might set <literal>/proc/sys/net/ipv4/conf/*/rp_filter</literal> to
+    strict filtering. That works badly with per-device connectivity checking,
+    which uses SO_BINDDEVICE to send requests on all devices. A strict rp_filter
+    setting will reject any response and the connectivity check on all but the
+    best route will fail.</para>
+
     <para>
       <variablelist>
         <varlistentry>
@@ -1037,10 +1104,15 @@ managed=1
         </varlistentry>
         <varlistentry>
           <term><varname>response</varname></term>
-          <listitem><para>If set controls what body content
+          <listitem><para>If set, controls what body content
           NetworkManager checks for when requesting the URI for
-          connectivity checking.  If missing, defaults to
-          "NetworkManager is online" </para></listitem>
+          connectivity checking.  Note that this only compares
+          that the HTTP response starts with the specifid text,
+          it does not compare the exact string. This behavior
+          might change in the future, so avoid relying on it.
+          If missing, the response defaults to "NetworkManager is online".
+          If set to empty, the HTTP server is expected to answer with
+          status code 204 or send no data.</para></listitem>
         </varlistentry>
       </variablelist>
     </para>
@@ -1064,7 +1136,7 @@ managed=1
           <term><varname>options</varname></term>
           <listitem>
             <para>
-             A list of of options to be passed to the hostname resolver.
+             A list of options to be passed to the hostname resolver.
            </para>
           </listitem>
         </varlistentry>
diff --git a/man/NetworkManager.xml b/man/NetworkManager.xml
index f78a44f4..2a13671b 100644
--- a/man/NetworkManager.xml
+++ b/man/NetworkManager.xml
@@ -55,7 +55,7 @@
       The NetworkManager daemon attempts to make networking
       configuration and operation as painless and automatic as
       possible by managing the primary network connection and other
-      network interfaces, like Ethernet, WiFi, and Mobile Broadband
+      network interfaces, like Ethernet, Wi-Fi, and Mobile Broadband
       devices.  NetworkManager will connect any network device when a
       connection for that device becomes available, unless that
       behavior is disabled.  Information about networking is exported
@@ -437,16 +437,13 @@
       <varlistentry>
         <term><varname>NM_UNMANAGED</varname></term>
         <listitem><para>
-          No default connection will be created and automatic activation
-          will not be attempted when this property of a device is set to a
-          true value ("1" or "true"). You will still be able to attach a
-          connection to the device manually or observe externally added
-          configuration such as addresses or routes.
-        </para><para>
-          Create an udev rule that sets this property to prevent NetworkManager
-          from interfering with virtual Ethernet device interfaces that are
-          managed by virtualization tools.
-        </para></listitem>
+          If set to <literal>"1"</literal> or <literal>"true"</literal>, the device is
+          configured as unmanaged by NetworkManager. Note that the user still can
+          explicitly overrule this configuration via means like
+          <command>nmcli device set "$DEVICE" managed yes</command> or
+          <literal>"device*.managed=1"</literal> in NetworkManager.conf.
+        </para>
+        </listitem>
       </varlistentry>
     </variablelist>
   </refsect1>
diff --git a/man/common.ent.in b/man/common.ent.in
index ddfbb69a..9632b4ef 100644
--- a/man/common.ent.in
+++ b/man/common.ent.in
@@ -2,6 +2,7 @@
 <!ENTITY NM_VERSION "@NM_VERSION@">
 <!ENTITY sysconfdir "@sysconfdir@">
 <!ENTITY nmrundir "@nmrundir@">
+<!ENTITY nmstatedir "@nmstatedir@">
 <!ENTITY NM_CONFIG_DEFAULT_MAIN_AUTH_POLKIT_TEXT "@NM_CONFIG_DEFAULT_MAIN_AUTH_POLKIT_TEXT@">
 <!ENTITY NM_CONFIG_DEFAULT_LOGGING_BACKEND_TEXT "@NM_CONFIG_DEFAULT_LOGGING_BACKEND_TEXT@">
 <!ENTITY NM_CONFIG_DEFAULT_LOGGING_AUDIT_TEXT "@NM_CONFIG_DEFAULT_LOGGING_AUDIT_TEXT@">
diff --git a/man/meson.build b/man/meson.build
index 21fac21d..a4ef3d9e 100644
--- a/man/meson.build
+++ b/man/meson.build
@@ -2,6 +2,7 @@ common_conf = configuration_data()
 common_conf.set('NM_VERSION', nm_version)
 common_conf.set('sysconfdir', nm_sysconfdir)
 common_conf.set('nmrundir', nm_pkgrundir)
+common_conf.set('nmstatedir', nm_pkgstatedir)
 common_conf.set('NM_CONFIG_DEFAULT_MAIN_AUTH_POLKIT_TEXT', config_default_main_auth_polkit)
 common_conf.set('NM_CONFIG_DEFAULT_LOGGING_BACKEND_TEXT', config_logging_backend_default)
 common_conf.set('NM_CONFIG_DEFAULT_LOGGING_AUDIT_TEXT', config_default_logging_audit)
@@ -13,7 +14,7 @@ common = 'common.ent'
 common_ent_file = configure_file(
   input: common + '.in',
   output: common,
-  configuration: common_conf
+  configuration: common_conf,
 )
 
 xsltproc_options = [
@@ -27,7 +28,7 @@ xsltproc_options = [
   '--stringparam', 'man.th.extra1.suppress', '1',
   '--stringparam', 'man.authors.section.enabled', '0',
   '--stringparam', 'man.copyright.section.enabled', '0',
-  '--stringparam', 'man.th.title.max.length', '30'
+  '--stringparam', 'man.th.title.max.length', '30',
 ]
 
 docbook_xls = 'http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl'
@@ -61,14 +62,14 @@ foreach man: mans
     command: xsltproc_options + [docbook_xls, '@INPUT@'],
     depend_files: common_ent_file,
     install: true,
-    install_dir: join_paths(nm_mandir, 'man' + man[1])
+    install_dir: join_paths(nm_mandir, 'man' + man[1]),
   )
 endforeach
 
 if enable_introspection
   mans = [
     ['nm-settings-keyfile', '5', nm_settings_keyfile_docs],
-    ['nm-settings', '5', nm_settings_docs]
+    ['nm-settings', '5', nm_settings_docs],
   ]
 
   if enable_ifcfg_rh
@@ -82,7 +83,7 @@ if enable_introspection
       output,
       input: man[2],
       output: output,
-      command: xsltproc_options + [join_paths(meson.current_source_dir(), man[0] + '.xsl'), '@INPUT@']
+      command: xsltproc_options + [join_paths(meson.current_source_dir(), man[0] + '.xsl'), '@INPUT@'],
     )
     content_files += input.full_path()
 
@@ -94,7 +95,7 @@ if enable_introspection
       output: output,
       command: xsltproc_options + [docbook_xls, '@INPUT@'],
       install: true,
-      install_dir: join_paths(nm_mandir, 'man' + man[1])
+      install_dir: join_paths(nm_mandir, 'man' + man[1]),
     )
   endforeach
 endif
diff --git a/man/nm-initrd-generator.8 b/man/nm-initrd-generator.8
index eaebea30..016e172c 100644
--- a/man/nm-initrd-generator.8
+++ b/man/nm-initrd-generator.8
@@ -2,12 +2,12 @@
 .\"     Title: nm-initrd-generator
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
-.\"      Date: 02/23/2019
+.\"      Date: 03/15/2019
 .\"    Manual: System Administration
-.\"    Source: NetworkManager 1.14.6
+.\"    Source: NetworkManager 1.16.0
 .\"  Language: English
 .\"
-.TH "NM\-INITRD\-GENERATOR" "8" "" "NetworkManager 1\&.14\&.6" "System Administration"
+.TH "NM\-INITRD\-GENERATOR" "8" "" "NetworkManager 1\&.16\&.0" "System Administration"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
diff --git a/man/nm-online.1 b/man/nm-online.1
index be044e0b..4ad7cdbf 100644
--- a/man/nm-online.1
+++ b/man/nm-online.1
@@ -2,12 +2,12 @@
 .\"     Title: nm-online
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
-.\"      Date: 02/23/2019
+.\"      Date: 03/15/2019
 .\"    Manual: General Commands Manual
-.\"    Source: NetworkManager 1.14.6
+.\"    Source: NetworkManager 1.16.0
 .\"  Language: English
 .\"
-.TH "NM\-ONLINE" "1" "" "NetworkManager 1\&.14\&.6" "General Commands Manual"
+.TH "NM\-ONLINE" "1" "" "NetworkManager 1\&.16\&.0" "General Commands Manual"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -50,14 +50,9 @@ or
 dhcp, to indicate that IPv6 connectivity is expected\&.
 .SH "OPTIONS"
 .PP
-\fB\-t\fR | \fB\-\-timeout\fR \fIseconds\fR
+\fB\-h\fR | \fB\-\-help\fR
 .RS 4
-Time to wait for a connection, in seconds\&. If the option is not provided, the default timeout is 30 seconds\&.
-.RE
-.PP
-\fB\-x\fR | \fB\-\-exit\fR
-.RS 4
-Exit immediately if NetworkManager is not running or connecting\&.
+Print help information\&.
 .RE
 .PP
 \fB\-q\fR | \fB\-\-quiet\fR
@@ -71,6 +66,16 @@ Wait for NetworkManager startup to complete, rather than waiting for network con
 \fBnm\-online \-s\fR
 will just return immediately, regardless of the current network state\&.)
 .RE
+.PP
+\fB\-t\fR | \fB\-\-timeout\fR \fIseconds\fR
+.RS 4
+Time to wait for a connection, in seconds\&. If the option is not provided, the default timeout is 30 seconds\&.
+.RE
+.PP
+\fB\-x\fR | \fB\-\-exit\fR
+.RS 4
+Exit immediately if NetworkManager is not running or connecting\&.
+.RE
 .SH "EXIT STATUS"
 .PP
 \fBnm\-online\fR
diff --git a/man/nm-online.xml b/man/nm-online.xml
index 297920dd..d40aef98 100644
--- a/man/nm-online.xml
+++ b/man/nm-online.xml
@@ -68,29 +68,13 @@
   <refsect1 id='options'><title>Options</title>
     <variablelist>
       <varlistentry>
-        <term>
-          <group choice='plain'>
-            <arg choice='plain'><option>-t</option></arg>
-            <arg choice='plain'><option>--timeout</option></arg>
-          </group>
-          <arg choice='plain'><replaceable>seconds</replaceable></arg>
-        </term>
-
-        <listitem>
-          <para>Time to wait for a connection, in seconds. If the option is not provided,
-          the default timeout is 30 seconds.</para>
-        </listitem>
-      </varlistentry>
-
-
-      <varlistentry>
         <term><group choice='plain'>
-          <arg choice='plain'><option>-x</option></arg>
-          <arg choice='plain'><option>--exit</option></arg>
+          <arg choice='plain'><option>-h</option></arg>
+          <arg choice='plain'><option>--help</option></arg>
         </group></term>
 
         <listitem>
-          <para>Exit immediately if NetworkManager is not running or connecting.</para>
+          <para>Print help information.</para>
         </listitem>
       </varlistentry>
 
@@ -122,6 +106,33 @@
         </listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term>
+          <group choice='plain'>
+            <arg choice='plain'><option>-t</option></arg>
+            <arg choice='plain'><option>--timeout</option></arg>
+          </group>
+          <arg choice='plain'><replaceable>seconds</replaceable></arg>
+        </term>
+
+        <listitem>
+          <para>Time to wait for a connection, in seconds. If the option is not provided,
+          the default timeout is 30 seconds.</para>
+        </listitem>
+      </varlistentry>
+
+
+      <varlistentry>
+        <term><group choice='plain'>
+          <arg choice='plain'><option>-x</option></arg>
+          <arg choice='plain'><option>--exit</option></arg>
+        </group></term>
+
+        <listitem>
+          <para>Exit immediately if NetworkManager is not running or connecting.</para>
+        </listitem>
+      </varlistentry>
+
     </variablelist>
   </refsect1>
 
diff --git a/man/nm-openvswitch.7 b/man/nm-openvswitch.7
index 1a63813b..9109071e 100644
--- a/man/nm-openvswitch.7
+++ b/man/nm-openvswitch.7
@@ -2,12 +2,12 @@
 .\"     Title: nm-openvswitch
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
-.\"      Date: 02/23/2019
-.\"    Manual: OpenVSwitch support overview
-.\"    Source: NetworkManager 1.14.6
+.\"      Date: 03/15/2019
+.\"    Manual: Open vSwitch support overview
+.\"    Source: NetworkManager 1.16.0
 .\"  Language: English
 .\"
-.TH "NM\-OPENVSWITCH" "7" "" "NetworkManager 1\&.14\&.6" "OpenVSwitch support overview"
+.TH "NM\-OPENVSWITCH" "7" "" "NetworkManager 1\&.16\&.0" "Open vSwitch support overview"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -28,10 +28,10 @@
 .\" * MAIN CONTENT STARTS HERE *
 .\" -----------------------------------------------------------------
 .SH "NAME"
-nm-openvswitch \- overview of NetworkManager OpenVSwitch support
+nm-openvswitch \- overview of NetworkManager Open vSwitch support
 .SH "OVERVIEW"
 .PP
-NetworkManager includes basic OpenVSwitch support, good enough to be capable of setting up simple OpenVSwitch configurations\&. It is not extensive and does not expose all functionality of OpenVSwitch provides\&. For large or complicated deployments users are advised to use native tools shipped with OpenVSwitch\&. This document seeks to provide overview of functionality currently provided by NetworkManager, its capabilities and limitations\&.
+NetworkManager includes basic Open vSwitch support, good enough to be capable of setting up simple Open vSwitch configurations\&. It is not extensive and does not expose all functionality of Open vSwitch provides\&. For large or complicated deployments users are advised to use native tools shipped with Open vSwitch\&. This document seeks to provide overview of functionality currently provided by NetworkManager, its capabilities and limitations\&.
 .PP
 First and foremost: NetworkManager applies the configuration by modifying the OVSDB directly\&. Its configuration model follows the OVSDB database model closely and it does not provide the level of abstraction
 \fBovs\-vsctl\fR
@@ -206,7 +206,7 @@ It\*(Aqs just a Port with multiple interfaces\&. See nm\-settings manual for Bon
 .sp -1
 .IP \(bu 2.3
 .\}
-Not all OpenVSwitch capabilities are supported\&.
+Not all Open vSwitch capabilities are supported\&.
 .RE
 .sp
 .RS 4
@@ -217,7 +217,7 @@ Not all OpenVSwitch capabilities are supported\&.
 .sp -1
 .IP \(bu 2.3
 .\}
-OpenVSwitch devices don\*(Aqt expose many useful properties on D\-Bus\&.
+Open vSwitch devices don\*(Aqt expose many useful properties on D\-Bus\&.
 .RE
 .PP
 Probably many more\&.
diff --git a/man/nm-openvswitch.xml b/man/nm-openvswitch.xml
index 7195adcc..d156e78e 100644
--- a/man/nm-openvswitch.xml
+++ b/man/nm-openvswitch.xml
@@ -26,30 +26,30 @@
 <refentry id="nm-openvswitch">
   <refentryinfo>
     <title>nm-openvswitch</title>
-    <author>NetworkManager OpenVSwitch support</author>
+    <author>NetworkManager Open vSwitch support</author>
   </refentryinfo>
 
   <refmeta>
     <refentrytitle>nm-openvswitch</refentrytitle>
     <manvolnum>7</manvolnum>
     <refmiscinfo class="source">NetworkManager</refmiscinfo>
-    <refmiscinfo class="manual">OpenVSwitch support overview</refmiscinfo>
+    <refmiscinfo class="manual">Open vSwitch support overview</refmiscinfo>
     <refmiscinfo class="version">&NM_VERSION;</refmiscinfo>
   </refmeta>
 
   <refnamediv>
     <refname>nm-openvswitch</refname>
-    <refpurpose>overview of NetworkManager OpenVSwitch support</refpurpose>
+    <refpurpose>overview of NetworkManager Open vSwitch support</refpurpose>
   </refnamediv>
 
   <refsect1>
     <title>Overview</title>
 
-    <para>NetworkManager includes basic OpenVSwitch support, good enough
-    to be capable of setting up simple OpenVSwitch configurations. It is not
-    extensive and does not expose all functionality of OpenVSwitch provides.
+    <para>NetworkManager includes basic Open vSwitch support, good enough
+    to be capable of setting up simple Open vSwitch configurations. It is not
+    extensive and does not expose all functionality of Open vSwitch provides.
     For large or complicated deployments users are advised to use native tools
-    shipped with OpenVSwitch. This document seeks to provide overview of
+    shipped with Open vSwitch. This document seeks to provide overview of
     functionality currently provided by NetworkManager, its capabilities and
     limitations.</para>
 
@@ -182,10 +182,10 @@ Connection 'ovs-slave-eth3' (8dedeecb-ed12-482b-b77a-24a4fb835136) successfully
 
     <itemizedlist>
        <listitem>
-          <para>Not all OpenVSwitch capabilities are supported.</para>
+          <para>Not all Open vSwitch capabilities are supported.</para>
        </listitem>
        <listitem>
-          <para>OpenVSwitch devices don't expose many useful properties on D-Bus.</para>
+          <para>Open vSwitch devices don't expose many useful properties on D-Bus.</para>
        </listitem>
     </itemizedlist>
     <para>Probably many more.</para>
diff --git a/man/nm-settings-ifcfg-rh.5 b/man/nm-settings-ifcfg-rh.5
index eba90b88..97953009 100644
--- a/man/nm-settings-ifcfg-rh.5
+++ b/man/nm-settings-ifcfg-rh.5
@@ -2,12 +2,12 @@
 .\"     Title: nm-settings-ifcfg-rh
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
-.\"      Date: 02/23/2019
+.\"      Date: 03/15/2019
 .\"    Manual: Configuration
-.\"    Source: NetworkManager 1.14.6
+.\"    Source: NetworkManager 1.16.0
 .\"  Language: English
 .\"
-.TH "NM\-SETTINGS\-IFCFG\-RH" "5" "" "NetworkManager 1\&.14\&.6" "Configuration"
+.TH "NM\-SETTINGS\-IFCFG\-RH" "5" "" "NetworkManager 1\&.16\&.0" "Configuration"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -1413,7 +1413,7 @@ DCB_PG_UP2TC
 T}:T{
 \ \&
 T}:T{
-Priority values\&. String of eight trafic class values (0 \- 7)\&.\fB
+Priority values\&. String of eight traffic class values (0 \- 7)\&.\fB
 
 Example: \fRDCB_PG_UP2TC=01623701
 T}
@@ -2460,7 +2460,29 @@ T}
 .nr an-no-space-flag 1
 .nr an-break-flag 1
 .br
-.B Table\ \&24.\ \&802\-3\-ethernet setting
+.B Table\ \&24.\ \&wifi\-p2p setting
+.TS
+allbox tab(:);
+lB lB lB lB.
+T{
+Property
+T}:T{
+Ifcfg\-rh Variable
+T}:T{
+Default
+T}:T{
+Description
+T}
+.T&
+.
+.TE
+.sp 1
+.sp
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
+.br
+.B Table\ \&25.\ \&802\-3\-ethernet setting
 .TS
 allbox tab(:);
 lB lB lB lB.
@@ -2609,7 +2631,29 @@ T}
 .nr an-no-space-flag 1
 .nr an-break-flag 1
 .br
-.B Table\ \&25.\ \&802\-11\-wireless\-security setting
+.B Table\ \&26.\ \&wireguard setting
+.TS
+allbox tab(:);
+lB lB lB lB.
+T{
+Property
+T}:T{
+Ifcfg\-rh Variable
+T}:T{
+Default
+T}:T{
+Description
+T}
+.T&
+.
+.TE
+.sp 1
+.sp
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
+.br
+.B Table\ \&27.\ \&802\-11\-wireless\-security setting
 .TS
 allbox tab(:);
 lB lB lB lB.
@@ -2856,7 +2900,7 @@ T}
 .nr an-no-space-flag 1
 .nr an-break-flag 1
 .br
-.B Table\ \&26.\ \&802\-11\-wireless setting
+.B Table\ \&28.\ \&802\-11\-wireless setting
 .TS
 allbox tab(:);
 lB lB lB lB.
@@ -3067,7 +3111,7 @@ T}
 .nr an-no-space-flag 1
 .nr an-break-flag 1
 .br
-.B Table\ \&27.\ \&wpan setting
+.B Table\ \&29.\ \&wpan setting
 .TS
 allbox tab(:);
 lB lB lB lB.
diff --git a/man/nm-settings-ifcfg-rh.xml b/man/nm-settings-ifcfg-rh.xml
index 0c534728..c0f834a1 100644
--- a/man/nm-settings-ifcfg-rh.xml
+++ b/man/nm-settings-ifcfg-rh.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0"?>
 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.3//EN" "http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd">
-<refentry id="nm-settings-ifcfg-rh"><refentryinfo><title>nm-settings-ifcfg-rh</title><author>NetworkManager developers</author></refentryinfo><refmeta><refentrytitle>nm-settings-ifcfg-rh</refentrytitle><manvolnum>5</manvolnum><refmiscinfo class="source">NetworkManager</refmiscinfo><refmiscinfo class="manual">Configuration</refmiscinfo><refmiscinfo class="version">1.14.6</refmiscinfo></refmeta><refnamediv><refname>nm-settings-ifcfg-rh</refname><refpurpose>Description of <emphasis>ifcfg-rh</emphasis> settings plugin</refpurpose></refnamediv><refsect1 id="description"><title>Description</title><para>
+<refentry id="nm-settings-ifcfg-rh"><refentryinfo><title>nm-settings-ifcfg-rh</title><author>NetworkManager developers</author></refentryinfo><refmeta><refentrytitle>nm-settings-ifcfg-rh</refentrytitle><manvolnum>5</manvolnum><refmiscinfo class="source">NetworkManager</refmiscinfo><refmiscinfo class="manual">Configuration</refmiscinfo><refmiscinfo class="version">1.16.0</refmiscinfo></refmeta><refnamediv><refname>nm-settings-ifcfg-rh</refname><refpurpose>Description of <emphasis>ifcfg-rh</emphasis> settings plugin</refpurpose></refnamediv><refsect1 id="description"><title>Description</title><para>
           NetworkManager is based on the concept of connection profiles that contain
           network configuration (see <citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum></citerefentry> for details). The profiles can be
           stored in various formats. NetworkManager uses plugins for reading and writing
@@ -287,7 +287,7 @@ Example: </emphasis>DCB_PG_PCT=10,5,10,15,10,10,10,30</entry></row><row><entry a
 
 Example: </emphasis>DCB_PG_UPPCT=7,13,10,10,15,15,10,20</entry></row><row><entry align="left">priority-strict-bandwidth</entry><entry align="left">DCB_PG_STRICT</entry><entry align="left"/><entry align="left">Priority values. String of eight "0" or "1", where "0" means "may not utilize all bandwidth", "1" means "may utilize all bandwidth".<emphasis role="bold">
 
-Example: </emphasis>DCB_PG_STRICT=01101110</entry></row><row><entry align="left">priority-traffic-class</entry><entry align="left">DCB_PG_UP2TC</entry><entry align="left"/><entry align="left">Priority values. String of eight trafic class values (0 - 7).<emphasis role="bold">
+Example: </emphasis>DCB_PG_STRICT=01101110</entry></row><row><entry align="left">priority-traffic-class</entry><entry align="left">DCB_PG_UP2TC</entry><entry align="left"/><entry align="left">Priority values. String of eight traffic class values (0 - 7).<emphasis role="bold">
 
 Example: </emphasis>DCB_PG_UP2TC=01623701</entry></row></tbody></tgroup></table><para>
           All DCB related configuration is a NetworkManager extension. DCB=yes must be
@@ -364,7 +364,7 @@ Example: </emphasis>VLAN_INGRESS_PRIORITY_MAP=4:2,3:5</entry></row><row><entry a
 
 Example: </emphasis>VLAN_EGRESS_PRIORITY_MAP=5:4,4:1,3:7</entry></row><row><entry align="left">interface-name</entry><entry align="left">PHYSDEV and VLAN_ID, or DEVICE</entry><entry align="left"/><entry align="left">VLAN interface name. If all variables are set, parent device from PHYSDEV takes precedence over DEVICE, but VLAN id from DEVICE takes precedence over VLAN_ID.<emphasis role="bold">
 
-Example: </emphasis>PHYSDEV=eth0, VLAN_ID=12; or DEVICE=eth0.12</entry></row></tbody></tgroup></table><table><title>802-3-ethernet setting</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Ifcfg-rh Variable</entry><entry>Default</entry><entry>Description</entry></row></thead><tbody><row><entry align="left">port</entry><entry align="left">(none)</entry><entry align="left"/><entry align="left">The property is not saved by the plugin.</entry></row><row><entry align="left">speed</entry><entry align="left">ETHTOOL_OPTS</entry><entry align="left"/><entry align="left">Fixed speed for the ethernet link. It is added as "speed" parameter in the ETHTOOL_OPTS variable.</entry></row><row><entry align="left">duplex</entry><entry align="left">ETHTOOL_OPTS</entry><entry align="left"/><entry align="left">Fixed duplex mode for the ethernet link. It is added as "duplex" parameter in the ETHOOL_OPTS variable.</entry></row><row><entry align="left">auto-negotiate</entry><entry align="left">ETHTOOL_OPTS</entry><entry align="left"/><entry align="left">Whether link speed and duplex autonegotiation is enabled. It is not saved only if disabled and no values are provided for the "speed" and "duplex" parameters (skips link configuration).</entry></row><row><entry align="left">mac-address</entry><entry align="left">HWADDR</entry><entry align="left"/><entry align="left">Hardware address of the device in traditional hex-digits-and-colons notation (e.g. 00:22:68:14:5A:05). Note that for initscripts this is the current MAC address of the device as found during ifup. For NetworkManager this is the permanent MAC address. Or in case no permanent MAC address exists, the MAC address initially configured on the device.</entry></row><row><entry align="left">cloned-mac-address</entry><entry align="left">MACADDR</entry><entry align="left"/><entry align="left">Cloned (spoofed) MAC address in traditional hex-digits-and-colons notation (e.g. 00:22:68:14:5A:99).</entry></row><row><entry align="left">generate-mac-address-mask</entry><entry align="left">GENERATE_MAC_ADDRESS_MASK<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">the MAC address mask for generating randomized and stable cloned-mac-address.</entry></row><row><entry align="left">mac-address-blacklist</entry><entry align="left">HWADDR_BLACKLIST<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">It denies usage of the connection for any device whose address is listed.<emphasis role="bold">
+Example: </emphasis>PHYSDEV=eth0, VLAN_ID=12; or DEVICE=eth0.12</entry></row></tbody></tgroup></table><table><title>wifi-p2p setting</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Ifcfg-rh Variable</entry><entry>Default</entry><entry>Description</entry></row></thead><tbody/></tgroup></table><table><title>802-3-ethernet setting</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Ifcfg-rh Variable</entry><entry>Default</entry><entry>Description</entry></row></thead><tbody><row><entry align="left">port</entry><entry align="left">(none)</entry><entry align="left"/><entry align="left">The property is not saved by the plugin.</entry></row><row><entry align="left">speed</entry><entry align="left">ETHTOOL_OPTS</entry><entry align="left"/><entry align="left">Fixed speed for the ethernet link. It is added as "speed" parameter in the ETHTOOL_OPTS variable.</entry></row><row><entry align="left">duplex</entry><entry align="left">ETHTOOL_OPTS</entry><entry align="left"/><entry align="left">Fixed duplex mode for the ethernet link. It is added as "duplex" parameter in the ETHOOL_OPTS variable.</entry></row><row><entry align="left">auto-negotiate</entry><entry align="left">ETHTOOL_OPTS</entry><entry align="left"/><entry align="left">Whether link speed and duplex autonegotiation is enabled. It is not saved only if disabled and no values are provided for the "speed" and "duplex" parameters (skips link configuration).</entry></row><row><entry align="left">mac-address</entry><entry align="left">HWADDR</entry><entry align="left"/><entry align="left">Hardware address of the device in traditional hex-digits-and-colons notation (e.g. 00:22:68:14:5A:05). Note that for initscripts this is the current MAC address of the device as found during ifup. For NetworkManager this is the permanent MAC address. Or in case no permanent MAC address exists, the MAC address initially configured on the device.</entry></row><row><entry align="left">cloned-mac-address</entry><entry align="left">MACADDR</entry><entry align="left"/><entry align="left">Cloned (spoofed) MAC address in traditional hex-digits-and-colons notation (e.g. 00:22:68:14:5A:99).</entry></row><row><entry align="left">generate-mac-address-mask</entry><entry align="left">GENERATE_MAC_ADDRESS_MASK<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">the MAC address mask for generating randomized and stable cloned-mac-address.</entry></row><row><entry align="left">mac-address-blacklist</entry><entry align="left">HWADDR_BLACKLIST<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">It denies usage of the connection for any device whose address is listed.<emphasis role="bold">
 
 Example: </emphasis>HWADDR_BLACKLIST="00:22:68:11:69:08 00:11:22:11:44:55"</entry></row><row><entry align="left">mtu</entry><entry align="left">MTU</entry><entry align="left"/><entry align="left">MTU of the interface.</entry></row><row><entry align="left">s390-subchannels</entry><entry align="left">SUBCHANNELS</entry><entry align="left"/><entry align="left">Subchannels for IBM S390 hosts.<emphasis role="bold">
 
@@ -372,7 +372,7 @@ Example: </emphasis>SUBCHANNELS=0.0.b00a,0.0.b00b,0.0.b00c</entry></row><row><en
 
 Example: </emphasis>NETTYPE=qeth<emphasis role="bold">
 
-Allowed values: </emphasis>"qeth", "lcs" or "ctc"</entry></row><row><entry align="left">s390-options</entry><entry align="left">OPTIONS and PORTNAME, CTCPROTO,</entry><entry align="left"/><entry align="left">S390 device options. All options go to OPTIONS, except for "portname" and "ctcprot" that have their own variables.</entry></row></tbody></tgroup></table><table><title>802-11-wireless-security setting</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Ifcfg-rh Variable</entry><entry>Default</entry><entry>Description</entry></row></thead><tbody><row><entry align="left">key-mgmt</entry><entry align="left">KEY_MGMT<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Key management menthod.<emphasis role="bold">
+Allowed values: </emphasis>"qeth", "lcs" or "ctc"</entry></row><row><entry align="left">s390-options</entry><entry align="left">OPTIONS and PORTNAME, CTCPROTO,</entry><entry align="left"/><entry align="left">S390 device options. All options go to OPTIONS, except for "portname" and "ctcprot" that have their own variables.</entry></row></tbody></tgroup></table><table><title>wireguard setting</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Ifcfg-rh Variable</entry><entry>Default</entry><entry>Description</entry></row></thead><tbody/></tgroup></table><table><title>802-11-wireless-security setting</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Ifcfg-rh Variable</entry><entry>Default</entry><entry>Description</entry></row></thead><tbody><row><entry align="left">key-mgmt</entry><entry align="left">KEY_MGMT<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Key management menthod.<emphasis role="bold">
 
 Allowed values: </emphasis>IEEE8021X, WPA-PSK, WPA-EAP</entry></row><row><entry align="left">wep-tx-keyidx</entry><entry align="left">DEFAULTKEY</entry><entry align="left">1</entry><entry align="left">Index of active WEP key.<emphasis role="bold">
 
diff --git a/man/nm-settings-keyfile.5 b/man/nm-settings-keyfile.5
index e6fe5c05..dd7995de 100644
--- a/man/nm-settings-keyfile.5
+++ b/man/nm-settings-keyfile.5
@@ -2,12 +2,12 @@
 .\"     Title: nm-settings-keyfile
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
-.\"      Date: 02/23/2019
+.\"      Date: 03/15/2019
 .\"    Manual: Configuration
-.\"    Source: NetworkManager 1.14.6
+.\"    Source: NetworkManager 1.16.0
 .\"  Language: English
 .\"
-.TH "NM\-SETTINGS\-KEYFILE" "5" "" "NetworkManager 1\&.14\&.6" "Configuration"
+.TH "NM\-SETTINGS\-KEYFILE" "5" "" "NetworkManager 1\&.16\&.0" "Configuration"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -513,7 +513,38 @@ T}
 .nr an-no-space-flag 1
 .nr an-break-flag 1
 .br
-.B Table\ \&7.\ \&802\-3\-ethernet setting (section)
+.B Table\ \&7.\ \&wifi\-p2p setting (section)
+.TS
+allbox tab(:);
+lB lB lB lB.
+T{
+Property
+T}:T{
+Keyfile Variable
+T}:T{
+Format
+T}:T{
+Description
+T}
+.T&
+l l l l.
+T{
+peer
+T}:T{
+peer
+T}:T{
+usual hex\-digits\-and\-colons notation
+T}:T{
+MAC address in traditional hex\-digits\-and\-colons notation (e\&.g\&. 00:22:68:12:79:A2), or semicolon separated list of 6 bytes (obsolete) (e\&.g\&. 0;34;104;18;121;162)\&.
+T}
+.TE
+.sp 1
+.sp
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
+.br
+.B Table\ \&8.\ \&802\-3\-ethernet setting (section)
 .TS
 allbox tab(:);
 lB lB lB lB.
@@ -566,7 +597,7 @@ T}
 .nr an-no-space-flag 1
 .nr an-break-flag 1
 .br
-.B Table\ \&8.\ \&802\-11\-wireless setting (section)
+.B Table\ \&9.\ \&802\-11\-wireless setting (section)
 .TS
 allbox tab(:);
 lB lB lB lB.
@@ -631,7 +662,7 @@ T}
 .nr an-no-space-flag 1
 .nr an-break-flag 1
 .br
-.B Table\ \&9.\ \&wpan setting (section)
+.B Table\ \&10.\ \&wpan setting (section)
 .TS
 allbox tab(:);
 lB lB lB lB.
diff --git a/man/nm-settings-keyfile.xml b/man/nm-settings-keyfile.xml
index 4fbbef11..3281f887 100644
--- a/man/nm-settings-keyfile.xml
+++ b/man/nm-settings-keyfile.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0"?>
 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.3//EN" "http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd">
-<refentry id="nm-settings-keyfile"><refentryinfo><title>nm-settings-keyfile</title><author>NetworkManager developers</author></refentryinfo><refmeta><refentrytitle>nm-settings-keyfile</refentrytitle><manvolnum>5</manvolnum><refmiscinfo class="source">NetworkManager</refmiscinfo><refmiscinfo class="manual">Configuration</refmiscinfo><refmiscinfo class="version">1.14.6</refmiscinfo></refmeta><refnamediv><refname>nm-settings-keyfile</refname><refpurpose>Description of <emphasis>keyfile</emphasis> settings plugin</refpurpose></refnamediv><refsect1 id="description"><title>Description</title><para>
+<refentry id="nm-settings-keyfile"><refentryinfo><title>nm-settings-keyfile</title><author>NetworkManager developers</author></refentryinfo><refmeta><refentrytitle>nm-settings-keyfile</refentrytitle><manvolnum>5</manvolnum><refmiscinfo class="source">NetworkManager</refmiscinfo><refmiscinfo class="manual">Configuration</refmiscinfo><refmiscinfo class="version">1.16.0</refmiscinfo></refmeta><refnamediv><refname>nm-settings-keyfile</refname><refpurpose>Description of <emphasis>keyfile</emphasis> settings plugin</refpurpose></refnamediv><refsect1 id="description"><title>Description</title><para>
           NetworkManager is based on the concept of connection profiles that contain
           network configuration (see <citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum></citerefentry> for details). The profiles can be
           stored in various formats. NetworkManager uses plugins for reading and writing
@@ -218,6 +218,9 @@ Example: </emphasis>remote=ovpn.corp.com cipher=AES-256-CBC username=joe</entry>
 Example: </emphasis>password=Popocatepetl</entry></row>
 </tbody></tgroup></table>
 
+<table><title>wifi-p2p setting (section)</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Keyfile Variable</entry><entry>Format</entry><entry>Description</entry></row></thead><tbody>
+<row><entry align="left">peer</entry><entry align="left">peer</entry><entry align="left">usual hex-digits-and-colons notation</entry><entry align="left">MAC address in traditional hex-digits-and-colons notation (e.g. 00:22:68:12:79:A2), or semicolon separated list of 6 bytes (obsolete) (e.g. 0;34;104;18;121;162).</entry></row>
+</tbody></tgroup></table>
 
 <table><title>802-3-ethernet setting (section)</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Keyfile Variable</entry><entry>Format</entry><entry>Description</entry></row></thead><tbody>
 <row><entry align="left">mac-address</entry><entry align="left">mac-address</entry><entry align="left">usual hex-digits-and-colons notation</entry><entry align="left">MAC address in traditional hex-digits-and-colons notation (e.g. 00:22:68:12:79:A2), or semicolon separated list of 6 bytes (obsolete) (e.g. 0;34;104;18;121;162)</entry></row>
@@ -227,6 +230,7 @@ Example: </emphasis>password=Popocatepetl</entry></row>
 Example: </emphasis>mac-address-blacklist= 00:22:68:12:79:A6;00:22:68:12:79:78</entry></row>
 </tbody></tgroup></table>
 
+
 <table><title>802-11-wireless setting (section)</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Keyfile Variable</entry><entry>Format</entry><entry>Description</entry></row></thead><tbody>
 <row><entry align="left">ssid</entry><entry align="left">ssid</entry><entry align="left">string (or decimal-byte list - obsolete)</entry><entry align="left">SSID of Wi-Fi network.<emphasis role="bold">
 
diff --git a/man/nm-settings.5 b/man/nm-settings.5
index 70ee2711..aa08919a 100644
--- a/man/nm-settings.5
+++ b/man/nm-settings.5
@@ -2,12 +2,12 @@
 .\"     Title: nm-settings
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
-.\"      Date: 02/23/2019
+.\"      Date: 03/15/2019
 .\"    Manual: Configuration
-.\"    Source: NetworkManager 1.14.6
+.\"    Source: NetworkManager 1.16.0
 .\"  Language: English
 .\"
-.TH "NM\-SETTINGS" "5" "" "NetworkManager 1\&.14\&.6" "Configuration"
+.TH "NM\-SETTINGS" "5" "" "NetworkManager 1\&.16\&.0" "Configuration"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -266,7 +266,7 @@ string
 T}:T{
 \ \&
 T}:T{
-This represents the identity of the connection used for various purposes\&. It allows to configure multiple profiles to share the identity\&. Also, the stable\-id can contain placeholders that are substituted dynamically and deterministically depending on the context\&. The stable\-id is used for generating IPv6 stable private addresses with ipv6\&.addr\-gen\-mode=stable\-privacy\&. It is also used to seed the generated cloned MAC address for ethernet\&.cloned\-mac\-address=stable and wifi\&.cloned\-mac\-address=stable\&. It is also used as DHCP client identifier with ipv4\&.dhcp\-client\-id=stable and to derive the DHCP DUID with ipv6\&.dhcp\-duid=stable\-[llt,ll,uuid]\&. Note that depending on the context where it is used, other parameters are also seeded into the generation algorithm\&. For example, a per\-host key is commonly also included, so that different systems end up generating different IDs\&. Or with ipv6\&.addr\-gen\-mode=stable\-privacy, also the device\*(Aqs name is included, so that different interfaces yield different addresses\&. The \*(Aq$\*(Aq character is treated special to perform dynamic substitutions at runtime\&. Currently supported are "${CONNECTION}", "${DEVICE}", "${MAC}", "${BOOT}", "${RANDOM}"\&. These effectively create unique IDs per\-connection, per\-device, per\-boot, or every time\&. Note that "${DEVICE}" corresponds the the interface name of the device and "${MAC}" is the permanent MAC address of the device\&. Any unrecognized patterns following \*(Aq$\*(Aq are treated verbatim, however are reserved for future use\&. You are thus advised to avoid \*(Aq$\*(Aq or escape it as "$$"\&. For example, set it to "${CONNECTION}\-${BOOT}\-${DEVICE}" to create a unique id for this connection that changes with every reboot and differs depending on the interface where the profile activates\&. If the value is unset, a global connection default is consulted\&. If the value is still unset, the default is similar to "${CONNECTION}" and uses a unique, fixed ID for the connection\&.
+This represents the identity of the connection used for various purposes\&. It allows to configure multiple profiles to share the identity\&. Also, the stable\-id can contain placeholders that are substituted dynamically and deterministically depending on the context\&. The stable\-id is used for generating IPv6 stable private addresses with ipv6\&.addr\-gen\-mode=stable\-privacy\&. It is also used to seed the generated cloned MAC address for ethernet\&.cloned\-mac\-address=stable and wifi\&.cloned\-mac\-address=stable\&. It is also used as DHCP client identifier with ipv4\&.dhcp\-client\-id=stable and to derive the DHCP DUID with ipv6\&.dhcp\-duid=stable\-[llt,ll,uuid]\&. Note that depending on the context where it is used, other parameters are also seeded into the generation algorithm\&. For example, a per\-host key is commonly also included, so that different systems end up generating different IDs\&. Or with ipv6\&.addr\-gen\-mode=stable\-privacy, also the device\*(Aqs name is included, so that different interfaces yield different addresses\&. The \*(Aq$\*(Aq character is treated special to perform dynamic substitutions at runtime\&. Currently supported are "${CONNECTION}", "${DEVICE}", "${MAC}", "${BOOT}", "${RANDOM}"\&. These effectively create unique IDs per\-connection, per\-device, per\-boot, or every time\&. Note that "${DEVICE}" corresponds to the interface name of the device and "${MAC}" is the permanent MAC address of the device\&. Any unrecognized patterns following \*(Aq$\*(Aq are treated verbatim, however are reserved for future use\&. You are thus advised to avoid \*(Aq$\*(Aq or escape it as "$$"\&. For example, set it to "${CONNECTION}\-${BOOT}\-${DEVICE}" to create a unique id for this connection that changes with every reboot and differs depending on the interface where the profile activates\&. If the value is unset, a global connection default is consulted\&. If the value is still unset, the default is similar to "${CONNECTION}" and uses a unique, fixed ID for the connection\&.
 T}
 T{
 timestamp
@@ -1496,7 +1496,7 @@ string
 T}:T{
 \ \&
 T}:T{
-Number to dial when establishing a PPP data session with the GSM\-based mobile broadband network\&.  Many modems do not require PPP for connections to the mobile network and thus this property should be left blank, which allows NetworkManager to select the appropriate settings automatically\&.
+Legacy setting that used to help establishing PPP data sessions for GSM\-based modems\&. Deprecated: 1
 T}
 T{
 password
@@ -1766,7 +1766,7 @@ int32
 T}:T{
 0
 T}:T{
-DNS servers priority\&. The relative priority for DNS servers specified by this setting\&.  A lower value is better (higher priority)\&.  Zero selects the default value, which is 50 for VPNs and 100 for other connections\&. Note that the priority is to order DNS settings for multiple active connections\&.  It does not disambiguate multiple DNS servers within the same connection profile\&. When using dns=default, servers with higher priority will be on top of resolv\&.conf\&.  To prioritize a given server over another one within the same connection, just specify them in the desired order\&.  When multiple devices have configurations with the same priority, the one with an active default route will be preferred\&.  Negative values have the special effect of excluding other configurations with a greater priority value; so in presence of at least a negative priority, only DNS servers from connections with the lowest priority value will be used\&. When using a DNS resolver that supports split\-DNS as dns=dnsmasq or dns=systemd\-resolved, each connection is used to query domains in its search list\&.  Queries for domains not present in any search list are routed through connections having the \*(Aq~\&.\*(Aq special wildcard domain, which is added automatically to connections with the default route (or can be added manually)\&.  When multiple connections specify the same domain, the one with the highest priority (lowest numerical value) wins\&.  If a connection specifies a domain which is subdomain of another domain with a negative DNS priority value, the subdomain is ignored\&.
+DNS servers priority\&. The relative priority for DNS servers specified by this setting\&.  A lower value is better (higher priority)\&. Zero selects a globally configured default value\&. If the latter is missing or zero too, it defaults to 50 for VPNs and 100 for other connections\&. Note that the priority is to order DNS settings for multiple active connections\&.  It does not disambiguate multiple DNS servers within the same connection profile\&. When using dns=default, servers with higher priority will be on top of resolv\&.conf\&.  To prioritize a given server over another one within the same connection, just specify them in the desired order\&.  When multiple devices have configurations with the same priority, the one with an active default route will be preferred\&.  Negative values have the special effect of excluding other configurations with a greater priority value; so in presence of at least a negative priority, only DNS servers from connections with the lowest priority value will be used\&. When using a DNS resolver that supports split\-DNS as dns=dnsmasq or dns=systemd\-resolved, each connection is used to query domains in its search list\&.  Queries for domains not present in any search list are routed through connections having the \*(Aq~\&.\*(Aq special wildcard domain, which is added automatically to connections with the default route (or can be added manually)\&.  When multiple connections specify the same domain, the one with the highest priority (lowest numerical value) wins\&.  If a connection specifies a domain which is subdomain of another domain with a negative DNS priority value, the subdomain is ignored\&.
 T}
 T{
 dns\-search
@@ -2006,7 +2006,7 @@ int32
 T}:T{
 0
 T}:T{
-DNS servers priority\&. The relative priority for DNS servers specified by this setting\&.  A lower value is better (higher priority)\&.  Zero selects the default value, which is 50 for VPNs and 100 for other connections\&. Note that the priority is to order DNS settings for multiple active connections\&.  It does not disambiguate multiple DNS servers within the same connection profile\&. When using dns=default, servers with higher priority will be on top of resolv\&.conf\&.  To prioritize a given server over another one within the same connection, just specify them in the desired order\&.  When multiple devices have configurations with the same priority, the one with an active default route will be preferred\&.  Negative values have the special effect of excluding other configurations with a greater priority value; so in presence of at least a negative priority, only DNS servers from connections with the lowest priority value will be used\&. When using a DNS resolver that supports split\-DNS as dns=dnsmasq or dns=systemd\-resolved, each connection is used to query domains in its search list\&.  Queries for domains not present in any search list are routed through connections having the \*(Aq~\&.\*(Aq special wildcard domain, which is added automatically to connections with the default route (or can be added manually)\&.  When multiple connections specify the same domain, the one with the highest priority (lowest numerical value) wins\&.  If a connection specifies a domain which is subdomain of another domain with a negative DNS priority value, the subdomain is ignored\&.
+DNS servers priority\&. The relative priority for DNS servers specified by this setting\&.  A lower value is better (higher priority)\&. Zero selects a globally configured default value\&. If the latter is missing or zero too, it defaults to 50 for VPNs and 100 for other connections\&. Note that the priority is to order DNS settings for multiple active connections\&.  It does not disambiguate multiple DNS servers within the same connection profile\&. When using dns=default, servers with higher priority will be on top of resolv\&.conf\&.  To prioritize a given server over another one within the same connection, just specify them in the desired order\&.  When multiple devices have configurations with the same priority, the one with an active default route will be preferred\&.  Negative values have the special effect of excluding other configurations with a greater priority value; so in presence of at least a negative priority, only DNS servers from connections with the lowest priority value will be used\&. When using a DNS resolver that supports split\-DNS as dns=dnsmasq or dns=systemd\-resolved, each connection is used to query domains in its search list\&.  Queries for domains not present in any search list are routed through connections having the \*(Aq~\&.\*(Aq special wildcard domain, which is added automatically to connections with the default route (or can be added manually)\&.  When multiple connections specify the same domain, the one with the highest priority (lowest numerical value) wins\&.  If a connection specifies a domain which is subdomain of another domain with a negative DNS priority value, the subdomain is ignored\&.
 T}
 T{
 dns\-search
@@ -3245,7 +3245,7 @@ array of vardict
 T}:T{
 []
 T}:T{
-Link watchers configuration for the connection: each link watcher is defined by a dictionary, whose keys depend upon the selected link watcher\&. Available link watchers are \*(Aqethtool\*(Aq, \*(Aqnsna_ping\*(Aq and \*(Aqarp_ping\*(Aq and it is specified in the dictionary with the key \*(Aqname\*(Aq\&. Available keys are:   ethtool: \*(Aqdelay\-up\*(Aq, \*(Aqdelay\-down\*(Aq, \*(Aqinit\-wait\*(Aq; nsna_ping: \*(Aqinit\-wait\*(Aq, \*(Aqinterval\*(Aq, \*(Aqmissed\-max\*(Aq, \*(Aqtarget\-host\*(Aq; arp_ping: all the ones in nsna_ping and \*(Aqsource\-host\*(Aq, \*(Aqvalidate\-active\*(Aq, \*(Aqvalidate\-incative\*(Aq, \*(Aqsend\-always\*(Aq\&. See teamd\&.conf man for more details\&.
+Link watchers configuration for the connection: each link watcher is defined by a dictionary, whose keys depend upon the selected link watcher\&. Available link watchers are \*(Aqethtool\*(Aq, \*(Aqnsna_ping\*(Aq and \*(Aqarp_ping\*(Aq and it is specified in the dictionary with the key \*(Aqname\*(Aq\&. Available keys are:   ethtool: \*(Aqdelay\-up\*(Aq, \*(Aqdelay\-down\*(Aq, \*(Aqinit\-wait\*(Aq; nsna_ping: \*(Aqinit\-wait\*(Aq, \*(Aqinterval\*(Aq, \*(Aqmissed\-max\*(Aq, \*(Aqtarget\-host\*(Aq; arp_ping: all the ones in nsna_ping and \*(Aqsource\-host\*(Aq, \*(Aqvalidate\-active\*(Aq, \*(Aqvalidate\-inactive\*(Aq, \*(Aqsend\-always\*(Aq\&. See teamd\&.conf man for more details\&.
 T}
 T{
 mcast\-rejoin\-count
@@ -3432,7 +3432,7 @@ array of vardict
 T}:T{
 []
 T}:T{
-Link watchers configuration for the connection: each link watcher is defined by a dictionary, whose keys depend upon the selected link watcher\&. Available link watchers are \*(Aqethtool\*(Aq, \*(Aqnsna_ping\*(Aq and \*(Aqarp_ping\*(Aq and it is specified in the dictionary with the key \*(Aqname\*(Aq\&. Available keys are:   ethtool: \*(Aqdelay\-up\*(Aq, \*(Aqdelay\-down\*(Aq, \*(Aqinit\-wait\*(Aq; nsna_ping: \*(Aqinit\-wait\*(Aq, \*(Aqinterval\*(Aq, \*(Aqmissed\-max\*(Aq, \*(Aqtarget\-host\*(Aq; arp_ping: all the ones in nsna_ping and \*(Aqsource\-host\*(Aq, \*(Aqvalidate\-active\*(Aq, \*(Aqvalidate\-incative\*(Aq, \*(Aqsend\-always\*(Aq\&. See teamd\&.conf man for more details\&.
+Link watchers configuration for the connection: each link watcher is defined by a dictionary, whose keys depend upon the selected link watcher\&. Available link watchers are \*(Aqethtool\*(Aq, \*(Aqnsna_ping\*(Aq and \*(Aqarp_ping\*(Aq and it is specified in the dictionary with the key \*(Aqname\*(Aq\&. Available keys are:   ethtool: \*(Aqdelay\-up\*(Aq, \*(Aqdelay\-down\*(Aq, \*(Aqinit\-wait\*(Aq; nsna_ping: \*(Aqinit\-wait\*(Aq, \*(Aqinterval\*(Aq, \*(Aqmissed\-max\*(Aq, \*(Aqtarget\-host\*(Aq; arp_ping: all the ones in nsna_ping and \*(Aqsource\-host\*(Aq, \*(Aqvalidate\-active\*(Aq, \*(Aqvalidate\-inactive\*(Aq, \*(Aqsend\-always\*(Aq\&. See teamd\&.conf man for more details\&.
 T}
 T{
 prio
@@ -3903,6 +3903,54 @@ Specifies the time\-to\-live value to use in outgoing packets\&.
 T}
 .TE
 .sp 1
+.SS "wifi\-p2p setting"
+.PP
+Wi\-Fi P2P Settings\&.
+.TS
+allbox tab(:);
+lB lB lB lB.
+T{
+Key Name
+T}:T{
+Value Type
+T}:T{
+Default Value
+T}:T{
+Value Description
+T}
+.T&
+l l l l
+l l l l
+l l l l.
+T{
+peer
+T}:T{
+string
+T}:T{
+\ \&
+T}:T{
+The P2P device that should be connected to\&. Currently this is the only way to create or join a group\&.
+T}
+T{
+wfd\-ies
+T}:T{
+byte array
+T}:T{
+\ \&
+T}:T{
+The Wi\-Fi Display (WFD) Information Elements (IEs) to set\&. Wi\-Fi Display requires a protocol specific information element to be set in certain Wi\-Fi frames\&. These can be specified here for the purpose of establishing a connection\&. This setting is only useful when implementing a Wi\-Fi Display client\&.
+T}
+T{
+wps\-method
+T}:T{
+uint32
+T}:T{
+0
+T}:T{
+Flags indicating which mode of WPS is to be used\&. There\*(Aqs little point in changing the default setting as NetworkManager will automatically determine the best method to use\&.
+T}
+.TE
+.sp 1
 .SS "wimax setting"
 .PP
 WiMax Settings\&.
@@ -3979,7 +4027,7 @@ string
 T}:T{
 \ \&
 T}:T{
-The new field for the cloned MAC address\&. It can be either a hardware address in ASCII representation, or one of the special values "preserve", "permanent", "random" or "stable"\&. This field replaces the deprecated "cloned\-mac\-address" on D\-Bus, which can only contain explict hardware addresses\&. Note that this property only exists in D\-Bus API\&. libnm and nmcli continue to call this property "cloned\-mac\-address"\&.
+The new field for the cloned MAC address\&. It can be either a hardware address in ASCII representation, or one of the special values "preserve", "permanent", "random" or "stable"\&. This field replaces the deprecated "cloned\-mac\-address" on D\-Bus, which can only contain explicit hardware addresses\&. Note that this property only exists in D\-Bus API\&. libnm and nmcli continue to call this property "cloned\-mac\-address"\&.
 T}
 T{
 auto\-negotiate
@@ -4109,6 +4157,94 @@ If specified, the password used with magic\-packet\-based Wake\-on\-LAN, represe
 T}
 .TE
 .sp 1
+.SS "wireguard setting"
+.PP
+WireGuard Ethernet Settings\&.
+.TS
+allbox tab(:);
+lB lB lB lB.
+T{
+Key Name
+T}:T{
+Value Type
+T}:T{
+Default Value
+T}:T{
+Value Description
+T}
+.T&
+l l l l
+l l l l
+l l l l
+l l l l
+l l l l
+l l l l
+l l l l.
+T{
+fwmark
+T}:T{
+uint32
+T}:T{
+0
+T}:T{
+The use of fwmark is optional and is by default off\&. Setting it to 0 disables it\&. Otherwise it is a 32\-bit fwmark for outgoing packets\&.
+T}
+T{
+listen\-port
+T}:T{
+uint32
+T}:T{
+0
+T}:T{
+The listen\-port\&. If listen\-port is not specified, the port will be chosen randomly when the interface comes up\&.
+T}
+T{
+mtu
+T}:T{
+uint32
+T}:T{
+0
+T}:T{
+If non\-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple fragments\&. If zero a default MTU is used\&. Note that contrary to wg\-quick\*(Aqs MTU setting, this does not take into account the current routes at the time of activation\&.
+T}
+T{
+peer\-routes
+T}:T{
+boolean
+T}:T{
+TRUE
+T}:T{
+Whether to automatically add routes for the AllowedIPs ranges of the peers\&. If TRUE (the default), NetworkManager will automatically add routes in the routing tables according to ipv4\&.route\-table and ipv6\&.route\-table\&. If FALSE, no such routes are added automatically\&. In this case, the user may want to configure static routes in ipv4\&.routes and ipv6\&.routes, respectively\&.
+T}
+T{
+peers
+T}:T{
+array of \*(Aqa{sv}\*(Aq
+T}:T{
+\ \&
+T}:T{
+Array of dictionaries for the WireGuard peers\&.
+T}
+T{
+private\-key
+T}:T{
+string
+T}:T{
+\ \&
+T}:T{
+The 256 bit private\-key in base64 encoding\&.
+T}
+T{
+private\-key\-flags
+T}:T{
+NMSettingSecretFlags (uint32)
+T}:T{
+\ \&
+T}:T{
+Flags indicating how to handle the "private\-key" property\&. (see the section called \(lqSecret flag types:\(rq for flag values)
+T}
+.TE
+.sp 1
 .SS "802\-11\-wireless setting"
 .PP
 Wi\-Fi Settings\&.
@@ -4151,7 +4287,7 @@ string
 T}:T{
 \ \&
 T}:T{
-The new field for the cloned MAC address\&. It can be either a hardware address in ASCII representation, or one of the special values "preserve", "permanent", "random" or "stable"\&. This field replaces the deprecated "cloned\-mac\-address" on D\-Bus, which can only contain explict hardware addresses\&. Note that this property only exists in D\-Bus API\&. libnm and nmcli continue to call this property "cloned\-mac\-address"\&.
+The new field for the cloned MAC address\&. It can be either a hardware address in ASCII representation, or one of the special values "preserve", "permanent", "random" or "stable"\&. This field replaces the deprecated "cloned\-mac\-address" on D\-Bus, which can only contain explicit hardware addresses\&. Note that this property only exists in D\-Bus API\&. libnm and nmcli continue to call this property "cloned\-mac\-address"\&.
 T}
 T{
 band
@@ -4387,7 +4523,7 @@ string
 T}:T{
 \ \&
 T}:T{
-Key management used for the connection\&.  One of "none" (WEP), "ieee8021x" (Dynamic WEP), "wpa\-none" (Ad\-Hoc WPA\-PSK), "wpa\-psk" (infrastructure WPA\-PSK), or "wpa\-eap" (WPA\-Enterprise)\&.  This property must be set for any Wi\-Fi connection that uses security\&.
+Key management used for the connection\&.  One of "none" (WEP), "ieee8021x" (Dynamic WEP), "wpa\-none" (Ad\-Hoc WPA\-PSK), "wpa\-psk" (infrastructure WPA\-PSK), "sae" (SAE) or "wpa\-eap" (WPA\-Enterprise)\&. This property must be set for any Wi\-Fi connection that uses security\&.
 T}
 T{
 leap\-password
@@ -4450,7 +4586,7 @@ string
 T}:T{
 \ \&
 T}:T{
-Pre\-Shared\-Key for WPA networks\&.  If the key is 64\-characters long, it must contain only hexadecimal characters and is interpreted as a hexadecimal WPA key\&.  Otherwise, the key must be between 8 and 63 ASCII characters (as specified in the 802\&.11i standard) and is interpreted as a WPA passphrase, and is hashed to derive the actual WPA\-PSK used when connecting to the Wi\-Fi network\&.
+Pre\-Shared\-Key for WPA networks\&. For WPA\-PSK, it\*(Aqs either an ASCII passphrase of 8 to 63 characters that is (as specified in the 802\&.11i standard) hashed to derive the actual key, or the key in form of 64 hexadecimal character\&. The WPA3\-Personal networks use a passphrase of any length for SAE authentication\&.
 T}
 T{
 psk\-flags
@@ -4553,8 +4689,19 @@ T}
 .T&
 l l l l
 l l l l
+l l l l
+l l l l
 l l l l.
 T{
+channel
+T}:T{
+int32
+T}:T{
+\-1
+T}:T{
+IEEE 802\&.15\&.4 channel\&. A positive integer or \-1, meaning "do not set, use whatever the device is already set to"\&.
+T}
+T{
 mac\-address
 T}:T{
 string
@@ -4564,6 +4711,15 @@ T}:T{
 If specified, this connection will only apply to the IEEE 802\&.15\&.4 (WPAN) MAC layer device whose permanent MAC address matches\&.
 T}
 T{
+page
+T}:T{
+int32
+T}:T{
+\-1
+T}:T{
+IEEE 802\&.15\&.4 channel page\&. A positive integer or \-1, meaning "do not set, use whatever the device is already set to"\&.
+T}
+T{
 pan\-id
 T}:T{
 uint32
diff --git a/man/nm-settings.xml b/man/nm-settings.xml
index 5e7029e0..50e573dc 100644
--- a/man/nm-settings.xml
+++ b/man/nm-settings.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0"?>
 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.3//EN" "http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd">
-<refentry id="nm-settings"><refentryinfo><title>nm-settings</title><author>NetworkManager developers</author></refentryinfo><refmeta><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum><refmiscinfo class="source">NetworkManager</refmiscinfo><refmiscinfo class="manual">Configuration</refmiscinfo><refmiscinfo class="version">1.14.6</refmiscinfo></refmeta><refnamediv><refname>nm-settings</refname><refpurpose>Description of settings and properties of NetworkManager connection profiles</refpurpose></refnamediv><refsect1 id="description"><title>Description</title><para>
+<refentry id="nm-settings"><refentryinfo><title>nm-settings</title><author>NetworkManager developers</author></refentryinfo><refmeta><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum><refmiscinfo class="source">NetworkManager</refmiscinfo><refmiscinfo class="manual">Configuration</refmiscinfo><refmiscinfo class="version">1.16.0</refmiscinfo></refmeta><refnamediv><refname>nm-settings</refname><refpurpose>Description of settings and properties of NetworkManager connection profiles</refpurpose></refnamediv><refsect1 id="description"><title>Description</title><para>
           NetworkManager is based on a concept of connection profiles, sometimes referred to as
           connections only. These connection profiles contain a network configuration. When
           NetworkManager activates a connection profile on a network device the configuration will
@@ -52,7 +52,7 @@
     <row><entry align="left" id="nm-settings.property.connection.read-only">read-only</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>FALSE if the connection can be modified using the provided settings service's D-Bus interface with the right privileges, or TRUE if the connection is read-only and cannot be modified.</entry></row>
     <row><entry align="left" id="nm-settings.property.connection.secondaries">secondaries</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>List of connection UUIDs that should be activated when the base connection itself is activated. Currently only VPN connections are supported.</entry></row>
     <row><entry align="left" id="nm-settings.property.connection.slave-type">slave-type</entry><entry align="left">string</entry><entry align="left"/><entry>Setting name of the device type of this slave's master connection (eg, "bond"), or NULL if this connection is not a slave.</entry></row>
-    <row><entry align="left" id="nm-settings.property.connection.stable-id">stable-id</entry><entry align="left">string</entry><entry align="left"/><entry>This represents the identity of the connection used for various purposes. It allows to configure multiple profiles to share the identity. Also, the stable-id can contain placeholders that are substituted dynamically and deterministically depending on the context. The stable-id is used for generating IPv6 stable private addresses with ipv6.addr-gen-mode=stable-privacy. It is also used to seed the generated cloned MAC address for ethernet.cloned-mac-address=stable and wifi.cloned-mac-address=stable. It is also used as DHCP client identifier with ipv4.dhcp-client-id=stable and to derive the DHCP DUID with ipv6.dhcp-duid=stable-[llt,ll,uuid]. Note that depending on the context where it is used, other parameters are also seeded into the generation algorithm. For example, a per-host key is commonly also included, so that different systems end up generating different IDs. Or with ipv6.addr-gen-mode=stable-privacy, also the device's name is included, so that different interfaces yield different addresses. The '$' character is treated special to perform dynamic substitutions at runtime. Currently supported are "${CONNECTION}", "${DEVICE}", "${MAC}", "${BOOT}", "${RANDOM}". These effectively create unique IDs per-connection, per-device, per-boot, or every time. Note that "${DEVICE}" corresponds the the interface name of the device and "${MAC}" is the permanent MAC address of the device. Any unrecognized patterns following '$' are treated verbatim, however are reserved for future use. You are thus advised to avoid '$' or escape it as "$$". For example, set it to "${CONNECTION}-${BOOT}-${DEVICE}" to create a unique id for this connection that changes with every reboot and differs depending on the interface where the profile activates. If the value is unset, a global connection default is consulted. If the value is still unset, the default is similar to "${CONNECTION}" and uses a unique, fixed ID for the connection.</entry></row>
+    <row><entry align="left" id="nm-settings.property.connection.stable-id">stable-id</entry><entry align="left">string</entry><entry align="left"/><entry>This represents the identity of the connection used for various purposes. It allows to configure multiple profiles to share the identity. Also, the stable-id can contain placeholders that are substituted dynamically and deterministically depending on the context. The stable-id is used for generating IPv6 stable private addresses with ipv6.addr-gen-mode=stable-privacy. It is also used to seed the generated cloned MAC address for ethernet.cloned-mac-address=stable and wifi.cloned-mac-address=stable. It is also used as DHCP client identifier with ipv4.dhcp-client-id=stable and to derive the DHCP DUID with ipv6.dhcp-duid=stable-[llt,ll,uuid]. Note that depending on the context where it is used, other parameters are also seeded into the generation algorithm. For example, a per-host key is commonly also included, so that different systems end up generating different IDs. Or with ipv6.addr-gen-mode=stable-privacy, also the device's name is included, so that different interfaces yield different addresses. The '$' character is treated special to perform dynamic substitutions at runtime. Currently supported are "${CONNECTION}", "${DEVICE}", "${MAC}", "${BOOT}", "${RANDOM}". These effectively create unique IDs per-connection, per-device, per-boot, or every time. Note that "${DEVICE}" corresponds to the interface name of the device and "${MAC}" is the permanent MAC address of the device. Any unrecognized patterns following '$' are treated verbatim, however are reserved for future use. You are thus advised to avoid '$' or escape it as "$$". For example, set it to "${CONNECTION}-${BOOT}-${DEVICE}" to create a unique id for this connection that changes with every reboot and differs depending on the interface where the profile activates. If the value is unset, a global connection default is consulted. If the value is still unset, the default is similar to "${CONNECTION}" and uses a unique, fixed ID for the connection.</entry></row>
     <row><entry align="left" id="nm-settings.property.connection.timestamp">timestamp</entry><entry align="left">uint64</entry><entry align="left">0</entry><entry>The time, in seconds since the Unix Epoch, that the connection was last _successfully_ fully activated. NetworkManager updates the connection timestamp periodically when the connection is active to ensure that an active connection has the latest timestamp. The property is only meant for reading (changes to this property will not be preserved).</entry></row>
     <row><entry align="left" id="nm-settings.property.connection.type">type</entry><entry align="left">string</entry><entry align="left"/><entry>Base type of the connection. For hardware-dependent connections, should contain the setting name of the hardware-type specific setting (ie, "802-3-ethernet" or "802-11-wireless" or "bluetooth", etc), and for non-hardware dependent connections like VPN or otherwise, should contain the setting name of that setting type (ie, "vpn" or "bridge", etc).</entry></row>
     <row><entry align="left" id="nm-settings.property.connection.uuid">uuid</entry><entry align="left">string</entry><entry align="left"/><entry>A universally unique identifier for the connection, for example generated with libuuid.  It should be assigned when the connection is created, and never changed as long as the connection still applies to the same network.  For example, it should not be changed when the "id" property or NMSettingIP4Config changes, but might need to be re-created when the Wi-Fi SSID, mobile broadband network provider, or "type" property changes. The UUID must be in the format "2815492f-7e56-435e-b2e9-246bd7cdc664" (ie, contains only hexadecimal characters and "-").</entry></row>
@@ -177,7 +177,7 @@
     <row><entry align="left" id="nm-settings.property.gsm.home-only">home-only</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>When TRUE, only connections to the home network will be allowed. Connections to roaming networks will not be made.</entry></row>
     <row><entry align="left" id="nm-settings.property.gsm.mtu">mtu</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>If non-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple frames.</entry></row>
     <row><entry align="left" id="nm-settings.property.gsm.network-id">network-id</entry><entry align="left">string</entry><entry align="left"/><entry>The Network ID (GSM LAI format, ie MCC-MNC) to force specific network registration.  If the Network ID is specified, NetworkManager will attempt to force the device to register only on the specified network. This can be used to ensure that the device does not roam when direct roaming control of the device is not otherwise possible.</entry></row>
-    <row><entry align="left" id="nm-settings.property.gsm.number">number</entry><entry align="left">string</entry><entry align="left"/><entry>Number to dial when establishing a PPP data session with the GSM-based mobile broadband network.  Many modems do not require PPP for connections to the mobile network and thus this property should be left blank, which allows NetworkManager to select the appropriate settings automatically.</entry></row>
+    <row><entry align="left" id="nm-settings.property.gsm.number">number</entry><entry align="left">string</entry><entry align="left"/><entry>Legacy setting that used to help establishing PPP data sessions for GSM-based modems. Deprecated: 1</entry></row>
     <row><entry align="left" id="nm-settings.property.gsm.password">password</entry><entry align="left">string</entry><entry align="left"/><entry>The password used to authenticate with the network, if required.  Many providers do not require a password, or accept any password.  But if a password is required, it is specified here.</entry></row>
     <row><entry align="left" id="nm-settings.property.gsm.password-flags">password-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "password" property. (see <xref linkend="secrets-flags"/> for flag values)</entry></row>
     <row><entry align="left" id="nm-settings.property.gsm.pin">pin</entry><entry align="left">string</entry><entry align="left"/><entry>If the SIM is locked with a PIN it must be unlocked before any other operations are requested.  Specify the PIN here to allow operation of the device.</entry></row>
@@ -204,7 +204,7 @@
     <row><entry align="left" id="nm-settings.property.ipv4.dhcp-timeout">dhcp-timeout</entry><entry align="left">int32</entry><entry align="left">0</entry><entry>A timeout for a DHCP transaction in seconds.</entry></row>
     <row><entry align="left" id="nm-settings.property.ipv4.dns">dns</entry><entry align="left">array of uint32</entry><entry align="left">[]</entry><entry>Array of IP addresses of DNS servers (as network-byte-order integers)</entry></row>
     <row><entry align="left" id="nm-settings.property.ipv4.dns-options">dns-options</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>Array of DNS options as described in man 5 resolv.conf. NULL means that the options are unset and left at the default. In this case NetworkManager will use default options. This is distinct from an empty list of properties.</entry></row>
-    <row><entry align="left" id="nm-settings.property.ipv4.dns-priority">dns-priority</entry><entry align="left">int32</entry><entry align="left">0</entry><entry>DNS servers priority. The relative priority for DNS servers specified by this setting.  A lower value is better (higher priority).  Zero selects the default value, which is 50 for VPNs and 100 for other connections. Note that the priority is to order DNS settings for multiple active connections.  It does not disambiguate multiple DNS servers within the same connection profile. When using dns=default, servers with higher priority will be on top of resolv.conf.  To prioritize a given server over another one within the same connection, just specify them in the desired order.  When multiple devices have configurations with the same priority, the one with an active default route will be preferred.  Negative values have the special effect of excluding other configurations with a greater priority value; so in presence of at least a negative priority, only DNS servers from connections with the lowest priority value will be used. When using a DNS resolver that supports split-DNS as dns=dnsmasq or dns=systemd-resolved, each connection is used to query domains in its search list.  Queries for domains not present in any search list are routed through connections having the '~.' special wildcard domain, which is added automatically to connections with the default route (or can be added manually).  When multiple connections specify the same domain, the one with the highest priority (lowest numerical value) wins.  If a connection specifies a domain which is subdomain of another domain with a negative DNS priority value, the subdomain is ignored.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv4.dns-priority">dns-priority</entry><entry align="left">int32</entry><entry align="left">0</entry><entry>DNS servers priority. The relative priority for DNS servers specified by this setting.  A lower value is better (higher priority). Zero selects a globally configured default value. If the latter is missing or zero too, it defaults to 50 for VPNs and 100 for other connections. Note that the priority is to order DNS settings for multiple active connections.  It does not disambiguate multiple DNS servers within the same connection profile. When using dns=default, servers with higher priority will be on top of resolv.conf.  To prioritize a given server over another one within the same connection, just specify them in the desired order.  When multiple devices have configurations with the same priority, the one with an active default route will be preferred.  Negative values have the special effect of excluding other configurations with a greater priority value; so in presence of at least a negative priority, only DNS servers from connections with the lowest priority value will be used. When using a DNS resolver that supports split-DNS as dns=dnsmasq or dns=systemd-resolved, each connection is used to query domains in its search list.  Queries for domains not present in any search list are routed through connections having the '~.' special wildcard domain, which is added automatically to connections with the default route (or can be added manually).  When multiple connections specify the same domain, the one with the highest priority (lowest numerical value) wins.  If a connection specifies a domain which is subdomain of another domain with a negative DNS priority value, the subdomain is ignored.</entry></row>
     <row><entry align="left" id="nm-settings.property.ipv4.dns-search">dns-search</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>Array of DNS search domains. Domains starting with a tilde ('~') are considered 'routing' domains and are used only to decide the interface over which a query must be forwarded; they are not used to complete unqualified host names.</entry></row>
     <row><entry align="left" id="nm-settings.property.ipv4.gateway">gateway</entry><entry align="left">string</entry><entry align="left"/><entry>The gateway associated with this configuration. This is only meaningful if "addresses" is also set.</entry></row>
     <row><entry align="left" id="nm-settings.property.ipv4.ignore-auto-dns">ignore-auto-dns</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>When "method" is set to "auto" and this property to TRUE, automatically configured nameservers and search domains are ignored and only nameservers and search domains specified in the "dns" and "dns-search" properties, if any, are used.</entry></row>
@@ -228,7 +228,7 @@
     <row><entry align="left" id="nm-settings.property.ipv6.dhcp-timeout">dhcp-timeout</entry><entry align="left">int32</entry><entry align="left">0</entry><entry>A timeout for a DHCP transaction in seconds.</entry></row>
     <row><entry align="left" id="nm-settings.property.ipv6.dns">dns</entry><entry align="left">array of byte array</entry><entry align="left">[]</entry><entry>Array of IP addresses of DNS servers (in network byte order)</entry></row>
     <row><entry align="left" id="nm-settings.property.ipv6.dns-options">dns-options</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>Array of DNS options as described in man 5 resolv.conf. NULL means that the options are unset and left at the default. In this case NetworkManager will use default options. This is distinct from an empty list of properties.</entry></row>
-    <row><entry align="left" id="nm-settings.property.ipv6.dns-priority">dns-priority</entry><entry align="left">int32</entry><entry align="left">0</entry><entry>DNS servers priority. The relative priority for DNS servers specified by this setting.  A lower value is better (higher priority).  Zero selects the default value, which is 50 for VPNs and 100 for other connections. Note that the priority is to order DNS settings for multiple active connections.  It does not disambiguate multiple DNS servers within the same connection profile. When using dns=default, servers with higher priority will be on top of resolv.conf.  To prioritize a given server over another one within the same connection, just specify them in the desired order.  When multiple devices have configurations with the same priority, the one with an active default route will be preferred.  Negative values have the special effect of excluding other configurations with a greater priority value; so in presence of at least a negative priority, only DNS servers from connections with the lowest priority value will be used. When using a DNS resolver that supports split-DNS as dns=dnsmasq or dns=systemd-resolved, each connection is used to query domains in its search list.  Queries for domains not present in any search list are routed through connections having the '~.' special wildcard domain, which is added automatically to connections with the default route (or can be added manually).  When multiple connections specify the same domain, the one with the highest priority (lowest numerical value) wins.  If a connection specifies a domain which is subdomain of another domain with a negative DNS priority value, the subdomain is ignored.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv6.dns-priority">dns-priority</entry><entry align="left">int32</entry><entry align="left">0</entry><entry>DNS servers priority. The relative priority for DNS servers specified by this setting.  A lower value is better (higher priority). Zero selects a globally configured default value. If the latter is missing or zero too, it defaults to 50 for VPNs and 100 for other connections. Note that the priority is to order DNS settings for multiple active connections.  It does not disambiguate multiple DNS servers within the same connection profile. When using dns=default, servers with higher priority will be on top of resolv.conf.  To prioritize a given server over another one within the same connection, just specify them in the desired order.  When multiple devices have configurations with the same priority, the one with an active default route will be preferred.  Negative values have the special effect of excluding other configurations with a greater priority value; so in presence of at least a negative priority, only DNS servers from connections with the lowest priority value will be used. When using a DNS resolver that supports split-DNS as dns=dnsmasq or dns=systemd-resolved, each connection is used to query domains in its search list.  Queries for domains not present in any search list are routed through connections having the '~.' special wildcard domain, which is added automatically to connections with the default route (or can be added manually).  When multiple connections specify the same domain, the one with the highest priority (lowest numerical value) wins.  If a connection specifies a domain which is subdomain of another domain with a negative DNS priority value, the subdomain is ignored.</entry></row>
     <row><entry align="left" id="nm-settings.property.ipv6.dns-search">dns-search</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>Array of DNS search domains. Domains starting with a tilde ('~') are considered 'routing' domains and are used only to decide the interface over which a query must be forwarded; they are not used to complete unqualified host names.</entry></row>
     <row><entry align="left" id="nm-settings.property.ipv6.gateway">gateway</entry><entry align="left">string</entry><entry align="left"/><entry>The gateway associated with this configuration. This is only meaningful if "addresses" is also set.</entry></row>
     <row><entry align="left" id="nm-settings.property.ipv6.ignore-auto-dns">ignore-auto-dns</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>When "method" is set to "auto" and this property to TRUE, automatically configured nameservers and search domains are ignored and only nameservers and search domains specified in the "dns" and "dns-search" properties, if any, are used.</entry></row>
@@ -355,7 +355,7 @@
   <refsect2><title>team setting</title><para>Teaming Settings.</para><informaltable><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
     <row><entry align="left" id="nm-settings.property.team.config">config</entry><entry align="left">string</entry><entry align="left"/><entry>The JSON configuration for the team network interface.  The property should contain raw JSON configuration data suitable for teamd, because the value is passed directly to teamd. If not specified, the default configuration is used.  See man teamd.conf for the format details.</entry></row>
     <row><entry align="left" id="nm-settings.property.team.interface-name">interface-name</entry><entry align="left">string</entry><entry align="left"/><entry>Deprecated in favor of connection.interface-name, but can be used for backward-compatibility with older daemons, to set the team's interface name.</entry></row>
-    <row><entry align="left" id="nm-settings.property.team.link-watchers">link-watchers</entry><entry align="left">array of vardict</entry><entry align="left">[]</entry><entry>Link watchers configuration for the connection: each link watcher is defined by a dictionary, whose keys depend upon the selected link watcher. Available link watchers are 'ethtool', 'nsna_ping' and 'arp_ping' and it is specified in the dictionary with the key 'name'. Available keys are:   ethtool: 'delay-up', 'delay-down', 'init-wait'; nsna_ping: 'init-wait', 'interval', 'missed-max', 'target-host'; arp_ping: all the ones in nsna_ping and 'source-host', 'validate-active', 'validate-incative', 'send-always'. See teamd.conf man for more details.</entry></row>
+    <row><entry align="left" id="nm-settings.property.team.link-watchers">link-watchers</entry><entry align="left">array of vardict</entry><entry align="left">[]</entry><entry>Link watchers configuration for the connection: each link watcher is defined by a dictionary, whose keys depend upon the selected link watcher. Available link watchers are 'ethtool', 'nsna_ping' and 'arp_ping' and it is specified in the dictionary with the key 'name'. Available keys are:   ethtool: 'delay-up', 'delay-down', 'init-wait'; nsna_ping: 'init-wait', 'interval', 'missed-max', 'target-host'; arp_ping: all the ones in nsna_ping and 'source-host', 'validate-active', 'validate-inactive', 'send-always'. See teamd.conf man for more details.</entry></row>
     <row><entry align="left" id="nm-settings.property.team.mcast-rejoin-count">mcast-rejoin-count</entry><entry align="left">int32</entry><entry align="left">0</entry><entry>Corresponds to the teamd mcast_rejoin.count.</entry></row>
     <row><entry align="left" id="nm-settings.property.team.mcast-rejoin-interval">mcast-rejoin-interval</entry><entry align="left">int32</entry><entry align="left">0</entry><entry>Corresponds to the teamd mcast_rejoin.interval.</entry></row>
     <row><entry align="left" id="nm-settings.property.team.notify-peers-count">notify-peers-count</entry><entry align="left">int32</entry><entry align="left">0</entry><entry>Corresponds to the teamd notify_peers.count.</entry></row>
@@ -375,7 +375,7 @@
     <row><entry align="left" id="nm-settings.property.team-port.config">config</entry><entry align="left">string</entry><entry align="left"/><entry>The JSON configuration for the team port. The property should contain raw JSON configuration data suitable for teamd, because the value is passed directly to teamd. If not specified, the default configuration is used. See man teamd.conf for the format details.</entry></row>
     <row><entry align="left" id="nm-settings.property.team-port.lacp-key">lacp-key</entry><entry align="left">int32</entry><entry align="left">0</entry><entry>Corresponds to the teamd ports.PORTIFNAME.lacp_key.</entry></row>
     <row><entry align="left" id="nm-settings.property.team-port.lacp-prio">lacp-prio</entry><entry align="left">int32</entry><entry align="left">255</entry><entry>Corresponds to the teamd ports.PORTIFNAME.lacp_prio.</entry></row>
-    <row><entry align="left" id="nm-settings.property.team-port.link-watchers">link-watchers</entry><entry align="left">array of vardict</entry><entry align="left">[]</entry><entry>Link watchers configuration for the connection: each link watcher is defined by a dictionary, whose keys depend upon the selected link watcher. Available link watchers are 'ethtool', 'nsna_ping' and 'arp_ping' and it is specified in the dictionary with the key 'name'. Available keys are:   ethtool: 'delay-up', 'delay-down', 'init-wait'; nsna_ping: 'init-wait', 'interval', 'missed-max', 'target-host'; arp_ping: all the ones in nsna_ping and 'source-host', 'validate-active', 'validate-incative', 'send-always'. See teamd.conf man for more details.</entry></row>
+    <row><entry align="left" id="nm-settings.property.team-port.link-watchers">link-watchers</entry><entry align="left">array of vardict</entry><entry align="left">[]</entry><entry>Link watchers configuration for the connection: each link watcher is defined by a dictionary, whose keys depend upon the selected link watcher. Available link watchers are 'ethtool', 'nsna_ping' and 'arp_ping' and it is specified in the dictionary with the key 'name'. Available keys are:   ethtool: 'delay-up', 'delay-down', 'init-wait'; nsna_ping: 'init-wait', 'interval', 'missed-max', 'target-host'; arp_ping: all the ones in nsna_ping and 'source-host', 'validate-active', 'validate-inactive', 'send-always'. See teamd.conf man for more details.</entry></row>
     <row><entry align="left" id="nm-settings.property.team-port.prio">prio</entry><entry align="left">int32</entry><entry align="left">0</entry><entry>Corresponds to the teamd ports.PORTIFNAME.prio.</entry></row>
     <row><entry align="left" id="nm-settings.property.team-port.queue-id">queue-id</entry><entry align="left">int32</entry><entry align="left">-1</entry><entry>Corresponds to the teamd ports.PORTIFNAME.queue_id. When set to -1 means the parameter is skipped from the json config.</entry></row>
     <row><entry align="left" id="nm-settings.property.team-port.sticky">sticky</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>Corresponds to the teamd ports.PORTIFNAME.sticky.</entry></row>
@@ -425,12 +425,17 @@
     <row><entry align="left" id="nm-settings.property.vxlan.tos">tos</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>Specifies the TOS value to use in outgoing packets.</entry></row>
     <row><entry align="left" id="nm-settings.property.vxlan.ttl">ttl</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>Specifies the time-to-live value to use in outgoing packets.</entry></row>
   </tbody></tgroup></informaltable></refsect2>
+  <refsect2><title>wifi-p2p setting</title><para>Wi-Fi P2P Settings.</para><informaltable><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
+    <row><entry align="left" id="nm-settings.property.wifi-p2p.peer">peer</entry><entry align="left">string</entry><entry align="left"/><entry>The P2P device that should be connected to. Currently this is the only way to create or join a group.</entry></row>
+    <row><entry align="left" id="nm-settings.property.wifi-p2p.wfd-ies">wfd-ies</entry><entry align="left">byte array</entry><entry align="left"/><entry>The Wi-Fi Display (WFD) Information Elements (IEs) to set. Wi-Fi Display requires a protocol specific information element to be set in certain Wi-Fi frames. These can be specified here for the purpose of establishing a connection. This setting is only useful when implementing a Wi-Fi Display client.</entry></row>
+    <row><entry align="left" id="nm-settings.property.wifi-p2p.wps-method">wps-method</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>Flags indicating which mode of WPS is to be used. There's little point in changing the default setting as NetworkManager will automatically determine the best method to use.</entry></row>
+  </tbody></tgroup></informaltable></refsect2>
   <refsect2><title>wimax setting</title><para>WiMax Settings.</para><informaltable><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
     <row><entry align="left" id="nm-settings.property.wimax.mac-address">mac-address</entry><entry align="left">byte array</entry><entry align="left"/><entry>If specified, this connection will only apply to the WiMAX device whose MAC address matches. This property does not change the MAC address of the device (known as MAC spoofing). Deprecated: 1</entry></row>
     <row><entry align="left" id="nm-settings.property.wimax.network-name">network-name</entry><entry align="left">string</entry><entry align="left"/><entry>Network Service Provider (NSP) name of the WiMAX network this connection should use. Deprecated: 1</entry></row>
   </tbody></tgroup></informaltable></refsect2>
   <refsect2><title>802-3-ethernet setting</title><para>Wired Ethernet Settings.</para><informaltable><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
-    <row><entry align="left" id="nm-settings.property.802-3-ethernet.assigned-mac-address">assigned-mac-address</entry><entry align="left">string</entry><entry align="left"/><entry>The new field for the cloned MAC address. It can be either a hardware address in ASCII representation, or one of the special values "preserve", "permanent", "random" or "stable". This field replaces the deprecated "cloned-mac-address" on D-Bus, which can only contain explict hardware addresses. Note that this property only exists in D-Bus API. libnm and nmcli continue to call this property "cloned-mac-address".</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-3-ethernet.assigned-mac-address">assigned-mac-address</entry><entry align="left">string</entry><entry align="left"/><entry>The new field for the cloned MAC address. It can be either a hardware address in ASCII representation, or one of the special values "preserve", "permanent", "random" or "stable". This field replaces the deprecated "cloned-mac-address" on D-Bus, which can only contain explicit hardware addresses. Note that this property only exists in D-Bus API. libnm and nmcli continue to call this property "cloned-mac-address".</entry></row>
     <row><entry align="left" id="nm-settings.property.802-3-ethernet.auto-negotiate">auto-negotiate</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>When TRUE, enforce auto-negotiation of speed and duplex mode. If "speed" and "duplex" properties are both specified, only that single mode will be advertised and accepted during the link auto-negotiation process: this works only for BASE-T 802.3 specifications and is useful for enforcing gigabits modes, as in these cases link negotiation is mandatory. When FALSE, "speed" and "duplex" properties should be both set or link configuration will be skipped.</entry></row>
     <row><entry align="left" id="nm-settings.property.802-3-ethernet.cloned-mac-address">cloned-mac-address</entry><entry align="left">byte array</entry><entry align="left"/><entry>This D-Bus field is deprecated in favor of "assigned-mac-address" which is more flexible and allows specifying special variants like "random". For libnm and nmcli, this field is called "cloned-mac-address".</entry></row>
     <row><entry align="left" id="nm-settings.property.802-3-ethernet.duplex">duplex</entry><entry align="left">string</entry><entry align="left"/><entry>When a value is set, either "half" or "full", configures the device to use the specified duplex mode. If "auto-negotiate" is "yes" the specified duplex mode will be the only one advertised during link negotiation: this works only for BASE-T 802.3 specifications and is useful for enforcing gigabits modes, as in these cases link negotiation is mandatory. If the value is unset (the default), the link configuration will be either skipped (if "auto-negotiate" is "no", the default) or will be auto-negotiated (if "auto-negotiate" is "yes") and the local device will advertise all the supported duplex modes. Must be set together with the "speed" property if specified. Before specifying a duplex mode be sure your device supports it.</entry></row>
@@ -446,8 +451,17 @@
     <row><entry align="left" id="nm-settings.property.802-3-ethernet.wake-on-lan">wake-on-lan</entry><entry align="left">uint32</entry><entry align="left">1</entry><entry>The NMSettingWiredWakeOnLan options to enable. Not all devices support all options. May be any combination of NM_SETTING_WIRED_WAKE_ON_LAN_PHY (0x2), NM_SETTING_WIRED_WAKE_ON_LAN_UNICAST (0x4), NM_SETTING_WIRED_WAKE_ON_LAN_MULTICAST (0x8), NM_SETTING_WIRED_WAKE_ON_LAN_BROADCAST (0x10), NM_SETTING_WIRED_WAKE_ON_LAN_ARP (0x20), NM_SETTING_WIRED_WAKE_ON_LAN_MAGIC (0x40) or the special values NM_SETTING_WIRED_WAKE_ON_LAN_DEFAULT (0x1) (to use global settings) and NM_SETTING_WIRED_WAKE_ON_LAN_IGNORE (0x8000) (to disable management of Wake-on-LAN in NetworkManager).</entry></row>
     <row><entry align="left" id="nm-settings.property.802-3-ethernet.wake-on-lan-password">wake-on-lan-password</entry><entry align="left">string</entry><entry align="left"/><entry>If specified, the password used with magic-packet-based Wake-on-LAN, represented as an Ethernet MAC address.  If NULL, no password will be required.</entry></row>
   </tbody></tgroup></informaltable></refsect2>
+  <refsect2><title>wireguard setting</title><para>WireGuard Ethernet Settings.</para><informaltable><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
+    <row><entry align="left" id="nm-settings.property.wireguard.fwmark">fwmark</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>The use of fwmark is optional and is by default off. Setting it to 0 disables it. Otherwise it is a 32-bit fwmark for outgoing packets.</entry></row>
+    <row><entry align="left" id="nm-settings.property.wireguard.listen-port">listen-port</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>The listen-port. If listen-port is not specified, the port will be chosen randomly when the interface comes up.</entry></row>
+    <row><entry align="left" id="nm-settings.property.wireguard.mtu">mtu</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>If non-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple fragments. If zero a default MTU is used. Note that contrary to wg-quick's MTU setting, this does not take into account the current routes at the time of activation.</entry></row>
+    <row><entry align="left" id="nm-settings.property.wireguard.peer-routes">peer-routes</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>Whether to automatically add routes for the AllowedIPs ranges of the peers. If TRUE (the default), NetworkManager will automatically add routes in the routing tables according to ipv4.route-table and ipv6.route-table. If FALSE, no such routes are added automatically. In this case, the user may want to configure static routes in ipv4.routes and ipv6.routes, respectively.</entry></row>
+    <row><entry align="left" id="nm-settings.property.wireguard.peers">peers</entry><entry align="left">array of 'a{sv}'</entry><entry align="left"/><entry>Array of dictionaries for the WireGuard peers.</entry></row>
+    <row><entry align="left" id="nm-settings.property.wireguard.private-key">private-key</entry><entry align="left">string</entry><entry align="left"/><entry>The 256 bit private-key in base64 encoding.</entry></row>
+    <row><entry align="left" id="nm-settings.property.wireguard.private-key-flags">private-key-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "private-key" property. (see <xref linkend="secrets-flags"/> for flag values)</entry></row>
+  </tbody></tgroup></informaltable></refsect2>
   <refsect2><title>802-11-wireless setting</title><para>Wi-Fi Settings.</para><informaltable><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
-    <row><entry align="left" id="nm-settings.property.802-11-wireless.assigned-mac-address">assigned-mac-address</entry><entry align="left">string</entry><entry align="left"/><entry>The new field for the cloned MAC address. It can be either a hardware address in ASCII representation, or one of the special values "preserve", "permanent", "random" or "stable". This field replaces the deprecated "cloned-mac-address" on D-Bus, which can only contain explict hardware addresses. Note that this property only exists in D-Bus API. libnm and nmcli continue to call this property "cloned-mac-address".</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-11-wireless.assigned-mac-address">assigned-mac-address</entry><entry align="left">string</entry><entry align="left"/><entry>The new field for the cloned MAC address. It can be either a hardware address in ASCII representation, or one of the special values "preserve", "permanent", "random" or "stable". This field replaces the deprecated "cloned-mac-address" on D-Bus, which can only contain explicit hardware addresses. Note that this property only exists in D-Bus API. libnm and nmcli continue to call this property "cloned-mac-address".</entry></row>
     <row><entry align="left" id="nm-settings.property.802-11-wireless.band">band</entry><entry align="left">string</entry><entry align="left"/><entry>802.11 frequency band of the network.  One of "a" for 5GHz 802.11a or "bg" for 2.4GHz 802.11.  This will lock associations to the Wi-Fi network to the specific band, i.e. if "a" is specified, the device will not associate with the same network in the 2.4GHz band even if the network's settings are compatible.  This setting depends on specific driver capability and may not work with all drivers.</entry></row>
     <row><entry align="left" id="nm-settings.property.802-11-wireless.bssid">bssid</entry><entry align="left">byte array</entry><entry align="left"/><entry>If specified, directs the device to only associate with the given access point.  This capability is highly driver dependent and not supported by all devices.  Note: this property does not control the BSSID used when creating an Ad-Hoc network and is unlikely to in the future.</entry></row>
     <row><entry align="left" id="nm-settings.property.802-11-wireless.channel">channel</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>Wireless channel to use for the Wi-Fi connection.  The device will only join (or create for Ad-Hoc networks) a Wi-Fi network on the specified channel.  Because channel numbers overlap between bands, this property also requires the "band" property to be set.</entry></row>
@@ -471,14 +485,14 @@
     <row><entry align="left" id="nm-settings.property.802-11-wireless-security.auth-alg">auth-alg</entry><entry align="left">string</entry><entry align="left"/><entry>When WEP is used (ie, key-mgmt = "none" or "ieee8021x") indicate the 802.11 authentication algorithm required by the AP here.  One of "open" for Open System, "shared" for Shared Key, or "leap" for Cisco LEAP.  When using Cisco LEAP (ie, key-mgmt = "ieee8021x" and auth-alg = "leap") the "leap-username" and "leap-password" properties must be specified.</entry></row>
     <row><entry align="left" id="nm-settings.property.802-11-wireless-security.fils">fils</entry><entry align="left">int32</entry><entry align="left">0</entry><entry>Indicates whether Fast Initial Link Setup (802.11ai) must be enabled for the connection.  One of NM_SETTING_WIRELESS_SECURITY_FILS_DEFAULT (0) (use global default value), NM_SETTING_WIRELESS_SECURITY_FILS_DISABLE (1) (disable FILS), NM_SETTING_WIRELESS_SECURITY_FILS_OPTIONAL (2) (enable FILS if the supplicant and the access point support it) or NM_SETTING_WIRELESS_SECURITY_FILS_REQUIRED (3) (enable FILS and fail if not supported).  When set to NM_SETTING_WIRELESS_SECURITY_FILS_DEFAULT (0) and no global default is set, FILS will be optionally enabled.</entry></row>
     <row><entry align="left" id="nm-settings.property.802-11-wireless-security.group">group</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>A list of group/broadcast encryption algorithms which prevents connections to Wi-Fi networks that do not utilize one of the algorithms in the list.  For maximum compatibility leave this property empty.  Each list element may be one of "wep40", "wep104", "tkip", or "ccmp".</entry></row>
-    <row><entry align="left" id="nm-settings.property.802-11-wireless-security.key-mgmt">key-mgmt</entry><entry align="left">string</entry><entry align="left"/><entry>Key management used for the connection.  One of "none" (WEP), "ieee8021x" (Dynamic WEP), "wpa-none" (Ad-Hoc WPA-PSK), "wpa-psk" (infrastructure WPA-PSK), or "wpa-eap" (WPA-Enterprise).  This property must be set for any Wi-Fi connection that uses security.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-11-wireless-security.key-mgmt">key-mgmt</entry><entry align="left">string</entry><entry align="left"/><entry>Key management used for the connection.  One of "none" (WEP), "ieee8021x" (Dynamic WEP), "wpa-none" (Ad-Hoc WPA-PSK), "wpa-psk" (infrastructure WPA-PSK), "sae" (SAE) or "wpa-eap" (WPA-Enterprise). This property must be set for any Wi-Fi connection that uses security.</entry></row>
     <row><entry align="left" id="nm-settings.property.802-11-wireless-security.leap-password">leap-password</entry><entry align="left">string</entry><entry align="left"/><entry>The login password for legacy LEAP connections (ie, key-mgmt = "ieee8021x" and auth-alg = "leap").</entry></row>
     <row><entry align="left" id="nm-settings.property.802-11-wireless-security.leap-password-flags">leap-password-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "leap-password" property. (see <xref linkend="secrets-flags"/> for flag values)</entry></row>
     <row><entry align="left" id="nm-settings.property.802-11-wireless-security.leap-username">leap-username</entry><entry align="left">string</entry><entry align="left"/><entry>The login username for legacy LEAP connections (ie, key-mgmt = "ieee8021x" and auth-alg = "leap").</entry></row>
     <row><entry align="left" id="nm-settings.property.802-11-wireless-security.pairwise">pairwise</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>A list of pairwise encryption algorithms which prevents connections to Wi-Fi networks that do not utilize one of the algorithms in the list. For maximum compatibility leave this property empty.  Each list element may be one of "tkip" or "ccmp".</entry></row>
     <row><entry align="left" id="nm-settings.property.802-11-wireless-security.pmf">pmf</entry><entry align="left">int32</entry><entry align="left">0</entry><entry>Indicates whether Protected Management Frames (802.11w) must be enabled for the connection.  One of NM_SETTING_WIRELESS_SECURITY_PMF_DEFAULT (0) (use global default value), NM_SETTING_WIRELESS_SECURITY_PMF_DISABLE (1) (disable PMF), NM_SETTING_WIRELESS_SECURITY_PMF_OPTIONAL (2) (enable PMF if the supplicant and the access point support it) or NM_SETTING_WIRELESS_SECURITY_PMF_REQUIRED (3) (enable PMF and fail if not supported).  When set to NM_SETTING_WIRELESS_SECURITY_PMF_DEFAULT (0) and no global default is set, PMF will be optionally enabled.</entry></row>
     <row><entry align="left" id="nm-settings.property.802-11-wireless-security.proto">proto</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>List of strings specifying the allowed WPA protocol versions to use. Each element may be one "wpa" (allow WPA) or "rsn" (allow WPA2/RSN).  If not specified, both WPA and RSN connections are allowed.</entry></row>
-    <row><entry align="left" id="nm-settings.property.802-11-wireless-security.psk">psk</entry><entry align="left">string</entry><entry align="left"/><entry>Pre-Shared-Key for WPA networks.  If the key is 64-characters long, it must contain only hexadecimal characters and is interpreted as a hexadecimal WPA key.  Otherwise, the key must be between 8 and 63 ASCII characters (as specified in the 802.11i standard) and is interpreted as a WPA passphrase, and is hashed to derive the actual WPA-PSK used when connecting to the Wi-Fi network.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-11-wireless-security.psk">psk</entry><entry align="left">string</entry><entry align="left"/><entry>Pre-Shared-Key for WPA networks. For WPA-PSK, it's either an ASCII passphrase of 8 to 63 characters that is (as specified in the 802.11i standard) hashed to derive the actual key, or the key in form of 64 hexadecimal character. The WPA3-Personal networks use a passphrase of any length for SAE authentication.</entry></row>
     <row><entry align="left" id="nm-settings.property.802-11-wireless-security.psk-flags">psk-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "psk" property. (see <xref linkend="secrets-flags"/> for flag values)</entry></row>
     <row><entry align="left" id="nm-settings.property.802-11-wireless-security.wep-key-flags">wep-key-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "wep-key0", "wep-key1", "wep-key2", and "wep-key3" properties. (see <xref linkend="secrets-flags"/> for flag values)</entry></row>
     <row><entry align="left" id="nm-settings.property.802-11-wireless-security.wep-key-type">wep-key-type</entry><entry align="left">NMWepKeyType (uint32)</entry><entry align="left"/><entry>Controls the interpretation of WEP keys.  Allowed values are NM_WEP_KEY_TYPE_KEY (1), in which case the key is either a 10- or 26-character hexadecimal string, or a 5- or 13-character ASCII password; or NM_WEP_KEY_TYPE_PASSPHRASE (2), in which case the passphrase is provided as a string and will be hashed using the de-facto MD5 method to derive the actual WEP key.</entry></row>
@@ -490,7 +504,9 @@
     <row><entry align="left" id="nm-settings.property.802-11-wireless-security.wps-method">wps-method</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>Flags indicating which mode of WPS is to be used if any. There's little point in changing the default setting as NetworkManager will automatically determine whether it's feasible to start WPS enrollment from the Access Point capabilities. WPS can be disabled by setting this property to a value of 1.</entry></row>
   </tbody></tgroup></informaltable></refsect2>
   <refsect2><title>wpan setting</title><para>IEEE 802.15.4 (WPAN) MAC Settings.</para><informaltable><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
+    <row><entry align="left" id="nm-settings.property.wpan.channel">channel</entry><entry align="left">int32</entry><entry align="left">-1</entry><entry>IEEE 802.15.4 channel. A positive integer or -1, meaning "do not set, use whatever the device is already set to".</entry></row>
     <row><entry align="left" id="nm-settings.property.wpan.mac-address">mac-address</entry><entry align="left">string</entry><entry align="left"/><entry>If specified, this connection will only apply to the IEEE 802.15.4 (WPAN) MAC layer device whose permanent MAC address matches.</entry></row>
+    <row><entry align="left" id="nm-settings.property.wpan.page">page</entry><entry align="left">int32</entry><entry align="left">-1</entry><entry>IEEE 802.15.4 channel page. A positive integer or -1, meaning "do not set, use whatever the device is already set to".</entry></row>
     <row><entry align="left" id="nm-settings.property.wpan.pan-id">pan-id</entry><entry align="left">uint32</entry><entry align="left">65535</entry><entry>IEEE 802.15.4 Personal Area Network (PAN) identifier.</entry></row>
     <row><entry align="left" id="nm-settings.property.wpan.short-address">short-address</entry><entry align="left">uint32</entry><entry align="left">65535</entry><entry>Short IEEE 802.15.4 address to be used within a restricted environment.</entry></row>
   </tbody></tgroup></informaltable></refsect2>
diff --git a/man/nmcli-examples.7 b/man/nmcli-examples.7
index 0bdbc359..202d3906 100644
--- a/man/nmcli-examples.7
+++ b/man/nmcli-examples.7
@@ -2,12 +2,12 @@
 .\"     Title: nmcli-examples
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
-.\"      Date: 02/23/2019
+.\"      Date: 03/15/2019
 .\"    Manual: Examples
-.\"    Source: NetworkManager 1.14.6
+.\"    Source: NetworkManager 1.16.0
 .\"  Language: English
 .\"
-.TH "NMCLI\-EXAMPLES" "7" "" "NetworkManager 1\&.14\&.6" "Examples"
+.TH "NMCLI\-EXAMPLES" "7" "" "NetworkManager 1\&.16\&.0" "Examples"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -200,7 +200,25 @@ The first command makes NetworkManager log in DEBUG level, and only for CORE, ET
 \fBNetworkManager.conf\fR(5)
 manual page for available logging levels and domains\&.
 .PP
-\fBExample\ \&6.\ \&Adding a bonding master and two slave connection profiles\fR
+\fBExample\ \&6.\ \&Activating a VPN connection profile requiring interactive password input\fR
+.sp
+.if n \{\
+.RS 4
+.\}
+.nf
+$ \fBnmcli \-\-ask con up my\-vpn\-con\fR
+.fi
+.if n \{\
+.RE
+.\}
+.PP
+This command activates a VPN connection profile enabling nmcli to interact with the user (\*(Aq\-\-ask\*(Aq): this will allow nmcli to prompt for the VPN password on the command line when the
+\fIpassword\-flags\fR
+are set to \*(Aq0x02\*(Aq (\*(Aqalways ask\*(Aq, see
+\fBnm-settings\fR(5)
+)\&. This is particularly useful for OTP based VPNs, as the user needs to be prompted for the password each time the connection is activated\&.
+.PP
+\fBExample\ \&7.\ \&Adding a bonding master and two slave connection profiles\fR
 .sp
 .if n \{\
 .RS 4
@@ -224,7 +242,7 @@ mode\&. The next two commands add slaves connections, both enslaved to
 interface, the second to
 \fIeth2\fR\&.
 .PP
-\fBExample\ \&7.\ \&Adding a team master and two slave connection profiles\fR
+\fBExample\ \&8.\ \&Adding a team master and two slave connection profiles\fR
 .sp
 .if n \{\
 .RS 4
@@ -266,7 +284,7 @@ will use its default configuration\&. You will activate the whole setup by activ
 .sp
 By default, the created profiles are marked for auto\-activation\&. But if another connection has been activated on the device, the new profile won\*(Aqt activate automatically and you need to activate it manually\&.
 .PP
-\fBExample\ \&8.\ \&Adding a bridge and two slave profiles\fR
+\fBExample\ \&9.\ \&Adding a bridge and two slave profiles\fR
 .sp
 .if n \{\
 .RS 4
@@ -288,7 +306,7 @@ This example demonstrates adding a bridge master connection and two slaves\&. Th
 interface, the second to
 \fIens4\fR\&. The last command will disable 802\&.1D STP for the TowerBridge profile\&.
 .PP
-\fBExample\ \&9.\ \&Adding an ethernet connection profile with manual IP configuration\fR
+\fBExample\ \&10.\ \&Adding an ethernet connection profile with manual IP configuration\fR
 .sp
 .if n \{\
 .RS 4
@@ -312,7 +330,7 @@ that is bound to interface name
 \fIcon show\fR
 command displays the profile so that all parameters can be reviewed\&.
 .PP
-\fBExample\ \&10.\ \&Convenient field values retrieval for scripting\fR
+\fBExample\ \&11.\ \&Convenient field values retrieval for scripting\fR
 .sp
 .if n \{\
 .RS 4
@@ -352,7 +370,7 @@ This example shows retrieval of ip4 connection field values via the \-\-get\-val
 \fBnmcli\fR(1)
 manual page for more customized output\&.
 .PP
-\fBExample\ \&11.\ \&Adding an Ethernet connection and configuring SR\-IOV VFs\fR
+\fBExample\ \&12.\ \&Adding an Ethernet connection and configuring SR\-IOV VFs\fR
 .sp
 .if n \{\
 .RS 4
@@ -375,7 +393,7 @@ and
 \fIspoof\-check\fR
 features respectively enabled and disabled\&. VF number 2 has a maximux transmission rate of 20Mbps\&. The kernel is instructed to not automatically instantiate a network interface for the VFs\&.
 .PP
-\fBExample\ \&12.\ \&Escaping colon characters in tabular mode\fR
+\fBExample\ \&13.\ \&Escaping colon characters in tabular mode\fR
 .sp
 .if n \{\
 .RS 4
@@ -394,7 +412,7 @@ nager/ActiveConnection/9
 .PP
 This example shows escaping colon characters in tabular mode\&. It may be useful for script processing, because \*(Aq:\*(Aq is used as a field separator\&.
 .PP
-\fBExample\ \&13.\ \&nmcli usage in a NetworkManager dispatcher script to make Ethernet and Wi\-Fi mutually exclusive\fR
+\fBExample\ \&14.\ \&nmcli usage in a NetworkManager dispatcher script to make Ethernet and Wi\-Fi mutually exclusive\fR
 .sp
 .if n \{\
 .RS 4
@@ -432,7 +450,7 @@ manual page for more information about NetworkManager dispatcher scripts\&.
 .PP
 \fBExample sessions of interactive connection editor\fR
 .PP
-\fBExample\ \&14.\ \&Adding an ethernet connection profile in interactive editor (a)\fR
+\fBExample\ \&15.\ \&Adding an ethernet connection profile in interactive editor (a)\fR
 .sp
 .if n \{\
 .RS 4
diff --git a/man/nmcli-examples.xml b/man/nmcli-examples.xml
index 8be3903a..e777c326 100644
--- a/man/nmcli-examples.xml
+++ b/man/nmcli-examples.xml
@@ -178,6 +178,19 @@ B,DISPATCH</screen>
       </para>
     </example>
 
+    <example><title>Activating a VPN connection profile requiring interactive password input</title>
+<screen><prompt>$ </prompt><userinput>nmcli --ask con up my-vpn-con</userinput></screen>
+      <para>
+        This command activates a VPN connection profile enabling nmcli to interact with the user
+        ('--ask'): this will allow nmcli to prompt for the VPN password on the command line when
+        the <emphasis>password-flags</emphasis> are set to '0x02' ('always ask', see
+        <link linkend='nm-settings'><citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum></citerefentry></link>
+        ).
+        This is particularly useful for OTP based VPNs, as the user needs to be prompted for the
+        password each time the connection is activated.
+      </para>
+    </example>
+
     <example><title>Adding a bonding master and two slave connection profiles</title>
 <screen><prompt>$ </prompt><userinput>nmcli con add type bond ifname mybond0 mode active-backup</userinput>
 <prompt>$ </prompt><userinput>nmcli con add type ethernet ifname eth1 master mybond0</userinput>
diff --git a/man/nmcli.1 b/man/nmcli.1
index 00ab979b..e16e5c16 100644
--- a/man/nmcli.1
+++ b/man/nmcli.1
@@ -2,12 +2,12 @@
 .\"     Title: nmcli
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
-.\"      Date: 02/23/2019
+.\"      Date: 03/15/2019
 .\"    Manual: General Commands Manual
-.\"    Source: NetworkManager 1.14.6
+.\"    Source: NetworkManager 1.16.0
 .\"  Language: English
 .\"
-.TH "NMCLI" "1" "" "NetworkManager 1\&.14\&.6" "General Commands Manual"
+.TH "NMCLI" "1" "" "NetworkManager 1\&.16\&.0" "General Commands Manual"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -39,7 +39,9 @@ is a command\-line tool for controlling NetworkManager and reporting network sta
 \fBnm\-applet\fR
 or other graphical clients\&.
 \fBnmcli\fR
-is used to create, display, edit, delete, activate, and deactivate network connections, as well as control and display network device status\&.
+is used to create, display, edit, delete, activate, and deactivate network connections, as well as control and display network device status\&. See
+\fBnmcli-examples\fR(7)
+for ready to run nmcli examples\&.
 .PP
 Typical uses include:
 .sp
@@ -74,16 +76,83 @@ can be used to control NetworkManager without a GUI, including creating, editing
 .RE
 .SH "OPTIONS"
 .PP
-\fB\-t\fR | \fB\-\-terse\fR
+\fB\-a\fR | \fB\-\-ask\fR
 .RS 4
-Output is terse\&. This mode is designed and suitable for computer (script) processing\&.
+When using this option
+\fBnmcli\fR
+will stop and ask for any missing required arguments, so do not use this option for non\-interactive purposes like scripts\&. This option controls, for example, whether you will be prompted for a password if it is required for connecting to a network\&.
 .RE
 .PP
-\fB\-p\fR | \fB\-\-pretty\fR
+\fB\-c\fR | \fB\-\-colors\fR {yes | no | auto}
 .RS 4
-Output is pretty\&. This causes
+This option controls color output (using terminal escape sequences)\&.
+yes
+enables colors,
+no
+disables them,
+auto
+only produces colors when standard output is directed to a terminal\&. The default value is
+auto\&.
+.sp
+The actual colors used are configured as described in
+\fBterminal-colors.d\fR(5)\&. Please refer to the
+COLORS
+section for a list of color names supported by
+\fBnmcli\fR\&.
+.RE
+.PP
+\fB\-\-complete\-args\fR
+.RS 4
+Instead of conducting the desired action,
 \fBnmcli\fR
-to produce easily readable outputs for humans, i\&.e\&. values are aligned, headers are printed, etc\&.
+will list possible completions for the last argument\&. This is useful to implement argument completion in shell\&.
+.sp
+The
+exit status
+will indicate success or return a code 65 to indicate the last argument is a file name\&.
+.sp
+NetworkManager ships with command completion support for GNU Bash\&.
+.RE
+.PP
+\fB\-e\fR | \fB\-\-escape\fR {yes | no}
+.RS 4
+Whether to escape
+:
+and
+\e
+characters in terse tabular mode\&. The escape character is
+\e\&.
+.sp
+If omitted, default is
+yes\&.
+.RE
+.PP
+\fB\-f\fR | \fB\-\-fields\fR {\fIfield1\fR,\fIfield2\fR... | all | common}
+.RS 4
+This option is used to specify what fields (column names) should be printed\&. Valid field names differ for specific commands\&. List available fields by providing an invalid value to the
+\fB\-\-fields\fR
+option\&.
+all
+is used to print all valid field values of the command\&.
+common
+is used to print common field values of the command\&.
+.sp
+If omitted, default is
+common\&.
+.RE
+.PP
+\fB\-g\fR | \fB\-\-get\-values\fR {\fIfield1\fR,\fIfield2\fR... | all | common}
+.RS 4
+This option is used to print values from specific fields\&. It is basically a shortcut for
+\-\-mode tabular \-\-terse \-\-fields
+and is a convenient way to retrieve values for particular fields\&. The values are printed one per line without headers\&.
+.sp
+If a section is specified instead of a field, the section name will be printed followed by colon separated values of the fields belonging to that section, all on the same line\&.
+.RE
+.PP
+\fB\-h\fR | \fB\-\-help\fR
+.RS 4
+Print help information\&.
 .RE
 .PP
 \fB\-m\fR | \fB\-\-mode\fR {tabular | multiline}
@@ -128,72 +197,30 @@ nmcli device show
 .RE
 .RE
 .PP
-\fB\-c\fR | \fB\-\-colors\fR {yes | no | auto}
-.RS 4
-This option controls color output (using terminal escape sequences)\&.
-yes
-enables colors,
-no
-disables them,
-auto
-only produces colors when standard output is directed to a terminal\&. The default value is
-auto\&.
-.sp
-The actual colors used are configured as described in
-\fBterminal-colors.d\fR(5)\&. Please refer to the
-COLORS
-section for a list of color names supported by
-\fBnmcli\fR\&.
-.RE
-.PP
-\fB\-f\fR | \fB\-\-fields\fR {\fIfield1\fR,\fIfield2\fR... | all | common}
-.RS 4
-This option is used to specify what fields (column names) should be printed\&. Valid field names differ for specific commands\&. List available fields by providing an invalid value to the
-\fB\-\-fields\fR
-option\&.
-all
-is used to print all valid field values of the command\&.
-common
-is used to print common field values of the command\&.
-.sp
-If omitted, default is
-common\&.
-.RE
-.PP
-\fB\-g\fR | \fB\-\-get\-values\fR {\fIfield1\fR,\fIfield2\fR... | all | common}
+\fB\-p\fR | \fB\-\-pretty\fR
 .RS 4
-This option is used to print values from specific fields\&. It is basically a shortcut for
-\-\-mode tabular \-\-terse \-\-fields
-and is a convenient way to retrieve values for particular fields\&. The values are printed one per line without headers\&.
-.sp
-If a section is specified instead of a field, the section name will be printed followed by colon separated values of the fields belonging to that section, all on the same line\&.
+Output is pretty\&. This causes
+\fBnmcli\fR
+to produce easily readable outputs for humans, i\&.e\&. values are aligned, headers are printed, etc\&.
 .RE
 .PP
-\fB\-e\fR | \fB\-\-escape\fR {yes | no}
+\fB\-s\fR | \fB\-\-show\-secrets\fR
 .RS 4
-Whether to escape
-:
-and
-\e
-characters in terse tabular mode\&. The escape character is
-\e\&.
-.sp
-If omitted, default is
-yes\&.
+When using this option
+\fBnmcli\fR
+will display passwords and secrets that might be present in an output of an operation\&. This option also influences echoing passwords typed by user as an input\&.
 .RE
 .PP
-\fB\-a\fR | \fB\-\-ask\fR
+\fB\-t\fR | \fB\-\-terse\fR
 .RS 4
-When using this option
-\fBnmcli\fR
-will stop and ask for any missing required arguments, so do not use this option for non\-interactive purposes like scripts\&. This option controls, for example, whether you will be prompted for a password if it is required for connecting to a network\&.
+Output is terse\&. This mode is designed and suitable for computer (script) processing\&.
 .RE
 .PP
-\fB\-s\fR | \fB\-\-show\-secrets\fR
+\fB\-v\fR | \fB\-\-version\fR
 .RS 4
-When using this option
+Show
 \fBnmcli\fR
-will display passwords and secrets that might be present in an output of an operation\&. This option also influences echoing passwords typed by user as an input\&.
+version\&.
 .RE
 .PP
 \fB\-w\fR | \fB\-\-wait\fR \fIseconds\fR
@@ -208,31 +235,6 @@ instructs
 \fBnmcli\fR
 not to wait but to exit immediately with a status of success\&. The default value depends on the executed command\&.
 .RE
-.PP
-\fB\-\-complete\-args\fR
-.RS 4
-Instead of conducting the desired action,
-\fBnmcli\fR
-will list possible completions for the last argument\&. This is useful to implement argument completion in shell\&.
-.sp
-The
-exit status
-will indicate success or return a code 65 to indicate the last argument is a file name\&.
-.sp
-NetworkManager ships with command completion support for GNU Bash\&.
-.RE
-.PP
-\fB\-v\fR | \fB\-\-version\fR
-.RS 4
-Show
-\fBnmcli\fR
-version\&.
-.RE
-.PP
-\fB\-h\fR | \fB\-\-help\fR
-.RS 4
-Print help information\&.
-.RE
 .SH "GENERAL COMMANDS"
 .HP \w'\fBnmcli\ general\fR\ 'u
 \fBnmcli general\fR {\fBstatus\fR | \fBhostname\fR | \fBpermissions\fR | \fBlogging\fR} [\fIARGUMENTS\fR...]
@@ -558,7 +560,7 @@ was not passed, NetworkManager can ask another secret agent that may be running
 .RS 4
 Deactivate a connection from a device without preventing the device from further auto\-activation\&. Multiple connections can be passed to the command\&.
 .sp
-Be aware that this command deactivates the specified active connection, but the device on which the connection was active, is still ready to connect and will perform auto\-activation by looking for a suitable connection that has the \*(Aqautoconnect\*(Aq flag set\&. This includes the just deactivated connection\&. So if the connection is set to auto\-connect, it will be automatically started on the disconnected device again\&.
+Be aware that this command deactivates the specified active connection, but the device on which the connection was active, is still ready to connect and will perform auto\-activation by looking for a suitable connection that has the \*(Aqautoconnect\*(Aq flag set\&. Note that the deactivating connection profile is internally blocked from autoconnecting again\&. Hence it will not autoconnect until reboot or until the user performs an action that unblocks autoconnect, like modifying the profile or explicitly activating it\&.
 .sp
 In most cases you may want to use
 \fBdevice disconnect\fR
@@ -1162,8 +1164,8 @@ can be used to either force or disable the scan regardless of how fresh the acce
 .PP
 \fBwifi\fR \fBconnect\fR \fI(B)SSID\fR [\fBpassword\fR\ \fIpassword\fR] [\fBwep\-key\-type\fR\ {key\ |\ phrase}] [\fBifname\fR\ \fIifname\fR] [\fBbssid\fR\ \fIBSSID\fR] [\fBname\fR\ \fIname\fR] [\fBprivate\fR\ {yes\ |\ no}] [\fBhidden\fR\ {yes\ |\ no}]
 .RS 4
-Connect to a Wi\-Fi network specified by SSID or BSSID\&. The command creates a new connection and then activates it on a device\&. This is a command\-line counterpart of clicking an SSID in a GUI client\&. The command always creates a new connection and thus it is mainly useful for connecting to new Wi\-Fi networks\&. If a connection for the network already exists, it is better to bring up (activate) the existing connection as follows:
-\fBnmcli con up id \fR\fB\fIname\fR\fR\&. Note that only open, WEP and WPA\-PSK networks are supported at the moment\&. It is also supposed that IP configuration is obtained via DHCP\&.
+Connect to a Wi\-Fi network specified by SSID or BSSID\&. The command finds a matching connection or creates one and then activates it on a device\&. This is a command\-line counterpart of clicking an SSID in a GUI client\&. If a connection for the network already exists, it is possible to bring up (activate) the existing profile as follows:
+\fBnmcli con up id \fR\fB\fIname\fR\fR\&. Note that only open, WEP and WPA\-PSK networks are supported if no previous connection exists\&. It is also assumed that IP configuration is obtained via DHCP\&.
 .sp
 If
 \fB\-\-wait\fR
@@ -2818,9 +2820,9 @@ shows all connection profile names and their auto\-connect property\&.
 shows details for "My default em1" connection profile\&.
 .RE
 .PP
-\fBnmcli \-\-show\-secrets connection show "My Home WiFi"\fR
+\fBnmcli \-\-show\-secrets connection show "My Home Wi\-Fi"\fR
 .RS 4
-shows details for "My Home WiFi" connection profile with all passwords\&. Without
+shows details for "My Home Wi\-Fi" connection profile with all passwords\&. Without
 \fB\-\-show\-secrets\fR
 option, secrets would not be displayed\&.
 .RE
diff --git a/man/nmcli.xml b/man/nmcli.xml
index 2a0765d0..3f123a57 100644
--- a/man/nmcli.xml
+++ b/man/nmcli.xml
@@ -68,7 +68,9 @@
     replacement for <command>nm-applet</command> or other graphical clients.
     <command>nmcli</command> is used to create, display, edit, delete, activate,
     and deactivate network connections, as well as control and display network
-    device status.</para>
+    device status. See
+    <link linkend='nmcli-examples'><citerefentry><refentrytitle>nmcli-examples</refentrytitle><manvolnum>7</manvolnum></citerefentry></link>
+    for ready to run nmcli examples.</para>
 
     <para>Typical uses include:</para>
     <itemizedlist>
@@ -95,98 +97,73 @@
 
       <varlistentry>
         <term><group choice='plain'>
-          <arg choice='plain'><option>-t</option></arg>
-          <arg choice='plain'><option>--terse</option></arg>
+          <arg choice='plain'><option>-a</option></arg>
+          <arg choice='plain'><option>--ask</option></arg>
         </group></term>
 
         <listitem>
-          <para>Output is terse. This mode is designed and suitable for computer (script)
-          processing.</para>
+          <para>When using this option <command>nmcli</command> will stop and ask for any
+          missing required arguments, so do not use this option for non-interactive
+          purposes like scripts. This option controls, for example, whether you will be
+          prompted for a password if it is required for connecting to a network.</para>
         </listitem>
       </varlistentry>
 
       <varlistentry>
         <term><group choice='plain'>
-          <arg choice='plain'><option>-p</option></arg>
-          <arg choice='plain'><option>--pretty</option></arg>
+          <arg choice='plain'><option>-c</option></arg>
+          <arg choice='plain'><option>--colors</option></arg>
+          <group choice='req'>
+            <arg choice='plain'>yes</arg>
+            <arg choice='plain'>no</arg>
+            <arg choice='plain'>auto</arg>
+          </group>
         </group></term>
 
         <listitem>
-          <para>Output is pretty. This causes <command>nmcli</command> to produce easily
-          readable outputs for humans, i.e. values are aligned, headers are printed,
-          etc.</para>
+          <para>This option controls color output (using terminal escape sequences).
+          <literal>yes</literal> enables colors, <literal>no</literal> disables them,
+          <literal>auto</literal> only produces colors when standard output is directed
+          to a terminal. The default value is <literal>auto</literal>.</para>
+          <para>The actual colors used are configured as described in
+          <citerefentry><refentrytitle>terminal-colors.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
+          Please refer to the <link linkend='colors' endterm='colors.title' /> section for a
+          list of color names supported by <command>nmcli</command>.</para>
         </listitem>
       </varlistentry>
 
       <varlistentry>
         <term><group choice='plain'>
-          <arg choice='plain'><option>-m</option></arg>
-          <arg choice='plain'><option>--mode</option></arg>
-          <group choice='req'>
-            <arg choice='plain'>tabular</arg>
-            <arg choice='plain'>multiline</arg>
-          </group>
+          <arg choice='plain'><option>--complete-args</option></arg>
         </group></term>
 
         <listitem>
-          <para>Switch between tabular and multiline output:</para>
-
-          <variablelist>
-            <varlistentry>
-              <term><arg choice='plain'>tabular</arg></term>
-              <listitem>
-                <para>Output is a table where each line describes a single entry.
-                Columns define particular properties of the entry.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><arg choice='plain'>multiline</arg></term>
-              <listitem>
-                <para>Each entry comprises multiple lines, each property on its
-                own line. The values are prefixed with the property name.</para>
-              </listitem>
-            </varlistentry>
-          </variablelist>
-
-          <para>If omitted, default is <literal>tabular</literal> for most commands.
-          For the commands producing more structured information, that cannot be
-          displayed on a single line, default is <literal>multiline</literal>.
-          Currently, they are:</para>
-
-          <itemizedlist>
-            <listitem>
-              <para><literal>nmcli connection show <replaceable>ID</replaceable></literal></para>
-            </listitem>
+          <para>Instead of conducting the desired action, <command>nmcli</command>
+          will list possible completions for the last argument. This is useful to implement
+          argument completion in shell.</para>
 
-            <listitem>
-              <para><literal>nmcli device show</literal></para>
-            </listitem>
-          </itemizedlist>
+          <para>The <link linkend='exit_status'>exit status</link> will indicate success
+          or return a code 65 to indicate the last argument is a file name.</para>
 
+          <para>NetworkManager ships with command completion support for GNU Bash.</para>
         </listitem>
       </varlistentry>
 
       <varlistentry>
         <term><group choice='plain'>
-          <arg choice='plain'><option>-c</option></arg>
-          <arg choice='plain'><option>--colors</option></arg>
+          <arg choice='plain'><option>-e</option></arg>
+          <arg choice='plain'><option>--escape</option></arg>
           <group choice='req'>
             <arg choice='plain'>yes</arg>
             <arg choice='plain'>no</arg>
-            <arg choice='plain'>auto</arg>
           </group>
         </group></term>
 
         <listitem>
-          <para>This option controls color output (using terminal escape sequences).
-          <literal>yes</literal> enables colors, <literal>no</literal> disables them,
-          <literal>auto</literal> only produces colors when standard output is directed
-          to a terminal. The default value is <literal>auto</literal>.</para>
-          <para>The actual colors used are configured as described in
-          <citerefentry><refentrytitle>terminal-colors.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
-          Please refer to the <link linkend='colors' endterm='colors.title' /> section for a
-          list of color names supported by <command>nmcli</command>.</para>
+          <para>Whether to escape <literal>:</literal> and <literal>\</literal> characters in terse tabular mode. The
+          escape character is <literal>\</literal>.</para>
+
+          <para>If omitted, default is <literal>yes</literal>.</para>
         </listitem>
       </varlistentry>
 
@@ -238,33 +215,74 @@
 
       <varlistentry>
         <term><group choice='plain'>
-          <arg choice='plain'><option>-e</option></arg>
-          <arg choice='plain'><option>--escape</option></arg>
+          <arg choice='plain'><option>-h</option></arg>
+          <arg choice='plain'><option>--help</option></arg>
+        </group></term>
+
+        <listitem>
+          <para>Print help information.</para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><group choice='plain'>
+          <arg choice='plain'><option>-m</option></arg>
+          <arg choice='plain'><option>--mode</option></arg>
           <group choice='req'>
-            <arg choice='plain'>yes</arg>
-            <arg choice='plain'>no</arg>
+            <arg choice='plain'>tabular</arg>
+            <arg choice='plain'>multiline</arg>
           </group>
         </group></term>
 
         <listitem>
-          <para>Whether to escape <literal>:</literal> and <literal>\</literal> characters in terse tabular mode. The
-          escape character is <literal>\</literal>.</para>
+          <para>Switch between tabular and multiline output:</para>
+
+          <variablelist>
+            <varlistentry>
+              <term><arg choice='plain'>tabular</arg></term>
+              <listitem>
+                <para>Output is a table where each line describes a single entry.
+                Columns define particular properties of the entry.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><arg choice='plain'>multiline</arg></term>
+              <listitem>
+                <para>Each entry comprises multiple lines, each property on its
+                own line. The values are prefixed with the property name.</para>
+              </listitem>
+            </varlistentry>
+          </variablelist>
+
+          <para>If omitted, default is <literal>tabular</literal> for most commands.
+          For the commands producing more structured information, that cannot be
+          displayed on a single line, default is <literal>multiline</literal>.
+          Currently, they are:</para>
+
+          <itemizedlist>
+            <listitem>
+              <para><literal>nmcli connection show <replaceable>ID</replaceable></literal></para>
+            </listitem>
+
+            <listitem>
+              <para><literal>nmcli device show</literal></para>
+            </listitem>
+          </itemizedlist>
 
-          <para>If omitted, default is <literal>yes</literal>.</para>
         </listitem>
       </varlistentry>
 
       <varlistentry>
         <term><group choice='plain'>
-          <arg choice='plain'><option>-a</option></arg>
-          <arg choice='plain'><option>--ask</option></arg>
+          <arg choice='plain'><option>-p</option></arg>
+          <arg choice='plain'><option>--pretty</option></arg>
         </group></term>
 
         <listitem>
-          <para>When using this option <command>nmcli</command> will stop and ask for any
-          missing required arguments, so do not use this option for non-interactive
-          purposes like scripts. This option controls, for example, whether you will be
-          prompted for a password if it is required for connecting to a network.</para>
+          <para>Output is pretty. This causes <command>nmcli</command> to produce easily
+          readable outputs for humans, i.e. values are aligned, headers are printed,
+          etc.</para>
         </listitem>
       </varlistentry>
 
@@ -283,37 +301,13 @@
 
       <varlistentry>
         <term><group choice='plain'>
-          <arg choice='plain'><option>-w</option></arg>
-          <arg choice='plain'><option>--wait</option></arg></group>
-          <arg choice='plain'><replaceable>seconds</replaceable></arg>
-        </term>
-
-        <listitem>
-          <para>This option sets a timeout period for which <command>nmcli</command> will
-          wait for NetworkManager to finish operations. It is
-          especially useful for commands that may take a longer time to complete, e.g.
-          connection activation.</para>
-
-          <para>Specifying a value of <literal>0</literal> instructs
-          <command>nmcli</command> not to wait but to exit immediately with a status of
-          success. The default value depends on the executed command.</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><group choice='plain'>
-          <arg choice='plain'><option>--complete-args</option></arg>
+          <arg choice='plain'><option>-t</option></arg>
+          <arg choice='plain'><option>--terse</option></arg>
         </group></term>
 
         <listitem>
-          <para>Instead of conducting the desired action, <command>nmcli</command>
-          will list possible completions for the last argument. This is useful to implement
-          argument completion in shell.</para>
-
-          <para>The <link linkend='exit_status'>exit status</link> will indicate success
-          or return a code 65 to indicate the last argument is a file name.</para>
-
-          <para>NetworkManager ships with command completion support for GNU Bash.</para>
+          <para>Output is terse. This mode is designed and suitable for computer (script)
+          processing.</para>
         </listitem>
       </varlistentry>
 
@@ -330,12 +324,20 @@
 
       <varlistentry>
         <term><group choice='plain'>
-          <arg choice='plain'><option>-h</option></arg>
-          <arg choice='plain'><option>--help</option></arg>
-        </group></term>
+          <arg choice='plain'><option>-w</option></arg>
+          <arg choice='plain'><option>--wait</option></arg></group>
+          <arg choice='plain'><replaceable>seconds</replaceable></arg>
+        </term>
 
         <listitem>
-          <para>Print help information.</para>
+          <para>This option sets a timeout period for which <command>nmcli</command> will
+          wait for NetworkManager to finish operations. It is
+          especially useful for commands that may take a longer time to complete, e.g.
+          connection activation.</para>
+
+          <para>Specifying a value of <literal>0</literal> instructs
+          <command>nmcli</command> not to wait but to exit immediately with a status of
+          success. The default value depends on the executed command.</para>
         </listitem>
       </varlistentry>
 
@@ -831,9 +833,10 @@
           <para>Be aware that this command deactivates the specified active connection,
           but the device on which the connection was active, is still ready to connect
           and will perform auto-activation by looking for a suitable connection that has
-          the 'autoconnect' flag set. This includes the just deactivated connection. So
-          if the connection is set to auto-connect, it will be automatically started on
-          the disconnected device again.</para>
+          the 'autoconnect' flag set. Note that the deactivating connection profile is
+          internally blocked from autoconnecting again. Hence it will not autoconnect
+          until reboot or until the user performs an action that unblocks autoconnect,
+          like modifying the profile or explicitly activating it.</para>
 
           <para>In most cases you may want to use <command>device disconnect</command>
           command instead.</para>
@@ -1442,14 +1445,13 @@
 
         <listitem>
           <para>Connect to a Wi-Fi network specified by SSID or BSSID. The command
-          creates a new connection and then activates it on a device. This is a
-          command-line counterpart of clicking an SSID in a GUI client. The command
-          always creates a new connection and thus it is mainly useful for connecting to
-          new Wi-Fi networks. If a connection for the network already exists, it is
-          better to bring up (activate) the existing connection as follows:
+          finds a matching connection or creates one and then activates it on a device.
+          This is a command-line counterpart of clicking an SSID in a GUI client. If
+          a connection for the network already exists, it is possible to bring up
+          (activate) the existing profile as follows:
           <command>nmcli con up id <replaceable>name</replaceable></command>. Note that
-          only open, WEP and WPA-PSK networks are supported at the moment. It is also
-          supposed that IP configuration is obtained via DHCP.</para>
+          only open, WEP and WPA-PSK networks are supported if no previous connection
+          exists. It is also assumed that IP configuration is obtained via DHCP.</para>
 
           <para>If <option>--wait</option> option is not specified, the default timeout will be 90
           seconds.</para>
@@ -2537,9 +2539,9 @@ It's equivalent to the <literal>+bond.options 'option=value'</literal> syntax.</
       </varlistentry>
 
       <varlistentry>
-        <term><userinput>nmcli --show-secrets connection show "My Home WiFi"</userinput></term>
+        <term><userinput>nmcli --show-secrets connection show "My Home Wi-Fi"</userinput></term>
         <listitem>
-          <para>shows details for "My Home WiFi" connection profile with all passwords.
+          <para>shows details for "My Home Wi-Fi" connection profile with all passwords.
           Without <option>--show-secrets</option> option, secrets would not be
           displayed.</para>
         </listitem>
diff --git a/man/nmtui.1 b/man/nmtui.1
index f87bc088..a5e9d072 100644
--- a/man/nmtui.1
+++ b/man/nmtui.1
@@ -2,12 +2,12 @@
 .\"     Title: nmtui
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
-.\"      Date: 02/23/2019
+.\"      Date: 03/15/2019
 .\"    Manual: General Commands Manual
-.\"    Source: NetworkManager 1.14.6
+.\"    Source: NetworkManager 1.16.0
 .\"  Language: English
 .\"
-.TH "NMTUI" "1" "" "NetworkManager 1\&.14\&.6" "General Commands Manual"
+.TH "NMTUI" "1" "" "NetworkManager 1\&.16\&.0" "General Commands Manual"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------