Imported Upstream version 1.4.0 upstream/1.4.0

22 files changed, 2720 insertions, 2296 deletions

diff --git a/man/Makefile.in b/man/Makefile.in
index b721527b..92bdb087 100644
--- a/man/Makefile.in
+++ b/man/Makefile.in
@@ -104,8 +104,9 @@ host_triplet = @host@
 
 subdir = man
 ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
-am__aclocal_m4_deps = $(top_srcdir)/m4/ax_lib_readline.m4 \
-	$(top_srcdir)/m4/compiler_warnings.m4 \
+am__aclocal_m4_deps = $(top_srcdir)/m4/attributes.m4 \
+	$(top_srcdir)/m4/ax_lib_readline.m4 \
+	$(top_srcdir)/m4/compiler_options.m4 \
 	$(top_srcdir)/m4/gettext.m4 \
 	$(top_srcdir)/m4/gnome-code-coverage.m4 \
 	$(top_srcdir)/m4/gtk-doc.m4 $(top_srcdir)/m4/iconv.m4 \
@@ -215,6 +216,7 @@ DHCLIENT_PATH = @DHCLIENT_PATH@
 DHCPCD_PATH = @DHCPCD_PATH@
 DISTRO_NETWORK_SERVICE = @DISTRO_NETWORK_SERVICE@
 DLLTOOL = @DLLTOOL@
+DL_LIBS = @DL_LIBS@
 DNSMASQ_PATH = @DNSMASQ_PATH@
 DNSSEC_TRIGGER_SCRIPT = @DNSSEC_TRIGGER_SCRIPT@
 DSYMUTIL = @DSYMUTIL@
@@ -271,13 +273,14 @@ INTROSPECTION_MAKEFILE = @INTROSPECTION_MAKEFILE@
 INTROSPECTION_SCANNER = @INTROSPECTION_SCANNER@
 INTROSPECTION_TYPELIBDIR = @INTROSPECTION_TYPELIBDIR@
 IPTABLES_PATH = @IPTABLES_PATH@
+JANSSON_CFLAGS = @JANSSON_CFLAGS@
+JANSSON_LIBS = @JANSSON_LIBS@
 KERNEL_FIRMWARE_DIR = @KERNEL_FIRMWARE_DIR@
 LCOV = @LCOV@
 LD = @LD@
 LDFLAGS = @LDFLAGS@
 LIBAUDIT_CFLAGS = @LIBAUDIT_CFLAGS@
 LIBAUDIT_LIBS = @LIBAUDIT_LIBS@
-LIBDL = @LIBDL@
 LIBICONV = @LIBICONV@
 LIBINTL = @LIBINTL@
 LIBM = @LIBM@
@@ -289,6 +292,8 @@ LIBOBJS = @LIBOBJS@
 LIBS = @LIBS@
 LIBSOUP_CFLAGS = @LIBSOUP_CFLAGS@
 LIBSOUP_LIBS = @LIBSOUP_LIBS@
+LIBSYSTEMD_CFLAGS = @LIBSYSTEMD_CFLAGS@
+LIBSYSTEMD_LIBS = @LIBSYSTEMD_LIBS@
 LIBTEAMDCTL_CFLAGS = @LIBTEAMDCTL_CFLAGS@
 LIBTEAMDCTL_LIBS = @LIBTEAMDCTL_LIBS@
 LIBTOOL = @LIBTOOL@
@@ -349,6 +354,8 @@ QT_CFLAGS = @QT_CFLAGS@
 QT_LIBS = @QT_LIBS@
 RANLIB = @RANLIB@
 READLINE_LIBS = @READLINE_LIBS@
+SANITIZERS = @SANITIZERS@
+SANITIZER_ENV = @SANITIZER_ENV@
 SED = @SED@
 SELINUX_CFLAGS = @SELINUX_CFLAGS@
 SELINUX_LIBS = @SELINUX_LIBS@
@@ -384,6 +391,7 @@ ac_ct_AR = @ac_ct_AR@
 ac_ct_CC = @ac_ct_CC@
 ac_ct_CXX = @ac_ct_CXX@
 ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
+ac_ct_RANLIB = @ac_ct_RANLIB@
 am__include = @am__include@
 am__leading_dot = @am__leading_dot@
 am__quote = @am__quote@
diff --git a/man/NetworkManager.8 b/man/NetworkManager.8
index f4ba4fef..6af6a49e 100644
--- a/man/NetworkManager.8
+++ b/man/NetworkManager.8
@@ -2,12 +2,12 @@
 .\"     Title: NetworkManager
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
-.\"      Date: 08/03/2016
+.\"      Date: 08/24/2016
 .\"    Manual: Network management daemons
-.\"    Source: NetworkManager 1.2.4
+.\"    Source: NetworkManager 1.4.0
 .\"  Language: English
 .\"
-.TH "NETWORKMANAGER" "8" "" "NetworkManager 1\&.2\&.4" "Network management daemons"
+.TH "NETWORKMANAGER" "8" "" "NetworkManager 1\&.4\&.0" "Network management daemons"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -41,7 +41,9 @@ NetworkManager will execute scripts in the /etc/NetworkManager/dispatcher\&.d di
 .PP
 Each script receives two arguments, the first being the interface name of the device an operation just happened on, and second the action\&. For device actions, the interface is the name of the kernel interface suitable for IP configuration\&. Thus it is either VPN_IP_IFACE, DEVICE_IP_IFACE, or DEVICE_IFACE, as applicable\&. For the
 \fIhostname\fR
-action it is always "none"\&.
+and
+\fIconnectivity\-change\fR
+actions it is always "none"\&.
 .PP
 The actions are:
 .PP
@@ -100,6 +102,11 @@ The DHCPv4 lease has changed (renewed, rebound, etc)\&.
 The DHCPv6 lease has changed (renewed, rebound, etc)\&.
 .RE
 .PP
+\fIconnectivity\-change\fR
+.RS 4
+The network connectivity state has changed (no connectivity, went online, etc)\&.
+.RE
+.PP
 The environment contains more information about the interface and the connection\&. The following variables are available for the use in the dispatcher scripts:
 .PP
 \fICONNECTION_UUID\fR
@@ -183,6 +190,11 @@ If the connection used DHCP for address configuration, the received DHCP configu
 The same variables as for IPv4 are available for IPv6, but the prefixes are IP6_ and DHCP6_ instead\&.
 .RE
 .PP
+\fICONNECTIVITY_STATE\fR
+.RS 4
+The network connectivity state, which can take the values defined by the NMConnectivityState type, from the org\&.freedesktop\&.NetworkManager D\-Bus API: unknown, none, portal, limited or full\&. Note: this variable will only be set for connectivity\-change actions\&.
+.RE
+.PP
 In case of VPN, VPN_IP_IFACE is set, and IP4_*, IP6_* variables with VPN prefix are exported too, like VPN_IP4_ADDRESS_0, VPN_IP4_NUM_ADDRESSES\&.
 .PP
 Dispatcher scripts are run one at a time, but asynchronously from the main NetworkManager process, and will be killed if they run for too long\&. If your script might take arbitrarily long to complete, you should spawn a child process and have the parent return immediately\&. Scripts that are symbolic links pointing inside the /etc/NetworkManager/dispatcher\&.d/no\-wait\&.d/ directory are run immediately, without waiting for the termination of previous scripts, and in parallel\&. Also beware that once a script is queued, it will always be run, even if a later event renders it obsolete\&. (Eg, if an interface goes up, and then back down again quickly, it is possible that one or more "up" scripts will be run after the interface has gone down\&.)
@@ -307,4 +319,5 @@ to enable debug logging inside NetworkManager itself\&.
 \fBnm-online\fR(1),
 \fBnm-settings\fR(5),
 \fBnm-applet\fR(1),
-\fBnm-connection-editor\fR(1)\fBudev\fR(7)
+\fBnm-connection-editor\fR(1),
+\fBudev\fR(7)
diff --git a/man/NetworkManager.conf.5 b/man/NetworkManager.conf.5
index ca316a03..f1d3d75f 100644
--- a/man/NetworkManager.conf.5
+++ b/man/NetworkManager.conf.5
@@ -2,12 +2,12 @@
 .\"     Title: NetworkManager.conf
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
-.\"      Date: 08/03/2016
+.\"      Date: 08/24/2016
 .\"    Manual: Configuration
-.\"    Source: NetworkManager 1.2.4
+.\"    Source: NetworkManager 1.4.0
 .\"  Language: English
 .\"
-.TH "NETWORKMANAGER\&.CON" "5" "" "NetworkManager 1\&.2\&.4" "Configuration"
+.TH "NETWORKMANAGER\&.CON" "5" "" "NetworkManager 1\&.4\&.0" "Configuration"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -173,13 +173,10 @@ no\-auto\-default=*
 .PP
 \fIignore\-carrier\fR
 .RS 4
-Specify devices for which NetworkManager will (partially) ignore the carrier state\&. Normally, for device types that support carrier\-detect, such as Ethernet and InfiniBand, NetworkManager will only allow a connection to be activated on the device if carrier is present (ie, a cable is plugged in), and it will deactivate the device if carrier drops for more than a few seconds\&.
-.sp
-Listing a device here will allow activating connections on that device even when it does not have carrier, provided that the connection uses only statically\-configured IP addresses\&. Additionally, it will allow any active connection (whether static or dynamic) to remain active on the device when carrier is lost\&.
-.sp
-Note that the "carrier" property of NMDevices and device D\-Bus interfaces will still reflect the actual device state; it\*(Aqs just that NetworkManager will not make use of that information\&.
-.sp
-See
+This setting is deprecated for the per\-device setting
+ignore\-carrier
+which overwrites this setting if specified (See
+???)\&. Otherwise, it is a list of matches to specify for which device carrier should be ignored\&. See
 the section called \(lqDevice List Format\(rq
 for the syntax how to specify a device\&.
 .RE
@@ -214,7 +211,7 @@ to point to the local nameserver\&.
 unbound: NetworkManager will talk to unbound and dnssec\-triggerd, providing a "split DNS" configuration with DNSSEC support\&. The /etc/resolv\&.conf will be managed by dnssec\-trigger daemon\&.
 .sp
 none: NetworkManager will not modify resolv\&.conf\&. This implies
-\fIrc\-manager\fRunmanaged
+rc\-manager\ \&unmanaged
 .RE
 .PP
 \fIrc\-manager\fR
@@ -225,7 +222,11 @@ management mode\&. The default value depends on how NetworkManager was built, wh
 .sp
 symlink: NetworkManager will symlink
 /etc/resolv\&.conf
-to its private resolv\&.conf file in the runtime state directory\&.
+to its private resolv\&.conf file in the runtime state directory\&. If
+/etc/resolv\&.conf
+already is a symlink pointing to a different location, the file will not be modified\&. This allows the user to disable managing by pointing the link
+/etc/resolv\&.conf
+to somewhere else\&.
 .sp
 file: NetworkManager will write
 /etc/resolv\&.conf
@@ -236,7 +237,7 @@ resolvconf: NetworkManager will run resolvconf to update the DNS configuration\&
 netconfig: NetworkManager will run netconfig to update the DNS configuration\&.
 .sp
 unmanaged: don\*(Aqt touch
-resolv\&.conf\&.
+/etc/resolv\&.conf\&.
 .sp
 none: deprecated alias for
 symlink\&.
@@ -263,7 +264,7 @@ This key is deprecated and has no effect since the hostname is now stored in /et
 .PP
 \fIpath\fR
 .RS 4
-The location where keyfiles are read and stored\&. This defaults to "${prefix}/etc/NetworkManager/conf\&.d"\&.
+The location where keyfiles are read and stored\&. This defaults to "/etc/NetworkManager/conf\&.d"\&.
 .RE
 .PP
 \fIunmanaged\-devices\fR
@@ -330,7 +331,7 @@ TRACE\&. The ERR level logs only critical errors\&. WARN logs warnings that may
 .PP
 \fIdomains\fR
 .RS 4
-The following log domains are available: PLATFORM, RFKILL, ETHER, WIFI, BT, MB, DHCP4, DHCP6, PPP, WIFI_SCAN, IP4, IP6, AUTOIP4, DNS, VPN, SHARING, SUPPLICANT, AGENTS, SETTINGS, SUSPEND, CORE, DEVICE, OLPC, WIMAX, INFINIBAND, FIREWALL, ADSL, BOND, VLAN, BRIDGE, DBUS_PROPS, TEAM, CONCHECK, DCB, DISPATCH, AUDIT\&.
+The following log domains are available: PLATFORM, RFKILL, ETHER, WIFI, BT, MB, DHCP4, DHCP6, PPP, WIFI_SCAN, IP4, IP6, AUTOIP4, DNS, VPN, SHARING, SUPPLICANT, AGENTS, SETTINGS, SUSPEND, CORE, DEVICE, OLPC, WIMAX, INFINIBAND, FIREWALL, ADSL, BOND, VLAN, BRIDGE, DBUS_PROPS, TEAM, CONCHECK, DCB, DISPATCH, AUDIT, SYSTEMD, VPN_PLUGIN\&.
 .sp
 In addition, these special domains can be used: NONE, ALL, DEFAULT, DHCP, IP\&.
 .sp
@@ -449,6 +450,12 @@ DISPATCH    : Dispatcher scripts
 AUDIT       : Audit records
 .RE
 .RS 4
+SYSTEMD     : Messages from internal libsystemd
+.RE
+.RS 4
+VPN_PLUGIN  : logging messages from VPN plugins
+.RE
+.RS 4
  
 .RE
 .RS 4
@@ -472,6 +479,15 @@ IP          : shortcut for "IP4,IP6"
 .RS 4
 HW          : deprecated alias for "PLATFORM"
 .RE
+.PP
+In general, the logfile should not contain passwords or private data\&. However, you are always advised to check the file before posting it online or attaching to a bug report\&.
+VPN_PLUGIN
+is special as it might reveal private information of the VPN plugins with verbose levels\&. Therefore this domain will be excluded when setting
+ALL
+or
+DEFAULT
+to more verbose levels then
+INFO\&.
 .RE
 .PP
 \fIbackend\fR
@@ -517,6 +533,15 @@ for details)\&. A default value is only consulted if the corresponding per\-conn
 .RS 4
 .RE
 .PP
+\fIethernet\&.cloned\-mac\-address\fR
+.RS 4
+If left unspecified, it defaults to "permanent"\&.
+.RE
+.PP
+\fIethernet\&.generate\-mac\-address\-mask\fR
+.RS 4
+.RE
+.PP
 \fIethernet\&.wake\-on\-lan\fR
 .RS 4
 .RE
@@ -550,9 +575,19 @@ is unset, use the content of "/proc/sys/net/ipv6/conf/default/use_tempaddr" as l
 If left unspecified, default value of 60 seconds is used\&.
 .RE
 .PP
+\fIwifi\&.cloned\-mac\-address\fR
+.RS 4
+If left unspecified, it defaults to "permanent"\&.
+.RE
+.PP
+\fIwifi\&.generate\-mac\-address\-mask\fR
+.RS 4
+.RE
+.PP
 \fIwifi\&.mac\-address\-randomization\fR
 .RS 4
-If left unspecified, MAC address randomization is disabled\&.
+If left unspecified, MAC address randomization is disabled\&. This setting is deprecated for
+wifi\&.cloned\-mac\-address\&.
 .RE
 .PP
 \fIwifi\&.powersave\fR
@@ -623,6 +658,69 @@ property unspecified\&. That is, the search for the property would not continue
 or
 [connection]\&.
 .RE
+.SH "DEVICE SECTION"
+.PP
+Contains per\-device persistent configuration\&.
+.PP
+Example:
+.sp
+.if n \{\
+.RS 4
+.\}
+.nf
+[device]
+match\-device=interface\-name:eth3
+unmanaged=1
+.fi
+.if n \{\
+.RE
+.\}
+.sp
+.SS "Supported Properties"
+.PP
+The following properties can be configured per\-device\&.
+.PP
+\fIignore\-carrier\fR
+.RS 4
+Specify devices for which NetworkManager will (partially) ignore the carrier state\&. Normally, for device types that support carrier\-detect, such as Ethernet and InfiniBand, NetworkManager will only allow a connection to be activated on the device if carrier is present (ie, a cable is plugged in), and it will deactivate the device if carrier drops for more than a few seconds\&.
+.sp
+A device with carrier ignored will allow activating connections on that device even when it does not have carrier, provided that the connection uses only statically\-configured IP addresses\&. Additionally, it will allow any active connection (whether static or dynamic) to remain active on the device when carrier is lost\&.
+.sp
+Note that the "carrier" property of NMDevices and device D\-Bus interfaces will still reflect the actual device state; it\*(Aqs just that NetworkManager will not make use of that information\&.
+.sp
+This setting overwrites the deprecated
+main\&.ignore\-carrier
+setting above\&.
+.RE
+.PP
+\fIwifi\&.scan\-rand\-mac\-address\fR
+.RS 4
+Configures MAC address randomization of a Wi\-Fi device during scanning\&. This defaults to
+yes
+in which case a random, locally\-administered MAC address will be used\&. The setting
+wifi\&.scan\-generate\-mac\-address\-mask
+allows to influence the generated MAC address to use certain vendor OUIs\&. If disabled, the MAC address during scanning is left unchanged to whatever is configured\&. For the configured MAC address while the device is associated, see instead the per\-connection setting
+wifi\&.cloned\-mac\-address\&.
+.RE
+.PP
+\fIwifi\&.scan\-generate\-mac\-address\-mask\fR
+.RS 4
+Like the per\-connection settings
+ethernet\&.generate\-mac\-address\-mask
+and
+wifi\&.generate\-mac\-address\-mask, this allows to configure the generated MAC addresses during scanning\&. See
+\fBnm-settings\fR(5)
+for details\&.
+.RE
+.SS "Sections"
+.PP
+The
+[device]
+section works the same as the
+[connection]
+section\&. That is, multiple sections that all start with the prefix "device" can be specified\&. The settings "match\-device" and "stop\-match" are available to match a device section on a device\&. The order of multiple sections is also top\-down within the file and later files overwrite previous settings\&. See
+the section called \(lqSections\(rq
+for details\&.
 .SH "CONNECTIVITY SECTION"
 .PP
 This section controls NetworkManager\*(Aqs optional connectivity checking functionality\&. This allows NetworkManager to detect whether or not the system can actually access the internet or whether it is behind a captive portal\&.
@@ -828,8 +926,11 @@ or to change the plugin order\&.
 .PP
 The configuration options
 main\&.no\-auto\-default,
-main\&.ignore\-carrier, and
-keyfile\&.unmanaged\-devices
+main\&.ignore\-carrier,
+keyfile\&.unmanaged\-devices,
+connection*\&.match\-device
+and
+device*\&.match\-device
 select devices based on a list of matchings\&. Devices can be specified using the following format:
 .PP
 .PP
@@ -845,7 +946,7 @@ Case sensitive match of interface name of the device\&. Globbing is not supporte
 .PP
 HWADDR
 .RS 4
-Match the MAC address of the device\&. Globbing is not supported
+Match the permanent MAC address of the device\&. Globbing is not supported
 .RE
 .PP
 interface\-name:IFNAME, interface\-name:~IFNAME
@@ -865,7 +966,7 @@ is taken literally\&.
 .PP
 mac:HWADDR
 .RS 4
-Match the MAC address of the device\&. Globbing is not supported
+Match the permanent MAC address of the device\&. Globbing is not supported
 .RE
 .PP
 s390\-subchannels:HWADDR
diff --git a/man/NetworkManager.conf.xml b/man/NetworkManager.conf.xml
index ea0573fa..db381f07 100644
--- a/man/NetworkManager.conf.xml
+++ b/man/NetworkManager.conf.xml
@@ -224,30 +224,12 @@ no-auto-default=*
         <term><varname>ignore-carrier</varname></term>
         <listitem>
           <para>
-            Specify devices for which NetworkManager will (partially)
-            ignore the carrier state. Normally, for
-            device types that support carrier-detect, such as Ethernet
-            and InfiniBand, NetworkManager will only allow a
-            connection to be activated on the device if carrier is
-            present (ie, a cable is plugged in), and it will
-            deactivate the device if carrier drops for more than a few
-            seconds.
-          </para>
-          <para>
-            Listing a device here will allow activating connections on
-            that device even when it does not have carrier, provided
-            that the connection uses only statically-configured IP
-            addresses. Additionally, it will allow any active
-            connection (whether static or dynamic) to remain active on
-            the device when carrier is lost.
-          </para>
-          <para>
-            Note that the "carrier" property of NMDevices and device D-Bus
-            interfaces will still reflect the actual device state; it's just
-            that NetworkManager will not make use of that information.
-          </para>
-          <para>See <xref linkend="device-spec"/> for the syntax how to
-           specify a device.
+            This setting is deprecated for the per-device setting
+            <literal>ignore-carrier</literal> which overwrites this setting
+            if specified (See <xref linked="ignore-carrier"/>).
+            Otherwise, it is a list of matches to specify for which device
+            carrier should be ignored. See <xref linkend="device-spec"/> for the
+            syntax how to specify a device.
           </para>
         </listitem>
       </varlistentry>
@@ -307,8 +289,8 @@ no-auto-default=*
         configuration with DNSSEC support. The /etc/resolv.conf
         will be managed by dnssec-trigger daemon.</para>
         <para><literal>none</literal>: NetworkManager will not
-        modify resolv.conf. This implies <varname>rc-manager</varname>
-        <literal>unmanaged</literal></para>
+        modify resolv.conf. This implies
+        <literal>rc-manager</literal>&nbsp;<literal>unmanaged</literal></para>
         </listitem>
       </varlistentry>
 
@@ -322,7 +304,12 @@ no-auto-default=*
         always write resolv.conf to its runtime state directory.</para>
         <para><literal>symlink</literal>: NetworkManager will symlink
         <filename>/etc/resolv.conf</filename> to its private
-        resolv.conf file in the runtime state directory.</para>
+        resolv.conf file in the runtime state directory. If
+        <filename>/etc/resolv.conf</filename>
+        already is a symlink pointing to a different location, the file
+        will not be modified. This allows the user to disable managing
+        by pointing the link <filename>/etc/resolv.conf</filename> to
+        somewhere else.</para>
         <para><literal>file</literal>: NetworkManager will write
         <filename>/etc/resolv.conf</filename> as file. If it finds
         a symlink, it will follow the symlink and update the target
@@ -332,7 +319,7 @@ no-auto-default=*
         <para><literal>netconfig</literal>: NetworkManager will run
         netconfig to update the DNS configuration.</para>
         <para><literal>unmanaged</literal>: don't touch
-        <filename>resolv.conf</filename>.</para>
+        <filename>/etc/resolv.conf</filename>.</para>
         <para><literal>none</literal>: deprecated alias for
         <literal>symlink</literal>.</para>
         </listitem>
@@ -461,7 +448,7 @@ unmanaged-devices=mac:00:22:68:1c:59:b1;mac:00:1E:65:30:D1:C4;interface-name:eth
           WIFI_SCAN, IP4, IP6, AUTOIP4, DNS, VPN, SHARING, SUPPLICANT,
           AGENTS, SETTINGS, SUSPEND, CORE, DEVICE, OLPC, WIMAX,
           INFINIBAND, FIREWALL, ADSL, BOND, VLAN, BRIDGE, DBUS_PROPS,
-          TEAM, CONCHECK, DCB, DISPATCH, AUDIT.</para>
+          TEAM, CONCHECK, DCB, DISPATCH, AUDIT, SYSTEMD, VPN_PLUGIN.</para>
           <para>In addition, these special domains can be used: NONE,
           ALL, DEFAULT, DHCP, IP.</para>
           <para>You can specify per-domain log level overrides by
@@ -507,6 +494,8 @@ unmanaged-devices=mac:00:22:68:1c:59:b1;mac:00:1E:65:30:D1:C4;interface-name:eth
           <member>DCB         : Data Center Bridging (DCB) operations</member>
           <member>DISPATCH    : Dispatcher scripts</member>
           <member>AUDIT       : Audit records</member>
+          <member>SYSTEMD     : Messages from internal libsystemd</member>
+          <member>VPN_PLUGIN  : logging messages from VPN plugins</member>
           <member> </member>
           <member>NONE        : when given by itself logging is disabled</member>
           <member>ALL         : all log domains</member>
@@ -517,6 +506,14 @@ unmanaged-devices=mac:00:22:68:1c:59:b1;mac:00:1E:65:30:D1:C4;interface-name:eth
           <member>HW          : deprecated alias for "PLATFORM"</member>
           </simplelist>
           </para>
+          <para>
+          In general, the logfile should not contain passwords or private data. However,
+          you are always advised to check the file before posting it online or attaching
+          to a bug report. <literal>VPN_PLUGIN</literal> is special as it might reveal
+          private information of the VPN plugins with verbose levels. Therefore this domain
+          will be excluded when setting <literal>ALL</literal> or <literal>DEFAULT</literal>
+          to more verbose levels then <literal>INFO</literal>.
+          </para>
         </varlistentry>
         <varlistentry>
           <term><varname>backend</varname></term>
@@ -558,7 +555,7 @@ ipv6.ip6-privacy=0
     <para>
       Not all properties can be overwritten, only the following
       properties are supported to have their default values configured
-      (see <citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum></citerefentry> for details).
+      (see <link linkend='nm-settings'><citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum></citerefentry></link> for details).
       A default value is only consulted if the corresponding per-connection value
       explicitly allows for that.
       <variablelist>
@@ -569,6 +566,13 @@ ipv6.ip6-privacy=0
           <term><varname>connection.lldp</varname></term>
         </varlistentry>
         <varlistentry>
+          <term><varname>ethernet.cloned-mac-address</varname></term>
+          <listitem><para>If left unspecified, it defaults to "permanent".</para></listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><varname>ethernet.generate-mac-address-mask</varname></term>
+        </varlistentry>
+        <varlistentry>
           <term><varname>ethernet.wake-on-lan</varname></term>
         </varlistentry>
         <varlistentry>
@@ -596,8 +600,17 @@ ipv6.ip6-privacy=0
           <listitem><para>If left unspecified, default value of 60 seconds is used.</para></listitem>
         </varlistentry>
         <varlistentry>
+          <term><varname>wifi.cloned-mac-address</varname></term>
+          <listitem><para>If left unspecified, it defaults to "permanent".</para></listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><varname>wifi.generate-mac-address-mask</varname></term>
+        </varlistentry>
+        <varlistentry>
           <term><varname>wifi.mac-address-randomization</varname></term>
-          <listitem><para>If left unspecified, MAC address randomization is disabled.</para></listitem>
+          <listitem><para>If left unspecified, MAC address randomization is disabled.
+            This setting is deprecated for <literal>wifi.cloned-mac-address</literal>.
+          </para></listitem>
         </varlistentry>
         <varlistentry>
           <term><varname>wifi.powersave</varname></term>
@@ -608,7 +621,7 @@ ipv6.ip6-privacy=0
     </para>
     </refsect2>
 
-    <refsect2>
+    <refsect2 id="connection-sections">
     <title>Sections</title>
     <para>
         You can configure multiple <literal>connection</literal>
@@ -682,6 +695,100 @@ ipv6.ip6-privacy=1
   </refsect1>
 
   <refsect1>
+    <title><literal>device</literal> section</title>
+    <para>Contains per-device persistent configuration.
+    </para>
+    <para>
+      Example:
+<programlisting>
+[device]
+match-device=interface-name:eth3
+unmanaged=1
+</programlisting>
+    </para>
+    <refsect2>
+    <title>Supported Properties</title>
+    <para>
+      The following properties can be configured per-device.
+      <variablelist>
+        <varlistentry id="ignore-carrier">
+          <term><varname>ignore-carrier</varname></term>
+          <listitem>
+            <para>
+              Specify devices for which NetworkManager will (partially)
+              ignore the carrier state. Normally, for
+              device types that support carrier-detect, such as Ethernet
+              and InfiniBand, NetworkManager will only allow a
+              connection to be activated on the device if carrier is
+              present (ie, a cable is plugged in), and it will
+              deactivate the device if carrier drops for more than a few
+              seconds.
+            </para>
+            <para>
+              A device with carrier ignored will allow activating connections on
+              that device even when it does not have carrier, provided
+              that the connection uses only statically-configured IP
+              addresses. Additionally, it will allow any active
+              connection (whether static or dynamic) to remain active on
+              the device when carrier is lost.
+            </para>
+            <para>
+              Note that the "carrier" property of NMDevices and device D-Bus
+              interfaces will still reflect the actual device state; it's just
+              that NetworkManager will not make use of that information.
+            </para>
+            <para>
+              This setting overwrites the deprecated <literal>main.ignore-carrier</literal>
+              setting above.
+            </para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><varname>wifi.scan-rand-mac-address</varname></term>
+          <listitem>
+            <para>
+              Configures MAC address randomization of a Wi-Fi device during
+              scanning. This defaults to <literal>yes</literal> in which case
+              a random, locally-administered MAC address will be used.
+              The setting <literal>wifi.scan-generate-mac-address-mask</literal>
+              allows to influence the generated MAC address to use certain vendor
+              OUIs.
+              If disabled, the MAC address during scanning is left unchanged to
+              whatever is configured.
+              For the configured MAC address while the device is associated, see instead
+              the per-connection setting <literal>wifi.cloned-mac-address</literal>.
+            </para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><varname>wifi.scan-generate-mac-address-mask</varname></term>
+          <listitem>
+            <para>
+              Like the per-connection settings <literal>ethernet.generate-mac-address-mask</literal>
+              and <literal>wifi.generate-mac-address-mask</literal>, this allows to configure the
+              generated MAC addresses during scanning. See <citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+              for details.
+            </para>
+          </listitem>
+        </varlistentry>
+      </variablelist>
+    </para>
+    </refsect2>
+
+    <refsect2>
+    <title>Sections</title>
+    <para>
+        The <literal>[device]</literal> section works the same as the <literal>[connection]</literal> section.
+        That is, multiple sections that all start with the prefix "device" can be specified.
+        The settings "match-device" and "stop-match" are available to match a device section
+        on a device. The order of multiple sections is also top-down within the file and
+        later files overwrite previous settings. See <xref linkend="connection-sections"/>
+        for details.
+    </para>
+    </refsect2>
+  </refsect1>
+
+  <refsect1>
     <title><literal>connectivity</literal> section</title>
     <para>This section controls NetworkManager's optional connectivity
     checking functionality.  This allows NetworkManager to detect
@@ -963,7 +1070,8 @@ enable=nm-version-min:1.3,nm-version-min:1.2.6,nm-version-min:1.0.16
       <title>Device List Format</title>
       <para>
           The configuration options <literal>main.no-auto-default</literal>, <literal>main.ignore-carrier</literal>,
-          and <literal>keyfile.unmanaged-devices</literal> select devices based on a list of matchings.
+          <literal>keyfile.unmanaged-devices</literal>, <literal>connection*.match-device</literal> and
+          <literal>device*.match-device</literal> select devices based on a list of matchings.
           Devices can be specified using the following format:
       </para>
       <para>
@@ -978,7 +1086,7 @@ enable=nm-version-min:1.3,nm-version-min:1.2.6,nm-version-min:1.0.16
         </varlistentry>
         <varlistentry>
           <term>HWADDR</term>
-          <listitem><para>Match the MAC address of the device. Globbing is not supported</para></listitem>
+          <listitem><para>Match the permanent MAC address of the device. Globbing is not supported</para></listitem>
         </varlistentry>
         <varlistentry>
           <term>interface-name:IFNAME</term>
@@ -993,7 +1101,7 @@ enable=nm-version-min:1.3,nm-version-min:1.2.6,nm-version-min:1.0.16
         </varlistentry>
         <varlistentry>
           <term>mac:HWADDR</term>
-          <listitem><para>Match the MAC address of the device. Globbing is not supported</para></listitem>
+          <listitem><para>Match the permanent MAC address of the device. Globbing is not supported</para></listitem>
         </varlistentry>
         <varlistentry>
           <term>s390-subchannels:HWADDR</term>
@@ -1040,11 +1148,11 @@ interface-name:vboxnet*,except:interface-name:vboxnet2
   <refsect1>
     <title>See Also</title>
     <para>
-      <citerefentry><refentrytitle>NetworkManager</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
-      <citerefentry><refentrytitle>nmcli</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
-      <citerefentry><refentrytitle>nmcli-examples</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
-      <citerefentry><refentrytitle>nm-online</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
-      <citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
+      <link linkend='NetworkManager'><citerefentry><refentrytitle>NetworkManager</refentrytitle><manvolnum>8</manvolnum></citerefentry></link>,
+      <link linkend='nmcli'><citerefentry><refentrytitle>nmcli</refentrytitle><manvolnum>1</manvolnum></citerefentry></link>,
+      <link linkend='nmcli-examples'><citerefentry><refentrytitle>nmcli-examples</refentrytitle><manvolnum>7</manvolnum></citerefentry></link>,
+      <link linkend='nm-online'><citerefentry><refentrytitle>nm-online</refentrytitle><manvolnum>1</manvolnum></citerefentry></link>,
+      <link linkend='nm-settings'><citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum></citerefentry></link>,
       <citerefentry><refentrytitle>nm-applet</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
       <citerefentry><refentrytitle>nm-connection-editor</refentrytitle><manvolnum>1</manvolnum></citerefentry>
     </para>
diff --git a/man/NetworkManager.xml b/man/NetworkManager.xml
index 0714d002..2cb458a2 100644
--- a/man/NetworkManager.xml
+++ b/man/NetworkManager.xml
@@ -79,7 +79,8 @@
       device an operation just happened on, and second the action. For device actions,
       the interface is the name of the kernel interface suitable for IP configuration.
       Thus it is either VPN_IP_IFACE, DEVICE_IP_IFACE, or DEVICE_IFACE, as applicable.
-      For the <varname>hostname</varname> action it is always "none".
+      For the <varname>hostname</varname> and <varname>connectivity-change</varname>
+      actions it is always "none".
     </para>
     <para>The actions are:</para>
     <variablelist class="dispatcher-options">
@@ -168,6 +169,12 @@
           The DHCPv6 lease has changed (renewed, rebound, etc).
         </para></listitem>
       </varlistentry>
+      <varlistentry>
+        <term><varname>connectivity-change</varname></term>
+        <listitem><para>
+          The network connectivity state has changed (no connectivity, went online, etc).
+        </para></listitem>
+      </varlistentry>
     </variablelist>
     <para>
       The environment contains more information about the interface and the connection.
@@ -281,6 +288,15 @@
             and DHCP6_ instead.
           </para></listitem>
         </varlistentry>
+        <varlistentry>
+          <term><varname>CONNECTIVITY_STATE</varname></term>
+          <listitem><para> The network connectivity state, which can
+          take the values defined by the NMConnectivityState type,
+          from the org.freedesktop.NetworkManager D-Bus API: unknown,
+          none, portal, limited or full. Note: this variable will only
+          be set for connectivity-change actions.
+          </para></listitem>
+        </varlistentry>
       </variablelist>
     </para>
     <para>
@@ -348,7 +364,7 @@
         value of /etc/NetworkManager/NetworkManager.conf is used with
         a fallback to the older 'nm-system-settings.conf' if located
         in the same directory.  See
-        <citerefentry><refentrytitle>NetworkManager.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+        <link linkend='NetworkManager.conf'><citerefentry><refentrytitle>NetworkManager.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry></link>
         for more information on configuration file.
         </para></listitem>
       </varlistentry>
@@ -367,7 +383,7 @@
           Sets how much information NetworkManager sends to the log destination (usually
           syslog's "daemon" facility).  By default, only informational, warning, and error
           messages are logged. See the section on <literal>logging</literal> in
-          <citerefentry><refentrytitle>NetworkManager.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+          <link linkend='NetworkManager.conf'><citerefentry><refentrytitle>NetworkManager.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry></link>
           for more information.
         </para></listitem>
       </varlistentry>
@@ -377,7 +393,7 @@
           A comma-separated list specifying which operations are logged to the log
           destination (usually syslog). By default, most domains are logging-enabled.
           See the section on <literal>logging</literal> in
-          <citerefentry><refentrytitle>NetworkManager.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+          <link linkend='NetworkManager.conf'><citerefentry><refentrytitle>NetworkManager.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry></link>
           for more information.
         </para></listitem>
       </varlistentry>
@@ -490,13 +506,13 @@
   <refsect1>
     <title>See Also</title>
     <para>
-      <citerefentry><refentrytitle>NetworkManager.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
-      <citerefentry><refentrytitle>nmcli</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
-      <citerefentry><refentrytitle>nmcli-examples</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
-      <citerefentry><refentrytitle>nm-online</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
-      <citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
+      <link linkend='NetworkManager.conf'><citerefentry><refentrytitle>NetworkManager.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry></link>,
+      <link linkend='nmcli'><citerefentry><refentrytitle>nmcli</refentrytitle><manvolnum>1</manvolnum></citerefentry></link>,
+      <link linkend='nmcli-examples'><citerefentry><refentrytitle>nmcli-examples</refentrytitle><manvolnum>7</manvolnum></citerefentry></link>,
+      <link linkend='nm-online'><citerefentry><refentrytitle>nm-online</refentrytitle><manvolnum>1</manvolnum></citerefentry></link>,
+      <link linkend='nm-settings'><citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum></citerefentry></link>,
       <citerefentry><refentrytitle>nm-applet</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
-      <citerefentry><refentrytitle>nm-connection-editor</refentrytitle><manvolnum>1</manvolnum></citerefentry>
+      <citerefentry><refentrytitle>nm-connection-editor</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
       <citerefentry><refentrytitle>udev</refentrytitle><manvolnum>7</manvolnum></citerefentry>
     </para>
   </refsect1>
diff --git a/man/nm-online.1 b/man/nm-online.1
index 49f2f2c8..93c1d32c 100644
--- a/man/nm-online.1
+++ b/man/nm-online.1
@@ -2,12 +2,12 @@
 .\"     Title: nm-online
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
-.\"      Date: 08/03/2016
+.\"      Date: 08/24/2016
 .\"    Manual: General Commands Manual
-.\"    Source: NetworkManager 1.2.4
+.\"    Source: NetworkManager 1.4.0
 .\"  Language: English
 .\"
-.TH "NM\-ONLINE" "1" "" "NetworkManager 1\&.2\&.4" "General Commands Manual"
+.TH "NM\-ONLINE" "1" "" "NetworkManager 1\&.4\&.0" "General Commands Manual"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
diff --git a/man/nm-online.xml b/man/nm-online.xml
index 7fdd2f3e..297920dd 100644
--- a/man/nm-online.xml
+++ b/man/nm-online.xml
@@ -156,8 +156,8 @@
   </refsect1>
 
   <refsect1 id='see_also'><title>See Also</title>
-    <para><citerefentry><refentrytitle>nmcli</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
-    <citerefentry><refentrytitle>NetworkManager</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
+    <para><link linkend='nmcli'><citerefentry><refentrytitle>nmcli</refentrytitle><manvolnum>1</manvolnum></citerefentry></link>,
+    <link linkend='NetworkManager'><citerefentry><refentrytitle>NetworkManager</refentrytitle><manvolnum>8</manvolnum></citerefentry></link>.</para>
   </refsect1>
 
 </refentry>
diff --git a/man/nm-settings-ifcfg-rh.5 b/man/nm-settings-ifcfg-rh.5
index 3aa9eff8..7c022bcc 100644
--- a/man/nm-settings-ifcfg-rh.5
+++ b/man/nm-settings-ifcfg-rh.5
@@ -2,12 +2,12 @@
 .\"     Title: nm-settings-ifcfg-rh
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
-.\"      Date: 08/03/2016
+.\"      Date: 08/24/2016
 .\"    Manual: Configuration
-.\"    Source: NetworkManager 1.2.4
+.\"    Source: NetworkManager 1.4.0
 .\"  Language: English
 .\"
-.TH "NM\-SETTINGS\-IFCFG\" "5" "" "NetworkManager 1\&.2\&.4" "Configuration"
+.TH "NM\-SETTINGS\-IFCFG\" "5" "" "NetworkManager 1\&.4\&.0" "Configuration"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -308,6 +308,18 @@ for connection sharing\&. When
 \fIshared\fR
 is used, NetworkManager assigns the interface 10\&.42\&.0\&.1, or it uses the first static address, if configured\&.
 .RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+HWADDR
+\- initscripts compare the currently set hardware address of a device, while NetworkManager considers the permanent one\&.
+.RE
 .RE
 .PP
 See the next section for detailed mapping of NetworkManager properties and
@@ -932,6 +944,7 @@ l l l l
 l l l l
 l l l l
 l l l l
+l l l l
 l l l l.
 T{
 id
@@ -949,7 +962,16 @@ UUID\fI(+)\fR
 T}:T{
 \ \&
 T}:T{
-UUID for the connection profile\&. When missing, NetworkManager creates the UUID itself (by hashing the file)\&.
+UUID for the connection profile\&. When missing, NetworkManager creates the UUID itself (by hashing the filename)\&.
+T}
+T{
+stable\-id
+T}:T{
+STABLE_ID\fI(+)\fR
+T}:T{
+\ \&
+T}:T{
+Token to generate stable IDs\&.
 T}
 T{
 interface\-name
@@ -1421,6 +1443,7 @@ l l l l
 l l l l
 l l l l
 l l l l
+l l l l
 l l l l.
 T{
 method
@@ -1548,6 +1571,17 @@ T}:T{
 IPV4_ROUTE_METRIC is the default IPv4 metric for routes on this connection\&. If set to \-1, a default metric based on the device type is used\&.
 T}
 T{
+dns\-priority
+T}:T{
+IPV4_DNS_PRIORITY\fI(+)\fR
+T}:T{
+0
+T}:T{
+The priority for DNS servers of this connection\&. Lower values have higher priority\&. If zero, the default value will be used (50 for VPNs, 100 for other connections)\&. A negative value prevents DNS from other connections with greater values to be used\&.\fB
+
+Example: \fRIPV4_DNS_PRIORITY=20
+T}
+T{
 dhcp\-client\-id
 T}:T{
 DHCP_CLIENT_ID\fI(+)\fR
@@ -1625,6 +1659,8 @@ l l l l
 l l l l
 l l l l
 l l l l
+l l l l
+l l l l
 l l l l.
 T{
 method
@@ -1739,6 +1775,17 @@ T}:T{
 IPV6_ROUTE_METRIC is the default IPv6 metric for routes on this connection\&. If set to \-1, a default metric based on the device type is used\&.
 T}
 T{
+dns\-priority
+T}:T{
+IPV6_DNS_PRIORITY\fI(+)\fR
+T}:T{
+0
+T}:T{
+The priority for DNS servers of this connection\&. Lower values have higher priority\&. If zero, the default value will be used (50 for VPNs, 100 for other connections)\&. A negative value prevents DNS from other connections with greater values to be used\&.\fB
+
+Example: \fRIPV6_DNS_PRIORITY=20
+T}
+T{
 ip6\-privacy
 T}:T{
 IPV6_PRIVACY, IPV6_PRIVACY_PREFER_PUBLIC_IP\fI(+)\fR
@@ -1764,6 +1811,17 @@ Example: \fRIPV6_ADDR_GEN_MODE=stable\-privacy\fB
 
 Allowed values: \fRIPV6_ADDR_GEN_MODE: eui64, stable\-privacy
 T}
+T{
+token
+T}:T{
+IPV6_TOKEN
+T}:T{
+\ \&
+T}:T{
+The IPv6 tokenized interface identifier token\fB
+
+Example: \fRIPV6_TOKEN=::53
+T}
 .TE
 .sp 1
 .sp
@@ -2012,6 +2070,7 @@ l l l l
 l l l l
 l l l l
 l l l l
+l l l l
 l l l l.
 T{
 port
@@ -2068,6 +2127,15 @@ T}:T{
 Cloned (spoofed) MAC address in traditional hex\-digits\-and\-colons notation (e\&.g\&. 00:22:68:14:5A:99)\&.
 T}
 T{
+generate\-mac\-address\-mask
+T}:T{
+GENERATE_MAC_ADDRESS_MASK
+T}:T{
+\ \&
+T}:T{
+the MAC address mask for generating randomized and stable cloned\-mac\-address\&.
+T}
+T{
 mac\-address\-blacklist
 T}:T{
 HWADDR_BLACKLIST\fI(+)\fR
@@ -2363,6 +2431,7 @@ l l l l
 l l l l
 l l l l
 l l l l
+l l l l
 l l l l.
 T{
 ssid
@@ -2458,6 +2527,15 @@ T}:T{
 Cloned (spoofed) MAC address in traditional hex\-digits\-and\-colons notation (e\&.g\&. 00:22:68:14:5A:99)\&.
 T}
 T{
+generate\-mac\-address\-mask
+T}:T{
+GENERATE_MAC_ADDRESS_MASK
+T}:T{
+\ \&
+T}:T{
+the MAC address mask for generating randomized and stable cloned\-mac\-address\&.
+T}
+T{
 mac\-address\-blacklist
 T}:T{
 HWADDR_BLACKLIST\fI(+)\fR
diff --git a/man/nm-settings-ifcfg-rh.xml b/man/nm-settings-ifcfg-rh.xml
index 712ad5f3..259459c2 100644
--- a/man/nm-settings-ifcfg-rh.xml
+++ b/man/nm-settings-ifcfg-rh.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0"?>
 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.3//EN" "http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd">
-<refentry id="nm-settings-ifcfg-rh"><refentryinfo><title>nm-settings-ifcfg-rh</title><author>NetworkManager developers</author></refentryinfo><refmeta><refentrytitle>nm-settings-ifcfg-rh</refentrytitle><manvolnum>5</manvolnum><refmiscinfo class="source">NetworkManager</refmiscinfo><refmiscinfo class="manual">Configuration</refmiscinfo><refmiscinfo class="version">1.2.4</refmiscinfo></refmeta><refnamediv><refname>nm-settings-ifcfg-rh</refname><refpurpose>Description of <emphasis>ifcfg-rh</emphasis> settings plugin</refpurpose></refnamediv><refsect1 id="description"><title>Description</title><para>
+<refentry id="nm-settings-ifcfg-rh"><refentryinfo><title>nm-settings-ifcfg-rh</title><author>NetworkManager developers</author></refentryinfo><refmeta><refentrytitle>nm-settings-ifcfg-rh</refentrytitle><manvolnum>5</manvolnum><refmiscinfo class="source">NetworkManager</refmiscinfo><refmiscinfo class="manual">Configuration</refmiscinfo><refmiscinfo class="version">1.4.0</refmiscinfo></refmeta><refnamediv><refname>nm-settings-ifcfg-rh</refname><refpurpose>Description of <emphasis>ifcfg-rh</emphasis> settings plugin</refpurpose></refnamediv><refsect1 id="description"><title>Description</title><para>
           NetworkManager is based on the concept of connection profiles that contain
           network configuration (see <citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum></citerefentry> for details). The profiles can be
           stored in various formats. NetworkManager uses plugins for reading and writing
@@ -15,7 +15,7 @@
           The plugin currently supports reading and writing Ethernet, Wi-Fi, InfiniBand,
           VLAN, Bond, Bridge, and Team connections. Unsupported connection types (such as
           WWAN, PPPoE, VPN, or ADSL) are handled by <emphasis>keyfile</emphasis> plugin
-          (<citerefentry><refentrytitle>nm-settings-keyfile</refentrytitle><manvolnum>5</manvolnum></citerefentry>).
+          (<link linkend="nm-settings-keyfile"><citerefentry><refentrytitle>nm-settings-keyfile</refentrytitle><manvolnum>5</manvolnum></citerefentry></link>).
           The main reason for using <emphasis>ifcfg-rh</emphasis> plugin is the compatibility
           with legacy configurations for <emphasis>ifup</emphasis> and <emphasis>ifdown</emphasis>
           (initscripts).
@@ -161,7 +161,9 @@ DEVICETYPE=TeamPort
                     link-local addressing using Avahi daemon and <emphasis>shared</emphasis> for
                     connection sharing. When <emphasis>shared</emphasis> is used, NetworkManager
                     assigns the interface 10.42.0.1, or it uses the first static address,
-                    if configured.</para></listitem></itemizedlist></para></listitem></varlistentry></variablelist></para><para>
+                    if configured.</para></listitem><listitem><para><literal>HWADDR</literal> -
+                    initscripts compare the currently set hardware address of a device, while
+                    NetworkManager considers the permanent one.</para></listitem></itemizedlist></para></listitem></varlistentry></variablelist></para><para>
           See the next section for detailed mapping of NetworkManager properties and
           <emphasis>ifcfg-rh</emphasis> variables. Variable names, format and usage
           differences in NetworkManager and initscripts are documented in the tables below.
@@ -223,7 +225,7 @@ Allowed values: </emphasis>6 - 40</entry></row><row><entry align="left">ageing-t
 
 Allowed values: </emphasis>0 - 1000000</entry></row><row><entry align="left">multicast-snooping</entry><entry align="left">BRIDGING_OPTS: multicast_snooping=</entry><entry align="left">1</entry><entry align="left">IGMP snooping support.<emphasis role="bold">
 
-Allowed values: </emphasis>0 or 1</entry></row></tbody></tgroup></table><table><title>connection setting</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Ifcfg-rh Variable</entry><entry>Default</entry><entry>Description</entry></row></thead><tbody><row><entry align="left">id</entry><entry align="left">NAME<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">User friendly name for the connection profile.</entry></row><row><entry align="left">uuid</entry><entry align="left">UUID<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">UUID for the connection profile. When missing, NetworkManager creates the UUID itself (by hashing the file).</entry></row><row><entry align="left">interface-name</entry><entry align="left">DEVICE</entry><entry align="left"/><entry align="left">Interface name of the device this profile is bound to. The variable can be left out when the profile should apply for more devices. Note that DEVICE can be required for some connection types.</entry></row><row><entry align="left">type</entry><entry align="left">TYPE (DEVICETYPE, DEVICE)</entry><entry align="left"/><entry align="left">Base type of the connection. DEVICETYPE is used for teaming connections.<emphasis role="bold">
+Allowed values: </emphasis>0 or 1</entry></row></tbody></tgroup></table><table><title>connection setting</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Ifcfg-rh Variable</entry><entry>Default</entry><entry>Description</entry></row></thead><tbody><row><entry align="left">id</entry><entry align="left">NAME<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">User friendly name for the connection profile.</entry></row><row><entry align="left">uuid</entry><entry align="left">UUID<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">UUID for the connection profile. When missing, NetworkManager creates the UUID itself (by hashing the filename).</entry></row><row><entry align="left">stable-id</entry><entry align="left">STABLE_ID<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Token to generate stable IDs.</entry></row><row><entry align="left">interface-name</entry><entry align="left">DEVICE</entry><entry align="left"/><entry align="left">Interface name of the device this profile is bound to. The variable can be left out when the profile should apply for more devices. Note that DEVICE can be required for some connection types.</entry></row><row><entry align="left">type</entry><entry align="left">TYPE (DEVICETYPE, DEVICE)</entry><entry align="left"/><entry align="left">Base type of the connection. DEVICETYPE is used for teaming connections.<emphasis role="bold">
 
 Example: </emphasis>TYPE=Ethernet; TYPE=Bond; TYPE=Bridge; DEVICETYPE=TeamPort<emphasis role="bold">
 
@@ -284,7 +286,9 @@ Example: </emphasis>DNS1=1.2.3.4 DNS2=10.0.0.254 DNS3=8.8.8.8</entry></row><row>
 
 Example: </emphasis>IPADDR=10.5.5.23 PREFIX=24 IPADDR1=1.1.1.2 PREFIX1=16</entry></row><row><entry align="left">gateway</entry><entry align="left">GATEWAY</entry><entry align="left"/><entry align="left">Gateway IP address.<emphasis role="bold">
 
-Example: </emphasis>GATEWAY=10.5.5.1</entry></row><row><entry align="left">routes</entry><entry align="left">ADDRESS1, NETMASK1, GATEWAY1, METRIC1, ...</entry><entry align="left"/><entry align="left">List of static routes. They are not stored in ifcfg-* file, but in route-* file instead.</entry></row><row><entry align="left">ignore-auto-routes</entry><entry align="left">PEERROUTES<emphasis>(+)</emphasis></entry><entry align="left">yes</entry><entry align="left">PEERROUTES has the opposite meaning as 'ignore-auto-routes' property.</entry></row><row><entry align="left">ignore-auto-dns</entry><entry align="left">PEERDNS</entry><entry align="left">yes</entry><entry align="left">PEERDNS has the opposite meaning as 'ignore-auto-dns' property.</entry></row><row><entry align="left">dhcp-send-hostname</entry><entry align="left">DHCP_SEND_HOSTNAME<emphasis>(+)</emphasis></entry><entry align="left">yes</entry><entry align="left">Whether DHCP_HOSTNAME should be sent to the DHCP server.</entry></row><row><entry align="left">dhcp-hostname</entry><entry align="left">DHCP_HOSTNAME</entry><entry align="left"/><entry align="left">Hostname to send to the DHCP server. When both DHCP_HOSTNAME and DHCP_FQDN are specified only the latter is used.</entry></row><row><entry align="left">never-default</entry><entry align="left">DEFROUTE (GATEWAYDEV in /etc/sysconfig/network)</entry><entry align="left">yes</entry><entry align="left">DEFROUTE=no tells NetworkManager that this connection should not be assigned the default route. DEFROUTE has the opposite meaning as 'never-default' property.</entry></row><row><entry align="left">may-fail</entry><entry align="left">IPV4_FAILURE_FATAL<emphasis>(+)</emphasis></entry><entry align="left">no</entry><entry align="left">IPV4_FAILURE_FATAL has the opposite meaning as 'may-fail' property.</entry></row><row><entry align="left">route-metric</entry><entry align="left">IPV4_ROUTE_METRIC<emphasis>(+)</emphasis></entry><entry align="left">-1</entry><entry align="left">IPV4_ROUTE_METRIC is the default IPv4 metric for routes on this connection. If set to -1, a default metric based on the device type is used.</entry></row><row><entry align="left">dhcp-client-id</entry><entry align="left">DHCP_CLIENT_ID<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">A string sent to the DHCP server to identify the local machine.<emphasis role="bold">
+Example: </emphasis>GATEWAY=10.5.5.1</entry></row><row><entry align="left">routes</entry><entry align="left">ADDRESS1, NETMASK1, GATEWAY1, METRIC1, ...</entry><entry align="left"/><entry align="left">List of static routes. They are not stored in ifcfg-* file, but in route-* file instead.</entry></row><row><entry align="left">ignore-auto-routes</entry><entry align="left">PEERROUTES<emphasis>(+)</emphasis></entry><entry align="left">yes</entry><entry align="left">PEERROUTES has the opposite meaning as 'ignore-auto-routes' property.</entry></row><row><entry align="left">ignore-auto-dns</entry><entry align="left">PEERDNS</entry><entry align="left">yes</entry><entry align="left">PEERDNS has the opposite meaning as 'ignore-auto-dns' property.</entry></row><row><entry align="left">dhcp-send-hostname</entry><entry align="left">DHCP_SEND_HOSTNAME<emphasis>(+)</emphasis></entry><entry align="left">yes</entry><entry align="left">Whether DHCP_HOSTNAME should be sent to the DHCP server.</entry></row><row><entry align="left">dhcp-hostname</entry><entry align="left">DHCP_HOSTNAME</entry><entry align="left"/><entry align="left">Hostname to send to the DHCP server. When both DHCP_HOSTNAME and DHCP_FQDN are specified only the latter is used.</entry></row><row><entry align="left">never-default</entry><entry align="left">DEFROUTE (GATEWAYDEV in /etc/sysconfig/network)</entry><entry align="left">yes</entry><entry align="left">DEFROUTE=no tells NetworkManager that this connection should not be assigned the default route. DEFROUTE has the opposite meaning as 'never-default' property.</entry></row><row><entry align="left">may-fail</entry><entry align="left">IPV4_FAILURE_FATAL<emphasis>(+)</emphasis></entry><entry align="left">no</entry><entry align="left">IPV4_FAILURE_FATAL has the opposite meaning as 'may-fail' property.</entry></row><row><entry align="left">route-metric</entry><entry align="left">IPV4_ROUTE_METRIC<emphasis>(+)</emphasis></entry><entry align="left">-1</entry><entry align="left">IPV4_ROUTE_METRIC is the default IPv4 metric for routes on this connection. If set to -1, a default metric based on the device type is used.</entry></row><row><entry align="left">dns-priority</entry><entry align="left">IPV4_DNS_PRIORITY<emphasis>(+)</emphasis></entry><entry align="left">0</entry><entry align="left">The priority for DNS servers of this connection. Lower values have higher priority. If zero, the default value will be used (50 for VPNs, 100 for other connections). A negative value prevents DNS from other connections with greater values to be used.<emphasis role="bold">
+
+Example: </emphasis>IPV4_DNS_PRIORITY=20</entry></row><row><entry align="left">dhcp-client-id</entry><entry align="left">DHCP_CLIENT_ID<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">A string sent to the DHCP server to identify the local machine.<emphasis role="bold">
 
 Example: </emphasis>DHCP_CLIENT_ID=ax-srv-1</entry></row><row><entry align="left">dad-timeout</entry><entry align="left">ARPING_WAIT</entry><entry align="left">missing variable means global default (config override or 3)</entry><entry align="left">Timeout (in seconds) for performing DAD before configuring IPv4 addresses. 0 turns off the DAD completely, -1 means default value.<emphasis role="bold">
 
@@ -296,7 +300,9 @@ Example: </emphasis>DHCP_FQDN=foo.bar.com</entry></row></tbody></tgroup></table>
 
 Example: </emphasis>IPV6ADDR=ab12:9876::1 IPV6ADDR_SECONDARIES="ab12:9876::2 ab12:9876::3"</entry></row><row><entry align="left">gateway</entry><entry align="left">IPV6_DEFAULTGW</entry><entry align="left"/><entry align="left">Gateway IP address.<emphasis role="bold">
 
-Example: </emphasis>IPV6_DEFAULTGW=abbe::1</entry></row><row><entry align="left">routes</entry><entry align="left">(none)</entry><entry align="left"/><entry align="left">List of static routes. They are not stored in ifcfg-* file, but in route6-* file instead in the form of command line for 'ip route add'.</entry></row><row><entry align="left">ignore-auto-routes</entry><entry align="left">IPV6_PEERROUTES<emphasis>(+)</emphasis></entry><entry align="left">yes</entry><entry align="left">IPV6_PEERROUTES has the opposite meaning as 'ignore-auto-routes' property.</entry></row><row><entry align="left">ignore-auto-dns</entry><entry align="left">IPV6_PEERDNS<emphasis>(+)</emphasis></entry><entry align="left">yes</entry><entry align="left">IPV6_PEERDNS has the opposite meaning as 'ignore-auto-dns' property.</entry></row><row><entry align="left">dhcp-hostname</entry><entry align="left">DHCP_HOSTNAME</entry><entry align="left"/><entry align="left">Hostname to send the DHCP server.</entry></row><row><entry align="left">never-default</entry><entry align="left">IPV6_DEFROUTE<emphasis>(+)</emphasis>, (and IPV6_DEFAULTGW, IPV6_DEFAULTDEV in /etc/sysconfig/network)</entry><entry align="left">IPV6_DEFROUTE=yes (when no variable specified)</entry><entry align="left">IPV6_DEFROUTE=no tells NetworkManager that this connection should not be assigned the default IPv6 route. IPV6_DEFROUTE has the opposite meaning as 'never-default' property.</entry></row><row><entry align="left">may-fail</entry><entry align="left">IPV6_FAILURE_FATAL<emphasis>(+)</emphasis></entry><entry align="left">no</entry><entry align="left">IPV6_FAILURE_FATAL has the opposite meaning as 'may-fail' property.</entry></row><row><entry align="left">route-metric</entry><entry align="left">IPV6_ROUTE_METRIC<emphasis>(+)</emphasis></entry><entry align="left">-1</entry><entry align="left">IPV6_ROUTE_METRIC is the default IPv6 metric for routes on this connection. If set to -1, a default metric based on the device type is used.</entry></row><row><entry align="left">ip6-privacy</entry><entry align="left">IPV6_PRIVACY, IPV6_PRIVACY_PREFER_PUBLIC_IP<emphasis>(+)</emphasis></entry><entry align="left">no</entry><entry align="left">Configure IPv6 Privacy Extensions for SLAAC (RFC4941).<emphasis role="bold">
+Example: </emphasis>IPV6_DEFAULTGW=abbe::1</entry></row><row><entry align="left">routes</entry><entry align="left">(none)</entry><entry align="left"/><entry align="left">List of static routes. They are not stored in ifcfg-* file, but in route6-* file instead in the form of command line for 'ip route add'.</entry></row><row><entry align="left">ignore-auto-routes</entry><entry align="left">IPV6_PEERROUTES<emphasis>(+)</emphasis></entry><entry align="left">yes</entry><entry align="left">IPV6_PEERROUTES has the opposite meaning as 'ignore-auto-routes' property.</entry></row><row><entry align="left">ignore-auto-dns</entry><entry align="left">IPV6_PEERDNS<emphasis>(+)</emphasis></entry><entry align="left">yes</entry><entry align="left">IPV6_PEERDNS has the opposite meaning as 'ignore-auto-dns' property.</entry></row><row><entry align="left">dhcp-hostname</entry><entry align="left">DHCP_HOSTNAME</entry><entry align="left"/><entry align="left">Hostname to send the DHCP server.</entry></row><row><entry align="left">never-default</entry><entry align="left">IPV6_DEFROUTE<emphasis>(+)</emphasis>, (and IPV6_DEFAULTGW, IPV6_DEFAULTDEV in /etc/sysconfig/network)</entry><entry align="left">IPV6_DEFROUTE=yes (when no variable specified)</entry><entry align="left">IPV6_DEFROUTE=no tells NetworkManager that this connection should not be assigned the default IPv6 route. IPV6_DEFROUTE has the opposite meaning as 'never-default' property.</entry></row><row><entry align="left">may-fail</entry><entry align="left">IPV6_FAILURE_FATAL<emphasis>(+)</emphasis></entry><entry align="left">no</entry><entry align="left">IPV6_FAILURE_FATAL has the opposite meaning as 'may-fail' property.</entry></row><row><entry align="left">route-metric</entry><entry align="left">IPV6_ROUTE_METRIC<emphasis>(+)</emphasis></entry><entry align="left">-1</entry><entry align="left">IPV6_ROUTE_METRIC is the default IPv6 metric for routes on this connection. If set to -1, a default metric based on the device type is used.</entry></row><row><entry align="left">dns-priority</entry><entry align="left">IPV6_DNS_PRIORITY<emphasis>(+)</emphasis></entry><entry align="left">0</entry><entry align="left">The priority for DNS servers of this connection. Lower values have higher priority. If zero, the default value will be used (50 for VPNs, 100 for other connections). A negative value prevents DNS from other connections with greater values to be used.<emphasis role="bold">
+
+Example: </emphasis>IPV6_DNS_PRIORITY=20</entry></row><row><entry align="left">ip6-privacy</entry><entry align="left">IPV6_PRIVACY, IPV6_PRIVACY_PREFER_PUBLIC_IP<emphasis>(+)</emphasis></entry><entry align="left">no</entry><entry align="left">Configure IPv6 Privacy Extensions for SLAAC (RFC4941).<emphasis role="bold">
 
 Example: </emphasis>IPV6_PRIVACY=rfc3041 IPV6_PRIVACY_PREFER_PUBLIC_IP=yes<emphasis role="bold">
 
@@ -304,7 +310,9 @@ Allowed values: </emphasis>IPV6_PRIVACY: no, yes (rfc3041 or rfc4941); IPV6_PRIV
 
 Example: </emphasis>IPV6_ADDR_GEN_MODE=stable-privacy<emphasis role="bold">
 
-Allowed values: </emphasis>IPV6_ADDR_GEN_MODE: eui64, stable-privacy</entry></row></tbody></tgroup></table><table><title>macvlan setting</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Ifcfg-rh Variable</entry><entry>Default</entry><entry>Description</entry></row></thead><tbody/></tgroup></table><table><title>team-port setting</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Ifcfg-rh Variable</entry><entry>Default</entry><entry>Description</entry></row></thead><tbody><row><entry align="left">config</entry><entry align="left">TEAM_PORT_CONFIG</entry><entry align="left"/><entry align="left">Team port configuration in JSON. See man teamd.conf for details.</entry></row></tbody></tgroup></table><table><title>team setting</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Ifcfg-rh Variable</entry><entry>Default</entry><entry>Description</entry></row></thead><tbody><row><entry align="left">config</entry><entry align="left">TEAM_CONFIG</entry><entry align="left"/><entry align="left">Team configuration in JSON. See man teamd.conf for details.</entry></row></tbody></tgroup></table><table><title>tun setting</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Ifcfg-rh Variable</entry><entry>Default</entry><entry>Description</entry></row></thead><tbody/></tgroup></table><table><title>vlan setting</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Ifcfg-rh Variable</entry><entry>Default</entry><entry>Description</entry></row></thead><tbody><row><entry align="left">parent</entry><entry align="left">DEVICE or PHYSDEV</entry><entry align="left"/><entry align="left">Parent interface of the VLAN.</entry></row><row><entry align="left">id</entry><entry align="left">VLAN_ID or DEVICE</entry><entry align="left"/><entry align="left">VLAN identifier.</entry></row><row><entry align="left">flags</entry><entry align="left">GVRP, MVRP, VLAN_FLAGS</entry><entry align="left"/><entry align="left">VLAN flags.<emphasis role="bold">
+Allowed values: </emphasis>IPV6_ADDR_GEN_MODE: eui64, stable-privacy</entry></row><row><entry align="left">token</entry><entry align="left">IPV6_TOKEN</entry><entry align="left"/><entry align="left">The IPv6 tokenized interface identifier token<emphasis role="bold">
+
+Example: </emphasis>IPV6_TOKEN=::53</entry></row></tbody></tgroup></table><table><title>macvlan setting</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Ifcfg-rh Variable</entry><entry>Default</entry><entry>Description</entry></row></thead><tbody/></tgroup></table><table><title>team-port setting</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Ifcfg-rh Variable</entry><entry>Default</entry><entry>Description</entry></row></thead><tbody><row><entry align="left">config</entry><entry align="left">TEAM_PORT_CONFIG</entry><entry align="left"/><entry align="left">Team port configuration in JSON. See man teamd.conf for details.</entry></row></tbody></tgroup></table><table><title>team setting</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Ifcfg-rh Variable</entry><entry>Default</entry><entry>Description</entry></row></thead><tbody><row><entry align="left">config</entry><entry align="left">TEAM_CONFIG</entry><entry align="left"/><entry align="left">Team configuration in JSON. See man teamd.conf for details.</entry></row></tbody></tgroup></table><table><title>tun setting</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Ifcfg-rh Variable</entry><entry>Default</entry><entry>Description</entry></row></thead><tbody/></tgroup></table><table><title>vlan setting</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Ifcfg-rh Variable</entry><entry>Default</entry><entry>Description</entry></row></thead><tbody><row><entry align="left">parent</entry><entry align="left">DEVICE or PHYSDEV</entry><entry align="left"/><entry align="left">Parent interface of the VLAN.</entry></row><row><entry align="left">id</entry><entry align="left">VLAN_ID or DEVICE</entry><entry align="left"/><entry align="left">VLAN identifier.</entry></row><row><entry align="left">flags</entry><entry align="left">GVRP, MVRP, VLAN_FLAGS</entry><entry align="left"/><entry align="left">VLAN flags.<emphasis role="bold">
 
 Allowed values: </emphasis>"yes or "no" for GVRP and MVRP; "LOOSE_BINDING" and "NO_REORDER_HDR" for VLAN_FLAGS</entry></row><row><entry align="left">ingress-priority-map</entry><entry align="left">VLAN_INGRESS_PRIORITY_MAP</entry><entry align="left"/><entry align="left">Ingress priority mapping.<emphasis role="bold">
 
@@ -312,7 +320,7 @@ Example: </emphasis>VLAN_INGRESS_PRIORITY_MAP=4:2,3:5</entry></row><row><entry a
 
 Example: </emphasis>VLAN_EGRESS_PRIORITY_MAP=5:4,4:1,3:7</entry></row><row><entry align="left">interface-name</entry><entry align="left">PHYSDEV and VLAN_ID, or DEVICE</entry><entry align="left"/><entry align="left">VLAN interface name. If all variables are set, parent device from PHYSDEV takes precedence over DEVICE, but VLAN id from DEVICE takes precedence over VLAN_ID.<emphasis role="bold">
 
-Example: </emphasis>PHYSDEV=eth0, VLAN_ID=12; or DEVICE=eth0.12</entry></row></tbody></tgroup></table><table><title>vxlan setting</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Ifcfg-rh Variable</entry><entry>Default</entry><entry>Description</entry></row></thead><tbody/></tgroup></table><table><title>802-3-ethernet setting</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Ifcfg-rh Variable</entry><entry>Default</entry><entry>Description</entry></row></thead><tbody><row><entry align="left">port</entry><entry align="left">(none)</entry><entry align="left"/><entry align="left">The property is not saved by the plugin.</entry></row><row><entry align="left">speed</entry><entry align="left">(none)</entry><entry align="left"/><entry align="left">The property is not saved by the plugin.</entry></row><row><entry align="left">duplex</entry><entry align="left">(none)</entry><entry align="left"/><entry align="left">The property is not saved by the plugin.</entry></row><row><entry align="left">auto-negotiate</entry><entry align="left">(none)</entry><entry align="left"/><entry align="left">The property is not saved by the plugin.</entry></row><row><entry align="left">mac-address</entry><entry align="left">HWADDR</entry><entry align="left"/><entry align="left">Hardware address of the device in traditional hex-digits-and-colons notation (e.g. 00:22:68:14:5A:05).</entry></row><row><entry align="left">cloned-mac-address</entry><entry align="left">MACADDR</entry><entry align="left"/><entry align="left">Cloned (spoofed) MAC address in traditional hex-digits-and-colons notation (e.g. 00:22:68:14:5A:99).</entry></row><row><entry align="left">mac-address-blacklist</entry><entry align="left">HWADDR_BLACKLIST<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">It denies usage of the connection for any device whose address is listed.<emphasis role="bold">
+Example: </emphasis>PHYSDEV=eth0, VLAN_ID=12; or DEVICE=eth0.12</entry></row></tbody></tgroup></table><table><title>vxlan setting</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Ifcfg-rh Variable</entry><entry>Default</entry><entry>Description</entry></row></thead><tbody/></tgroup></table><table><title>802-3-ethernet setting</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Ifcfg-rh Variable</entry><entry>Default</entry><entry>Description</entry></row></thead><tbody><row><entry align="left">port</entry><entry align="left">(none)</entry><entry align="left"/><entry align="left">The property is not saved by the plugin.</entry></row><row><entry align="left">speed</entry><entry align="left">(none)</entry><entry align="left"/><entry align="left">The property is not saved by the plugin.</entry></row><row><entry align="left">duplex</entry><entry align="left">(none)</entry><entry align="left"/><entry align="left">The property is not saved by the plugin.</entry></row><row><entry align="left">auto-negotiate</entry><entry align="left">(none)</entry><entry align="left"/><entry align="left">The property is not saved by the plugin.</entry></row><row><entry align="left">mac-address</entry><entry align="left">HWADDR</entry><entry align="left"/><entry align="left">Hardware address of the device in traditional hex-digits-and-colons notation (e.g. 00:22:68:14:5A:05).</entry></row><row><entry align="left">cloned-mac-address</entry><entry align="left">MACADDR</entry><entry align="left"/><entry align="left">Cloned (spoofed) MAC address in traditional hex-digits-and-colons notation (e.g. 00:22:68:14:5A:99).</entry></row><row><entry align="left">generate-mac-address-mask</entry><entry align="left">GENERATE_MAC_ADDRESS_MASK</entry><entry align="left"/><entry align="left">the MAC address mask for generating randomized and stable cloned-mac-address.</entry></row><row><entry align="left">mac-address-blacklist</entry><entry align="left">HWADDR_BLACKLIST<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">It denies usage of the connection for any device whose address is listed.<emphasis role="bold">
 
 Example: </emphasis>HWADDR_BLACKLIST="00:22:68:11:69:08 00:11:22:11:44:55"</entry></row><row><entry align="left">mtu</entry><entry align="left">MTU</entry><entry align="left"/><entry align="left">MTU of the interface.</entry></row><row><entry align="left">s390-subchannels</entry><entry align="left">SUBCHANNELS</entry><entry align="left"/><entry align="left">Subchannels for IBM S390 hosts.<emphasis role="bold">
 
@@ -348,7 +356,7 @@ Allowed values: </emphasis>a, bg</entry></row><row><entry align="left">channel</
 
 Example: </emphasis>CHANNEL=6</entry></row><row><entry align="left">bssid</entry><entry align="left">BSSID<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Restricts association only to a single AP.<emphasis role="bold">
 
-Example: </emphasis>BSSID=00:1E:BD:64:83:21</entry></row><row><entry align="left">rate</entry><entry align="left">(none)</entry><entry align="left"/><entry align="left">This property is not handled by ifcfg-rh plugin.</entry></row><row><entry align="left">tx-power</entry><entry align="left">(none)</entry><entry align="left"/><entry align="left">This property is not handled by ifcfg-rh plugin.</entry></row><row><entry align="left">mac-address</entry><entry align="left">HWADDR</entry><entry align="left"/><entry align="left">Hardware address of the device in traditional hex-digits-and-colons notation (e.g. 00:22:68:14:5A:05).</entry></row><row><entry align="left">cloned-mac-address</entry><entry align="left">MACADDR</entry><entry align="left"/><entry align="left">Cloned (spoofed) MAC address in traditional hex-digits-and-colons notation (e.g. 00:22:68:14:5A:99).</entry></row><row><entry align="left">mac-address-blacklist</entry><entry align="left">HWADDR_BLACKLIST<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">It denies usage of the connection for any device whose address is listed.</entry></row><row><entry align="left">seen-bssids</entry><entry align="left">(none)</entry><entry align="left"/><entry align="left">This property is not handled by ifcfg-rh plugin.</entry></row><row><entry align="left">mtu</entry><entry align="left">MTU</entry><entry align="left"/><entry align="left">MTU of the wireless interface.</entry></row><row><entry align="left">hidden</entry><entry align="left">SSID_HIDDEN<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Whether the network hides the SSID.</entry></row><row><entry align="left">powersave</entry><entry align="left">POWERSAVE<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Enables or disables Wi-Fi power saving.<emphasis role="bold">
+Example: </emphasis>BSSID=00:1E:BD:64:83:21</entry></row><row><entry align="left">rate</entry><entry align="left">(none)</entry><entry align="left"/><entry align="left">This property is not handled by ifcfg-rh plugin.</entry></row><row><entry align="left">tx-power</entry><entry align="left">(none)</entry><entry align="left"/><entry align="left">This property is not handled by ifcfg-rh plugin.</entry></row><row><entry align="left">mac-address</entry><entry align="left">HWADDR</entry><entry align="left"/><entry align="left">Hardware address of the device in traditional hex-digits-and-colons notation (e.g. 00:22:68:14:5A:05).</entry></row><row><entry align="left">cloned-mac-address</entry><entry align="left">MACADDR</entry><entry align="left"/><entry align="left">Cloned (spoofed) MAC address in traditional hex-digits-and-colons notation (e.g. 00:22:68:14:5A:99).</entry></row><row><entry align="left">generate-mac-address-mask</entry><entry align="left">GENERATE_MAC_ADDRESS_MASK</entry><entry align="left"/><entry align="left">the MAC address mask for generating randomized and stable cloned-mac-address.</entry></row><row><entry align="left">mac-address-blacklist</entry><entry align="left">HWADDR_BLACKLIST<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">It denies usage of the connection for any device whose address is listed.</entry></row><row><entry align="left">seen-bssids</entry><entry align="left">(none)</entry><entry align="left"/><entry align="left">This property is not handled by ifcfg-rh plugin.</entry></row><row><entry align="left">mtu</entry><entry align="left">MTU</entry><entry align="left"/><entry align="left">MTU of the wireless interface.</entry></row><row><entry align="left">hidden</entry><entry align="left">SSID_HIDDEN<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Whether the network hides the SSID.</entry></row><row><entry align="left">powersave</entry><entry align="left">POWERSAVE<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Enables or disables Wi-Fi power saving.<emphasis role="bold">
 
 Example: </emphasis>POWERSAVE=enable<emphasis role="bold">
 
@@ -367,9 +375,9 @@ Allowed values: </emphasis>default, never, always</entry></row><row><entry align
               and storing this secret; when it is required, agents will be asked to provide it.</para></listitem><listitem><para><literal>ask</literal> - the associated password is not saved but it will be
               requested from the user each time it is required.</para></listitem><listitem><para><literal>unused</literal> - in some situations it cannot be automatically determined
               that a secret is required or not. This flag hints that the secret is not required and should
-              not be requested from the user.</para></listitem></itemizedlist></refsect2></refsect1><refsect1 id="files"><title>Files</title><para><filename>/etc/sysconfig/network-scripts/ifcfg-*</filename></para><para><filename>/etc/sysconfig/network-scripts/keys-*</filename></para><para><filename>/etc/sysconfig/network-scripts/route-*</filename></para><para><filename>/etc/sysconfig/network-scripts/route6-*</filename></para><para><filename>/usr/share/doc/initscripts/sysconfig.txt</filename></para></refsect1><refsect1 id="see_also"><title>See Also</title><para><citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
-        <citerefentry><refentrytitle>nm-settings-keyfile</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
-        <citerefentry><refentrytitle>NetworkManager</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
-        <citerefentry><refentrytitle>NetworkManager.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
-        <citerefentry><refentrytitle>nmcli</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
-        <citerefentry><refentrytitle>nmcli-examples</refentrytitle><manvolnum>7</manvolnum></citerefentry></para></refsect1></refentry>
+              not be requested from the user.</para></listitem></itemizedlist></refsect2></refsect1><refsect1 id="files"><title>Files</title><para><filename>/etc/sysconfig/network-scripts/ifcfg-*</filename></para><para><filename>/etc/sysconfig/network-scripts/keys-*</filename></para><para><filename>/etc/sysconfig/network-scripts/route-*</filename></para><para><filename>/etc/sysconfig/network-scripts/route6-*</filename></para><para><filename>/usr/share/doc/initscripts/sysconfig.txt</filename></para></refsect1><refsect1 id="see_also"><title>See Also</title><para><link linkend="nm-settings"><citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum></citerefentry></link>,
+        <link linkend="nm-settings-keyfile"><citerefentry><refentrytitle>nm-settings-keyfile</refentrytitle><manvolnum>5</manvolnum></citerefentry></link>,
+        <link linkend="NetworkManager"><citerefentry><refentrytitle>NetworkManager</refentrytitle><manvolnum>8</manvolnum></citerefentry></link>,
+        <link linkend="NetworkManager.conf"><citerefentry><refentrytitle>NetworkManager.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry></link>,
+        <link linkend="nmcli"><citerefentry><refentrytitle>nmcli</refentrytitle><manvolnum>1</manvolnum></citerefentry></link>,
+        <link linkend="nmcli-examples"><citerefentry><refentrytitle>nmcli-examples</refentrytitle><manvolnum>7</manvolnum></citerefentry></link></para></refsect1></refentry>
diff --git a/man/nm-settings-ifcfg-rh.xsl b/man/nm-settings-ifcfg-rh.xsl
index 5a9f8d6a..80d33f2b 100644
--- a/man/nm-settings-ifcfg-rh.xsl
+++ b/man/nm-settings-ifcfg-rh.xsl
@@ -53,7 +53,7 @@
           The plugin currently supports reading and writing Ethernet, Wi-Fi, InfiniBand,
           VLAN, Bond, Bridge, and Team connections. Unsupported connection types (such as
           WWAN, PPPoE, VPN, or ADSL) are handled by <emphasis>keyfile</emphasis> plugin
-          (<citerefentry><refentrytitle>nm-settings-keyfile</refentrytitle><manvolnum>5</manvolnum></citerefentry>).
+          (<link linkend='nm-settings-keyfile'><citerefentry><refentrytitle>nm-settings-keyfile</refentrytitle><manvolnum>5</manvolnum></citerefentry></link>).
           The main reason for using <emphasis>ifcfg-rh</emphasis> plugin is the compatibility
           with legacy configurations for <emphasis>ifup</emphasis> and <emphasis>ifdown</emphasis>
           (initscripts).
@@ -257,6 +257,11 @@ DEVICETYPE=TeamPort
                     assigns the interface 10.42.0.1, or it uses the first static address,
                     if configured.</para>
                  </listitem>
+                  <listitem>
+                    <para><literal>HWADDR</literal> -
+                    initscripts compare the currently set hardware address of a device, while
+                    NetworkManager considers the permanent one.</para>
+                  </listitem>
                 </itemizedlist>
               </para></listitem>
             </varlistentry>
@@ -311,12 +316,12 @@ DEVICETYPE=TeamPort
         <para><filename>/usr/share/doc/initscripts/sysconfig.txt</filename></para>
       </refsect1>
       <refsect1 id='see_also'><title>See Also</title>
-        <para><citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
-        <citerefentry><refentrytitle>nm-settings-keyfile</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
-        <citerefentry><refentrytitle>NetworkManager</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
-        <citerefentry><refentrytitle>NetworkManager.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
-        <citerefentry><refentrytitle>nmcli</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
-        <citerefentry><refentrytitle>nmcli-examples</refentrytitle><manvolnum>7</manvolnum></citerefentry></para>
+        <para><link linkend='nm-settings'><citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum></citerefentry></link>,
+        <link linkend='nm-settings-keyfile'><citerefentry><refentrytitle>nm-settings-keyfile</refentrytitle><manvolnum>5</manvolnum></citerefentry></link>,
+        <link linkend='NetworkManager'><citerefentry><refentrytitle>NetworkManager</refentrytitle><manvolnum>8</manvolnum></citerefentry></link>,
+        <link linkend='NetworkManager.conf'><citerefentry><refentrytitle>NetworkManager.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry></link>,
+        <link linkend='nmcli'><citerefentry><refentrytitle>nmcli</refentrytitle><manvolnum>1</manvolnum></citerefentry></link>,
+        <link linkend='nmcli-examples'><citerefentry><refentrytitle>nmcli-examples</refentrytitle><manvolnum>7</manvolnum></citerefentry></link></para>
       </refsect1>
     </refentry>
   </xsl:template>
diff --git a/man/nm-settings-keyfile.5 b/man/nm-settings-keyfile.5
index 0d3930ad..72a364a8 100644
--- a/man/nm-settings-keyfile.5
+++ b/man/nm-settings-keyfile.5
@@ -2,12 +2,12 @@
 .\"     Title: nm-settings-keyfile
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
-.\"      Date: 08/03/2016
+.\"      Date: 08/24/2016
 .\"    Manual: Configuration
-.\"    Source: NetworkManager 1.2.4
+.\"    Source: NetworkManager 1.4.0
 .\"  Language: English
 .\"
-.TH "NM\-SETTINGS\-KEYFIL" "5" "" "NetworkManager 1\&.2\&.4" "Configuration"
+.TH "NM\-SETTINGS\-KEYFIL" "5" "" "NetworkManager 1\&.4\&.0" "Configuration"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
diff --git a/man/nm-settings-keyfile.xml b/man/nm-settings-keyfile.xml
index 849b3da9..1bf66c7e 100644
--- a/man/nm-settings-keyfile.xml
+++ b/man/nm-settings-keyfile.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0"?>
 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.3//EN" "http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd">
-<refentry id="nm-settings-keyfile"><refentryinfo><title>nm-settings-keyfile</title><author>NetworkManager developers</author></refentryinfo><refmeta><refentrytitle>nm-settings-keyfile</refentrytitle><manvolnum>5</manvolnum><refmiscinfo class="source">NetworkManager</refmiscinfo><refmiscinfo class="manual">Configuration</refmiscinfo><refmiscinfo class="version">1.2.4</refmiscinfo></refmeta><refnamediv><refname>nm-settings-keyfile</refname><refpurpose>Description of <emphasis>keyfile</emphasis> settings plugin</refpurpose></refnamediv><refsect1 id="description"><title>Description</title><para>
+<refentry id="nm-settings-keyfile"><refentryinfo><title>nm-settings-keyfile</title><author>NetworkManager developers</author></refentryinfo><refmeta><refentrytitle>nm-settings-keyfile</refentrytitle><manvolnum>5</manvolnum><refmiscinfo class="source">NetworkManager</refmiscinfo><refmiscinfo class="manual">Configuration</refmiscinfo><refmiscinfo class="version">1.4.0</refmiscinfo></refmeta><refnamediv><refname>nm-settings-keyfile</refname><refpurpose>Description of <emphasis>keyfile</emphasis> settings plugin</refpurpose></refnamediv><refsect1 id="description"><title>Description</title><para>
           NetworkManager is based on the concept of connection profiles that contain
           network configuration (see <citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum></citerefentry> for details). The profiles can be
           stored in various formats. NetworkManager uses plugins for reading and writing
@@ -128,7 +128,7 @@ id=4
           There are several exceptions to this rule, mainly for making keyfile syntax easier
           for humans. The exceptions handled specially by <emphasis>keyfile</emphasis>
           plugin are listed below. Refer to
-          <citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+          <link linkend="nm-settings"><citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum></citerefentry></link>
           for all available settings and properties and their description.
         </para><formalpara><title>Name aliases</title><para>
             Some of the NetworkManager setting names are somewhat hard to type or remember. Therefore
@@ -234,9 +234,9 @@ Example: </emphasis>mac-address-blacklist= 00:22:68:12:79:A6;00:22:68:12:79:78</
               and storing this secret; when it is required, agents will be asked to provide it.</para></listitem><listitem><para>2 - (not-saved) - this secret should not be saved but should be requested
               from the user each time it is required.</para></listitem><listitem><para>4 - (not-required) - in some situations it cannot be automatically determined
               that a secret is required or not. This flag hints that the secret is not required
-              and should not be requested from the user.</para></listitem></itemizedlist></refsect2></refsect1><refsect1 id="files"><title>Files</title><para><filename>/etc/NetworkManager/system-connections/*</filename></para></refsect1><refsect1 id="see_also"><title>See Also</title><para><citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
-        <citerefentry><refentrytitle>nm-settings-ifcfg-rh</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
-        <citerefentry><refentrytitle>NetworkManager</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
-        <citerefentry><refentrytitle>NetworkManager.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
-        <citerefentry><refentrytitle>nmcli</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
-        <citerefentry><refentrytitle>nmcli-examples</refentrytitle><manvolnum>7</manvolnum></citerefentry></para></refsect1></refentry>
+              and should not be requested from the user.</para></listitem></itemizedlist></refsect2></refsect1><refsect1 id="files"><title>Files</title><para><filename>/etc/NetworkManager/system-connections/*</filename></para></refsect1><refsect1 id="see_also"><title>See Also</title><para><link linkend="nm-settings"><citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum></citerefentry></link>,
+        <link linkend="nm-settings-ifcfg-rh"><citerefentry><refentrytitle>nm-settings-ifcfg-rh</refentrytitle><manvolnum>5</manvolnum></citerefentry></link>,
+        <link linkend="NetworkManager"><citerefentry><refentrytitle>NetworkManager</refentrytitle><manvolnum>8</manvolnum></citerefentry></link>,
+        <link linkend="NetworkManager.conf"><citerefentry><refentrytitle>NetworkManager.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry></link>,
+        <link linkend="nmcli"><citerefentry><refentrytitle>nmcli</refentrytitle><manvolnum>1</manvolnum></citerefentry></link>,
+        <link linkend="nmcli-examples"><citerefentry><refentrytitle>nmcli-examples</refentrytitle><manvolnum>7</manvolnum></citerefentry></link></para></refsect1></refentry>
diff --git a/man/nm-settings-keyfile.xsl b/man/nm-settings-keyfile.xsl
index 41e7dcdb..486a4c53 100644
--- a/man/nm-settings-keyfile.xsl
+++ b/man/nm-settings-keyfile.xsl
@@ -195,7 +195,7 @@ id=4
           There are several exceptions to this rule, mainly for making keyfile syntax easier
           for humans. The exceptions handled specially by <emphasis>keyfile</emphasis>
           plugin are listed below. Refer to
-          <citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+          <link linkend='nm-settings'><citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum></citerefentry></link>
           for all available settings and properties and their description.
         </para>
         <formalpara><title>Name aliases</title>
@@ -246,12 +246,12 @@ id=4
       </refsect1>
 
       <refsect1 id='see_also'><title>See Also</title>
-        <para><citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
-        <citerefentry><refentrytitle>nm-settings-ifcfg-rh</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
-        <citerefentry><refentrytitle>NetworkManager</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
-        <citerefentry><refentrytitle>NetworkManager.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
-        <citerefentry><refentrytitle>nmcli</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
-        <citerefentry><refentrytitle>nmcli-examples</refentrytitle><manvolnum>7</manvolnum></citerefentry></para>
+        <para><link linkend='nm-settings'><citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum></citerefentry></link>,
+        <link linkend='nm-settings-ifcfg-rh'><citerefentry><refentrytitle>nm-settings-ifcfg-rh</refentrytitle><manvolnum>5</manvolnum></citerefentry></link>,
+        <link linkend='NetworkManager'><citerefentry><refentrytitle>NetworkManager</refentrytitle><manvolnum>8</manvolnum></citerefentry></link>,
+        <link linkend='NetworkManager.conf'><citerefentry><refentrytitle>NetworkManager.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry></link>,
+        <link linkend='nmcli'><citerefentry><refentrytitle>nmcli</refentrytitle><manvolnum>1</manvolnum></citerefentry></link>,
+        <link linkend='nmcli-examples'><citerefentry><refentrytitle>nmcli-examples</refentrytitle><manvolnum>7</manvolnum></citerefentry></link></para>
       </refsect1>
     </refentry>
   </xsl:template>
diff --git a/man/nm-settings.5 b/man/nm-settings.5
index 08312995..e963f5ef 100644
--- a/man/nm-settings.5
+++ b/man/nm-settings.5
@@ -2,12 +2,12 @@
 .\"     Title: nm-settings
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
-.\"      Date: 08/03/2016
+.\"      Date: 08/24/2016
 .\"    Manual: Configuration
-.\"    Source: NetworkManager 1.2.4
+.\"    Source: NetworkManager 1.4.0
 .\"  Language: English
 .\"
-.TH "NM\-SETTINGS" "5" "" "NetworkManager 1\&.2\&.4" "Configuration"
+.TH "NM\-SETTINGS" "5" "" "NetworkManager 1\&.4\&.0" "Configuration"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -921,6 +921,7 @@ l l l l
 l l l l
 l l l l
 l l l l
+l l l l
 l l l l.
 T{
 autoconnect
@@ -1049,6 +1050,15 @@ T}:T{
 Setting name of the device type of this slave\*(Aqs master connection (eg, "bond"), or NULL if this connection is not a slave\&.
 T}
 T{
+stable\-id
+T}:T{
+string
+T}:T{
+\ \&
+T}:T{
+This token to generate stable IDs for the connection\&. If unset, the UUID will be used instead\&. The stable\-id is used instead of the connection UUID for generating IPv6 stable private addresses with ipv6\&.addr\-gen\-mode=stable\-privacy\&. It is also used to seed the generated cloned MAC address for ethernet\&.cloned\-mac\-address=stable and wifi\&.cloned\-mac\-address=stable\&.
+T}
+T{
 timestamp
 T}:T{
 uint64
@@ -1811,6 +1821,7 @@ l l l l
 l l l l
 l l l l
 l l l l
+l l l l
 l l l l.
 T{
 addr\-gen\-mode
@@ -2010,6 +2021,15 @@ T}:T{
 T}:T{
 Deprecated in favor of the \*(Aqroute\-data\*(Aq property, but this can be used for backward\-compatibility with older daemons\&. Note that if you send this property the daemon will ignore \*(Aqroute\-data\*(Aq\&.  Array of IPv6 route structures\&.  Each IPv6 route structure is composed of an IPv6 address, a prefix length (1 \- 128), an IPv6 next hop address (which may be zeroed out if there is no next hop), and a metric\&. If the metric is 0, NM will choose an appropriate default metric for the device\&.
 T}
+T{
+token
+T}:T{
+string
+T}:T{
+\ \&
+T}:T{
+Configure the token for draft\-chown\-6man\-tokenised\-ipv6\-identifiers\-02 IPv6 tokenized interface identifiers\&. Useful with eui64 addr\-gen\-mode\&.
+T}
 .TE
 .sp 1
 .sp
@@ -3297,8 +3317,19 @@ l l l l
 l l l l
 l l l l
 l l l l
+l l l l
+l l l l
 l l l l.
 T{
+assigned\-mac\-address
+T}:T{
+string
+T}:T{
+\ \&
+T}:T{
+The new field for the cloned MAC address\&. It can be either a hardware address in ASCII representation, or one of the special values "preserve", "permanent", "random" or "stable"\&. This field replaces the deprecated "cloned\-mac\-address" on D\-Bus, which can only contain explict hardware addresses\&.
+T}
+T{
 auto\-negotiate
 T}:T{
 boolean
@@ -3314,7 +3345,7 @@ byte array
 T}:T{
 \ \&
 T}:T{
-If specified, request that the device use this MAC address instead of its permanent MAC address\&.  This is known as MAC cloning or spoofing\&.
+This D\-Bus field is deprecated in favor of "assigned\-mac\-address" which is more flexible and allows specifying special variants like "random"\&.
 T}
 T{
 duplex
@@ -3326,6 +3357,15 @@ T}:T{
 If specified, request that the device only use the specified duplex mode\&. Either "half" or "full"\&.
 T}
 T{
+generate\-mac\-address\-mask
+T}:T{
+string
+T}:T{
+\ \&
+T}:T{
+With "cloned\-mac\-address" setting "random" or "stable", by default all bits of the MAC address are scrambled and a locally\-administered, unicast MAC address is created\&. This property allows to specify that certain bits are fixed\&. Note that the least significant bit of the first MAC address will always be unset to create a unicast MAC address\&. If the property is NULL, it is eligible to be overwritten by a default connection setting\&. If the value is still NULL or an empty string, the default is to create a locally\-administered, unicast MAC address\&. If the value contains one MAC address, this address is used as mask\&. The set bits of the mask are to be filled with the current MAC address of the device, while the unset bits are subject to randomization\&. Setting "FE:FF:FF:00:00:00" means to preserve the OUI of the current MAC address and only randomize the lower 3 bytes using the "random" or "stable" algorithm\&. If the value contains one additional MAC address after the mask, this address is used instead of the current MAC address to fill the bits that shall not be randomized\&. For example, a value of "FE:FF:FF:00:00:00 68:F7:28:00:00:00" will set the OUI of the MAC address to 68:F7:28, while the lower bits are randomized\&. A value of "02:00:00:00:00:00 00:00:00:00:00:00" will create a fully scrambled globally\-administered, burned\-in MAC address\&. If the value contains more then one additional MAC addresses, one of them is chosen randomly\&. For example, "02:00:00:00:00:00 00:00:00:00:00:00 02:00:00:00:00:00" will create a fully scrambled MAC address, randomly locally or globally administered\&.
+T}
+T{
 mac\-address
 T}:T{
 byte array
@@ -3461,8 +3501,19 @@ l l l l
 l l l l
 l l l l
 l l l l
+l l l l
+l l l l
 l l l l.
 T{
+assigned\-mac\-address
+T}:T{
+string
+T}:T{
+\ \&
+T}:T{
+The new field for the cloned MAC address\&. It can be either a hardware address in ASCII representation, or one of the special values "preserve", "permanent", "random" or "stable"\&. This field replaces the deprecated "cloned\-mac\-address" on D\-Bus, which can only contain explict hardware addresses\&.
+T}
+T{
 band
 T}:T{
 string
@@ -3496,7 +3547,16 @@ byte array
 T}:T{
 \ \&
 T}:T{
-If specified, request that the Wi\-Fi device use this MAC address instead of its permanent MAC address\&.  This is known as MAC cloning or spoofing\&.
+This D\-Bus field is deprecated in favor of "assigned\-mac\-address" which is more flexible and allows specifying special variants like "random"\&.
+T}
+T{
+generate\-mac\-address\-mask
+T}:T{
+string
+T}:T{
+\ \&
+T}:T{
+With "cloned\-mac\-address" setting "random" or "stable", by default all bits of the MAC address are scrambled and a locally\-administered, unicast MAC address is created\&. This property allows to specify that certain bits are fixed\&. Note that the least significant bit of the first MAC address will always be unset to create a unicast MAC address\&. If the property is NULL, it is eligible to be overwritten by a default connection setting\&. If the value is still NULL or an empty string, the default is to create a locally\-administered, unicast MAC address\&. If the value contains one MAC address, this address is used as mask\&. The set bits of the mask are to be filled with the current MAC address of the device, while the unset bits are subject to randomization\&. Setting "FE:FF:FF:00:00:00" means to preserve the OUI of the current MAC address and only randomize the lower 3 bytes using the "random" or "stable" algorithm\&. If the value contains one additional MAC address after the mask, this address is used instead of the current MAC address to fill the bits that shall not be randomized\&. For example, a value of "FE:FF:FF:00:00:00 68:F7:28:00:00:00" will set the OUI of the MAC address to 68:F7:28, while the lower bits are randomized\&. A value of "02:00:00:00:00:00 00:00:00:00:00:00" will create a fully scrambled globally\-administered, burned\-in MAC address\&. If the value contains more then one additional MAC addresses, one of them is chosen randomly\&. For example, "02:00:00:00:00:00 00:00:00:00:00:00 02:00:00:00:00:00" will create a fully scrambled MAC address, randomly locally or globally administered\&.
 T}
 T{
 hidden
@@ -3532,7 +3592,7 @@ uint32
 T}:T{
 0
 T}:T{
-One of NM_SETTING_MAC_RANDOMIZATION_DEFAULT (0) (never randomize unless the user has set a global default to randomize and the supplicant supports randomization),  NM_SETTING_MAC_RANDOMIZATION_NEVER (1) (never randomize the MAC address), or NM_SETTING_MAC_RANDOMIZATION_ALWAYS (2) (always randomize the MAC address)\&.
+One of NM_SETTING_MAC_RANDOMIZATION_DEFAULT (0) (never randomize unless the user has set a global default to randomize and the supplicant supports randomization),  NM_SETTING_MAC_RANDOMIZATION_NEVER (1) (never randomize the MAC address), or NM_SETTING_MAC_RANDOMIZATION_ALWAYS (2) (always randomize the MAC address)\&. Deprecated: 1
 T}
 T{
 mode
diff --git a/man/nm-settings.xml b/man/nm-settings.xml
index 06146e5e..5f34d9ee 100644
--- a/man/nm-settings.xml
+++ b/man/nm-settings.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0"?>
 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.3//EN" "http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd">
-<refentry id="nm-settings"><refentryinfo><title>nm-settings</title><author>NetworkManager developers</author></refentryinfo><refmeta><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum><refmiscinfo class="source">NetworkManager</refmiscinfo><refmiscinfo class="manual">Configuration</refmiscinfo><refmiscinfo class="version">1.2.4</refmiscinfo></refmeta><refnamediv><refname>nm-settings</refname><refpurpose>Description of settings and properties of NetworkManager connection profiles</refpurpose></refnamediv><refsect1 id="description"><title>Description</title><para>
+<refentry id="nm-settings"><refentryinfo><title>nm-settings</title><author>NetworkManager developers</author></refentryinfo><refmeta><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum><refmiscinfo class="source">NetworkManager</refmiscinfo><refmiscinfo class="manual">Configuration</refmiscinfo><refmiscinfo class="version">1.4.0</refmiscinfo></refmeta><refnamediv><refname>nm-settings</refname><refpurpose>Description of settings and properties of NetworkManager connection profiles</refpurpose></refnamediv><refsect1 id="description"><title>Description</title><para>
           NetworkManager is based on a concept of connection profiles, sometimes referred to as
           connections only. These connection profiles contain a network configuration. When
           NetworkManager activates a connection profile on a network device the configuration will
@@ -34,377 +34,383 @@
               and properties of this page.
             </para></variablelist></para>
   <table><title>802-1x setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
-    <row><entry align="left">altsubject-matches</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>List of strings to be matched against the altSubjectName of the certificate presented by the authentication server. If the list is empty, no verification of the server certificate's altSubjectName is performed.</entry></row>
-    <row><entry align="left">anonymous-identity</entry><entry align="left">string</entry><entry align="left"/><entry>Anonymous identity string for EAP authentication methods.  Used as the unencrypted identity with EAP types that support different tunneled identity like EAP-TTLS.</entry></row>
-    <row><entry align="left">ca-cert</entry><entry align="left">byte array</entry><entry align="left"/><entry>Contains the CA certificate if used by the EAP method specified in the "eap" property. Certificate data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended.</entry></row>
-    <row><entry align="left">ca-path</entry><entry align="left">string</entry><entry align="left"/><entry>UTF-8 encoded path to a directory containing PEM or DER formatted certificates to be added to the verification chain in addition to the certificate specified in the "ca-cert" property.</entry></row>
-    <row><entry align="left">client-cert</entry><entry align="left">byte array</entry><entry align="left"/><entry>Contains the client certificate if used by the EAP method specified in the "eap" property. Certificate data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte.</entry></row>
-    <row><entry align="left">domain-suffix-match</entry><entry align="left">string</entry><entry align="left"/><entry>Constraint for server domain name. If set, this FQDN is used as a suffix match requirement for dNSName element(s) of the certificate presented by the authentication server.  If a matching dNSName is found, this constraint is met.  If no dNSName values are present, this constraint is matched against SubjectName CN using same suffix match comparison.</entry></row>
-    <row><entry align="left">eap</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>The allowed EAP method to be used when authenticating to the network with 802.1x.  Valid methods are: "leap", "md5", "tls", "peap", "ttls", "pwd", and "fast".  Each method requires different configuration using the properties of this setting; refer to wpa_supplicant documentation for the allowed combinations.</entry></row>
-    <row><entry align="left">identity</entry><entry align="left">string</entry><entry align="left"/><entry>Identity string for EAP authentication methods.  Often the user's user or login name.</entry></row>
-    <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">802-1x</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
-    <row><entry align="left">pac-file</entry><entry align="left">string</entry><entry align="left"/><entry>UTF-8 encoded file path containing PAC for EAP-FAST.</entry></row>
-    <row><entry align="left">password</entry><entry align="left">string</entry><entry align="left"/><entry>UTF-8 encoded password used for EAP authentication methods. If both the "password" property and the "password-raw" property are specified, "password" is preferred.</entry></row>
-    <row><entry align="left">password-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "password" property. (see <xref linkend="secrets-flags"/> for flag values)</entry></row>
-    <row><entry align="left">password-raw</entry><entry align="left">byte array</entry><entry align="left"/><entry>Password used for EAP authentication methods, given as a byte array to allow passwords in other encodings than UTF-8 to be used. If both the "password" property and the "password-raw" property are specified, "password" is preferred.</entry></row>
-    <row><entry align="left">password-raw-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "password-raw" property. (see <xref linkend="secrets-flags"/> for flag values)</entry></row>
-    <row><entry align="left">phase1-fast-provisioning</entry><entry align="left">string</entry><entry align="left"/><entry>Enables or disables in-line provisioning of EAP-FAST credentials when FAST is specified as the EAP method in the "eap" property. Recognized values are "0" (disabled), "1" (allow unauthenticated provisioning), "2" (allow authenticated provisioning), and "3" (allow both authenticated and unauthenticated provisioning).  See the wpa_supplicant documentation for more details.</entry></row>
-    <row><entry align="left">phase1-peaplabel</entry><entry align="left">string</entry><entry align="left"/><entry>Forces use of the new PEAP label during key derivation.  Some RADIUS servers may require forcing the new PEAP label to interoperate with PEAPv1.  Set to "1" to force use of the new PEAP label.  See the wpa_supplicant documentation for more details.</entry></row>
-    <row><entry align="left">phase1-peapver</entry><entry align="left">string</entry><entry align="left"/><entry>Forces which PEAP version is used when PEAP is set as the EAP method in the "eap" property.  When unset, the version reported by the server will be used.  Sometimes when using older RADIUS servers, it is necessary to force the client to use a particular PEAP version.  To do so, this property may be set to "0" or "1" to force that specific PEAP version.</entry></row>
-    <row><entry align="left">phase2-altsubject-matches</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>List of strings to be matched against the altSubjectName of the certificate presented by the authentication server during the inner "phase 2" authentication. If the list is empty, no verification of the server certificate's altSubjectName is performed.</entry></row>
-    <row><entry align="left">phase2-auth</entry><entry align="left">string</entry><entry align="left"/><entry>Specifies the allowed "phase 2" inner non-EAP authentication methods when an EAP method that uses an inner TLS tunnel is specified in the "eap" property.  Recognized non-EAP "phase 2" methods are "pap", "chap", "mschap", "mschapv2", "gtc", "otp", "md5", and "tls". Each "phase 2" inner method requires specific parameters for successful authentication; see the wpa_supplicant documentation for more details.</entry></row>
-    <row><entry align="left">phase2-autheap</entry><entry align="left">string</entry><entry align="left"/><entry>Specifies the allowed "phase 2" inner EAP-based authentication methods when an EAP method that uses an inner TLS tunnel is specified in the "eap" property.  Recognized EAP-based "phase 2" methods are "md5", "mschapv2", "otp", "gtc", and "tls". Each "phase 2" inner method requires specific parameters for successful authentication; see the wpa_supplicant documentation for more details.</entry></row>
-    <row><entry align="left">phase2-ca-cert</entry><entry align="left">byte array</entry><entry align="left"/><entry>Contains the "phase 2" CA certificate if used by the EAP method specified in the "phase2-auth" or "phase2-autheap" properties. Certificate data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended.</entry></row>
-    <row><entry align="left">phase2-ca-path</entry><entry align="left">string</entry><entry align="left"/><entry>UTF-8 encoded path to a directory containing PEM or DER formatted certificates to be added to the verification chain in addition to the certificate specified in the "phase2-ca-cert" property.</entry></row>
-    <row><entry align="left">phase2-client-cert</entry><entry align="left">byte array</entry><entry align="left"/><entry>Contains the "phase 2" client certificate if used by the EAP method specified in the "phase2-auth" or "phase2-autheap" properties. Certificate data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended.</entry></row>
-    <row><entry align="left">phase2-domain-suffix-match</entry><entry align="left">string</entry><entry align="left"/><entry>Constraint for server domain name. If set, this FQDN is used as a suffix match requirement for dNSName element(s) of the certificate presented by the authentication server during the inner "phase 2" authentication.  If a matching dNSName is found, this constraint is met.  If no dNSName values are present, this constraint is matched against SubjectName CN using same suffix match comparison.</entry></row>
-    <row><entry align="left">phase2-private-key</entry><entry align="left">byte array</entry><entry align="left"/><entry>Contains the "phase 2" inner private key when the "phase2-auth" or "phase2-autheap" property is set to "tls". Key data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme and private keys, this property should be set to the key's encrypted PEM encoded data. When using private keys with the path scheme, this property should be set to the full UTF-8 encoded path of the key, prefixed with the string "file://" and ending with a terminating NUL byte. When using PKCS#12 format private keys and the blob scheme, this property should be set to the PKCS#12 data and the "phase2-private-key-password" property must be set to password used to decrypt the PKCS#12 certificate and key. When using PKCS#12 files and the path scheme, this property should be set to the full UTF-8 encoded path of the key, prefixed with the string "file://" and and ending with a terminating NUL byte, and as with the blob scheme the "phase2-private-key-password" property must be set to the password used to decode the PKCS#12 private key and certificate.</entry></row>
-    <row><entry align="left">phase2-private-key-password</entry><entry align="left">string</entry><entry align="left"/><entry>The password used to decrypt the "phase 2" private key specified in the "phase2-private-key" property when the private key either uses the path scheme, or is a PKCS#12 format key.</entry></row>
-    <row><entry align="left">phase2-private-key-password-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "phase2-private-key-password" property. (see <xref linkend="secrets-flags"/> for flag values)</entry></row>
-    <row><entry align="left">phase2-subject-match</entry><entry align="left">string</entry><entry align="left"/><entry>Substring to be matched against the subject of the certificate presented by the authentication server during the inner "phase 2" authentication. When unset, no verification of the authentication server certificate's subject is performed.  This property provides little security, if any, and its use is deprecated in favor of NMSetting8021x:phase2-domain-suffix-match.</entry></row>
-    <row><entry align="left">pin</entry><entry align="left">string</entry><entry align="left"/><entry>PIN used for EAP authentication methods.</entry></row>
-    <row><entry align="left">pin-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "pin" property. (see <xref linkend="secrets-flags"/> for flag values)</entry></row>
-    <row><entry align="left">private-key</entry><entry align="left">byte array</entry><entry align="left"/><entry>Contains the private key when the "eap" property is set to "tls". Key data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme and private keys, this property should be set to the key's encrypted PEM encoded data. When using private keys with the path scheme, this property should be set to the full UTF-8 encoded path of the key, prefixed with the string "file://" and ending with a terminating NUL byte. When using PKCS#12 format private keys and the blob scheme, this property should be set to the PKCS#12 data and the "private-key-password" property must be set to password used to decrypt the PKCS#12 certificate and key. When using PKCS#12 files and the path scheme, this property should be set to the full UTF-8 encoded path of the key, prefixed with the string "file://" and and ending with a terminating NUL byte, and as with the blob scheme the "private-key-password" property must be set to the password used to decode the PKCS#12 private key and certificate. WARNING: "private-key" is not a "secret" property, and thus unencrypted private key data using the BLOB scheme may be readable by unprivileged users.  Private keys should always be encrypted with a private key password to prevent unauthorized access to unencrypted private key data.</entry></row>
-    <row><entry align="left">private-key-password</entry><entry align="left">string</entry><entry align="left"/><entry>The password used to decrypt the private key specified in the "private-key" property when the private key either uses the path scheme, or if the private key is a PKCS#12 format key.</entry></row>
-    <row><entry align="left">private-key-password-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "private-key-password" property. (see <xref linkend="secrets-flags"/> for flag values)</entry></row>
-    <row><entry align="left">subject-match</entry><entry align="left">string</entry><entry align="left"/><entry>Substring to be matched against the subject of the certificate presented by the authentication server. When unset, no verification of the authentication server certificate's subject is performed.  This property provides little security, if any, and its use is deprecated in favor of NMSetting8021x:domain-suffix-match.</entry></row>
-    <row><entry align="left">system-ca-certs</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>When TRUE, overrides the "ca-path" and "phase2-ca-path" properties using the system CA directory specified at configure time with the --system-ca-path switch.  The certificates in this directory are added to the verification chain in addition to any certificates specified by the "ca-cert" and "phase2-ca-cert" properties. If the path provided with --system-ca-path is rather a file name (bundle of trusted CA certificates), it overrides "ca-cert" and "phase2-ca-cert" properties instead (sets ca_cert/ca_cert2 options for wpa_supplicant).</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-1x.altsubject-matches">altsubject-matches</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>List of strings to be matched against the altSubjectName of the certificate presented by the authentication server. If the list is empty, no verification of the server certificate's altSubjectName is performed.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-1x.anonymous-identity">anonymous-identity</entry><entry align="left">string</entry><entry align="left"/><entry>Anonymous identity string for EAP authentication methods.  Used as the unencrypted identity with EAP types that support different tunneled identity like EAP-TTLS.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-1x.ca-cert">ca-cert</entry><entry align="left">byte array</entry><entry align="left"/><entry>Contains the CA certificate if used by the EAP method specified in the "eap" property. Certificate data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-1x.ca-path">ca-path</entry><entry align="left">string</entry><entry align="left"/><entry>UTF-8 encoded path to a directory containing PEM or DER formatted certificates to be added to the verification chain in addition to the certificate specified in the "ca-cert" property.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-1x.client-cert">client-cert</entry><entry align="left">byte array</entry><entry align="left"/><entry>Contains the client certificate if used by the EAP method specified in the "eap" property. Certificate data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-1x.domain-suffix-match">domain-suffix-match</entry><entry align="left">string</entry><entry align="left"/><entry>Constraint for server domain name. If set, this FQDN is used as a suffix match requirement for dNSName element(s) of the certificate presented by the authentication server.  If a matching dNSName is found, this constraint is met.  If no dNSName values are present, this constraint is matched against SubjectName CN using same suffix match comparison.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-1x.eap">eap</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>The allowed EAP method to be used when authenticating to the network with 802.1x.  Valid methods are: "leap", "md5", "tls", "peap", "ttls", "pwd", and "fast".  Each method requires different configuration using the properties of this setting; refer to wpa_supplicant documentation for the allowed combinations.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-1x.identity">identity</entry><entry align="left">string</entry><entry align="left"/><entry>Identity string for EAP authentication methods.  Often the user's user or login name.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-1x.name">name</entry><entry align="left">string</entry><entry align="left">802-1x</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-1x.pac-file">pac-file</entry><entry align="left">string</entry><entry align="left"/><entry>UTF-8 encoded file path containing PAC for EAP-FAST.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-1x.password">password</entry><entry align="left">string</entry><entry align="left"/><entry>UTF-8 encoded password used for EAP authentication methods. If both the "password" property and the "password-raw" property are specified, "password" is preferred.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-1x.password-flags">password-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "password" property. (see <xref linkend="secrets-flags"/> for flag values)</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-1x.password-raw">password-raw</entry><entry align="left">byte array</entry><entry align="left"/><entry>Password used for EAP authentication methods, given as a byte array to allow passwords in other encodings than UTF-8 to be used. If both the "password" property and the "password-raw" property are specified, "password" is preferred.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-1x.password-raw-flags">password-raw-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "password-raw" property. (see <xref linkend="secrets-flags"/> for flag values)</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-1x.phase1-fast-provisioning">phase1-fast-provisioning</entry><entry align="left">string</entry><entry align="left"/><entry>Enables or disables in-line provisioning of EAP-FAST credentials when FAST is specified as the EAP method in the "eap" property. Recognized values are "0" (disabled), "1" (allow unauthenticated provisioning), "2" (allow authenticated provisioning), and "3" (allow both authenticated and unauthenticated provisioning).  See the wpa_supplicant documentation for more details.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-1x.phase1-peaplabel">phase1-peaplabel</entry><entry align="left">string</entry><entry align="left"/><entry>Forces use of the new PEAP label during key derivation.  Some RADIUS servers may require forcing the new PEAP label to interoperate with PEAPv1.  Set to "1" to force use of the new PEAP label.  See the wpa_supplicant documentation for more details.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-1x.phase1-peapver">phase1-peapver</entry><entry align="left">string</entry><entry align="left"/><entry>Forces which PEAP version is used when PEAP is set as the EAP method in the "eap" property.  When unset, the version reported by the server will be used.  Sometimes when using older RADIUS servers, it is necessary to force the client to use a particular PEAP version.  To do so, this property may be set to "0" or "1" to force that specific PEAP version.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-1x.phase2-altsubject-matches">phase2-altsubject-matches</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>List of strings to be matched against the altSubjectName of the certificate presented by the authentication server during the inner "phase 2" authentication. If the list is empty, no verification of the server certificate's altSubjectName is performed.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-1x.phase2-auth">phase2-auth</entry><entry align="left">string</entry><entry align="left"/><entry>Specifies the allowed "phase 2" inner non-EAP authentication methods when an EAP method that uses an inner TLS tunnel is specified in the "eap" property.  Recognized non-EAP "phase 2" methods are "pap", "chap", "mschap", "mschapv2", "gtc", "otp", "md5", and "tls". Each "phase 2" inner method requires specific parameters for successful authentication; see the wpa_supplicant documentation for more details.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-1x.phase2-autheap">phase2-autheap</entry><entry align="left">string</entry><entry align="left"/><entry>Specifies the allowed "phase 2" inner EAP-based authentication methods when an EAP method that uses an inner TLS tunnel is specified in the "eap" property.  Recognized EAP-based "phase 2" methods are "md5", "mschapv2", "otp", "gtc", and "tls". Each "phase 2" inner method requires specific parameters for successful authentication; see the wpa_supplicant documentation for more details.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-1x.phase2-ca-cert">phase2-ca-cert</entry><entry align="left">byte array</entry><entry align="left"/><entry>Contains the "phase 2" CA certificate if used by the EAP method specified in the "phase2-auth" or "phase2-autheap" properties. Certificate data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-1x.phase2-ca-path">phase2-ca-path</entry><entry align="left">string</entry><entry align="left"/><entry>UTF-8 encoded path to a directory containing PEM or DER formatted certificates to be added to the verification chain in addition to the certificate specified in the "phase2-ca-cert" property.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-1x.phase2-client-cert">phase2-client-cert</entry><entry align="left">byte array</entry><entry align="left"/><entry>Contains the "phase 2" client certificate if used by the EAP method specified in the "phase2-auth" or "phase2-autheap" properties. Certificate data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-1x.phase2-domain-suffix-match">phase2-domain-suffix-match</entry><entry align="left">string</entry><entry align="left"/><entry>Constraint for server domain name. If set, this FQDN is used as a suffix match requirement for dNSName element(s) of the certificate presented by the authentication server during the inner "phase 2" authentication.  If a matching dNSName is found, this constraint is met.  If no dNSName values are present, this constraint is matched against SubjectName CN using same suffix match comparison.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-1x.phase2-private-key">phase2-private-key</entry><entry align="left">byte array</entry><entry align="left"/><entry>Contains the "phase 2" inner private key when the "phase2-auth" or "phase2-autheap" property is set to "tls". Key data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme and private keys, this property should be set to the key's encrypted PEM encoded data. When using private keys with the path scheme, this property should be set to the full UTF-8 encoded path of the key, prefixed with the string "file://" and ending with a terminating NUL byte. When using PKCS#12 format private keys and the blob scheme, this property should be set to the PKCS#12 data and the "phase2-private-key-password" property must be set to password used to decrypt the PKCS#12 certificate and key. When using PKCS#12 files and the path scheme, this property should be set to the full UTF-8 encoded path of the key, prefixed with the string "file://" and and ending with a terminating NUL byte, and as with the blob scheme the "phase2-private-key-password" property must be set to the password used to decode the PKCS#12 private key and certificate.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-1x.phase2-private-key-password">phase2-private-key-password</entry><entry align="left">string</entry><entry align="left"/><entry>The password used to decrypt the "phase 2" private key specified in the "phase2-private-key" property when the private key either uses the path scheme, or is a PKCS#12 format key.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-1x.phase2-private-key-password-flags">phase2-private-key-password-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "phase2-private-key-password" property. (see <xref linkend="secrets-flags"/> for flag values)</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-1x.phase2-subject-match">phase2-subject-match</entry><entry align="left">string</entry><entry align="left"/><entry>Substring to be matched against the subject of the certificate presented by the authentication server during the inner "phase 2" authentication. When unset, no verification of the authentication server certificate's subject is performed.  This property provides little security, if any, and its use is deprecated in favor of NMSetting8021x:phase2-domain-suffix-match.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-1x.pin">pin</entry><entry align="left">string</entry><entry align="left"/><entry>PIN used for EAP authentication methods.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-1x.pin-flags">pin-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "pin" property. (see <xref linkend="secrets-flags"/> for flag values)</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-1x.private-key">private-key</entry><entry align="left">byte array</entry><entry align="left"/><entry>Contains the private key when the "eap" property is set to "tls". Key data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme and private keys, this property should be set to the key's encrypted PEM encoded data. When using private keys with the path scheme, this property should be set to the full UTF-8 encoded path of the key, prefixed with the string "file://" and ending with a terminating NUL byte. When using PKCS#12 format private keys and the blob scheme, this property should be set to the PKCS#12 data and the "private-key-password" property must be set to password used to decrypt the PKCS#12 certificate and key. When using PKCS#12 files and the path scheme, this property should be set to the full UTF-8 encoded path of the key, prefixed with the string "file://" and and ending with a terminating NUL byte, and as with the blob scheme the "private-key-password" property must be set to the password used to decode the PKCS#12 private key and certificate. WARNING: "private-key" is not a "secret" property, and thus unencrypted private key data using the BLOB scheme may be readable by unprivileged users.  Private keys should always be encrypted with a private key password to prevent unauthorized access to unencrypted private key data.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-1x.private-key-password">private-key-password</entry><entry align="left">string</entry><entry align="left"/><entry>The password used to decrypt the private key specified in the "private-key" property when the private key either uses the path scheme, or if the private key is a PKCS#12 format key.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-1x.private-key-password-flags">private-key-password-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "private-key-password" property. (see <xref linkend="secrets-flags"/> for flag values)</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-1x.subject-match">subject-match</entry><entry align="left">string</entry><entry align="left"/><entry>Substring to be matched against the subject of the certificate presented by the authentication server. When unset, no verification of the authentication server certificate's subject is performed.  This property provides little security, if any, and its use is deprecated in favor of NMSetting8021x:domain-suffix-match.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-1x.system-ca-certs">system-ca-certs</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>When TRUE, overrides the "ca-path" and "phase2-ca-path" properties using the system CA directory specified at configure time with the --system-ca-path switch.  The certificates in this directory are added to the verification chain in addition to any certificates specified by the "ca-cert" and "phase2-ca-cert" properties. If the path provided with --system-ca-path is rather a file name (bundle of trusted CA certificates), it overrides "ca-cert" and "phase2-ca-cert" properties instead (sets ca_cert/ca_cert2 options for wpa_supplicant).</entry></row>
   </tbody></tgroup></table>
   <table><title>adsl setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
-    <row><entry align="left">encapsulation</entry><entry align="left">string</entry><entry align="left"/><entry>Encapsulation of ADSL connection.  Can be "vcmux" or "llc".</entry></row>
-    <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">adsl</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
-    <row><entry align="left">password</entry><entry align="left">string</entry><entry align="left"/><entry>Password used to authenticate with the ADSL service.</entry></row>
-    <row><entry align="left">password-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "password" property. (see <xref linkend="secrets-flags"/> for flag values)</entry></row>
-    <row><entry align="left">protocol</entry><entry align="left">string</entry><entry align="left"/><entry>ADSL connection protocol.  Can be "pppoa", "pppoe" or "ipoatm".</entry></row>
-    <row><entry align="left">username</entry><entry align="left">string</entry><entry align="left"/><entry>Username used to authenticate with the ADSL service.</entry></row>
-    <row><entry align="left">vci</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>VCI of ADSL connection</entry></row>
-    <row><entry align="left">vpi</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>VPI of ADSL connection</entry></row>
+    <row><entry align="left" id="nm-settings.property.adsl.encapsulation">encapsulation</entry><entry align="left">string</entry><entry align="left"/><entry>Encapsulation of ADSL connection.  Can be "vcmux" or "llc".</entry></row>
+    <row><entry align="left" id="nm-settings.property.adsl.name">name</entry><entry align="left">string</entry><entry align="left">adsl</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
+    <row><entry align="left" id="nm-settings.property.adsl.password">password</entry><entry align="left">string</entry><entry align="left"/><entry>Password used to authenticate with the ADSL service.</entry></row>
+    <row><entry align="left" id="nm-settings.property.adsl.password-flags">password-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "password" property. (see <xref linkend="secrets-flags"/> for flag values)</entry></row>
+    <row><entry align="left" id="nm-settings.property.adsl.protocol">protocol</entry><entry align="left">string</entry><entry align="left"/><entry>ADSL connection protocol.  Can be "pppoa", "pppoe" or "ipoatm".</entry></row>
+    <row><entry align="left" id="nm-settings.property.adsl.username">username</entry><entry align="left">string</entry><entry align="left"/><entry>Username used to authenticate with the ADSL service.</entry></row>
+    <row><entry align="left" id="nm-settings.property.adsl.vci">vci</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>VCI of ADSL connection</entry></row>
+    <row><entry align="left" id="nm-settings.property.adsl.vpi">vpi</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>VPI of ADSL connection</entry></row>
   </tbody></tgroup></table>
   <table><title>bluetooth setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
-    <row><entry align="left">bdaddr</entry><entry align="left">byte array</entry><entry align="left"/><entry>The Bluetooth address of the device.</entry></row>
-    <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">bluetooth</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
-    <row><entry align="left">type</entry><entry align="left">string</entry><entry align="left"/><entry>Either "dun" for Dial-Up Networking connections or "panu" for Personal Area Networking connections to devices supporting the NAP profile.</entry></row>
+    <row><entry align="left" id="nm-settings.property.bluetooth.bdaddr">bdaddr</entry><entry align="left">byte array</entry><entry align="left"/><entry>The Bluetooth address of the device.</entry></row>
+    <row><entry align="left" id="nm-settings.property.bluetooth.name">name</entry><entry align="left">string</entry><entry align="left">bluetooth</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
+    <row><entry align="left" id="nm-settings.property.bluetooth.type">type</entry><entry align="left">string</entry><entry align="left"/><entry>Either "dun" for Dial-Up Networking connections or "panu" for Personal Area Networking connections to devices supporting the NAP profile.</entry></row>
   </tbody></tgroup></table>
   <table><title>bond setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
-    <row><entry align="left">interface-name</entry><entry align="left">string</entry><entry align="left"/><entry>Deprecated in favor of connection.interface-name, but can be used for backward-compatibility with older daemons, to set the bond's interface name.</entry></row>
-    <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">bond</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
-    <row><entry align="left">options</entry><entry align="left">dict of string to string</entry><entry align="left">{'mode': 'balance-rr'}</entry><entry>Dictionary of key/value pairs of bonding options.  Both keys and values must be strings. Option names must contain only alphanumeric characters (ie, [a-zA-Z0-9]).</entry></row>
+    <row><entry align="left" id="nm-settings.property.bond.interface-name">interface-name</entry><entry align="left">string</entry><entry align="left"/><entry>Deprecated in favor of connection.interface-name, but can be used for backward-compatibility with older daemons, to set the bond's interface name.</entry></row>
+    <row><entry align="left" id="nm-settings.property.bond.name">name</entry><entry align="left">string</entry><entry align="left">bond</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
+    <row><entry align="left" id="nm-settings.property.bond.options">options</entry><entry align="left">dict of string to string</entry><entry align="left">{'mode': 'balance-rr'}</entry><entry>Dictionary of key/value pairs of bonding options.  Both keys and values must be strings. Option names must contain only alphanumeric characters (ie, [a-zA-Z0-9]).</entry></row>
   </tbody></tgroup></table>
   <table><title>bridge setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
-    <row><entry align="left">ageing-time</entry><entry align="left">uint32</entry><entry align="left">300</entry><entry>The Ethernet MAC address aging time, in seconds.</entry></row>
-    <row><entry align="left">forward-delay</entry><entry align="left">uint32</entry><entry align="left">15</entry><entry>The Spanning Tree Protocol (STP) forwarding delay, in seconds.</entry></row>
-    <row><entry align="left">hello-time</entry><entry align="left">uint32</entry><entry align="left">2</entry><entry>The Spanning Tree Protocol (STP) hello time, in seconds.</entry></row>
-    <row><entry align="left">interface-name</entry><entry align="left">string</entry><entry align="left"/><entry>Deprecated in favor of connection.interface-name, but can be used for backward-compatibility with older daemons, to set the bridge's interface name.</entry></row>
-    <row><entry align="left">mac-address</entry><entry align="left">byte array</entry><entry align="left"/><entry>If specified, the MAC address of bridge. When creating a new bridge, this MAC address will be set. When matching an existing (outside NetworkManager created) bridge, this MAC address must match.</entry></row>
-    <row><entry align="left">max-age</entry><entry align="left">uint32</entry><entry align="left">20</entry><entry>The Spanning Tree Protocol (STP) maximum message age, in seconds.</entry></row>
-    <row><entry align="left">multicast-snooping</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>Controls whether IGMP snooping is enabled for this bridge. Note that if snooping was automatically disabled due to hash collisions, the system may refuse to enable the feature until the collisions are resolved.</entry></row>
-    <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">bridge</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
-    <row><entry align="left">priority</entry><entry align="left">uint32</entry><entry align="left">32768</entry><entry>Sets the Spanning Tree Protocol (STP) priority for this bridge.  Lower values are "better"; the lowest priority bridge will be elected the root bridge.</entry></row>
-    <row><entry align="left">stp</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>Controls whether Spanning Tree Protocol (STP) is enabled for this bridge.</entry></row>
+    <row><entry align="left" id="nm-settings.property.bridge.ageing-time">ageing-time</entry><entry align="left">uint32</entry><entry align="left">300</entry><entry>The Ethernet MAC address aging time, in seconds.</entry></row>
+    <row><entry align="left" id="nm-settings.property.bridge.forward-delay">forward-delay</entry><entry align="left">uint32</entry><entry align="left">15</entry><entry>The Spanning Tree Protocol (STP) forwarding delay, in seconds.</entry></row>
+    <row><entry align="left" id="nm-settings.property.bridge.hello-time">hello-time</entry><entry align="left">uint32</entry><entry align="left">2</entry><entry>The Spanning Tree Protocol (STP) hello time, in seconds.</entry></row>
+    <row><entry align="left" id="nm-settings.property.bridge.interface-name">interface-name</entry><entry align="left">string</entry><entry align="left"/><entry>Deprecated in favor of connection.interface-name, but can be used for backward-compatibility with older daemons, to set the bridge's interface name.</entry></row>
+    <row><entry align="left" id="nm-settings.property.bridge.mac-address">mac-address</entry><entry align="left">byte array</entry><entry align="left"/><entry>If specified, the MAC address of bridge. When creating a new bridge, this MAC address will be set. When matching an existing (outside NetworkManager created) bridge, this MAC address must match.</entry></row>
+    <row><entry align="left" id="nm-settings.property.bridge.max-age">max-age</entry><entry align="left">uint32</entry><entry align="left">20</entry><entry>The Spanning Tree Protocol (STP) maximum message age, in seconds.</entry></row>
+    <row><entry align="left" id="nm-settings.property.bridge.multicast-snooping">multicast-snooping</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>Controls whether IGMP snooping is enabled for this bridge. Note that if snooping was automatically disabled due to hash collisions, the system may refuse to enable the feature until the collisions are resolved.</entry></row>
+    <row><entry align="left" id="nm-settings.property.bridge.name">name</entry><entry align="left">string</entry><entry align="left">bridge</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
+    <row><entry align="left" id="nm-settings.property.bridge.priority">priority</entry><entry align="left">uint32</entry><entry align="left">32768</entry><entry>Sets the Spanning Tree Protocol (STP) priority for this bridge.  Lower values are "better"; the lowest priority bridge will be elected the root bridge.</entry></row>
+    <row><entry align="left" id="nm-settings.property.bridge.stp">stp</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>Controls whether Spanning Tree Protocol (STP) is enabled for this bridge.</entry></row>
   </tbody></tgroup></table>
   <table><title>bridge-port setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
-    <row><entry align="left">hairpin-mode</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>Enables or disabled "hairpin mode" for the port, which allows frames to be sent back out through the port the frame was received on.</entry></row>
-    <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">bridge-port</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
-    <row><entry align="left">path-cost</entry><entry align="left">uint32</entry><entry align="left">100</entry><entry>The Spanning Tree Protocol (STP) port cost for destinations via this port.</entry></row>
-    <row><entry align="left">priority</entry><entry align="left">uint32</entry><entry align="left">32</entry><entry>The Spanning Tree Protocol (STP) priority of this bridge port.</entry></row>
+    <row><entry align="left" id="nm-settings.property.bridge-port.hairpin-mode">hairpin-mode</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>Enables or disabled "hairpin mode" for the port, which allows frames to be sent back out through the port the frame was received on.</entry></row>
+    <row><entry align="left" id="nm-settings.property.bridge-port.name">name</entry><entry align="left">string</entry><entry align="left">bridge-port</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
+    <row><entry align="left" id="nm-settings.property.bridge-port.path-cost">path-cost</entry><entry align="left">uint32</entry><entry align="left">100</entry><entry>The Spanning Tree Protocol (STP) port cost for destinations via this port.</entry></row>
+    <row><entry align="left" id="nm-settings.property.bridge-port.priority">priority</entry><entry align="left">uint32</entry><entry align="left">32</entry><entry>The Spanning Tree Protocol (STP) priority of this bridge port.</entry></row>
   </tbody></tgroup></table>
   <table><title>cdma setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
-    <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">cdma</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
-    <row><entry align="left">number</entry><entry align="left">string</entry><entry align="left"/><entry>The number to dial to establish the connection to the CDMA-based mobile broadband network, if any.  If not specified, the default number (#777) is used when required.</entry></row>
-    <row><entry align="left">password</entry><entry align="left">string</entry><entry align="left"/><entry>The password used to authenticate with the network, if required.  Many providers do not require a password, or accept any password.  But if a password is required, it is specified here.</entry></row>
-    <row><entry align="left">password-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "password" property. (see <xref linkend="secrets-flags"/> for flag values)</entry></row>
-    <row><entry align="left">username</entry><entry align="left">string</entry><entry align="left"/><entry>The username used to authenticate with the network, if required.  Many providers do not require a username, or accept any username.  But if a username is required, it is specified here.</entry></row>
+    <row><entry align="left" id="nm-settings.property.cdma.name">name</entry><entry align="left">string</entry><entry align="left">cdma</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
+    <row><entry align="left" id="nm-settings.property.cdma.number">number</entry><entry align="left">string</entry><entry align="left"/><entry>The number to dial to establish the connection to the CDMA-based mobile broadband network, if any.  If not specified, the default number (#777) is used when required.</entry></row>
+    <row><entry align="left" id="nm-settings.property.cdma.password">password</entry><entry align="left">string</entry><entry align="left"/><entry>The password used to authenticate with the network, if required.  Many providers do not require a password, or accept any password.  But if a password is required, it is specified here.</entry></row>
+    <row><entry align="left" id="nm-settings.property.cdma.password-flags">password-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "password" property. (see <xref linkend="secrets-flags"/> for flag values)</entry></row>
+    <row><entry align="left" id="nm-settings.property.cdma.username">username</entry><entry align="left">string</entry><entry align="left"/><entry>The username used to authenticate with the network, if required.  Many providers do not require a username, or accept any username.  But if a username is required, it is specified here.</entry></row>
   </tbody></tgroup></table>
   <table><title>connection setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
-    <row><entry align="left">autoconnect</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>Whether or not the connection should be automatically connected by NetworkManager when the resources for the connection are available. TRUE to automatically activate the connection, FALSE to require manual intervention to activate the connection.</entry></row>
-    <row><entry align="left">autoconnect-priority</entry><entry align="left">int32</entry><entry align="left">0</entry><entry>The autoconnect priority. If the connection is set to autoconnect, connections with higher priority will be preferred. Defaults to 0. The higher number means higher priority.</entry></row>
-    <row><entry align="left">autoconnect-slaves</entry><entry align="left">NMSettingConnectionAutoconnectSlaves (int32)</entry><entry align="left"/><entry>Whether or not slaves of this connection should be automatically brought up when NetworkManager activates this connection. This only has a real effect for master connections. The permitted values are: 0: leave slave connections untouched, 1: activate all the slave connections with this connection, -1: default. If -1 (default) is set, global connection.autoconnect-slaves is read to determine the real value. If it is default as well, this fallbacks to 0.</entry></row>
-    <row><entry align="left">gateway-ping-timeout</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>If greater than zero, delay success of IP addressing until either the timeout is reached, or an IP gateway replies to a ping.</entry></row>
-    <row><entry align="left">id</entry><entry align="left">string</entry><entry align="left"/><entry>A human readable unique identifier for the connection, like "Work Wi-Fi" or "T-Mobile 3G".</entry></row>
-    <row><entry align="left">interface-name</entry><entry align="left">string</entry><entry align="left"/><entry>The name of the network interface this connection is bound to. If not set, then the connection can be attached to any interface of the appropriate type (subject to restrictions imposed by other settings). For software devices this specifies the name of the created device. For connection types where interface names cannot easily be made persistent (e.g. mobile broadband or USB Ethernet), this property should not be used. Setting this property restricts the interfaces a connection can be used with, and if interface names change or are reordered the connection may be applied to the wrong interface.</entry></row>
-    <row><entry align="left">lldp</entry><entry align="left">int32</entry><entry align="left">-1</entry><entry>Whether LLDP is enabled for the connection.</entry></row>
-    <row><entry align="left">master</entry><entry align="left">string</entry><entry align="left"/><entry>Interface name of the master device or UUID of the master connection.</entry></row>
-    <row><entry align="left">metered</entry><entry align="left">NMMetered (int32)</entry><entry align="left"/><entry>Whether the connection is metered. When updating this property on a currently activated connection, the change takes effect immediately.</entry></row>
-    <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">connection</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
-    <row><entry align="left">permissions</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>An array of strings defining what access a given user has to this connection.  If this is NULL or empty, all users are allowed to access this connection.  Otherwise a user is allowed to access this connection if and only if they are in this list. Each entry is of the form "[type]:[id]:[reserved]"; for example, "user:dcbw:blah". At this time only the "user" [type] is allowed.  Any other values are ignored and reserved for future use.  [id] is the username that this permission refers to, which may not contain the ":" character. Any [reserved] information present must be ignored and is reserved for future use.  All of [type], [id], and [reserved] must be valid UTF-8.</entry></row>
-    <row><entry align="left">read-only</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>FALSE if the connection can be modified using the provided settings service's D-Bus interface with the right privileges, or TRUE if the connection is read-only and cannot be modified.</entry></row>
-    <row><entry align="left">secondaries</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>List of connection UUIDs that should be activated when the base connection itself is activated. Currently only VPN connections are supported.</entry></row>
-    <row><entry align="left">slave-type</entry><entry align="left">string</entry><entry align="left"/><entry>Setting name of the device type of this slave's master connection (eg, "bond"), or NULL if this connection is not a slave.</entry></row>
-    <row><entry align="left">timestamp</entry><entry align="left">uint64</entry><entry align="left">0</entry><entry>The time, in seconds since the Unix Epoch, that the connection was last _successfully_ fully activated. NetworkManager updates the connection timestamp periodically when the connection is active to ensure that an active connection has the latest timestamp. The property is only meant for reading (changes to this property will not be preserved).</entry></row>
-    <row><entry align="left">type</entry><entry align="left">string</entry><entry align="left"/><entry>Base type of the connection. For hardware-dependent connections, should contain the setting name of the hardware-type specific setting (ie, "802-3-ethernet" or "802-11-wireless" or "bluetooth", etc), and for non-hardware dependent connections like VPN or otherwise, should contain the setting name of that setting type (ie, "vpn" or "bridge", etc).</entry></row>
-    <row><entry align="left">uuid</entry><entry align="left">string</entry><entry align="left"/><entry>A universally unique identifier for the connection, for example generated with libuuid.  It should be assigned when the connection is created, and never changed as long as the connection still applies to the same network.  For example, it should not be changed when the "id" property or NMSettingIP4Config changes, but might need to be re-created when the Wi-Fi SSID, mobile broadband network provider, or "type" property changes. The UUID must be in the format "2815492f-7e56-435e-b2e9-246bd7cdc664" (ie, contains only hexadecimal characters and "-").</entry></row>
-    <row><entry align="left">zone</entry><entry align="left">string</entry><entry align="left"/><entry>The trust level of a the connection.  Free form case-insensitive string (for example "Home", "Work", "Public").  NULL or unspecified zone means the connection will be placed in the default zone as defined by the firewall. When updating this property on a currently activated connection, the change takes effect immediately.</entry></row>
+    <row><entry align="left" id="nm-settings.property.connection.autoconnect">autoconnect</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>Whether or not the connection should be automatically connected by NetworkManager when the resources for the connection are available. TRUE to automatically activate the connection, FALSE to require manual intervention to activate the connection.</entry></row>
+    <row><entry align="left" id="nm-settings.property.connection.autoconnect-priority">autoconnect-priority</entry><entry align="left">int32</entry><entry align="left">0</entry><entry>The autoconnect priority. If the connection is set to autoconnect, connections with higher priority will be preferred. Defaults to 0. The higher number means higher priority.</entry></row>
+    <row><entry align="left" id="nm-settings.property.connection.autoconnect-slaves">autoconnect-slaves</entry><entry align="left">NMSettingConnectionAutoconnectSlaves (int32)</entry><entry align="left"/><entry>Whether or not slaves of this connection should be automatically brought up when NetworkManager activates this connection. This only has a real effect for master connections. The permitted values are: 0: leave slave connections untouched, 1: activate all the slave connections with this connection, -1: default. If -1 (default) is set, global connection.autoconnect-slaves is read to determine the real value. If it is default as well, this fallbacks to 0.</entry></row>
+    <row><entry align="left" id="nm-settings.property.connection.gateway-ping-timeout">gateway-ping-timeout</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>If greater than zero, delay success of IP addressing until either the timeout is reached, or an IP gateway replies to a ping.</entry></row>
+    <row><entry align="left" id="nm-settings.property.connection.id">id</entry><entry align="left">string</entry><entry align="left"/><entry>A human readable unique identifier for the connection, like "Work Wi-Fi" or "T-Mobile 3G".</entry></row>
+    <row><entry align="left" id="nm-settings.property.connection.interface-name">interface-name</entry><entry align="left">string</entry><entry align="left"/><entry>The name of the network interface this connection is bound to. If not set, then the connection can be attached to any interface of the appropriate type (subject to restrictions imposed by other settings). For software devices this specifies the name of the created device. For connection types where interface names cannot easily be made persistent (e.g. mobile broadband or USB Ethernet), this property should not be used. Setting this property restricts the interfaces a connection can be used with, and if interface names change or are reordered the connection may be applied to the wrong interface.</entry></row>
+    <row><entry align="left" id="nm-settings.property.connection.lldp">lldp</entry><entry align="left">int32</entry><entry align="left">-1</entry><entry>Whether LLDP is enabled for the connection.</entry></row>
+    <row><entry align="left" id="nm-settings.property.connection.master">master</entry><entry align="left">string</entry><entry align="left"/><entry>Interface name of the master device or UUID of the master connection.</entry></row>
+    <row><entry align="left" id="nm-settings.property.connection.metered">metered</entry><entry align="left">NMMetered (int32)</entry><entry align="left"/><entry>Whether the connection is metered. When updating this property on a currently activated connection, the change takes effect immediately.</entry></row>
+    <row><entry align="left" id="nm-settings.property.connection.name">name</entry><entry align="left">string</entry><entry align="left">connection</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
+    <row><entry align="left" id="nm-settings.property.connection.permissions">permissions</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>An array of strings defining what access a given user has to this connection.  If this is NULL or empty, all users are allowed to access this connection.  Otherwise a user is allowed to access this connection if and only if they are in this list. Each entry is of the form "[type]:[id]:[reserved]"; for example, "user:dcbw:blah". At this time only the "user" [type] is allowed.  Any other values are ignored and reserved for future use.  [id] is the username that this permission refers to, which may not contain the ":" character. Any [reserved] information present must be ignored and is reserved for future use.  All of [type], [id], and [reserved] must be valid UTF-8.</entry></row>
+    <row><entry align="left" id="nm-settings.property.connection.read-only">read-only</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>FALSE if the connection can be modified using the provided settings service's D-Bus interface with the right privileges, or TRUE if the connection is read-only and cannot be modified.</entry></row>
+    <row><entry align="left" id="nm-settings.property.connection.secondaries">secondaries</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>List of connection UUIDs that should be activated when the base connection itself is activated. Currently only VPN connections are supported.</entry></row>
+    <row><entry align="left" id="nm-settings.property.connection.slave-type">slave-type</entry><entry align="left">string</entry><entry align="left"/><entry>Setting name of the device type of this slave's master connection (eg, "bond"), or NULL if this connection is not a slave.</entry></row>
+    <row><entry align="left" id="nm-settings.property.connection.stable-id">stable-id</entry><entry align="left">string</entry><entry align="left"/><entry>This token to generate stable IDs for the connection. If unset, the UUID will be used instead. The stable-id is used instead of the connection UUID for generating IPv6 stable private addresses with ipv6.addr-gen-mode=stable-privacy. It is also used to seed the generated cloned MAC address for ethernet.cloned-mac-address=stable and wifi.cloned-mac-address=stable.</entry></row>
+    <row><entry align="left" id="nm-settings.property.connection.timestamp">timestamp</entry><entry align="left">uint64</entry><entry align="left">0</entry><entry>The time, in seconds since the Unix Epoch, that the connection was last _successfully_ fully activated. NetworkManager updates the connection timestamp periodically when the connection is active to ensure that an active connection has the latest timestamp. The property is only meant for reading (changes to this property will not be preserved).</entry></row>
+    <row><entry align="left" id="nm-settings.property.connection.type">type</entry><entry align="left">string</entry><entry align="left"/><entry>Base type of the connection. For hardware-dependent connections, should contain the setting name of the hardware-type specific setting (ie, "802-3-ethernet" or "802-11-wireless" or "bluetooth", etc), and for non-hardware dependent connections like VPN or otherwise, should contain the setting name of that setting type (ie, "vpn" or "bridge", etc).</entry></row>
+    <row><entry align="left" id="nm-settings.property.connection.uuid">uuid</entry><entry align="left">string</entry><entry align="left"/><entry>A universally unique identifier for the connection, for example generated with libuuid.  It should be assigned when the connection is created, and never changed as long as the connection still applies to the same network.  For example, it should not be changed when the "id" property or NMSettingIP4Config changes, but might need to be re-created when the Wi-Fi SSID, mobile broadband network provider, or "type" property changes. The UUID must be in the format "2815492f-7e56-435e-b2e9-246bd7cdc664" (ie, contains only hexadecimal characters and "-").</entry></row>
+    <row><entry align="left" id="nm-settings.property.connection.zone">zone</entry><entry align="left">string</entry><entry align="left"/><entry>The trust level of a the connection.  Free form case-insensitive string (for example "Home", "Work", "Public").  NULL or unspecified zone means the connection will be placed in the default zone as defined by the firewall. When updating this property on a currently activated connection, the change takes effect immediately.</entry></row>
   </tbody></tgroup></table>
   <table><title>dcb setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
-    <row><entry align="left">app-fcoe-flags</entry><entry align="left">NMSettingDcbFlags (uint32)</entry><entry align="left"/><entry>Specifies the NMSettingDcbFlags for the DCB FCoE application.  Flags may be any combination of NM_SETTING_DCB_FLAG_ENABLE (0x1), NM_SETTING_DCB_FLAG_ADVERTISE (0x2), and NM_SETTING_DCB_FLAG_WILLING (0x4).</entry></row>
-    <row><entry align="left">app-fcoe-mode</entry><entry align="left">string</entry><entry align="left">"fabric"</entry><entry>The FCoE controller mode; either "fabric" (default) or "vn2vn".</entry></row>
-    <row><entry align="left">app-fcoe-priority</entry><entry align="left">int32</entry><entry align="left">-1</entry><entry>The highest User Priority (0 - 7) which FCoE frames should use, or -1 for default priority.  Only used when the "app-fcoe-flags" property includes the NM_SETTING_DCB_FLAG_ENABLE (0x1) flag.</entry></row>
-    <row><entry align="left">app-fip-flags</entry><entry align="left">NMSettingDcbFlags (uint32)</entry><entry align="left"/><entry>Specifies the NMSettingDcbFlags for the DCB FIP application.  Flags may be any combination of NM_SETTING_DCB_FLAG_ENABLE (0x1), NM_SETTING_DCB_FLAG_ADVERTISE (0x2), and NM_SETTING_DCB_FLAG_WILLING (0x4).</entry></row>
-    <row><entry align="left">app-fip-priority</entry><entry align="left">int32</entry><entry align="left">-1</entry><entry>The highest User Priority (0 - 7) which FIP frames should use, or -1 for default priority.  Only used when the "app-fip-flags" property includes the NM_SETTING_DCB_FLAG_ENABLE (0x1) flag.</entry></row>
-    <row><entry align="left">app-iscsi-flags</entry><entry align="left">NMSettingDcbFlags (uint32)</entry><entry align="left"/><entry>Specifies the NMSettingDcbFlags for the DCB iSCSI application.  Flags may be any combination of NM_SETTING_DCB_FLAG_ENABLE (0x1), NM_SETTING_DCB_FLAG_ADVERTISE (0x2), and NM_SETTING_DCB_FLAG_WILLING (0x4).</entry></row>
-    <row><entry align="left">app-iscsi-priority</entry><entry align="left">int32</entry><entry align="left">-1</entry><entry>The highest User Priority (0 - 7) which iSCSI frames should use, or -1 for default priority. Only used when the "app-iscsi-flags" property includes the NM_SETTING_DCB_FLAG_ENABLE (0x1) flag.</entry></row>
-    <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">dcb</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
-    <row><entry align="left">priority-bandwidth</entry><entry align="left">array of uint32</entry><entry align="left">[0, 0, 0, 0, 0, 0, 0, 0]</entry><entry>An array of 8 uint values, where the array index corresponds to the User Priority (0 - 7) and the value indicates the percentage of bandwidth of the priority's assigned group that the priority may use.  The sum of all percentages for priorities which belong to the same group must total 100 percent.</entry></row>
-    <row><entry align="left">priority-flow-control</entry><entry align="left">array of uint32</entry><entry align="left">[0, 0, 0, 0, 0, 0, 0, 0]</entry><entry>An array of 8 boolean values, where the array index corresponds to the User Priority (0 - 7) and the value indicates whether or not the corresponding priority should transmit priority pause.</entry></row>
-    <row><entry align="left">priority-flow-control-flags</entry><entry align="left">NMSettingDcbFlags (uint32)</entry><entry align="left"/><entry>Specifies the NMSettingDcbFlags for DCB Priority Flow Control (PFC). Flags may be any combination of NM_SETTING_DCB_FLAG_ENABLE (0x1), NM_SETTING_DCB_FLAG_ADVERTISE (0x2), and NM_SETTING_DCB_FLAG_WILLING (0x4).</entry></row>
-    <row><entry align="left">priority-group-bandwidth</entry><entry align="left">array of uint32</entry><entry align="left">[0, 0, 0, 0, 0, 0, 0, 0]</entry><entry>An array of 8 uint values, where the array index corresponds to the Priority Group ID (0 - 7) and the value indicates the percentage of link bandwidth allocated to that group.  Allowed values are 0 - 100, and the sum of all values must total 100 percent.</entry></row>
-    <row><entry align="left">priority-group-flags</entry><entry align="left">NMSettingDcbFlags (uint32)</entry><entry align="left"/><entry>Specifies the NMSettingDcbFlags for DCB Priority Groups.  Flags may be any combination of NM_SETTING_DCB_FLAG_ENABLE (0x1), NM_SETTING_DCB_FLAG_ADVERTISE (0x2), and NM_SETTING_DCB_FLAG_WILLING (0x4).</entry></row>
-    <row><entry align="left">priority-group-id</entry><entry align="left">array of uint32</entry><entry align="left">[0, 0, 0, 0, 0, 0, 0, 0]</entry><entry>An array of 8 uint values, where the array index corresponds to the User Priority (0 - 7) and the value indicates the Priority Group ID.  Allowed Priority Group ID values are 0 - 7 or 15 for the unrestricted group.</entry></row>
-    <row><entry align="left">priority-strict-bandwidth</entry><entry align="left">array of uint32</entry><entry align="left">[0, 0, 0, 0, 0, 0, 0, 0]</entry><entry>An array of 8 boolean values, where the array index corresponds to the User Priority (0 - 7) and the value indicates whether or not the priority may use all of the bandwidth allocated to its assigned group.</entry></row>
-    <row><entry align="left">priority-traffic-class</entry><entry align="left">array of uint32</entry><entry align="left">[0, 0, 0, 0, 0, 0, 0, 0]</entry><entry>An array of 8 uint values, where the array index corresponds to the User Priority (0 - 7) and the value indicates the traffic class (0 - 7) to which the priority is mapped.</entry></row>
+    <row><entry align="left" id="nm-settings.property.dcb.app-fcoe-flags">app-fcoe-flags</entry><entry align="left">NMSettingDcbFlags (uint32)</entry><entry align="left"/><entry>Specifies the NMSettingDcbFlags for the DCB FCoE application.  Flags may be any combination of NM_SETTING_DCB_FLAG_ENABLE (0x1), NM_SETTING_DCB_FLAG_ADVERTISE (0x2), and NM_SETTING_DCB_FLAG_WILLING (0x4).</entry></row>
+    <row><entry align="left" id="nm-settings.property.dcb.app-fcoe-mode">app-fcoe-mode</entry><entry align="left">string</entry><entry align="left">"fabric"</entry><entry>The FCoE controller mode; either "fabric" (default) or "vn2vn".</entry></row>
+    <row><entry align="left" id="nm-settings.property.dcb.app-fcoe-priority">app-fcoe-priority</entry><entry align="left">int32</entry><entry align="left">-1</entry><entry>The highest User Priority (0 - 7) which FCoE frames should use, or -1 for default priority.  Only used when the "app-fcoe-flags" property includes the NM_SETTING_DCB_FLAG_ENABLE (0x1) flag.</entry></row>
+    <row><entry align="left" id="nm-settings.property.dcb.app-fip-flags">app-fip-flags</entry><entry align="left">NMSettingDcbFlags (uint32)</entry><entry align="left"/><entry>Specifies the NMSettingDcbFlags for the DCB FIP application.  Flags may be any combination of NM_SETTING_DCB_FLAG_ENABLE (0x1), NM_SETTING_DCB_FLAG_ADVERTISE (0x2), and NM_SETTING_DCB_FLAG_WILLING (0x4).</entry></row>
+    <row><entry align="left" id="nm-settings.property.dcb.app-fip-priority">app-fip-priority</entry><entry align="left">int32</entry><entry align="left">-1</entry><entry>The highest User Priority (0 - 7) which FIP frames should use, or -1 for default priority.  Only used when the "app-fip-flags" property includes the NM_SETTING_DCB_FLAG_ENABLE (0x1) flag.</entry></row>
+    <row><entry align="left" id="nm-settings.property.dcb.app-iscsi-flags">app-iscsi-flags</entry><entry align="left">NMSettingDcbFlags (uint32)</entry><entry align="left"/><entry>Specifies the NMSettingDcbFlags for the DCB iSCSI application.  Flags may be any combination of NM_SETTING_DCB_FLAG_ENABLE (0x1), NM_SETTING_DCB_FLAG_ADVERTISE (0x2), and NM_SETTING_DCB_FLAG_WILLING (0x4).</entry></row>
+    <row><entry align="left" id="nm-settings.property.dcb.app-iscsi-priority">app-iscsi-priority</entry><entry align="left">int32</entry><entry align="left">-1</entry><entry>The highest User Priority (0 - 7) which iSCSI frames should use, or -1 for default priority. Only used when the "app-iscsi-flags" property includes the NM_SETTING_DCB_FLAG_ENABLE (0x1) flag.</entry></row>
+    <row><entry align="left" id="nm-settings.property.dcb.name">name</entry><entry align="left">string</entry><entry align="left">dcb</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
+    <row><entry align="left" id="nm-settings.property.dcb.priority-bandwidth">priority-bandwidth</entry><entry align="left">array of uint32</entry><entry align="left">[0, 0, 0, 0, 0, 0, 0, 0]</entry><entry>An array of 8 uint values, where the array index corresponds to the User Priority (0 - 7) and the value indicates the percentage of bandwidth of the priority's assigned group that the priority may use.  The sum of all percentages for priorities which belong to the same group must total 100 percent.</entry></row>
+    <row><entry align="left" id="nm-settings.property.dcb.priority-flow-control">priority-flow-control</entry><entry align="left">array of uint32</entry><entry align="left">[0, 0, 0, 0, 0, 0, 0, 0]</entry><entry>An array of 8 boolean values, where the array index corresponds to the User Priority (0 - 7) and the value indicates whether or not the corresponding priority should transmit priority pause.</entry></row>
+    <row><entry align="left" id="nm-settings.property.dcb.priority-flow-control-flags">priority-flow-control-flags</entry><entry align="left">NMSettingDcbFlags (uint32)</entry><entry align="left"/><entry>Specifies the NMSettingDcbFlags for DCB Priority Flow Control (PFC). Flags may be any combination of NM_SETTING_DCB_FLAG_ENABLE (0x1), NM_SETTING_DCB_FLAG_ADVERTISE (0x2), and NM_SETTING_DCB_FLAG_WILLING (0x4).</entry></row>
+    <row><entry align="left" id="nm-settings.property.dcb.priority-group-bandwidth">priority-group-bandwidth</entry><entry align="left">array of uint32</entry><entry align="left">[0, 0, 0, 0, 0, 0, 0, 0]</entry><entry>An array of 8 uint values, where the array index corresponds to the Priority Group ID (0 - 7) and the value indicates the percentage of link bandwidth allocated to that group.  Allowed values are 0 - 100, and the sum of all values must total 100 percent.</entry></row>
+    <row><entry align="left" id="nm-settings.property.dcb.priority-group-flags">priority-group-flags</entry><entry align="left">NMSettingDcbFlags (uint32)</entry><entry align="left"/><entry>Specifies the NMSettingDcbFlags for DCB Priority Groups.  Flags may be any combination of NM_SETTING_DCB_FLAG_ENABLE (0x1), NM_SETTING_DCB_FLAG_ADVERTISE (0x2), and NM_SETTING_DCB_FLAG_WILLING (0x4).</entry></row>
+    <row><entry align="left" id="nm-settings.property.dcb.priority-group-id">priority-group-id</entry><entry align="left">array of uint32</entry><entry align="left">[0, 0, 0, 0, 0, 0, 0, 0]</entry><entry>An array of 8 uint values, where the array index corresponds to the User Priority (0 - 7) and the value indicates the Priority Group ID.  Allowed Priority Group ID values are 0 - 7 or 15 for the unrestricted group.</entry></row>
+    <row><entry align="left" id="nm-settings.property.dcb.priority-strict-bandwidth">priority-strict-bandwidth</entry><entry align="left">array of uint32</entry><entry align="left">[0, 0, 0, 0, 0, 0, 0, 0]</entry><entry>An array of 8 boolean values, where the array index corresponds to the User Priority (0 - 7) and the value indicates whether or not the priority may use all of the bandwidth allocated to its assigned group.</entry></row>
+    <row><entry align="left" id="nm-settings.property.dcb.priority-traffic-class">priority-traffic-class</entry><entry align="left">array of uint32</entry><entry align="left">[0, 0, 0, 0, 0, 0, 0, 0]</entry><entry>An array of 8 uint values, where the array index corresponds to the User Priority (0 - 7) and the value indicates the traffic class (0 - 7) to which the priority is mapped.</entry></row>
   </tbody></tgroup></table>
   <table><title>generic setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
-    <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">generic</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
+    <row><entry align="left" id="nm-settings.property.generic.name">name</entry><entry align="left">string</entry><entry align="left">generic</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
   </tbody></tgroup></table>
   <table><title>gsm setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
-    <row><entry align="left">apn</entry><entry align="left">string</entry><entry align="left"/><entry>The GPRS Access Point Name specifying the APN used when establishing a data session with the GSM-based network.  The APN often determines how the user will be billed for their network usage and whether the user has access to the Internet or just a provider-specific walled-garden, so it is important to use the correct APN for the user's mobile broadband plan. The APN may only be composed of the characters a-z, 0-9, ., and - per GSM 03.60 Section 14.9.</entry></row>
-    <row><entry align="left">device-id</entry><entry align="left">string</entry><entry align="left"/><entry>The device unique identifier (as given by the WWAN management service) which this connection applies to.  If given, the connection will only apply to the specified device.</entry></row>
-    <row><entry align="left">home-only</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>When TRUE, only connections to the home network will be allowed. Connections to roaming networks will not be made.</entry></row>
-    <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">gsm</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
-    <row><entry align="left">network-id</entry><entry align="left">string</entry><entry align="left"/><entry>The Network ID (GSM LAI format, ie MCC-MNC) to force specific network registration.  If the Network ID is specified, NetworkManager will attempt to force the device to register only on the specified network. This can be used to ensure that the device does not roam when direct roaming control of the device is not otherwise possible.</entry></row>
-    <row><entry align="left">number</entry><entry align="left">string</entry><entry align="left"/><entry>Number to dial when establishing a PPP data session with the GSM-based mobile broadband network.  Many modems do not require PPP for connections to the mobile network and thus this property should be left blank, which allows NetworkManager to select the appropriate settings automatically.</entry></row>
-    <row><entry align="left">password</entry><entry align="left">string</entry><entry align="left"/><entry>The password used to authenticate with the network, if required.  Many providers do not require a password, or accept any password.  But if a password is required, it is specified here.</entry></row>
-    <row><entry align="left">password-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "password" property. (see <xref linkend="secrets-flags"/> for flag values)</entry></row>
-    <row><entry align="left">pin</entry><entry align="left">string</entry><entry align="left"/><entry>If the SIM is locked with a PIN it must be unlocked before any other operations are requested.  Specify the PIN here to allow operation of the device.</entry></row>
-    <row><entry align="left">pin-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "pin" property. (see <xref linkend="secrets-flags"/> for flag values)</entry></row>
-    <row><entry align="left">sim-id</entry><entry align="left">string</entry><entry align="left"/><entry>The SIM card unique identifier (as given by the WWAN management service) which this connection applies to.  If given, the connection will apply to any device also allowed by "device-id" which contains a SIM card matching the given identifier.</entry></row>
-    <row><entry align="left">sim-operator-id</entry><entry align="left">string</entry><entry align="left"/><entry>A MCC/MNC string like "310260" or "21601" identifying the specific mobile network operator which this connection applies to.  If given, the connection will apply to any device also allowed by "device-id" and "sim-id" which contains a SIM card provisioined by the given operator.</entry></row>
-    <row><entry align="left">username</entry><entry align="left">string</entry><entry align="left"/><entry>The username used to authenticate with the network, if required.  Many providers do not require a username, or accept any username.  But if a username is required, it is specified here.</entry></row>
+    <row><entry align="left" id="nm-settings.property.gsm.apn">apn</entry><entry align="left">string</entry><entry align="left"/><entry>The GPRS Access Point Name specifying the APN used when establishing a data session with the GSM-based network.  The APN often determines how the user will be billed for their network usage and whether the user has access to the Internet or just a provider-specific walled-garden, so it is important to use the correct APN for the user's mobile broadband plan. The APN may only be composed of the characters a-z, 0-9, ., and - per GSM 03.60 Section 14.9.</entry></row>
+    <row><entry align="left" id="nm-settings.property.gsm.device-id">device-id</entry><entry align="left">string</entry><entry align="left"/><entry>The device unique identifier (as given by the WWAN management service) which this connection applies to.  If given, the connection will only apply to the specified device.</entry></row>
+    <row><entry align="left" id="nm-settings.property.gsm.home-only">home-only</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>When TRUE, only connections to the home network will be allowed. Connections to roaming networks will not be made.</entry></row>
+    <row><entry align="left" id="nm-settings.property.gsm.name">name</entry><entry align="left">string</entry><entry align="left">gsm</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
+    <row><entry align="left" id="nm-settings.property.gsm.network-id">network-id</entry><entry align="left">string</entry><entry align="left"/><entry>The Network ID (GSM LAI format, ie MCC-MNC) to force specific network registration.  If the Network ID is specified, NetworkManager will attempt to force the device to register only on the specified network. This can be used to ensure that the device does not roam when direct roaming control of the device is not otherwise possible.</entry></row>
+    <row><entry align="left" id="nm-settings.property.gsm.number">number</entry><entry align="left">string</entry><entry align="left"/><entry>Number to dial when establishing a PPP data session with the GSM-based mobile broadband network.  Many modems do not require PPP for connections to the mobile network and thus this property should be left blank, which allows NetworkManager to select the appropriate settings automatically.</entry></row>
+    <row><entry align="left" id="nm-settings.property.gsm.password">password</entry><entry align="left">string</entry><entry align="left"/><entry>The password used to authenticate with the network, if required.  Many providers do not require a password, or accept any password.  But if a password is required, it is specified here.</entry></row>
+    <row><entry align="left" id="nm-settings.property.gsm.password-flags">password-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "password" property. (see <xref linkend="secrets-flags"/> for flag values)</entry></row>
+    <row><entry align="left" id="nm-settings.property.gsm.pin">pin</entry><entry align="left">string</entry><entry align="left"/><entry>If the SIM is locked with a PIN it must be unlocked before any other operations are requested.  Specify the PIN here to allow operation of the device.</entry></row>
+    <row><entry align="left" id="nm-settings.property.gsm.pin-flags">pin-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "pin" property. (see <xref linkend="secrets-flags"/> for flag values)</entry></row>
+    <row><entry align="left" id="nm-settings.property.gsm.sim-id">sim-id</entry><entry align="left">string</entry><entry align="left"/><entry>The SIM card unique identifier (as given by the WWAN management service) which this connection applies to.  If given, the connection will apply to any device also allowed by "device-id" which contains a SIM card matching the given identifier.</entry></row>
+    <row><entry align="left" id="nm-settings.property.gsm.sim-operator-id">sim-operator-id</entry><entry align="left">string</entry><entry align="left"/><entry>A MCC/MNC string like "310260" or "21601" identifying the specific mobile network operator which this connection applies to.  If given, the connection will apply to any device also allowed by "device-id" and "sim-id" which contains a SIM card provisioined by the given operator.</entry></row>
+    <row><entry align="left" id="nm-settings.property.gsm.username">username</entry><entry align="left">string</entry><entry align="left"/><entry>The username used to authenticate with the network, if required.  Many providers do not require a username, or accept any username.  But if a username is required, it is specified here.</entry></row>
   </tbody></tgroup></table>
   <table><title>infiniband setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
-    <row><entry align="left">mac-address</entry><entry align="left">byte array</entry><entry align="left"/><entry>If specified, this connection will only apply to the IPoIB device whose permanent MAC address matches. This property does not change the MAC address of the device (i.e. MAC spoofing).</entry></row>
-    <row><entry align="left">mtu</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>If non-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple frames.</entry></row>
-    <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">infiniband</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
-    <row><entry align="left">p-key</entry><entry align="left">int32</entry><entry align="left">-1</entry><entry>The InfiniBand P_Key to use for this device. A value of -1 means to use the default P_Key (aka "the P_Key at index 0").  Otherwise it is a 16-bit unsigned integer, whose high bit is set if it is a "full membership" P_Key.</entry></row>
-    <row><entry align="left">parent</entry><entry align="left">string</entry><entry align="left"/><entry>The interface name of the parent device of this device. Normally NULL, but if the "p_key" property is set, then you must specify the base device by setting either this property or "mac-address".</entry></row>
-    <row><entry align="left">transport-mode</entry><entry align="left">string</entry><entry align="left"/><entry>The IP-over-InfiniBand transport mode. Either "datagram" or "connected".</entry></row>
+    <row><entry align="left" id="nm-settings.property.infiniband.mac-address">mac-address</entry><entry align="left">byte array</entry><entry align="left"/><entry>If specified, this connection will only apply to the IPoIB device whose permanent MAC address matches. This property does not change the MAC address of the device (i.e. MAC spoofing).</entry></row>
+    <row><entry align="left" id="nm-settings.property.infiniband.mtu">mtu</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>If non-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple frames.</entry></row>
+    <row><entry align="left" id="nm-settings.property.infiniband.name">name</entry><entry align="left">string</entry><entry align="left">infiniband</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
+    <row><entry align="left" id="nm-settings.property.infiniband.p-key">p-key</entry><entry align="left">int32</entry><entry align="left">-1</entry><entry>The InfiniBand P_Key to use for this device. A value of -1 means to use the default P_Key (aka "the P_Key at index 0").  Otherwise it is a 16-bit unsigned integer, whose high bit is set if it is a "full membership" P_Key.</entry></row>
+    <row><entry align="left" id="nm-settings.property.infiniband.parent">parent</entry><entry align="left">string</entry><entry align="left"/><entry>The interface name of the parent device of this device. Normally NULL, but if the "p_key" property is set, then you must specify the base device by setting either this property or "mac-address".</entry></row>
+    <row><entry align="left" id="nm-settings.property.infiniband.transport-mode">transport-mode</entry><entry align="left">string</entry><entry align="left"/><entry>The IP-over-InfiniBand transport mode. Either "datagram" or "connected".</entry></row>
   </tbody></tgroup></table>
   <table><title>ipv4 setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
-    <row><entry align="left">address-data</entry><entry align="left">array of vardict</entry><entry align="left"/><entry>Array of IPv4 addresses. Each address dictionary contains at least 'address' and 'prefix' entries, containing the IP address as a string, and the prefix length as a uint32. Additional attributes may also exist on some addresses.</entry></row>
-    <row><entry align="left">addresses</entry><entry align="left">array of array of uint32</entry><entry align="left">[]</entry><entry>Deprecated in favor of the 'address-data' and 'gateway' properties, but this can be used for backward-compatibility with older daemons. Note that if you send this property the daemon will ignore 'address-data' and 'gateway'.  Array of IPv4 address structures.  Each IPv4 address structure is composed of 3 32-bit values; the first being the IPv4 address (network byte order), the second the prefix (1 - 32), and last the IPv4 gateway (network byte order). The gateway may be left as 0 if no gateway exists for that subnet.</entry></row>
-    <row><entry align="left">dad-timeout</entry><entry align="left">int32</entry><entry align="left">-1</entry><entry>Timeout in milliseconds used to check for the presence of duplicate IP addresses on the network.  If an address conflict is detected, the activation will fail.  A zero value means that no duplicate address detection is performed, -1 means the default value (either configuration ipvx.dad-timeout override or 3 seconds).  A value greater than zero is a timeout in milliseconds.</entry></row>
-    <row><entry align="left">dhcp-client-id</entry><entry align="left">string</entry><entry align="left"/><entry>A string sent to the DHCP server to identify the local machine which the DHCP server may use to customize the DHCP lease and options.</entry></row>
-    <row><entry align="left">dhcp-fqdn</entry><entry align="left">string</entry><entry align="left"/><entry>If the "dhcp-send-hostname" property is TRUE, then the specified FQDN will be sent to the DHCP server when acquiring a lease. This property and "dhcp-hostname" are mutually exclusive and cannot be set at the same time.</entry></row>
-    <row><entry align="left">dhcp-hostname</entry><entry align="left">string</entry><entry align="left"/><entry>If the "dhcp-send-hostname" property is TRUE, then the specified name will be sent to the DHCP server when acquiring a lease. This property and "dhcp-fqdn" are mutually exclusive and cannot be set at the same time.</entry></row>
-    <row><entry align="left">dhcp-send-hostname</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>If TRUE, a hostname is sent to the DHCP server when acquiring a lease. Some DHCP servers use this hostname to update DNS databases, essentially providing a static hostname for the computer.  If the "dhcp-hostname" property is NULL and this property is TRUE, the current persistent hostname of the computer is sent.</entry></row>
-    <row><entry align="left">dhcp-timeout</entry><entry align="left">int32</entry><entry align="left">0</entry><entry>A timeout for a DHCP transaction in seconds.</entry></row>
-    <row><entry align="left">dns</entry><entry align="left">array of uint32</entry><entry align="left">[]</entry><entry>Array of IP addresses of DNS servers (as network-byte-order integers)</entry></row>
-    <row><entry align="left">dns-options</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>Array of DNS options. NULL means that the options are unset and left at the default. In this case NetworkManager will use default options. This is distinct from an empty list of properties.</entry></row>
-    <row><entry align="left">dns-priority</entry><entry align="left">int32</entry><entry align="left">0</entry><entry>DNS priority. The relative priority to be used when determining the order of DNS servers in resolv.conf.  A lower value means that servers will be on top of the file.  Zero selects the default value, which is 50 for VPNs and 100 for other connections.  When multiple devices have configurations with the same priority, the one with an active default route will be preferred.  Note that when using dns=dnsmasq the order is meaningless since dnsmasq forwards queries to all known servers at the same time. Negative values have the special effect of excluding other configurations with a greater priority value; so in presence of at least a negative priority, only DNS servers from configurations with the lowest priority value will be used.</entry></row>
-    <row><entry align="left">dns-search</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>Array of DNS search domains.</entry></row>
-    <row><entry align="left">gateway</entry><entry align="left">string</entry><entry align="left"/><entry>The gateway associated with this configuration. This is only meaningful if "addresses" is also set.</entry></row>
-    <row><entry align="left">ignore-auto-dns</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>When "method" is set to "auto" and this property to TRUE, automatically configured nameservers and search domains are ignored and only nameservers and search domains specified in the "dns" and "dns-search" properties, if any, are used.</entry></row>
-    <row><entry align="left">ignore-auto-routes</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>When "method" is set to "auto" and this property to TRUE, automatically configured routes are ignored and only routes specified in the "routes" property, if any, are used.</entry></row>
-    <row><entry align="left">may-fail</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>If TRUE, allow overall network configuration to proceed even if the configuration specified by this property times out.  Note that at least one IP configuration must succeed or overall network configuration will still fail.  For example, in IPv6-only networks, setting this property to TRUE on the NMSettingIP4Config allows the overall network configuration to succeed if IPv4 configuration fails but IPv6 configuration completes successfully.</entry></row>
-    <row><entry align="left">method</entry><entry align="left">string</entry><entry align="left"/><entry>IP configuration method. NMSettingIP4Config and NMSettingIP6Config both support "auto", "manual", and "link-local". See the subclass-specific documentation for other values. In general, for the "auto" method, properties such as "dns" and "routes" specify information that is added on to the information returned from automatic configuration.  The "ignore-auto-routes" and "ignore-auto-dns" properties modify this behavior. For methods that imply no upstream network, such as "shared" or "link-local", these properties must be empty. For IPv4 method "shared", the IP subnet can be configured by adding one manual IPv4 address or otherwise 10.42.x.0/24 is chosen.</entry></row>
-    <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">ipv4</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
-    <row><entry align="left">never-default</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If TRUE, this connection will never be the default connection for this IP type, meaning it will never be assigned the default route by NetworkManager.</entry></row>
-    <row><entry align="left">route-data</entry><entry align="left">array of vardict</entry><entry align="left"/><entry>Array of IPv4 routes. Each route dictionary contains at least 'dest' and 'prefix' entries, containing the destination IP address as a string, and the prefix length as a uint32. Most routes will also have a 'gateway' entry, containing the gateway IP address as a string. If the route has a 'metric' entry (containing a uint32), that will be used as the metric for the route (otherwise NM will pick a default value appropriate to the device). Additional attributes may also exist on some routes.</entry></row>
-    <row><entry align="left">route-metric</entry><entry align="left">int64</entry><entry align="left">-1</entry><entry>The default metric for routes that don't explicitly specify a metric. The default value -1 means that the metric is choosen automatically based on the device type. The metric applies to dynamic routes, manual (static) routes that don't have an explicit metric setting, address prefix routes, and the default route. Note that for IPv6, the kernel accepts zero (0) but coerces it to 1024 (user default). Hence, setting this property to zero effectively mean setting it to 1024. For IPv4, zero is a regular value for the metric.</entry></row>
-    <row><entry align="left">routes</entry><entry align="left">array of array of uint32</entry><entry align="left">[]</entry><entry>Deprecated in favor of the 'route-data' property, but this can be used for backward-compatibility with older daemons. Note that if you send this property the daemon will ignore 'route-data'.  Array of IPv4 route structures.  Each IPv4 route structure is composed of 4 32-bit values; the first being the destination IPv4 network or address (network byte order), the second the destination network or address prefix (1 - 32), the third being the next-hop (network byte order) if any, and the fourth being the route metric. If the metric is 0, NM will choose an appropriate default metric for the device. (There is no way to explicitly specify an actual metric of 0 with this property.)</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv4.address-data">address-data</entry><entry align="left">array of vardict</entry><entry align="left"/><entry>Array of IPv4 addresses. Each address dictionary contains at least 'address' and 'prefix' entries, containing the IP address as a string, and the prefix length as a uint32. Additional attributes may also exist on some addresses.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv4.addresses">addresses</entry><entry align="left">array of array of uint32</entry><entry align="left">[]</entry><entry>Deprecated in favor of the 'address-data' and 'gateway' properties, but this can be used for backward-compatibility with older daemons. Note that if you send this property the daemon will ignore 'address-data' and 'gateway'.  Array of IPv4 address structures.  Each IPv4 address structure is composed of 3 32-bit values; the first being the IPv4 address (network byte order), the second the prefix (1 - 32), and last the IPv4 gateway (network byte order). The gateway may be left as 0 if no gateway exists for that subnet.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv4.dad-timeout">dad-timeout</entry><entry align="left">int32</entry><entry align="left">-1</entry><entry>Timeout in milliseconds used to check for the presence of duplicate IP addresses on the network.  If an address conflict is detected, the activation will fail.  A zero value means that no duplicate address detection is performed, -1 means the default value (either configuration ipvx.dad-timeout override or 3 seconds).  A value greater than zero is a timeout in milliseconds.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv4.dhcp-client-id">dhcp-client-id</entry><entry align="left">string</entry><entry align="left"/><entry>A string sent to the DHCP server to identify the local machine which the DHCP server may use to customize the DHCP lease and options.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv4.dhcp-fqdn">dhcp-fqdn</entry><entry align="left">string</entry><entry align="left"/><entry>If the "dhcp-send-hostname" property is TRUE, then the specified FQDN will be sent to the DHCP server when acquiring a lease. This property and "dhcp-hostname" are mutually exclusive and cannot be set at the same time.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv4.dhcp-hostname">dhcp-hostname</entry><entry align="left">string</entry><entry align="left"/><entry>If the "dhcp-send-hostname" property is TRUE, then the specified name will be sent to the DHCP server when acquiring a lease. This property and "dhcp-fqdn" are mutually exclusive and cannot be set at the same time.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv4.dhcp-send-hostname">dhcp-send-hostname</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>If TRUE, a hostname is sent to the DHCP server when acquiring a lease. Some DHCP servers use this hostname to update DNS databases, essentially providing a static hostname for the computer.  If the "dhcp-hostname" property is NULL and this property is TRUE, the current persistent hostname of the computer is sent.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv4.dhcp-timeout">dhcp-timeout</entry><entry align="left">int32</entry><entry align="left">0</entry><entry>A timeout for a DHCP transaction in seconds.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv4.dns">dns</entry><entry align="left">array of uint32</entry><entry align="left">[]</entry><entry>Array of IP addresses of DNS servers (as network-byte-order integers)</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv4.dns-options">dns-options</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>Array of DNS options. NULL means that the options are unset and left at the default. In this case NetworkManager will use default options. This is distinct from an empty list of properties.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv4.dns-priority">dns-priority</entry><entry align="left">int32</entry><entry align="left">0</entry><entry>DNS priority. The relative priority to be used when determining the order of DNS servers in resolv.conf.  A lower value means that servers will be on top of the file.  Zero selects the default value, which is 50 for VPNs and 100 for other connections.  When multiple devices have configurations with the same priority, the one with an active default route will be preferred.  Note that when using dns=dnsmasq the order is meaningless since dnsmasq forwards queries to all known servers at the same time. Negative values have the special effect of excluding other configurations with a greater priority value; so in presence of at least a negative priority, only DNS servers from configurations with the lowest priority value will be used.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv4.dns-search">dns-search</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>Array of DNS search domains.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv4.gateway">gateway</entry><entry align="left">string</entry><entry align="left"/><entry>The gateway associated with this configuration. This is only meaningful if "addresses" is also set.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv4.ignore-auto-dns">ignore-auto-dns</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>When "method" is set to "auto" and this property to TRUE, automatically configured nameservers and search domains are ignored and only nameservers and search domains specified in the "dns" and "dns-search" properties, if any, are used.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv4.ignore-auto-routes">ignore-auto-routes</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>When "method" is set to "auto" and this property to TRUE, automatically configured routes are ignored and only routes specified in the "routes" property, if any, are used.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv4.may-fail">may-fail</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>If TRUE, allow overall network configuration to proceed even if the configuration specified by this property times out.  Note that at least one IP configuration must succeed or overall network configuration will still fail.  For example, in IPv6-only networks, setting this property to TRUE on the NMSettingIP4Config allows the overall network configuration to succeed if IPv4 configuration fails but IPv6 configuration completes successfully.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv4.method">method</entry><entry align="left">string</entry><entry align="left"/><entry>IP configuration method. NMSettingIP4Config and NMSettingIP6Config both support "auto", "manual", and "link-local". See the subclass-specific documentation for other values. In general, for the "auto" method, properties such as "dns" and "routes" specify information that is added on to the information returned from automatic configuration.  The "ignore-auto-routes" and "ignore-auto-dns" properties modify this behavior. For methods that imply no upstream network, such as "shared" or "link-local", these properties must be empty. For IPv4 method "shared", the IP subnet can be configured by adding one manual IPv4 address or otherwise 10.42.x.0/24 is chosen.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv4.name">name</entry><entry align="left">string</entry><entry align="left">ipv4</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv4.never-default">never-default</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If TRUE, this connection will never be the default connection for this IP type, meaning it will never be assigned the default route by NetworkManager.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv4.route-data">route-data</entry><entry align="left">array of vardict</entry><entry align="left"/><entry>Array of IPv4 routes. Each route dictionary contains at least 'dest' and 'prefix' entries, containing the destination IP address as a string, and the prefix length as a uint32. Most routes will also have a 'gateway' entry, containing the gateway IP address as a string. If the route has a 'metric' entry (containing a uint32), that will be used as the metric for the route (otherwise NM will pick a default value appropriate to the device). Additional attributes may also exist on some routes.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv4.route-metric">route-metric</entry><entry align="left">int64</entry><entry align="left">-1</entry><entry>The default metric for routes that don't explicitly specify a metric. The default value -1 means that the metric is choosen automatically based on the device type. The metric applies to dynamic routes, manual (static) routes that don't have an explicit metric setting, address prefix routes, and the default route. Note that for IPv6, the kernel accepts zero (0) but coerces it to 1024 (user default). Hence, setting this property to zero effectively mean setting it to 1024. For IPv4, zero is a regular value for the metric.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv4.routes">routes</entry><entry align="left">array of array of uint32</entry><entry align="left">[]</entry><entry>Deprecated in favor of the 'route-data' property, but this can be used for backward-compatibility with older daemons. Note that if you send this property the daemon will ignore 'route-data'.  Array of IPv4 route structures.  Each IPv4 route structure is composed of 4 32-bit values; the first being the destination IPv4 network or address (network byte order), the second the destination network or address prefix (1 - 32), the third being the next-hop (network byte order) if any, and the fourth being the route metric. If the metric is 0, NM will choose an appropriate default metric for the device. (There is no way to explicitly specify an actual metric of 0 with this property.)</entry></row>
   </tbody></tgroup></table>
   <table><title>ipv6 setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
-    <row><entry align="left">addr-gen-mode</entry><entry align="left">int32</entry><entry align="left">1</entry><entry>Configure method for creating the address for use with RFC4862 IPv6 Stateless Address Autoconfiguration. The permitted values are: "eui64", or "stable-privacy". If the property is set to "eui64", the addresses will be generated using the interface tokens derived from  hardware address. This makes the host part of the address to stay constant, making it possible to track host's presence when it changes networks. The address changes when the interface hardware is replaced. The value of "stable-privacy" enables use of cryptographically secure hash of a secret host-specific key along with the connection identification and the network address as specified by RFC7217. This makes it impossible to use the address track host's presence, and makes the address stable when the network interface hardware is replaced. On D-Bus, the absence of an addr-gen-mode setting equals enabling "stable-privacy". For keyfile plugin, the absence of the setting on disk means "eui64" so that the property doesn't change on upgrade from older versions. Note that this setting is distinct from the Privacy Extensions as configured by "ip6-privacy" property and it does not affect the temporary addresses configured with this option.</entry></row>
-    <row><entry align="left">address-data</entry><entry align="left">array of vardict</entry><entry align="left"/><entry>Array of IPv6 addresses. Each address dictionary contains at least 'address' and 'prefix' entries, containing the IP address as a string, and the prefix length as a uint32. Additional attributes may also exist on some addresses.</entry></row>
-    <row><entry align="left">addresses</entry><entry align="left">array of legacy IPv6 address struct (a(ayuay))</entry><entry align="left">[]</entry><entry>Deprecated in favor of the 'address-data' and 'gateway' properties, but this can be used for backward-compatibility with older daemons. Note that if you send this property the daemon will ignore 'address-data' and 'gateway'.  Array of IPv6 address structures.  Each IPv6 address structure is composed of an IPv6 address, a prefix length (1 - 128), and an IPv6 gateway address. The gateway may be zeroed out if no gateway exists for that subnet.</entry></row>
-    <row><entry align="left">dad-timeout</entry><entry align="left">int32</entry><entry align="left">-1</entry><entry>Timeout in milliseconds used to check for the presence of duplicate IP addresses on the network.  If an address conflict is detected, the activation will fail.  A zero value means that no duplicate address detection is performed, -1 means the default value (either configuration ipvx.dad-timeout override or 3 seconds).  A value greater than zero is a timeout in milliseconds.</entry></row>
-    <row><entry align="left">dhcp-hostname</entry><entry align="left">string</entry><entry align="left"/><entry>If the "dhcp-send-hostname" property is TRUE, then the specified name will be sent to the DHCP server when acquiring a lease. This property and "dhcp-fqdn" are mutually exclusive and cannot be set at the same time.</entry></row>
-    <row><entry align="left">dhcp-send-hostname</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>If TRUE, a hostname is sent to the DHCP server when acquiring a lease. Some DHCP servers use this hostname to update DNS databases, essentially providing a static hostname for the computer.  If the "dhcp-hostname" property is NULL and this property is TRUE, the current persistent hostname of the computer is sent.</entry></row>
-    <row><entry align="left">dhcp-timeout</entry><entry align="left">int32</entry><entry align="left">0</entry><entry>A timeout for a DHCP transaction in seconds.</entry></row>
-    <row><entry align="left">dns</entry><entry align="left">array of byte array</entry><entry align="left">[]</entry><entry>Array of IP addresses of DNS servers (in network byte order)</entry></row>
-    <row><entry align="left">dns-options</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>Array of DNS options. NULL means that the options are unset and left at the default. In this case NetworkManager will use default options. This is distinct from an empty list of properties.</entry></row>
-    <row><entry align="left">dns-priority</entry><entry align="left">int32</entry><entry align="left">0</entry><entry>DNS priority. The relative priority to be used when determining the order of DNS servers in resolv.conf.  A lower value means that servers will be on top of the file.  Zero selects the default value, which is 50 for VPNs and 100 for other connections.  When multiple devices have configurations with the same priority, the one with an active default route will be preferred.  Note that when using dns=dnsmasq the order is meaningless since dnsmasq forwards queries to all known servers at the same time. Negative values have the special effect of excluding other configurations with a greater priority value; so in presence of at least a negative priority, only DNS servers from configurations with the lowest priority value will be used.</entry></row>
-    <row><entry align="left">dns-search</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>Array of DNS search domains.</entry></row>
-    <row><entry align="left">gateway</entry><entry align="left">string</entry><entry align="left"/><entry>The gateway associated with this configuration. This is only meaningful if "addresses" is also set.</entry></row>
-    <row><entry align="left">ignore-auto-dns</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>When "method" is set to "auto" and this property to TRUE, automatically configured nameservers and search domains are ignored and only nameservers and search domains specified in the "dns" and "dns-search" properties, if any, are used.</entry></row>
-    <row><entry align="left">ignore-auto-routes</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>When "method" is set to "auto" and this property to TRUE, automatically configured routes are ignored and only routes specified in the "routes" property, if any, are used.</entry></row>
-    <row><entry align="left">ip6-privacy</entry><entry align="left">NMSettingIP6ConfigPrivacy (int32)</entry><entry align="left"/><entry>Configure IPv6 Privacy Extensions for SLAAC, described in RFC4941.  If enabled, it makes the kernel generate a temporary IPv6 address in addition to the public one generated from MAC address via modified EUI-64.  This enhances privacy, but could cause problems in some applications, on the other hand.  The permitted values are: -1: unknown, 0: disabled, 1: enabled (prefer public address), 2: enabled (prefer temporary addresses). Having a per-connection setting set to "-1" (unknown) means fallback to global configuration "ipv6.ip6-privacy". If also global configuration is unspecified or set to "-1", fallback to read "/proc/sys/net/ipv6/conf/default/use_tempaddr". Note that this setting is distinct from the Stable Privacy addresses that can be enabled with the "addr-gen-mode" property's "stable-privacy" setting as another way of avoiding host tracking with IPv6 addresses.</entry></row>
-    <row><entry align="left">may-fail</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>If TRUE, allow overall network configuration to proceed even if the configuration specified by this property times out.  Note that at least one IP configuration must succeed or overall network configuration will still fail.  For example, in IPv6-only networks, setting this property to TRUE on the NMSettingIP4Config allows the overall network configuration to succeed if IPv4 configuration fails but IPv6 configuration completes successfully.</entry></row>
-    <row><entry align="left">method</entry><entry align="left">string</entry><entry align="left"/><entry>IP configuration method. NMSettingIP4Config and NMSettingIP6Config both support "auto", "manual", and "link-local". See the subclass-specific documentation for other values. In general, for the "auto" method, properties such as "dns" and "routes" specify information that is added on to the information returned from automatic configuration.  The "ignore-auto-routes" and "ignore-auto-dns" properties modify this behavior. For methods that imply no upstream network, such as "shared" or "link-local", these properties must be empty. For IPv4 method "shared", the IP subnet can be configured by adding one manual IPv4 address or otherwise 10.42.x.0/24 is chosen.</entry></row>
-    <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">ipv6</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
-    <row><entry align="left">never-default</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If TRUE, this connection will never be the default connection for this IP type, meaning it will never be assigned the default route by NetworkManager.</entry></row>
-    <row><entry align="left">route-data</entry><entry align="left">array of vardict</entry><entry align="left"/><entry>Array of IPv6 routes. Each route dictionary contains at least 'dest' and 'prefix' entries, containing the destination IP address as a string, and the prefix length as a uint32. Most routes will also have a 'next-hop' entry, containing the next hop IP address as a string. If the route has a 'metric' entry (containing a uint32), that will be used as the metric for the route (otherwise NM will pick a default value appropriate to the device). Additional attributes may also exist on some routes.</entry></row>
-    <row><entry align="left">route-metric</entry><entry align="left">int64</entry><entry align="left">-1</entry><entry>The default metric for routes that don't explicitly specify a metric. The default value -1 means that the metric is choosen automatically based on the device type. The metric applies to dynamic routes, manual (static) routes that don't have an explicit metric setting, address prefix routes, and the default route. Note that for IPv6, the kernel accepts zero (0) but coerces it to 1024 (user default). Hence, setting this property to zero effectively mean setting it to 1024. For IPv4, zero is a regular value for the metric.</entry></row>
-    <row><entry align="left">routes</entry><entry align="left">array of legacy IPv6 route struct (a(ayuayu))</entry><entry align="left">[]</entry><entry>Deprecated in favor of the 'route-data' property, but this can be used for backward-compatibility with older daemons. Note that if you send this property the daemon will ignore 'route-data'.  Array of IPv6 route structures.  Each IPv6 route structure is composed of an IPv6 address, a prefix length (1 - 128), an IPv6 next hop address (which may be zeroed out if there is no next hop), and a metric. If the metric is 0, NM will choose an appropriate default metric for the device.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv6.addr-gen-mode">addr-gen-mode</entry><entry align="left">int32</entry><entry align="left">1</entry><entry>Configure method for creating the address for use with RFC4862 IPv6 Stateless Address Autoconfiguration. The permitted values are: "eui64", or "stable-privacy". If the property is set to "eui64", the addresses will be generated using the interface tokens derived from  hardware address. This makes the host part of the address to stay constant, making it possible to track host's presence when it changes networks. The address changes when the interface hardware is replaced. The value of "stable-privacy" enables use of cryptographically secure hash of a secret host-specific key along with the connection identification and the network address as specified by RFC7217. This makes it impossible to use the address track host's presence, and makes the address stable when the network interface hardware is replaced. On D-Bus, the absence of an addr-gen-mode setting equals enabling "stable-privacy". For keyfile plugin, the absence of the setting on disk means "eui64" so that the property doesn't change on upgrade from older versions. Note that this setting is distinct from the Privacy Extensions as configured by "ip6-privacy" property and it does not affect the temporary addresses configured with this option.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv6.address-data">address-data</entry><entry align="left">array of vardict</entry><entry align="left"/><entry>Array of IPv6 addresses. Each address dictionary contains at least 'address' and 'prefix' entries, containing the IP address as a string, and the prefix length as a uint32. Additional attributes may also exist on some addresses.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv6.addresses">addresses</entry><entry align="left">array of legacy IPv6 address struct (a(ayuay))</entry><entry align="left">[]</entry><entry>Deprecated in favor of the 'address-data' and 'gateway' properties, but this can be used for backward-compatibility with older daemons. Note that if you send this property the daemon will ignore 'address-data' and 'gateway'.  Array of IPv6 address structures.  Each IPv6 address structure is composed of an IPv6 address, a prefix length (1 - 128), and an IPv6 gateway address. The gateway may be zeroed out if no gateway exists for that subnet.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv6.dad-timeout">dad-timeout</entry><entry align="left">int32</entry><entry align="left">-1</entry><entry>Timeout in milliseconds used to check for the presence of duplicate IP addresses on the network.  If an address conflict is detected, the activation will fail.  A zero value means that no duplicate address detection is performed, -1 means the default value (either configuration ipvx.dad-timeout override or 3 seconds).  A value greater than zero is a timeout in milliseconds.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv6.dhcp-hostname">dhcp-hostname</entry><entry align="left">string</entry><entry align="left"/><entry>If the "dhcp-send-hostname" property is TRUE, then the specified name will be sent to the DHCP server when acquiring a lease. This property and "dhcp-fqdn" are mutually exclusive and cannot be set at the same time.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv6.dhcp-send-hostname">dhcp-send-hostname</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>If TRUE, a hostname is sent to the DHCP server when acquiring a lease. Some DHCP servers use this hostname to update DNS databases, essentially providing a static hostname for the computer.  If the "dhcp-hostname" property is NULL and this property is TRUE, the current persistent hostname of the computer is sent.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv6.dhcp-timeout">dhcp-timeout</entry><entry align="left">int32</entry><entry align="left">0</entry><entry>A timeout for a DHCP transaction in seconds.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv6.dns">dns</entry><entry align="left">array of byte array</entry><entry align="left">[]</entry><entry>Array of IP addresses of DNS servers (in network byte order)</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv6.dns-options">dns-options</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>Array of DNS options. NULL means that the options are unset and left at the default. In this case NetworkManager will use default options. This is distinct from an empty list of properties.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv6.dns-priority">dns-priority</entry><entry align="left">int32</entry><entry align="left">0</entry><entry>DNS priority. The relative priority to be used when determining the order of DNS servers in resolv.conf.  A lower value means that servers will be on top of the file.  Zero selects the default value, which is 50 for VPNs and 100 for other connections.  When multiple devices have configurations with the same priority, the one with an active default route will be preferred.  Note that when using dns=dnsmasq the order is meaningless since dnsmasq forwards queries to all known servers at the same time. Negative values have the special effect of excluding other configurations with a greater priority value; so in presence of at least a negative priority, only DNS servers from configurations with the lowest priority value will be used.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv6.dns-search">dns-search</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>Array of DNS search domains.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv6.gateway">gateway</entry><entry align="left">string</entry><entry align="left"/><entry>The gateway associated with this configuration. This is only meaningful if "addresses" is also set.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv6.ignore-auto-dns">ignore-auto-dns</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>When "method" is set to "auto" and this property to TRUE, automatically configured nameservers and search domains are ignored and only nameservers and search domains specified in the "dns" and "dns-search" properties, if any, are used.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv6.ignore-auto-routes">ignore-auto-routes</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>When "method" is set to "auto" and this property to TRUE, automatically configured routes are ignored and only routes specified in the "routes" property, if any, are used.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv6.ip6-privacy">ip6-privacy</entry><entry align="left">NMSettingIP6ConfigPrivacy (int32)</entry><entry align="left"/><entry>Configure IPv6 Privacy Extensions for SLAAC, described in RFC4941.  If enabled, it makes the kernel generate a temporary IPv6 address in addition to the public one generated from MAC address via modified EUI-64.  This enhances privacy, but could cause problems in some applications, on the other hand.  The permitted values are: -1: unknown, 0: disabled, 1: enabled (prefer public address), 2: enabled (prefer temporary addresses). Having a per-connection setting set to "-1" (unknown) means fallback to global configuration "ipv6.ip6-privacy". If also global configuration is unspecified or set to "-1", fallback to read "/proc/sys/net/ipv6/conf/default/use_tempaddr". Note that this setting is distinct from the Stable Privacy addresses that can be enabled with the "addr-gen-mode" property's "stable-privacy" setting as another way of avoiding host tracking with IPv6 addresses.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv6.may-fail">may-fail</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>If TRUE, allow overall network configuration to proceed even if the configuration specified by this property times out.  Note that at least one IP configuration must succeed or overall network configuration will still fail.  For example, in IPv6-only networks, setting this property to TRUE on the NMSettingIP4Config allows the overall network configuration to succeed if IPv4 configuration fails but IPv6 configuration completes successfully.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv6.method">method</entry><entry align="left">string</entry><entry align="left"/><entry>IP configuration method. NMSettingIP4Config and NMSettingIP6Config both support "auto", "manual", and "link-local". See the subclass-specific documentation for other values. In general, for the "auto" method, properties such as "dns" and "routes" specify information that is added on to the information returned from automatic configuration.  The "ignore-auto-routes" and "ignore-auto-dns" properties modify this behavior. For methods that imply no upstream network, such as "shared" or "link-local", these properties must be empty. For IPv4 method "shared", the IP subnet can be configured by adding one manual IPv4 address or otherwise 10.42.x.0/24 is chosen.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv6.name">name</entry><entry align="left">string</entry><entry align="left">ipv6</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv6.never-default">never-default</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If TRUE, this connection will never be the default connection for this IP type, meaning it will never be assigned the default route by NetworkManager.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv6.route-data">route-data</entry><entry align="left">array of vardict</entry><entry align="left"/><entry>Array of IPv6 routes. Each route dictionary contains at least 'dest' and 'prefix' entries, containing the destination IP address as a string, and the prefix length as a uint32. Most routes will also have a 'next-hop' entry, containing the next hop IP address as a string. If the route has a 'metric' entry (containing a uint32), that will be used as the metric for the route (otherwise NM will pick a default value appropriate to the device). Additional attributes may also exist on some routes.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv6.route-metric">route-metric</entry><entry align="left">int64</entry><entry align="left">-1</entry><entry>The default metric for routes that don't explicitly specify a metric. The default value -1 means that the metric is choosen automatically based on the device type. The metric applies to dynamic routes, manual (static) routes that don't have an explicit metric setting, address prefix routes, and the default route. Note that for IPv6, the kernel accepts zero (0) but coerces it to 1024 (user default). Hence, setting this property to zero effectively mean setting it to 1024. For IPv4, zero is a regular value for the metric.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv6.routes">routes</entry><entry align="left">array of legacy IPv6 route struct (a(ayuayu))</entry><entry align="left">[]</entry><entry>Deprecated in favor of the 'route-data' property, but this can be used for backward-compatibility with older daemons. Note that if you send this property the daemon will ignore 'route-data'.  Array of IPv6 route structures.  Each IPv6 route structure is composed of an IPv6 address, a prefix length (1 - 128), an IPv6 next hop address (which may be zeroed out if there is no next hop), and a metric. If the metric is 0, NM will choose an appropriate default metric for the device.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv6.token">token</entry><entry align="left">string</entry><entry align="left"/><entry>Configure the token for draft-chown-6man-tokenised-ipv6-identifiers-02 IPv6 tokenized interface identifiers. Useful with eui64 addr-gen-mode.</entry></row>
   </tbody></tgroup></table>
   <table><title>ip-tunnel setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
-    <row><entry align="left">encapsulation-limit</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>How many additional levels of encapsulation are permitted to be prepended to packets. This property applies only to IPv6 tunnels.</entry></row>
-    <row><entry align="left">flow-label</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>The flow label to assign to tunnel packets. This property applies only to IPv6 tunnels.</entry></row>
-    <row><entry align="left">input-key</entry><entry align="left">string</entry><entry align="left"/><entry>The key used for tunnel input packets; the property is valid only for certain tunnel modes (GRE, IP6GRE). If empty, no key is used.</entry></row>
-    <row><entry align="left">local</entry><entry align="left">string</entry><entry align="left"/><entry>The local endpoint of the tunnel; the value can be empty, otherwise it must contain an IPv4 or IPv6 address.</entry></row>
-    <row><entry align="left">mode</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>The tunneling mode, for example NM_IP_TUNNEL_MODE_IPIP (1) or NM_IP_TUNNEL_MODE_GRE (2).</entry></row>
-    <row><entry align="left">mtu</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>None</entry></row>
-    <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">ip-tunnel</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
-    <row><entry align="left">output-key</entry><entry align="left">string</entry><entry align="left"/><entry>The key used for tunnel output packets; the property is valid only for certain tunnel modes (GRE, IP6GRE). If empty, no key is used.</entry></row>
-    <row><entry align="left">parent</entry><entry align="left">string</entry><entry align="left"/><entry>If given, specifies the parent interface name or parent connection UUID the new device will be bound to so that tunneled packets will only be routed via that interface.</entry></row>
-    <row><entry align="left">path-mtu-discovery</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>Whether to enable Path MTU Discovery on this tunnel.</entry></row>
-    <row><entry align="left">remote</entry><entry align="left">string</entry><entry align="left"/><entry>The remote endpoint of the tunnel; the value must contain an IPv4 or IPv6 address.</entry></row>
-    <row><entry align="left">tos</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>The type of service (IPv4) or traffic class (IPv6) field to be set on tunneled packets.</entry></row>
-    <row><entry align="left">ttl</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>The TTL to assign to tunneled packets. 0 is a special value meaning that packets inherit the TTL value.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ip-tunnel.encapsulation-limit">encapsulation-limit</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>How many additional levels of encapsulation are permitted to be prepended to packets. This property applies only to IPv6 tunnels.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ip-tunnel.flow-label">flow-label</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>The flow label to assign to tunnel packets. This property applies only to IPv6 tunnels.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ip-tunnel.input-key">input-key</entry><entry align="left">string</entry><entry align="left"/><entry>The key used for tunnel input packets; the property is valid only for certain tunnel modes (GRE, IP6GRE). If empty, no key is used.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ip-tunnel.local">local</entry><entry align="left">string</entry><entry align="left"/><entry>The local endpoint of the tunnel; the value can be empty, otherwise it must contain an IPv4 or IPv6 address.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ip-tunnel.mode">mode</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>The tunneling mode, for example NM_IP_TUNNEL_MODE_IPIP (1) or NM_IP_TUNNEL_MODE_GRE (2).</entry></row>
+    <row><entry align="left" id="nm-settings.property.ip-tunnel.mtu">mtu</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>None</entry></row>
+    <row><entry align="left" id="nm-settings.property.ip-tunnel.name">name</entry><entry align="left">string</entry><entry align="left">ip-tunnel</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
+    <row><entry align="left" id="nm-settings.property.ip-tunnel.output-key">output-key</entry><entry align="left">string</entry><entry align="left"/><entry>The key used for tunnel output packets; the property is valid only for certain tunnel modes (GRE, IP6GRE). If empty, no key is used.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ip-tunnel.parent">parent</entry><entry align="left">string</entry><entry align="left"/><entry>If given, specifies the parent interface name or parent connection UUID the new device will be bound to so that tunneled packets will only be routed via that interface.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ip-tunnel.path-mtu-discovery">path-mtu-discovery</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>Whether to enable Path MTU Discovery on this tunnel.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ip-tunnel.remote">remote</entry><entry align="left">string</entry><entry align="left"/><entry>The remote endpoint of the tunnel; the value must contain an IPv4 or IPv6 address.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ip-tunnel.tos">tos</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>The type of service (IPv4) or traffic class (IPv6) field to be set on tunneled packets.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ip-tunnel.ttl">ttl</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>The TTL to assign to tunneled packets. 0 is a special value meaning that packets inherit the TTL value.</entry></row>
   </tbody></tgroup></table>
   <table><title>macvlan setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
-    <row><entry align="left">mode</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>The macvlan mode, which specifies the communication mechanism between multiple macvlans on the same lower device.</entry></row>
-    <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">macvlan</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
-    <row><entry align="left">parent</entry><entry align="left">string</entry><entry align="left"/><entry>If given, specifies the parent interface name or parent connection UUID from which this MAC-VLAN interface should be created.  If this property is not specified, the connection must contain an "802-3-ethernet" setting with a "mac-address" property.</entry></row>
-    <row><entry align="left">promiscuous</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>Whether the interface should be put in promiscuous mode.</entry></row>
-    <row><entry align="left">tap</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>Whether the interface should be a MACVTAP.</entry></row>
+    <row><entry align="left" id="nm-settings.property.macvlan.mode">mode</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>The macvlan mode, which specifies the communication mechanism between multiple macvlans on the same lower device.</entry></row>
+    <row><entry align="left" id="nm-settings.property.macvlan.name">name</entry><entry align="left">string</entry><entry align="left">macvlan</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
+    <row><entry align="left" id="nm-settings.property.macvlan.parent">parent</entry><entry align="left">string</entry><entry align="left"/><entry>If given, specifies the parent interface name or parent connection UUID from which this MAC-VLAN interface should be created.  If this property is not specified, the connection must contain an "802-3-ethernet" setting with a "mac-address" property.</entry></row>
+    <row><entry align="left" id="nm-settings.property.macvlan.promiscuous">promiscuous</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>Whether the interface should be put in promiscuous mode.</entry></row>
+    <row><entry align="left" id="nm-settings.property.macvlan.tap">tap</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>Whether the interface should be a MACVTAP.</entry></row>
   </tbody></tgroup></table>
   <table><title>802-11-olpc-mesh setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
-    <row><entry align="left">channel</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>Channel on which the mesh network to join is located.</entry></row>
-    <row><entry align="left">dhcp-anycast-address</entry><entry align="left">byte array</entry><entry align="left"/><entry>Anycast DHCP MAC address used when requesting an IP address via DHCP. The specific anycast address used determines which DHCP server class answers the request.</entry></row>
-    <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">802-11-olpc-mesh</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
-    <row><entry align="left">ssid</entry><entry align="left">byte array</entry><entry align="left"/><entry>SSID of the mesh network to join.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-11-olpc-mesh.channel">channel</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>Channel on which the mesh network to join is located.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-11-olpc-mesh.dhcp-anycast-address">dhcp-anycast-address</entry><entry align="left">byte array</entry><entry align="left"/><entry>Anycast DHCP MAC address used when requesting an IP address via DHCP. The specific anycast address used determines which DHCP server class answers the request.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-11-olpc-mesh.name">name</entry><entry align="left">string</entry><entry align="left">802-11-olpc-mesh</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-11-olpc-mesh.ssid">ssid</entry><entry align="left">byte array</entry><entry align="left"/><entry>SSID of the mesh network to join.</entry></row>
   </tbody></tgroup></table>
   <table><title>ppp setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
-    <row><entry align="left">baud</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>If non-zero, instruct pppd to set the serial port to the specified baudrate.  This value should normally be left as 0 to automatically choose the speed.</entry></row>
-    <row><entry align="left">crtscts</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If TRUE, specify that pppd should set the serial port to use hardware flow control with RTS and CTS signals.  This value should normally be set to FALSE.</entry></row>
-    <row><entry align="left">lcp-echo-failure</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>If non-zero, instruct pppd to presume the connection to the peer has failed if the specified number of LCP echo-requests go unanswered by the peer.  The "lcp-echo-interval" property must also be set to a non-zero value if this property is used.</entry></row>
-    <row><entry align="left">lcp-echo-interval</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>If non-zero, instruct pppd to send an LCP echo-request frame to the peer every n seconds (where n is the specified value).  Note that some PPP peers will respond to echo requests and some will not, and it is not possible to autodetect this.</entry></row>
-    <row><entry align="left">mppe-stateful</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If TRUE, stateful MPPE is used.  See pppd documentation for more information on stateful MPPE.</entry></row>
-    <row><entry align="left">mru</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>If non-zero, instruct pppd to request that the peer send packets no larger than the specified size.  If non-zero, the MRU should be between 128 and 16384.</entry></row>
-    <row><entry align="left">mtu</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>If non-zero, instruct pppd to send packets no larger than the specified size.</entry></row>
-    <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">ppp</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
-    <row><entry align="left">no-vj-comp</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If TRUE, Van Jacobsen TCP header compression will not be requested.</entry></row>
-    <row><entry align="left">noauth</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>If TRUE, do not require the other side (usually the PPP server) to authenticate itself to the client.  If FALSE, require authentication from the remote side.  In almost all cases, this should be TRUE.</entry></row>
-    <row><entry align="left">nobsdcomp</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If TRUE, BSD compression will not be requested.</entry></row>
-    <row><entry align="left">nodeflate</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If TRUE, "deflate" compression will not be requested.</entry></row>
-    <row><entry align="left">refuse-chap</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If TRUE, the CHAP authentication method will not be used.</entry></row>
-    <row><entry align="left">refuse-eap</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If TRUE, the EAP authentication method will not be used.</entry></row>
-    <row><entry align="left">refuse-mschap</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If TRUE, the MSCHAP authentication method will not be used.</entry></row>
-    <row><entry align="left">refuse-mschapv2</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If TRUE, the MSCHAPv2 authentication method will not be used.</entry></row>
-    <row><entry align="left">refuse-pap</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If TRUE, the PAP authentication method will not be used.</entry></row>
-    <row><entry align="left">require-mppe</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If TRUE, MPPE (Microsoft Point-to-Point Encrpytion) will be required for the PPP session.  If either 64-bit or 128-bit MPPE is not available the session will fail.  Note that MPPE is not used on mobile broadband connections.</entry></row>
-    <row><entry align="left">require-mppe-128</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If TRUE, 128-bit MPPE (Microsoft Point-to-Point Encrpytion) will be required for the PPP session, and the "require-mppe" property must also be set to TRUE.  If 128-bit MPPE is not available the session will fail.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ppp.baud">baud</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>If non-zero, instruct pppd to set the serial port to the specified baudrate.  This value should normally be left as 0 to automatically choose the speed.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ppp.crtscts">crtscts</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If TRUE, specify that pppd should set the serial port to use hardware flow control with RTS and CTS signals.  This value should normally be set to FALSE.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ppp.lcp-echo-failure">lcp-echo-failure</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>If non-zero, instruct pppd to presume the connection to the peer has failed if the specified number of LCP echo-requests go unanswered by the peer.  The "lcp-echo-interval" property must also be set to a non-zero value if this property is used.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ppp.lcp-echo-interval">lcp-echo-interval</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>If non-zero, instruct pppd to send an LCP echo-request frame to the peer every n seconds (where n is the specified value).  Note that some PPP peers will respond to echo requests and some will not, and it is not possible to autodetect this.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ppp.mppe-stateful">mppe-stateful</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If TRUE, stateful MPPE is used.  See pppd documentation for more information on stateful MPPE.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ppp.mru">mru</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>If non-zero, instruct pppd to request that the peer send packets no larger than the specified size.  If non-zero, the MRU should be between 128 and 16384.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ppp.mtu">mtu</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>If non-zero, instruct pppd to send packets no larger than the specified size.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ppp.name">name</entry><entry align="left">string</entry><entry align="left">ppp</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
+    <row><entry align="left" id="nm-settings.property.ppp.no-vj-comp">no-vj-comp</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If TRUE, Van Jacobsen TCP header compression will not be requested.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ppp.noauth">noauth</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>If TRUE, do not require the other side (usually the PPP server) to authenticate itself to the client.  If FALSE, require authentication from the remote side.  In almost all cases, this should be TRUE.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ppp.nobsdcomp">nobsdcomp</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If TRUE, BSD compression will not be requested.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ppp.nodeflate">nodeflate</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If TRUE, "deflate" compression will not be requested.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ppp.refuse-chap">refuse-chap</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If TRUE, the CHAP authentication method will not be used.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ppp.refuse-eap">refuse-eap</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If TRUE, the EAP authentication method will not be used.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ppp.refuse-mschap">refuse-mschap</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If TRUE, the MSCHAP authentication method will not be used.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ppp.refuse-mschapv2">refuse-mschapv2</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If TRUE, the MSCHAPv2 authentication method will not be used.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ppp.refuse-pap">refuse-pap</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If TRUE, the PAP authentication method will not be used.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ppp.require-mppe">require-mppe</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If TRUE, MPPE (Microsoft Point-to-Point Encrpytion) will be required for the PPP session.  If either 64-bit or 128-bit MPPE is not available the session will fail.  Note that MPPE is not used on mobile broadband connections.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ppp.require-mppe-128">require-mppe-128</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If TRUE, 128-bit MPPE (Microsoft Point-to-Point Encrpytion) will be required for the PPP session, and the "require-mppe" property must also be set to TRUE.  If 128-bit MPPE is not available the session will fail.</entry></row>
   </tbody></tgroup></table>
   <table><title>pppoe setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
-    <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">pppoe</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
-    <row><entry align="left">password</entry><entry align="left">string</entry><entry align="left"/><entry>Password used to authenticate with the PPPoE service.</entry></row>
-    <row><entry align="left">password-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "password" property. (see <xref linkend="secrets-flags"/> for flag values)</entry></row>
-    <row><entry align="left">service</entry><entry align="left">string</entry><entry align="left"/><entry>If specified, instruct PPPoE to only initiate sessions with access concentrators that provide the specified service.  For most providers, this should be left blank.  It is only required if there are multiple access concentrators or a specific service is known to be required.</entry></row>
-    <row><entry align="left">username</entry><entry align="left">string</entry><entry align="left"/><entry>Username used to authenticate with the PPPoE service.</entry></row>
+    <row><entry align="left" id="nm-settings.property.pppoe.name">name</entry><entry align="left">string</entry><entry align="left">pppoe</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
+    <row><entry align="left" id="nm-settings.property.pppoe.password">password</entry><entry align="left">string</entry><entry align="left"/><entry>Password used to authenticate with the PPPoE service.</entry></row>
+    <row><entry align="left" id="nm-settings.property.pppoe.password-flags">password-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "password" property. (see <xref linkend="secrets-flags"/> for flag values)</entry></row>
+    <row><entry align="left" id="nm-settings.property.pppoe.service">service</entry><entry align="left">string</entry><entry align="left"/><entry>If specified, instruct PPPoE to only initiate sessions with access concentrators that provide the specified service.  For most providers, this should be left blank.  It is only required if there are multiple access concentrators or a specific service is known to be required.</entry></row>
+    <row><entry align="left" id="nm-settings.property.pppoe.username">username</entry><entry align="left">string</entry><entry align="left"/><entry>Username used to authenticate with the PPPoE service.</entry></row>
   </tbody></tgroup></table>
   <table><title>serial setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
-    <row><entry align="left">baud</entry><entry align="left">uint32</entry><entry align="left">57600</entry><entry>Speed to use for communication over the serial port.  Note that this value usually has no effect for mobile broadband modems as they generally ignore speed settings and use the highest available speed.</entry></row>
-    <row><entry align="left">bits</entry><entry align="left">uint32</entry><entry align="left">8</entry><entry>Byte-width of the serial communication. The 8 in "8n1" for example.</entry></row>
-    <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">serial</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
-    <row><entry align="left">parity</entry><entry align="left">byte</entry><entry align="left"/><entry>The connection parity: 69 (ASCII 'E') for even parity, 111 (ASCII 'o') for odd, 110 (ASCII 'n') for none.</entry></row>
-    <row><entry align="left">send-delay</entry><entry align="left">uint64</entry><entry align="left">0</entry><entry>Time to delay between each byte sent to the modem, in microseconds.</entry></row>
-    <row><entry align="left">stopbits</entry><entry align="left">uint32</entry><entry align="left">1</entry><entry>Number of stop bits for communication on the serial port.  Either 1 or 2. The 1 in "8n1" for example.</entry></row>
+    <row><entry align="left" id="nm-settings.property.serial.baud">baud</entry><entry align="left">uint32</entry><entry align="left">57600</entry><entry>Speed to use for communication over the serial port.  Note that this value usually has no effect for mobile broadband modems as they generally ignore speed settings and use the highest available speed.</entry></row>
+    <row><entry align="left" id="nm-settings.property.serial.bits">bits</entry><entry align="left">uint32</entry><entry align="left">8</entry><entry>Byte-width of the serial communication. The 8 in "8n1" for example.</entry></row>
+    <row><entry align="left" id="nm-settings.property.serial.name">name</entry><entry align="left">string</entry><entry align="left">serial</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
+    <row><entry align="left" id="nm-settings.property.serial.parity">parity</entry><entry align="left">byte</entry><entry align="left"/><entry>The connection parity: 69 (ASCII 'E') for even parity, 111 (ASCII 'o') for odd, 110 (ASCII 'n') for none.</entry></row>
+    <row><entry align="left" id="nm-settings.property.serial.send-delay">send-delay</entry><entry align="left">uint64</entry><entry align="left">0</entry><entry>Time to delay between each byte sent to the modem, in microseconds.</entry></row>
+    <row><entry align="left" id="nm-settings.property.serial.stopbits">stopbits</entry><entry align="left">uint32</entry><entry align="left">1</entry><entry>Number of stop bits for communication on the serial port.  Either 1 or 2. The 1 in "8n1" for example.</entry></row>
   </tbody></tgroup></table>
   <table><title>team setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
-    <row><entry align="left">config</entry><entry align="left">string</entry><entry align="left"/><entry>The JSON configuration for the team network interface.  The property should contain raw JSON configuration data suitable for teamd, because the value is passed directly to teamd. If not specified, the default configuration is used.  See man teamd.conf for the format details.</entry></row>
-    <row><entry align="left">interface-name</entry><entry align="left">string</entry><entry align="left"/><entry>Deprecated in favor of connection.interface-name, but can be used for backward-compatibility with older daemons, to set the team's interface name.</entry></row>
-    <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">team</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
+    <row><entry align="left" id="nm-settings.property.team.config">config</entry><entry align="left">string</entry><entry align="left"/><entry>The JSON configuration for the team network interface.  The property should contain raw JSON configuration data suitable for teamd, because the value is passed directly to teamd. If not specified, the default configuration is used.  See man teamd.conf for the format details.</entry></row>
+    <row><entry align="left" id="nm-settings.property.team.interface-name">interface-name</entry><entry align="left">string</entry><entry align="left"/><entry>Deprecated in favor of connection.interface-name, but can be used for backward-compatibility with older daemons, to set the team's interface name.</entry></row>
+    <row><entry align="left" id="nm-settings.property.team.name">name</entry><entry align="left">string</entry><entry align="left">team</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
   </tbody></tgroup></table>
   <table><title>team-port setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
-    <row><entry align="left">config</entry><entry align="left">string</entry><entry align="left"/><entry>The JSON configuration for the team port. The property should contain raw JSON configuration data suitable for teamd, because the value is passed directly to teamd. If not specified, the default configuration is used. See man teamd.conf for the format details.</entry></row>
-    <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">team-port</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
+    <row><entry align="left" id="nm-settings.property.team-port.config">config</entry><entry align="left">string</entry><entry align="left"/><entry>The JSON configuration for the team port. The property should contain raw JSON configuration data suitable for teamd, because the value is passed directly to teamd. If not specified, the default configuration is used. See man teamd.conf for the format details.</entry></row>
+    <row><entry align="left" id="nm-settings.property.team-port.name">name</entry><entry align="left">string</entry><entry align="left">team-port</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
   </tbody></tgroup></table>
   <table><title>tun setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
-    <row><entry align="left">group</entry><entry align="left">string</entry><entry align="left"/><entry>The group ID which will own the device. If set to NULL everyone will be able to use the device.</entry></row>
-    <row><entry align="left">mode</entry><entry align="left">uint32</entry><entry align="left">1</entry><entry>The operating mode of the virtual device. Allowed values are NM_SETTING_TUN_MODE_TUN (1) to create a layer 3 device and NM_SETTING_TUN_MODE_TAP (2) to create an Ethernet-like layer 2 one.</entry></row>
-    <row><entry align="left">multi-queue</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If the property is set to TRUE, the interface will support multiple file descriptors (queues) to parallelize packet sending or receiving. Otherwise, the interface will only support a single queue.</entry></row>
-    <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">tun</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
-    <row><entry align="left">owner</entry><entry align="left">string</entry><entry align="left"/><entry>The user ID which will own the device. If set to NULL everyone will be able to use the device.</entry></row>
-    <row><entry align="left">pi</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If TRUE the interface will prepend a 4 byte header describing the physical interface to the packets.</entry></row>
-    <row><entry align="left">vnet-hdr</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If TRUE the IFF_VNET_HDR the tunnel packets will include a virtio network header.</entry></row>
+    <row><entry align="left" id="nm-settings.property.tun.group">group</entry><entry align="left">string</entry><entry align="left"/><entry>The group ID which will own the device. If set to NULL everyone will be able to use the device.</entry></row>
+    <row><entry align="left" id="nm-settings.property.tun.mode">mode</entry><entry align="left">uint32</entry><entry align="left">1</entry><entry>The operating mode of the virtual device. Allowed values are NM_SETTING_TUN_MODE_TUN (1) to create a layer 3 device and NM_SETTING_TUN_MODE_TAP (2) to create an Ethernet-like layer 2 one.</entry></row>
+    <row><entry align="left" id="nm-settings.property.tun.multi-queue">multi-queue</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If the property is set to TRUE, the interface will support multiple file descriptors (queues) to parallelize packet sending or receiving. Otherwise, the interface will only support a single queue.</entry></row>
+    <row><entry align="left" id="nm-settings.property.tun.name">name</entry><entry align="left">string</entry><entry align="left">tun</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
+    <row><entry align="left" id="nm-settings.property.tun.owner">owner</entry><entry align="left">string</entry><entry align="left"/><entry>The user ID which will own the device. If set to NULL everyone will be able to use the device.</entry></row>
+    <row><entry align="left" id="nm-settings.property.tun.pi">pi</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If TRUE the interface will prepend a 4 byte header describing the physical interface to the packets.</entry></row>
+    <row><entry align="left" id="nm-settings.property.tun.vnet-hdr">vnet-hdr</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If TRUE the IFF_VNET_HDR the tunnel packets will include a virtio network header.</entry></row>
   </tbody></tgroup></table>
   <table><title>vlan setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
-    <row><entry align="left">egress-priority-map</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>For outgoing packets, a list of mappings from Linux SKB priorities to 802.1p priorities.  The mapping is given in the format "from:to" where both "from" and "to" are unsigned integers, ie "7:3".</entry></row>
-    <row><entry align="left">flags</entry><entry align="left">NMVlanFlags (uint32)</entry><entry align="left"/><entry>One or more flags which control the behavior and features of the VLAN interface.  Flags include NM_VLAN_FLAG_REORDER_HEADERS (0x1) (reordering of output packet headers), NM_VLAN_FLAG_GVRP (0x2) (use of the GVRP protocol), and NM_VLAN_FLAG_LOOSE_BINDING (0x4) (loose binding of the interface to its master device's operating state). NM_VLAN_FLAG_MVRP (0x8) (use of the MVRP protocol). The default value of this property is NM_VLAN_FLAG_REORDER_HEADERS, but it used to be 0. To preserve backward compatibility, the default-value in the D-Bus API continues to be 0 and a missing property on D-Bus is still considered as 0.</entry></row>
-    <row><entry align="left">id</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>The VLAN identifier that the interface created by this connection should be assigned. The valid range is from 0 to 4094, without the reserved id 4095.</entry></row>
-    <row><entry align="left">ingress-priority-map</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>For incoming packets, a list of mappings from 802.1p priorities to Linux SKB priorities.  The mapping is given in the format "from:to" where both "from" and "to" are unsigned integers, ie "7:3".</entry></row>
-    <row><entry align="left">interface-name</entry><entry align="left">string</entry><entry align="left"/><entry>Deprecated in favor of connection.interface-name, but can be used for backward-compatibility with older daemons, to set the vlan's interface name.</entry></row>
-    <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">vlan</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
-    <row><entry align="left">parent</entry><entry align="left">string</entry><entry align="left"/><entry>If given, specifies the parent interface name or parent connection UUID from which this VLAN interface should be created.  If this property is not specified, the connection must contain an "802-3-ethernet" setting with a "mac-address" property.</entry></row>
+    <row><entry align="left" id="nm-settings.property.vlan.egress-priority-map">egress-priority-map</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>For outgoing packets, a list of mappings from Linux SKB priorities to 802.1p priorities.  The mapping is given in the format "from:to" where both "from" and "to" are unsigned integers, ie "7:3".</entry></row>
+    <row><entry align="left" id="nm-settings.property.vlan.flags">flags</entry><entry align="left">NMVlanFlags (uint32)</entry><entry align="left"/><entry>One or more flags which control the behavior and features of the VLAN interface.  Flags include NM_VLAN_FLAG_REORDER_HEADERS (0x1) (reordering of output packet headers), NM_VLAN_FLAG_GVRP (0x2) (use of the GVRP protocol), and NM_VLAN_FLAG_LOOSE_BINDING (0x4) (loose binding of the interface to its master device's operating state). NM_VLAN_FLAG_MVRP (0x8) (use of the MVRP protocol). The default value of this property is NM_VLAN_FLAG_REORDER_HEADERS, but it used to be 0. To preserve backward compatibility, the default-value in the D-Bus API continues to be 0 and a missing property on D-Bus is still considered as 0.</entry></row>
+    <row><entry align="left" id="nm-settings.property.vlan.id">id</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>The VLAN identifier that the interface created by this connection should be assigned. The valid range is from 0 to 4094, without the reserved id 4095.</entry></row>
+    <row><entry align="left" id="nm-settings.property.vlan.ingress-priority-map">ingress-priority-map</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>For incoming packets, a list of mappings from 802.1p priorities to Linux SKB priorities.  The mapping is given in the format "from:to" where both "from" and "to" are unsigned integers, ie "7:3".</entry></row>
+    <row><entry align="left" id="nm-settings.property.vlan.interface-name">interface-name</entry><entry align="left">string</entry><entry align="left"/><entry>Deprecated in favor of connection.interface-name, but can be used for backward-compatibility with older daemons, to set the vlan's interface name.</entry></row>
+    <row><entry align="left" id="nm-settings.property.vlan.name">name</entry><entry align="left">string</entry><entry align="left">vlan</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
+    <row><entry align="left" id="nm-settings.property.vlan.parent">parent</entry><entry align="left">string</entry><entry align="left"/><entry>If given, specifies the parent interface name or parent connection UUID from which this VLAN interface should be created.  If this property is not specified, the connection must contain an "802-3-ethernet" setting with a "mac-address" property.</entry></row>
   </tbody></tgroup></table>
   <table><title>vpn setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
-    <row><entry align="left">data</entry><entry align="left">dict of string to string</entry><entry align="left">{}</entry><entry>Dictionary of key/value pairs of VPN plugin specific data.  Both keys and values must be strings.</entry></row>
-    <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">vpn</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
-    <row><entry align="left">persistent</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If the VPN service supports persistence, and this property is TRUE, the VPN will attempt to stay connected across link changes and outages, until explicitly disconnected.</entry></row>
-    <row><entry align="left">secrets</entry><entry align="left">dict of string to string</entry><entry align="left">{}</entry><entry>Dictionary of key/value pairs of VPN plugin specific secrets like passwords or private keys.  Both keys and values must be strings.</entry></row>
-    <row><entry align="left">service-type</entry><entry align="left">string</entry><entry align="left"/><entry>D-Bus service name of the VPN plugin that this setting uses to connect to its network.  i.e. org.freedesktop.NetworkManager.vpnc for the vpnc plugin.</entry></row>
-    <row><entry align="left">timeout</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>Timeout for the VPN service to establish the connection. Some services may take quite a long time to connect. Value of 0 means a default timeout, which is 60 seconds (unless overriden by vpn.timeout in configuration file). Values greater than zero mean timeout in seconds.</entry></row>
-    <row><entry align="left">user-name</entry><entry align="left">string</entry><entry align="left"/><entry>If the VPN connection requires a user name for authentication, that name should be provided here.  If the connection is available to more than one user, and the VPN requires each user to supply a different name, then leave this property empty.  If this property is empty, NetworkManager will automatically supply the username of the user which requested the VPN connection.</entry></row>
+    <row><entry align="left" id="nm-settings.property.vpn.data">data</entry><entry align="left">dict of string to string</entry><entry align="left">{}</entry><entry>Dictionary of key/value pairs of VPN plugin specific data.  Both keys and values must be strings.</entry></row>
+    <row><entry align="left" id="nm-settings.property.vpn.name">name</entry><entry align="left">string</entry><entry align="left">vpn</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
+    <row><entry align="left" id="nm-settings.property.vpn.persistent">persistent</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If the VPN service supports persistence, and this property is TRUE, the VPN will attempt to stay connected across link changes and outages, until explicitly disconnected.</entry></row>
+    <row><entry align="left" id="nm-settings.property.vpn.secrets">secrets</entry><entry align="left">dict of string to string</entry><entry align="left">{}</entry><entry>Dictionary of key/value pairs of VPN plugin specific secrets like passwords or private keys.  Both keys and values must be strings.</entry></row>
+    <row><entry align="left" id="nm-settings.property.vpn.service-type">service-type</entry><entry align="left">string</entry><entry align="left"/><entry>D-Bus service name of the VPN plugin that this setting uses to connect to its network.  i.e. org.freedesktop.NetworkManager.vpnc for the vpnc plugin.</entry></row>
+    <row><entry align="left" id="nm-settings.property.vpn.timeout">timeout</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>Timeout for the VPN service to establish the connection. Some services may take quite a long time to connect. Value of 0 means a default timeout, which is 60 seconds (unless overriden by vpn.timeout in configuration file). Values greater than zero mean timeout in seconds.</entry></row>
+    <row><entry align="left" id="nm-settings.property.vpn.user-name">user-name</entry><entry align="left">string</entry><entry align="left"/><entry>If the VPN connection requires a user name for authentication, that name should be provided here.  If the connection is available to more than one user, and the VPN requires each user to supply a different name, then leave this property empty.  If this property is empty, NetworkManager will automatically supply the username of the user which requested the VPN connection.</entry></row>
   </tbody></tgroup></table>
   <table><title>vxlan setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
-    <row><entry align="left">ageing</entry><entry align="left">uint32</entry><entry align="left">300</entry><entry>Specifies the lifetime in seconds of FDB entries learnt by the kernel.</entry></row>
-    <row><entry align="left">destination-port</entry><entry align="left">uint32</entry><entry align="left">8472</entry><entry>Specifies the UDP destination port to communicate to the remote VXLAN tunnel endpoint.</entry></row>
-    <row><entry align="left">id</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>Specifies the VXLAN Network Identifer (or VXLAN Segment Identifier) to use.</entry></row>
-    <row><entry align="left">l2-miss</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>Specifies whether netlink LL ADDR miss notifications are generated.</entry></row>
-    <row><entry align="left">l3-miss</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>Specifies whether netlink IP ADDR miss notifications are generated.</entry></row>
-    <row><entry align="left">learning</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>Specifies whether unknown source link layer addresses and IP addresses are entered into the VXLAN device forwarding database.</entry></row>
-    <row><entry align="left">limit</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>Specifies the maximum number of FDB entries. A value of zero means that the kernel will store unlimited entries.</entry></row>
-    <row><entry align="left">local</entry><entry align="left">string</entry><entry align="left"/><entry>If given, specifies the source IP address to use in outgoing packets.</entry></row>
-    <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">vxlan</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
-    <row><entry align="left">parent</entry><entry align="left">string</entry><entry align="left"/><entry>If given, specifies the parent interface name or parent connection UUID.</entry></row>
-    <row><entry align="left">proxy</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>Specifies whether ARP proxy is turned on.</entry></row>
-    <row><entry align="left">remote</entry><entry align="left">string</entry><entry align="left"/><entry>Specifies the unicast destination IP address to use in outgoing packets when the destination link layer address is not known in the VXLAN device forwarding database, or the multicast IP address to join.</entry></row>
-    <row><entry align="left">rsc</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>Specifies whether route short circuit is turned on.</entry></row>
-    <row><entry align="left">source-port-max</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>Specifies the maximum UDP source port to communicate to the remote VXLAN tunnel endpoint.</entry></row>
-    <row><entry align="left">source-port-min</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>Specifies the minimum UDP source port to communicate to the remote VXLAN tunnel endpoint.</entry></row>
-    <row><entry align="left">tos</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>Specifies the TOS value to use in outgoing packets.</entry></row>
-    <row><entry align="left">ttl</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>Specifies the time-to-live value to use in outgoing packets.</entry></row>
+    <row><entry align="left" id="nm-settings.property.vxlan.ageing">ageing</entry><entry align="left">uint32</entry><entry align="left">300</entry><entry>Specifies the lifetime in seconds of FDB entries learnt by the kernel.</entry></row>
+    <row><entry align="left" id="nm-settings.property.vxlan.destination-port">destination-port</entry><entry align="left">uint32</entry><entry align="left">8472</entry><entry>Specifies the UDP destination port to communicate to the remote VXLAN tunnel endpoint.</entry></row>
+    <row><entry align="left" id="nm-settings.property.vxlan.id">id</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>Specifies the VXLAN Network Identifer (or VXLAN Segment Identifier) to use.</entry></row>
+    <row><entry align="left" id="nm-settings.property.vxlan.l2-miss">l2-miss</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>Specifies whether netlink LL ADDR miss notifications are generated.</entry></row>
+    <row><entry align="left" id="nm-settings.property.vxlan.l3-miss">l3-miss</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>Specifies whether netlink IP ADDR miss notifications are generated.</entry></row>
+    <row><entry align="left" id="nm-settings.property.vxlan.learning">learning</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>Specifies whether unknown source link layer addresses and IP addresses are entered into the VXLAN device forwarding database.</entry></row>
+    <row><entry align="left" id="nm-settings.property.vxlan.limit">limit</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>Specifies the maximum number of FDB entries. A value of zero means that the kernel will store unlimited entries.</entry></row>
+    <row><entry align="left" id="nm-settings.property.vxlan.local">local</entry><entry align="left">string</entry><entry align="left"/><entry>If given, specifies the source IP address to use in outgoing packets.</entry></row>
+    <row><entry align="left" id="nm-settings.property.vxlan.name">name</entry><entry align="left">string</entry><entry align="left">vxlan</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
+    <row><entry align="left" id="nm-settings.property.vxlan.parent">parent</entry><entry align="left">string</entry><entry align="left"/><entry>If given, specifies the parent interface name or parent connection UUID.</entry></row>
+    <row><entry align="left" id="nm-settings.property.vxlan.proxy">proxy</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>Specifies whether ARP proxy is turned on.</entry></row>
+    <row><entry align="left" id="nm-settings.property.vxlan.remote">remote</entry><entry align="left">string</entry><entry align="left"/><entry>Specifies the unicast destination IP address to use in outgoing packets when the destination link layer address is not known in the VXLAN device forwarding database, or the multicast IP address to join.</entry></row>
+    <row><entry align="left" id="nm-settings.property.vxlan.rsc">rsc</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>Specifies whether route short circuit is turned on.</entry></row>
+    <row><entry align="left" id="nm-settings.property.vxlan.source-port-max">source-port-max</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>Specifies the maximum UDP source port to communicate to the remote VXLAN tunnel endpoint.</entry></row>
+    <row><entry align="left" id="nm-settings.property.vxlan.source-port-min">source-port-min</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>Specifies the minimum UDP source port to communicate to the remote VXLAN tunnel endpoint.</entry></row>
+    <row><entry align="left" id="nm-settings.property.vxlan.tos">tos</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>Specifies the TOS value to use in outgoing packets.</entry></row>
+    <row><entry align="left" id="nm-settings.property.vxlan.ttl">ttl</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>Specifies the time-to-live value to use in outgoing packets.</entry></row>
   </tbody></tgroup></table>
   <table><title>wimax setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
-    <row><entry align="left">mac-address</entry><entry align="left">byte array</entry><entry align="left"/><entry>If specified, this connection will only apply to the WiMAX device whose MAC address matches. This property does not change the MAC address of the device (known as MAC spoofing). Deprecated: 1</entry></row>
-    <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">wimax</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
-    <row><entry align="left">network-name</entry><entry align="left">string</entry><entry align="left"/><entry>Network Service Provider (NSP) name of the WiMAX network this connection should use. Deprecated: 1</entry></row>
+    <row><entry align="left" id="nm-settings.property.wimax.mac-address">mac-address</entry><entry align="left">byte array</entry><entry align="left"/><entry>If specified, this connection will only apply to the WiMAX device whose MAC address matches. This property does not change the MAC address of the device (known as MAC spoofing). Deprecated: 1</entry></row>
+    <row><entry align="left" id="nm-settings.property.wimax.name">name</entry><entry align="left">string</entry><entry align="left">wimax</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
+    <row><entry align="left" id="nm-settings.property.wimax.network-name">network-name</entry><entry align="left">string</entry><entry align="left"/><entry>Network Service Provider (NSP) name of the WiMAX network this connection should use. Deprecated: 1</entry></row>
   </tbody></tgroup></table>
   <table><title>802-3-ethernet setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
-    <row><entry align="left">auto-negotiate</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>If TRUE, allow auto-negotiation of port speed and duplex mode.  If FALSE, do not allow auto-negotiation, in which case the "speed" and "duplex" properties should be set.</entry></row>
-    <row><entry align="left">cloned-mac-address</entry><entry align="left">byte array</entry><entry align="left"/><entry>If specified, request that the device use this MAC address instead of its permanent MAC address.  This is known as MAC cloning or spoofing.</entry></row>
-    <row><entry align="left">duplex</entry><entry align="left">string</entry><entry align="left"/><entry>If specified, request that the device only use the specified duplex mode. Either "half" or "full".</entry></row>
-    <row><entry align="left">mac-address</entry><entry align="left">byte array</entry><entry align="left"/><entry>If specified, this connection will only apply to the Ethernet device whose permanent MAC address matches. This property does not change the MAC address of the device (i.e. MAC spoofing).</entry></row>
-    <row><entry align="left">mac-address-blacklist</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>If specified, this connection will never apply to the Ethernet device whose permanent MAC address matches an address in the list.  Each MAC address is in the standard hex-digits-and-colons notation (00:11:22:33:44:55).</entry></row>
-    <row><entry align="left">mtu</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>If non-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple Ethernet frames.</entry></row>
-    <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">802-3-ethernet</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
-    <row><entry align="left">port</entry><entry align="left">string</entry><entry align="left"/><entry>Specific port type to use if multiple the device supports multiple attachment methods.  One of "tp" (Twisted Pair), "aui" (Attachment Unit Interface), "bnc" (Thin Ethernet) or "mii" (Media Independent Interface. If the device supports only one port type, this setting is ignored.</entry></row>
-    <row><entry align="left">s390-nettype</entry><entry align="left">string</entry><entry align="left"/><entry>s390 network device type; one of "qeth", "lcs", or "ctc", representing the different types of virtual network devices available on s390 systems.</entry></row>
-    <row><entry align="left">s390-options</entry><entry align="left">dict of string to string</entry><entry align="left">{}</entry><entry>Dictionary of key/value pairs of s390-specific device options.  Both keys and values must be strings.  Allowed keys include "portno", "layer2", "portname", "protocol", among others.  Key names must contain only alphanumeric characters (ie, [a-zA-Z0-9]).</entry></row>
-    <row><entry align="left">s390-subchannels</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>Identifies specific subchannels that this network device uses for communication with z/VM or s390 host.  Like the "mac-address" property for non-z/VM devices, this property can be used to ensure this connection only applies to the network device that uses these subchannels.  The list should contain exactly 3 strings, and each string may only be composed of hexadecimal characters and the period (.) character.</entry></row>
-    <row><entry align="left">speed</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>If non-zero, request that the device use only the specified speed.  In Mbit/s, ie 100 == 100Mbit/s.</entry></row>
-    <row><entry align="left">wake-on-lan</entry><entry align="left">uint32</entry><entry align="left">1</entry><entry>The NMSettingWiredWakeOnLan options to enable. Not all devices support all options. May be any combination of NM_SETTING_WIRED_WAKE_ON_LAN_PHY (0x2), NM_SETTING_WIRED_WAKE_ON_LAN_UNICAST (0x4), NM_SETTING_WIRED_WAKE_ON_LAN_MULTICAST (0x8), NM_SETTING_WIRED_WAKE_ON_LAN_BROADCAST (0x10), NM_SETTING_WIRED_WAKE_ON_LAN_ARP (0x20), NM_SETTING_WIRED_WAKE_ON_LAN_MAGIC (0x40) or the special values NM_SETTING_WIRED_WAKE_ON_LAN_DEFAULT (0x1) (to use global settings) and NM_SETTING_WIRED_WAKE_ON_LAN_IGNORE (0x8000) (to disable management of Wake-on-LAN in NetworkManager).</entry></row>
-    <row><entry align="left">wake-on-lan-password</entry><entry align="left">string</entry><entry align="left"/><entry>If specified, the password used with magic-packet-based Wake-on-LAN, represented as an Ethernet MAC address.  If NULL, no password will be required.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-3-ethernet.assigned-mac-address">assigned-mac-address</entry><entry align="left">string</entry><entry align="left"/><entry>The new field for the cloned MAC address. It can be either a hardware address in ASCII representation, or one of the special values "preserve", "permanent", "random" or "stable". This field replaces the deprecated "cloned-mac-address" on D-Bus, which can only contain explict hardware addresses.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-3-ethernet.auto-negotiate">auto-negotiate</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>If TRUE, allow auto-negotiation of port speed and duplex mode.  If FALSE, do not allow auto-negotiation, in which case the "speed" and "duplex" properties should be set.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-3-ethernet.cloned-mac-address">cloned-mac-address</entry><entry align="left">byte array</entry><entry align="left"/><entry>This D-Bus field is deprecated in favor of "assigned-mac-address" which is more flexible and allows specifying special variants like "random".</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-3-ethernet.duplex">duplex</entry><entry align="left">string</entry><entry align="left"/><entry>If specified, request that the device only use the specified duplex mode. Either "half" or "full".</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-3-ethernet.generate-mac-address-mask">generate-mac-address-mask</entry><entry align="left">string</entry><entry align="left"/><entry>With "cloned-mac-address" setting "random" or "stable", by default all bits of the MAC address are scrambled and a locally-administered, unicast MAC address is created. This property allows to specify that certain bits are fixed. Note that the least significant bit of the first MAC address will always be unset to create a unicast MAC address. If the property is NULL, it is eligible to be overwritten by a default connection setting. If the value is still NULL or an empty string, the default is to create a locally-administered, unicast MAC address. If the value contains one MAC address, this address is used as mask. The set bits of the mask are to be filled with the current MAC address of the device, while the unset bits are subject to randomization. Setting "FE:FF:FF:00:00:00" means to preserve the OUI of the current MAC address and only randomize the lower 3 bytes using the "random" or "stable" algorithm. If the value contains one additional MAC address after the mask, this address is used instead of the current MAC address to fill the bits that shall not be randomized. For example, a value of "FE:FF:FF:00:00:00 68:F7:28:00:00:00" will set the OUI of the MAC address to 68:F7:28, while the lower bits are randomized. A value of "02:00:00:00:00:00 00:00:00:00:00:00" will create a fully scrambled globally-administered, burned-in MAC address. If the value contains more then one additional MAC addresses, one of them is chosen randomly. For example, "02:00:00:00:00:00 00:00:00:00:00:00 02:00:00:00:00:00" will create a fully scrambled MAC address, randomly locally or globally administered.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-3-ethernet.mac-address">mac-address</entry><entry align="left">byte array</entry><entry align="left"/><entry>If specified, this connection will only apply to the Ethernet device whose permanent MAC address matches. This property does not change the MAC address of the device (i.e. MAC spoofing).</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-3-ethernet.mac-address-blacklist">mac-address-blacklist</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>If specified, this connection will never apply to the Ethernet device whose permanent MAC address matches an address in the list.  Each MAC address is in the standard hex-digits-and-colons notation (00:11:22:33:44:55).</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-3-ethernet.mtu">mtu</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>If non-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple Ethernet frames.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-3-ethernet.name">name</entry><entry align="left">string</entry><entry align="left">802-3-ethernet</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-3-ethernet.port">port</entry><entry align="left">string</entry><entry align="left"/><entry>Specific port type to use if multiple the device supports multiple attachment methods.  One of "tp" (Twisted Pair), "aui" (Attachment Unit Interface), "bnc" (Thin Ethernet) or "mii" (Media Independent Interface. If the device supports only one port type, this setting is ignored.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-3-ethernet.s390-nettype">s390-nettype</entry><entry align="left">string</entry><entry align="left"/><entry>s390 network device type; one of "qeth", "lcs", or "ctc", representing the different types of virtual network devices available on s390 systems.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-3-ethernet.s390-options">s390-options</entry><entry align="left">dict of string to string</entry><entry align="left">{}</entry><entry>Dictionary of key/value pairs of s390-specific device options.  Both keys and values must be strings.  Allowed keys include "portno", "layer2", "portname", "protocol", among others.  Key names must contain only alphanumeric characters (ie, [a-zA-Z0-9]).</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-3-ethernet.s390-subchannels">s390-subchannels</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>Identifies specific subchannels that this network device uses for communication with z/VM or s390 host.  Like the "mac-address" property for non-z/VM devices, this property can be used to ensure this connection only applies to the network device that uses these subchannels.  The list should contain exactly 3 strings, and each string may only be composed of hexadecimal characters and the period (.) character.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-3-ethernet.speed">speed</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>If non-zero, request that the device use only the specified speed.  In Mbit/s, ie 100 == 100Mbit/s.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-3-ethernet.wake-on-lan">wake-on-lan</entry><entry align="left">uint32</entry><entry align="left">1</entry><entry>The NMSettingWiredWakeOnLan options to enable. Not all devices support all options. May be any combination of NM_SETTING_WIRED_WAKE_ON_LAN_PHY (0x2), NM_SETTING_WIRED_WAKE_ON_LAN_UNICAST (0x4), NM_SETTING_WIRED_WAKE_ON_LAN_MULTICAST (0x8), NM_SETTING_WIRED_WAKE_ON_LAN_BROADCAST (0x10), NM_SETTING_WIRED_WAKE_ON_LAN_ARP (0x20), NM_SETTING_WIRED_WAKE_ON_LAN_MAGIC (0x40) or the special values NM_SETTING_WIRED_WAKE_ON_LAN_DEFAULT (0x1) (to use global settings) and NM_SETTING_WIRED_WAKE_ON_LAN_IGNORE (0x8000) (to disable management of Wake-on-LAN in NetworkManager).</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-3-ethernet.wake-on-lan-password">wake-on-lan-password</entry><entry align="left">string</entry><entry align="left"/><entry>If specified, the password used with magic-packet-based Wake-on-LAN, represented as an Ethernet MAC address.  If NULL, no password will be required.</entry></row>
   </tbody></tgroup></table>
   <table><title>802-11-wireless setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
-    <row><entry align="left">band</entry><entry align="left">string</entry><entry align="left"/><entry>802.11 frequency band of the network.  One of "a" for 5GHz 802.11a or "bg" for 2.4GHz 802.11.  This will lock associations to the Wi-Fi network to the specific band, i.e. if "a" is specified, the device will not associate with the same network in the 2.4GHz band even if the network's settings are compatible.  This setting depends on specific driver capability and may not work with all drivers.</entry></row>
-    <row><entry align="left">bssid</entry><entry align="left">byte array</entry><entry align="left"/><entry>If specified, directs the device to only associate with the given access point.  This capability is highly driver dependent and not supported by all devices.  Note: this property does not control the BSSID used when creating an Ad-Hoc network and is unlikely to in the future.</entry></row>
-    <row><entry align="left">channel</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>Wireless channel to use for the Wi-Fi connection.  The device will only join (or create for Ad-Hoc networks) a Wi-Fi network on the specified channel.  Because channel numbers overlap between bands, this property also requires the "band" property to be set.</entry></row>
-    <row><entry align="left">cloned-mac-address</entry><entry align="left">byte array</entry><entry align="left"/><entry>If specified, request that the Wi-Fi device use this MAC address instead of its permanent MAC address.  This is known as MAC cloning or spoofing.</entry></row>
-    <row><entry align="left">hidden</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If TRUE, indicates this network is a non-broadcasting network that hides its SSID.  In this case various workarounds may take place, such as probe-scanning the SSID for more reliable network discovery.  However, these workarounds expose inherent insecurities with hidden SSID networks, and thus hidden SSID networks should be used with caution.</entry></row>
-    <row><entry align="left">mac-address</entry><entry align="left">byte array</entry><entry align="left"/><entry>If specified, this connection will only apply to the Wi-Fi device whose permanent MAC address matches. This property does not change the MAC address of the device (i.e. MAC spoofing).</entry></row>
-    <row><entry align="left">mac-address-blacklist</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>A list of permanent MAC addresses of Wi-Fi devices to which this connection should never apply.  Each MAC address should be given in the standard hex-digits-and-colons notation (eg "00:11:22:33:44:55").</entry></row>
-    <row><entry align="left">mac-address-randomization</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>One of NM_SETTING_MAC_RANDOMIZATION_DEFAULT (0) (never randomize unless the user has set a global default to randomize and the supplicant supports randomization),  NM_SETTING_MAC_RANDOMIZATION_NEVER (1) (never randomize the MAC address), or NM_SETTING_MAC_RANDOMIZATION_ALWAYS (2) (always randomize the MAC address).</entry></row>
-    <row><entry align="left">mode</entry><entry align="left">string</entry><entry align="left"/><entry>Wi-Fi network mode; one of "infrastructure", "adhoc" or "ap".  If blank, infrastructure is assumed.</entry></row>
-    <row><entry align="left">mtu</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>If non-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple Ethernet frames.</entry></row>
-    <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">802-11-wireless</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
-    <row><entry align="left">powersave</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>One of NM_SETTING_WIRELESS_POWERSAVE_DISABLE (2) (disable Wi-Fi power saving), NM_SETTING_WIRELESS_POWERSAVE_ENABLE (3) (enable Wi-Fi power saving), NM_SETTING_WIRELESS_POWERSAVE_IGNORE (1) (don't touch currently configure setting) or NM_SETTING_WIRELESS_POWERSAVE_DEFAULT (0) (use the globally configured value). All other values are reserved.</entry></row>
-    <row><entry align="left">rate</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>If non-zero, directs the device to only use the specified bitrate for communication with the access point.  Units are in Kb/s, ie 5500 = 5.5 Mbit/s.  This property is highly driver dependent and not all devices support setting a static bitrate.</entry></row>
-    <row><entry align="left">security</entry><entry align="left">None</entry><entry align="left"/><entry>This property is deprecated, but can be set to the value '802-11-wireless-security' when a wireless security setting is also present in the connection dictionary, for compatibility with very old NetworkManager daemons.</entry></row>
-    <row><entry align="left">seen-bssids</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>A list of BSSIDs (each BSSID formatted as a MAC address like "00:11:22:33:44:55") that have been detected as part of the Wi-Fi network.  NetworkManager internally tracks previously seen BSSIDs. The property is only meant for reading and reflects the BSSID list of NetworkManager. The changes you make to this property will not be preserved.</entry></row>
-    <row><entry align="left">ssid</entry><entry align="left">byte array</entry><entry align="left"/><entry>SSID of the Wi-Fi network. Must be specified.</entry></row>
-    <row><entry align="left">tx-power</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>If non-zero, directs the device to use the specified transmit power. Units are dBm.  This property is highly driver dependent and not all devices support setting a static transmit power.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-11-wireless.assigned-mac-address">assigned-mac-address</entry><entry align="left">string</entry><entry align="left"/><entry>The new field for the cloned MAC address. It can be either a hardware address in ASCII representation, or one of the special values "preserve", "permanent", "random" or "stable". This field replaces the deprecated "cloned-mac-address" on D-Bus, which can only contain explict hardware addresses.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-11-wireless.band">band</entry><entry align="left">string</entry><entry align="left"/><entry>802.11 frequency band of the network.  One of "a" for 5GHz 802.11a or "bg" for 2.4GHz 802.11.  This will lock associations to the Wi-Fi network to the specific band, i.e. if "a" is specified, the device will not associate with the same network in the 2.4GHz band even if the network's settings are compatible.  This setting depends on specific driver capability and may not work with all drivers.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-11-wireless.bssid">bssid</entry><entry align="left">byte array</entry><entry align="left"/><entry>If specified, directs the device to only associate with the given access point.  This capability is highly driver dependent and not supported by all devices.  Note: this property does not control the BSSID used when creating an Ad-Hoc network and is unlikely to in the future.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-11-wireless.channel">channel</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>Wireless channel to use for the Wi-Fi connection.  The device will only join (or create for Ad-Hoc networks) a Wi-Fi network on the specified channel.  Because channel numbers overlap between bands, this property also requires the "band" property to be set.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-11-wireless.cloned-mac-address">cloned-mac-address</entry><entry align="left">byte array</entry><entry align="left"/><entry>This D-Bus field is deprecated in favor of "assigned-mac-address" which is more flexible and allows specifying special variants like "random".</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-11-wireless.generate-mac-address-mask">generate-mac-address-mask</entry><entry align="left">string</entry><entry align="left"/><entry>With "cloned-mac-address" setting "random" or "stable", by default all bits of the MAC address are scrambled and a locally-administered, unicast MAC address is created. This property allows to specify that certain bits are fixed. Note that the least significant bit of the first MAC address will always be unset to create a unicast MAC address. If the property is NULL, it is eligible to be overwritten by a default connection setting. If the value is still NULL or an empty string, the default is to create a locally-administered, unicast MAC address. If the value contains one MAC address, this address is used as mask. The set bits of the mask are to be filled with the current MAC address of the device, while the unset bits are subject to randomization. Setting "FE:FF:FF:00:00:00" means to preserve the OUI of the current MAC address and only randomize the lower 3 bytes using the "random" or "stable" algorithm. If the value contains one additional MAC address after the mask, this address is used instead of the current MAC address to fill the bits that shall not be randomized. For example, a value of "FE:FF:FF:00:00:00 68:F7:28:00:00:00" will set the OUI of the MAC address to 68:F7:28, while the lower bits are randomized. A value of "02:00:00:00:00:00 00:00:00:00:00:00" will create a fully scrambled globally-administered, burned-in MAC address. If the value contains more then one additional MAC addresses, one of them is chosen randomly. For example, "02:00:00:00:00:00 00:00:00:00:00:00 02:00:00:00:00:00" will create a fully scrambled MAC address, randomly locally or globally administered.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-11-wireless.hidden">hidden</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If TRUE, indicates this network is a non-broadcasting network that hides its SSID.  In this case various workarounds may take place, such as probe-scanning the SSID for more reliable network discovery.  However, these workarounds expose inherent insecurities with hidden SSID networks, and thus hidden SSID networks should be used with caution.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-11-wireless.mac-address">mac-address</entry><entry align="left">byte array</entry><entry align="left"/><entry>If specified, this connection will only apply to the Wi-Fi device whose permanent MAC address matches. This property does not change the MAC address of the device (i.e. MAC spoofing).</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-11-wireless.mac-address-blacklist">mac-address-blacklist</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>A list of permanent MAC addresses of Wi-Fi devices to which this connection should never apply.  Each MAC address should be given in the standard hex-digits-and-colons notation (eg "00:11:22:33:44:55").</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-11-wireless.mac-address-randomization">mac-address-randomization</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>One of NM_SETTING_MAC_RANDOMIZATION_DEFAULT (0) (never randomize unless the user has set a global default to randomize and the supplicant supports randomization),  NM_SETTING_MAC_RANDOMIZATION_NEVER (1) (never randomize the MAC address), or NM_SETTING_MAC_RANDOMIZATION_ALWAYS (2) (always randomize the MAC address). Deprecated: 1</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-11-wireless.mode">mode</entry><entry align="left">string</entry><entry align="left"/><entry>Wi-Fi network mode; one of "infrastructure", "adhoc" or "ap".  If blank, infrastructure is assumed.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-11-wireless.mtu">mtu</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>If non-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple Ethernet frames.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-11-wireless.name">name</entry><entry align="left">string</entry><entry align="left">802-11-wireless</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-11-wireless.powersave">powersave</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>One of NM_SETTING_WIRELESS_POWERSAVE_DISABLE (2) (disable Wi-Fi power saving), NM_SETTING_WIRELESS_POWERSAVE_ENABLE (3) (enable Wi-Fi power saving), NM_SETTING_WIRELESS_POWERSAVE_IGNORE (1) (don't touch currently configure setting) or NM_SETTING_WIRELESS_POWERSAVE_DEFAULT (0) (use the globally configured value). All other values are reserved.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-11-wireless.rate">rate</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>If non-zero, directs the device to only use the specified bitrate for communication with the access point.  Units are in Kb/s, ie 5500 = 5.5 Mbit/s.  This property is highly driver dependent and not all devices support setting a static bitrate.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-11-wireless.security">security</entry><entry align="left">None</entry><entry align="left"/><entry>This property is deprecated, but can be set to the value '802-11-wireless-security' when a wireless security setting is also present in the connection dictionary, for compatibility with very old NetworkManager daemons.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-11-wireless.seen-bssids">seen-bssids</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>A list of BSSIDs (each BSSID formatted as a MAC address like "00:11:22:33:44:55") that have been detected as part of the Wi-Fi network.  NetworkManager internally tracks previously seen BSSIDs. The property is only meant for reading and reflects the BSSID list of NetworkManager. The changes you make to this property will not be preserved.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-11-wireless.ssid">ssid</entry><entry align="left">byte array</entry><entry align="left"/><entry>SSID of the Wi-Fi network. Must be specified.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-11-wireless.tx-power">tx-power</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>If non-zero, directs the device to use the specified transmit power. Units are dBm.  This property is highly driver dependent and not all devices support setting a static transmit power.</entry></row>
   </tbody></tgroup></table>
   <table><title>802-11-wireless-security setting</title><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
-    <row><entry align="left">auth-alg</entry><entry align="left">string</entry><entry align="left"/><entry>When WEP is used (ie, key-mgmt = "none" or "ieee8021x") indicate the 802.11 authentication algorithm required by the AP here.  One of "open" for Open System, "shared" for Shared Key, or "leap" for Cisco LEAP.  When using Cisco LEAP (ie, key-mgmt = "ieee8021x" and auth-alg = "leap") the "leap-username" and "leap-password" properties must be specified.</entry></row>
-    <row><entry align="left">group</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>A list of group/broadcast encryption algorithms which prevents connections to Wi-Fi networks that do not utilize one of the algorithms in the list.  For maximum compatibility leave this property empty.  Each list element may be one of "wep40", "wep104", "tkip", or "ccmp".</entry></row>
-    <row><entry align="left">key-mgmt</entry><entry align="left">string</entry><entry align="left"/><entry>Key management used for the connection.  One of "none" (WEP), "ieee8021x" (Dynamic WEP), "wpa-none" (Ad-Hoc WPA-PSK), "wpa-psk" (infrastructure WPA-PSK), or "wpa-eap" (WPA-Enterprise).  This property must be set for any Wi-Fi connection that uses security.</entry></row>
-    <row><entry align="left">leap-password</entry><entry align="left">string</entry><entry align="left"/><entry>The login password for legacy LEAP connections (ie, key-mgmt = "ieee8021x" and auth-alg = "leap").</entry></row>
-    <row><entry align="left">leap-password-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "leap-password" property. (see <xref linkend="secrets-flags"/> for flag values)</entry></row>
-    <row><entry align="left">leap-username</entry><entry align="left">string</entry><entry align="left"/><entry>The login username for legacy LEAP connections (ie, key-mgmt = "ieee8021x" and auth-alg = "leap").</entry></row>
-    <row><entry align="left">name</entry><entry align="left">string</entry><entry align="left">802-11-wireless-security</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
-    <row><entry align="left">pairwise</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>A list of pairwise encryption algorithms which prevents connections to Wi-Fi networks that do not utilize one of the algorithms in the list. For maximum compatibility leave this property empty.  Each list element may be one of "tkip" or "ccmp".</entry></row>
-    <row><entry align="left">proto</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>List of strings specifying the allowed WPA protocol versions to use. Each element may be one "wpa" (allow WPA) or "rsn" (allow WPA2/RSN).  If not specified, both WPA and RSN connections are allowed.</entry></row>
-    <row><entry align="left">psk</entry><entry align="left">string</entry><entry align="left"/><entry>Pre-Shared-Key for WPA networks.  If the key is 64-characters long, it must contain only hexadecimal characters and is interpreted as a hexadecimal WPA key.  Otherwise, the key must be between 8 and 63 ASCII characters (as specified in the 802.11i standard) and is interpreted as a WPA passphrase, and is hashed to derive the actual WPA-PSK used when connecting to the Wi-Fi network.</entry></row>
-    <row><entry align="left">psk-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "psk" property. (see <xref linkend="secrets-flags"/> for flag values)</entry></row>
-    <row><entry align="left">wep-key-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "wep-key0", "wep-key1", "wep-key2", and "wep-key3" properties. (see <xref linkend="secrets-flags"/> for flag values)</entry></row>
-    <row><entry align="left">wep-key-type</entry><entry align="left">NMWepKeyType (uint32)</entry><entry align="left"/><entry>Controls the interpretation of WEP keys.  Allowed values are NM_WEP_KEY_TYPE_KEY (1), in which case the key is either a 10- or 26-character hexadecimal string, or a 5- or 13-character ASCII password; or NM_WEP_KEY_TYPE_PASSPHRASE (2), in which case the passphrase is provided as a string and will be hashed using the de-facto MD5 method to derive the actual WEP key.</entry></row>
-    <row><entry align="left">wep-key0</entry><entry align="left">string</entry><entry align="left"/><entry>Index 0 WEP key.  This is the WEP key used in most networks.  See the "wep-key-type" property for a description of how this key is interpreted.</entry></row>
-    <row><entry align="left">wep-key1</entry><entry align="left">string</entry><entry align="left"/><entry>Index 1 WEP key.  This WEP index is not used by most networks.  See the "wep-key-type" property for a description of how this key is interpreted.</entry></row>
-    <row><entry align="left">wep-key2</entry><entry align="left">string</entry><entry align="left"/><entry>Index 2 WEP key.  This WEP index is not used by most networks.  See the "wep-key-type" property for a description of how this key is interpreted.</entry></row>
-    <row><entry align="left">wep-key3</entry><entry align="left">string</entry><entry align="left"/><entry>Index 3 WEP key.  This WEP index is not used by most networks.  See the "wep-key-type" property for a description of how this key is interpreted.</entry></row>
-    <row><entry align="left">wep-tx-keyidx</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>When static WEP is used (ie, key-mgmt = "none") and a non-default WEP key index is used by the AP, put that WEP key index here.  Valid values are 0 (default key) through 3.  Note that some consumer access points (like the Linksys WRT54G) number the keys 1 - 4.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-11-wireless-security.auth-alg">auth-alg</entry><entry align="left">string</entry><entry align="left"/><entry>When WEP is used (ie, key-mgmt = "none" or "ieee8021x") indicate the 802.11 authentication algorithm required by the AP here.  One of "open" for Open System, "shared" for Shared Key, or "leap" for Cisco LEAP.  When using Cisco LEAP (ie, key-mgmt = "ieee8021x" and auth-alg = "leap") the "leap-username" and "leap-password" properties must be specified.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-11-wireless-security.group">group</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>A list of group/broadcast encryption algorithms which prevents connections to Wi-Fi networks that do not utilize one of the algorithms in the list.  For maximum compatibility leave this property empty.  Each list element may be one of "wep40", "wep104", "tkip", or "ccmp".</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-11-wireless-security.key-mgmt">key-mgmt</entry><entry align="left">string</entry><entry align="left"/><entry>Key management used for the connection.  One of "none" (WEP), "ieee8021x" (Dynamic WEP), "wpa-none" (Ad-Hoc WPA-PSK), "wpa-psk" (infrastructure WPA-PSK), or "wpa-eap" (WPA-Enterprise).  This property must be set for any Wi-Fi connection that uses security.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-11-wireless-security.leap-password">leap-password</entry><entry align="left">string</entry><entry align="left"/><entry>The login password for legacy LEAP connections (ie, key-mgmt = "ieee8021x" and auth-alg = "leap").</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-11-wireless-security.leap-password-flags">leap-password-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "leap-password" property. (see <xref linkend="secrets-flags"/> for flag values)</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-11-wireless-security.leap-username">leap-username</entry><entry align="left">string</entry><entry align="left"/><entry>The login username for legacy LEAP connections (ie, key-mgmt = "ieee8021x" and auth-alg = "leap").</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-11-wireless-security.name">name</entry><entry align="left">string</entry><entry align="left">802-11-wireless-security</entry><entry>The setting's name, which uniquely identifies the setting within the connection.  Each setting type has a name unique to that type, for example "ppp" or "wireless" or "wired".</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-11-wireless-security.pairwise">pairwise</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>A list of pairwise encryption algorithms which prevents connections to Wi-Fi networks that do not utilize one of the algorithms in the list. For maximum compatibility leave this property empty.  Each list element may be one of "tkip" or "ccmp".</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-11-wireless-security.proto">proto</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>List of strings specifying the allowed WPA protocol versions to use. Each element may be one "wpa" (allow WPA) or "rsn" (allow WPA2/RSN).  If not specified, both WPA and RSN connections are allowed.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-11-wireless-security.psk">psk</entry><entry align="left">string</entry><entry align="left"/><entry>Pre-Shared-Key for WPA networks.  If the key is 64-characters long, it must contain only hexadecimal characters and is interpreted as a hexadecimal WPA key.  Otherwise, the key must be between 8 and 63 ASCII characters (as specified in the 802.11i standard) and is interpreted as a WPA passphrase, and is hashed to derive the actual WPA-PSK used when connecting to the Wi-Fi network.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-11-wireless-security.psk-flags">psk-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "psk" property. (see <xref linkend="secrets-flags"/> for flag values)</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-11-wireless-security.wep-key-flags">wep-key-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "wep-key0", "wep-key1", "wep-key2", and "wep-key3" properties. (see <xref linkend="secrets-flags"/> for flag values)</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-11-wireless-security.wep-key-type">wep-key-type</entry><entry align="left">NMWepKeyType (uint32)</entry><entry align="left"/><entry>Controls the interpretation of WEP keys.  Allowed values are NM_WEP_KEY_TYPE_KEY (1), in which case the key is either a 10- or 26-character hexadecimal string, or a 5- or 13-character ASCII password; or NM_WEP_KEY_TYPE_PASSPHRASE (2), in which case the passphrase is provided as a string and will be hashed using the de-facto MD5 method to derive the actual WEP key.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-11-wireless-security.wep-key0">wep-key0</entry><entry align="left">string</entry><entry align="left"/><entry>Index 0 WEP key.  This is the WEP key used in most networks.  See the "wep-key-type" property for a description of how this key is interpreted.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-11-wireless-security.wep-key1">wep-key1</entry><entry align="left">string</entry><entry align="left"/><entry>Index 1 WEP key.  This WEP index is not used by most networks.  See the "wep-key-type" property for a description of how this key is interpreted.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-11-wireless-security.wep-key2">wep-key2</entry><entry align="left">string</entry><entry align="left"/><entry>Index 2 WEP key.  This WEP index is not used by most networks.  See the "wep-key-type" property for a description of how this key is interpreted.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-11-wireless-security.wep-key3">wep-key3</entry><entry align="left">string</entry><entry align="left"/><entry>Index 3 WEP key.  This WEP index is not used by most networks.  See the "wep-key-type" property for a description of how this key is interpreted.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-11-wireless-security.wep-tx-keyidx">wep-tx-keyidx</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>When static WEP is used (ie, key-mgmt = "none") and a non-default WEP key index is used by the AP, put that WEP key index here.  Valid values are 0 (default key) through 3.  Note that some consumer access points (like the Linksys WRT54G) number the keys 1 - 4.</entry></row>
   </tbody></tgroup></table>
 <refsect2 id="secrets-flags"><title>Secret flag types:</title><para>
             Each secret property in a setting has an associated <emphasis>flags</emphasis> property
@@ -414,7 +420,7 @@
               this secret; when it is required, agents will be asked to provide it.</para></listitem><listitem><para>0x2 (not-saved) - this secret should not be saved but should be requested from the user
               each time it is required. This flag should be used for One-Time-Pad secrets, PIN codes from hardware tokens,
               or if the user simply does not want to save the secret.</para></listitem><listitem><para>0x4 (not-required) - in some situations it cannot be automatically determined that a secret
-              is required or not. This flag hints that the secret is not required and should not be requested from the user.</para></listitem></itemizedlist></refsect2></refsect1><refsect1 id="files"><title>Files</title><para><filename>/etc/NetworkManager/system-connections</filename> or distro plugin-specific location</para></refsect1><refsect1 id="see_also"><title>See Also</title><para><citerefentry><refentrytitle>NetworkManager</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
-        <citerefentry><refentrytitle>nmcli</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
-        <citerefentry><refentrytitle>nmcli-examples</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
-        <citerefentry><refentrytitle>NetworkManager.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry></para></refsect1></refentry>
+              is required or not. This flag hints that the secret is not required and should not be requested from the user.</para></listitem></itemizedlist></refsect2></refsect1><refsect1 id="files"><title>Files</title><para><filename>/etc/NetworkManager/system-connections</filename> or distro plugin-specific location</para></refsect1><refsect1 id="see_also"><title>See Also</title><para><link linkend="NetworkManager"><citerefentry><refentrytitle>NetworkManager</refentrytitle><manvolnum>8</manvolnum></citerefentry></link>,
+        <link linkend="nmcli"><citerefentry><refentrytitle>nmcli</refentrytitle><manvolnum>1</manvolnum></citerefentry></link>,
+        <link linkend="nmcli-examples"><citerefentry><refentrytitle>nmcli-examples</refentrytitle><manvolnum>7</manvolnum></citerefentry></link>,
+        <link linkend="NetworkManager.conf"><citerefentry><refentrytitle>NetworkManager.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry></link></para></refsect1></refentry>
diff --git a/man/nm-settings.xsl b/man/nm-settings.xsl
index 0fe4cabe..03a10766 100644
--- a/man/nm-settings.xsl
+++ b/man/nm-settings.xsl
@@ -117,10 +117,10 @@
       </refsect1>
 
       <refsect1 id='see_also'><title>See Also</title>
-        <para><citerefentry><refentrytitle>NetworkManager</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
-        <citerefentry><refentrytitle>nmcli</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
-        <citerefentry><refentrytitle>nmcli-examples</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
-        <citerefentry><refentrytitle>NetworkManager.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry></para>
+        <para><link linkend='NetworkManager'><citerefentry><refentrytitle>NetworkManager</refentrytitle><manvolnum>8</manvolnum></citerefentry></link>,
+        <link linkend='nmcli'><citerefentry><refentrytitle>nmcli</refentrytitle><manvolnum>1</manvolnum></citerefentry></link>,
+        <link linkend='nmcli-examples'><citerefentry><refentrytitle>nmcli-examples</refentrytitle><manvolnum>7</manvolnum></citerefentry></link>,
+        <link linkend='NetworkManager.conf'><citerefentry><refentrytitle>NetworkManager.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry></link></para>
       </refsect1>
     </refentry>
   </xsl:template>
@@ -147,7 +147,7 @@
   <xsl:template match="property">
     <xsl:variable name="setting_name" select="../@name"/>
     <row>
-      <entry align="left"><xsl:value-of select="@name"/></entry>
+      <entry align="left"><xsl:attribute name="id">nm-settings.property.<xsl:value-of select="../@name"/>.<xsl:value-of select="@name"/></xsl:attribute><xsl:value-of select="@name"/></entry>
       <entry align="left"><xsl:value-of select="@type"/></entry>
       <entry align="left"><xsl:value-of select="@default"/></entry>
       <entry><xsl:value-of select="@description"/><xsl:if test="@type = 'NMSettingSecretFlags (uint32)'"> (see <xref linkend="secrets-flags"/> for flag values)</xsl:if></entry>
diff --git a/man/nmcli-examples.7 b/man/nmcli-examples.7
index a1056f02..5d8c680b 100644
--- a/man/nmcli-examples.7
+++ b/man/nmcli-examples.7
@@ -2,12 +2,12 @@
 .\"     Title: nmcli-examples
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
-.\"      Date: 08/03/2016
+.\"      Date: 08/24/2016
 .\"    Manual: Examples
-.\"    Source: NetworkManager 1.2.4
+.\"    Source: NetworkManager 1.4.0
 .\"  Language: English
 .\"
-.TH "NMCLI\-EXAMPLES" "7" "" "NetworkManager 1\&.2\&.4" "Examples"
+.TH "NMCLI\-EXAMPLES" "7" "" "NetworkManager 1\&.4\&.0" "Examples"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -139,7 +139,8 @@ org\&.freedesktop\&.NetworkManager\&.wifi\&.share\&.open            yes
 org\&.freedesktop\&.NetworkManager\&.settings\&.modify\&.system     yes
 org\&.freedesktop\&.NetworkManager\&.settings\&.modify\&.own        yes
 org\&.freedesktop\&.NetworkManager\&.settings\&.modify\&.hostname   auth
-org\&.freedesktop\&.NetworkManager\&.reload                     no
+org\&.freedesktop\&.NetworkManager\&.settings\&.modify\&.global\-dns auth
+org\&.freedesktop\&.NetworkManager\&.reload                     auth
 .fi
 .if n \{\
 .RE
diff --git a/man/nmcli-examples.xml b/man/nmcli-examples.xml
index d0485bc5..864e6504 100644
--- a/man/nmcli-examples.xml
+++ b/man/nmcli-examples.xml
@@ -54,7 +54,7 @@
     <para>
       <emphasis>nmcli</emphasis> is a command-line client for NetworkManager. It
       allows controlling NetworkManager and reporting its status. For more information
-      please refer to <citerefentry><refentrytitle>nmcli</refentrytitle><manvolnum>1</manvolnum></citerefentry>
+      please refer to <link linkend='nmcli'><citerefentry><refentrytitle>nmcli</refentrytitle><manvolnum>1</manvolnum></citerefentry></link>
       manual page.
     </para>
     <para>
@@ -141,7 +141,8 @@ org.freedesktop.NetworkManager.wifi.share.open            yes
 org.freedesktop.NetworkManager.settings.modify.system     yes
 org.freedesktop.NetworkManager.settings.modify.own        yes
 org.freedesktop.NetworkManager.settings.modify.hostname   auth
-org.freedesktop.NetworkManager.reload                     no</screen>
+org.freedesktop.NetworkManager.settings.modify.global-dns auth
+org.freedesktop.NetworkManager.reload                     auth</screen>
       <para>
         This command shows configured polkit permissions for various NetworkManager
         operations. These permissions or actions (using polkit language) are configured
@@ -172,7 +173,7 @@ B,DISPATCH</screen>
       <para>
         The first command makes NetworkManager log in DEBUG level, and only for CORE, ETHER and
         IP domains. The second command restores the default logging state. Please refer to the
-        <citerefentry><refentrytitle>NetworkManager.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry> manual page
+        <link linkend='NetworkManager.conf'><citerefentry><refentrytitle>NetworkManager.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry></link> manual page
         for available logging levels and domains.
       </para>
     </example>
@@ -296,7 +297,7 @@ fi
         Wi-Fi will be turned back on.
         Name this script e.g. 70-wifi-wired-exclusive.sh and put it into /etc/NetworkManager/dispatcher.d/
         directory.
-        See <citerefentry><refentrytitle>NetworkManager</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+        See <link linkend='NetworkManager'><citerefentry><refentrytitle>NetworkManager</refentrytitle><manvolnum>8</manvolnum></citerefentry></link>
         manual page for more information about NetworkManager dispatcher scripts.
       </para>
     </example>
@@ -542,11 +543,11 @@ Connection 'ethernet-4' (de89cdeb-a3e1-4d53-8fa0-c22546c775f4) successfully
   <refsect1>
     <title>See Also</title>
     <para>
-      <citerefentry><refentrytitle>nmcli</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
-      <citerefentry><refentrytitle>NetworkManager</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
-      <citerefentry><refentrytitle>NetworkManager.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
-      <citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
-      <citerefentry><refentrytitle>nm-online</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
+      <link linkend='nmcli'><citerefentry><refentrytitle>nmcli</refentrytitle><manvolnum>1</manvolnum></citerefentry></link>,
+      <link linkend='NetworkManager'><citerefentry><refentrytitle>NetworkManager</refentrytitle><manvolnum>8</manvolnum></citerefentry></link>,
+      <link linkend='NetworkManager.conf'><citerefentry><refentrytitle>NetworkManager.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry></link>,
+      <link linkend='nm-settings'><citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum></citerefentry></link>,
+      <link linkend='nm-online'><citerefentry><refentrytitle>nm-online</refentrytitle><manvolnum>1</manvolnum></citerefentry></link>,
       <citerefentry><refentrytitle>nm-applet</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
       <citerefentry><refentrytitle>nm-connection-editor</refentrytitle><manvolnum>1</manvolnum></citerefentry>
     </para>
diff --git a/man/nmcli.1 b/man/nmcli.1
index e0b9e527..2eaef626 100644
--- a/man/nmcli.1
+++ b/man/nmcli.1
@@ -2,12 +2,12 @@
 .\"     Title: nmcli
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
-.\"      Date: 08/03/2016
+.\"      Date: 08/24/2016
 .\"    Manual: General Commands Manual
-.\"    Source: NetworkManager 1.2.4
+.\"    Source: NetworkManager 1.4.0
 .\"  Language: English
 .\"
-.TH "NMCLI" "1" "" "NetworkManager 1\&.2\&.4" "General Commands Manual"
+.TH "NMCLI" "1" "" "NetworkManager 1\&.4\&.0" "General Commands Manual"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -140,7 +140,7 @@ only produces colors when standard output is directed to a terminal\&. The defau
 auto\&.
 .RE
 .PP
-\fB\-f\fR | \fB\-\-fields\fR {[\fIfield\fR...] | all | common}
+\fB\-f\fR | \fB\-\-fields\fR {\fIfield1\fR,\fIfield2\fR... | all | common}
 .RS 4
 This option is used to specify what fields (column names) should be printed\&. Valid field names differ for specific commands\&. List available fields by providing an invalid value to the
 \fB\-\-fields\fR
@@ -187,7 +187,7 @@ When using this option
 will display passwords and secrets that might be present in an output of an operation\&. This option also influences echoing passwords typed by user as an input\&.
 .RE
 .PP
-[\fB\-w\fR\ |\ \fB\-\-wait\fR\ \fIseconds\fR...]
+\fB\-w\fR | \fB\-\-wait\fR \fIseconds\fR
 .RS 4
 This option sets a timeout period for which
 \fBnmcli\fR
@@ -200,6 +200,19 @@ instructs
 not to wait but to exit immediately with a status of success\&. The default value depends on the executed command\&.
 .RE
 .PP
+\fB\-\-complete\-args\fR
+.RS 4
+Instead of conducting the desired action,
+\fBnmcli\fR
+will list possible completions for the last argument\&. This is useful to implement argument completion in shell\&.
+.sp
+The
+exit status
+will indicate success or return a code 65 to indicate the last argument is a file name\&.
+.sp
+NetworkManager ships with command completion support for GNU Bash\&.
+.RE
+.PP
 \fB\-v\fR | \fB\-\-version\fR
 .RS 4
 Show
@@ -239,7 +252,7 @@ file when it starts\&.
 Show the permissions a caller has for various authenticated operations that NetworkManager provides, like enable and disable networking, changing Wi\-Fi and WWAN state, modifying connections, etc\&.
 .RE
 .PP
-\fBlogging\fR [\fBlevel\fR\ \fIlevel\fR] [\fBdomain\fR\ \fIdomains\fR...]
+\fBlogging\fR [\fBlevel\fR\ \fIlevel\fR] [\fBdomains\fR\ \fIdomains\fR...]
 .RS 4
 Get and change NetworkManager logging level and domains\&. Without any argument current logging level and domains are shown\&. In order to change logging state, provide
 \fBlevel\fR
@@ -334,7 +347,7 @@ and
 to watch for changes in certain devices or connections\&.
 .SH "CONNECTION MANAGEMENT COMMANDS"
 .HP \w'\fBnmcli\ connection\fR\ 'u
-\fBnmcli connection\fR {\fBshow\fR | \fBup\fR | \fBdown\fR | \fBadd\fR | \fBedit\fR | \fBmodify\fR | \fBdelete\fR | \fBmonitor\fR | \fBreload\fR | \fBload\fR} [\fIARGUMENTS\fR...]
+\fBnmcli connection\fR {\fBshow\fR | \fBup\fR | \fBdown\fR | \fBmodify\fR | \fBadd\fR | \fBedit\fR | \fBclone\fR | \fBdelete\fR | \fBmonitor\fR | \fBreload\fR | \fBload\fR | \fBimport\fR | \fBexport\fR} [\fIARGUMENTS\fR...]
 .PP
 NetworkManager stores all network configuration as "connections", which are collections of data (Layer2 details, IP addressing, etc\&.) that describe how to create or connect to a network\&. A connection is "active" when a device uses that connection\*(Aqs configuration to create or connect to a network\&. There may be multiple connections that apply to a device, but only one of them can be active on that device at any given time\&. The additional connections can be used to allow quick switching between different networks and configurations\&.
 .PP
@@ -435,7 +448,7 @@ When no command is given to the
 \fBnmcli connection show\fR\&.
 .RE
 .PP
-\fBup\fR [\fBid\fR | \fBuuid\fR | \fBpath\fR] \fIID\fR... [\fBifname\fR\ \fIifname\fR] [\fBap\fR\ \fIBSSID\fR] [\fBpasswd\-file\fR\ \fIfile\fR]
+\fBup\fR [\fBid\fR | \fBuuid\fR | \fBpath\fR] \fIID\fR [\fBifname\fR\ \fIifname\fR] [\fBap\fR\ \fIBSSID\fR] [\fBpasswd\-file\fR\ \fIfile\fR]
 .RS 4
 Activate a connection\&. The connection is identified by its name, UUID or D\-Bus path\&. If
 \fIID\fR
@@ -561,634 +574,330 @@ If
 option is not specified, the default timeout will be 10 seconds\&.
 .RE
 .PP
-\fBadd\fR \fBifname\fR\ \fIifname\fR [con\-name\ \fIname\fR] [\fBautoconnect\fR\ {yes\ |\ no}] [\fBsave\fR\ {yes\ |\ no}] [master\ \fImaster\fR] [slave\-type\ \fItype\fR] [type\ \fItype\fR] [\fIARGUMENTS\fR...] [ip4\ \fIaddr\fR] [gw4\ \fIaddr\fR] [ip6\ \fIaddr\fR] [gw6\ \fIaddr\fR] [\fB\-\-\fR\ [+|\-]\fIsetting\fR\&.\fIproperty\fR\ \fIvalue\fR\ ...]
-.RS 4
-Add a connection for NetworkManager\&. Arguments differ according to connection types, see below\&.
-.PP
-\fBifname\fR
-.RS 4
-interface to bind the connection to\&. The connection will only be applicable to this interface name\&. A special value of
-*
-can be used for interface\-independent connections\&. The
-\fBifname\fR
-argument is mandatory for all connection types except bond, team, bridge and vlan\&. Note: use quotes around
-*
-to suppress shell expansion\&.
-.RE
-.PP
-\fBcon\-name\fR
-.RS 4
-connection name (when not provided a default name is generated: <type>[\-<ifname>][\-<num>])\&.
-.RE
-.PP
-\fBautoconnect\fR
+\fBmodify\fR [\fB\-\-temporary\fR] [\fBid\fR | \fBuuid\fR | \fBpath\fR] \fIID\fR {\fIoption\fR\ \fIvalue\fR\ |\ [+|\-]\fIsetting\fR\&.\fIproperty\fR\ \fIvalue\fR}...
 .RS 4
-whether the connection profile can be automatically activated (default: yes)\&.
-.RE
-.PP
-\fBsave\fR
-.RS 4
-whether the connection should be persistent, i\&.e\&. NetworkManager should store it on disk (default:
-yes)\&.
-.RE
-.PP
-\fBmaster\fR
-.RS 4
-master interface name, or connection UUID or ID of master connection profile\&. The value can be prefixed with
-ifname/,
-uuid/
+Add, modify or remove properties in the connection profile\&.
+.sp
+To set the property just specify the property name followed by the value\&. An empty value ("") removes the property value\&.
+.sp
+In addition to the properties, you can also use short names for some of the properties\&. Consult the
+PROPERTY ALIASES
+section for details\&.
+.sp
+If you want to append an item to the existing value, use
++
+prefix for the property name\&. If you want to remove just one item from container\-type property, use
+\-
+prefix for the property name and specify a value or an zero\-based index of the item to remove (or option name for properties with named options) as
+\fIvalue\fR\&. The
++
+and
+\-
+modifies only have a real effect for multi\-value (container) properties like
+ipv4\&.dns,
+ipv4\&.addresses,
+bond\&.options, etc\&.
+.sp
+See
+\fBnm-settings\fR(5)
+for complete reference of setting and property names, their descriptions and default values\&. The
+\fIsetting\fR
+and
+\fIproperty\fR
+can be abbreviated provided they are unique\&.
+.sp
+The connection is identified by its name, UUID or D\-Bus path\&. If
+\fIID\fR
+is ambiguous, a keyword
+\fBid\fR,
+\fBuuid\fR
 or
-id/
-to disambiguate it\&.
+\fBpath\fR
+can be used\&.
 .RE
 .PP
-\fBslave\-type\fR
+\fBadd\fR [\fBsave\fR\ {yes\ |\ no}] {\fIoption\fR\ \fIvalue\fR\ |\ [+|\-]\fIsetting\fR\&.\fIproperty\fR\ \fIvalue\fR}...
 .RS 4
-type of master connection\&. Only required when it can not be inferred (i\&.e\&. the master connection does not exist yet)\&.
-.RE
-.PP
+Create a new connection using specified properties\&.
+.sp
+You need to describe the newly created connections with the property and value pairs\&. See
+\fBnm-settings\fR(5)
+for the complete reference\&. You can also use the aliases described in
+PROPERTY ALIASES
+section\&. The syntax is the same as of the
+\fBnmcli connection modify\fR
+command\&.
+.sp
+To construct a meaningful connection you at the very least need to set the
+\fBconnection\&.type\fR
+property (or use the
 \fBtype\fR
+alias) to one of known NetworkManager connection types:
+.sp
 .RS 4
-connection type; see below for allowed values\&. Note that types
-\fBbond\-slave\fR,
-\fBteam\-slave\fR
-and
-\fBbridge\-slave\fR
-create
-\fBethernet\fR
-connection profiles\&. Their use is discouraged in favor of using a specific type with
-\fBmaster\fR
-option\&.
-.RE
-.PP
-\fBtype ethernet\fR [\fBmac\fR\ \fIaddr\fR] [\fBcloned\-mac\fR\ \fIaddr\fR] [\fBmtu\fR\ \fImtu\fR]
-.RS 4
-.PP
-\fBmac\fR
-.RS 4
-MAC address of the device this connection is locked to\&.
-.RE
-.PP
-\fBcloned\-mac\fR
-.RS 4
-cloned MAC\&.
-.RE
-.PP
-\fBmtu\fR
-.RS 4
-MTU\&.
-.RE
-.RE
-.PP
-\fBtype wifi\fR \fBssid\fR\ \fISSID\fR [\fBmac\fR\ \fIaddr\fR] [\fBcloned\-mac\fR\ \fIaddr\fR] [\fBmode\fR\ {infrastructure\ |\ ap\ |\ adhoc}] [\fBmtu\fR\ \fImtu\fR]
-.RS 4
-.PP
-\fBssid\fR
-.RS 4
-SSID\&.
-.RE
-.PP
-\fBmac\fR
-.RS 4
-MAC address of the device this connection is locked to\&.
-.RE
-.PP
-\fBcloned\-mac\fR
-.RS 4
-cloned MAC\&.
-.RE
-.PP
-\fBmode\fR
-.RS 4
-Wi\-Fi network mode\&. If blank,
-infrastructure
-is assumed\&.
-.RE
-.PP
-\fBmtu\fR
-.RS 4
-MTU\&.
-.RE
-.RE
-.PP
-\fBtype wimax\fR [\fBmac\fR\ \fIaddr\fR] [\fBnsp\fR\ \fInsp\fR]
-.RS 4
-.PP
-\fBmac\fR
-.RS 4
-MAC address of the device this connection is locked to\&.
-.RE
-.PP
-\fBnsp\fR
-.RS 4
-Network Service Provider name\&.
-.RE
-.RE
-.PP
-\fBtype pppoe\fR \fBusername\fR\ \fIuser\fR [\fBpassword\fR\ \fIpasswd\fR] [\fBservice\fR\ \fIname\fR] [\fBmtu\fR\ \fImtu\fR] [\fBmac\fR\ \fIaddr\fR]
-.RS 4
-.PP
-\fBusername\fR
-.RS 4
-PPPoE username\&.
-.RE
-.PP
-\fBpassword\fR
-.RS 4
-Password for the PPPoE username\&.
-.RE
-.PP
-\fBservice\fR
-.RS 4
-PPPoE service name (if required by concentrator)\&.
-.RE
-.PP
-\fBmtu\fR
-.RS 4
-MTU\&.
-.RE
-.PP
-\fBmac\fR
-.RS 4
-MAC address of the device this connection is locked to\&.
-.RE
-.RE
-.PP
-\fBtype gsm\fR [\fBapn\fR\ \fIAPN\fR] [\fBusername\fR\ \fIuser\fR] [\fBpassword\fR\ \fIpasswd\fR]
-.RS 4
-.PP
-\fBapn\fR
-.RS 4
-APN \- GSM Access Point Name\&.
-.RE
-.PP
-\fBuser\fR
-.RS 4
-user name\&.
-.RE
-.PP
-\fBpassword\fR
-.RS 4
-password\&.
-.RE
-.RE
-.PP
-\fBtype cdma\fR [\fBusername\fR\ \fIuser\fR] [\fBpassword\fR\ \fIpasswd\fR]
-.RS 4
-.PP
-\fBuser\fR
-.RS 4
-user name\&.
-.RE
-.PP
-\fBpassword\fR
-.RS 4
-password\&.
-.RE
-.RE
-.PP
-\fBtype infiniband\fR [\fBmac\fR\ \fIaddr\fR] [\fBmtu\fR\ \fImtu\fR] [\fBtransport\-mode\fR\ {datagram\ |\ connected}] [\fBparent\fR\ \fIdevice\fR] [\fBp\-key\fR\ \fIkey\fR]
-.RS 4
-.PP
-\fBmac\fR
-.RS 4
-MAC address of the device this connection is locked to (InfiniBand MAC is 20 bytes)\&.
-.RE
-.PP
-\fBmtu\fR
-.RS 4
-MTU\&.
-.RE
-.PP
-\fBtransport\-mode\fR
-.RS 4
-InfiniBand transport mode\&.
-.RE
-.PP
-\fBparent\fR
-.RS 4
-the interface name of the parent device (if any)\&.
-.RE
-.PP
-\fBp\-key\fR
-.RS 4
-the InfiniBand P_Key (16\-bit unsigned integer)\&.
-.RE
-.RE
-.PP
-\fBtype bluetooth\fR [\fBaddr\fR\ \fIaddr\fR] [\fBbt\-type\fR\ {panu\ |\ dun\-gsm\ |\ dun\-cdma}]
-.RS 4
-.PP
-\fBaddr\fR
-.RS 4
-Bluetooth device address (MAC)\&.
-.RE
-.PP
-\fBbt\-type\fR
-.RS 4
-Bluetooth connection type\&.
-.RE
-.RE
-.PP
-\fBtype vlan\fR \fBdev\fR\ \fIdevice\fR \fBid\fR\ \fIid\fR [\fBflags\fR\ \fIflags\fR] [\fBingress\fR\ \fImapping\fR] [\fBegress\fR\ \fImapping\fR] [\fBmtu\fR\ \fImtu\fR]
-.RS 4
-.PP
-\fBdev\fR
-.RS 4
-parent device this VLAN is on\&.
-.RE
-.PP
-\fBid\fR
-.RS 4
-VLAN ID in range 0\-4095\&.
-.RE
-.PP
-\fBflags\fR
-.RS 4
-flags\&.
-.RE
-.PP
-\fBingress\fR
-.RS 4
-VLAN ingress priority mapping\&.
-.RE
-.PP
-\fBegress\fR
-.RS 4
-VLAN egress priority mapping\&.
-.RE
-.PP
-\fBmtu\fR
-.RS 4
-MTU\&.
-.RE
-.RE
-.PP
-\fBtype bond\fR [\fBmode\fR\ {active\-backup\ |\ balance\-xor\ |\ broadcast\ |\ 802\&.3ad\ |\ balance\-tlb\ |\ balance\-alb\ |\ \fInum\fR}] [\fBprimary\fR\ \fIifname\fR] [\fBmiimon\fR\ \fInum\fR] [\fBdowndelay\fR\ \fInum\fR] [\fBupdelay\fR\ \fInum\fR] [\fBarp\-interval\fR\ \fInum\fR] [\fBarp\-ip\-target\fR\ \fInum\fR]
-.RS 4
-.PP
-\fBmode\fR
-.RS 4
-bonding mode (default:
-balance\-rr)\&.
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+ethernet
 .RE
-.PP
-\fBprimary\fR
+.sp
 .RS 4
-primary interface name (for
-active\-backup
-mode)\&.
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+wifi
 .RE
-.PP
-\fBmiimon\fR
+.sp
 .RS 4
-miimon (default:
-100)\&.
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+wimax
 .RE
-.PP
-\fBdowndelay\fR
+.sp
 .RS 4
-downdelay (default:
-0)\&.
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+pppoe
 .RE
-.PP
-\fBupdelay\fR
+.sp
 .RS 4
-updelay (default:
-0)\&.
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+gsm
 .RE
-.PP
-\fBarp\-interval\fR
+.sp
 .RS 4
-ARP interval (default:
-0)\&.
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+cdma
 .RE
-.PP
-\fBarp\-ip\-target\fR
+.sp
 .RS 4
-ARP IP target\&.
-.RE
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+infiniband
 .RE
-.PP
-\fBtype bond\-slave\fR [\fBmaster\fR\ \fImaster\fR]
-.RS 4
-.PP
-\fBmaster\fR
+.sp
 .RS 4
-master bond interface name, or connection UUID or ID of bond master connection profile\&. The value can be prefixed with
-ifname/,
-uuid/
-or
-id/
-to disambiguate it\&.
-.RE
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+bluetooth
 .RE
-.PP
-\fBtype team\fR [\fBconfig\fR\ {file\ |\ \fIJSON\fR}]
-.RS 4
-.PP
-\fBconfig\fR
+.sp
 .RS 4
-JSON configuration for team\&.
-.RE
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+vlan
 .RE
-.PP
-\fBtype team\-slave\fR [\fBconfig\fR\ \fB\fIJSON\fR\fR]
-.RS 4
-.PP
-\fBmaster\fR
+.sp
 .RS 4
-master team interface name, or connection UUID or ID of team master connection profile\&. The value can be prefixed with
-ifname/,
-uuid/
-or
-id/to disambiguate it\&.
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+bond
 .RE
-.PP
-\fBconfig\fR
+.sp
 .RS 4
-JSON configuration for team\&.
-.RE
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+bond\-slave
 .RE
-.PP
-\fBtype bridge\fR [\fBstp\fR\ {yes\ |\ no}] [\fBpriority\fR\ \fInum\fR] [\fBforward\-delay\fR\ \fI2\-30\fR] [\fBhello\-time\fR\ \fI1\-10\fR] [\fBmax\-age\fR\ \fI6\-42\fR] [\fBageing\-time\fR\ \fI0\-1000000\fR] [\fBmulticast\-snooping\fR\ {yes\ |\ no}] [\fBmac\fR\ \fIaddr\fR]
-.RS 4
-.PP
-\fBstp\fR
+.sp
 .RS 4
-controls whether Spanning Tree Protocol (STP) is enabled for this bridge (default:
-yes)\&.
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+team
 .RE
-.PP
-\fBpriority\fR
+.sp
 .RS 4
-sets STP priority (default:
-128)\&.
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+team\-slave
 .RE
-.PP
-\fBforward\-delay\fR
+.sp
 .RS 4
-STP forwarding delay, in seconds (default:
-15)\&.
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+bridge
 .RE
-.PP
-\fBhello\-time\fR
+.sp
 .RS 4
-STP hello time, in seconds (default:
-2)\&.
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+bridge\-slave
 .RE
-.PP
-\fBmax\-age\fR
+.sp
 .RS 4
-STP maximum message age, in seconds (default:
-20)\&.
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+vpn
 .RE
-.PP
-\fBageing\-time\fR
+.sp
 .RS 4
-the Ethernet MAC address aging time, in seconds (default:
-300)\&.
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+olpc\-mesh
 .RE
-.PP
-\fBmulticast\-snooping\fR
+.sp
 .RS 4
-controls whether IGMP snooping is enabled (default:
-yes)\&.
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+adsl
 .RE
-.PP
-\fBmac\fR
+.sp
 .RS 4
-MAC address of the bridge (note: this requires a recent kernel feature, originally introduced in 3\&.15 upstream kernel)\&.
-.RE
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+tun
 .RE
-.PP
-\fBtype bridge\-slave\fR [\fBmaster\fR\ \fImaster\fR] [\fBpriority\fR\ \fInum\fR] [\fBpath\-cost\fR\ \fI1\-65535\fR] [\fBhairpin\fR\ {yes\ |\ no}]
-.RS 4
-.PP
-\fBmaster\fR
+.sp
 .RS 4
-master bridge interface name, or connection UUID or ID of bridge master connection profile\&. The value can be prefixed with
-ifname/,
-uuid/
-or
-id/
-to disambiguate it\&.
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+ip\-tunnel
 .RE
-.PP
-\fBpriority\fR
+.sp
 .RS 4
-STP priority of this slave (default:
-32)\&.
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+macvlan
 .RE
-.PP
-\fBpath\-cost\fR
+.sp
 .RS 4
-STP port cost for destinations via this slave (default:
-100)\&.
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+vxlan
 .RE
+.sp
+The most typical uses are described in the
+EXAMPLES
+section\&.
+.sp
+Aside from the properties and values two special options are accepted:
 .PP
-\fBhairpin\fR
+\fBsave\fR
 .RS 4
-\*(Aqhairpin mode\*(Aq for the slave, which allows frames to be sent back out through the slave the frame was received on (default:
+Controls whether the connection should be persistent, i\&.e\&. NetworkManager should store it on disk (default:
 yes)\&.
 .RE
-.RE
-.PP
-\fBtype vpn\fR [\fBtype\fR\ \fItype\fR] [\fBuser\fR\ \fIusername\fR]
-.RS 4
-.PP
-\fBvpn\-type\fR
-.RS 4
-VPN type\&.
-.RE
-.PP
-\fBuser\fR
-.RS 4
-VPN username\&.
-.RE
-.RE
-.PP
-\fBtype olpc\-mesh\fR \fBssid\fR\ \fISSID\fR [\fBchannel\fR\ \fI1\-13\fR] [\fBdhcp\-anycast\fR\ \fIMAC\fR]
-.RS 4
-.PP
-\fBssid\fR
-.RS 4
-SSID\&.
-.RE
-.PP
-\fBchannel\fR
-.RS 4
-channel to use for the network\&.
-.RE
-.PP
-\fBdhcp\-anycast\fR
-.RS 4
-anycast DHCP MAC address used when requesting an IP address via DHCP\&.
-.RE
-.RE
-.PP
-\fBtype adsl\fR \fBusername\fR\ \fIusername\fR \fBprotocol\fR\ {pppoa\ |\ pppoe\ |\ ipoatm} [\fBpassword\fR\ \fIpasswd\fR] [\fBencapsulation\fR\ {vcmux\ |\ llc}]
-.RS 4
-.PP
-\fBusername\fR
-.RS 4
-ADSL user name\&.
-.RE
-.PP
-\fBprotocol\fR
-.RS 4
-ADSL protocol\&.
-.RE
-.PP
-\fBpassword\fR
-.RS 4
-ADSL password\&.
-.RE
-.PP
-\fBencapsulation\fR
-.RS 4
-ADSL encapsulation\&.
-.RE
-.RE
-.PP
-\fBtype tun\fR \fBmode\fR\ {tun\ |\ tap} [\fBowner\fR\ \fIUID\fR] [\fBgroup\fR\ \fIGID\fR] [\fBpi\fR\ {yes\ |\ no}] [\fBvnet\-hdr\fR\ {yes\ |\ no}] [\fBmulti\-queue\fR\ {yes\ |\ no}]
-.RS 4
-.PP
-\fBmode\fR
-.RS 4
-Mode for the device\&.
-.RE
-.PP
-\fBowner\fR
-.RS 4
-UID of the owner\&.
-.RE
-.PP
-\fBgroup\fR
-.RS 4
-GID of the group\&.
-.RE
-.PP
-\fBpi\fR
-.RS 4
-include packet information (~IFF_NO_PI flag)\&.
-.RE
-.PP
-\fBvnet\-hdr\fR
-.RS 4
-send and receive large (i\&.e\&. GSO) packets and packets with partial checksums (IFF_VNET_HDR flag)\&.
-.RE
-.PP
-\fBmulti\-queue\fR
-.RS 4
-multi\-queue support for tun/tap device (IFF_MULTI_QUEUE flag)\&.
-.RE
-.RE
-.PP
-\fBtype ip\-tunnel\fR \fBmode\fR\ {ipip\ |\ gre\ |\ sit\ |\ isatap\ |\ vti\ |\ ip6ip6\ |\ ipip6\ |\ ip6gre\ |\ vti6\ |\ tun} \fBremote\fR\ \fIaddr\fR [\fBlocal\fR\ \fIaddr\fR] [\fBdev\fR\ \fIdevice\fR]
-.RS 4
-.PP
-\fBmode\fR
-.RS 4
-tunnel mode\&.
-.RE
-.PP
-\fBremote\fR
-.RS 4
-IPv4 or IPv6 address of the remote tunnel endpoint\&.
-.RE
-.PP
-\fBlocal\fR
-.RS 4
-IPv4 or IPv6 address of the local tunnel endpoint\&.
-.RE
-.PP
-\fBdev\fR
-.RS 4
-device to use for tunnel endpoint communication\&.
-.RE
-.RE
-.PP
-\fBtype macvlan\fR \fBdev\fR\ \fIdevice\fR \fBmode\fR\ {vepa\ |\ bridge\ |\ private\ |\ passthru\ |\ source} [\fBtap\fR\ {yes\ |\ no}]
-.RS 4
-.PP
-\fBdev\fR
-.RS 4
-parent device this MACVLAN is on\&.
-.RE
-.PP
-\fBmode\fR
-.RS 4
-MACVLAN mode, which specifies the communication mechanism between multiple MACVLANs on the same lower device\&.
-.RE
-.PP
-\fBtap\fR
-.RS 4
-controls the device type\&. If set to \*(Aqyes\*(Aq a MACVTAP will be created (default:
-no)\&.
-.RE
-.RE
-.PP
-\fBtype vxlan\fR \fBid\fR\ \fIid\fR \fBremote\fR\ \fIaddr\fR [\fBdev\fR\ \fIparent\ device\ (ifname\ or\ connection\ UUID)\fR] [\fBlocal\fR\ \fIaddr\fR] [\fBsource\-port\-min\fR\ \fI0\-65535\fR] [\fBsource\-port\-max\fR\ \fI0\-65535\fR] [\fBdestination\-port\fR\ \fI0\-65535\fR]
-.RS 4
-.PP
-\fBid\fR
-.RS 4
-VXLAN Network Identifer to use\&.
-.RE
-.PP
-\fBremote\fR
-.RS 4
-unicast destination IP address or multicast IP address to join\&.
-.RE
-.PP
-\fBdev\fR
-.RS 4
-device to use for tunnel endpoint communication\&.
-.RE
-.PP
-\fBlocal\fR
-.RS 4
-source IP address\&.
-.RE
-.PP
-\fBsource\-port\-min\fR
-.RS 4
-minimum UDP source port to communicate to the remote VXLAN tunnel endpoint\&.
-.RE
-.PP
-\fBsource\-port\-max\fR
-.RS 4
-maximum UDP source port to communicate to the remote VXLAN tunnel endpoint\&.
-.RE
-.PP
-\fBdestination\-port\fR
-.RS 4
-UDP destination port to communicate to the remote VXLAN tunnel endpoint\&.
-.RE
-.RE
-.PP
-\fBip4\fR, \fBgw4\fR
-.RS 4
-IPv4 addresses\&.
-.RE
-.PP
-\fBip6\fR, \fBgw6\fR
-.RS 4
-IPv6 addresses\&.
-.RE
 .PP
 \fB\-\-\fR
 .RS 4
-If a
+If a single
 \fB\-\-\fR
-argument is encountered, the rest of command line is interpreted as property list in the same format as
-\fBconnection modify\fR
-command accepts\&. This makes it possible to adjust the connection properties before it\*(Aqs added\&.
+argument is encountered it is ignored\&. This is for compatibility with older versions on
+\fBnmcli\fR\&.
 .RE
 .RE
 .PP
-\fBedit\fR {[\fBid\fR\ |\ \fBuuid\fR\ |\ \fBpath\fR]\ \fIID\fR... | [\fBtype\fR\ \fItype\fR]\ [\fBcon\-name\fR\ \fIname\fR] }
+\fBedit\fR {[\fBid\fR\ |\ \fBuuid\fR\ |\ \fBpath\fR]\ \fIID\fR | [\fBtype\fR\ \fItype\fR]\ [\fBcon\-name\fR\ \fIname\fR] }
 .RS 4
 Edit an existing connection or add a new one, using an interactive editor\&.
 .sp
@@ -1228,43 +937,7 @@ for all NetworkManager settings and property names, and their descriptions; and
 for sample editor sessions\&.
 .RE
 .PP
-\fBmodify\fR [\fB\-\-temporary\fR] [\fBid\fR | \fBuuid\fR | \fBpath\fR] \fIID\fR [+|\-]\fIsetting\fR\&.\fIproperty\fR\ \fIvalue\fR...
-.RS 4
-Modify one or more properties in the connection profile\&.
-.sp
-The connection is identified by its name, UUID or D\-Bus path\&. If
-\fIID\fR
-is ambiguous, a keyword
-\fBid\fR,
-\fBuuid\fR
-or
-\fBpath\fR
-can be used\&. See
-\fBnm-settings\fR(5)
-for setting and property names, their descriptions and default values\&. This command supports abbreviations for
-\fIsetting\fR
-and
-\fIproperty\fR
-provided they are unique\&. Empty
-\fIvalue\fR
-("") removes the property value (sets the property to the default value)\&. The provided value overwrites the existing property value\&.
-.sp
-If you want to append an item to the existing value, use
-+
-prefix for the property name\&. If you want to remove just one item from container\-type property, use
-\-
-prefix for the property name and specify a value or an zero\-based index of the item to remove (or option name for properties with named options) as
-\fIvalue\fR\&. Of course,
-+
-and
-\-
-only have a real effect for multi\-value (container) properties like
-ipv4\&.dns,
-ipv4\&.addresses,
-bond\&.options, etc\&.
-.RE
-.PP
-\fBclone\fR [\fB\-\-temporary\fR] [\fBid\fR | \fBuuid\fR | \fBpath\fR] \fIID\fR... \fBnew\fR\ \fIname\fR
+\fBclone\fR [\fB\-\-temporary\fR] [\fBid\fR | \fBuuid\fR | \fBpath\fR] \fIID\fR \fInew_name\fR
 .RS 4
 Clone a connection\&. The connection to be cloned is identified by its name, UUID or D\-Bus path\&. If
 \fIID\fR
@@ -1277,8 +950,8 @@ can be used\&. See
 \fBconnection show\fR
 above for the description of the
 \fIID\fR\-specifying keywords\&.
-\fIname\fR
-is the name of the new cloned connection\&. The new connection will be the exact copy except the connection\&.id (\fIname\fR) and connection\&.uuid (generated) properties\&.
+\fInew_name\fR
+is the name of the new cloned connection\&. The new connection will be the exact copy except the connection\&.id (\fInew_name\fR) and connection\&.uuid (generated) properties\&.
 .sp
 The new connection profile will be saved as persistent unless
 \fB\-\-temporary\fR
@@ -1334,7 +1007,7 @@ Reload all connection files from disk\&. NetworkManager does not monitor changes
 Load/reload one or more connection files from disk\&. Use this after manually editing a connection file to ensure that NetworkManager is aware of its latest state\&.
 .RE
 .PP
-\fBimport\fR [\fB\-\-temporary\fR] [\fBtype\fR\ \fItype\fR] [\fBfile\fR\ \fIfile\fR]
+\fBimport\fR [\fB\-\-temporary\fR] \fBtype\fR\ \fItype\fR \fBfile\fR\ \fIfile\fR
 .RS 4
 Import an external/foreign configuration as a NetworkManager connection profile\&. The type of the input file is specified by
 \fBtype\fR
@@ -1366,7 +1039,7 @@ is provided, the VPN configuration data will be printed to standard output\&.
 .RE
 .SH "DEVICE MANAGEMENT COMMANDS"
 .HP \w'\fBnmcli\ device\fR\ 'u
-\fBnmcli device\fR {\fBstatus\fR | \fBshow\fR | \fBset\fR | \fBconnect\fR | \fBreapply\fR | \fBdisconnect\fR | \fBdelete\fR | \fBmonitor\fR | \fBwifi\fR | \fBlldp\fR} [\fIARGUMENTS\fR...]
+\fBnmcli device\fR {\fBstatus\fR | \fBshow\fR | \fBset\fR | \fBconnect\fR | \fBreapply\fR | \fBmodify\fR | \fBdisconnect\fR | \fBdelete\fR | \fBmonitor\fR | \fBwifi\fR | \fBlldp\fR} [\fIARGUMENTS\fR...]
 .PP
 Show and manage network interfaces\&.
 .PP
@@ -1388,7 +1061,7 @@ Show detailed information about devices\&. Without an argument, all devices are
 Set device properties\&.
 .RE
 .PP
-\fBconnect\fR [\fIifname\fR]
+\fBconnect\fR \fIifname\fR
 .RS 4
 Connect the device\&. NetworkManager will try to find a suitable connection that will be activated\&. It will also consider connections that are not set to auto connect\&.
 .sp
@@ -1397,12 +1070,29 @@ If
 option is not specified, the default timeout will be 90 seconds\&.
 .RE
 .PP
-\fBreapply\fR [\fIifname\fR]
+\fBreapply\fR \fIifname\fR
 .RS 4
 Attempt to update device with changes to the currently active connection made since it was last applied\&.
 .RE
 .PP
-\fBdisconnect\fR [\fIifname\fR...]
+\fBmodify\fR \fIifname\fR {\fIoption\fR\ \fIvalue\fR\ |\ [+|\-]\fIsetting\fR\&.\fIproperty\fR\ \fIvalue\fR}...
+.RS 4
+Modify the settings currently active on the device\&.
+.sp
+This command lets you do temporary changes to a configuration active on a particular device\&. The changes are not preserved in the connection profile\&.
+.sp
+See
+\fBnm-settings\fR(5)
+for the list of available properties\&. Please note that some properties can\*(Aqt be changed on an already connected device\&.
+.sp
+You can also use the aliases described in
+PROPERTY ALIASES
+section\&. The syntax is the same as of the
+\fBnmcli connection modify\fR
+command\&.
+.RE
+.PP
+\fBdisconnect\fR \fIifname\fR...
 .RS 4
 Disconnect a device and prevent the device from automatically activating further connections without user/manual intervention\&. Note that disconnecting software devices may mean that the devices will disappear\&.
 .sp
@@ -1411,7 +1101,7 @@ If
 option is not specified, the default timeout will be 10 seconds\&.
 .RE
 .PP
-\fBdelete\fR [\fIifname\fR...]
+\fBdelete\fR \fIifname\fR...
 .RS 4
 Delete a device\&. The command removes the interface from the system\&. Note that this only works for software devices like bonds, bridges, teams, etc\&. Hardware devices (like Ethernet) cannot be deleted by the command\&.
 .sp
@@ -1592,6 +1282,987 @@ Runs
 \fBnmcli\fR
 as both NetworkManager secret and a polkit agent\&.
 .RE
+.SH "PROPERTY ALIASES"
+.PP
+Apart from the property\-value pairs,
+\fBconnection add\fR,
+\fBconnection modify\fR
+and
+\fBdevice modify\fR
+also accept short forms of some properties\&. They exist for convenience and compatiblity with older versions of
+\fBnmcli\fR
+that could not accept the raw properties\&.
+.PP
+The overview of the aliases is below\&. An actual connection type is used to disambiguate these options from the options of the same name that are valid for multiple connection types (such as
+\fBmtu\fR)\&.
+.sp
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
+.br
+.B Table\ \&1.\ \&Options for all connections
+.TS
+allbox tab(:);
+lB lB lB.
+T{
+Alias
+T}:T{
+Property
+T}:T{
+Note
+T}
+.T&
+l l lt
+l l lt
+l l l
+l l lt
+l l lt
+l l l.
+T{
+type
+T}:T{
+connection.type
+T}:T{
+This option also accepts values of \fBbond\-slave\fR,
+\fBteam\-slave\fR and \fBbridge\-slave\fR\&. They create
+\fBethernet\fR connection profiles\&. Their use is discouraged in
+favor of using a specific type with \fBmaster\fR option\&.
+T}
+T{
+con\-name
+T}:T{
+connection.id
+T}:T{
+When not provided a default name is generated: <type>[\-<ifname>][\-<num>])\&.
+T}
+T{
+autoconnect
+T}:T{
+connection.autoconnect
+T}:T{
+\ \&
+T}
+T{
+ifname
+T}:T{
+connection.interface-name
+T}:T{
+A value of * will be interpreted as
+no value, making the connection profile interface\-independent\&.
+Note: use quotes around * to suppress shell expansion\&.
+For bond, team and bridge connections a default name will be generated if not set\&.
+T}
+T{
+master
+T}:T{
+connection.master
+T}:T{
+Value specified here will be canonicalized\&.
+It can be prefixed with ifname/, uuid/
+or id/ to disambiguate it\&.
+T}
+T{
+slave\-type
+T}:T{
+connection.slave-type
+T}:T{
+\ \&
+T}
+.TE
+.sp 1
+.sp
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
+.br
+.B Table\ \&2.\ \&PPPoE options
+.TS
+allbox tab(:);
+lB lB.
+T{
+Alias
+T}:T{
+Property
+T}
+.T&
+l l
+l l
+l l.
+T{
+username
+T}:T{
+pppoe.username
+T}
+T{
+password
+T}:T{
+pppoe.password
+T}
+T{
+service
+T}:T{
+pppoe.service
+T}
+.TE
+.sp 1
+.sp
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
+.br
+.B Table\ \&3.\ \&Wired Ethernet options
+.TS
+allbox tab(:);
+lB lB.
+T{
+Alias
+T}:T{
+Property
+T}
+.T&
+l l
+l l
+l l.
+T{
+mtu
+T}:T{
+wired.mtu
+T}
+T{
+mac
+T}:T{
+wired.mac-address
+T}
+T{
+cloned\-mac
+T}:T{
+wired.cloned-mac-address
+T}
+.TE
+.sp 1
+.sp
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
+.br
+.B Table\ \&4.\ \&Infiniband options
+.TS
+allbox tab(:);
+lB lB.
+T{
+Alias
+T}:T{
+Property
+T}
+.T&
+l l
+l l
+l l
+l l
+l l.
+T{
+mtu
+T}:T{
+infiniband.mtu
+T}
+T{
+mac
+T}:T{
+infiniband.mac-address
+T}
+T{
+transport\-mode
+T}:T{
+infiniband.transport-mode
+T}
+T{
+parent
+T}:T{
+infiniband.parent
+T}
+T{
+p\-key
+T}:T{
+infiniband.p-key
+T}
+.TE
+.sp 1
+.sp
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
+.br
+.B Table\ \&5.\ \&Wi-Fi options
+.TS
+allbox tab(:);
+lB lB.
+T{
+Alias
+T}:T{
+Property
+T}
+.T&
+l l
+l l
+l l
+l l
+l l.
+T{
+ssid
+T}:T{
+wireless.ssid
+T}
+T{
+mode
+T}:T{
+wireless.mode
+T}
+T{
+mtu
+T}:T{
+wireless.mtu
+T}
+T{
+mac
+T}:T{
+wireless.mac-address
+T}
+T{
+cloned\-mac
+T}:T{
+wireless.cloned-mac-address
+T}
+.TE
+.sp 1
+.sp
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
+.br
+.B Table\ \&6.\ \&WiMax options
+.TS
+allbox tab(:);
+lB lB.
+T{
+Alias
+T}:T{
+Property
+T}
+.T&
+l l
+l l.
+T{
+nsp
+T}:T{
+wimax.network-name
+T}
+T{
+mac
+T}:T{
+wimax.mac-address
+T}
+.TE
+.sp 1
+.sp
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
+.br
+.B Table\ \&7.\ \&GSM options
+.TS
+allbox tab(:);
+lB lB.
+T{
+Alias
+T}:T{
+Property
+T}
+.T&
+l l
+l l
+l l.
+T{
+apn
+T}:T{
+gsm.apn
+T}
+T{
+user
+T}:T{
+gsm.username
+T}
+T{
+password
+T}:T{
+gsm.password
+T}
+.TE
+.sp 1
+.sp
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
+.br
+.B Table\ \&8.\ \&CDMA options
+.TS
+allbox tab(:);
+lB lB.
+T{
+Alias
+T}:T{
+Property
+T}
+.T&
+l l
+l l.
+T{
+user
+T}:T{
+cdma.username
+T}
+T{
+password
+T}:T{
+cdma.password
+T}
+.TE
+.sp 1
+.sp
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
+.br
+.B Table\ \&9.\ \&Bluetooth options
+.TS
+allbox tab(:);
+lB lB lB.
+T{
+Alias
+T}:T{
+Property
+T}:T{
+Note
+T}
+.T&
+l l l
+l l lt.
+T{
+addr
+T}:T{
+bluetooth.bdaddr
+T}:T{
+\ \&
+T}
+T{
+bt\-type
+T}:T{
+bluetooth.type
+T}:T{
+Apart from the usual dun and
+panu options, the values of dun\-gsm
+and dun\-cdma can be used for compatibility with older
+versions\&. They are equivalent to using dun and setting
+appropriate gsm\&.* or cdma\&.* properties\&.
+T}
+.TE
+.sp 1
+.sp
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
+.br
+.B Table\ \&10.\ \&VLAN options
+.TS
+allbox tab(:);
+lB lB.
+T{
+Alias
+T}:T{
+Property
+T}
+.T&
+l l
+l l
+l l
+l l
+l l.
+T{
+dev
+T}:T{
+vlan.parent
+T}
+T{
+id
+T}:T{
+vlan.id
+T}
+T{
+flags
+T}:T{
+vlan.flags
+T}
+T{
+ingress
+T}:T{
+vlan.ingress-priority-map
+T}
+T{
+egress
+T}:T{
+vlan.egress-priority-map
+T}
+.TE
+.sp 1
+.sp
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
+.br
+.B Table\ \&11.\ \&Bonding options
+.TS
+allbox tab(:);
+lB lB lB.
+T{
+Alias
+T}:T{
+Property
+T}:T{
+Note
+T}
+.T&
+l l lt
+l ^ ^
+l ^ ^
+l ^ ^
+l ^ ^
+l ^ ^
+l ^ ^
+l ^ ^.
+T{
+mode
+T}:T{
+bond\&.options
+T}:T{
+Setting each of these adds the option to bond\&.options property\&.
+It\*(Aqs equivalent of using the +bond\&.options \*(Aqoption=value\*(Aq syntax\&.
+T}
+T{
+primary
+T}::
+T{
+miimon
+T}::
+T{
+downdelay
+T}::
+T{
+updelay
+T}::
+T{
+arp\-interval
+T}::
+T{
+arp\-ip\-target
+T}::
+T{
+lacp\-rate
+T}::
+.TE
+.sp 1
+.sp
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
+.br
+.B Table\ \&12.\ \&Team options
+.TS
+allbox tab(:);
+lB lB.
+T{
+Alias
+T}:T{
+Property
+T}
+.T&
+l l.
+T{
+config
+T}:T{
+team.config
+T}
+.TE
+.sp 1
+.sp
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
+.br
+.B Table\ \&13.\ \&Team port options
+.TS
+allbox tab(:);
+lB lB.
+T{
+Alias
+T}:T{
+Property
+T}
+.T&
+l l.
+T{
+config
+T}:T{
+team-port.config
+T}
+.TE
+.sp 1
+.sp
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
+.br
+.B Table\ \&14.\ \&Bridge options
+.TS
+allbox tab(:);
+lB lB.
+T{
+Alias
+T}:T{
+Property
+T}
+.T&
+l l
+l l
+l l
+l l
+l l
+l l
+l l
+l l
+l l
+l l
+l l.
+T{
+stp
+T}:T{
+bridge.stp
+T}
+T{
+priority
+T}:T{
+bridge.priority
+T}
+T{
+forward\-delay
+T}:T{
+bridge.forward-delay
+T}
+T{
+hello\-time
+T}:T{
+bridge.hello-time
+T}
+T{
+max\-age
+T}:T{
+bridge.max-age
+T}
+T{
+ageing\-time
+T}:T{
+bridge.ageing-time
+T}
+T{
+multicast\-snooping
+T}:T{
+bridge.multicast-snooping
+T}
+T{
+mac
+T}:T{
+bridge.mac-address
+T}
+T{
+priority
+T}:T{
+bridge-port.priority
+T}
+T{
+path\-cost
+T}:T{
+bridge-port.path-cost
+T}
+T{
+hairpin
+T}:T{
+bridge-port.hairpin-mode
+T}
+.TE
+.sp 1
+.sp
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
+.br
+.B Table\ \&15.\ \&VPN options
+.TS
+allbox tab(:);
+lB lB.
+T{
+Alias
+T}:T{
+Property
+T}
+.T&
+l l
+l l.
+T{
+vpn\-type
+T}:T{
+vpn.service-type
+T}
+T{
+user
+T}:T{
+vpn.user-name
+T}
+.TE
+.sp 1
+.sp
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
+.br
+.B Table\ \&16.\ \&OLPC Mesh options
+.TS
+allbox tab(:);
+lB lB.
+T{
+Alias
+T}:T{
+Property
+T}
+.T&
+l l
+l l
+l l.
+T{
+ssid
+T}:T{
+olpc-mesh.ssid
+T}
+T{
+channel
+T}:T{
+olpc-mesh.channel
+T}
+T{
+dhcp\-anycast
+T}:T{
+olpc-mesh.dhcp-anycast-address
+T}
+.TE
+.sp 1
+.sp
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
+.br
+.B Table\ \&17.\ \&ADSL options
+.TS
+allbox tab(:);
+lB lB.
+T{
+Alias
+T}:T{
+Property
+T}
+.T&
+l l
+l l
+l l
+l l.
+T{
+username
+T}:T{
+adsl.username
+T}
+T{
+protocol
+T}:T{
+adsl.protocol
+T}
+T{
+password
+T}:T{
+adsl.password
+T}
+T{
+encapsulation
+T}:T{
+adsl.encapsulation
+T}
+.TE
+.sp 1
+.sp
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
+.br
+.B Table\ \&18.\ \&MACVLAN options
+.TS
+allbox tab(:);
+lB lB.
+T{
+Alias
+T}:T{
+Property
+T}
+.T&
+l l
+l l
+l l.
+T{
+dev
+T}:T{
+macvlan.parent
+T}
+T{
+mode
+T}:T{
+macvlan.mode
+T}
+T{
+tap
+T}:T{
+macvlan.tap
+T}
+.TE
+.sp 1
+.sp
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
+.br
+.B Table\ \&19.\ \&VxLAN options
+.TS
+allbox tab(:);
+lB lB.
+T{
+Alias
+T}:T{
+Property
+T}
+.T&
+l l
+l l
+l l
+l l
+l l
+l l
+l l.
+T{
+id
+T}:T{
+vxlan.id
+T}
+T{
+remote
+T}:T{
+vxlan.remote
+T}
+T{
+dev
+T}:T{
+vxlan.parent
+T}
+T{
+local
+T}:T{
+vxlan.local
+T}
+T{
+source\-port\-min
+T}:T{
+vxlan.source-port-min
+T}
+T{
+source\-port\-max
+T}:T{
+vxlan.source-port-max
+T}
+T{
+destination\-port
+T}:T{
+vxlan.destination-port
+T}
+.TE
+.sp 1
+.sp
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
+.br
+.B Table\ \&20.\ \&Tun options
+.TS
+allbox tab(:);
+lB lB.
+T{
+Alias
+T}:T{
+Property
+T}
+.T&
+l l
+l l
+l l
+l l
+l l
+l l.
+T{
+mode
+T}:T{
+tun.mode
+T}
+T{
+owner
+T}:T{
+tun.owner
+T}
+T{
+group
+T}:T{
+tun.group
+T}
+T{
+pi
+T}:T{
+tun.pi
+T}
+T{
+vnet\-hdr
+T}:T{
+tun.vnet-hdr
+T}
+T{
+multi\-queue
+T}:T{
+tun.multi-queue
+T}
+.TE
+.sp 1
+.sp
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
+.br
+.B Table\ \&21.\ \&IP tunneling options
+.TS
+allbox tab(:);
+lB lB.
+T{
+Alias
+T}:T{
+Property
+T}
+.T&
+l l
+l l
+l l
+l l.
+T{
+mode
+T}:T{
+ip-tunnel.mode
+T}
+T{
+local
+T}:T{
+ip-tunnel.local
+T}
+T{
+remote
+T}:T{
+ip-tunnel.remote
+T}
+T{
+dev
+T}:T{
+ip-tunnel.parent
+T}
+.TE
+.sp 1
+.sp
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
+.br
+.B Table\ \&22.\ \&IPv4 options
+.TS
+allbox tab(:);
+lB lB lB.
+T{
+Alias
+T}:T{
+Property
+T}:T{
+Note
+T}
+.T&
+l l lt
+l l l.
+T{
+ip4
+T}:T{
+ipv4.addresses
+T}:T{
+This option can be specified multiple times\&.
+It\*(Aqs equivalent of using +ipv4\&.addresses syntax\&.
+T}
+T{
+gw4
+T}:T{
+ipv4.gateway
+T}:T{
+\ \&
+T}
+.TE
+.sp 1
+.sp
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
+.br
+.B Table\ \&23.\ \&IPv6 options
+.TS
+allbox tab(:);
+lB lB lB.
+T{
+Alias
+T}:T{
+Property
+T}:T{
+Note
+T}
+.T&
+l l lt
+l l l.
+T{
+ip6
+T}:T{
+ipv6.addresses
+T}:T{
+This option can be specified multiple times\&.
+It\*(Aqs equivalent of using +ipv6\&.addresses syntax\&.
+T}
+T{
+gw6
+T}:T{
+ipv6.gateway
+T}:T{
+\ \&
+T}
+.TE
+.sp 1
 .SH "ENVIRONMENT VARIABLES"
 .PP
 \fBnmcli\fR\*(Aqs behavior is affected by the following environment variables\&.
@@ -1692,6 +2363,13 @@ NetworkManager is not running\&.
 .RS 4
 Connection, device, or access point does not exist\&.
 .RE
+.PP
+\fB65\fR
+.RS 4
+When used with
+\fB\-\-complete\-args\fR
+option, a file name is expected to follow\&.
+.RE
 .SH "EXAMPLES"
 .PP
 This section presents various examples of
@@ -1806,6 +2484,16 @@ so that the existing connection profile can be used and no additional is created
 creates a hotspot profile and connects it\&. Prints the hotspot password the user should use to connect to the hotspot from other devices\&.
 .RE
 .PP
+\fBnmcli dev modify em1 ipv4\&.method shared\fR
+.RS 4
+starts IPv4 connection sharing using em1 device\&. The sharing will be active until the device is disconnected\&.
+.RE
+.PP
+\fBnmcli dev modify em1 ipv6\&.address 2001:db8::a:bad:c0de\fR
+.RS 4
+temporarily adds an IP address to a device\&. The address will be removed when the same connection is activated again\&.
+.RE
+.PP
 \fBnmcli connection add type ethernet autoconnect no ifname eth0\fR
 .RS 4
 non\-interactively adds an Ethernet connection tied to eth0 interface with automatic IP configuration (DHCP), and disables the connection\*(Aqs
@@ -1818,7 +2506,7 @@ flag\&.
 non\-interactively adds a VLAN connection with ID 55\&. The connection will use eth0 and the VLAN interface will be named Maxipes\-fik\&.
 .RE
 .PP
-\fBnmcli c a ifname eth0 type ethernet \-\- ipv4\&.method disabled ipv6\&.method link\-local\fR
+\fBnmcli c a ifname eth0 type ethernet ipv4\&.method disabled ipv6\&.method link\-local\fR
 .RS 4
 non\-interactively adds a connection that will use eth0 Ethernet interface and only have an IPv6 link\-local address configured\&.
 .RE
diff --git a/man/nmcli.xml b/man/nmcli.xml
index ee5a4495..5a936335 100644
--- a/man/nmcli.xml
+++ b/man/nmcli.xml
@@ -78,7 +78,7 @@
         terse output format which is better suited for script processing. Note that
         NetworkManager can also execute scripts, called "dispatcher scripts", in
         response to network events. See
-        <citerefentry><refentrytitle>NetworkManager</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+        <link linkend='NetworkManager'><link linkend='NetworkManager'><citerefentry><refentrytitle>NetworkManager</refentrytitle><manvolnum>8</manvolnum></citerefentry></link></link>
         for details about these dispatcher scripts.</para>
       </listitem>
 
@@ -191,7 +191,7 @@
           <arg choice='plain'><option>-f</option></arg>
           <arg choice='plain'><option>--fields</option></arg>
           <group choice='req'>
-            <arg conice='plain' rep='repeat'><replaceable>field</replaceable></arg>
+            <arg choice='plain' rep='repeat'><replaceable>field1</replaceable>,<replaceable>field2</replaceable></arg>
             <arg choice='plain'>all</arg>
             <arg choice='plain'>common</arg>
           </group>
@@ -258,13 +258,11 @@
       </varlistentry>
 
       <varlistentry>
-        <term><arg>
-          <group choice='plain'>
-            <arg choice='plain'><option>-w</option></arg>
-            <arg choice='plain'><option>--wait</option></arg>
-          </group>
-          <arg choice='plain' rep='repeat'><replaceable>seconds</replaceable></arg>
-        </arg></term>
+        <term><group choice='plain'>
+          <arg choice='plain'><option>-w</option></arg>
+          <arg choice='plain'><option>--wait</option></arg></group>
+          <arg choice='plain'><replaceable>seconds</replaceable></arg>
+        </term>
 
         <listitem>
           <para>This option sets a timeout period for which <command>nmcli</command> will
@@ -280,6 +278,23 @@
 
       <varlistentry>
         <term><group choice='plain'>
+          <arg choice='plain'><option>--complete-args</option></arg>
+        </group></term>
+
+        <listitem>
+          <para>Instead of conducting the desired action, <command>nmcli</command>
+          will list possible completions for the last argument. This is useful to implement
+          argument completion in shell.</para>
+
+          <para>The <link linkend='exit_status'>exit status</link> will indicate success
+          or return a code 65 to indicate the last argument is a file name.</para>
+
+          <para>NetworkManager ships with command completion support for GNU Bash.</para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><group choice='plain'>
           <arg choice='plain'><option>-v</option></arg>
           <arg choice='plain'><option>--version</option></arg>
         </group></term>
@@ -363,7 +378,7 @@
         <term>
           <command>logging</command>
           <arg><option>level</option> <replaceable>level</replaceable></arg>
-          <arg rep='repeat'><option>domain</option> <replaceable>domains</replaceable></arg>
+          <arg rep='repeat'><option>domains</option> <replaceable>domains</replaceable></arg>
         </term>
 
         <listitem>
@@ -371,7 +386,7 @@
           domains. Without any argument current logging level and domains are shown. In
           order to change logging state, provide <option>level</option> and, or,
           <option>domain</option> parameters. See
-          <citerefentry><refentrytitle>NetworkManager.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+          <link linkend='NetworkManager.conf'><link linkend='NetworkManager.conf'><citerefentry><refentrytitle>NetworkManager.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry></link></link>
           for available level and domain values.</para>
         </listitem>
       </varlistentry>
@@ -544,13 +559,16 @@
         <arg choice='plain'><command>show</command></arg>
         <arg choice='plain'><command>up</command></arg>
         <arg choice='plain'><command>down</command></arg>
+        <arg choice='plain'><command>modify</command></arg>
         <arg choice='plain'><command>add</command></arg>
         <arg choice='plain'><command>edit</command></arg>
-        <arg choice='plain'><command>modify</command></arg>
+        <arg choice='plain'><command>clone</command></arg>
         <arg choice='plain'><command>delete</command></arg>
         <arg choice='plain'><command>monitor</command></arg>
         <arg choice='plain'><command>reload</command></arg>
         <arg choice='plain'><command>load</command></arg>
+        <arg choice='plain'><command>import</command></arg>
+        <arg choice='plain'><command>export</command></arg>
       </group>
       <arg rep='repeat'><replaceable>ARGUMENTS</replaceable></arg>
     </cmdsynopsis>
@@ -699,7 +717,7 @@
             <arg choice='plain'><option>uuid</option></arg>
             <arg choice='plain'><option>path</option></arg>
           </group>
-          <arg rep='repeat' choice='plain'><replaceable>ID</replaceable></arg>
+          <arg choice='plain'><replaceable>ID</replaceable></arg>
           <arg><option>ifname</option> <replaceable>ifname</replaceable></arg>
           <arg><option>ap</option> <replaceable>BSSID</replaceable></arg>
           <arg><option>passwd-file</option> <replaceable>file</replaceable></arg>
@@ -811,1156 +829,122 @@
 
       <varlistentry>
         <term>
-          <command>add</command>
-          <arg choice='plain'><option>ifname</option> <replaceable>ifname</replaceable></arg>
-          <arg>con-name <replaceable>name</replaceable></arg>
-          <arg>
-            <option>autoconnect</option>
-            <group choice='req'>
-              <arg choice='plain'>yes</arg>
-              <arg choice='plain'>no</arg>
-            </group>
-          </arg>
-          <arg>
-            <option>save</option>
+          <command>modify</command>
+          <arg><option>--temporary</option></arg>
+          <group>
+            <arg choice='plain'><option>id</option></arg>
+            <arg choice='plain'><option>uuid</option></arg>
+            <arg choice='plain'><option>path</option></arg>
+          </group>
+          <arg choice='plain'><replaceable>ID</replaceable></arg>
+          <arg rep='repeat' choice='plain'>
             <group choice='req'>
-              <arg choice='plain'>yes</arg>
-              <arg choice='plain'>no</arg>
+              <arg choice='plain'><replaceable>option</replaceable> <replaceable>value</replaceable></arg>
+              <arg choice='plain'>[+|-]<replaceable>setting</replaceable>.<replaceable>property</replaceable> <replaceable>value</replaceable></arg>
             </group>
           </arg>
-          <arg>master <replaceable>master</replaceable></arg>
-          <arg>slave-type <replaceable>type</replaceable></arg>
-          <arg>type <replaceable>type</replaceable></arg>
-          <arg rep="repeat"><replaceable>ARGUMENTS</replaceable></arg>
-          <arg>ip4 <replaceable>addr</replaceable></arg>
-          <arg>gw4 <replaceable>addr</replaceable></arg>
-          <arg>ip6 <replaceable>addr</replaceable></arg>
-          <arg>gw6 <replaceable>addr</replaceable></arg>
-          <arg>
-            <option>--</option>
-            <arg choice='plain' rep='repeat'>
-              [+|-]<replaceable>setting</replaceable>.<replaceable>property</replaceable>
-              <replaceable>value</replaceable>
-            </arg>
-          </arg>
         </term>
 
         <listitem>
-          <para>Add a connection for NetworkManager. Arguments differ according to connection types, see below.</para>
-
-          <variablelist>
+          <para>Add, modify or remove properties in the connection profile.</para>
 
-            <varlistentry>
-              <term><option>ifname</option></term>
-              <listitem>
-                <para>interface to bind the connection to. The connection will only be
-                applicable to this interface name. A special value of <literal>*</literal>
-                can be used for interface-independent connections. The
-                <option>ifname</option> argument is mandatory for all connection types
-                except bond, team, bridge and vlan. Note: use quotes around
-                <literal>*</literal> to suppress shell expansion.</para>
-              </listitem>
-            </varlistentry>
+          <para>To set the property just specify the property name followed by the
+          value. An empty value (<literal>""</literal>) removes the property value.</para>
 
-            <varlistentry>
-              <term><option>con-name</option></term>
-              <listitem>
-                <para>connection name (when not provided a default name is generated:
-                &lt;type&gt;[-&lt;ifname&gt;][-&lt;num&gt;]).</para>
-              </listitem>
-            </varlistentry>
+          <para>In addition to the properties, you can also use short names for some of
+          the properties. Consult the <link linkend='property_aliases' endterm='property_aliases.title' />
+          section for details.</para>
 
-            <varlistentry>
-              <term><option>autoconnect</option></term>
-              <listitem>
-                <para>whether the connection profile can be automatically activated (default:
-                yes).</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><option>save</option></term>
-              <listitem>
-                <para>whether the connection should be persistent, i.e. NetworkManager should
-                store it on disk (default: <literal>yes</literal>).</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><option>master</option></term>
-              <listitem>
-                <para>master interface name, or connection UUID or ID of master connection
-                profile. The value can be prefixed with <literal>ifname/</literal>,
-                <literal>uuid/</literal> or <literal>id/</literal> to disambiguate it.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><option>slave-type</option></term>
-              <listitem>
-                <para>type of master connection. Only required when it can not be inferred
-                (i.e. the master connection does
-                not exist yet).</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><option>type</option></term>
-              <listitem>
-                <para>connection type; see below for allowed values. Note that types
-                <option>bond-slave</option>, <option>team-slave</option> and
-                <option>bridge-slave</option> create <option>ethernet</option> connection
-                profiles. Their use is discouraged in favor of using a specific type with
-                <option>master</option> option.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term>
-                <option>type ethernet</option>
-                <arg><option>mac</option> <replaceable>addr</replaceable></arg>
-                <arg><option>cloned-mac</option> <replaceable>addr</replaceable></arg>
-                <arg><option>mtu</option> <replaceable>mtu</replaceable></arg>
-              </term>
-              <listitem>
-                <variablelist>
-                  <varlistentry>
-                    <term><option>mac</option></term>
-                    <listitem>
-                      <para>MAC address of the device this connection is locked to.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>cloned-mac</option></term>
-                    <listitem>
-                      <para>cloned MAC.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>mtu</option></term>
-                    <listitem>
-                      <para>MTU.</para>
-                    </listitem>
-                  </varlistentry>
-                </variablelist>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term>
-                <option>type wifi</option>
-                <arg choice='plain'><option>ssid</option> <replaceable>SSID</replaceable></arg>
-                <arg><option>mac</option> <replaceable>addr</replaceable></arg>
-                <arg><option>cloned-mac</option> <replaceable>addr</replaceable></arg>
-                <arg>
-                  <option>mode</option>
-                  <group choice='req'>
-                    <arg choice='plain'>infrastructure</arg>
-                    <arg choice='plain'>ap</arg>
-                    <arg choice='plain'>adhoc</arg>
-                  </group>
-                </arg>
-                <arg><option>mtu</option> <replaceable>mtu</replaceable></arg>
-              </term>
-              <listitem>
-                <variablelist>
-                  <varlistentry>
-                    <term><option>ssid</option></term>
-                    <listitem>
-                      <para>SSID.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>mac</option></term>
-                    <listitem>
-                      <para>MAC address of the device this connection is locked to.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>cloned-mac</option></term>
-                    <listitem>
-                      <para>cloned MAC.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>mode</option></term>
-                    <listitem>
-                      <para>Wi-Fi network mode. If blank, <literal>infrastructure</literal>
-                      is assumed.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>mtu</option></term>
-                    <listitem>
-                      <para>MTU.</para>
-                    </listitem>
-                  </varlistentry>
-                </variablelist>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term>
-                <option>type wimax</option>
-                <arg><option>mac</option> <replaceable>addr</replaceable></arg>
-                <arg><option>nsp</option> <replaceable>nsp</replaceable></arg>
-              </term>
-              <listitem>
-                <variablelist>
-                  <varlistentry>
-                    <term><option>mac</option></term>
-                    <listitem>
-                      <para>MAC address of the device this connection is locked to.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>nsp</option></term>
-                    <listitem>
-                      <para>Network Service Provider name.</para>
-                    </listitem>
-                  </varlistentry>
-                </variablelist>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term>
-                <option>type pppoe</option>
-                <arg choice='plain'><option>username</option> <replaceable>user</replaceable></arg>
-                <arg><option>password</option> <replaceable>passwd</replaceable></arg>
-                <arg><option>service</option> <replaceable>name</replaceable></arg>
-                <arg><option>mtu</option> <replaceable>mtu</replaceable></arg>
-                <arg><option>mac</option> <replaceable>addr</replaceable></arg>
-              </term>
-              <listitem>
-                <variablelist>
-                  <varlistentry>
-                    <term><option>username</option></term>
-                    <listitem>
-                      <para>PPPoE username.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>password</option></term>
-                    <listitem>
-                      <para>Password for the PPPoE username.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>service</option></term>
-                    <listitem>
-                      <para>PPPoE service name (if required by concentrator).</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>mtu</option></term>
-                    <listitem>
-                      <para>MTU.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>mac</option></term>
-                    <listitem>
-                      <para>MAC address of the device this connection is locked to.</para>
-                    </listitem>
-                  </varlistentry>
-                </variablelist>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term>
-                <option>type gsm</option>
-                <arg><option>apn</option> <replaceable>APN</replaceable></arg>
-                <arg><option>username</option> <replaceable>user</replaceable></arg>
-                <arg><option>password</option> <replaceable>passwd</replaceable></arg>
-              </term>
-              <listitem>
-                <variablelist>
-                  <varlistentry>
-                    <term><option>apn</option></term>
-                    <listitem>
-                      <para>APN - GSM Access Point Name.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>user</option></term>
-                    <listitem>
-                      <para>user name.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>password</option></term>
-                    <listitem>
-                      <para>password.</para>
-                    </listitem>
-                  </varlistentry>
-                </variablelist>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term>
-                <option>type cdma</option>
-                <arg><option>username</option> <replaceable>user</replaceable></arg>
-                <arg><option>password</option> <replaceable>passwd</replaceable></arg>
-              </term>
-              <listitem>
-                <variablelist>
-                  <varlistentry>
-                    <term><option>user</option></term>
-                    <listitem>
-                      <para>user name.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>password</option></term>
-                    <listitem>
-                      <para>password.</para>
-                    </listitem>
-                  </varlistentry>
-                </variablelist>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term>
-                <option>type infiniband</option>
-                <arg><option>mac</option> <replaceable>addr</replaceable></arg>
-                <arg><option>mtu</option> <replaceable>mtu</replaceable></arg>
-                <arg>
-                  <option>transport-mode</option>
-                  <group choice='req'>
-                    <arg choice='plain'>datagram</arg>
-                    <arg choice='plain'>connected</arg>
-                  </group>
-                </arg>
-                <arg><option>parent</option> <replaceable>device</replaceable></arg>
-                <arg><option>p-key</option> <replaceable>key</replaceable></arg>
-              </term>
-              <listitem>
-                <variablelist>
-                  <varlistentry>
-                    <term><option>mac</option></term>
-                    <listitem>
-                      <para>MAC address of the device this connection is locked to
-                      (InfiniBand MAC is 20 bytes).</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>mtu</option></term>
-                    <listitem>
-                      <para>MTU.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>transport-mode</option></term>
-                    <listitem>
-                      <para>InfiniBand transport mode.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>parent</option></term>
-                    <listitem>
-                      <para>the interface name of the parent device (if any).</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>p-key</option></term>
-                    <listitem>
-                      <para>the InfiniBand P_Key (16-bit unsigned integer).</para>
-                    </listitem>
-                  </varlistentry>
-                </variablelist>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term>
-                <option>type bluetooth</option>
-                <arg><option>addr</option> <replaceable>addr</replaceable></arg>
-                <arg>
-                  <option>bt-type</option>
-                  <group choice='req'>
-                    <arg choice='plain'>panu</arg>
-                    <arg choice='plain'>dun-gsm</arg>
-                    <arg choice='plain'>dun-cdma</arg>
-                  </group>
-                </arg>
-              </term>
-              <listitem>
-                <variablelist>
-                  <varlistentry>
-                    <term><option>addr</option></term>
-                    <listitem>
-                      <para>Bluetooth device address (MAC).</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>bt-type</option></term>
-                    <listitem>
-                      <para>Bluetooth connection type.</para>
-                    </listitem>
-                  </varlistentry>
-                </variablelist>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term>
-                <option>type vlan</option>
-                <arg choice='plain'><option>dev</option> <replaceable>device</replaceable></arg>
-                <arg choice='plain'><option>id</option> <replaceable>id</replaceable></arg>
-                <arg><option>flags</option> <replaceable>flags</replaceable></arg>
-                <arg><option>ingress</option> <replaceable>mapping</replaceable></arg>
-                <arg><option>egress</option> <replaceable>mapping</replaceable></arg>
-                <arg><option>mtu</option> <replaceable>mtu</replaceable></arg>
-              </term>
-              <listitem>
-                <variablelist>
-                  <varlistentry>
-                    <term><option>dev</option></term>
-                    <listitem>
-                      <para>parent device this VLAN is on.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>id</option></term>
-                    <listitem>
-                      <para>VLAN ID in range 0-4095.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>flags</option></term>
-                    <listitem>
-                      <para>flags.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>ingress</option></term>
-                    <listitem>
-                      <para>VLAN ingress priority mapping.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>egress</option></term>
-                    <listitem>
-                      <para>VLAN egress priority mapping.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>mtu</option></term>
-                    <listitem>
-                      <para>MTU.</para>
-                    </listitem>
-                  </varlistentry>
-                </variablelist>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term>
-                <option>type bond</option>
-                <arg>
-                  <option>mode</option>
-                  <group choice='req'>
-                    <arg choice='plain'>active-backup</arg>
-                    <arg choice='plain'>balance-xor</arg>
-                    <arg choice='plain'>broadcast</arg>
-                    <arg choice='plain'>802.3ad</arg>
-                    <arg choice='plain'>balance-tlb</arg>
-                    <arg choice='plain'>balance-alb</arg>
-                    <arg choice='plain'><replaceable>num</replaceable></arg>
-                  </group>
-                </arg>
-                <arg><option>primary</option> <replaceable>ifname</replaceable></arg>
-                <arg><option>miimon</option> <replaceable>num</replaceable></arg>
-                <arg><option>downdelay</option> <replaceable>num</replaceable></arg>
-                <arg><option>updelay</option> <replaceable>num</replaceable></arg>
-                <arg><option>arp-interval</option> <replaceable>num</replaceable></arg>
-                <arg><option>arp-ip-target</option> <replaceable>num</replaceable></arg>
-              </term>
-              <listitem>
-                <variablelist>
-
-                  <varlistentry>
-                    <term><option>mode</option></term>
-                    <listitem>
-                      <para>bonding mode (default: <literal>balance-rr</literal>).</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>primary</option></term>
-                    <listitem>
-                      <para>primary interface name (for <literal>active-backup</literal> mode).</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>miimon</option></term>
-                    <listitem>
-                      <para>miimon (default: <literal>100</literal>).</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>downdelay</option></term>
-                    <listitem>
-                      <para>downdelay (default: <literal>0</literal>).</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>updelay</option></term>
-                    <listitem>
-                      <para>updelay (default: <literal>0</literal>).</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>arp-interval</option></term>
-                    <listitem>
-                      <para>ARP interval (default: <literal>0</literal>).</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>arp-ip-target</option></term>
-                    <listitem>
-                      <para>ARP IP target.</para>
-                    </listitem>
-                  </varlistentry>
-                </variablelist>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term>
-                <option>type bond-slave</option>
-                <arg><option>master</option> <replaceable>master</replaceable></arg>
-              </term>
-              <listitem>
-                <variablelist>
-                  <varlistentry>
-                    <term><option>master</option></term>
-                    <listitem>
-                      <para>master bond interface name, or connection UUID or
-                      ID of bond master connection profile. The value can be
-                      prefixed with <literal>ifname/</literal>,
-                      <literal>uuid/</literal> or <literal>id/</literal> to
-                      disambiguate it.</para>
-                    </listitem>
-                  </varlistentry>
-                </variablelist>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term>
-                <option>type team</option>
-                <arg>
-                  <option>config</option>
-                  <group choice='req'>
-                    <arg choice='plain'>file</arg>
-                    <arg choice='plain'><replaceable>JSON</replaceable></arg>
-                  </group>
-                </arg>
-              </term>
-              <listitem>
-                <variablelist>
-
-                  <varlistentry>
-                    <term><option>config</option></term>
-                    <listitem>
-                      <para>JSON configuration for team.</para>
-                    </listitem>
-                  </varlistentry>
-                </variablelist>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term>
-                <option>type team-slave</option>
-                <arg>
-                  <option>config</option>
-                  <option><replaceable>JSON</replaceable></option>
-                </arg>
-              </term>
-              <listitem>
-                <variablelist>
-                  <varlistentry>
-                    <term><option>master</option></term>
-                    <listitem>
-                      <para>master team interface name, or connection UUID or
-                      ID of team master connection profile. The value can be
-                      prefixed with <literal>ifname/</literal>,
-                      <literal>uuid/</literal> or <literal>id/</literal>to
-                      disambiguate it.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>config</option></term>
-                    <listitem>
-                      <para>JSON configuration for team.</para>
-                    </listitem>
-                  </varlistentry>
-                </variablelist>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term>
-                <option>type bridge</option>
-                <arg>
-                  <option>stp</option>
-                  <group choice='req'>
-                    <arg choice='plain'>yes</arg>
-                    <arg choice='plain'>no</arg>
-                  </group>
-                </arg>
-                <arg><option>priority</option> <replaceable>num</replaceable></arg>
-                <arg><option>forward-delay</option> <replaceable>2-30</replaceable></arg>
-                <arg><option>hello-time</option> <replaceable>1-10</replaceable></arg>
-                <arg><option>max-age</option> <replaceable>6-42</replaceable></arg>
-                <arg><option>ageing-time</option> <replaceable>0-1000000</replaceable></arg>
-                <arg>
-                  <option>multicast-snooping</option>
-                  <group choice='req'>
-                    <arg choice='plain'>yes</arg>
-                    <arg choice='plain'>no</arg>
-                  </group>
-                </arg>
-                <arg><option>mac</option> <replaceable>addr</replaceable></arg>
-              </term>
-              <listitem>
-                <variablelist>
-                  <varlistentry>
-                    <term><option>stp</option></term>
-                    <listitem>
-                      <para>controls whether Spanning Tree Protocol (STP) is enabled for this bridge
-                      (default: <literal>yes</literal>).</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>priority</option></term>
-                    <listitem>
-                      <para>sets STP priority (default: <literal>128</literal>).</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>forward-delay</option></term>
-                    <listitem>
-                      <para>STP forwarding delay, in seconds (default: <literal>15</literal>).</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>hello-time</option></term>
-                    <listitem>
-                      <para>STP hello time, in seconds (default: <literal>2</literal>).</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>max-age</option></term>
-                    <listitem>
-                      <para>STP maximum message age, in seconds (default: <literal>20</literal>).</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>ageing-time</option></term>
-                    <listitem>
-                      <para>the Ethernet MAC address aging time, in seconds (default: <literal>300</literal>).</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>multicast-snooping</option></term>
-                    <listitem>
-                      <para>controls whether IGMP snooping is enabled (default: <literal>yes</literal>).</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>mac</option></term>
-                    <listitem>
-                      <para>MAC address of the bridge (note: this requires a recent kernel feature,
-                      originally introduced in 3.15 upstream kernel).</para>
-                    </listitem>
-                  </varlistentry>
-                </variablelist>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term>
-                <option>type bridge-slave</option>
-                <arg><option>master</option> <replaceable>master</replaceable></arg>
-                <arg><option>priority</option> <replaceable>num</replaceable></arg>
-                <arg><option>path-cost</option> <replaceable>1-65535</replaceable></arg>
-                <arg>
-                  <option>hairpin</option>
-                  <group choice='req'>
-                    <arg choice='plain'>yes</arg>
-                    <arg choice='plain'>no</arg>
-                  </group>
-                </arg>
-              </term>
-              <listitem>
-                <variablelist>
-                  <varlistentry>
-                    <term><option>master</option></term>
-                    <listitem>
-                      <para>master bridge interface name, or connection UUID
-                      or ID of bridge master connection profile. The value
-                      can be prefixed with <literal>ifname/</literal>,
-                      <literal>uuid/</literal> or <literal>id/</literal>
-                      to disambiguate it.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>priority</option></term>
-                    <listitem>
-                      <para>STP priority of this slave (default: <literal>32</literal>).</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>path-cost</option></term>
-                    <listitem>
-                      <para>STP port cost for destinations via this slave (default: <literal>100</literal>).</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>hairpin</option></term>
-                    <listitem>
-                       <para>'hairpin mode' for the slave, which allows frames to be sent back out
-                       through the slave the frame was received on (default: <literal>yes</literal>).</para>
-                    </listitem>
-                  </varlistentry>
-                </variablelist>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term>
-                <option>type vpn</option>
-                <arg><option>type</option> <replaceable>type</replaceable></arg>
-                <arg><option>user</option> <replaceable>username</replaceable></arg>
-              </term>
-              <listitem>
-                <variablelist>
-                  <varlistentry>
-                    <term><option>vpn-type</option></term>
-                    <listitem>
-                      <para>VPN type.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>user</option></term>
-                    <listitem>
-                      <para>VPN username.</para>
-                    </listitem>
-                  </varlistentry>
-                </variablelist>
-              </listitem>
-            </varlistentry>
+          <para>If you want to append an item to the existing value, use
+          <literal>+</literal> prefix for the property name. If you want to remove just
+          one item from container-type property, use <literal>-</literal> prefix for
+          the property name and specify a value or an zero-based index of the item to
+          remove (or option name for properties with named options) as
+          <replaceable>value</replaceable>. The <literal>+</literal> and <literal>-</literal>
+          modifies only have a real effect for multi-value (container)
+          properties like <literal>ipv4.dns</literal>, <literal>ipv4.addresses</literal>,
+          <literal>bond.options</literal>, etc.</para>
 
-            <varlistentry>
-              <term>
-                <option>type olpc-mesh</option>
-                <arg choice='plain'><option>ssid</option> <replaceable>SSID</replaceable></arg>
-                <arg><option>channel</option> <replaceable>1-13</replaceable></arg>
-                <arg><option>dhcp-anycast</option> <replaceable>MAC</replaceable></arg>
-              </term>
-              <listitem>
-                <variablelist>
-                  <varlistentry>
-                    <term><option>ssid</option></term>
-                    <listitem>
-                      <para>SSID.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>channel</option></term>
-                    <listitem>
-                      <para>channel to use for the network.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>dhcp-anycast</option></term>
-                    <listitem>
-                      <para>anycast DHCP MAC address used when requesting an IP address via DHCP.</para>
-                    </listitem>
-                  </varlistentry>
-                </variablelist>
-              </listitem>
-            </varlistentry>
+          <para>See <citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum>
+          </citerefentry> for complete reference of setting and property names, their descriptions
+          and default values. The <replaceable>setting</replaceable> and
+          <replaceable>property</replaceable> can be abbreviated provided they are unique.</para>
 
-            <varlistentry>
-              <term>
-                <option>type adsl</option>
-                <arg choice='plain'><option>username</option> <replaceable>username</replaceable></arg>
-                <arg choice='plain'>
-                  <option>protocol</option>
-                  <group choice='req'>
-                    <arg choice='plain'>pppoa</arg>
-                    <arg choice='plain'>pppoe</arg>
-                    <arg choice='plain'>ipoatm</arg>
-                  </group>
-                </arg>
-                <arg><option>password</option> <replaceable>passwd</replaceable></arg>
-                <arg>
-                  <option>encapsulation</option>
-                  <group choice='req'>
-                    <arg choice='plain'>vcmux</arg>
-                    <arg choice='plain'>llc</arg>
-                  </group>
-                </arg>
-              </term>
-              <listitem>
-                <variablelist>
-                  <varlistentry>
-                    <term><option>username</option></term>
-                    <listitem>
-                      <para>ADSL user name.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>protocol</option></term>
-                    <listitem>
-                      <para>ADSL protocol.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>password</option></term>
-                    <listitem>
-                      <para>ADSL password.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>encapsulation</option></term>
-                    <listitem>
-                      <para>ADSL encapsulation.</para>
-                    </listitem>
-                  </varlistentry>
-                </variablelist>
-              </listitem>
-            </varlistentry>
+          <para>The connection is identified by its name, UUID or D-Bus path. If
+          <replaceable>ID</replaceable> is ambiguous, a keyword <option>id</option>,
+          <option>uuid</option> or <option>path</option> can be used.</para>
+        </listitem>
+      </varlistentry>
 
-            <varlistentry>
-              <term>
-                <option>type tun</option>
-                <arg choice='plain'>
-                  <option>mode</option>
-                  <group choice='req'>
-                    <arg choice='plain'>tun</arg>
-                    <arg choice='plain'>tap</arg>
-                  </group>
-                </arg>
-                <arg><option>owner</option> <replaceable>UID</replaceable></arg>
-                <arg><option>group</option> <replaceable>GID</replaceable></arg>
-                <arg>
-                  <option>pi</option>
-                  <group choice='req'>
-                    <arg choice='plain'>yes</arg>
-                    <arg choice='plain'>no</arg>
-                  </group>
-                </arg>
-                <arg>
-                  <option>vnet-hdr</option>
-                  <group choice='req'>
-                    <arg choice='plain'>yes</arg>
-                    <arg choice='plain'>no</arg>
-                  </group>
-                </arg>
-                <arg>
-                  <option>multi-queue</option>
-                  <group choice='req'>
-                    <arg choice='plain'>yes</arg>
-                    <arg choice='plain'>no</arg>
-                  </group>
-                </arg>
-              </term>
-              <listitem>
-                <variablelist>
-                  <varlistentry>
-                    <term><option>mode</option></term>
-                    <listitem>
-                      <para>Mode for the device.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>owner</option></term>
-                    <listitem>
-                      <para>UID of the owner.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>group</option></term>
-                    <listitem>
-                      <para>GID of the group.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>pi</option></term>
-                    <listitem>
-                      <para>include packet information (~IFF_NO_PI flag).</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>vnet-hdr</option></term>
-                    <listitem>
-                      <para>send and receive large (i.e. GSO) packets and packets with partial
-                      checksums (IFF_VNET_HDR flag).</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>multi-queue</option></term>
-                    <listitem>
-                      <para>multi-queue support for tun/tap device (IFF_MULTI_QUEUE flag).</para>
-                    </listitem>
-                  </varlistentry>
-                </variablelist>
-              </listitem>
-            </varlistentry>
 
-            <varlistentry>
-              <term>
-                <option>type ip-tunnel</option>
-                <arg choice='plain'>
-                  <option>mode</option>
-                  <group choice='req'>
-                    <arg choice='plain'>ipip</arg>
-                    <arg choice='plain'>gre</arg>
-                    <arg choice='plain'>sit</arg>
-                    <arg choice='plain'>isatap</arg>
-                    <arg choice='plain'>vti</arg>
-                    <arg choice='plain'>ip6ip6</arg>
-                    <arg choice='plain'>ipip6</arg>
-                    <arg choice='plain'>ip6gre</arg>
-                    <arg choice='plain'>vti6</arg>
-                    <arg choice='plain'>tun</arg>
-                  </group>
-                </arg>
-                <arg choice='plain'><option>remote</option> <replaceable>addr</replaceable></arg>
-                <arg><option>local</option> <replaceable>addr</replaceable></arg>
-                <arg><option>dev</option> <replaceable>device</replaceable></arg>
-              </term>
-              <listitem>
-                <variablelist>
-                  <varlistentry>
-                    <term><option>mode</option></term>
-                    <listitem>
-                      <para>tunnel mode.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>remote</option></term>
-                    <listitem>
-                      <para>IPv4 or IPv6 address of the remote tunnel endpoint.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>local</option></term>
-                    <listitem>
-                      <para>IPv4 or IPv6 address of the local tunnel endpoint.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>dev</option></term>
-                    <listitem>
-                      <para>device to use for tunnel endpoint communication.</para>
-                    </listitem>
-                  </varlistentry>
-                </variablelist>
-              </listitem>
-            </varlistentry>
+      <varlistentry>
+        <term>
+          <command>add</command>
+          <arg><option>save</option><group choice='req'><arg choice='plain'>yes</arg><arg choice='plain'>no</arg></group></arg>
+          <arg rep='repeat' choice='plain'>
+            <group choice='req'>
+              <arg choice='plain'><replaceable>option</replaceable> <replaceable>value</replaceable></arg>
+              <arg choice='plain'>[+|-]<replaceable>setting</replaceable>.<replaceable>property</replaceable> <replaceable>value</replaceable></arg>
+            </group>
+          </arg>
+        </term>
 
-            <varlistentry>
-              <term>
-                <option>type macvlan</option>
-                <arg choice='plain'><option>dev</option> <replaceable>device</replaceable></arg>
-                <arg choice='plain'>
-                  <option>mode</option>
-                  <group choice='req'>
-                    <arg choice='plain'>vepa</arg>
-                    <arg choice='plain'>bridge</arg>
-                    <arg choice='plain'>private</arg>
-                    <arg choice='plain'>passthru</arg>
-                    <arg choice='plain'>source</arg>
-                  </group>
-                </arg>
-                <arg>
-                  <option>tap</option>
-                  <group choice='req'>
-                    <arg choice='plain'>yes</arg>
-                    <arg choice='plain'>no</arg>
-                  </group>
-                </arg>
-              </term>
-              <listitem>
-                <variablelist>
-                  <varlistentry>
-                    <term><option>dev</option></term>
-                    <listitem>
-                      <para>parent device this MACVLAN is on.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>mode</option></term>
-                    <listitem>
-                      <para>MACVLAN mode, which specifies the communication mechanism between
-                      multiple MACVLANs on the same lower device.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>tap</option></term>
-                    <listitem>
-                      <para>controls the device type. If set to 'yes' a MACVTAP will be created
-                      (default: <literal>no</literal>).</para>
-                    </listitem>
-                  </varlistentry>
-                </variablelist>
-              </listitem>
-            </varlistentry>
+        <listitem>
+          <para>Create a new connection using specified properties.</para>
+
+          <para>You need to describe the newly created connections with the property and value pairs.
+          See <citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum>
+          </citerefentry> for the complete reference. You can also use the aliases described in
+          <link linkend='property_aliases' endterm='property_aliases.title' /> section. The syntax is
+          the same as of the <command>nmcli connection modify</command> command.</para>
+
+          <para>To construct a meaningful connection you at the very least need to set the
+          <option>connection.type</option> property (or use the <option>type</option> alias)
+          to one of known NetworkManager connection types:</para>
+
+          <itemizedlist spacing='compact'>
+            <listitem><para><literal>ethernet</literal></para></listitem>
+            <listitem><para><literal>wifi</literal></para></listitem>
+            <listitem><para><literal>wimax</literal></para></listitem>
+            <listitem><para><literal>pppoe</literal></para></listitem>
+            <listitem><para><literal>gsm</literal></para></listitem>
+            <listitem><para><literal>cdma</literal></para></listitem>
+            <listitem><para><literal>infiniband</literal></para></listitem>
+            <listitem><para><literal>bluetooth</literal></para></listitem>
+            <listitem><para><literal>vlan</literal></para></listitem>
+            <listitem><para><literal>bond</literal></para></listitem>
+            <listitem><para><literal>bond-slave</literal></para></listitem>
+            <listitem><para><literal>team</literal></para></listitem>
+            <listitem><para><literal>team-slave</literal></para></listitem>
+            <listitem><para><literal>bridge</literal></para></listitem>
+            <listitem><para><literal>bridge-slave</literal></para></listitem>
+            <listitem><para><literal>vpn</literal></para></listitem>
+            <listitem><para><literal>olpc-mesh</literal></para></listitem>
+            <listitem><para><literal>adsl</literal></para></listitem>
+            <listitem><para><literal>tun</literal></para></listitem>
+            <listitem><para><literal>ip-tunnel</literal></para></listitem>
+            <listitem><para><literal>macvlan</literal></para></listitem>
+            <listitem><para><literal>vxlan</literal></para></listitem>
+          </itemizedlist>
 
-            <varlistentry>
-              <term>
-                <option>type vxlan</option>
-                <arg choice='plain'><option>id</option> <replaceable>id</replaceable></arg>
-                <arg choice='plain'><option>remote</option> <replaceable>addr</replaceable></arg>
-                <arg><option>dev</option> <replaceable>parent device (ifname or connection UUID)</replaceable></arg>
-                <arg><option>local</option> <replaceable>addr</replaceable></arg>
-                <arg><option>source-port-min</option> <replaceable>0-65535</replaceable></arg>
-                <arg><option>source-port-max</option> <replaceable>0-65535</replaceable></arg>
-                <arg><option>destination-port</option> <replaceable>0-65535</replaceable></arg>
-              </term>
-              <listitem>
-                <variablelist>
-                  <varlistentry>
-                    <term><option>id</option></term>
-                    <listitem>
-                      <para>VXLAN Network Identifer to use.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>remote</option></term>
-                    <listitem>
-                      <para>unicast destination IP address or multicast IP address to join.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>dev</option></term>
-                    <listitem>
-                      <para>device to use for tunnel endpoint communication.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>local</option></term>
-                    <listitem>
-                      <para>source IP address.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>source-port-min</option></term>
-                    <listitem>
-                      <para>minimum UDP source port to communicate to the remote VXLAN tunnel endpoint.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>source-port-max</option></term>
-                    <listitem>
-                      <para>maximum UDP source port to communicate to the remote VXLAN tunnel endpoint.</para>
-                    </listitem>
-                  </varlistentry>
-
-                  <varlistentry>
-                    <term><option>destination-port</option></term>
-                    <listitem>
-                      <para>UDP destination port to communicate to the remote VXLAN tunnel endpoint.</para>
-                    </listitem>
-                  </varlistentry>
-                </variablelist>
-              </listitem>
-            </varlistentry>
+          <para>The most typical uses are described in the <link linkend='examples' endterm='examples.title' /> section.</para>
 
-            <varlistentry>
-              <term><option>ip4</option></term>
-              <term><option>gw4</option></term>
-              <listitem>
-                <para>IPv4 addresses.</para>
-              </listitem>
-            </varlistentry>
+          <para>Aside from the properties and values two special options are accepted:</para>
 
+          <variablelist>
             <varlistentry>
-              <term><option>ip6</option></term>
-              <term><option>gw6</option></term>
+              <term><option>save</option></term>
               <listitem>
-                <para>IPv6 addresses.</para>
+                <para>Controls whether the connection should be persistent, i.e. NetworkManager should
+                store it on disk (default: <literal>yes</literal>).</para>
               </listitem>
             </varlistentry>
 
             <varlistentry>
               <term><option>--</option></term>
               <listitem>
-                <para>If a <option>--</option> argument is encountered, the rest of command
-                line is interpreted as property list in the same format as <command>connection
-                modify</command> command accepts.  This makes it possible to adjust the
-                connection properties before it's added.</para>
+                <para>If a single <option>--</option> argument is encountered it is ignored.
+                This is for compatibility with older versions on <command>nmcli</command>.</para>
               </listitem>
             </varlistentry>
           </variablelist>
@@ -1977,7 +961,7 @@
                 <arg choice='plain'><option>uuid</option></arg>
                 <arg choice='plain'><option>path</option></arg>
               </group>
-              <arg rep='repeat' choice='plain'><replaceable>ID</replaceable></arg>
+              <arg choice='plain'><replaceable>ID</replaceable></arg>
             </arg>
             <arg choice='plain'>
               <arg><option>type</option> <replaceable>type</replaceable></arg>
@@ -2023,55 +1007,13 @@
           <citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum>
           </citerefentry> for all NetworkManager settings and property names, and their
           descriptions; and
-          <citerefentry><refentrytitle>nmcli-examples</refentrytitle><manvolnum>7</manvolnum></citerefentry>
+          <link linkend='nmcli-examples'><citerefentry><refentrytitle>nmcli-examples</refentrytitle><manvolnum>7</manvolnum></citerefentry></link>
           for sample editor sessions.</para>
         </listitem>
       </varlistentry>
 
       <varlistentry>
         <term>
-          <command>modify</command>
-          <arg><option>--temporary</option></arg>
-          <group>
-            <arg choice='plain'><option>id</option></arg>
-            <arg choice='plain'><option>uuid</option></arg>
-            <arg choice='plain'><option>path</option></arg>
-          </group>
-          <arg choice='plain'><replaceable>ID</replaceable></arg>
-          <arg choice='plain' rep='repeat'>
-            [+|-]<replaceable>setting</replaceable>.<replaceable>property</replaceable>
-            <replaceable>value</replaceable>
-          </arg>
-        </term>
-
-        <listitem>
-          <para>Modify one or more properties in the connection profile.</para>
-
-          <para>The connection is identified by its name, UUID or D-Bus path. If
-          <replaceable>ID</replaceable> is ambiguous, a keyword <option>id</option>,
-          <option>uuid</option> or <option>path</option> can be used. See
-          <citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum>
-          </citerefentry> for setting and property names, their descriptions and default
-          values. This command supports abbreviations for <replaceable>setting</replaceable>
-          and <replaceable>property</replaceable> provided they are unique. Empty
-          <replaceable>value</replaceable> ("") removes the property value (sets
-          the property to the default value). The provided value overwrites the existing
-          property value.</para>
-
-          <para>If you want to append an item to the existing value, use
-          <literal>+</literal> prefix for the property name. If you want to remove just
-          one item from container-type property, use <literal>-</literal> prefix for
-          the property name and specify a value or an zero-based index of the item to
-          remove (or option name for properties with named options) as
-          <replaceable>value</replaceable>. Of course, <literal>+</literal> and
-          <literal>-</literal> only have a real effect for multi-value (container)
-          properties like <literal>ipv4.dns</literal>, <literal>ipv4.addresses</literal>,
-          <literal>bond.options</literal>, etc.</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>
           <command>clone</command>
           <arg><option>--temporary</option></arg>
           <group>
@@ -2079,8 +1021,8 @@
             <arg choice='plain'><option>uuid</option></arg>
             <arg choice='plain'><option>path</option></arg>
           </group>
-          <arg choice='plain' rep='repeat'><replaceable>ID</replaceable></arg>
-          <arg choice='plain'><option>new</option> <replaceable>name</replaceable></arg>
+          <arg choice='plain'><replaceable>ID</replaceable></arg>
+          <arg choice='plain'><replaceable>new_name</replaceable></arg>
         </term>
 
         <listitem>
@@ -2088,9 +1030,9 @@
           name, UUID or D-Bus path. If <replaceable>ID</replaceable> is ambiguous, a keyword
           <option>id</option>, <option>uuid</option> or <option>path</option>
           can be used. See <command>connection show</command> above for the description
-          of the <replaceable>ID</replaceable>-specifying keywords. <replaceable>name</replaceable> is
+          of the <replaceable>ID</replaceable>-specifying keywords. <replaceable>new_name</replaceable> is
           the name of the new cloned connection. The new connection will be the exact
-          copy except the connection.id (<replaceable>name</replaceable>) and
+          copy except the connection.id (<replaceable>new_name</replaceable>) and
           connection.uuid (generated) properties.</para>
 
           <para>The new connection profile will be saved as persistent unless
@@ -2161,7 +1103,7 @@
           disk when a change was made to them. However, the auto-loading feature can be
           enabled and then NetworkManager will reload connection
           files any time they change (monitor-connection-files=true in
-          <citerefentry><refentrytitle>NetworkManager.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>).
+          <link linkend='NetworkManager.conf'><link linkend='NetworkManager.conf'><citerefentry><refentrytitle>NetworkManager.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry></link></link>).
           </para>
         </listitem>
       </varlistentry>
@@ -2183,8 +1125,8 @@
         <term>
           <command>import</command>
           <arg><option>--temporary</option></arg>
-          <arg><option>type</option> <replaceable>type</replaceable></arg>
-          <arg><option>file</option> <replaceable>file</replaceable></arg>
+          <arg choice='plain'><option>type</option> <replaceable>type</replaceable></arg>
+          <arg choice='plain'><option>file</option> <replaceable>file</replaceable></arg>
         </term>
 
         <listitem>
@@ -2239,6 +1181,7 @@
         <arg choice='plain'><command>set</command></arg>
         <arg choice='plain'><command>connect</command></arg>
         <arg choice='plain'><command>reapply</command></arg>
+        <arg choice='plain'><command>modify</command></arg>
         <arg choice='plain'><command>disconnect</command></arg>
         <arg choice='plain'><command>delete</command></arg>
         <arg choice='plain'><command>monitor</command></arg>
@@ -2305,7 +1248,7 @@
       <varlistentry>
         <term>
           <command>connect</command>
-          <arg><replaceable>ifname</replaceable></arg>
+          <arg choice='plain'><replaceable>ifname</replaceable></arg>
         </term>
 
         <listitem>
@@ -2321,7 +1264,7 @@
       <varlistentry>
         <term>
           <command>reapply</command>
-          <arg><replaceable>ifname</replaceable></arg>
+          <arg choice='plain'><replaceable>ifname</replaceable></arg>
         </term>
 
         <listitem>
@@ -2332,8 +1275,36 @@
 
       <varlistentry>
         <term>
+          <command>modify</command>
+          <arg choice='plain'><replaceable>ifname</replaceable></arg>
+          <arg rep='repeat' choice='plain'>
+            <group choice='req'>
+              <arg choice='plain'><replaceable>option</replaceable> <replaceable>value</replaceable></arg>
+              <arg choice='plain'>[+|-]<replaceable>setting</replaceable>.<replaceable>property</replaceable> <replaceable>value</replaceable></arg>
+            </group>
+          </arg>
+        </term>
+
+        <listitem>
+          <para>Modify the settings currently active on the device.</para>
+
+          <para>This command lets you do temporary changes to a configuration active on
+          a particular device. The changes are not preserved in the connection profile.</para>
+
+          <para>See <citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum>
+          </citerefentry> for the list of available properties. Please note that some
+          properties can't be changed on an already connected device.</para>
+
+          <para>You can also use the aliases described in
+          <link linkend='property_aliases' endterm='property_aliases.title' /> section. The syntax is
+          the same as of the <command>nmcli connection modify</command> command.</para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term>
           <command>disconnect</command>
-          <arg rep='repeat'><replaceable>ifname</replaceable></arg>
+          <arg choice='plain' rep='repeat'><replaceable>ifname</replaceable></arg>
         </term>
 
         <listitem>
@@ -2350,7 +1321,7 @@
       <varlistentry>
         <term>
           <command>delete</command>
-          <arg rep='repeat'><replaceable>ifname</replaceable></arg>
+          <arg choice='plain' rep='repeat'><replaceable>ifname</replaceable></arg>
         </term>
 
         <listitem>
@@ -2673,6 +1644,343 @@
 
   </refsect1>
 
+  <refsect1 id='property_aliases'><title id='property_aliases.title'>Property Aliases</title>
+
+    <para>Apart from the property-value pairs, <command>connection add</command>,
+    <command>connection modify</command> and <command>device modify</command> also
+    accept short forms of some properties. They exist for convenience and compatiblity
+    with older versions of <command>nmcli</command> that could not accept the raw
+    properties.</para>
+
+   <para>The overview of the aliases is below. An actual connection type is used to
+   disambiguate these options from the options of the same name that are valid for
+   multiple connection types (such as <option>mtu</option>).</para>
+
+    <table><title>Options for all connections</title><tgroup cols="3">
+    <thead>
+      <row><entry>Alias</entry><entry>Property</entry><entry>Note</entry></row>
+    </thead>
+    <tbody>
+      <row>
+        <entry align="left">type</entry>
+        <entry align="left"><link linkend="nm-settings.property.connection.type">connection.type</link></entry>
+        <entry align="left" valign="top">This option also accepts values of <option>bond-slave</option>,
+<option>team-slave</option> and <option>bridge-slave</option>. They create
+<option>ethernet</option> connection profiles. Their use is discouraged in
+favor of using a specific type with <option>master</option> option.</entry>
+      </row>
+      <row>
+        <entry align="left">con-name</entry>
+        <entry align="left"><link linkend="nm-settings.property.connection.id">connection.id</link></entry>
+        <entry align="left" valign="top">When not provided a default name is generated: &lt;type&gt;[-&lt;ifname&gt;][-&lt;num&gt;]).</entry>
+      </row>
+      <row><entry align="left">autoconnect</entry><entry align="left"><link linkend="nm-settings.property.connection.autoconnect">connection.autoconnect</link></entry><entry align="left" /></row>
+      <row>
+        <entry align="left">ifname</entry>
+        <entry align="left"><link linkend="nm-settings.property.connection.interface-name">connection.interface-name</link></entry>
+        <entry align="left" valign="top">A value of <literal>*</literal> will be interpreted as
+no value, making the connection profile interface-independent.
+Note: use quotes around <literal>*</literal> to suppress shell expansion.
+For bond, team and bridge connections a default name will be generated if not set.</entry>
+      </row>
+      <row>
+        <entry align="left">master</entry>
+        <entry align="left"><link linkend="nm-settings.property.connection.master">connection.master</link></entry>
+        <entry align="left" valign="top">Value specified here will be canonicalized.
+It can be prefixed with <literal>ifname/</literal>, <literal>uuid/</literal>
+or <literal>id/</literal> to disambiguate it.</entry>
+If the master connection can be found this will set <literal>connection.slave-type</literal>
+property as well.
+      </row>
+      <row><entry align="left">slave-type</entry><entry align="left"><link linkend="nm-settings.property.connection.slave-type">connection.slave-type</link></entry><entry align="left" /></row>
+    </tbody>
+    </tgroup></table>
+
+    <table><title>PPPoE options</title><tgroup cols="2">
+    <thead>
+      <row><entry>Alias</entry><entry>Property</entry></row>
+    </thead>
+    <tbody>
+      <row><entry align="left">username</entry><entry align="left"><link linkend="nm-settings.property.pppoe.username">pppoe.username</link></entry></row>
+      <row><entry align="left">password</entry><entry align="left"><link linkend="nm-settings.property.pppoe.password">pppoe.password</link></entry></row>
+      <row><entry align="left">service</entry><entry align="left"><link linkend="nm-settings.property.pppoe.service">pppoe.service</link></entry></row>
+    </tbody>
+    </tgroup></table>
+
+    <table><title>Wired Ethernet options</title><tgroup cols="2">
+    <thead>
+      <row><entry>Alias</entry><entry>Property</entry></row>
+    </thead>
+    <tbody>
+      <row><entry align="left">mtu</entry><entry align="left"><link linkend="nm-settings.property.802-3-ethernet.mtu">wired.mtu</link></entry></row>
+      <row><entry align="left">mac</entry><entry align="left"><link linkend="nm-settings.property.802-3-ethernet.mac-address">wired.mac-address</link></entry></row>
+      <row><entry align="left">cloned-mac</entry><entry align="left"><link linkend="nm-settings.property.802-3-ethernet.cloned-mac-address">wired.cloned-mac-address</link></entry></row>
+    </tbody>
+    </tgroup></table>
+
+    <table><title>Infiniband options</title><tgroup cols="2">
+    <thead>
+      <row><entry>Alias</entry><entry>Property</entry></row>
+    </thead>
+    <tbody>
+      <row><entry align="left">mtu</entry><entry align="left"><link linkend="nm-settings.property.infiniband.mtu">infiniband.mtu</link></entry></row>
+      <row><entry align="left">mac</entry><entry align="left"><link linkend="nm-settings.property.infiniband.mac-address">infiniband.mac-address</link></entry></row>
+      <row><entry align="left">transport-mode</entry><entry align="left"><link linkend="nm-settings.property.infiniband.transport-mode">infiniband.transport-mode</link></entry></row>
+      <row><entry align="left">parent</entry><entry align="left"><link linkend="nm-settings.property.infiniband.parent">infiniband.parent</link></entry></row>
+      <row><entry align="left">p-key</entry><entry align="left"><link linkend="nm-settings.property.infiniband.p-key">infiniband.p-key</link></entry></row>
+    </tbody>
+    </tgroup></table>
+
+    <table><title>Wi-Fi options</title><tgroup cols="2">
+    <thead>
+      <row><entry>Alias</entry><entry>Property</entry></row>
+    </thead>
+    <tbody>
+      <row><entry align="left">ssid</entry><entry align="left"><link linkend="nm-settings.property.802-11-wireless.ssid">wireless.ssid</link></entry></row>
+      <row><entry align="left">mode</entry><entry align="left"><link linkend="nm-settings.property.802-11-wireless.mode">wireless.mode</link></entry></row>
+      <row><entry align="left">mtu</entry><entry align="left"><link linkend="nm-settings.property.802-11-wireless.mtu">wireless.mtu</link></entry></row>
+      <row><entry align="left">mac</entry><entry align="left"><link linkend="nm-settings.property.802-11-wireless.mac-address">wireless.mac-address</link></entry></row>
+      <row><entry align="left">cloned-mac</entry><entry align="left"><link linkend="nm-settings.property.802-11-wireless.cloned-mac-address">wireless.cloned-mac-address</link></entry></row>
+    </tbody>
+    </tgroup></table>
+
+    <table><title>WiMax options</title><tgroup cols="2">
+    <thead>
+      <row><entry>Alias</entry><entry>Property</entry></row>
+    </thead>
+    <tbody>
+      <row><entry align="left">nsp</entry><entry align="left"><link linkend="nm-settings.property.wimax.network-name">wimax.network-name</link></entry></row>
+      <row><entry align="left">mac</entry><entry align="left"><link linkend="nm-settings.property.wimax.mac-address">wimax.mac-address</link></entry></row>
+    </tbody>
+    </tgroup></table>
+
+    <table><title>GSM options</title><tgroup cols="2">
+    <thead>
+      <row><entry>Alias</entry><entry>Property</entry></row>
+    </thead>
+    <tbody>
+      <row><entry align="left">apn</entry><entry align="left"><link linkend="nm-settings.property.gsm.apn">gsm.apn</link></entry></row>
+      <row><entry align="left">user</entry><entry align="left"><link linkend="nm-settings.property.gsm.username">gsm.username</link></entry></row>
+      <row><entry align="left">password</entry><entry align="left"><link linkend="nm-settings.property.gsm.password">gsm.password</link></entry></row>
+    </tbody>
+    </tgroup></table>
+
+    <table><title>CDMA options</title><tgroup cols="2">
+    <thead>
+      <row><entry>Alias</entry><entry>Property</entry></row>
+    </thead>
+    <tbody>
+      <row><entry align="left">user</entry><entry align="left"><link linkend="nm-settings.property.cdma.username">cdma.username</link></entry></row>
+      <row><entry align="left">password</entry><entry align="left"><link linkend="nm-settings.property.cdma.password">cdma.password</link></entry></row>
+    </tbody>
+    </tgroup></table>
+
+    <table><title>Bluetooth options</title><tgroup cols="3">
+    <thead>
+      <row><entry>Alias</entry><entry>Property</entry><entry>Note</entry></row>
+    </thead>
+    <tbody>
+      <row><entry align="left">addr</entry><entry align="left"><link linkend="nm-settings.property.bluetooth.bdaddr">bluetooth.bdaddr</link></entry><entry align="left" /></row>
+      <row>
+        <entry align="left">bt-type</entry>
+        <entry align="left"><link linkend="nm-settings.property.bluetooth.type">bluetooth.type</link></entry>
+        <entry align="left" valign="top">Apart from the usual <literal>dun</literal> and
+<literal>panu</literal> options, the values of <literal>dun-gsm</literal>
+and <literal>dun-cdma</literal> can be used for compatibility with older
+versions. They are equivalent to using <literal>dun</literal> and setting
+appropriate <literal>gsm.*</literal> or <literal>cdma.*</literal> properties.</entry>
+      </row>
+    </tbody>
+    </tgroup></table>
+
+    <table><title>VLAN options</title><tgroup cols="2">
+    <thead>
+      <row><entry>Alias</entry><entry>Property</entry></row>
+    </thead>
+    <tbody>
+      <row><entry align="left">dev</entry><entry align="left"><link linkend="nm-settings.property.vlan.parent">vlan.parent</link></entry></row>
+      <row><entry align="left">id</entry><entry align="left"><link linkend="nm-settings.property.vlan.id">vlan.id</link></entry></row>
+      <row><entry align="left">flags</entry><entry align="left"><link linkend="nm-settings.property.vlan.flags">vlan.flags</link></entry></row>
+      <row><entry align="left">ingress</entry><entry align="left"><link linkend="nm-settings.property.vlan.ingress-priority-map">vlan.ingress-priority-map</link></entry></row>
+      <row><entry align="left">egress</entry><entry align="left"><link linkend="nm-settings.property.vlan.egress-priority-map">vlan.egress-priority-map</link></entry></row>
+    </tbody>
+    </tgroup></table>
+
+    <table><title>Bonding options</title><tgroup cols="3">
+    <thead>
+      <row><entry>Alias</entry><entry>Property</entry><entry>Note</entry></row>
+    </thead>
+    <tbody>
+      <row>
+        <entry align="left">mode</entry>
+        <entry align="left" morerows="7">bond.options</entry>
+        <entry align="left" morerows="7" valign="top">Setting each of these adds the option to <literal>bond.options</literal> property.
+It's equivalent of using the <literal>+bond.options 'option=value'</literal> syntax.</entry>
+      </row>
+      <row><entry align="left">primary</entry></row>
+      <row><entry align="left">miimon</entry></row>
+      <row><entry align="left">downdelay</entry></row>
+      <row><entry align="left">updelay</entry></row>
+      <row><entry align="left">arp-interval</entry></row>
+      <row><entry align="left">arp-ip-target</entry></row>
+      <row><entry align="left">lacp-rate</entry></row>
+    </tbody>
+    </tgroup></table>
+
+    <table><title>Team options</title><tgroup cols="2">
+    <thead>
+      <row><entry>Alias</entry><entry>Property</entry></row>
+    </thead>
+    <tbody>
+      <row><entry align="left">config</entry><entry align="left"><link linkend="nm-settings.property.team.config">team.config</link></entry></row>
+    </tbody>
+    </tgroup></table>
+
+    <table><title>Team port options</title><tgroup cols="2">
+    <thead>
+      <row><entry>Alias</entry><entry>Property</entry></row>
+    </thead>
+    <tbody>
+      <row><entry align="left">config</entry><entry align="left"><link linkend="nm-settings.property.team-port.config">team-port.config</link></entry></row>
+    </tbody>
+    </tgroup></table>
+
+    <table><title>Bridge options</title><tgroup cols="2">
+    <thead>
+      <row><entry>Alias</entry><entry>Property</entry></row>
+    </thead>
+    <tbody>
+      <row><entry align="left">stp</entry><entry align="left"><link linkend="nm-settings.property.bridge.stp">bridge.stp</link></entry></row>
+      <row><entry align="left">priority</entry><entry align="left"><link linkend="nm-settings.property.bridge.priority">bridge.priority</link></entry></row>
+      <row><entry align="left">forward-delay</entry><entry align="left"><link linkend="nm-settings.property.bridge.forward-delay">bridge.forward-delay</link></entry></row>
+      <row><entry align="left">hello-time</entry><entry align="left"><link linkend="nm-settings.property.bridge.hello-time">bridge.hello-time</link></entry></row>
+      <row><entry align="left">max-age</entry><entry align="left"><link linkend="nm-settings.property.bridge.max-age">bridge.max-age</link></entry></row>
+      <row><entry align="left">ageing-time</entry><entry align="left"><link linkend="nm-settings.property.bridge.ageing-time">bridge.ageing-time</link></entry></row>
+      <row><entry align="left">multicast-snooping</entry><entry align="left"><link linkend="nm-settings.property.bridge.multicast-snooping">bridge.multicast-snooping</link></entry></row>
+      <row><entry align="left">mac</entry><entry align="left"><link linkend="nm-settings.property.bridge.mac-address">bridge.mac-address</link></entry></row>
+      <row><entry align="left">priority</entry><entry align="left"><link linkend="nm-settings.property.bridge-port.priority">bridge-port.priority</link></entry></row>
+      <row><entry align="left">path-cost</entry><entry align="left"><link linkend="nm-settings.property.bridge-port.path-cost">bridge-port.path-cost</link></entry></row>
+      <row><entry align="left">hairpin</entry><entry align="left"><link linkend="nm-settings.property.bridge-port.hairpin-mode">bridge-port.hairpin-mode</link></entry></row>
+    </tbody>
+    </tgroup></table>
+
+    <table><title>VPN options</title><tgroup cols="2">
+    <thead>
+      <row><entry>Alias</entry><entry>Property</entry></row>
+    </thead>
+    <tbody>
+      <row><entry align="left">vpn-type</entry><entry align="left"><link linkend="nm-settings.property.vpn.service-type">vpn.service-type</link></entry></row>
+      <row><entry align="left">user</entry><entry align="left"><link linkend="nm-settings.property.vpn.user-name">vpn.user-name</link></entry></row>
+    </tbody>
+    </tgroup></table>
+
+    <table><title>OLPC Mesh options</title><tgroup cols="2">
+    <thead>
+      <row><entry>Alias</entry><entry>Property</entry></row>
+    </thead>
+    <tbody>
+      <row><entry align="left">ssid</entry><entry align="left"><link linkend="nm-settings.property.802-11-olpc-mesh.ssid">olpc-mesh.ssid</link></entry></row>
+      <row><entry align="left">channel</entry><entry align="left"><link linkend="nm-settings.property.802-11-olpc-mesh.channel">olpc-mesh.channel</link></entry></row>
+      <row><entry align="left">dhcp-anycast</entry><entry align="left"><link linkend="nm-settings.property.802-11-olpc-mesh.dhcp-anycast-address">olpc-mesh.dhcp-anycast-address</link></entry></row>
+    </tbody>
+    </tgroup></table>
+
+    <table><title>ADSL options</title><tgroup cols="2">
+    <thead>
+      <row><entry>Alias</entry><entry>Property</entry></row>
+    </thead>
+    <tbody>
+      <row><entry align="left">username</entry><entry align="left"><link linkend="nm-settings.property.adsl.username">adsl.username</link></entry></row>
+      <row><entry align="left">protocol</entry><entry align="left"><link linkend="nm-settings.property.adsl.protocol">adsl.protocol</link></entry></row>
+      <row><entry align="left">password</entry><entry align="left"><link linkend="nm-settings.property.adsl.password">adsl.password</link></entry></row>
+      <row><entry align="left">encapsulation</entry><entry align="left"><link linkend="nm-settings.property.adsl.encapsulation">adsl.encapsulation</link></entry></row>
+    </tbody>
+    </tgroup></table>
+
+    <table><title>MACVLAN options</title><tgroup cols="2">
+    <thead>
+      <row><entry>Alias</entry><entry>Property</entry></row>
+    </thead>
+    <tbody>
+      <row><entry align="left">dev</entry><entry align="left"><link linkend="nm-settings.property.macvlan.parent">macvlan.parent</link></entry></row>
+      <row><entry align="left">mode</entry><entry align="left"><link linkend="nm-settings.property.macvlan.mode">macvlan.mode</link></entry></row>
+      <row><entry align="left">tap</entry><entry align="left"><link linkend="nm-settings.property.macvlan.tap">macvlan.tap</link></entry></row>
+    </tbody>
+    </tgroup></table>
+
+    <table><title>VxLAN options</title><tgroup cols="2">
+    <thead>
+      <row><entry>Alias</entry><entry>Property</entry></row>
+    </thead>
+    <tbody>
+      <row><entry align="left">id</entry><entry align="left"><link linkend="nm-settings.property.vxlan.id">vxlan.id</link></entry></row>
+      <row><entry align="left">remote</entry><entry align="left"><link linkend="nm-settings.property.vxlan.remote">vxlan.remote</link></entry></row>
+      <row><entry align="left">dev</entry><entry align="left"><link linkend="nm-settings.property.vxlan.parent">vxlan.parent</link></entry></row>
+      <row><entry align="left">local</entry><entry align="left"><link linkend="nm-settings.property.vxlan.local">vxlan.local</link></entry></row>
+      <row><entry align="left">source-port-min</entry><entry align="left"><link linkend="nm-settings.property.vxlan.source-port-min">vxlan.source-port-min</link></entry></row>
+      <row><entry align="left">source-port-max</entry><entry align="left"><link linkend="nm-settings.property.vxlan.source-port-max">vxlan.source-port-max</link></entry></row>
+      <row><entry align="left">destination-port</entry><entry align="left"><link linkend="nm-settings.property.vxlan.destination-port">vxlan.destination-port</link></entry></row>
+    </tbody>
+    </tgroup></table>
+
+    <table><title>Tun options</title><tgroup cols="2">
+    <thead>
+      <row><entry>Alias</entry><entry>Property</entry></row>
+    </thead>
+    <tbody>
+      <row><entry align="left">mode</entry><entry align="left"><link linkend="nm-settings.property.tun.mode">tun.mode</link></entry></row>
+      <row><entry align="left">owner</entry><entry align="left"><link linkend="nm-settings.property.tun.owner">tun.owner</link></entry></row>
+      <row><entry align="left">group</entry><entry align="left"><link linkend="nm-settings.property.tun.group">tun.group</link></entry></row>
+      <row><entry align="left">pi</entry><entry align="left"><link linkend="nm-settings.property.tun.pi">tun.pi</link></entry></row>
+      <row><entry align="left">vnet-hdr</entry><entry align="left"><link linkend="nm-settings.property.tun.vnet-hdr">tun.vnet-hdr</link></entry></row>
+      <row><entry align="left">multi-queue</entry><entry align="left"><link linkend="nm-settings.property.tun.multi-queue">tun.multi-queue</link></entry></row>
+    </tbody>
+    </tgroup></table>
+
+    <table><title>IP tunneling options</title><tgroup cols="2">
+    <thead>
+      <row><entry>Alias</entry><entry>Property</entry></row>
+    </thead>
+    <tbody>
+      <row><entry align="left">mode</entry><entry align="left"><link linkend="nm-settings.property.ip-tunnel.mode">ip-tunnel.mode</link></entry></row>
+      <row><entry align="left">local</entry><entry align="left"><link linkend="nm-settings.property.ip-tunnel.local">ip-tunnel.local</link></entry></row>
+      <row><entry align="left">remote</entry><entry align="left"><link linkend="nm-settings.property.ip-tunnel.remote">ip-tunnel.remote</link></entry></row>
+      <row><entry align="left">dev</entry><entry align="left"><link linkend="nm-settings.property.ip-tunnel.parent">ip-tunnel.parent</link></entry></row>
+    </tbody>
+    </tgroup></table>
+
+    <table><title>IPv4 options</title><tgroup cols="3">
+    <thead>
+      <row><entry>Alias</entry><entry>Property</entry><entry>Note</entry></row>
+    </thead>
+    <tbody>
+      <row>
+        <entry align="left">ip4</entry>
+        <entry align="left"><link linkend="nm-settings.property.ipv4.addresses">ipv4.addresses</link></entry>
+        <entry align="left" valign="top">This option can be specified multiple times.
+It's equivalent of using <literal>+ipv4.addresses</literal> syntax.</entry>
+      </row>
+      <row><entry align="left">gw4</entry><entry align="left"><link linkend="nm-settings.property.ipv4.gateway">ipv4.gateway</link></entry><entry align="left" /></row>
+    </tbody>
+    </tgroup></table>
+
+    <table><title>IPv6 options</title><tgroup cols="3">
+    <thead>
+      <row><entry>Alias</entry><entry>Property</entry><entry>Note</entry></row>
+    </thead>
+    <tbody>
+      <row>
+        <entry align="left">ip6</entry>
+        <entry align="left"><link linkend="nm-settings.property.ipv6.addresses">ipv6.addresses</link></entry>
+        <entry align="left" valign="top">This option can be specified multiple times.
+It's equivalent of using <literal>+ipv6.addresses</literal> syntax.</entry>
+      </row>
+      <row><entry align="left">gw6</entry><entry align="left"><link linkend="nm-settings.property.ipv6.gateway">ipv6.gateway</link></entry><entry align="left" /></row>
+    </tbody>
+    </tgroup></table>
+
+  </refsect1>
+
   <refsect1 id='environment_variables'><title>Environment Variables</title>
 
     <para><command>nmcli</command>'s behavior is affected by the following
@@ -2798,14 +2106,21 @@
           <para>Connection, device, or access point does not exist.</para>
         </listitem>
       </varlistentry>
+
+      <varlistentry>
+        <term><errorcode>65</errorcode></term>
+        <listitem>
+          <para>When used with <option>--complete-args</option> option, a file name is expected to follow.</para>
+        </listitem>
+      </varlistentry>
     </variablelist>
   </refsect1>
 
-  <refsect1 id='examples'><title>Examples</title>
+  <refsect1 id='examples'><title id='examples.title'>Examples</title>
 
     <para>This section presents various examples of <command>nmcli</command> usage. If you want even
     more, please refer to
-    <citerefentry><refentrytitle>nmcli-examples</refentrytitle><manvolnum>7</manvolnum></citerefentry>
+    <link linkend='nmcli-examples'><citerefentry><refentrytitle>nmcli-examples</refentrytitle><manvolnum>7</manvolnum></citerefentry></link>
     manual page.</para>
 
     <variablelist>
@@ -2968,6 +2283,22 @@
       </varlistentry>
 
       <varlistentry>
+        <term><userinput>nmcli dev modify em1 ipv4.method shared</userinput></term>
+        <listitem>
+          <para>starts IPv4 connection sharing using em1 device. The sharing will be active
+          until the device is disconnected.</para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><userinput>nmcli dev modify em1 ipv6.address 2001:db8::a:bad:c0de</userinput></term>
+        <listitem>
+          <para>temporarily adds an IP address to a device. The address will be removed
+          when the same connection is activated again.</para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
         <term><userinput>nmcli connection add type ethernet autoconnect no ifname eth0</userinput></term>
         <listitem>
           <para>non-interactively adds an Ethernet connection tied to eth0 interface with
@@ -2985,7 +2316,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><userinput>nmcli c a ifname eth0 type ethernet -- ipv4.method disabled ipv6.method link-local</userinput></term>
+        <term><userinput>nmcli c a ifname eth0 type ethernet ipv4.method disabled ipv6.method link-local</userinput></term>
         <listitem>
           <para>non-interactively adds a connection that will use eth0 Ethernet interface
           and only have an IPv6 link-local address configured.</para>
@@ -3074,11 +2405,11 @@
   </refsect1>
 
   <refsect1 id='see_also'><title>See Also</title>
-    <para><citerefentry><refentrytitle>nmcli-examples</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
-    <citerefentry><refentrytitle>nm-online</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
-    <citerefentry><refentrytitle>NetworkManager</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
-    <citerefentry><refentrytitle>NetworkManager.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
-    <citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
+    <para><link linkend='nmcli-examples'><citerefentry><refentrytitle>nmcli-examples</refentrytitle><manvolnum>7</manvolnum></citerefentry></link>,
+    <link linkend='nm-online'><citerefentry><refentrytitle>nm-online</refentrytitle><manvolnum>1</manvolnum></citerefentry></link>,
+    <link linkend='NetworkManager'><citerefentry><refentrytitle>NetworkManager</refentrytitle><manvolnum>8</manvolnum></citerefentry></link>,
+    <link linkend='NetworkManager.conf'><citerefentry><refentrytitle>NetworkManager.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry></link>,
+    <link linkend='nm-settings'><citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum></citerefentry></link>,
     <citerefentry><refentrytitle>nm-applet</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
     <citerefentry><refentrytitle>nm-connection-editor</refentrytitle><manvolnum>1</manvolnum></citerefentry>.</para>
   </refsect1>
diff --git a/man/nmtui.1 b/man/nmtui.1
index 984fb79c..6f0d2c74 100644
--- a/man/nmtui.1
+++ b/man/nmtui.1
@@ -2,12 +2,12 @@
 .\"     Title: nmtui
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
-.\"      Date: 08/03/2016
+.\"      Date: 08/24/2016
 .\"    Manual: General Commands Manual
-.\"    Source: NetworkManager 1.2.4
+.\"    Source: NetworkManager 1.4.0
 .\"  Language: English
 .\"
-.TH "NMTUI" "1" "" "NetworkManager 1\&.2\&.4" "General Commands Manual"
+.TH "NMTUI" "1" "" "NetworkManager 1\&.4\&.0" "General Commands Manual"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
diff --git a/man/nmtui.xml b/man/nmtui.xml
index 357472fe..8bf6dd58 100644
--- a/man/nmtui.xml
+++ b/man/nmtui.xml
@@ -120,10 +120,10 @@
   </refsect1>
 
   <refsect1 id='see_also'><title>See Also</title>
-    <para><citerefentry><refentrytitle>nmcli</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
+    <para><link linkend='nmcli'><citerefentry><refentrytitle>nmcli</refentrytitle><manvolnum>1</manvolnum></citerefentry></link>,
     <citerefentry><refentrytitle>nm-applet</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
     <citerefentry><refentrytitle>nm-connection-editor</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
-    <citerefentry><refentrytitle>NetworkManager</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
+    <link linkend='NetworkManager'><citerefentry><refentrytitle>NetworkManager</refentrytitle><manvolnum>8</manvolnum></citerefentry></link>.</para>
   </refsect1>
 
 </refentry>