Merge branch 'upstream/latest' of https://salsa.debian.org/utopia-team/network-manager into upstream/latestt pu

22 files changed, 515 insertions, 158 deletions

diff --git a/man/NetworkManager.8 b/man/NetworkManager.8
index ab13ba67..e1487c38 100644
--- a/man/NetworkManager.8
+++ b/man/NetworkManager.8
@@ -2,12 +2,12 @@
 .\"     Title: NetworkManager
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
-.\"      Date: 03/12/2020
+.\"      Date: 05/08/2020
 .\"    Manual: Network management daemons
-.\"    Source: NetworkManager 1.22.10
+.\"    Source: NetworkManager 1.24.0
 .\"  Language: English
 .\"
-.TH "NETWORKMANAGER" "8" "" "NetworkManager 1\&.22\&.10" "Network management daemons"
+.TH "NETWORKMANAGER" "8" "" "NetworkManager 1\&.24\&.0" "Network management daemons"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -43,9 +43,11 @@ directory or subdirectories in alphabetical order in response to network events\
 .PP
 Each script receives two arguments, the first being the interface name of the device an operation just happened on, and second the action\&. For device actions, the interface is the name of the kernel interface suitable for IP configuration\&. Thus it is either VPN_IP_IFACE, DEVICE_IP_IFACE, or DEVICE_IFACE, as applicable\&. For the
 \fIhostname\fR
-and
+action the device name is always
+"none"
+and for
 \fIconnectivity\-change\fR
-actions it is always "none"\&.
+it is empty\&.
 .PP
 The actions are:
 .PP
diff --git a/man/NetworkManager.conf.5 b/man/NetworkManager.conf.5
index 9e253850..2d9621fd 100644
--- a/man/NetworkManager.conf.5
+++ b/man/NetworkManager.conf.5
@@ -2,12 +2,12 @@
 .\"     Title: NetworkManager.conf
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
-.\"      Date: 03/12/2020
+.\"      Date: 05/08/2020
 .\"    Manual: Configuration
-.\"    Source: NetworkManager 1.22.10
+.\"    Source: NetworkManager 1.24.0
 .\"  Language: English
 .\"
-.TH "NETWORKMANAGER\&.CONF" "5" "" "NetworkManager 1\&.22\&.10" "Configuration"
+.TH "NETWORKMANAGER\&.CONF" "5" "" "NetworkManager 1\&.24\&.0" "Configuration"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -120,7 +120,9 @@ plugin is always appended to the end of this list (if it doesn\*(Aqt already app
 .PP
 \fImonitor\-connection\-files\fR
 .RS 4
-This setting is deprecated and has no effect\&.
+This setting is deprecated and has no effect\&. Profiles from disk are never automatically reloaded\&. Use for example
+nmcli connection (re)load
+for that\&.
 .RE
 .PP
 \fIauth\-polkit\fR
diff --git a/man/NetworkManager.conf.xml b/man/NetworkManager.conf.xml
index 782f1ab5..6aa0398e 100644
--- a/man/NetworkManager.conf.xml
+++ b/man/NetworkManager.conf.xml
@@ -153,7 +153,9 @@ plugins-=remove-me
       </varlistentry>
       <varlistentry>
         <term><varname>monitor-connection-files</varname></term>
-        <listitem><para>This setting is deprecated and has no effect.</para></listitem>
+        <listitem><para>This setting is deprecated and has no effect. Profiles
+        from disk are never automatically reloaded. Use for example <literal>nmcli connection (re)load</literal>
+        for that.</para></listitem>
       </varlistentry>
       <varlistentry>
         <term><varname>auth-polkit</varname></term>
diff --git a/man/NetworkManager.xml b/man/NetworkManager.xml
index 2a13671b..a04fec8e 100644
--- a/man/NetworkManager.xml
+++ b/man/NetworkManager.xml
@@ -80,8 +80,8 @@
       device an operation just happened on, and second the action. For device actions,
       the interface is the name of the kernel interface suitable for IP configuration.
       Thus it is either VPN_IP_IFACE, DEVICE_IP_IFACE, or DEVICE_IFACE, as applicable.
-      For the <varname>hostname</varname> and <varname>connectivity-change</varname>
-      actions it is always "none".
+      For the <varname>hostname</varname> action the device name is always <literal>"none"</literal>
+      and for <varname>connectivity-change</varname> it is empty.
     </para>
     <para>The actions are:</para>
     <variablelist class="dispatcher-options">
diff --git a/man/meson.build b/man/meson.build
index f9130535..407d027e 100644
--- a/man/meson.build
+++ b/man/meson.build
@@ -1,3 +1,5 @@
+# SPDX-License-Identifier: LGPL-2.1+
+
 common_ent_file = configure_file(
   input: 'common.ent.in',
   output: '@BASENAME@',
diff --git a/man/nm-initrd-generator.8 b/man/nm-initrd-generator.8
index aae5b1de..17fb9cac 100644
--- a/man/nm-initrd-generator.8
+++ b/man/nm-initrd-generator.8
@@ -2,12 +2,12 @@
 .\"     Title: nm-initrd-generator
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
-.\"      Date: 03/12/2020
+.\"      Date: 05/08/2020
 .\"    Manual: System Administration
-.\"    Source: NetworkManager 1.22.10
+.\"    Source: NetworkManager 1.24.0
 .\"  Language: English
 .\"
-.TH "NM\-INITRD\-GENERATOR" "8" "" "NetworkManager 1\&.22\&.10" "System Administration"
+.TH "NM\-INITRD\-GENERATOR" "8" "" "NetworkManager 1\&.24\&.0" "System Administration"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
diff --git a/man/nm-online.1 b/man/nm-online.1
index a111451b..3f36cdc8 100644
--- a/man/nm-online.1
+++ b/man/nm-online.1
@@ -2,12 +2,12 @@
 .\"     Title: nm-online
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
-.\"      Date: 03/12/2020
+.\"      Date: 05/08/2020
 .\"    Manual: General Commands Manual
-.\"    Source: NetworkManager 1.22.10
+.\"    Source: NetworkManager 1.24.0
 .\"  Language: English
 .\"
-.TH "NM\-ONLINE" "1" "" "NetworkManager 1\&.22\&.10" "General Commands Manual"
+.TH "NM\-ONLINE" "1" "" "NetworkManager 1\&.24\&.0" "General Commands Manual"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -39,15 +39,29 @@ is a utility to find out whether we are online\&. It is done by asking NetworkMa
 \fBnm\-online\fR
 waits until NetworkManager reports an active connection, or specified timeout expires\&. On exit, the returned status code should be checked (see the return codes below)\&.
 .PP
-By default NetworkManager waits for IPv4 dynamic addressing to complete but does not wait for the
-auto
-IPv6 dynamic addressing\&. To wait for IPv6 addressing to complete, either (1) change the network connection\*(Aqs IPv6
+This tool is not very useful to call directly\&. It is however used by
+NetworkManager\-wait\-online\&.service
+with
+\-\-wait\-for\-startup
+argument\&. This is used to delay the service and indirectly
+network\-online\&.target, until networking is up\&. Don\*(Aqt order your own systemd services after
+NetworkManager\-wait\-online\&.service
+directly\&. Instead if necessary, order your services after
+network\-online\&.target\&. Even better is to have your services react to network changes dynamically and don\*(Aqt order them with respect to
+network\-online\&.target
+at all\&.
+.PP
+By default, connections have the
+ipv4\&.may\-fail
+and
+ipv6\&.may\-fail
+properties set to
+yes; this means that NetworkManager waits for one of the two address families to complete configuration before considering the connection activated\&. If you need a specific address family configured before
+network\-online\&.target
+is reached, set the corresponding
 may\-fail
-setting to
-no, and/or (2) change the IPv6 addressing method to
-manual
-or
-dhcp, to indicate that IPv6 connectivity is expected\&.
+property to
+no\&.
 .SH "OPTIONS"
 .PP
 \fB\-h\fR | \fB\-\-help\fR
@@ -62,14 +76,31 @@ Don\*(Aqt print anything\&.
 .PP
 \fB\-s\fR | \fB\-\-wait\-for\-startup\fR
 .RS 4
-Wait for NetworkManager startup to complete, rather than waiting for network connectivity specifically\&. Startup is considered complete once NetworkManager has activated (or attempted to activate) every auto\-activate connection which is available given the current network state\&. (This is generally only useful at boot time; after startup has completed,
+Wait for NetworkManager startup to complete, rather than waiting for network connectivity specifically\&. Startup is considered complete once NetworkManager has activated (or attempted to activate) every auto\-activate connection which is available given the current network state\&. This corresponds to the moment when NetworkManager logs
+"startup complete"\&. This mode is generally only useful at boot time\&. After startup has completed,
 \fBnm\-online \-s\fR
-will just return immediately, regardless of the current network state\&.)
+will just return immediately, regardless of the current network state\&.
+.sp
+There are various ways to affect when startup complete is reached\&. For example, by setting a connection profile to autoconnect, such a profile possibly will activate during startup and thus delay startup complete being reached\&. Also, a profile is considered ready when it fully reached the logical
+connected
+state in NetworkManager\&. That means, properties like
+ipv4\&.may\-fail
+and
+ipv6\&.may\-fail
+affect whether a certain address family is required\&. Also, the connection property
+connection\&.wait\-device\-timeout
+affects whether to wait for the driver to detect a certain device\&. Generally, a failure of
+NetworkManager\-wait\-online\&.service
+indicates a configuration error, where NetworkManager won\*(Aqt be able to reach the desired connectivity state during startup\&. An example for that are bridge or bond master profiles, that get autoconnected but without activating any slaves\&. Such master devices hang in activating state indefinitely, and cause
+NetworkManager\-wait\-online\&.service
+to fail\&.
 .RE
 .PP
 \fB\-t\fR | \fB\-\-timeout\fR \fIseconds\fR
 .RS 4
-Time to wait for a connection, in seconds\&. If the option is not provided, the default timeout is 30 seconds\&.
+Time to wait for a connection, in seconds\&. If the option is not provided, the environment variable
+NM_ONLINE_TIMEOUT
+is honored\&. The default timeout is 30 seconds\&.
 .RE
 .PP
 \fB\-x\fR | \fB\-\-exit\fR
diff --git a/man/nm-online.xml b/man/nm-online.xml
index d40aef98..a0db6b3d 100644
--- a/man/nm-online.xml
+++ b/man/nm-online.xml
@@ -57,12 +57,25 @@
     connection, or specified timeout expires. On exit, the returned status code
     should be checked (see the return codes below).</para>
 
-    <para>By default NetworkManager waits for IPv4 dynamic addressing to complete
-    but does not wait for the <literal>auto</literal> IPv6 dynamic addressing. To
-    wait for IPv6 addressing to complete, either (1) change the network
-    connection's IPv6 <literal>may-fail</literal> setting to <literal>no</literal>,
-    and/or (2) change the IPv6 addressing method to <literal>manual</literal> or
-    <literal>dhcp</literal>, to indicate that IPv6 connectivity is expected.</para>
+    <para>This tool is not very useful to call directly. It is however used by
+    <literal>NetworkManager-wait-online.service</literal> with
+    <literal>--wait-for-startup</literal> argument. This is used to delay
+    the service and indirectly <literal>network-online.target</literal>,
+    until networking is up. Don't order your own systemd services after
+    <literal>NetworkManager-wait-online.service</literal> directly. Instead
+    if necessary, order your services after <literal>network-online.target</literal>.
+    Even better is to have your services react to network changes dynamically
+    and don't order them with respect to <literal>network-online.target</literal>
+    at all.
+    </para>
+
+    <para>By default, connections have the <literal>ipv4.may-fail</literal> and
+    <literal>ipv6.may-fail</literal> properties set to <literal>yes</literal>;
+    this means that NetworkManager waits for one of the two address families to
+    complete configuration before considering the connection activated. If you
+    need a specific address family configured before
+    <literal>network-online.target</literal> is reached, set the corresponding
+    <literal>may-fail</literal> property to <literal>no</literal>.</para>
   </refsect1>
 
   <refsect1 id='options'><title>Options</title>
@@ -99,10 +112,25 @@
           <para>Wait for NetworkManager startup to complete, rather than waiting for
           network connectivity specifically. Startup is considered complete once
           NetworkManager has activated (or attempted to activate) every auto-activate
-          connection which is available given the current network state. (This is
-          generally only useful at boot time; after startup has completed,
+          connection which is available given the current network state. This corresponds
+          to the moment when NetworkManager logs <literal>"startup complete"</literal>.
+          This mode is generally only useful at boot time. After startup has completed,
           <command>nm-online -s</command> will just return immediately, regardless of the
-          current network state.)</para>
+          current network state.</para>
+          <para>There are various ways to affect when startup complete is reached.
+          For example, by setting a connection profile to autoconnect, such a profile
+          possibly will activate during startup and thus delay startup complete being reached.
+          Also, a profile is considered ready when it fully reached the logical <literal>connected</literal>
+          state in NetworkManager. That means, properties like <literal>ipv4.may-fail</literal> and <literal>ipv6.may-fail</literal>
+          affect whether a certain address family is required. Also, the connection property
+          <literal>connection.wait-device-timeout</literal> affects whether to wait for
+          the driver to detect a certain device. Generally, a failure of <literal>NetworkManager-wait-online.service</literal>
+          indicates a configuration error, where NetworkManager won't be able to reach the
+          desired connectivity state during startup. An example for that are bridge or bond master
+          profiles, that get autoconnected but without activating any slaves. Such master devices
+          hang in activating state indefinitely, and cause <literal>NetworkManager-wait-online.service</literal>
+          to fail.
+          </para>
         </listitem>
       </varlistentry>
 
@@ -117,7 +145,8 @@
 
         <listitem>
           <para>Time to wait for a connection, in seconds. If the option is not provided,
-          the default timeout is 30 seconds.</para>
+          the environment variable <literal>NM_ONLINE_TIMEOUT</literal> is honored.
+          The default timeout is 30 seconds.</para>
         </listitem>
       </varlistentry>
 
diff --git a/man/nm-openvswitch.7 b/man/nm-openvswitch.7
index bb256dee..e0c317f6 100644
--- a/man/nm-openvswitch.7
+++ b/man/nm-openvswitch.7
@@ -2,12 +2,12 @@
 .\"     Title: nm-openvswitch
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
-.\"      Date: 03/12/2020
+.\"      Date: 05/08/2020
 .\"    Manual: Open vSwitch support overview
-.\"    Source: NetworkManager 1.22.10
+.\"    Source: NetworkManager 1.24.0
 .\"  Language: English
 .\"
-.TH "NM\-OPENVSWITCH" "7" "" "NetworkManager 1\&.22\&.10" "Open vSwitch support overview"
+.TH "NM\-OPENVSWITCH" "7" "" "NetworkManager 1\&.24\&.0" "Open vSwitch support overview"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
diff --git a/man/nm-settings-ifcfg-rh.5 b/man/nm-settings-ifcfg-rh.5
index 9bfcb266..8cb5a0a9 100644
--- a/man/nm-settings-ifcfg-rh.5
+++ b/man/nm-settings-ifcfg-rh.5
@@ -2,12 +2,12 @@
 .\"     Title: nm-settings-ifcfg-rh
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
-.\"      Date: 03/12/2020
+.\"      Date: 05/08/2020
 .\"    Manual: Configuration
-.\"    Source: NetworkManager 1.22.10
+.\"    Source: NetworkManager 1.24.0
 .\"  Language: English
 .\"
-.TH "NM\-SETTINGS\-IFCFG\-RH" "5" "" "NetworkManager 1\&.22\&.10" "Configuration"
+.TH "NM\-SETTINGS\-IFCFG\-RH" "5" "" "NetworkManager 1\&.24\&.0" "Configuration"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -72,10 +72,7 @@ character can be used for comments, strings with spaces must be quoted, special
 .PP
 Users can create or modify the
 \fIifcfg\-rh\fR
-connection files manually, even if that is not the recommended way of managing the profiles\&. However, if they choose to do that, they must inform NetworkManager about their changes (see
-\fImonitor\-connection\-file\fR
-in
-\fBnm-settings\fR(5), and
+connection files manually, even if that is not the recommended way of managing the profiles\&. However, if they choose to do that, they must inform NetworkManager about their changes (for example via
 \fInmcli con (re)load\fR)\&.
 .PP
 \fBSome ifcfg-rh configuration examples:\fR. 
@@ -285,7 +282,7 @@ PEERDNS
 .IP \(bu 2.3
 .\}
 ONBOOT
-\- initscripts use ONBOOT=yes to mark the devices that are to be activated during boot\&. NetworkManager extents this to also mean that this profile can be used for auto\-connecting at any time\&.
+\- initscripts use ONBOOT=yes to mark the devices that are to be activated during boot\&. NetworkManager extends this to also mean that this profile can be used for auto\-connecting at any time\&.
 .RE
 .sp
 .RS 4
@@ -406,6 +403,8 @@ l l l l
 l l l l
 l l l l
 l l l l
+l l l l
+l l l l
 l l l l.
 T{
 eap
@@ -503,6 +502,15 @@ T}:T{
 Suffix to match domain of server certificate against\&.
 T}
 T{
+domain\-match
+T}:T{
+IEEE_8021X_DOMAIN_MATCH\fI(+)\fR
+T}:T{
+\ \&
+T}:T{
+Value to match domain of server certificate against\&.
+T}
+T{
 client\-cert
 T}:T{
 IEEE_8021X_CLIENT_CERT\fI(+)\fR
@@ -617,6 +625,15 @@ T}:T{
 Suffix to match domain of server certificate for phase 2 against\&.
 T}
 T{
+phase2\-domain\-match
+T}:T{
+IEEE_8021X_PHASE2_DOMAIN_MATCH\fI(+)\fR
+T}:T{
+\ \&
+T}:T{
+Value to match domain of server certificate for phase 2 against\&.
+T}
+T{
 phase2\-client\-cert
 T}:T{
 IEEE_8021X_INNER_CLIENT_CERT\fI(+)\fR
@@ -897,6 +914,12 @@ l l l l
 l l l l
 l l l l
 l l l l
+l l l l
+l l l l
+l l l l
+l l l l
+l l l l
+l l l l
 l l l l.
 T{
 mac\-address
@@ -1015,6 +1038,74 @@ List of VLANs on the bridge\fB
 
 Example: \fRBRIDGE_VLANS="1 pvid untagged,20,300\-400 untagged"
 T}
+T{
+group\-address
+T}:T{
+BRIDGING_OPTS: group_address=
+T}:T{
+\ \&
+T}:T{
+STP group address\&.\fB
+
+Example: \fRBRIDGING_OPTS="group_address=01:80:C2:00:00:0A"
+T}
+T{
+vlan\-protocol
+T}:T{
+BRIDGING_OPTS: vlan_protocol=
+T}:T{
+\ \&
+T}:T{
+VLAN filtering protocol\&.\fB
+
+Example: \fRBRIDGING_OPTS="vlan_protocol=802\&.1Q"
+T}
+T{
+vlan\-stats\-enabled
+T}:T{
+BRIDGING_OPTS: vlan_stats_enabled=
+T}:T{
+0
+T}:T{
+\fB
+
+Example: \fRBRIDGING_OPTS="vlan_stats_enabled=1"
+T}
+T{
+multicast\-router
+T}:T{
+BRIDGING_OPTS: multicast_router=
+T}:T{
+auto
+T}:T{
+\fB
+
+Example: \fRBRIDGING_OPTS="multicast_router=enabled"\fB
+
+Allowed values: \fRauto, enabled, disabled
+T}
+T{
+multicast\-query\-use\-ifaddr
+T}:T{
+BRIDGING_OPTS: multicast_query_use_ifaddr=
+T}:T{
+0
+T}:T{
+\fB
+
+Example: \fRBRIDGING_OPTS="multicast_query\-use_ifaddr=1"
+T}
+T{
+multicast\-querier
+T}:T{
+BRIDGING_OPTS: multicast_querier=
+T}:T{
+0
+T}:T{
+\fB
+
+Example: \fRBRIDGING_OPTS="multicast_querier=1"
+T}
 .TE
 .sp 1
 .sp
@@ -1162,7 +1253,7 @@ T}:T{
 T}:T{
 whether the profile can be active on multiple devices at a given moment\&. The values are numbers corresponding to #NMConnectionMultiConnect enum\&.\fB
 
-Example: \fRZONE=3
+Example: \fRMULTI_CONNECT=3
 T}
 T{
 zone
@@ -2580,7 +2671,29 @@ T}
 .nr an-no-space-flag 1
 .nr an-break-flag 1
 .br
-.B Table\ \&25.\ \&wifi\-p2p setting
+.B Table\ \&25.\ \&vrf setting
+.TS
+allbox tab(:);
+lB lB lB lB.
+T{
+Property
+T}:T{
+Ifcfg\-rh Variable
+T}:T{
+Default
+T}:T{
+Description
+T}
+.T&
+.
+.TE
+.sp 1
+.sp
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
+.br
+.B Table\ \&26.\ \&wifi\-p2p setting
 .TS
 allbox tab(:);
 lB lB lB lB.
@@ -2602,7 +2715,7 @@ T}
 .nr an-no-space-flag 1
 .nr an-break-flag 1
 .br
-.B Table\ \&26.\ \&802\-3\-ethernet setting
+.B Table\ \&27.\ \&802\-3\-ethernet setting
 .TS
 allbox tab(:);
 lB lB lB lB.
@@ -2751,7 +2864,7 @@ T}
 .nr an-no-space-flag 1
 .nr an-break-flag 1
 .br
-.B Table\ \&27.\ \&wireguard setting
+.B Table\ \&28.\ \&wireguard setting
 .TS
 allbox tab(:);
 lB lB lB lB.
@@ -2773,7 +2886,7 @@ T}
 .nr an-no-space-flag 1
 .nr an-break-flag 1
 .br
-.B Table\ \&28.\ \&802\-11\-wireless\-security setting
+.B Table\ \&29.\ \&802\-11\-wireless\-security setting
 .TS
 allbox tab(:);
 lB lB lB lB.
@@ -3020,7 +3133,7 @@ T}
 .nr an-no-space-flag 1
 .nr an-break-flag 1
 .br
-.B Table\ \&29.\ \&802\-11\-wireless setting
+.B Table\ \&30.\ \&802\-11\-wireless setting
 .TS
 allbox tab(:);
 lB lB lB lB.
@@ -3231,7 +3344,7 @@ T}
 .nr an-no-space-flag 1
 .nr an-break-flag 1
 .br
-.B Table\ \&30.\ \&wpan setting
+.B Table\ \&31.\ \&wpan setting
 .TS
 allbox tab(:);
 lB lB lB lB.
diff --git a/man/nm-settings-ifcfg-rh.xml b/man/nm-settings-ifcfg-rh.xml
index cdfe7e01..d43958d1 100644
--- a/man/nm-settings-ifcfg-rh.xml
+++ b/man/nm-settings-ifcfg-rh.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0"?>
 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.3//EN" "http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd">
-<refentry id="nm-settings-ifcfg-rh"><refentryinfo><title>nm-settings-ifcfg-rh</title><author>NetworkManager developers</author></refentryinfo><refmeta><refentrytitle>nm-settings-ifcfg-rh</refentrytitle><manvolnum>5</manvolnum><refmiscinfo class="source">NetworkManager</refmiscinfo><refmiscinfo class="manual">Configuration</refmiscinfo><refmiscinfo class="version">1.22.10</refmiscinfo></refmeta><refnamediv><refname>nm-settings-ifcfg-rh</refname><refpurpose>Description of <emphasis>ifcfg-rh</emphasis> settings plugin</refpurpose></refnamediv><refsect1 id="description"><title>Description</title><para>
+<refentry id="nm-settings-ifcfg-rh"><refentryinfo><title>nm-settings-ifcfg-rh</title><author>NetworkManager developers</author></refentryinfo><refmeta><refentrytitle>nm-settings-ifcfg-rh</refentrytitle><manvolnum>5</manvolnum><refmiscinfo class="source">NetworkManager</refmiscinfo><refmiscinfo class="manual">Configuration</refmiscinfo><refmiscinfo class="version">1.24.0</refmiscinfo></refmeta><refnamediv><refname>nm-settings-ifcfg-rh</refname><refpurpose>Description of <emphasis>ifcfg-rh</emphasis> settings plugin</refpurpose></refnamediv><refsect1 id="description"><title>Description</title><para>
           NetworkManager is based on the concept of connection profiles that contain
           network configuration (see <citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum></citerefentry> for details). The profiles can be
           stored in various formats. NetworkManager uses plugins for reading and writing
@@ -31,8 +31,7 @@
           Users can create or modify the <emphasis>ifcfg-rh</emphasis> connection files
           manually, even if that is not the recommended way of managing the profiles.
           However, if they choose to do that, they must inform NetworkManager about
-          their changes (see <emphasis>monitor-connection-file</emphasis> in
-          <citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum></citerefentry>, and <emphasis>nmcli con (re)load</emphasis>).
+          their changes (for example via <emphasis>nmcli con (re)load</emphasis>).
         </para><formalpara><title>Some <emphasis>ifcfg-rh</emphasis> configuration examples:</title><para><programlisting><emphasis role="bold">Simple DHCP ethernet configuration:</emphasis>
 NAME=ethernet
 UUID=1c4ddf70-01bf-46d6-b04f-47e842bd98da
@@ -153,7 +152,7 @@ DEVICETYPE=TeamPort
                     NetworkManager interprets it to say "never add automatic (DHCP, PPP, VPN, etc.)
                     nameservers to resolv.conf".</para></listitem><listitem><para><literal>ONBOOT</literal> -
                     initscripts use ONBOOT=yes to mark the devices that are to be activated
-                    during boot. NetworkManager extents this to also mean that this profile
+                    during boot. NetworkManager extends this to also mean that this profile
                     can be used for auto-connecting at any time.</para></listitem><listitem><para><literal>BOOTPROTO</literal> -
                     NetworkManager supports traditional values <emphasis>none</emphasis> (static),
                     <emphasis>dhcp</emphasis>. But it also allows additional values to
@@ -183,7 +182,7 @@ Example: </emphasis>IEEE_8021X_CA_CERT=/home/joe/cacert.crt</entry></row><row><e
 
 Example: </emphasis>IEEE_8021X_SUBJECT_MATCH="Red Hat"</entry></row><row><entry align="left">altsubject-matches</entry><entry align="left">IEEE_8021X_ALTSUBJECT_MATCHES<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">List of strings to be matched against the altSubjectName.<emphasis role="bold">
 
-Example: </emphasis>IEEE_8021X_ALTSUBJECT_MATCHES="s1.domain.cc"</entry></row><row><entry align="left">domain-suffix-match</entry><entry align="left">IEEE_8021X_DOMAIN_SUFFIX_MATCH<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Suffix to match domain of server certificate against.</entry></row><row><entry align="left">client-cert</entry><entry align="left">IEEE_8021X_CLIENT_CERT<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Client certificate for EAP.<emphasis role="bold">
+Example: </emphasis>IEEE_8021X_ALTSUBJECT_MATCHES="s1.domain.cc"</entry></row><row><entry align="left">domain-suffix-match</entry><entry align="left">IEEE_8021X_DOMAIN_SUFFIX_MATCH<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Suffix to match domain of server certificate against.</entry></row><row><entry align="left">domain-match</entry><entry align="left">IEEE_8021X_DOMAIN_MATCH<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Value to match domain of server certificate against.</entry></row><row><entry align="left">client-cert</entry><entry align="left">IEEE_8021X_CLIENT_CERT<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Client certificate for EAP.<emphasis role="bold">
 
 Example: </emphasis>IEEE_8021X_CLIENT_CERT=/home/joe/mycert.crt</entry></row><row><entry align="left">phase1-peapver</entry><entry align="left">IEEE_8021X_PEAP_VERSION<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Use to force a specific PEAP version.<emphasis role="bold">
 
@@ -207,7 +206,7 @@ Example: </emphasis>IEEE_8021X_INNER_AUTH_METHODS="MSCHAPV2 EAP-TLS"<emphasis ro
 
 Allowed values: </emphasis>"EAP-MD5", "EAP-MSCHAPV2", "EAP-GTC", "EAP-OTP" and "EAP-TLS"</entry></row><row><entry align="left">phase2-subject-match</entry><entry align="left">IEEE_8021X_PHASE2_SUBJECT_MATCH<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Substring to match subject of server certificate against.<emphasis role="bold">
 
-Example: </emphasis>IEEE_8021X_PHASE2_SUBJECT_MATCH="Red Hat"</entry></row><row><entry align="left">phase2-altsubject-matches</entry><entry align="left">IEEE_8021X_PHASE2_ALTSUBJECT_MATCHES<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left"/></row><row><entry align="left">phase2-domain-suffix-match</entry><entry align="left">IEEE_8021X_PHASE2_DOMAIN_SUFFIX_MATCH<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Suffix to match domain of server certificate for phase 2 against.</entry></row><row><entry align="left">phase2-client-cert</entry><entry align="left">IEEE_8021X_INNER_CLIENT_CERT<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Client certificate for inner EAP method.<emphasis role="bold">
+Example: </emphasis>IEEE_8021X_PHASE2_SUBJECT_MATCH="Red Hat"</entry></row><row><entry align="left">phase2-altsubject-matches</entry><entry align="left">IEEE_8021X_PHASE2_ALTSUBJECT_MATCHES<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left"/></row><row><entry align="left">phase2-domain-suffix-match</entry><entry align="left">IEEE_8021X_PHASE2_DOMAIN_SUFFIX_MATCH<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Suffix to match domain of server certificate for phase 2 against.</entry></row><row><entry align="left">phase2-domain-match</entry><entry align="left">IEEE_8021X_PHASE2_DOMAIN_MATCH<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Value to match domain of server certificate for phase 2 against.</entry></row><row><entry align="left">phase2-client-cert</entry><entry align="left">IEEE_8021X_INNER_CLIENT_CERT<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Client certificate for inner EAP method.<emphasis role="bold">
 
 Example: </emphasis>IEEE_8021X_INNER_CLIENT_CERT=/home/joe/mycert.crt</entry></row><row><entry align="left">password</entry><entry align="left">IEEE_8021X_PASSWORD<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">UTF-8 encoded password used for EAP. It can also go to "key-" lookaside file, or it can be owned by a secret agent.</entry></row><row><entry align="left">password-flags</entry><entry align="left">IEEE_8021X_PASSWORD_FLAGS<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Password flags for IEEE_8021X_PASSWORD password. (see <xref linkend="secrets-flags"/> for _FLAGS values)</entry></row><row><entry align="left">password-raw</entry><entry align="left">IEEE_8021X_PASSWORD_RAW<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">password used for EAP, encoded as a hexadecimal string. It can also go to "key-" lookaside file.<emphasis role="bold">
 
@@ -239,7 +238,21 @@ Allowed values: </emphasis>0 or 1</entry></row><row><entry align="left">vlan-def
 
 Allowed values: </emphasis>0 - 4094</entry></row><row><entry align="left">vlans</entry><entry align="left">BRIDGE_VLANS</entry><entry align="left"/><entry align="left">List of VLANs on the bridge<emphasis role="bold">
 
-Example: </emphasis>BRIDGE_VLANS="1 pvid untagged,20,300-400 untagged"</entry></row></tbody></tgroup></table><table><title>connection setting</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Ifcfg-rh Variable</entry><entry>Default</entry><entry>Description</entry></row></thead><tbody><row><entry align="left">id</entry><entry align="left">NAME<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">User friendly name for the connection profile.</entry></row><row><entry align="left">uuid</entry><entry align="left">UUID<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">UUID for the connection profile. When missing, NetworkManager creates the UUID itself (by hashing the filename).</entry></row><row><entry align="left">stable-id</entry><entry align="left">STABLE_ID<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Token to generate stable IDs.</entry></row><row><entry align="left">interface-name</entry><entry align="left">DEVICE</entry><entry align="left"/><entry align="left">Interface name of the device this profile is bound to. The variable can be left out when the profile should apply for more devices. Note that DEVICE can be required for some connection types.</entry></row><row><entry align="left">type</entry><entry align="left">TYPE (DEVICETYPE, DEVICE)</entry><entry align="left"/><entry align="left">Base type of the connection. DEVICETYPE is used for teaming connections.<emphasis role="bold">
+Example: </emphasis>BRIDGE_VLANS="1 pvid untagged,20,300-400 untagged"</entry></row><row><entry align="left">group-address</entry><entry align="left">BRIDGING_OPTS: group_address=</entry><entry align="left"/><entry align="left">STP group address.<emphasis role="bold">
+
+Example: </emphasis>BRIDGING_OPTS="group_address=01:80:C2:00:00:0A"</entry></row><row><entry align="left">vlan-protocol</entry><entry align="left">BRIDGING_OPTS: vlan_protocol=</entry><entry align="left"/><entry align="left">VLAN filtering protocol.<emphasis role="bold">
+
+Example: </emphasis>BRIDGING_OPTS="vlan_protocol=802.1Q"</entry></row><row><entry align="left">vlan-stats-enabled</entry><entry align="left">BRIDGING_OPTS: vlan_stats_enabled=</entry><entry align="left">0</entry><entry align="left"><emphasis role="bold">
+
+Example: </emphasis>BRIDGING_OPTS="vlan_stats_enabled=1"</entry></row><row><entry align="left">multicast-router</entry><entry align="left">BRIDGING_OPTS: multicast_router=</entry><entry align="left">auto</entry><entry align="left"><emphasis role="bold">
+
+Example: </emphasis>BRIDGING_OPTS="multicast_router=enabled"<emphasis role="bold">
+
+Allowed values: </emphasis>auto, enabled, disabled</entry></row><row><entry align="left">multicast-query-use-ifaddr</entry><entry align="left">BRIDGING_OPTS: multicast_query_use_ifaddr=</entry><entry align="left">0</entry><entry align="left"><emphasis role="bold">
+
+Example: </emphasis>BRIDGING_OPTS="multicast_query-use_ifaddr=1"</entry></row><row><entry align="left">multicast-querier</entry><entry align="left">BRIDGING_OPTS: multicast_querier=</entry><entry align="left">0</entry><entry align="left"><emphasis role="bold">
+
+Example: </emphasis>BRIDGING_OPTS="multicast_querier=1"</entry></row></tbody></tgroup></table><table><title>connection setting</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Ifcfg-rh Variable</entry><entry>Default</entry><entry>Description</entry></row></thead><tbody><row><entry align="left">id</entry><entry align="left">NAME<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">User friendly name for the connection profile.</entry></row><row><entry align="left">uuid</entry><entry align="left">UUID<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">UUID for the connection profile. When missing, NetworkManager creates the UUID itself (by hashing the filename).</entry></row><row><entry align="left">stable-id</entry><entry align="left">STABLE_ID<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Token to generate stable IDs.</entry></row><row><entry align="left">interface-name</entry><entry align="left">DEVICE</entry><entry align="left"/><entry align="left">Interface name of the device this profile is bound to. The variable can be left out when the profile should apply for more devices. Note that DEVICE can be required for some connection types.</entry></row><row><entry align="left">type</entry><entry align="left">TYPE (DEVICETYPE, DEVICE)</entry><entry align="left"/><entry align="left">Base type of the connection. DEVICETYPE is used for teaming connections.<emphasis role="bold">
 
 Example: </emphasis>TYPE=Ethernet; TYPE=Bond; TYPE=Bridge; DEVICETYPE=TeamPort<emphasis role="bold">
 
@@ -255,7 +268,7 @@ Example: </emphasis>AUTOCONNECT_RETRIES=1<emphasis role="bold">
 
 Allowed values: </emphasis>-1 (use global default), 0 (forever) or a positive value</entry></row><row><entry align="left">multi-connect</entry><entry align="left">MULTI_CONNECT<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">whether the profile can be active on multiple devices at a given moment. The values are numbers corresponding to #NMConnectionMultiConnect enum.<emphasis role="bold">
 
-Example: </emphasis>ZONE=3</entry></row><row><entry align="left">zone</entry><entry align="left">ZONE<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Trust level of this connection. The string is usually used for a firewall.<emphasis role="bold">
+Example: </emphasis>MULTI_CONNECT=3</entry></row><row><entry align="left">zone</entry><entry align="left">ZONE<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">Trust level of this connection. The string is usually used for a firewall.<emphasis role="bold">
 
 Example: </emphasis>ZONE=Work</entry></row><row><entry align="left">master</entry><entry align="left">MASTER, MASTER_UUID, TEAM_MASTER, TEAM_MASTER_UUID, BRIDGE, BRIDGE_UUID</entry><entry align="left"/><entry align="left">Reference to master connection. The variable used depends on the connection type and the value. In general, if the *_UUID variant is present, the variant without *_UUID is ignored. NetworkManager attempts to write both for compatibility with legacy tooling.</entry></row><row><entry align="left">slave-type</entry><entry align="left">MASTER, MASTER_UUID, TEAM_MASTER, TEAM_MASTER_UUID, DEVICETYPE, BRIDGE, BRIDGE_UUID</entry><entry align="left"/><entry align="left">Slave type doesn't map directly to a variable, but it is recognized using different variables.  MASTER and MASTER_UUID for bonding, TEAM_MASTER, TEAM_MASTER_UUID and DEVICETYPE for teaming, BRIDGE and BRIDGE_UUID for bridging.</entry></row><row><entry align="left">autoconnect-slaves</entry><entry align="left">AUTOCONNECT_SLAVES<emphasis>(+)</emphasis></entry><entry align="left">missing variable means global default</entry><entry align="left">Whether slaves of this connection should be auto-connected when this connection is activated.</entry></row><row><entry align="left">secondaries</entry><entry align="left">SECONDARY_UUIDS<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">UUID of VPN connections that should be activated together with this connection.</entry></row><row><entry align="left">gateway-ping-timeout</entry><entry align="left">GATEWAY_PING_TIMEOUT<emphasis>(+)</emphasis></entry><entry align="left">0</entry><entry align="left">If greater than zero, the IP connectivity will be checked by pinging the gateway and waiting for the specified timeout (in seconds).<emphasis role="bold">
 
@@ -382,7 +395,7 @@ Example: </emphasis>VLAN_INGRESS_PRIORITY_MAP=4:2,3:5</entry></row><row><entry a
 
 Example: </emphasis>VLAN_EGRESS_PRIORITY_MAP=5:4,4:1,3:7</entry></row><row><entry align="left">interface-name</entry><entry align="left">PHYSDEV and VLAN_ID, or DEVICE</entry><entry align="left"/><entry align="left">VLAN interface name. If all variables are set, parent device from PHYSDEV takes precedence over DEVICE, but VLAN id from DEVICE takes precedence over VLAN_ID.<emphasis role="bold">
 
-Example: </emphasis>PHYSDEV=eth0, VLAN_ID=12; or DEVICE=eth0.12</entry></row></tbody></tgroup></table><table><title>wifi-p2p setting</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Ifcfg-rh Variable</entry><entry>Default</entry><entry>Description</entry></row></thead><tbody/></tgroup></table><table><title>802-3-ethernet setting</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Ifcfg-rh Variable</entry><entry>Default</entry><entry>Description</entry></row></thead><tbody><row><entry align="left">port</entry><entry align="left">(none)</entry><entry align="left"/><entry align="left">The property is not saved by the plugin.</entry></row><row><entry align="left">speed</entry><entry align="left">ETHTOOL_OPTS</entry><entry align="left"/><entry align="left">Fixed speed for the ethernet link. It is added as "speed" parameter in the ETHTOOL_OPTS variable.</entry></row><row><entry align="left">duplex</entry><entry align="left">ETHTOOL_OPTS</entry><entry align="left"/><entry align="left">Fixed duplex mode for the ethernet link. It is added as "duplex" parameter in the ETHOOL_OPTS variable.</entry></row><row><entry align="left">auto-negotiate</entry><entry align="left">ETHTOOL_OPTS</entry><entry align="left"/><entry align="left">Whether link speed and duplex autonegotiation is enabled. It is not saved only if disabled and no values are provided for the "speed" and "duplex" parameters (skips link configuration).</entry></row><row><entry align="left">mac-address</entry><entry align="left">HWADDR</entry><entry align="left"/><entry align="left">Hardware address of the device in traditional hex-digits-and-colons notation (e.g. 00:22:68:14:5A:05). Note that for initscripts this is the current MAC address of the device as found during ifup. For NetworkManager this is the permanent MAC address. Or in case no permanent MAC address exists, the MAC address initially configured on the device.</entry></row><row><entry align="left">cloned-mac-address</entry><entry align="left">MACADDR</entry><entry align="left"/><entry align="left">Cloned (spoofed) MAC address in traditional hex-digits-and-colons notation (e.g. 00:22:68:14:5A:99).</entry></row><row><entry align="left">generate-mac-address-mask</entry><entry align="left">GENERATE_MAC_ADDRESS_MASK<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">the MAC address mask for generating randomized and stable cloned-mac-address.</entry></row><row><entry align="left">mac-address-blacklist</entry><entry align="left">HWADDR_BLACKLIST<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">It denies usage of the connection for any device whose address is listed.<emphasis role="bold">
+Example: </emphasis>PHYSDEV=eth0, VLAN_ID=12; or DEVICE=eth0.12</entry></row></tbody></tgroup></table><table><title>vrf setting</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Ifcfg-rh Variable</entry><entry>Default</entry><entry>Description</entry></row></thead><tbody/></tgroup></table><table><title>wifi-p2p setting</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Ifcfg-rh Variable</entry><entry>Default</entry><entry>Description</entry></row></thead><tbody/></tgroup></table><table><title>802-3-ethernet setting</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Ifcfg-rh Variable</entry><entry>Default</entry><entry>Description</entry></row></thead><tbody><row><entry align="left">port</entry><entry align="left">(none)</entry><entry align="left"/><entry align="left">The property is not saved by the plugin.</entry></row><row><entry align="left">speed</entry><entry align="left">ETHTOOL_OPTS</entry><entry align="left"/><entry align="left">Fixed speed for the ethernet link. It is added as "speed" parameter in the ETHTOOL_OPTS variable.</entry></row><row><entry align="left">duplex</entry><entry align="left">ETHTOOL_OPTS</entry><entry align="left"/><entry align="left">Fixed duplex mode for the ethernet link. It is added as "duplex" parameter in the ETHOOL_OPTS variable.</entry></row><row><entry align="left">auto-negotiate</entry><entry align="left">ETHTOOL_OPTS</entry><entry align="left"/><entry align="left">Whether link speed and duplex autonegotiation is enabled. It is not saved only if disabled and no values are provided for the "speed" and "duplex" parameters (skips link configuration).</entry></row><row><entry align="left">mac-address</entry><entry align="left">HWADDR</entry><entry align="left"/><entry align="left">Hardware address of the device in traditional hex-digits-and-colons notation (e.g. 00:22:68:14:5A:05). Note that for initscripts this is the current MAC address of the device as found during ifup. For NetworkManager this is the permanent MAC address. Or in case no permanent MAC address exists, the MAC address initially configured on the device.</entry></row><row><entry align="left">cloned-mac-address</entry><entry align="left">MACADDR</entry><entry align="left"/><entry align="left">Cloned (spoofed) MAC address in traditional hex-digits-and-colons notation (e.g. 00:22:68:14:5A:99).</entry></row><row><entry align="left">generate-mac-address-mask</entry><entry align="left">GENERATE_MAC_ADDRESS_MASK<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">the MAC address mask for generating randomized and stable cloned-mac-address.</entry></row><row><entry align="left">mac-address-blacklist</entry><entry align="left">HWADDR_BLACKLIST<emphasis>(+)</emphasis></entry><entry align="left"/><entry align="left">It denies usage of the connection for any device whose address is listed.<emphasis role="bold">
 
 Example: </emphasis>HWADDR_BLACKLIST="00:22:68:11:69:08 00:11:22:11:44:55"</entry></row><row><entry align="left">mtu</entry><entry align="left">MTU</entry><entry align="left"/><entry align="left">MTU of the interface.</entry></row><row><entry align="left">s390-subchannels</entry><entry align="left">SUBCHANNELS</entry><entry align="left"/><entry align="left">Subchannels for IBM S390 hosts.<emphasis role="bold">
 
diff --git a/man/nm-settings-ifcfg-rh.xsl b/man/nm-settings-ifcfg-rh.xsl
index aef30fd1..e14b742f 100644
--- a/man/nm-settings-ifcfg-rh.xsl
+++ b/man/nm-settings-ifcfg-rh.xsl
@@ -72,9 +72,7 @@
           Users can create or modify the <emphasis>ifcfg-rh</emphasis> connection files
           manually, even if that is not the recommended way of managing the profiles.
           However, if they choose to do that, they must inform NetworkManager about
-          their changes (see <emphasis>monitor-connection-file</emphasis> in
-          <citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum>
-          </citerefentry>, and <emphasis>nmcli con (re)load</emphasis>).
+          their changes (for example via <emphasis>nmcli con (re)load</emphasis>).
         </para>
         <formalpara>
           <title>Some <emphasis>ifcfg-rh</emphasis> configuration examples:</title>
@@ -243,7 +241,7 @@ DEVICETYPE=TeamPort
                   <listitem>
                     <para><literal>ONBOOT</literal> -
                     initscripts use ONBOOT=yes to mark the devices that are to be activated
-                    during boot. NetworkManager extents this to also mean that this profile
+                    during boot. NetworkManager extends this to also mean that this profile
                     can be used for auto-connecting at any time.</para>
                   </listitem>
                   <listitem>
diff --git a/man/nm-settings-keyfile.5 b/man/nm-settings-keyfile.5
index befa00a7..40533116 100644
--- a/man/nm-settings-keyfile.5
+++ b/man/nm-settings-keyfile.5
@@ -2,12 +2,12 @@
 .\"     Title: nm-settings-keyfile
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
-.\"      Date: 03/12/2020
+.\"      Date: 05/08/2020
 .\"    Manual: Configuration
-.\"    Source: NetworkManager 1.22.10
+.\"    Source: NetworkManager 1.24.0
 .\"  Language: English
 .\"
-.TH "NM\-SETTINGS\-KEYFILE" "5" "" "NetworkManager 1\&.22\&.10" "Configuration"
+.TH "NM\-SETTINGS\-KEYFILE" "5" "" "NetworkManager 1\&.24\&.0" "Configuration"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -38,8 +38,11 @@ for details)\&. The profiles can be stored in various formats\&. NetworkManager
 .PP
 The
 \fIkeyfile\fR
-plugin is the generic plugin that supports all the connection types and capabilities that NetworkManager has\&. It writes files out in a \&.ini\-style format in
-/etc/NetworkManager/system\-connections/\&. This plugin is always enabled and will automatically be used to store any connections that are not supported by any other active plugin\&. For security, it will ignore files that are readable or writable by any user or group other than \*(Aqroot\*(Aq since private keys and passphrases may be stored in plaintext inside the file\&.
+plugin is the generic plugin that supports all the connection types and capabilities that NetworkManager has\&. The files are in a \&.ini\-style format and located in
+/etc/NetworkManager/system\-connections/,
+/usr/lib/NetworkManager/system\-connections/
+and
+/run/NetworkManager/system\-connections/\&. This plugin is always enabled and will automatically be used to store any connections that are not supported by any other active plugin\&. For security, it will ignore files that are readable or writable by any user other than \*(Aqroot\*(Aq since private keys and passphrases may be stored in plaintext inside the file\&.
 .SH "FILE FORMAT"
 .PP
 The
@@ -54,11 +57,7 @@ etc\&.)\&.
 .PP
 Users can create or modify the
 \fIkeyfile\fR
-connection files manually, even if that is not the recommended way of managing the profiles\&. However, if they choose to do that, they must inform NetworkManager about their changes (see
-\fImonitor\-connection\-file\fR
-in
-\fBnm-settings\fR(5)
-and
+connection files manually, even if that is not the recommended way of managing the profiles\&. However, if they choose to do that, they must inform NetworkManager about their changes (for example via
 \fInmcli con (re)load\fR)\&.
 .PP
 \fBExamples of keyfile configuration\fR. 
diff --git a/man/nm-settings-keyfile.xml b/man/nm-settings-keyfile.xml
index ed84e458..ea9eb7f0 100644
--- a/man/nm-settings-keyfile.xml
+++ b/man/nm-settings-keyfile.xml
@@ -1,18 +1,20 @@
 <?xml version="1.0"?>
 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.3//EN" "http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd">
-<refentry id="nm-settings-keyfile"><refentryinfo><title>nm-settings-keyfile</title><author>NetworkManager developers</author></refentryinfo><refmeta><refentrytitle>nm-settings-keyfile</refentrytitle><manvolnum>5</manvolnum><refmiscinfo class="source">NetworkManager</refmiscinfo><refmiscinfo class="manual">Configuration</refmiscinfo><refmiscinfo class="version">1.22.10</refmiscinfo></refmeta><refnamediv><refname>nm-settings-keyfile</refname><refpurpose>Description of <emphasis>keyfile</emphasis> settings plugin</refpurpose></refnamediv><refsect1 id="description"><title>Description</title><para>
+<refentry id="nm-settings-keyfile"><refentryinfo><title>nm-settings-keyfile</title><author>NetworkManager developers</author></refentryinfo><refmeta><refentrytitle>nm-settings-keyfile</refentrytitle><manvolnum>5</manvolnum><refmiscinfo class="source">NetworkManager</refmiscinfo><refmiscinfo class="manual">Configuration</refmiscinfo><refmiscinfo class="version">1.24.0</refmiscinfo></refmeta><refnamediv><refname>nm-settings-keyfile</refname><refpurpose>Description of <emphasis>keyfile</emphasis> settings plugin</refpurpose></refnamediv><refsect1 id="description"><title>Description</title><para>
           NetworkManager is based on the concept of connection profiles that contain
           network configuration (see <citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum></citerefentry> for details). The profiles can be
           stored in various formats. NetworkManager uses plugins for reading and writing
           the data. The plugins can be configured in <citerefentry><refentrytitle>NetworkManager.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
         </para><para>
           The <emphasis>keyfile</emphasis> plugin is the generic plugin that supports all
-          the connection types and capabilities that NetworkManager has. It writes files
-          out in a .ini-style format in <filename>/etc/NetworkManager/system-connections/</filename>.
+          the connection types and capabilities that NetworkManager has. The files are
+          in a .ini-style format and located in <filename>/etc/NetworkManager/system-connections/</filename>,
+          <filename>/usr/lib/NetworkManager/system-connections/</filename> and
+          <filename>/run/NetworkManager/system-connections/</filename>.
           This plugin is always enabled and will automatically be used to store
           any connections that are not supported by any other active plugin.
           For security, it will ignore files that are readable or writable by any user
-          or group other than 'root' since private keys and passphrases may be stored
+          other than 'root' since private keys and passphrases may be stored
           in plaintext inside the file.
         </para></refsect1><refsect1 id="file_format"><title>File Format</title><para>
           The <emphasis>keyfile</emphasis> config format is a simple .ini-style
@@ -34,8 +36,7 @@
           Users can create or modify the <emphasis>keyfile</emphasis> connection files
           manually, even if that is not the recommended way of managing the profiles.
           However, if they choose to do that, they must inform NetworkManager about
-          their changes (see <emphasis>monitor-connection-file</emphasis> in
-          <citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum></citerefentry> and <emphasis>nmcli con (re)load</emphasis>).
+          their changes (for example via <emphasis>nmcli con (re)load</emphasis>).
         </para><formalpara><title>Examples of <emphasis>keyfile</emphasis> configuration</title><para><programlisting><emphasis role="bold">A sample configuration for an ethernet network:</emphasis>
 [connection]
 id=Main eth0
@@ -219,6 +220,7 @@ Example: </emphasis>remote=ovpn.corp.com cipher=AES-256-CBC username=joe</entry>
 Example: </emphasis>password=Popocatepetl</entry></row>
 </tbody></tgroup></table>
 
+
 <table><title>wifi-p2p setting (section)</title><tgroup cols="4"><thead><row><entry>Property</entry><entry>Keyfile Variable</entry><entry>Format</entry><entry>Description</entry></row></thead><tbody>
 <row><entry align="left">peer</entry><entry align="left">peer</entry><entry align="left">usual hex-digits-and-colons notation</entry><entry align="left">MAC address in traditional hex-digits-and-colons notation (e.g. 00:22:68:12:79:A2), or semicolon separated list of 6 bytes (obsolete) (e.g. 0;34;104;18;121;162).</entry></row>
 </tbody></tgroup></table>
diff --git a/man/nm-settings-keyfile.xsl b/man/nm-settings-keyfile.xsl
index 486a4c53..c22bd4fc 100644
--- a/man/nm-settings-keyfile.xsl
+++ b/man/nm-settings-keyfile.xsl
@@ -40,12 +40,14 @@
         </para>
         <para>
           The <emphasis>keyfile</emphasis> plugin is the generic plugin that supports all
-          the connection types and capabilities that NetworkManager has. It writes files
-          out in a .ini-style format in <filename>/etc/NetworkManager/system-connections/</filename>.
+          the connection types and capabilities that NetworkManager has. The files are
+          in a .ini-style format and located in <filename>/etc/NetworkManager/system-connections/</filename>,
+          <filename>/usr/lib/NetworkManager/system-connections/</filename> and
+          <filename>/run/NetworkManager/system-connections/</filename>.
           This plugin is always enabled and will automatically be used to store
           any connections that are not supported by any other active plugin.
           For security, it will ignore files that are readable or writable by any user
-          or group other than 'root' since private keys and passphrases may be stored
+          other than 'root' since private keys and passphrases may be stored
           in plaintext inside the file.
         </para>
       </refsect1>
@@ -72,9 +74,7 @@
           Users can create or modify the <emphasis>keyfile</emphasis> connection files
           manually, even if that is not the recommended way of managing the profiles.
           However, if they choose to do that, they must inform NetworkManager about
-          their changes (see <emphasis>monitor-connection-file</emphasis> in
-          <citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum>
-          </citerefentry> and <emphasis>nmcli con (re)load</emphasis>).
+          their changes (for example via <emphasis>nmcli con (re)load</emphasis>).
         </para>
         <formalpara>
           <title>Examples of <emphasis>keyfile</emphasis> configuration</title>
diff --git a/man/nm-settings.5 b/man/nm-settings.5
index 202f1183..0278cb20 100644
--- a/man/nm-settings.5
+++ b/man/nm-settings.5
@@ -2,12 +2,12 @@
 .\"     Title: nm-settings
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
-.\"      Date: 03/12/2020
+.\"      Date: 05/08/2020
 .\"    Manual: Configuration
-.\"    Source: NetworkManager 1.22.10
+.\"    Source: NetworkManager 1.24.0
 .\"  Language: English
 .\"
-.TH "NM\-SETTINGS" "5" "" "NetworkManager 1\&.22\&.10" "Configuration"
+.TH "NM\-SETTINGS" "5" "" "NetworkManager 1\&.24\&.0" "Configuration"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -404,6 +404,8 @@ l l l l
 l l l l
 l l l l
 l l l l
+l l l l
+l l l l
 l l l l.
 T{
 altsubject\-matches
@@ -496,13 +498,22 @@ T}:T{
 Flags indicating how to handle the "client\-cert\-password" property\&. (see the section called \(lqSecret flag types:\(rq for flag values)
 T}
 T{
+domain\-match
+T}:T{
+string
+T}:T{
+\ \&
+T}:T{
+Constraint for server domain name\&. If set, this list of FQDNs is used as a match requirement for dNSName element(s) of the certificate presented by the authentication server\&.  If a matching dNSName is found, this constraint is met\&.  If no dNSName values are present, this constraint is matched against SubjectName CN using the same comparison\&. Multiple valid FQDNs can be passed as a ";" delimited list\&.
+T}
+T{
 domain\-suffix\-match
 T}:T{
 string
 T}:T{
 \ \&
 T}:T{
-Constraint for server domain name\&. If set, this FQDN is used as a suffix match requirement for dNSName element(s) of the certificate presented by the authentication server\&.  If a matching dNSName is found, this constraint is met\&.  If no dNSName values are present, this constraint is matched against SubjectName CN using same suffix match comparison\&.
+Constraint for server domain name\&. If set, this FQDN is used as a suffix match requirement for dNSName element(s) of the certificate presented by the authentication server\&.  If a matching dNSName is found, this constraint is met\&.  If no dNSName values are present, this constraint is matched against SubjectName CN using same suffix match comparison\&. Since version 1\&.24, multiple valid FQDNs can be passed as a ";" delimited list\&.
 T}
 T{
 eap
@@ -703,13 +714,22 @@ T}:T{
 Flags indicating how to handle the "phase2\-client\-cert\-password" property\&. (see the section called \(lqSecret flag types:\(rq for flag values)
 T}
 T{
+phase2\-domain\-match
+T}:T{
+string
+T}:T{
+\ \&
+T}:T{
+Constraint for server domain name\&. If set, this list of FQDNs is used as a match requirement for dNSName element(s) of the certificate presented by the authentication server during the inner "phase 2" authentication\&. If a matching dNSName is found, this constraint is met\&.  If no dNSName values are present, this constraint is matched against SubjectName CN using the same comparison\&. Multiple valid FQDNs can be passed as a ";" delimited list\&.
+T}
+T{
 phase2\-domain\-suffix\-match
 T}:T{
 string
 T}:T{
 \ \&
 T}:T{
-Constraint for server domain name\&. If set, this FQDN is used as a suffix match requirement for dNSName element(s) of the certificate presented by the authentication server during the inner "phase 2" authentication\&.  If a matching dNSName is found, this constraint is met\&.  If no dNSName values are present, this constraint is matched against SubjectName CN using same suffix match comparison\&.
+Constraint for server domain name\&. If set, this FQDN is used as a suffix match requirement for dNSName element(s) of the certificate presented by the authentication server during the inner "phase 2" authentication\&.  If a matching dNSName is found, this constraint is met\&.  If no dNSName values are present, this constraint is matched against SubjectName CN using same suffix match comparison\&. Since version 1\&.24, multiple valid FQDNs can be passed as a ";" delimited list\&.
 T}
 T{
 phase2\-private\-key
@@ -1004,6 +1024,12 @@ l l l l
 l l l l
 l l l l
 l l l l
+l l l l
+l l l l
+l l l l
+l l l l
+l l l l
+l l l l
 l l l l.
 T{
 ageing\-time
@@ -1024,6 +1050,15 @@ T}:T{
 The Spanning Tree Protocol (STP) forwarding delay, in seconds\&.
 T}
 T{
+group\-address
+T}:T{
+byte array
+T}:T{
+\ \&
+T}:T{
+If specified, The MAC address of the multicast group this bridge uses for STP\&. The address must be a link\-local address in standard Ethernet MAC address format, ie an address of the form 01:80:C2:00:00:0X, with X in [0, 4\&.\&.F]\&. If not specified the default value is 01:80:C2:00:00:00\&.
+T}
+T{
 group\-forward\-mask
 T}:T{
 uint32
@@ -1069,6 +1104,33 @@ T}:T{
 The Spanning Tree Protocol (STP) maximum message age, in seconds\&.
 T}
 T{
+multicast\-querier
+T}:T{
+boolean
+T}:T{
+FALSE
+T}:T{
+Enable or disable sending of multicast queries by the bridge\&. If not specified the option is disabled\&.
+T}
+T{
+multicast\-query\-use\-ifaddr
+T}:T{
+boolean
+T}:T{
+FALSE
+T}:T{
+If enabled the bridge\*(Aqs own IP address is used as the source address for IGMP queries otherwise the default of 0\&.0\&.0\&.0 is used\&.
+T}
+T{
+multicast\-router
+T}:T{
+string
+T}:T{
+\ \&
+T}:T{
+Sets bridge\*(Aqs multicast router\&. multicast\-snooping must be enabled for this option to work\&. Supported values are: \*(Aqauto\*(Aq, \*(Aqdisabled\*(Aq, \*(Aqenabled\*(Aq\&. If not specified the default value is \*(Aqauto\*(Aq\&.
+T}
+T{
 multicast\-snooping
 T}:T{
 boolean
@@ -1114,6 +1176,24 @@ T}:T{
 Control whether VLAN filtering is enabled on the bridge\&.
 T}
 T{
+vlan\-protocol
+T}:T{
+string
+T}:T{
+\ \&
+T}:T{
+If specified, the protocol used for VLAN filtering\&. Supported values are: \*(Aq802\&.1Q\*(Aq, \*(Aq802\&.1ad\*(Aq\&. If not specified the default value is \*(Aq802\&.1Q\*(Aq\&.
+T}
+T{
+vlan\-stats\-enabled
+T}:T{
+boolean
+T}:T{
+FALSE
+T}:T{
+Controls whether per\-VLAN stats accounting is enabled\&.
+T}
+T{
 vlans
 T}:T{
 array of vardict
@@ -1847,7 +1927,7 @@ array of string
 T}:T{
 \ \&
 T}:T{
-Array of DNS options as described in man 5 resolv\&.conf\&. NULL means that the options are unset and left at the default\&. In this case NetworkManager will use default options\&. This is distinct from an empty list of properties\&.
+Array of DNS options as described in man 5 resolv\&.conf\&. NULL means that the options are unset and left at the default\&. In this case NetworkManager will use default options\&. This is distinct from an empty list of properties\&. The currently supported options are "attempts", "debug", "edns0", "inet6", "ip6\-bytestring", "ip6\-dotint", "ndots", "no\-check\-names", "no\-ip6\-dotint", "no\-reload", "no\-tld\-query", "rotate", "single\-request", "single\-request\-reopen", "timeout", "trust\-ad", "use\-vc"\&. The "trust\-ad" setting is only honored if the profile contributes name servers to resolv\&.conf, and if all contributing profiles have "trust\-ad" enabled\&.
 T}
 T{
 dns\-priority
@@ -1856,7 +1936,7 @@ int32
 T}:T{
 0
 T}:T{
-DNS servers priority\&. The relative priority for DNS servers specified by this setting\&.  A lower value is better (higher priority)\&. Zero selects a globally configured default value\&. If the latter is missing or zero too, it defaults to 50 for VPNs and 100 for other connections\&. Note that the priority is to order DNS settings for multiple active connections\&.  It does not disambiguate multiple DNS servers within the same connection profile\&. When using dns=default, servers with higher priority will be on top of resolv\&.conf\&.  To prioritize a given server over another one within the same connection, just specify them in the desired order\&.  When multiple devices have configurations with the same priority, VPNs will be considered first, then devices with the best (lowest metric) default route and then all other devices\&.  Negative values have the special effect of excluding other configurations with a greater priority value; so in presence of at least one negative priority, only DNS servers from connections with the lowest priority value will be used\&. When using a DNS resolver that supports Conditional Forwarding as dns=dnsmasq or dns=systemd\-resolved, each connection is used to query domains in its search list\&.  Queries for domains not present in any search list are routed through connections having the \*(Aq~\&.\*(Aq special wildcard domain, which is added automatically to connections with the default route (or can be added manually)\&.  When multiple connections specify the same domain, the one with the highest priority (lowest numerical value) wins\&.  If a connection specifies a domain which is subdomain of another domain with a negative DNS priority value, the subdomain is ignored\&.
+DNS servers priority\&. The relative priority for DNS servers specified by this setting\&.  A lower value is better (higher priority)\&. Zero selects a globally configured default value\&. If the latter is missing or zero too, it defaults to 50 for VPNs (including WireGuard) and 100 for other connections\&. Note that the priority is to order DNS settings for multiple active connections\&.  It does not disambiguate multiple DNS servers within the same connection profile\&. When using dns=default, servers with higher priority will be on top of resolv\&.conf\&.  To prioritize a given server over another one within the same connection, just specify them in the desired order\&.  When multiple devices have configurations with the same priority, VPNs will be considered first, then devices with the best (lowest metric) default route and then all other devices\&.  Negative values have the special effect of excluding other configurations with a greater priority value; so in presence of at least one negative priority, only DNS servers from connections with the lowest priority value will be used\&. When using a DNS resolver that supports Conditional Forwarding as dns=dnsmasq or dns=systemd\-resolved, each connection is used to query domains in its search list\&.  Queries for domains not present in any search list are routed through connections having the \*(Aq~\&.\*(Aq special wildcard domain, which is added automatically to connections with the default route (or can be added manually)\&.  When multiple connections specify the same domain, the one with the highest priority (lowest numerical value) wins\&.  If a connection specifies a domain which is subdomain of another domain with a negative DNS priority value, the subdomain is ignored\&.
 T}
 T{
 dns\-search
@@ -1874,7 +1954,7 @@ string
 T}:T{
 \ \&
 T}:T{
-The gateway associated with this configuration\&. This is only meaningful if "addresses" is also set\&.
+The gateway associated with this configuration\&. This is only meaningful if "addresses" is also set\&. The gateway\*(Aqs main purpose is to control the next hop of the standard default route on the device\&. Hence, the gateway property conflicts with "never\-default" and will be automatically dropped if the IP configuration is set to never\-default\&. As an alternative to set the gateway, configure a static default route with /0 as prefix length\&.
 T}
 T{
 ignore\-auto\-dns
@@ -2108,7 +2188,7 @@ array of string
 T}:T{
 \ \&
 T}:T{
-Array of DNS options as described in man 5 resolv\&.conf\&. NULL means that the options are unset and left at the default\&. In this case NetworkManager will use default options\&. This is distinct from an empty list of properties\&.
+Array of DNS options as described in man 5 resolv\&.conf\&. NULL means that the options are unset and left at the default\&. In this case NetworkManager will use default options\&. This is distinct from an empty list of properties\&. The currently supported options are "attempts", "debug", "edns0", "inet6", "ip6\-bytestring", "ip6\-dotint", "ndots", "no\-check\-names", "no\-ip6\-dotint", "no\-reload", "no\-tld\-query", "rotate", "single\-request", "single\-request\-reopen", "timeout", "trust\-ad", "use\-vc"\&. The "trust\-ad" setting is only honored if the profile contributes name servers to resolv\&.conf, and if all contributing profiles have "trust\-ad" enabled\&.
 T}
 T{
 dns\-priority
@@ -2117,7 +2197,7 @@ int32
 T}:T{
 0
 T}:T{
-DNS servers priority\&. The relative priority for DNS servers specified by this setting\&.  A lower value is better (higher priority)\&. Zero selects a globally configured default value\&. If the latter is missing or zero too, it defaults to 50 for VPNs and 100 for other connections\&. Note that the priority is to order DNS settings for multiple active connections\&.  It does not disambiguate multiple DNS servers within the same connection profile\&. When using dns=default, servers with higher priority will be on top of resolv\&.conf\&.  To prioritize a given server over another one within the same connection, just specify them in the desired order\&.  When multiple devices have configurations with the same priority, VPNs will be considered first, then devices with the best (lowest metric) default route and then all other devices\&.  Negative values have the special effect of excluding other configurations with a greater priority value; so in presence of at least one negative priority, only DNS servers from connections with the lowest priority value will be used\&. When using a DNS resolver that supports Conditional Forwarding as dns=dnsmasq or dns=systemd\-resolved, each connection is used to query domains in its search list\&.  Queries for domains not present in any search list are routed through connections having the \*(Aq~\&.\*(Aq special wildcard domain, which is added automatically to connections with the default route (or can be added manually)\&.  When multiple connections specify the same domain, the one with the highest priority (lowest numerical value) wins\&.  If a connection specifies a domain which is subdomain of another domain with a negative DNS priority value, the subdomain is ignored\&.
+DNS servers priority\&. The relative priority for DNS servers specified by this setting\&.  A lower value is better (higher priority)\&. Zero selects a globally configured default value\&. If the latter is missing or zero too, it defaults to 50 for VPNs (including WireGuard) and 100 for other connections\&. Note that the priority is to order DNS settings for multiple active connections\&.  It does not disambiguate multiple DNS servers within the same connection profile\&. When using dns=default, servers with higher priority will be on top of resolv\&.conf\&.  To prioritize a given server over another one within the same connection, just specify them in the desired order\&.  When multiple devices have configurations with the same priority, VPNs will be considered first, then devices with the best (lowest metric) default route and then all other devices\&.  Negative values have the special effect of excluding other configurations with a greater priority value; so in presence of at least one negative priority, only DNS servers from connections with the lowest priority value will be used\&. When using a DNS resolver that supports Conditional Forwarding as dns=dnsmasq or dns=systemd\-resolved, each connection is used to query domains in its search list\&.  Queries for domains not present in any search list are routed through connections having the \*(Aq~\&.\*(Aq special wildcard domain, which is added automatically to connections with the default route (or can be added manually)\&.  When multiple connections specify the same domain, the one with the highest priority (lowest numerical value) wins\&.  If a connection specifies a domain which is subdomain of another domain with a negative DNS priority value, the subdomain is ignored\&.
 T}
 T{
 dns\-search
@@ -2135,7 +2215,7 @@ string
 T}:T{
 \ \&
 T}:T{
-The gateway associated with this configuration\&. This is only meaningful if "addresses" is also set\&.
+The gateway associated with this configuration\&. This is only meaningful if "addresses" is also set\&. The gateway\*(Aqs main purpose is to control the next hop of the standard default route on the device\&. Hence, the gateway property conflicts with "never\-default" and will be automatically dropped if the IP configuration is set to never\-default\&. As an alternative to set the gateway, configure a static default route with /0 as prefix length\&.
 T}
 T{
 ignore\-auto\-dns
@@ -2563,7 +2643,7 @@ T}
 .sp 1
 .SS "match setting"
 .PP
-Match settings\&.\&.
+Match settings\&.
 .TS
 allbox tab(:);
 lB lB lB lB.
@@ -3261,7 +3341,7 @@ T}
 .sp 1
 .SS "sriov setting"
 .PP
-SR\-IOV settings\&.\&.
+SR\-IOV settings\&.
 .TS
 allbox tab(:);
 lB lB lB lB.
@@ -3294,7 +3374,7 @@ uint32
 T}:T{
 0
 T}:T{
-The total number of virtual functions to create\&. Note that when the sriov setting is present NetworkManager enforces the number of virtual functions on the interface also when it is zero\&. To prevent any changes to SR\-IOV parameters don\*(Aqt add a sriov setting to the connection\&.
+The total number of virtual functions to create\&. Note that when the sriov setting is present NetworkManager enforces the number of virtual functions on the interface (also when it is zero) during activation and resets it upon deactivation\&. To prevent any changes to SR\-IOV parameters don\*(Aqt add a sriov setting to the connection\&.
 T}
 T{
 vfs
@@ -3309,7 +3389,7 @@ T}
 .sp 1
 .SS "tc setting"
 .PP
-Linux Traffic Control Settings\&.\&.
+Linux Traffic Control Settings\&.
 .TS
 allbox tab(:);
 lB lB lB lB.
@@ -3883,6 +3963,34 @@ If the VPN connection requires a user name for authentication, that name should
 T}
 .TE
 .sp 1
+.SS "vrf setting"
+.PP
+VRF settings\&.
+.TS
+allbox tab(:);
+lB lB lB lB.
+T{
+Key Name
+T}:T{
+Value Type
+T}:T{
+Default Value
+T}:T{
+Value Description
+T}
+.T&
+l l l l.
+T{
+table
+T}:T{
+uint32
+T}:T{
+0
+T}:T{
+The routing table for this VRF\&.
+T}
+.TE
+.sp 1
 .SS "vxlan setting"
 .PP
 VXLAN Settings\&.
@@ -4356,7 +4464,7 @@ NMTernary (int32)
 T}:T{
 \ \&
 T}:T{
-Whether to enable special handling of the IPv4 default route\&. If enabled, the IPv4 default route will be placed to a dedicated routing\-table and two policy routing rules will be added\&. The fwmark number is also used as routing\-table for the default\-route, and if fwmark is zero, a unused fwmark/table is chosen automatically\&. This corresponds to what wg\-quick does with Table=auto\&. Leaving this at the default will enable this option automatically if ipv4\&.never\-default is not set and there are any peers that use a default\-route as allowed\-ips\&.
+Whether to enable special handling of the IPv4 default route\&. If enabled, the IPv4 default route from wireguard\&.peer\-routes will be placed to a dedicated routing\-table and two policy routing rules will be added\&. The fwmark number is also used as routing\-table for the default\-route, and if fwmark is zero, an unused fwmark/table is chosen automatically\&. This corresponds to what wg\-quick does with Table=auto and what WireGuard calls "Improved Rule\-based Routing"\&. Note that for this automatism to work, you usually don\*(Aqt want to set ipv4\&.gateway, because that will result in a conflicting default route\&. Leaving this at the default will enable this option automatically if ipv4\&.never\-default is not set and there are any peers that use a default\-route as allowed\-ips\&.
 T}
 T{
 ip6\-auto\-default\-route
@@ -4392,7 +4500,7 @@ boolean
 T}:T{
 TRUE
 T}:T{
-Whether to automatically add routes for the AllowedIPs ranges of the peers\&. If TRUE (the default), NetworkManager will automatically add routes in the routing tables according to ipv4\&.route\-table and ipv6\&.route\-table\&. If FALSE, no such routes are added automatically\&. In this case, the user may want to configure static routes in ipv4\&.routes and ipv6\&.routes, respectively\&.
+Whether to automatically add routes for the AllowedIPs ranges of the peers\&. If TRUE (the default), NetworkManager will automatically add routes in the routing tables according to ipv4\&.route\-table and ipv6\&.route\-table\&. Usually you want this automatism enabled\&. If FALSE, no such routes are added automatically\&. In this case, the user may want to configure static routes in ipv4\&.routes and ipv6\&.routes, respectively\&. Note that if the peer\*(Aqs AllowedIPs is "0\&.0\&.0\&.0/0" or "::/0" and the profile\*(Aqs ipv4\&.never\-default or ipv6\&.never\-default setting is enabled, the peer route for this peer won\*(Aqt be added automatically\&.
 T}
 T{
 peers
@@ -4701,7 +4809,7 @@ string
 T}:T{
 \ \&
 T}:T{
-Key management used for the connection\&.  One of "none" (WEP), "ieee8021x" (Dynamic WEP), "wpa\-psk" (infrastructure WPA\-PSK), "sae" (SAE) or "wpa\-eap" (WPA\-Enterprise)\&.  This property must be set for any Wi\-Fi connection that uses security\&.
+Key management used for the connection\&.  One of "none" (WEP), "ieee8021x" (Dynamic WEP), "wpa\-psk" (infrastructure WPA\-PSK), "sae" (SAE), "owe" (Opportunistic Wireless Encryption) or "wpa\-eap" (WPA\-Enterprise)\&.  This property must be set for any Wi\-Fi connection that uses security\&.
 T}
 T{
 leap\-password
diff --git a/man/nm-settings.xml b/man/nm-settings.xml
index 70e922de..3ea3a43b 100644
--- a/man/nm-settings.xml
+++ b/man/nm-settings.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0"?>
 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.3//EN" "http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd">
-<refentry id="nm-settings"><refentryinfo><title>nm-settings</title><author>NetworkManager developers</author></refentryinfo><refmeta><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum><refmiscinfo class="source">NetworkManager</refmiscinfo><refmiscinfo class="manual">Configuration</refmiscinfo><refmiscinfo class="version">1.22.10</refmiscinfo></refmeta><refnamediv><refname>nm-settings</refname><refpurpose>Description of settings and properties of NetworkManager connection profiles</refpurpose></refnamediv><refsect1 id="description"><title>Description</title><para>
+<refentry id="nm-settings"><refentryinfo><title>nm-settings</title><author>NetworkManager developers</author></refentryinfo><refmeta><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum><refmiscinfo class="source">NetworkManager</refmiscinfo><refmiscinfo class="manual">Configuration</refmiscinfo><refmiscinfo class="version">1.24.0</refmiscinfo></refmeta><refnamediv><refname>nm-settings</refname><refpurpose>Description of settings and properties of NetworkManager connection profiles</refpurpose></refnamediv><refsect1 id="description"><title>Description</title><para>
           NetworkManager is based on a concept of connection profiles, sometimes referred to as
           connections only. These connection profiles contain a network configuration. When
           NetworkManager activates a connection profile on a network device the configuration will
@@ -73,7 +73,8 @@
     <row><entry align="left" id="nm-settings.property.802-1x.client-cert">client-cert</entry><entry align="left">byte array</entry><entry align="left"/><entry>Contains the client certificate if used by the EAP method specified in the "eap" property. Certificate data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte.</entry></row>
     <row><entry align="left" id="nm-settings.property.802-1x.client-cert-password">client-cert-password</entry><entry align="left">string</entry><entry align="left"/><entry>The password used to access the client certificate stored in "client-cert" property. Only makes sense if the certificate is stored on a PKCS#11 token that requires a login.</entry></row>
     <row><entry align="left" id="nm-settings.property.802-1x.client-cert-password-flags">client-cert-password-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "client-cert-password" property. (see <xref linkend="secrets-flags"/> for flag values)</entry></row>
-    <row><entry align="left" id="nm-settings.property.802-1x.domain-suffix-match">domain-suffix-match</entry><entry align="left">string</entry><entry align="left"/><entry>Constraint for server domain name. If set, this FQDN is used as a suffix match requirement for dNSName element(s) of the certificate presented by the authentication server.  If a matching dNSName is found, this constraint is met.  If no dNSName values are present, this constraint is matched against SubjectName CN using same suffix match comparison.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-1x.domain-match">domain-match</entry><entry align="left">string</entry><entry align="left"/><entry>Constraint for server domain name. If set, this list of FQDNs is used as a match requirement for dNSName element(s) of the certificate presented by the authentication server.  If a matching dNSName is found, this constraint is met.  If no dNSName values are present, this constraint is matched against SubjectName CN using the same comparison. Multiple valid FQDNs can be passed as a ";" delimited list.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-1x.domain-suffix-match">domain-suffix-match</entry><entry align="left">string</entry><entry align="left"/><entry>Constraint for server domain name. If set, this FQDN is used as a suffix match requirement for dNSName element(s) of the certificate presented by the authentication server.  If a matching dNSName is found, this constraint is met.  If no dNSName values are present, this constraint is matched against SubjectName CN using same suffix match comparison. Since version 1.24, multiple valid FQDNs can be passed as a ";" delimited list.</entry></row>
     <row><entry align="left" id="nm-settings.property.802-1x.eap">eap</entry><entry align="left">array of string</entry><entry align="left"/><entry>The allowed EAP method to be used when authenticating to the network with 802.1x.  Valid methods are: "leap", "md5", "tls", "peap", "ttls", "pwd", and "fast".  Each method requires different configuration using the properties of this setting; refer to wpa_supplicant documentation for the allowed combinations.</entry></row>
     <row><entry align="left" id="nm-settings.property.802-1x.identity">identity</entry><entry align="left">string</entry><entry align="left"/><entry>Identity string for EAP authentication methods.  Often the user's user or login name.</entry></row>
     <row><entry align="left" id="nm-settings.property.802-1x.optional">optional</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>Whether the 802.1X authentication is optional. If TRUE, the activation will continue even after a timeout or an authentication failure. Setting the property to TRUE is currently allowed only for Ethernet connections. If set to FALSE, the activation can continue only after a successful authentication.</entry></row>
@@ -96,7 +97,8 @@
     <row><entry align="left" id="nm-settings.property.802-1x.phase2-client-cert">phase2-client-cert</entry><entry align="left">byte array</entry><entry align="left"/><entry>Contains the "phase 2" client certificate if used by the EAP method specified in the "phase2-auth" or "phase2-autheap" properties. Certificate data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string "file://" and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended.</entry></row>
     <row><entry align="left" id="nm-settings.property.802-1x.phase2-client-cert-password">phase2-client-cert-password</entry><entry align="left">string</entry><entry align="left"/><entry>The password used to access the "phase2" client certificate stored in "phase2-client-cert" property. Only makes sense if the certificate is stored on a PKCS#11 token that requires a login.</entry></row>
     <row><entry align="left" id="nm-settings.property.802-1x.phase2-client-cert-password-flags">phase2-client-cert-password-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "phase2-client-cert-password" property. (see <xref linkend="secrets-flags"/> for flag values)</entry></row>
-    <row><entry align="left" id="nm-settings.property.802-1x.phase2-domain-suffix-match">phase2-domain-suffix-match</entry><entry align="left">string</entry><entry align="left"/><entry>Constraint for server domain name. If set, this FQDN is used as a suffix match requirement for dNSName element(s) of the certificate presented by the authentication server during the inner "phase 2" authentication.  If a matching dNSName is found, this constraint is met.  If no dNSName values are present, this constraint is matched against SubjectName CN using same suffix match comparison.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-1x.phase2-domain-match">phase2-domain-match</entry><entry align="left">string</entry><entry align="left"/><entry>Constraint for server domain name. If set, this list of FQDNs is used as a match requirement for dNSName element(s) of the certificate presented by the authentication server during the inner "phase 2" authentication. If a matching dNSName is found, this constraint is met.  If no dNSName values are present, this constraint is matched against SubjectName CN using the same comparison. Multiple valid FQDNs can be passed as a ";" delimited list.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-1x.phase2-domain-suffix-match">phase2-domain-suffix-match</entry><entry align="left">string</entry><entry align="left"/><entry>Constraint for server domain name. If set, this FQDN is used as a suffix match requirement for dNSName element(s) of the certificate presented by the authentication server during the inner "phase 2" authentication.  If a matching dNSName is found, this constraint is met.  If no dNSName values are present, this constraint is matched against SubjectName CN using same suffix match comparison. Since version 1.24, multiple valid FQDNs can be passed as a ";" delimited list.</entry></row>
     <row><entry align="left" id="nm-settings.property.802-1x.phase2-private-key">phase2-private-key</entry><entry align="left">byte array</entry><entry align="left"/><entry>Contains the "phase 2" inner private key when the "phase2-auth" or "phase2-autheap" property is set to "tls". Key data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme and private keys, this property should be set to the key's encrypted PEM encoded data. When using private keys with the path scheme, this property should be set to the full UTF-8 encoded path of the key, prefixed with the string "file://" and ending with a terminating NUL byte. When using PKCS#12 format private keys and the blob scheme, this property should be set to the PKCS#12 data and the "phase2-private-key-password" property must be set to password used to decrypt the PKCS#12 certificate and key. When using PKCS#12 files and the path scheme, this property should be set to the full UTF-8 encoded path of the key, prefixed with the string "file://" and ending with a terminating NUL byte, and as with the blob scheme the "phase2-private-key-password" property must be set to the password used to decode the PKCS#12 private key and certificate.</entry></row>
     <row><entry align="left" id="nm-settings.property.802-1x.phase2-private-key-password">phase2-private-key-password</entry><entry align="left">string</entry><entry align="left"/><entry>The password used to decrypt the "phase 2" private key specified in the "phase2-private-key" property when the private key either uses the path scheme, or is a PKCS#12 format key.</entry></row>
     <row><entry align="left" id="nm-settings.property.802-1x.phase2-private-key-password-flags">phase2-private-key-password-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "phase2-private-key-password" property. (see <xref linkend="secrets-flags"/> for flag values)</entry></row>
@@ -129,16 +131,22 @@
   <refsect2><title>bridge setting</title><para>Bridging Settings.</para><informaltable><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
     <row><entry align="left" id="nm-settings.property.bridge.ageing-time">ageing-time</entry><entry align="left">uint32</entry><entry align="left">300</entry><entry>The Ethernet MAC address aging time, in seconds.</entry></row>
     <row><entry align="left" id="nm-settings.property.bridge.forward-delay">forward-delay</entry><entry align="left">uint32</entry><entry align="left">15</entry><entry>The Spanning Tree Protocol (STP) forwarding delay, in seconds.</entry></row>
+    <row><entry align="left" id="nm-settings.property.bridge.group-address">group-address</entry><entry align="left">byte array</entry><entry align="left"/><entry>If specified, The MAC address of the multicast group this bridge uses for STP. The address must be a link-local address in standard Ethernet MAC address format, ie an address of the form 01:80:C2:00:00:0X, with X in [0, 4..F]. If not specified the default value is 01:80:C2:00:00:00.</entry></row>
     <row><entry align="left" id="nm-settings.property.bridge.group-forward-mask">group-forward-mask</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>A mask of group addresses to forward. Usually, group addresses in the range from 01:80:C2:00:00:00 to 01:80:C2:00:00:0F are not forwarded according to standards. This property is a mask of 16 bits, each corresponding to a group address in that range that must be forwarded. The mask can't have bits 0, 1 or 2 set because they are used for STP, MAC pause frames and LACP.</entry></row>
     <row><entry align="left" id="nm-settings.property.bridge.hello-time">hello-time</entry><entry align="left">uint32</entry><entry align="left">2</entry><entry>The Spanning Tree Protocol (STP) hello time, in seconds.</entry></row>
     <row><entry align="left" id="nm-settings.property.bridge.interface-name">interface-name</entry><entry align="left">string</entry><entry align="left"/><entry>Deprecated in favor of connection.interface-name, but can be used for backward-compatibility with older daemons, to set the bridge's interface name.</entry></row>
     <row><entry align="left" id="nm-settings.property.bridge.mac-address">mac-address</entry><entry align="left">byte array</entry><entry align="left"/><entry>If specified, the MAC address of bridge. When creating a new bridge, this MAC address will be set. If this field is left unspecified, the "ethernet.cloned-mac-address" is referred instead to generate the initial MAC address. Note that setting "ethernet.cloned-mac-address" anyway overwrites the MAC address of the bridge later while activating the bridge. Hence, this property is deprecated. Deprecated: 1</entry></row>
     <row><entry align="left" id="nm-settings.property.bridge.max-age">max-age</entry><entry align="left">uint32</entry><entry align="left">20</entry><entry>The Spanning Tree Protocol (STP) maximum message age, in seconds.</entry></row>
+    <row><entry align="left" id="nm-settings.property.bridge.multicast-querier">multicast-querier</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>Enable or disable sending of multicast queries by the bridge. If not specified the option is disabled.</entry></row>
+    <row><entry align="left" id="nm-settings.property.bridge.multicast-query-use-ifaddr">multicast-query-use-ifaddr</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>If enabled the bridge's own IP address is used as the source address for IGMP queries otherwise the default of 0.0.0.0 is used.</entry></row>
+    <row><entry align="left" id="nm-settings.property.bridge.multicast-router">multicast-router</entry><entry align="left">string</entry><entry align="left"/><entry>Sets bridge's multicast router. multicast-snooping must be enabled for this option to work. Supported values are: 'auto', 'disabled', 'enabled'. If not specified the default value is 'auto'.</entry></row>
     <row><entry align="left" id="nm-settings.property.bridge.multicast-snooping">multicast-snooping</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>Controls whether IGMP snooping is enabled for this bridge. Note that if snooping was automatically disabled due to hash collisions, the system may refuse to enable the feature until the collisions are resolved.</entry></row>
     <row><entry align="left" id="nm-settings.property.bridge.priority">priority</entry><entry align="left">uint32</entry><entry align="left">32768</entry><entry>Sets the Spanning Tree Protocol (STP) priority for this bridge.  Lower values are "better"; the lowest priority bridge will be elected the root bridge.</entry></row>
     <row><entry align="left" id="nm-settings.property.bridge.stp">stp</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>Controls whether Spanning Tree Protocol (STP) is enabled for this bridge.</entry></row>
     <row><entry align="left" id="nm-settings.property.bridge.vlan-default-pvid">vlan-default-pvid</entry><entry align="left">uint32</entry><entry align="left">1</entry><entry>The default PVID for the ports of the bridge, that is the VLAN id assigned to incoming untagged frames.</entry></row>
     <row><entry align="left" id="nm-settings.property.bridge.vlan-filtering">vlan-filtering</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>Control whether VLAN filtering is enabled on the bridge.</entry></row>
+    <row><entry align="left" id="nm-settings.property.bridge.vlan-protocol">vlan-protocol</entry><entry align="left">string</entry><entry align="left"/><entry>If specified, the protocol used for VLAN filtering. Supported values are: '802.1Q', '802.1ad'. If not specified the default value is '802.1Q'.</entry></row>
+    <row><entry align="left" id="nm-settings.property.bridge.vlan-stats-enabled">vlan-stats-enabled</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>Controls whether per-VLAN stats accounting is enabled.</entry></row>
     <row><entry align="left" id="nm-settings.property.bridge.vlans">vlans</entry><entry align="left">array of vardict</entry><entry align="left"/><entry>Array of bridge VLAN objects. In addition to the VLANs specified here, the bridge will also have the default-pvid VLAN configured  by the bridge.vlan-default-pvid property. In nmcli the VLAN list can be specified with the following syntax: $vid [pvid] [untagged] [, $vid [pvid] [untagged]]... where $vid is either a single id between 1 and 4094 or a range, represented as a couple of ids separated by a dash.</entry></row>
   </tbody></tgroup></informaltable></refsect2>
   <refsect2><title>bridge-port setting</title><para>Bridge Port Settings.</para><informaltable><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
@@ -212,10 +220,10 @@
     <row><entry align="left" id="nm-settings.property.ipv4.dhcp-send-hostname">dhcp-send-hostname</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>If TRUE, a hostname is sent to the DHCP server when acquiring a lease. Some DHCP servers use this hostname to update DNS databases, essentially providing a static hostname for the computer.  If the "dhcp-hostname" property is NULL and this property is TRUE, the current persistent hostname of the computer is sent.</entry></row>
     <row><entry align="left" id="nm-settings.property.ipv4.dhcp-timeout">dhcp-timeout</entry><entry align="left">int32</entry><entry align="left">0</entry><entry>A timeout for a DHCP transaction in seconds. If zero (the default), a globally configured default is used. If still unspecified, a device specific timeout is used (usually 45 seconds). Set to 2147483647 (MAXINT32) for infinity.</entry></row>
     <row><entry align="left" id="nm-settings.property.ipv4.dns">dns</entry><entry align="left">array of uint32</entry><entry align="left"/><entry>Array of IP addresses of DNS servers (as network-byte-order integers)</entry></row>
-    <row><entry align="left" id="nm-settings.property.ipv4.dns-options">dns-options</entry><entry align="left">array of string</entry><entry align="left"/><entry>Array of DNS options as described in man 5 resolv.conf. NULL means that the options are unset and left at the default. In this case NetworkManager will use default options. This is distinct from an empty list of properties.</entry></row>
-    <row><entry align="left" id="nm-settings.property.ipv4.dns-priority">dns-priority</entry><entry align="left">int32</entry><entry align="left">0</entry><entry>DNS servers priority. The relative priority for DNS servers specified by this setting.  A lower value is better (higher priority). Zero selects a globally configured default value. If the latter is missing or zero too, it defaults to 50 for VPNs and 100 for other connections. Note that the priority is to order DNS settings for multiple active connections.  It does not disambiguate multiple DNS servers within the same connection profile. When using dns=default, servers with higher priority will be on top of resolv.conf.  To prioritize a given server over another one within the same connection, just specify them in the desired order.  When multiple devices have configurations with the same priority, VPNs will be considered first, then devices with the best (lowest metric) default route and then all other devices.  Negative values have the special effect of excluding other configurations with a greater priority value; so in presence of at least one negative priority, only DNS servers from connections with the lowest priority value will be used. When using a DNS resolver that supports Conditional Forwarding as dns=dnsmasq or dns=systemd-resolved, each connection is used to query domains in its search list.  Queries for domains not present in any search list are routed through connections having the '~.' special wildcard domain, which is added automatically to connections with the default route (or can be added manually).  When multiple connections specify the same domain, the one with the highest priority (lowest numerical value) wins.  If a connection specifies a domain which is subdomain of another domain with a negative DNS priority value, the subdomain is ignored.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv4.dns-options">dns-options</entry><entry align="left">array of string</entry><entry align="left"/><entry>Array of DNS options as described in man 5 resolv.conf. NULL means that the options are unset and left at the default. In this case NetworkManager will use default options. This is distinct from an empty list of properties. The currently supported options are "attempts", "debug", "edns0", "inet6", "ip6-bytestring", "ip6-dotint", "ndots", "no-check-names", "no-ip6-dotint", "no-reload", "no-tld-query", "rotate", "single-request", "single-request-reopen", "timeout", "trust-ad", "use-vc". The "trust-ad" setting is only honored if the profile contributes name servers to resolv.conf, and if all contributing profiles have "trust-ad" enabled.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv4.dns-priority">dns-priority</entry><entry align="left">int32</entry><entry align="left">0</entry><entry>DNS servers priority. The relative priority for DNS servers specified by this setting.  A lower value is better (higher priority). Zero selects a globally configured default value. If the latter is missing or zero too, it defaults to 50 for VPNs (including WireGuard) and 100 for other connections. Note that the priority is to order DNS settings for multiple active connections.  It does not disambiguate multiple DNS servers within the same connection profile. When using dns=default, servers with higher priority will be on top of resolv.conf.  To prioritize a given server over another one within the same connection, just specify them in the desired order.  When multiple devices have configurations with the same priority, VPNs will be considered first, then devices with the best (lowest metric) default route and then all other devices.  Negative values have the special effect of excluding other configurations with a greater priority value; so in presence of at least one negative priority, only DNS servers from connections with the lowest priority value will be used. When using a DNS resolver that supports Conditional Forwarding as dns=dnsmasq or dns=systemd-resolved, each connection is used to query domains in its search list.  Queries for domains not present in any search list are routed through connections having the '~.' special wildcard domain, which is added automatically to connections with the default route (or can be added manually).  When multiple connections specify the same domain, the one with the highest priority (lowest numerical value) wins.  If a connection specifies a domain which is subdomain of another domain with a negative DNS priority value, the subdomain is ignored.</entry></row>
     <row><entry align="left" id="nm-settings.property.ipv4.dns-search">dns-search</entry><entry align="left">array of string</entry><entry align="left"/><entry>Array of DNS search domains. Domains starting with a tilde ('~') are considered 'routing' domains and are used only to decide the interface over which a query must be forwarded; they are not used to complete unqualified host names.</entry></row>
-    <row><entry align="left" id="nm-settings.property.ipv4.gateway">gateway</entry><entry align="left">string</entry><entry align="left"/><entry>The gateway associated with this configuration. This is only meaningful if "addresses" is also set.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv4.gateway">gateway</entry><entry align="left">string</entry><entry align="left"/><entry>The gateway associated with this configuration. This is only meaningful if "addresses" is also set. The gateway's main purpose is to control the next hop of the standard default route on the device. Hence, the gateway property conflicts with "never-default" and will be automatically dropped if the IP configuration is set to never-default. As an alternative to set the gateway, configure a static default route with /0 as prefix length.</entry></row>
     <row><entry align="left" id="nm-settings.property.ipv4.ignore-auto-dns">ignore-auto-dns</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>When "method" is set to "auto" and this property to TRUE, automatically configured nameservers and search domains are ignored and only nameservers and search domains specified in the "dns" and "dns-search" properties, if any, are used.</entry></row>
     <row><entry align="left" id="nm-settings.property.ipv4.ignore-auto-routes">ignore-auto-routes</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>When "method" is set to "auto" and this property to TRUE, automatically configured routes are ignored and only routes specified in the "routes" property, if any, are used.</entry></row>
     <row><entry align="left" id="nm-settings.property.ipv4.may-fail">may-fail</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>If TRUE, allow overall network configuration to proceed even if the configuration specified by this property times out.  Note that at least one IP configuration must succeed or overall network configuration will still fail.  For example, in IPv6-only networks, setting this property to TRUE on the NMSettingIP4Config allows the overall network configuration to succeed if IPv4 configuration fails but IPv6 configuration completes successfully.</entry></row>
@@ -238,10 +246,10 @@
     <row><entry align="left" id="nm-settings.property.ipv6.dhcp-send-hostname">dhcp-send-hostname</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>If TRUE, a hostname is sent to the DHCP server when acquiring a lease. Some DHCP servers use this hostname to update DNS databases, essentially providing a static hostname for the computer.  If the "dhcp-hostname" property is NULL and this property is TRUE, the current persistent hostname of the computer is sent.</entry></row>
     <row><entry align="left" id="nm-settings.property.ipv6.dhcp-timeout">dhcp-timeout</entry><entry align="left">int32</entry><entry align="left">0</entry><entry>A timeout for a DHCP transaction in seconds. If zero (the default), a globally configured default is used. If still unspecified, a device specific timeout is used (usually 45 seconds). Set to 2147483647 (MAXINT32) for infinity.</entry></row>
     <row><entry align="left" id="nm-settings.property.ipv6.dns">dns</entry><entry align="left">array of byte array</entry><entry align="left"/><entry>Array of IP addresses of DNS servers (in network byte order)</entry></row>
-    <row><entry align="left" id="nm-settings.property.ipv6.dns-options">dns-options</entry><entry align="left">array of string</entry><entry align="left"/><entry>Array of DNS options as described in man 5 resolv.conf. NULL means that the options are unset and left at the default. In this case NetworkManager will use default options. This is distinct from an empty list of properties.</entry></row>
-    <row><entry align="left" id="nm-settings.property.ipv6.dns-priority">dns-priority</entry><entry align="left">int32</entry><entry align="left">0</entry><entry>DNS servers priority. The relative priority for DNS servers specified by this setting.  A lower value is better (higher priority). Zero selects a globally configured default value. If the latter is missing or zero too, it defaults to 50 for VPNs and 100 for other connections. Note that the priority is to order DNS settings for multiple active connections.  It does not disambiguate multiple DNS servers within the same connection profile. When using dns=default, servers with higher priority will be on top of resolv.conf.  To prioritize a given server over another one within the same connection, just specify them in the desired order.  When multiple devices have configurations with the same priority, VPNs will be considered first, then devices with the best (lowest metric) default route and then all other devices.  Negative values have the special effect of excluding other configurations with a greater priority value; so in presence of at least one negative priority, only DNS servers from connections with the lowest priority value will be used. When using a DNS resolver that supports Conditional Forwarding as dns=dnsmasq or dns=systemd-resolved, each connection is used to query domains in its search list.  Queries for domains not present in any search list are routed through connections having the '~.' special wildcard domain, which is added automatically to connections with the default route (or can be added manually).  When multiple connections specify the same domain, the one with the highest priority (lowest numerical value) wins.  If a connection specifies a domain which is subdomain of another domain with a negative DNS priority value, the subdomain is ignored.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv6.dns-options">dns-options</entry><entry align="left">array of string</entry><entry align="left"/><entry>Array of DNS options as described in man 5 resolv.conf. NULL means that the options are unset and left at the default. In this case NetworkManager will use default options. This is distinct from an empty list of properties. The currently supported options are "attempts", "debug", "edns0", "inet6", "ip6-bytestring", "ip6-dotint", "ndots", "no-check-names", "no-ip6-dotint", "no-reload", "no-tld-query", "rotate", "single-request", "single-request-reopen", "timeout", "trust-ad", "use-vc". The "trust-ad" setting is only honored if the profile contributes name servers to resolv.conf, and if all contributing profiles have "trust-ad" enabled.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv6.dns-priority">dns-priority</entry><entry align="left">int32</entry><entry align="left">0</entry><entry>DNS servers priority. The relative priority for DNS servers specified by this setting.  A lower value is better (higher priority). Zero selects a globally configured default value. If the latter is missing or zero too, it defaults to 50 for VPNs (including WireGuard) and 100 for other connections. Note that the priority is to order DNS settings for multiple active connections.  It does not disambiguate multiple DNS servers within the same connection profile. When using dns=default, servers with higher priority will be on top of resolv.conf.  To prioritize a given server over another one within the same connection, just specify them in the desired order.  When multiple devices have configurations with the same priority, VPNs will be considered first, then devices with the best (lowest metric) default route and then all other devices.  Negative values have the special effect of excluding other configurations with a greater priority value; so in presence of at least one negative priority, only DNS servers from connections with the lowest priority value will be used. When using a DNS resolver that supports Conditional Forwarding as dns=dnsmasq or dns=systemd-resolved, each connection is used to query domains in its search list.  Queries for domains not present in any search list are routed through connections having the '~.' special wildcard domain, which is added automatically to connections with the default route (or can be added manually).  When multiple connections specify the same domain, the one with the highest priority (lowest numerical value) wins.  If a connection specifies a domain which is subdomain of another domain with a negative DNS priority value, the subdomain is ignored.</entry></row>
     <row><entry align="left" id="nm-settings.property.ipv6.dns-search">dns-search</entry><entry align="left">array of string</entry><entry align="left"/><entry>Array of DNS search domains. Domains starting with a tilde ('~') are considered 'routing' domains and are used only to decide the interface over which a query must be forwarded; they are not used to complete unqualified host names.</entry></row>
-    <row><entry align="left" id="nm-settings.property.ipv6.gateway">gateway</entry><entry align="left">string</entry><entry align="left"/><entry>The gateway associated with this configuration. This is only meaningful if "addresses" is also set.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv6.gateway">gateway</entry><entry align="left">string</entry><entry align="left"/><entry>The gateway associated with this configuration. This is only meaningful if "addresses" is also set. The gateway's main purpose is to control the next hop of the standard default route on the device. Hence, the gateway property conflicts with "never-default" and will be automatically dropped if the IP configuration is set to never-default. As an alternative to set the gateway, configure a static default route with /0 as prefix length.</entry></row>
     <row><entry align="left" id="nm-settings.property.ipv6.ignore-auto-dns">ignore-auto-dns</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>When "method" is set to "auto" and this property to TRUE, automatically configured nameservers and search domains are ignored and only nameservers and search domains specified in the "dns" and "dns-search" properties, if any, are used.</entry></row>
     <row><entry align="left" id="nm-settings.property.ipv6.ignore-auto-routes">ignore-auto-routes</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>When "method" is set to "auto" and this property to TRUE, automatically configured routes are ignored and only routes specified in the "routes" property, if any, are used.</entry></row>
     <row><entry align="left" id="nm-settings.property.ipv6.ip6-privacy">ip6-privacy</entry><entry align="left">NMSettingIP6ConfigPrivacy (int32)</entry><entry align="left"/><entry>Configure IPv6 Privacy Extensions for SLAAC, described in RFC4941.  If enabled, it makes the kernel generate a temporary IPv6 address in addition to the public one generated from MAC address via modified EUI-64.  This enhances privacy, but could cause problems in some applications, on the other hand.  The permitted values are: -1: unknown, 0: disabled, 1: enabled (prefer public address), 2: enabled (prefer temporary addresses). Having a per-connection setting set to "-1" (unknown) means fallback to global configuration "ipv6.ip6-privacy". If also global configuration is unspecified or set to "-1", fallback to read "/proc/sys/net/ipv6/conf/default/use_tempaddr". Note that this setting is distinct from the Stable Privacy addresses that can be enabled with the "addr-gen-mode" property's "stable-privacy" setting as another way of avoiding host tracking with IPv6 addresses.</entry></row>
@@ -287,7 +295,7 @@
     <row><entry align="left" id="nm-settings.property.macvlan.promiscuous">promiscuous</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>Whether the interface should be put in promiscuous mode.</entry></row>
     <row><entry align="left" id="nm-settings.property.macvlan.tap">tap</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>Whether the interface should be a MACVTAP.</entry></row>
   </tbody></tgroup></informaltable></refsect2>
-  <refsect2><title>match setting</title><para>Match settings..</para><informaltable><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
+  <refsect2><title>match setting</title><para>Match settings.</para><informaltable><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
     <row><entry align="left" id="nm-settings.property.match.interface-name">interface-name</entry><entry align="left">array of string</entry><entry align="left"/><entry>A list of interface names to match. Each element is a shell wildcard pattern.  When an element is prefixed with exclamation mark (!) the condition is inverted. A candidate interface name is considered matching when both these conditions are satisfied: (a) any of the elements not prefixed with '!' matches or there aren't such elements; (b) none of the elements prefixed with '!' match.</entry></row>
   </tbody></tgroup></informaltable></refsect2>
   <refsect2><title>802-11-olpc-mesh setting</title><para>OLPC Wireless Mesh Settings.</para><informaltable><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
@@ -359,12 +367,12 @@
     <row><entry align="left" id="nm-settings.property.serial.send-delay">send-delay</entry><entry align="left">uint64</entry><entry align="left">0</entry><entry>Time to delay between each byte sent to the modem, in microseconds.</entry></row>
     <row><entry align="left" id="nm-settings.property.serial.stopbits">stopbits</entry><entry align="left">uint32</entry><entry align="left">1</entry><entry>Number of stop bits for communication on the serial port.  Either 1 or 2. The 1 in "8n1" for example.</entry></row>
   </tbody></tgroup></informaltable></refsect2>
-  <refsect2><title>sriov setting</title><para>SR-IOV settings..</para><informaltable><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
+  <refsect2><title>sriov setting</title><para>SR-IOV settings.</para><informaltable><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
     <row><entry align="left" id="nm-settings.property.sriov.autoprobe-drivers">autoprobe-drivers</entry><entry align="left">NMTernary (int32)</entry><entry align="left"/><entry>Whether to autoprobe virtual functions by a compatible driver. If set to NM_TERNARY_TRUE (1), the kernel will try to bind VFs to a compatible driver and if this succeeds a new network interface will be instantiated for each VF. If set to NM_TERNARY_FALSE (0), VFs will not be claimed and no network interfaces will be created for them. When set to NM_TERNARY_DEFAULT (-1), the global default is used; in case the global default is unspecified it is assumed to be NM_TERNARY_TRUE (1).</entry></row>
-    <row><entry align="left" id="nm-settings.property.sriov.total-vfs">total-vfs</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>The total number of virtual functions to create. Note that when the sriov setting is present NetworkManager enforces the number of virtual functions on the interface also when it is zero. To prevent any changes to SR-IOV parameters don't add a sriov setting to the connection.</entry></row>
+    <row><entry align="left" id="nm-settings.property.sriov.total-vfs">total-vfs</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>The total number of virtual functions to create. Note that when the sriov setting is present NetworkManager enforces the number of virtual functions on the interface (also when it is zero) during activation and resets it upon deactivation. To prevent any changes to SR-IOV parameters don't add a sriov setting to the connection.</entry></row>
     <row><entry align="left" id="nm-settings.property.sriov.vfs">vfs</entry><entry align="left">array of vardict</entry><entry align="left"/><entry>Array of virtual function descriptors. Each VF descriptor is a dictionary mapping attribute names to GVariant values. The 'index' entry is mandatory for each VF. When represented as string a VF is in the form: "INDEX [ATTR=VALUE[ ATTR=VALUE]...]". for example: "2 mac=00:11:22:33:44:55 spoof-check=true". Multiple VFs can be specified using a comma as separator. Currently the following attributes are supported: mac, spoof-check, trust, min-tx-rate, max-tx-rate, vlans. The "vlans" attribute is represented as a semicolon-separated list of VLAN descriptors, where each descriptor has the form "ID[.PRIORITY[.PROTO]]". PROTO can be either 'q' for 802.1Q (the default) or 'ad' for 802.1ad.</entry></row>
   </tbody></tgroup></informaltable></refsect2>
-  <refsect2><title>tc setting</title><para>Linux Traffic Control Settings..</para><informaltable><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
+  <refsect2><title>tc setting</title><para>Linux Traffic Control Settings.</para><informaltable><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
     <row><entry align="left" id="nm-settings.property.tc.qdiscs">qdiscs</entry><entry align="left">array of vardict</entry><entry align="left"/><entry>Array of TC queueing disciplines.</entry></row>
     <row><entry align="left" id="nm-settings.property.tc.tfilters">tfilters</entry><entry align="left">array of vardict</entry><entry align="left"/><entry>Array of TC traffic filters.</entry></row>
   </tbody></tgroup></informaltable></refsect2>
@@ -423,6 +431,9 @@
     <row><entry align="left" id="nm-settings.property.vpn.timeout">timeout</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>Timeout for the VPN service to establish the connection. Some services may take quite a long time to connect. Value of 0 means a default timeout, which is 60 seconds (unless overridden by vpn.timeout in configuration file). Values greater than zero mean timeout in seconds.</entry></row>
     <row><entry align="left" id="nm-settings.property.vpn.user-name">user-name</entry><entry align="left">string</entry><entry align="left"/><entry>If the VPN connection requires a user name for authentication, that name should be provided here.  If the connection is available to more than one user, and the VPN requires each user to supply a different name, then leave this property empty.  If this property is empty, NetworkManager will automatically supply the username of the user which requested the VPN connection.</entry></row>
   </tbody></tgroup></informaltable></refsect2>
+  <refsect2><title>vrf setting</title><para>VRF settings.</para><informaltable><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
+    <row><entry align="left" id="nm-settings.property.vrf.table">table</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>The routing table for this VRF.</entry></row>
+  </tbody></tgroup></informaltable></refsect2>
   <refsect2><title>vxlan setting</title><para>VXLAN Settings.</para><informaltable><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
     <row><entry align="left" id="nm-settings.property.vxlan.ageing">ageing</entry><entry align="left">uint32</entry><entry align="left">300</entry><entry>Specifies the lifetime in seconds of FDB entries learnt by the kernel.</entry></row>
     <row><entry align="left" id="nm-settings.property.vxlan.destination-port">destination-port</entry><entry align="left">uint32</entry><entry align="left">8472</entry><entry>Specifies the UDP destination port to communicate to the remote VXLAN tunnel endpoint.</entry></row>
@@ -469,11 +480,11 @@
   </tbody></tgroup></informaltable></refsect2>
   <refsect2><title>wireguard setting</title><para>WireGuard Settings.</para><informaltable><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
     <row><entry align="left" id="nm-settings.property.wireguard.fwmark">fwmark</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>The use of fwmark is optional and is by default off. Setting it to 0 disables it. Otherwise it is a 32-bit fwmark for outgoing packets. Note that "ip4-auto-default-route" or "ip6-auto-default-route" enabled, implies to automatically choose a fwmark.</entry></row>
-    <row><entry align="left" id="nm-settings.property.wireguard.ip4-auto-default-route">ip4-auto-default-route</entry><entry align="left">NMTernary (int32)</entry><entry align="left"/><entry>Whether to enable special handling of the IPv4 default route. If enabled, the IPv4 default route will be placed to a dedicated routing-table and two policy routing rules will be added. The fwmark number is also used as routing-table for the default-route, and if fwmark is zero, a unused fwmark/table is chosen automatically. This corresponds to what wg-quick does with Table=auto. Leaving this at the default will enable this option automatically if ipv4.never-default is not set and there are any peers that use a default-route as allowed-ips.</entry></row>
+    <row><entry align="left" id="nm-settings.property.wireguard.ip4-auto-default-route">ip4-auto-default-route</entry><entry align="left">NMTernary (int32)</entry><entry align="left"/><entry>Whether to enable special handling of the IPv4 default route. If enabled, the IPv4 default route from wireguard.peer-routes will be placed to a dedicated routing-table and two policy routing rules will be added. The fwmark number is also used as routing-table for the default-route, and if fwmark is zero, an unused fwmark/table is chosen automatically. This corresponds to what wg-quick does with Table=auto and what WireGuard calls "Improved Rule-based Routing". Note that for this automatism to work, you usually don't want to set ipv4.gateway, because that will result in a conflicting default route. Leaving this at the default will enable this option automatically if ipv4.never-default is not set and there are any peers that use a default-route as allowed-ips.</entry></row>
     <row><entry align="left" id="nm-settings.property.wireguard.ip6-auto-default-route">ip6-auto-default-route</entry><entry align="left">NMTernary (int32)</entry><entry align="left"/><entry>Like ip4-auto-default-route, but for the IPv6 default route.</entry></row>
     <row><entry align="left" id="nm-settings.property.wireguard.listen-port">listen-port</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>The listen-port. If listen-port is not specified, the port will be chosen randomly when the interface comes up.</entry></row>
     <row><entry align="left" id="nm-settings.property.wireguard.mtu">mtu</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>If non-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple fragments. If zero a default MTU is used. Note that contrary to wg-quick's MTU setting, this does not take into account the current routes at the time of activation.</entry></row>
-    <row><entry align="left" id="nm-settings.property.wireguard.peer-routes">peer-routes</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>Whether to automatically add routes for the AllowedIPs ranges of the peers. If TRUE (the default), NetworkManager will automatically add routes in the routing tables according to ipv4.route-table and ipv6.route-table. If FALSE, no such routes are added automatically. In this case, the user may want to configure static routes in ipv4.routes and ipv6.routes, respectively.</entry></row>
+    <row><entry align="left" id="nm-settings.property.wireguard.peer-routes">peer-routes</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>Whether to automatically add routes for the AllowedIPs ranges of the peers. If TRUE (the default), NetworkManager will automatically add routes in the routing tables according to ipv4.route-table and ipv6.route-table. Usually you want this automatism enabled. If FALSE, no such routes are added automatically. In this case, the user may want to configure static routes in ipv4.routes and ipv6.routes, respectively. Note that if the peer's AllowedIPs is "0.0.0.0/0" or "::/0" and the profile's ipv4.never-default or ipv6.never-default setting is enabled, the peer route for this peer won't be added automatically.</entry></row>
     <row><entry align="left" id="nm-settings.property.wireguard.peers">peers</entry><entry align="left">array of 'a{sv}'</entry><entry align="left"/><entry>Array of dictionaries for the WireGuard peers.</entry></row>
     <row><entry align="left" id="nm-settings.property.wireguard.private-key">private-key</entry><entry align="left">string</entry><entry align="left"/><entry>The 256 bit private-key in base64 encoding.</entry></row>
     <row><entry align="left" id="nm-settings.property.wireguard.private-key-flags">private-key-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "private-key" property. (see <xref linkend="secrets-flags"/> for flag values)</entry></row>
@@ -503,7 +514,7 @@
     <row><entry align="left" id="nm-settings.property.802-11-wireless-security.auth-alg">auth-alg</entry><entry align="left">string</entry><entry align="left"/><entry>When WEP is used (ie, key-mgmt = "none" or "ieee8021x") indicate the 802.11 authentication algorithm required by the AP here.  One of "open" for Open System, "shared" for Shared Key, or "leap" for Cisco LEAP.  When using Cisco LEAP (ie, key-mgmt = "ieee8021x" and auth-alg = "leap") the "leap-username" and "leap-password" properties must be specified.</entry></row>
     <row><entry align="left" id="nm-settings.property.802-11-wireless-security.fils">fils</entry><entry align="left">int32</entry><entry align="left">0</entry><entry>Indicates whether Fast Initial Link Setup (802.11ai) must be enabled for the connection.  One of NM_SETTING_WIRELESS_SECURITY_FILS_DEFAULT (0) (use global default value), NM_SETTING_WIRELESS_SECURITY_FILS_DISABLE (1) (disable FILS), NM_SETTING_WIRELESS_SECURITY_FILS_OPTIONAL (2) (enable FILS if the supplicant and the access point support it) or NM_SETTING_WIRELESS_SECURITY_FILS_REQUIRED (3) (enable FILS and fail if not supported).  When set to NM_SETTING_WIRELESS_SECURITY_FILS_DEFAULT (0) and no global default is set, FILS will be optionally enabled.</entry></row>
     <row><entry align="left" id="nm-settings.property.802-11-wireless-security.group">group</entry><entry align="left">array of string</entry><entry align="left"/><entry>A list of group/broadcast encryption algorithms which prevents connections to Wi-Fi networks that do not utilize one of the algorithms in the list.  For maximum compatibility leave this property empty.  Each list element may be one of "wep40", "wep104", "tkip", or "ccmp".</entry></row>
-    <row><entry align="left" id="nm-settings.property.802-11-wireless-security.key-mgmt">key-mgmt</entry><entry align="left">string</entry><entry align="left"/><entry>Key management used for the connection.  One of "none" (WEP), "ieee8021x" (Dynamic WEP), "wpa-psk" (infrastructure WPA-PSK), "sae" (SAE) or "wpa-eap" (WPA-Enterprise).  This property must be set for any Wi-Fi connection that uses security.</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-11-wireless-security.key-mgmt">key-mgmt</entry><entry align="left">string</entry><entry align="left"/><entry>Key management used for the connection.  One of "none" (WEP), "ieee8021x" (Dynamic WEP), "wpa-psk" (infrastructure WPA-PSK), "sae" (SAE), "owe" (Opportunistic Wireless Encryption) or "wpa-eap" (WPA-Enterprise).  This property must be set for any Wi-Fi connection that uses security.</entry></row>
     <row><entry align="left" id="nm-settings.property.802-11-wireless-security.leap-password">leap-password</entry><entry align="left">string</entry><entry align="left"/><entry>The login password for legacy LEAP connections (ie, key-mgmt = "ieee8021x" and auth-alg = "leap").</entry></row>
     <row><entry align="left" id="nm-settings.property.802-11-wireless-security.leap-password-flags">leap-password-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "leap-password" property. (see <xref linkend="secrets-flags"/> for flag values)</entry></row>
     <row><entry align="left" id="nm-settings.property.802-11-wireless-security.leap-username">leap-username</entry><entry align="left">string</entry><entry align="left"/><entry>The login username for legacy LEAP connections (ie, key-mgmt = "ieee8021x" and auth-alg = "leap").</entry></row>
diff --git a/man/nmcli-examples.7 b/man/nmcli-examples.7
index 18225b04..2043b483 100644
--- a/man/nmcli-examples.7
+++ b/man/nmcli-examples.7
@@ -2,12 +2,12 @@
 .\"     Title: nmcli-examples
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
-.\"      Date: 03/12/2020
+.\"      Date: 05/08/2020
 .\"    Manual: Examples
-.\"    Source: NetworkManager 1.22.10
+.\"    Source: NetworkManager 1.24.0
 .\"  Language: English
 .\"
-.TH "NMCLI\-EXAMPLES" "7" "" "NetworkManager 1\&.22\&.10" "Examples"
+.TH "NMCLI\-EXAMPLES" "7" "" "NetworkManager 1\&.24\&.0" "Examples"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -73,7 +73,29 @@ option for displaying different columns\&.
 \fBnmcli \-f all dev wifi list\fR
 will show all of them\&.
 .PP
-\fBExample\ \&2.\ \&Showing general information and properties for a Wi\-Fi interface\fR
+\fBExample\ \&2.\ \&Connect to a password\-protected wifi network\fR
+.sp
+.if n \{\
+.RS 4
+.\}
+.nf
+$ \fBnmcli device wifi connect "$SSID" password "$PASSWORD"\fR
+.fi
+.if n \{\
+.RE
+.\}
+.sp
+.if n \{\
+.RS 4
+.\}
+.nf
+$ \fBnmcli \-\-ask device wifi connect "$SSID"\fR
+.fi
+.if n \{\
+.RE
+.\}
+.PP
+\fBExample\ \&3.\ \&Showing general information and properties for a Wi\-Fi interface\fR
 .sp
 .if n \{\
 .RS 4
@@ -120,7 +142,7 @@ WIFI\-PROPERTIES\&.ADHOC:    yes
 .PP
 This command shows information about a Wi\-Fi device\&.
 .PP
-\fBExample\ \&3.\ \&Listing NetworkManager polkit permissions\fR
+\fBExample\ \&4.\ \&Listing NetworkManager polkit permissions\fR
 .sp
 .if n \{\
 .RS 4
@@ -164,7 +186,7 @@ command can display description for polkit actions\&.
 .sp
 More information about polkit can be found at http://www\&.freedesktop\&.org/wiki/Software/polkit\&.
 .PP
-\fBExample\ \&4.\ \&Listing NetworkManager log level and domains\fR
+\fBExample\ \&5.\ \&Listing NetworkManager log level and domains\fR
 .sp
 .if n \{\
 .RS 4
@@ -183,7 +205,7 @@ B,DISPATCH
 .PP
 This command shows current NetworkManager logging status\&.
 .PP
-\fBExample\ \&5.\ \&Changing NetworkManager logging\fR
+\fBExample\ \&6.\ \&Changing NetworkManager logging\fR
 .sp
 .if n \{\
 .RS 4
@@ -200,7 +222,7 @@ The first command makes NetworkManager log in DEBUG level, and only for CORE, ET
 \fBNetworkManager.conf\fR(5)
 manual page for available logging levels and domains\&.
 .PP
-\fBExample\ \&6.\ \&Activating a VPN connection profile requiring interactive password input\fR
+\fBExample\ \&7.\ \&Activating a VPN connection profile requiring interactive password input\fR
 .sp
 .if n \{\
 .RS 4
@@ -218,7 +240,7 @@ are set to \*(Aq0x02\*(Aq (\*(Aqalways ask\*(Aq, see
 \fBnm-settings\fR(5)
 )\&. This is particularly useful for OTP based VPNs, as the user needs to be prompted for the password each time the connection is activated\&.
 .PP
-\fBExample\ \&7.\ \&Adding a bonding master and two slave connection profiles\fR
+\fBExample\ \&8.\ \&Adding a bonding master and two slave connection profiles\fR
 .sp
 .if n \{\
 .RS 4
@@ -242,7 +264,7 @@ mode\&. The next two commands add slaves connections, both enslaved to
 interface, the second to
 \fIeth2\fR\&.
 .PP
-\fBExample\ \&8.\ \&Adding a team master and two slave connection profiles\fR
+\fBExample\ \&9.\ \&Adding a team master and two slave connection profiles\fR
 .sp
 .if n \{\
 .RS 4
@@ -284,7 +306,7 @@ will use its default configuration\&. You will activate the whole setup by activ
 .sp
 By default, the created profiles are marked for auto\-activation\&. But if another connection has been activated on the device, the new profile won\*(Aqt activate automatically and you need to activate it manually\&.
 .PP
-\fBExample\ \&9.\ \&Adding a bridge and two slave profiles\fR
+\fBExample\ \&10.\ \&Adding a bridge and two slave profiles\fR
 .sp
 .if n \{\
 .RS 4
@@ -306,7 +328,7 @@ This example demonstrates adding a bridge master connection and two slaves\&. Th
 interface, the second to
 \fIens4\fR\&. The last command will disable 802\&.1D STP for the TowerBridge profile\&.
 .PP
-\fBExample\ \&10.\ \&Adding an ethernet connection profile with manual IP configuration\fR
+\fBExample\ \&11.\ \&Adding an ethernet connection profile with manual IP configuration\fR
 .sp
 .if n \{\
 .RS 4
@@ -330,7 +352,7 @@ that is bound to interface name
 \fIcon show\fR
 command displays the profile so that all parameters can be reviewed\&.
 .PP
-\fBExample\ \&11.\ \&Convenient field values retrieval for scripting\fR
+\fBExample\ \&12.\ \&Convenient field values retrieval for scripting\fR
 .sp
 .if n \{\
 .RS 4
@@ -370,7 +392,7 @@ This example shows retrieval of ip4 connection field values via the \-\-get\-val
 \fBnmcli\fR(1)
 manual page for more customized output\&.
 .PP
-\fBExample\ \&12.\ \&Adding an Ethernet connection and configuring SR\-IOV VFs\fR
+\fBExample\ \&13.\ \&Adding an Ethernet connection and configuring SR\-IOV VFs\fR
 .sp
 .if n \{\
 .RS 4
@@ -393,7 +415,7 @@ and
 \fIspoof\-check\fR
 features respectively enabled and disabled\&. VF number 2 has a maximux transmission rate of 20Mbps\&. The kernel is instructed to not automatically instantiate a network interface for the VFs\&.
 .PP
-\fBExample\ \&13.\ \&Escaping colon characters in tabular mode\fR
+\fBExample\ \&14.\ \&Escaping colon characters in tabular mode\fR
 .sp
 .if n \{\
 .RS 4
@@ -412,7 +434,7 @@ nager/ActiveConnection/9
 .PP
 This example shows escaping colon characters in tabular mode\&. It may be useful for script processing, because \*(Aq:\*(Aq is used as a field separator\&.
 .PP
-\fBExample\ \&14.\ \&nmcli usage in a NetworkManager dispatcher script to make Ethernet and Wi\-Fi mutually exclusive\fR
+\fBExample\ \&15.\ \&nmcli usage in a NetworkManager dispatcher script to make Ethernet and Wi\-Fi mutually exclusive\fR
 .sp
 .if n \{\
 .RS 4
@@ -450,7 +472,7 @@ manual page for more information about NetworkManager dispatcher scripts\&.
 .PP
 \fBExample sessions of interactive connection editor\fR
 .PP
-\fBExample\ \&15.\ \&Adding an ethernet connection profile in interactive editor (a)\fR
+\fBExample\ \&16.\ \&Adding an ethernet connection profile in interactive editor (a)\fR
 .sp
 .if n \{\
 .RS 4
@@ -690,7 +712,7 @@ nmcli> \fBquit\fR
 .PP
 Example session in the nmcli interactive connection editor\&. The scenario creates an Ethernet connection profile with static addressing (IPs and DNS)\&.
 .PP
-\fBExample\ \&16.\ \&Bluetooth connection profiles\fR
+\fBExample\ \&17.\ \&Bluetooth connection profiles\fR
 .PP
 NetworkManger supports both connecting to NAP and DUN devices as a client\&. It also supports sharing the network via a NAP server\&.
 .PP
diff --git a/man/nmcli-examples.xml b/man/nmcli-examples.xml
index 53e003fb..a4dfc3d7 100644
--- a/man/nmcli-examples.xml
+++ b/man/nmcli-examples.xml
@@ -87,6 +87,11 @@
       </para>
     </example>
 
+    <example><title>Connect to a password-protected wifi network</title>
+<screen><prompt>$ </prompt><userinput>nmcli device wifi connect "$SSID" password "$PASSWORD"</userinput></screen>
+<screen><prompt>$ </prompt><userinput>nmcli --ask device wifi connect "$SSID"</userinput></screen>
+    </example>
+
     <example><title>Showing general information and properties for a Wi-Fi interface</title>
 <screen><prompt>$ </prompt><userinput>nmcli -p -f general,wifi-properties device show wlan0</userinput>
 ===========================================================================
diff --git a/man/nmcli.1 b/man/nmcli.1
index dbdd4c3a..9a941fd9 100644
--- a/man/nmcli.1
+++ b/man/nmcli.1
@@ -2,12 +2,12 @@
 .\"     Title: nmcli
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
-.\"      Date: 03/12/2020
+.\"      Date: 05/08/2020
 .\"    Manual: General Commands Manual
-.\"    Source: NetworkManager 1.22.10
+.\"    Source: NetworkManager 1.24.0
 .\"  Language: English
 .\"
-.TH "NMCLI" "1" "" "NetworkManager 1\&.22\&.10" "General Commands Manual"
+.TH "NMCLI" "1" "" "NetworkManager 1\&.24\&.0" "General Commands Manual"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -634,6 +634,11 @@ or
 can be used\&.
 .RE
 .PP
+\fBmodify\fR [\fB\-\-temporary\fR] [\fBid\fR | \fBuuid\fR | \fBpath\fR] \fIID\fR \fBremove\fR\ \fIsetting\fR
+.RS 4
+Removes a setting from the connection profile\&.
+.RE
+.PP
 \fBadd\fR [\fBsave\fR\ {yes\ |\ no}] {\fIoption\fR\ \fIvalue\fR\ |\ [+|\-]\fIsetting\fR\&.\fIproperty\fR\ \fIvalue\fR}...
 .RS 4
 Create a new connection using specified properties\&.
@@ -1027,8 +1032,7 @@ command\&.
 .PP
 \fBreload\fR
 .RS 4
-Reload all connection files from disk\&. NetworkManager does not monitor changes to connection files by default\&. So you need to use this command in order to tell NetworkManager to re\-read the connection profiles from disk when a change was made to them\&. However, the auto\-loading feature can be enabled and then NetworkManager will reload connection files any time they change (monitor\-connection\-files=true in
-\fBNetworkManager.conf\fR(5))\&.
+Reload all connection files from disk\&. NetworkManager does not monitor changes to connection\&. So you need to use this command in order to tell NetworkManager to re\-read the connection profiles from disk when a change was made to them\&.
 .RE
 .PP
 \fBload\fR \fIfilename\fR...
diff --git a/man/nmcli.xml b/man/nmcli.xml
index e0e8b3ff..cded9ab6 100644
--- a/man/nmcli.xml
+++ b/man/nmcli.xml
@@ -908,6 +908,23 @@
         </listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term>
+          <command>modify</command>
+          <arg><option>--temporary</option></arg>
+          <group>
+            <arg choice='plain'><option>id</option></arg>
+            <arg choice='plain'><option>uuid</option></arg>
+            <arg choice='plain'><option>path</option></arg>
+          </group>
+          <arg choice='plain'><replaceable>ID</replaceable></arg>
+          <arg choice='plain'><option>remove</option> <replaceable>setting</replaceable></arg>
+        </term>
+
+        <listitem>
+          <para>Removes a setting from the connection profile.</para>
+        </listitem>
+      </varlistentry>
 
       <varlistentry>
         <term>
@@ -1130,13 +1147,10 @@
 
         <listitem>
           <para>Reload all connection files from disk.
-          NetworkManager does not monitor changes to connection
-          files by default. So you need to use this command in order to tell
+          NetworkManager does not monitor changes to connection.
+          So you need to use this command in order to tell
           NetworkManager to re-read the connection profiles from
-          disk when a change was made to them. However, the auto-loading feature can be
-          enabled and then NetworkManager will reload connection
-          files any time they change (monitor-connection-files=true in
-          <link linkend='NetworkManager.conf'><link linkend='NetworkManager.conf'><citerefentry><refentrytitle>NetworkManager.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry></link></link>).
+          disk when a change was made to them.
           </para>
         </listitem>
       </varlistentry>
diff --git a/man/nmtui.1 b/man/nmtui.1
index 2875ee8a..24a58f17 100644
--- a/man/nmtui.1
+++ b/man/nmtui.1
@@ -2,12 +2,12 @@
 .\"     Title: nmtui
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
-.\"      Date: 03/12/2020
+.\"      Date: 05/08/2020
 .\"    Manual: General Commands Manual
-.\"    Source: NetworkManager 1.22.10
+.\"    Source: NetworkManager 1.24.0
 .\"  Language: English
 .\"
-.TH "NMTUI" "1" "" "NetworkManager 1\&.22\&.10" "General Commands Manual"
+.TH "NMTUI" "1" "" "NetworkManager 1\&.24\&.0" "General Commands Manual"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------