New upstream version 1.15.2

22 files changed, 625 insertions, 352 deletions

diff --git a/man/NetworkManager.8 b/man/NetworkManager.8
index 5cf80c19..1992f827 100644
--- a/man/NetworkManager.8
+++ b/man/NetworkManager.8
@@ -2,12 +2,12 @@
 .\"     Title: NetworkManager
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
-.\"      Date: 10/24/2018
+.\"      Date: 01/22/2019
 .\"    Manual: Network management daemons
-.\"    Source: NetworkManager 1.14.4
+.\"    Source: NetworkManager 1.15.2
 .\"  Language: English
 .\"
-.TH "NETWORKMANAGER" "8" "" "NetworkManager 1\&.14\&.4" "Network management daemons"
+.TH "NETWORKMANAGER" "8" "" "NetworkManager 1\&.15\&.2" "Network management daemons"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -34,7 +34,7 @@ NetworkManager \- network management daemon
 \fBNetworkManager \fR\fB[OPTIONS...]\fR
 .SH "DESCRIPTION"
 .PP
-The NetworkManager daemon attempts to make networking configuration and operation as painless and automatic as possible by managing the primary network connection and other network interfaces, like Ethernet, WiFi, and Mobile Broadband devices\&. NetworkManager will connect any network device when a connection for that device becomes available, unless that behavior is disabled\&. Information about networking is exported via a D\-Bus interface to any interested application, providing a rich API with which to inspect and control network settings and operation\&.
+The NetworkManager daemon attempts to make networking configuration and operation as painless and automatic as possible by managing the primary network connection and other network interfaces, like Ethernet, Wi\-Fi, and Mobile Broadband devices\&. NetworkManager will connect any network device when a connection for that device becomes available, unless that behavior is disabled\&. Information about networking is exported via a D\-Bus interface to any interested application, providing a rich API with which to inspect and control network settings and operation\&.
 .SH "DISPATCHER SCRIPTS"
 .PP
 NetworkManager will execute scripts in the
@@ -305,9 +305,14 @@ device manager is used for the network device discovery\&. The following propert
 .PP
 \fINM_UNMANAGED\fR
 .RS 4
-No default connection will be created and automatic activation will not be attempted when this property of a device is set to a true value ("1" or "true")\&. You will still be able to attach a connection to the device manually or observe externally added configuration such as addresses or routes\&.
-.sp
-Create an udev rule that sets this property to prevent NetworkManager from interfering with virtual Ethernet device interfaces that are managed by virtualization tools\&.
+If set to
+"1"
+or
+"true", the device is configured as unmanaged by NetworkManager\&. Note that the user still can explicitly overrule this configuration via means like
+\fBnmcli device set "$DEVICE" managed yes\fR
+or
+"device*\&.managed=1"
+in NetworkManager\&.conf\&.
 .RE
 .SH "SIGNALS"
 .PP
diff --git a/man/NetworkManager.conf.5 b/man/NetworkManager.conf.5
index a27b8c3e..54c912ec 100644
--- a/man/NetworkManager.conf.5
+++ b/man/NetworkManager.conf.5
@@ -2,12 +2,12 @@
 .\"     Title: NetworkManager.conf
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
-.\"      Date: 10/24/2018
+.\"      Date: 01/22/2019
 .\"    Manual: Configuration
-.\"    Source: NetworkManager 1.14.4
+.\"    Source: NetworkManager 1.15.2
 .\"  Language: English
 .\"
-.TH "NETWORKMANAGER\&.CONF" "5" "" "NetworkManager 1\&.14\&.4" "Configuration"
+.TH "NETWORKMANAGER\&.CONF" "5" "" "NetworkManager 1\&.15\&.2" "Configuration"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -121,6 +121,16 @@ plugin is always appended to the end of this list (if it doesn\*(Aqt already app
 \fImonitor\-connection\-files\fR
 .RS 4
 Whether the configured settings plugin(s) should set up file monitors and immediately pick up changes made to connection files while NetworkManager is running\&. This is disabled by default; NetworkManager will only read the connection files at startup, and when explicitly requested via the ReloadConnections D\-Bus call\&. If this key is set to \*(Aqtrue\*(Aq, then NetworkManager will reload connection files any time they changed\&. Automatic reloading is not advised because there are race conditions involved and it depends on the way how the editor updates the file\&. In some situations, NetworkManager might first delete and add the connection anew, instead of updating the existing one\&. Also, NetworkManager might pick up incomplete settings while the user is still editing the files\&.
+.sp
+Note that neither this setting nor restarting the NetworkManager daemon is the advised way to reload connection profiles from disk\&. Instead, after modifying the files reload them with
+\fBnmcli connection reload\fR
+or
+\fBnmcli connection load "$FILENAME"\fR\&. Even better, instead of modifying files directly, use NetworkManager tools like
+\fBnmcli\fR,
+\fBnmtui\fR
+or the GUI\&.
+.sp
+This setting is deprecated and will have no effect in the future\&.
 .RE
 .PP
 \fIauth\-polkit\fR
@@ -158,7 +168,7 @@ Specify devices for which NetworkManager shouldn\*(Aqt create default wired conn
 to apply to all devices\&.
 .sp
 When the default wired connection is deleted or saved to a new persistent connection by a plugin, the device is added to a list in the file
-/run/NetworkManager/no\-auto\-default\&.state
+/var/lib/NetworkManager/no\-auto\-default\&.state
 to prevent creating the default connection for that device again\&.
 .sp
 See
@@ -203,7 +213,7 @@ for the syntax how to specify a device\&.
 \fIconfigure\-and\-quit\fR
 .RS 4
 When set to \*(Aqtrue\*(Aq, NetworkManager quits after performing initial network configuration but spawns small helpers to preserve DHCP leases and IPv6 addresses\&. This is useful in environments where network setup is more or less static or it is desirable to save process time but still handle some dynamic configurations\&. When this option is
-true, network configuration for WiFi, WWAN, Bluetooth, ADSL, and PPPoE interfaces cannot be preserved due to their use of external services, and these devices will be deconfigured when NetworkManager quits even though other interface\*(Aqs configuration may be preserved\&. Also, to preserve DHCP addresses the \*(Aqdhcp\*(Aq option must be set to \*(Aqinternal\*(Aq\&. The default value of the \*(Aqconfigure\-and\-quit\*(Aq option is \*(Aqfalse\*(Aq, meaning that NetworkManager will continue running after initial network configuration and continue responding to system and hardware events, D\-Bus requests, and user commands\&.
+true, network configuration for Wi\-Fi, WWAN, Bluetooth, ADSL, and PPPoE interfaces cannot be preserved due to their use of external services, and these devices will be deconfigured when NetworkManager quits even though other interface\*(Aqs configuration may be preserved\&. Also, to preserve DHCP addresses the \*(Aqdhcp\*(Aq option must be set to \*(Aqinternal\*(Aq\&. The default value of the \*(Aqconfigure\-and\-quit\*(Aq option is \*(Aqfalse\*(Aq, meaning that NetworkManager will continue running after initial network configuration and continue responding to system and hardware events, D\-Bus requests, and user commands\&.
 .RE
 .PP
 \fIhostname\-mode\fR
@@ -219,7 +229,9 @@ none: NetworkManager will not manage the transient hostname and will never set i
 .PP
 \fIdns\fR
 .RS 4
-Set the DNS (resolv\&.conf) processing mode\&. If the key is unspecified,
+Set the DNS processing mode\&.
+.sp
+If the key is unspecified,
 default
 is used, unless
 /etc/resolv\&.conf
@@ -240,14 +252,29 @@ dnsmasq: NetworkManager will run dnsmasq as a local caching nameserver, using a
 resolv\&.conf
 to point to the local nameserver\&. It is possible to pass custom options to the dnsmasq instance by adding them to files in the "/etc/NetworkManager/dnsmasq\&.d/" directory\&. Note that when multiple upstream servers are available, dnsmasq will initially contact them in parallel and then use the fastest to respond, probing again other servers after some time\&. This behavior can be modified passing the \*(Aqall\-servers\*(Aq or \*(Aqstrict\-order\*(Aq options to dnsmasq (see the manual page for more details)\&.
 .sp
+systemd\-resolved: NetworkManager will push the DNS configuration to systemd\-resolved
+.sp
 unbound: NetworkManager will talk to unbound and dnssec\-triggerd, providing a "split DNS" configuration with DNSSEC support\&.
 /etc/resolv\&.conf
 will be managed by dnssec\-trigger daemon\&.
 .sp
-systemd\-resolved: NetworkManager will push the DNS configuration to systemd\-resolved
-.sp
 none: NetworkManager will not modify resolv\&.conf\&. This implies
 rc\-manager\ \&unmanaged
+.sp
+Note that the plugins
+dnsmasq,
+systemd\-resolved
+and
+unbound
+are caching local nameservers\&. Hence, when NetworkManager writes
+/var/run/NetworkManager/resolv\&.conf
+and
+/etc/resolv\&.conf
+(according to
+rc\-manager
+setting below), the name server there will be localhost only\&. NetworkManager also writes a file
+/var/run/NetworkManager/no\-stub\-resolv\&.conf
+that contains the original name servers pushed to the DNS plugin\&.
 .RE
 .PP
 \fIrc\-manager\fR
@@ -281,6 +308,26 @@ none: deprecated alias for
 symlink\&.
 .RE
 .PP
+\fIsystemd\-resolved\fR
+.RS 4
+Send the connection DNS configuration to
+systemd\-resolved\&. Defaults to "true"\&.
+.sp
+Note that this setting is complementary to the
+\fIdns\fR
+setting\&. You can keep this enabled while using
+\fIdns\fR
+set to another DNS plugin alongside
+systemd\-resolved, or
+\fIdns\fR
+set to
+systemd\-resolved
+to configure the system resolver to use
+systemd\-resolved\&.
+.sp
+If systemd\-resolved is enabled, the connectivity check resolves the hostname per\-device\&.
+.RE
+.PP
 \fIdebug\fR
 .RS 4
 Comma separated list of options to aid debugging\&. This value will be combined with the environment variable
@@ -583,6 +630,16 @@ ipv6\&.ip6\-privacy=0
 Not all properties can be overwritten, only the following properties are supported to have their default values configured (see
 \fBnm-settings\fR(5)
 for details)\&. A default value is only consulted if the corresponding per\-connection value explicitly allows for that\&.
+
+
+.PP
+\fI802\-1x\&.auth\-timeout\fR
+.RS 4
+.RE
+.PP
+\fIcdma\&.mtu\fR
+.RS 4
+.RE
 .PP
 \fIconnection\&.auth\-retries\fR
 .RS 4
@@ -627,6 +684,10 @@ If configured explicitly to 0, the MTU is not reconfigured during device activat
 .RS 4
 .RE
 .PP
+\fIgsm\&.mtu\fR
+.RS 4
+.RE
+.PP
 \fIinfiniband\&.mtu\fR
 .RS 4
 If configured explicitly to 0, the MTU is not reconfigured during device activation unless it is required due to IPv6 constraints\&. If left unspecified, a DHCP/IPv6 SLAAC provided value is used or the MTU is left unspecified on activation\&.
@@ -650,6 +711,11 @@ If configured explicitly to 0, the MTU is not reconfigured during device activat
 If left unspecified, the default value for the interface type is used\&.
 .RE
 .PP
+\fIipv4\&.dns\-priority\fR
+.RS 4
+If unspecified or zero, use 50 for VPN profiles and 100 for other profiles\&.
+.RE
+.PP
 \fIipv4\&.route\-metric\fR
 .RS 4
 .RE
@@ -669,6 +735,11 @@ If left unspecified, it defaults to "lease"\&.
 If left unspecified, the default value for the interface type is used\&.
 .RE
 .PP
+\fIipv6\&.dns\-priority\fR
+.RS 4
+If unspecified or zero, use 50 for VPN profiles and 100 for other profiles\&.
+.RE
+.PP
 \fIipv6\&.ip6\-privacy\fR
 .RS 4
 If
@@ -729,6 +800,11 @@ If left unspecified, the default value "optional" will be used\&.
 .RS 4
 If left unspecified, the default value "optional" will be used\&.
 .RE
+.PP
+\fIwifi\&.wake\-on\-wlan\fR
+.RS 4
+.RE
+
 .SS "Sections"
 .PP
 You can configure multiple
@@ -1004,7 +1080,7 @@ enable=env:TAG1
 .RE
 .\}
 .sp
-More then one match can be specified\&. The configuration will be enabled if one of the predicates matches ("or")\&. The special prefix "except:" can be used to negate the match\&. Note that if one except\-predicate matches, the entire configuration will be disabled\&. In other words, a except predicate always wins over other predicates\&.
+More then one match can be specified\&. The configuration will be enabled if one of the predicates matches ("or")\&. The special prefix "except:" can be used to negate the match\&. Note that if one except\-predicate matches, the entire configuration will be disabled\&. In other words, a except predicate always wins over other predicates\&. If the setting only consists of "except:" matches and none of the negative conditions are satisfied, the configuration is still enabled\&.
 .sp
 .if n \{\
 .RS 4
@@ -1161,12 +1237,22 @@ driver:DRIVER
 Match the device driver as reported by "nmcli \-f GENERAL\&.DRIVER,GENERAL\&.DRIVER\-VERSION device show"\&. "DRIVER" must match the driver name exactly and does not support globbing\&. Optionally, a driver version may be specified separated by \*(Aq/\*(Aq\&. Globbing is supported for the version\&.
 .RE
 .PP
+dhcp\-plugin:DHCP
+.RS 4
+Match the configured DHCP plugin "main\&.dhcp"\&.
+.RE
+.PP
 except:SPEC
 .RS 4
 Negative match of a device\&.
 SPEC
 must be explicitly qualified with a prefix such as
 interface\-name:\&. A negative match has higher priority then the positive matches above\&.
+.sp
+If there is a list consisting only of negative matches, the behavior is the same as if there is also match\-all\&. That means, if none of all the negative matches is satisfied, the overall result is still a positive match\&. That means,
+"except:interface\-name:eth0"
+is the same as
+"*,except:interface\-name:eth0"\&.
 .RE
 .PP
 SPEC[,;]SPEC
diff --git a/man/NetworkManager.conf.xml b/man/NetworkManager.conf.xml
index 87cf0016..e22aa20a 100644
--- a/man/NetworkManager.conf.xml
+++ b/man/NetworkManager.conf.xml
@@ -166,6 +166,15 @@ plugins-=remove-me
         In some situations, NetworkManager might first delete and add the
         connection anew, instead of updating the existing one. Also, NetworkManager
         might pick up incomplete settings while the user is still editing the files.
+        </para><para>
+        Note that neither this setting nor restarting the NetworkManager daemon
+        is the advised way to reload connection profiles from disk. Instead, after
+        modifying the files reload them with <command>nmcli connection reload</command>
+        or <command>nmcli connection load "$FILENAME"</command>. Even better,
+        instead of modifying files directly, use NetworkManager tools like
+        <command>nmcli</command>, <command>nmtui</command> or the GUI.
+        </para><para>
+        This setting is deprecated and will have no effect in the future.
         </para></listitem>
       </varlistentry>
       <varlistentry>
@@ -204,7 +213,7 @@ plugins-=remove-me
         <para>When the default wired connection is deleted or saved
         to a new persistent connection by a plugin, the device is
         added to a list in the file
-        <filename>/run/NetworkManager/no-auto-default.state</filename>
+        <filename>&nmstatedir;/no-auto-default.state</filename>
         to prevent creating the default connection for that device
         again.</para>
         <para>See <xref linkend="device-spec"/> for the syntax how to
@@ -262,7 +271,7 @@ no-auto-default=*
             environments where network setup is more or less static or it is
             desirable to save process time but still handle some dynamic
             configurations.  When this option is <literal>true</literal>,
-            network configuration for WiFi, WWAN, Bluetooth, ADSL, and PPPoE
+            network configuration for Wi-Fi, WWAN, Bluetooth, ADSL, and PPPoE
             interfaces cannot be preserved due to their use of external
             services, and these devices will be deconfigured when NetworkManager
             quits even though other interface's configuration may be preserved.
@@ -306,8 +315,8 @@ no-auto-default=*
       </varlistentry>
       <varlistentry>
         <term><varname>dns</varname></term>
-        <listitem><para>Set the DNS (<filename>resolv.conf</filename>) processing mode.
-        If the key is unspecified, <literal>default</literal> is used,
+        <listitem><para>Set the DNS processing mode.</para>
+        <para>If the key is unspecified, <literal>default</literal> is used,
         unless <filename>/etc/resolv.conf</filename> is a symlink to
         <filename>/run/systemd/resolve/stub-resolv.conf</filename>,
         <filename>/run/systemd/resolve/resolv.conf</filename>,
@@ -331,15 +340,23 @@ no-auto-default=*
         after some time. This behavior can be modified passing the
         'all-servers' or 'strict-order' options to dnsmasq (see the
         manual page for more details).</para>
+        <para><literal>systemd-resolved</literal>: NetworkManager will
+        push the DNS configuration to systemd-resolved</para>
         <para><literal>unbound</literal>: NetworkManager will talk
         to unbound and dnssec-triggerd, providing a "split DNS"
         configuration with DNSSEC support. <filename>/etc/resolv.conf</filename>
         will be managed by dnssec-trigger daemon.</para>
-        <para><literal>systemd-resolved</literal>: NetworkManager will
-        push the DNS configuration to systemd-resolved</para>
         <para><literal>none</literal>: NetworkManager will not
         modify resolv.conf. This implies
         <literal>rc-manager</literal>&nbsp;<literal>unmanaged</literal></para>
+
+        <para>Note that the plugins <literal>dnsmasq</literal>, <literal>systemd-resolved</literal>
+        and <literal>unbound</literal> are caching local nameservers.
+        Hence, when NetworkManager writes <filename>&nmrundir;/resolv.conf</filename>
+        and <filename>/etc/resolv.conf</filename> (according to <literal>rc-manager</literal>
+        setting below), the name server there will be localhost only.
+        NetworkManager also writes a file <filename>&nmrundir;/no-stub-resolv.conf</filename>
+        that contains the original name servers pushed to the DNS plugin.</para>
         </listitem>
       </varlistentry>
 
@@ -380,6 +397,22 @@ no-auto-default=*
       </varlistentry>
 
       <varlistentry>
+        <term><varname>systemd-resolved</varname></term>
+        <listitem><para>Send the connection DNS configuration to
+        <literal>systemd-resolved</literal>. Defaults to "<literal>true</literal>".
+        </para>
+        <para>Note that this setting is complementary to the
+        <varname>dns</varname> setting. You can keep this enabled while using
+        <varname>dns</varname> set to another DNS plugin alongside
+        <literal>systemd-resolved</literal>, or <varname>dns</varname> set to
+        <literal>systemd-resolved</literal> to configure the system resolver to use
+        <literal>systemd-resolved</literal>.</para>
+        <para>If systemd-resolved is enabled, the connectivity check resolves the
+        hostname per-device.</para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
         <term><varname>debug</varname></term>
         <listitem><para>Comma separated list of options to aid
         debugging. This value will be combined with the environment
@@ -641,8 +674,16 @@ ipv6.ip6-privacy=0
       (see <link linkend='nm-settings'><citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum></citerefentry></link> for details).
       A default value is only consulted if the corresponding per-connection value
       explicitly allows for that.
+      <!-- The following comment is used by check-config-options.sh, don't remove it. -->
+      <!-- start connection defaults -->
       <variablelist>
         <varlistentry>
+          <term><varname>802-1x.auth-timeout</varname></term>
+        </varlistentry>
+        <varlistentry>
+          <term><varname>cdma.mtu</varname></term>
+        </varlistentry>
+        <varlistentry>
           <term><varname>connection.auth-retries</varname></term>
           <listitem><para>If left unspecified, the default value is 3 tries before failing the connection.
           </para></listitem>
@@ -677,6 +718,9 @@ ipv6.ip6-privacy=0
           <term><varname>ethernet.wake-on-lan</varname></term>
         </varlistentry>
         <varlistentry>
+          <term><varname>gsm.mtu</varname></term>
+        </varlistentry>
+        <varlistentry>
           <term><varname>infiniband.mtu</varname></term>
           <listitem><para>If configured explicitly to 0, the MTU is not reconfigured during device activation unless it is required due to IPv6 constraints. If left unspecified, a DHCP/IPv6 SLAAC provided value is used or the MTU is left unspecified on activation.</para></listitem>
         </varlistentry>
@@ -696,6 +740,11 @@ ipv6.ip6-privacy=0
            the interface type is used.</para></listitem>
         </varlistentry>
         <varlistentry>
+          <term><varname>ipv4.dns-priority</varname></term>
+          <listitem><para>If unspecified or zero, use 50 for VPN profiles
+           and 100 for other profiles.</para></listitem>
+        </varlistentry>
+        <varlistentry>
           <term><varname>ipv4.route-metric</varname></term>
         </varlistentry>
         <varlistentry>
@@ -715,6 +764,11 @@ ipv6.ip6-privacy=0
            the interface type is used.</para></listitem>
         </varlistentry>
         <varlistentry>
+          <term><varname>ipv6.dns-priority</varname></term>
+          <listitem><para>If unspecified or zero, use 50 for VPN profiles
+           and 100 for other profiles.</para></listitem>
+        </varlistentry>
+        <varlistentry>
           <term><varname>ipv6.ip6-privacy</varname></term>
           <listitem><para>If <literal>ipv6.ip6-privacy</literal> is unset, use the content of
             "/proc/sys/net/ipv6/conf/default/use_tempaddr" as last fallback.
@@ -770,7 +824,12 @@ ipv6.ip6-privacy=0
           <listitem><para>If left unspecified, the default value
           "<literal>optional</literal>" will be used.</para></listitem>
         </varlistentry>
+        <varlistentry>
+          <term><varname>wifi.wake-on-wlan</varname></term>
+        </varlistentry>
       </variablelist>
+      <!-- The following comment is used by check-config-options.sh, don't remove it. -->
+      <!-- end connection defaults -->
     </para>
     </refsect2>
 
@@ -1158,6 +1217,8 @@ enable=env:TAG1
               be used to negate the match. Note that if one except-predicate
               matches, the entire configuration will be disabled.
               In other words, a except predicate always wins over other predicates.
+              If the setting only consists of "except:" matches and none of the
+              negative conditions are satisfied, the configuration is still enabled.
 <programlisting>
 # enable the configuration either when the environment variable
 # is present or the version is at least 1.2.0.
@@ -1344,10 +1405,19 @@ enable=nm-version-min:1.3,nm-version-min:1.2.6,nm-version-min:1.0.16
           </para></listitem>
         </varlistentry>
         <varlistentry>
+          <term>dhcp-plugin:DHCP</term>
+          <listitem><para>Match the configured DHCP plugin "<literal>main.dhcp</literal>".
+          </para></listitem>
+        </varlistentry>
+        <varlistentry>
           <term>except:SPEC</term>
           <listitem><para>Negative match of a device. <literal>SPEC</literal> must be explicitly qualified with
              a prefix such as <literal>interface-name:</literal>. A negative match has higher priority then the positive
-             matches above.</para></listitem>
+             matches above.</para>
+             <para>If there is a list consisting only of negative matches, the behavior is the same as if there
+             is also match-all. That means, if none of all the negative matches is satisfied, the overall result is
+             still a positive match. That means, <literal>"except:interface-name:eth0"</literal> is the same as
+             <literal>"*,except:interface-name:eth0"</literal>.</para></listitem>
         </varlistentry>
         <varlistentry>
           <term>SPEC[,;]SPEC</term>
diff --git a/man/NetworkManager.xml b/man/NetworkManager.xml
index f78a44f4..2a13671b 100644
--- a/man/NetworkManager.xml
+++ b/man/NetworkManager.xml
@@ -55,7 +55,7 @@
       The NetworkManager daemon attempts to make networking
       configuration and operation as painless and automatic as
       possible by managing the primary network connection and other
-      network interfaces, like Ethernet, WiFi, and Mobile Broadband
+      network interfaces, like Ethernet, Wi-Fi, and Mobile Broadband
       devices.  NetworkManager will connect any network device when a
       connection for that device becomes available, unless that
       behavior is disabled.  Information about networking is exported
@@ -437,16 +437,13 @@
       <varlistentry>
         <term><varname>NM_UNMANAGED</varname></term>
         <listitem><para>
-          No default connection will be created and automatic activation
-          will not be attempted when this property of a device is set to a
-          true value ("1" or "true"). You will still be able to attach a
-          connection to the device manually or observe externally added
-          configuration such as addresses or routes.
-        </para><para>
-          Create an udev rule that sets this property to prevent NetworkManager
-          from interfering with virtual Ethernet device interfaces that are
-          managed by virtualization tools.
-        </para></listitem>
+          If set to <literal>"1"</literal> or <literal>"true"</literal>, the device is
+          configured as unmanaged by NetworkManager. Note that the user still can
+          explicitly overrule this configuration via means like
+          <command>nmcli device set "$DEVICE" managed yes</command> or
+          <literal>"device*.managed=1"</literal> in NetworkManager.conf.
+        </para>
+        </listitem>
       </varlistentry>
     </variablelist>
   </refsect1>
diff --git a/man/common.ent.in b/man/common.ent.in
index ddfbb69a..9632b4ef 100644
--- a/man/common.ent.in
+++ b/man/common.ent.in
@@ -2,6 +2,7 @@
 <!ENTITY NM_VERSION "@NM_VERSION@">
 <!ENTITY sysconfdir "@sysconfdir@">
 <!ENTITY nmrundir "@nmrundir@">
+<!ENTITY nmstatedir "@nmstatedir@">
 <!ENTITY NM_CONFIG_DEFAULT_MAIN_AUTH_POLKIT_TEXT "@NM_CONFIG_DEFAULT_MAIN_AUTH_POLKIT_TEXT@">
 <!ENTITY NM_CONFIG_DEFAULT_LOGGING_BACKEND_TEXT "@NM_CONFIG_DEFAULT_LOGGING_BACKEND_TEXT@">
 <!ENTITY NM_CONFIG_DEFAULT_LOGGING_AUDIT_TEXT "@NM_CONFIG_DEFAULT_LOGGING_AUDIT_TEXT@">
diff --git a/man/meson.build b/man/meson.build
index 21fac21d..a4ef3d9e 100644
--- a/man/meson.build
+++ b/man/meson.build
@@ -2,6 +2,7 @@ common_conf = configuration_data()
 common_conf.set('NM_VERSION', nm_version)
 common_conf.set('sysconfdir', nm_sysconfdir)
 common_conf.set('nmrundir', nm_pkgrundir)
+common_conf.set('nmstatedir', nm_pkgstatedir)
 common_conf.set('NM_CONFIG_DEFAULT_MAIN_AUTH_POLKIT_TEXT', config_default_main_auth_polkit)
 common_conf.set('NM_CONFIG_DEFAULT_LOGGING_BACKEND_TEXT', config_logging_backend_default)
 common_conf.set('NM_CONFIG_DEFAULT_LOGGING_AUDIT_TEXT', config_default_logging_audit)
@@ -13,7 +14,7 @@ common = 'common.ent'
 common_ent_file = configure_file(
   input: common + '.in',
   output: common,
-  configuration: common_conf
+  configuration: common_conf,
 )
 
 xsltproc_options = [
@@ -27,7 +28,7 @@ xsltproc_options = [
   '--stringparam', 'man.th.extra1.suppress', '1',
   '--stringparam', 'man.authors.section.enabled', '0',
   '--stringparam', 'man.copyright.section.enabled', '0',
-  '--stringparam', 'man.th.title.max.length', '30'
+  '--stringparam', 'man.th.title.max.length', '30',
 ]
 
 docbook_xls = 'http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl'
@@ -61,14 +62,14 @@ foreach man: mans
     command: xsltproc_options + [docbook_xls, '@INPUT@'],
     depend_files: common_ent_file,
     install: true,
-    install_dir: join_paths(nm_mandir, 'man' + man[1])
+    install_dir: join_paths(nm_mandir, 'man' + man[1]),
   )
 endforeach
 
 if enable_introspection
   mans = [
     ['nm-settings-keyfile', '5', nm_settings_keyfile_docs],
-    ['nm-settings', '5', nm_settings_docs]
+    ['nm-settings', '5', nm_settings_docs],
   ]
 
   if enable_ifcfg_rh
@@ -82,7 +83,7 @@ if enable_introspection
       output,
       input: man[2],
       output: output,
-      command: xsltproc_options + [join_paths(meson.current_source_dir(), man[0] + '.xsl'), '@INPUT@']
+      command: xsltproc_options + [join_paths(meson.current_source_dir(), man[0] + '.xsl'), '@INPUT@'],
     )
     content_files += input.full_path()
 
@@ -94,7 +95,7 @@ if enable_introspection
       output: output,
       command: xsltproc_options + [docbook_xls, '@INPUT@'],
       install: true,
-      install_dir: join_paths(nm_mandir, 'man' + man[1])
+      install_dir: join_paths(nm_mandir, 'man' + man[1]),
     )
   endforeach
 endif
diff --git a/man/nm-initrd-generator.8 b/man/nm-initrd-generator.8
index 0f53f770..3df0447b 100644
--- a/man/nm-initrd-generator.8
+++ b/man/nm-initrd-generator.8
@@ -2,12 +2,12 @@
 .\"     Title: nm-initrd-generator
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
-.\"      Date: 10/24/2018
+.\"      Date: 01/22/2019
 .\"    Manual: System Administration
-.\"    Source: NetworkManager 1.14.4
+.\"    Source: NetworkManager 1.15.2
 .\"  Language: English
 .\"
-.TH "NM\-INITRD\-GENERATOR" "8" "" "NetworkManager 1\&.14\&.4" "System Administration"
+.TH "NM\-INITRD\-GENERATOR" "8" "" "NetworkManager 1\&.15\&.2" "System Administration"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
diff --git a/man/nm-online.1 b/man/nm-online.1
index 9e2f23e9..0155f816 100644
--- a/man/nm-online.1
+++ b/man/nm-online.1
@@ -2,12 +2,12 @@
 .\"     Title: nm-online
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
-.\"      Date: 10/24/2018
+.\"      Date: 01/22/2019
 .\"    Manual: General Commands Manual
-.\"    Source: NetworkManager 1.14.4
+.\"    Source: NetworkManager 1.15.2
 .\"  Language: English
 .\"
-.TH "NM\-ONLINE" "1" "" "NetworkManager 1\&.14\&.4" "General Commands Manual"
+.TH "NM\-ONLINE" "1" "" "NetworkManager 1\&.15\&.2" "General Commands Manual"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -50,14 +50,9 @@ or
 dhcp, to indicate that IPv6 connectivity is expected\&.
 .SH "OPTIONS"
 .PP
-\fB\-t\fR | \fB\-\-timeout\fR \fIseconds\fR
+\fB\-h\fR | \fB\-\-help\fR
 .RS 4
-Time to wait for a connection, in seconds\&. If the option is not provided, the default timeout is 30 seconds\&.
-.RE
-.PP
-\fB\-x\fR | \fB\-\-exit\fR
-.RS 4
-Exit immediately if NetworkManager is not running or connecting\&.
+Print help information\&.
 .RE
 .PP
 \fB\-q\fR | \fB\-\-quiet\fR
@@ -71,6 +66,16 @@ Wait for NetworkManager startup to complete, rather than waiting for network con
 \fBnm\-online \-s\fR
 will just return immediately, regardless of the current network state\&.)
 .RE
+.PP
+\fB\-t\fR | \fB\-\-timeout\fR \fIseconds\fR
+.RS 4
+Time to wait for a connection, in seconds\&. If the option is not provided, the default timeout is 30 seconds\&.
+.RE
+.PP
+\fB\-x\fR | \fB\-\-exit\fR
+.RS 4
+Exit immediately if NetworkManager is not running or connecting\&.
+.RE
 .SH "EXIT STATUS"
 .PP
 \fBnm\-online\fR
diff --git a/man/nm-online.xml b/man/nm-online.xml
index 297920dd..d40aef98 100644
--- a/man/nm-online.xml
+++ b/man/nm-online.xml
@@ -68,29 +68,13 @@
   <refsect1 id='options'><title>Options</title>
     <variablelist>
       <varlistentry>
-        <term>
-          <group choice='plain'>
-            <arg choice='plain'><option>-t</option></arg>
-            <arg choice='plain'><option>--timeout</option></arg>
-          </group>
-          <arg choice='plain'><replaceable>seconds</replaceable></arg>
-        </term>
-
-        <listitem>
-          <para>Time to wait for a connection, in seconds. If the option is not provided,
-          the default timeout is 30 seconds.</para>
-        </listitem>
-      </varlistentry>
-
-
-      <varlistentry>
         <term><group choice='plain'>
-          <arg choice='plain'><option>-x</option></arg>
-          <arg choice='plain'><option>--exit</option></arg>
+          <arg choice='plain'><option>-h</option></arg>
+          <arg choice='plain'><option>--help</option></arg>
         </group></term>
 
         <listitem>
-          <para>Exit immediately if NetworkManager is not running or connecting.</para>
+          <para>Print help information.</para>
         </listitem>
       </varlistentry>
 
@@ -122,6 +106,33 @@
         </listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term>
+          <group choice='plain'>
+            <arg choice='plain'><option>-t</option></arg>
+            <arg choice='plain'><option>--timeout</option></arg>
+          </group>
+          <arg choice='plain'><replaceable>seconds</replaceable></arg>
+        </term>
+
+        <listitem>
+          <para>Time to wait for a connection, in seconds. If the option is not provided,
+          the default timeout is 30 seconds.</para>
+        </listitem>
+      </varlistentry>
+
+
+      <varlistentry>
+        <term><group choice='plain'>
+          <arg choice='plain'><option>-x</option></arg>
+          <arg choice='plain'><option>--exit</option></arg>
+        </group></term>
+
+        <listitem>
+          <para>Exit immediately if NetworkManager is not running or connecting.</para>
+        </listitem>
+      </varlistentry>
+
     </variablelist>
   </refsect1>
 
diff --git a/man/nm-openvswitch.7 b/man/nm-openvswitch.7
index 4b6c23b9..87156e51 100644
--- a/man/nm-openvswitch.7
+++ b/man/nm-openvswitch.7
@@ -2,12 +2,12 @@
 .\"     Title: nm-openvswitch
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
-.\"      Date: 10/24/2018
-.\"    Manual: OpenVSwitch support overview
-.\"    Source: NetworkManager 1.14.4
+.\"      Date: 01/22/2019
+.\"    Manual: Open vSwitch support overview
+.\"    Source: NetworkManager 1.15.2
 .\"  Language: English
 .\"
-.TH "NM\-OPENVSWITCH" "7" "" "NetworkManager 1\&.14\&.4" "OpenVSwitch support overview"
+.TH "NM\-OPENVSWITCH" "7" "" "NetworkManager 1\&.15\&.2" "Open vSwitch support overview"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -28,10 +28,10 @@
 .\" * MAIN CONTENT STARTS HERE *
 .\" -----------------------------------------------------------------
 .SH "NAME"
-nm-openvswitch \- overview of NetworkManager OpenVSwitch support
+nm-openvswitch \- overview of NetworkManager Open vSwitch support
 .SH "OVERVIEW"
 .PP
-NetworkManager includes basic OpenVSwitch support, good enough to be capable of setting up simple OpenVSwitch configurations\&. It is not extensive and does not expose all functionality of OpenVSwitch provides\&. For large or complicated deployments users are advised to use native tools shipped with OpenVSwitch\&. This document seeks to provide overview of functionality currently provided by NetworkManager, its capabilities and limitations\&.
+NetworkManager includes basic Open vSwitch support, good enough to be capable of setting up simple Open vSwitch configurations\&. It is not extensive and does not expose all functionality of Open vSwitch provides\&. For large or complicated deployments users are advised to use native tools shipped with Open vSwitch\&. This document seeks to provide overview of functionality currently provided by NetworkManager, its capabilities and limitations\&.
 .PP
 First and foremost: NetworkManager applies the configuration by modifying the OVSDB directly\&. Its configuration model follows the OVSDB database model closely and it does not provide the level of abstraction
 \fBovs\-vsctl\fR
@@ -206,7 +206,7 @@ It\*(Aqs just a Port with multiple interfaces\&. See nm\-settings manual for Bon
 .sp -1
 .IP \(bu 2.3
 .\}
-Not all OpenVSwitch capabilities are supported\&.
+Not all Open vSwitch capabilities are supported\&.
 .RE
 .sp
 .RS 4
@@ -217,7 +217,7 @@ Not all OpenVSwitch capabilities are supported\&.
 .sp -1
 .IP \(bu 2.3
 .\}
-OpenVSwitch devices don\*(Aqt expose many useful properties on D\-Bus\&.
+Open vSwitch devices don\*(Aqt expose many useful properties on D\-Bus\&.
 .RE
 .PP
 Probably many more\&.
diff --git a/man/nm-openvswitch.xml b/man/nm-openvswitch.xml
index 7195adcc..d156e78e 100644
--- a/man/nm-openvswitch.xml
+++ b/man/nm-openvswitch.xml
@@ -26,30 +26,30 @@
 <refentry id="nm-openvswitch">
   <refentryinfo>
     <title>nm-openvswitch</title>
-    <author>NetworkManager OpenVSwitch support</author>
+    <author>NetworkManager Open vSwitch support</author>
   </refentryinfo>
 
   <refmeta>
     <refentrytitle>nm-openvswitch</refentrytitle>
     <manvolnum>7</manvolnum>
     <refmiscinfo class="source">NetworkManager</refmiscinfo>
-    <refmiscinfo class="manual">OpenVSwitch support overview</refmiscinfo>
+    <refmiscinfo class="manual">Open vSwitch support overview</refmiscinfo>
     <refmiscinfo class="version">&NM_VERSION;</refmiscinfo>
   </refmeta>
 
   <refnamediv>
     <refname>nm-openvswitch</refname>
-    <refpurpose>overview of NetworkManager OpenVSwitch support</refpurpose>
+    <refpurpose>overview of NetworkManager Open vSwitch support</refpurpose>
   </refnamediv>
 
   <refsect1>
     <title>Overview</title>
 
-    <para>NetworkManager includes basic OpenVSwitch support, good enough
-    to be capable of setting up simple OpenVSwitch configurations. It is not
-    extensive and does not expose all functionality of OpenVSwitch provides.
+    <para>NetworkManager includes basic Open vSwitch support, good enough
+    to be capable of setting up simple Open vSwitch configurations. It is not
+    extensive and does not expose all functionality of Open vSwitch provides.
     For large or complicated deployments users are advised to use native tools
-    shipped with OpenVSwitch. This document seeks to provide overview of
+    shipped with Open vSwitch. This document seeks to provide overview of
     functionality currently provided by NetworkManager, its capabilities and
     limitations.</para>
 
@@ -182,10 +182,10 @@ Connection 'ovs-slave-eth3' (8dedeecb-ed12-482b-b77a-24a4fb835136) successfully
 
     <itemizedlist>
        <listitem>
-          <para>Not all OpenVSwitch capabilities are supported.</para>
+          <para>Not all Open vSwitch capabilities are supported.</para>
        </listitem>
        <listitem>
-          <para>OpenVSwitch devices don't expose many useful properties on D-Bus.</para>
+          <para>Open vSwitch devices don't expose many useful properties on D-Bus.</para>
        </listitem>
     </itemizedlist>
     <para>Probably many more.</para>
diff --git a/man/nm-settings-ifcfg-rh.5 b/man/nm-settings-ifcfg-rh.5
index 99434ecc..d11336f1 100644
--- a/man/nm-settings-ifcfg-rh.5
+++ b/man/nm-settings-ifcfg-rh.5
@@ -2,12 +2,12 @@
 .\"     Title: nm-settings-ifcfg-rh
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
-.\"      Date: 10/24/2018
+.\"      Date: 01/22/2019
 .\"    Manual: Configuration
-.\"    Source: NetworkManager 1.14.4
+.\"    Source: NetworkManager 1.15.2
 .\"  Language: English
 .\"
-.TH "NM\-SETTINGS\-IFCFG\-RH" "5" "" "NetworkManager 1\&.14\&.4" "Configuration"
+.TH "NM\-SETTINGS\-IFCFG\-RH" "5" "" "NetworkManager 1\&.15\&.2" "Configuration"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -1413,7 +1413,7 @@ DCB_PG_UP2TC
 T}:T{
 \ \&
 T}:T{
-Priority values\&. String of eight trafic class values (0 \- 7)\&.\fB
+Priority values\&. String of eight traffic class values (0 \- 7)\&.\fB
 
 Example: \fRDCB_PG_UP2TC=01623701
 T}
diff --git a/man/nm-settings-ifcfg-rh.xml b/man/nm-settings-ifcfg-rh.xml
index 3739fb28..ee867e12 100644
--- a/man/nm-settings-ifcfg-rh.xml
+++ b/man/nm-settings-ifcfg-rh.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0"?>
 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.3//EN" "http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd">
-<refentry id="nm-settings-ifcfg-rh"><refentryinfo><title>nm-settings-ifcfg-rh</title><author>NetworkManager developers</author></refentryinfo><refmeta><refentrytitle>nm-settings-ifcfg-rh</refentrytitle><manvolnum>5</manvolnum><refmiscinfo class="source">NetworkManager</refmiscinfo><refmiscinfo class="manual">Configuration</refmiscinfo><refmiscinfo class="version">1.14.4</refmiscinfo></refmeta><refnamediv><refname>nm-settings-ifcfg-rh</refname><refpurpose>Description of <emphasis>ifcfg-rh</emphasis> settings plugin</refpurpose></refnamediv><refsect1 id="description"><title>Description</title><para>
+<refentry id="nm-settings-ifcfg-rh"><refentryinfo><title>nm-settings-ifcfg-rh</title><author>NetworkManager developers</author></refentryinfo><refmeta><refentrytitle>nm-settings-ifcfg-rh</refentrytitle><manvolnum>5</manvolnum><refmiscinfo class="source">NetworkManager</refmiscinfo><refmiscinfo class="manual">Configuration</refmiscinfo><refmiscinfo class="version">1.15.2</refmiscinfo></refmeta><refnamediv><refname>nm-settings-ifcfg-rh</refname><refpurpose>Description of <emphasis>ifcfg-rh</emphasis> settings plugin</refpurpose></refnamediv><refsect1 id="description"><title>Description</title><para>
           NetworkManager is based on the concept of connection profiles that contain
           network configuration (see <citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum></citerefentry> for details). The profiles can be
           stored in various formats. NetworkManager uses plugins for reading and writing
@@ -287,7 +287,7 @@ Example: </emphasis>DCB_PG_PCT=10,5,10,15,10,10,10,30</entry></row><row><entry a
 
 Example: </emphasis>DCB_PG_UPPCT=7,13,10,10,15,15,10,20</entry></row><row><entry align="left">priority-strict-bandwidth</entry><entry align="left">DCB_PG_STRICT</entry><entry align="left"/><entry align="left">Priority values. String of eight "0" or "1", where "0" means "may not utilize all bandwidth", "1" means "may utilize all bandwidth".<emphasis role="bold">
 
-Example: </emphasis>DCB_PG_STRICT=01101110</entry></row><row><entry align="left">priority-traffic-class</entry><entry align="left">DCB_PG_UP2TC</entry><entry align="left"/><entry align="left">Priority values. String of eight trafic class values (0 - 7).<emphasis role="bold">
+Example: </emphasis>DCB_PG_STRICT=01101110</entry></row><row><entry align="left">priority-traffic-class</entry><entry align="left">DCB_PG_UP2TC</entry><entry align="left"/><entry align="left">Priority values. String of eight traffic class values (0 - 7).<emphasis role="bold">
 
 Example: </emphasis>DCB_PG_UP2TC=01623701</entry></row></tbody></tgroup></table><para>
           All DCB related configuration is a NetworkManager extension. DCB=yes must be
diff --git a/man/nm-settings-keyfile.5 b/man/nm-settings-keyfile.5
index 09f40a7a..c32fc672 100644
--- a/man/nm-settings-keyfile.5
+++ b/man/nm-settings-keyfile.5
@@ -2,12 +2,12 @@
 .\"     Title: nm-settings-keyfile
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
-.\"      Date: 10/24/2018
+.\"      Date: 01/22/2019
 .\"    Manual: Configuration
-.\"    Source: NetworkManager 1.14.4
+.\"    Source: NetworkManager 1.15.2
 .\"  Language: English
 .\"
-.TH "NM\-SETTINGS\-KEYFILE" "5" "" "NetworkManager 1\&.14\&.4" "Configuration"
+.TH "NM\-SETTINGS\-KEYFILE" "5" "" "NetworkManager 1\&.15\&.2" "Configuration"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
diff --git a/man/nm-settings-keyfile.xml b/man/nm-settings-keyfile.xml
index 9731f684..68ae20e4 100644
--- a/man/nm-settings-keyfile.xml
+++ b/man/nm-settings-keyfile.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0"?>
 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.3//EN" "http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd">
-<refentry id="nm-settings-keyfile"><refentryinfo><title>nm-settings-keyfile</title><author>NetworkManager developers</author></refentryinfo><refmeta><refentrytitle>nm-settings-keyfile</refentrytitle><manvolnum>5</manvolnum><refmiscinfo class="source">NetworkManager</refmiscinfo><refmiscinfo class="manual">Configuration</refmiscinfo><refmiscinfo class="version">1.14.4</refmiscinfo></refmeta><refnamediv><refname>nm-settings-keyfile</refname><refpurpose>Description of <emphasis>keyfile</emphasis> settings plugin</refpurpose></refnamediv><refsect1 id="description"><title>Description</title><para>
+<refentry id="nm-settings-keyfile"><refentryinfo><title>nm-settings-keyfile</title><author>NetworkManager developers</author></refentryinfo><refmeta><refentrytitle>nm-settings-keyfile</refentrytitle><manvolnum>5</manvolnum><refmiscinfo class="source">NetworkManager</refmiscinfo><refmiscinfo class="manual">Configuration</refmiscinfo><refmiscinfo class="version">1.15.2</refmiscinfo></refmeta><refnamediv><refname>nm-settings-keyfile</refname><refpurpose>Description of <emphasis>keyfile</emphasis> settings plugin</refpurpose></refnamediv><refsect1 id="description"><title>Description</title><para>
           NetworkManager is based on the concept of connection profiles that contain
           network configuration (see <citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum></citerefentry> for details). The profiles can be
           stored in various formats. NetworkManager uses plugins for reading and writing
diff --git a/man/nm-settings.5 b/man/nm-settings.5
index 59c7f754..215f4633 100644
--- a/man/nm-settings.5
+++ b/man/nm-settings.5
@@ -2,12 +2,12 @@
 .\"     Title: nm-settings
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
-.\"      Date: 10/24/2018
+.\"      Date: 01/22/2019
 .\"    Manual: Configuration
-.\"    Source: NetworkManager 1.14.4
+.\"    Source: NetworkManager 1.15.2
 .\"  Language: English
 .\"
-.TH "NM\-SETTINGS" "5" "" "NetworkManager 1\&.14\&.4" "Configuration"
+.TH "NM\-SETTINGS" "5" "" "NetworkManager 1\&.15\&.2" "Configuration"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -266,7 +266,7 @@ string
 T}:T{
 \ \&
 T}:T{
-This represents the identity of the connection used for various purposes\&. It allows to configure multiple profiles to share the identity\&. Also, the stable\-id can contain placeholders that are substituted dynamically and deterministically depending on the context\&. The stable\-id is used for generating IPv6 stable private addresses with ipv6\&.addr\-gen\-mode=stable\-privacy\&. It is also used to seed the generated cloned MAC address for ethernet\&.cloned\-mac\-address=stable and wifi\&.cloned\-mac\-address=stable\&. It is also used as DHCP client identifier with ipv4\&.dhcp\-client\-id=stable and to derive the DHCP DUID with ipv6\&.dhcp\-duid=stable\-[llt,ll,uuid]\&. Note that depending on the context where it is used, other parameters are also seeded into the generation algorithm\&. For example, a per\-host key is commonly also included, so that different systems end up generating different IDs\&. Or with ipv6\&.addr\-gen\-mode=stable\-privacy, also the device\*(Aqs name is included, so that different interfaces yield different addresses\&. The \*(Aq$\*(Aq character is treated special to perform dynamic substitutions at runtime\&. Currently supported are "${CONNECTION}", "${DEVICE}", "${BOOT}", "${RANDOM}"\&. These effectively create unique IDs per\-connection, per\-device, per\-boot, or every time\&. Note that "${DEVICE}" corresponds the the interface name of the device\&. Any unrecognized patterns following \*(Aq$\*(Aq are treated verbatim, however are reserved for future use\&. You are thus advised to avoid \*(Aq$\*(Aq or escape it as "$$"\&. For example, set it to "${CONNECTION}\-${BOOT}\-${DEVICE}" to create a unique id for this connection that changes with every reboot and differs depending on the interface where the profile activates\&. If the value is unset, a global connection default is consulted\&. If the value is still unset, the default is similar to "${CONNECTION}" and uses a unique, fixed ID for the connection\&.
+This represents the identity of the connection used for various purposes\&. It allows to configure multiple profiles to share the identity\&. Also, the stable\-id can contain placeholders that are substituted dynamically and deterministically depending on the context\&. The stable\-id is used for generating IPv6 stable private addresses with ipv6\&.addr\-gen\-mode=stable\-privacy\&. It is also used to seed the generated cloned MAC address for ethernet\&.cloned\-mac\-address=stable and wifi\&.cloned\-mac\-address=stable\&. It is also used as DHCP client identifier with ipv4\&.dhcp\-client\-id=stable and to derive the DHCP DUID with ipv6\&.dhcp\-duid=stable\-[llt,ll,uuid]\&. Note that depending on the context where it is used, other parameters are also seeded into the generation algorithm\&. For example, a per\-host key is commonly also included, so that different systems end up generating different IDs\&. Or with ipv6\&.addr\-gen\-mode=stable\-privacy, also the device\*(Aqs name is included, so that different interfaces yield different addresses\&. The \*(Aq$\*(Aq character is treated special to perform dynamic substitutions at runtime\&. Currently supported are "${CONNECTION}", "${DEVICE}", "${MAC}", "${BOOT}", "${RANDOM}"\&. These effectively create unique IDs per\-connection, per\-device, per\-boot, or every time\&. Note that "${DEVICE}" corresponds the the interface name of the device and "${MAC}" is the permanent MAC address of the device\&. Any unrecognized patterns following \*(Aq$\*(Aq are treated verbatim, however are reserved for future use\&. You are thus advised to avoid \*(Aq$\*(Aq or escape it as "$$"\&. For example, set it to "${CONNECTION}\-${BOOT}\-${DEVICE}" to create a unique id for this connection that changes with every reboot and differs depending on the interface where the profile activates\&. If the value is unset, a global connection default is consulted\&. If the value is still unset, the default is similar to "${CONNECTION}" and uses a unique, fixed ID for the connection\&.
 T}
 T{
 timestamp
@@ -1496,7 +1496,7 @@ string
 T}:T{
 \ \&
 T}:T{
-Number to dial when establishing a PPP data session with the GSM\-based mobile broadband network\&.  Many modems do not require PPP for connections to the mobile network and thus this property should be left blank, which allows NetworkManager to select the appropriate settings automatically\&.
+Legacy setting that used to help establishing PPP data sessions for GSM\-based modems\&. Deprecated: 1
 T}
 T{
 password
@@ -1703,7 +1703,7 @@ string
 T}:T{
 \ \&
 T}:T{
-A string sent to the DHCP server to identify the local machine which the DHCP server may use to customize the DHCP lease and options\&. When the property is a hex string (\*(Aqaa:bb:cc\*(Aq) it is interpreted as a binary client ID, in which case the first byte is assumed to be the \*(Aqtype\*(Aq field as per RFC 2132 section 9\&.14 and the remaining bytes may be an hardware address (e\&.g\&. \*(Aq01:xx:xx:xx:xx:xx:xx\*(Aq where 1 is the Ethernet ARP type and the rest is a MAC address)\&. If the property is not a hex string it is considered as a non\-hardware\-address client ID and the \*(Aqtype\*(Aq field is set to 0\&. The special values "mac" and "perm\-mac" are supported, which use the current or permanent MAC address of the device to generate a client identifier with type ethernet (01)\&. Currently, these options only work for ethernet type of links\&. The special value "stable" is supported to generate a type 0 client identifier based on the stable\-id (see connection\&.stable\-id) and a per\-host key\&. If unset, a globally configured default is used\&. If still unset, the client\-id from the last lease is reused\&.
+A string sent to the DHCP server to identify the local machine which the DHCP server may use to customize the DHCP lease and options\&. When the property is a hex string (\*(Aqaa:bb:cc\*(Aq) it is interpreted as a binary client ID, in which case the first byte is assumed to be the \*(Aqtype\*(Aq field as per RFC 2132 section 9\&.14 and the remaining bytes may be an hardware address (e\&.g\&. \*(Aq01:xx:xx:xx:xx:xx:xx\*(Aq where 1 is the Ethernet ARP type and the rest is a MAC address)\&. If the property is not a hex string it is considered as a non\-hardware\-address client ID and the \*(Aqtype\*(Aq field is set to 0\&. The special values "mac" and "perm\-mac" are supported, which use the current or permanent MAC address of the device to generate a client identifier with type ethernet (01)\&. Currently, these options only work for ethernet type of links\&. The special value "duid" generates a RFC4361\-compliant client identifier based on a hash of the interface name as IAID and /etc/machine\-id\&. The special value "stable" is supported to generate a type 0 client identifier based on the stable\-id (see connection\&.stable\-id) and a per\-host key\&. If you set the stable\-id, you may want to include the "${DEVICE}" or "${MAC}" specifier to get a per\-device key\&. If unset, a globally configured default is used\&. If still unset, the default depends on the DHCP plugin\&.
 T}
 T{
 dhcp\-fqdn
@@ -1766,7 +1766,7 @@ int32
 T}:T{
 0
 T}:T{
-DNS servers priority\&. The relative priority for DNS servers specified by this setting\&.  A lower value is better (higher priority)\&.  Zero selects the default value, which is 50 for VPNs and 100 for other connections\&. Note that the priority is to order DNS settings for multiple active connections\&.  It does not disambiguate multiple DNS servers within the same connection profile\&. When using dns=default, servers with higher priority will be on top of resolv\&.conf\&.  To prioritize a given server over another one within the same connection, just specify them in the desired order\&.  When multiple devices have configurations with the same priority, the one with an active default route will be preferred\&.  Negative values have the special effect of excluding other configurations with a greater priority value; so in presence of at least a negative priority, only DNS servers from connections with the lowest priority value will be used\&. When using a DNS resolver that supports split\-DNS as dns=dnsmasq or dns=systemd\-resolved, each connection is used to query domains in its search list\&.  Queries for domains not present in any search list are routed through connections having the \*(Aq~\&.\*(Aq special wildcard domain, which is added automatically to connections with the default route (or can be added manually)\&.  When multiple connections specify the same domain, the one with the highest priority (lowest numerical value) wins\&.  If a connection specifies a domain which is subdomain of another domain with a negative DNS priority value, the subdomain is ignored\&.
+DNS servers priority\&. The relative priority for DNS servers specified by this setting\&.  A lower value is better (higher priority)\&. Zero selects a globally configured default value\&. If the latter is missing or zero too, it defaults to 50 for VPNs and 100 for other connections\&. Note that the priority is to order DNS settings for multiple active connections\&.  It does not disambiguate multiple DNS servers within the same connection profile\&. When using dns=default, servers with higher priority will be on top of resolv\&.conf\&.  To prioritize a given server over another one within the same connection, just specify them in the desired order\&.  When multiple devices have configurations with the same priority, the one with an active default route will be preferred\&.  Negative values have the special effect of excluding other configurations with a greater priority value; so in presence of at least a negative priority, only DNS servers from connections with the lowest priority value will be used\&. When using a DNS resolver that supports split\-DNS as dns=dnsmasq or dns=systemd\-resolved, each connection is used to query domains in its search list\&.  Queries for domains not present in any search list are routed through connections having the \*(Aq~\&.\*(Aq special wildcard domain, which is added automatically to connections with the default route (or can be added manually)\&.  When multiple connections specify the same domain, the one with the highest priority (lowest numerical value) wins\&.  If a connection specifies a domain which is subdomain of another domain with a negative DNS priority value, the subdomain is ignored\&.
 T}
 T{
 dns\-search
@@ -1952,7 +1952,7 @@ string
 T}:T{
 \ \&
 T}:T{
-A string containing the DHCPv6 Unique Identifier (DUID) used by the dhcp client to identify itself to DHCPv6 servers (RFC 3315)\&. The DUID is carried in the Client Identifier option\&. If the property is a hex string (\*(Aqaa:bb:cc\*(Aq) it is interpreted as a binary DUID and filled as an opaque value in the Client Identifier option\&. The special value "lease" will retrieve the DUID previously used from the lease file belonging to the connection\&. If no DUID is found and "dhclient" is the configured dhcp client, the DUID is searched in the system\-wide dhclient lease file\&. If still no DUID is found, or another dhcp client is used, a global and permanent DUID\-UUID (RFC 6355) will be generated based on the machine\-id\&. The special values "llt" and "ll" will generate a DUID of type LLT or LL (see RFC 3315) based on the current MAC address of the device\&. In order to try providing a stable DUID\-LLT, the time field will contain a constant timestamp that is used globally (for all profiles) and persisted to disk\&. The special values "stable\-llt", "stable\-ll" and "stable\-uuid" will generate a DUID of the corresponding type, derived from the connection\*(Aqs stable\-id and a per\-host unique key\&. So, the link\-layer address of "stable\-ll" and "stable\-llt" will be a generated address derived from the stable id\&. The DUID\-LLT time value in the "stable\-llt" option will be picked among a static timespan of three years (the upper bound of the interval is the same constant timestamp used in "llt")\&. When the property is unset, the global value provided for "ipv6\&.dhcp\-duid" is used\&. If no global value is provided, the default "lease" value is assumed\&.
+A string containing the DHCPv6 Unique Identifier (DUID) used by the dhcp client to identify itself to DHCPv6 servers (RFC 3315)\&. The DUID is carried in the Client Identifier option\&. If the property is a hex string (\*(Aqaa:bb:cc\*(Aq) it is interpreted as a binary DUID and filled as an opaque value in the Client Identifier option\&. The special value "lease" will retrieve the DUID previously used from the lease file belonging to the connection\&. If no DUID is found and "dhclient" is the configured dhcp client, the DUID is searched in the system\-wide dhclient lease file\&. If still no DUID is found, or another dhcp client is used, a global and permanent DUID\-UUID (RFC 6355) will be generated based on the machine\-id\&. The special values "llt" and "ll" will generate a DUID of type LLT or LL (see RFC 3315) based on the current MAC address of the device\&. In order to try providing a stable DUID\-LLT, the time field will contain a constant timestamp that is used globally (for all profiles) and persisted to disk\&. The special values "stable\-llt", "stable\-ll" and "stable\-uuid" will generate a DUID of the corresponding type, derived from the connection\*(Aqs stable\-id and a per\-host unique key\&. You may want to include the "${DEVICE}" or "${MAC}" specifier in the stable\-id, in case this profile gets activated on multiple devices\&. So, the link\-layer address of "stable\-ll" and "stable\-llt" will be a generated address derived from the stable id\&. The DUID\-LLT time value in the "stable\-llt" option will be picked among a static timespan of three years (the upper bound of the interval is the same constant timestamp used in "llt")\&. When the property is unset, the global value provided for "ipv6\&.dhcp\-duid" is used\&. If no global value is provided, the default "lease" value is assumed\&.
 T}
 T{
 dhcp\-hostname
@@ -2006,7 +2006,7 @@ int32
 T}:T{
 0
 T}:T{
-DNS servers priority\&. The relative priority for DNS servers specified by this setting\&.  A lower value is better (higher priority)\&.  Zero selects the default value, which is 50 for VPNs and 100 for other connections\&. Note that the priority is to order DNS settings for multiple active connections\&.  It does not disambiguate multiple DNS servers within the same connection profile\&. When using dns=default, servers with higher priority will be on top of resolv\&.conf\&.  To prioritize a given server over another one within the same connection, just specify them in the desired order\&.  When multiple devices have configurations with the same priority, the one with an active default route will be preferred\&.  Negative values have the special effect of excluding other configurations with a greater priority value; so in presence of at least a negative priority, only DNS servers from connections with the lowest priority value will be used\&. When using a DNS resolver that supports split\-DNS as dns=dnsmasq or dns=systemd\-resolved, each connection is used to query domains in its search list\&.  Queries for domains not present in any search list are routed through connections having the \*(Aq~\&.\*(Aq special wildcard domain, which is added automatically to connections with the default route (or can be added manually)\&.  When multiple connections specify the same domain, the one with the highest priority (lowest numerical value) wins\&.  If a connection specifies a domain which is subdomain of another domain with a negative DNS priority value, the subdomain is ignored\&.
+DNS servers priority\&. The relative priority for DNS servers specified by this setting\&.  A lower value is better (higher priority)\&. Zero selects a globally configured default value\&. If the latter is missing or zero too, it defaults to 50 for VPNs and 100 for other connections\&. Note that the priority is to order DNS settings for multiple active connections\&.  It does not disambiguate multiple DNS servers within the same connection profile\&. When using dns=default, servers with higher priority will be on top of resolv\&.conf\&.  To prioritize a given server over another one within the same connection, just specify them in the desired order\&.  When multiple devices have configurations with the same priority, the one with an active default route will be preferred\&.  Negative values have the special effect of excluding other configurations with a greater priority value; so in presence of at least a negative priority, only DNS servers from connections with the lowest priority value will be used\&. When using a DNS resolver that supports split\-DNS as dns=dnsmasq or dns=systemd\-resolved, each connection is used to query domains in its search list\&.  Queries for domains not present in any search list are routed through connections having the \*(Aq~\&.\*(Aq special wildcard domain, which is added automatically to connections with the default route (or can be added manually)\&.  When multiple connections specify the same domain, the one with the highest priority (lowest numerical value) wins\&.  If a connection specifies a domain which is subdomain of another domain with a negative DNS priority value, the subdomain is ignored\&.
 T}
 T{
 dns\-search
@@ -3136,7 +3136,7 @@ uint32
 T}:T{
 0
 T}:T{
-The total number of virtual functions to create\&.
+The total number of virtual functions to create\&. Note that when the sriov setting is present NetworkManager enforces the number of virtual functions on the interface also when it is zero\&. To prevent any changes to SR\-IOV parameters don\*(Aqt add a sriov setting to the connection\&.
 T}
 T{
 vfs
@@ -3145,7 +3145,7 @@ array of vardict
 T}:T{
 []
 T}:T{
-Array of virtual function descriptors\&. Each VF descriptor is a dictionary mapping attribute names to GVariant values\&. The \*(Aqindex\*(Aq entry is mandatory for each VF\&. When represented as string a VF is in the form: "INDEX [ATTR=VALUE[ ATTR=VALUE]\&.\&.\&.]"\&. for example: "2 mac=00:11:22:33:44:55 spoof\-check=true"\&. The "vlans" attribute is represented as a semicolor\-separated list of VLAN descriptors, where each descriptor has the form "ID[\&.PRIORITY[\&.PROTO]]"\&. PROTO can be either \*(Aqq\*(Aq for 802\&.1Q (the default) or \*(Aqad\*(Aq for 802\&.1ad\&.
+Array of virtual function descriptors\&. Each VF descriptor is a dictionary mapping attribute names to GVariant values\&. The \*(Aqindex\*(Aq entry is mandatory for each VF\&. When represented as string a VF is in the form: "INDEX [ATTR=VALUE[ ATTR=VALUE]\&.\&.\&.]"\&. for example: "2 mac=00:11:22:33:44:55 spoof\-check=true"\&. Multiple VFs can be specified using a comma as separator\&. Currently the following attributes are supported: mac, spoof\-check, trust, min\-tx\-rate, max\-tx\-rate, vlans\&. The "vlans" attribute is represented as a semicolon\-separated list of VLAN descriptors, where each descriptor has the form "ID[\&.PRIORITY[\&.PROTO]]"\&. PROTO can be either \*(Aqq\*(Aq for 802\&.1Q (the default) or \*(Aqad\*(Aq for 802\&.1ad\&.
 T}
 .TE
 .sp 1
@@ -3245,7 +3245,7 @@ array of vardict
 T}:T{
 []
 T}:T{
-Link watchers configuration for the connection: each link watcher is defined by a dictionary, whose keys depend upon the selected link watcher\&. Available link watchers are \*(Aqethtool\*(Aq, \*(Aqnsna_ping\*(Aq and \*(Aqarp_ping\*(Aq and it is specified in the dictionary with the key \*(Aqname\*(Aq\&. Available keys are:   ethtool: \*(Aqdelay\-up\*(Aq, \*(Aqdelay\-down\*(Aq, \*(Aqinit\-wait\*(Aq; nsna_ping: \*(Aqinit\-wait\*(Aq, \*(Aqinterval\*(Aq, \*(Aqmissed\-max\*(Aq, \*(Aqtarget\-host\*(Aq; arp_ping: all the ones in nsna_ping and \*(Aqsource\-host\*(Aq, \*(Aqvalidate\-active\*(Aq, \*(Aqvalidate\-incative\*(Aq, \*(Aqsend\-always\*(Aq\&. See teamd\&.conf man for more details\&.
+Link watchers configuration for the connection: each link watcher is defined by a dictionary, whose keys depend upon the selected link watcher\&. Available link watchers are \*(Aqethtool\*(Aq, \*(Aqnsna_ping\*(Aq and \*(Aqarp_ping\*(Aq and it is specified in the dictionary with the key \*(Aqname\*(Aq\&. Available keys are:   ethtool: \*(Aqdelay\-up\*(Aq, \*(Aqdelay\-down\*(Aq, \*(Aqinit\-wait\*(Aq; nsna_ping: \*(Aqinit\-wait\*(Aq, \*(Aqinterval\*(Aq, \*(Aqmissed\-max\*(Aq, \*(Aqtarget\-host\*(Aq; arp_ping: all the ones in nsna_ping and \*(Aqsource\-host\*(Aq, \*(Aqvalidate\-active\*(Aq, \*(Aqvalidate\-inactive\*(Aq, \*(Aqsend\-always\*(Aq\&. See teamd\&.conf man for more details\&.
 T}
 T{
 mcast\-rejoin\-count
@@ -3432,7 +3432,7 @@ array of vardict
 T}:T{
 []
 T}:T{
-Link watchers configuration for the connection: each link watcher is defined by a dictionary, whose keys depend upon the selected link watcher\&. Available link watchers are \*(Aqethtool\*(Aq, \*(Aqnsna_ping\*(Aq and \*(Aqarp_ping\*(Aq and it is specified in the dictionary with the key \*(Aqname\*(Aq\&. Available keys are:   ethtool: \*(Aqdelay\-up\*(Aq, \*(Aqdelay\-down\*(Aq, \*(Aqinit\-wait\*(Aq; nsna_ping: \*(Aqinit\-wait\*(Aq, \*(Aqinterval\*(Aq, \*(Aqmissed\-max\*(Aq, \*(Aqtarget\-host\*(Aq; arp_ping: all the ones in nsna_ping and \*(Aqsource\-host\*(Aq, \*(Aqvalidate\-active\*(Aq, \*(Aqvalidate\-incative\*(Aq, \*(Aqsend\-always\*(Aq\&. See teamd\&.conf man for more details\&.
+Link watchers configuration for the connection: each link watcher is defined by a dictionary, whose keys depend upon the selected link watcher\&. Available link watchers are \*(Aqethtool\*(Aq, \*(Aqnsna_ping\*(Aq and \*(Aqarp_ping\*(Aq and it is specified in the dictionary with the key \*(Aqname\*(Aq\&. Available keys are:   ethtool: \*(Aqdelay\-up\*(Aq, \*(Aqdelay\-down\*(Aq, \*(Aqinit\-wait\*(Aq; nsna_ping: \*(Aqinit\-wait\*(Aq, \*(Aqinterval\*(Aq, \*(Aqmissed\-max\*(Aq, \*(Aqtarget\-host\*(Aq; arp_ping: all the ones in nsna_ping and \*(Aqsource\-host\*(Aq, \*(Aqvalidate\-active\*(Aq, \*(Aqvalidate\-inactive\*(Aq, \*(Aqsend\-always\*(Aq\&. See teamd\&.conf man for more details\&.
 T}
 T{
 prio
@@ -3979,7 +3979,7 @@ string
 T}:T{
 \ \&
 T}:T{
-The new field for the cloned MAC address\&. It can be either a hardware address in ASCII representation, or one of the special values "preserve", "permanent", "random" or "stable"\&. This field replaces the deprecated "cloned\-mac\-address" on D\-Bus, which can only contain explict hardware addresses\&. Note that this property only exists in D\-Bus API\&. libnm and nmcli continue to call this property "cloned\-mac\-address"\&.
+The new field for the cloned MAC address\&. It can be either a hardware address in ASCII representation, or one of the special values "preserve", "permanent", "random" or "stable"\&. This field replaces the deprecated "cloned\-mac\-address" on D\-Bus, which can only contain explicit hardware addresses\&. Note that this property only exists in D\-Bus API\&. libnm and nmcli continue to call this property "cloned\-mac\-address"\&.
 T}
 T{
 auto\-negotiate
@@ -4151,7 +4151,7 @@ string
 T}:T{
 \ \&
 T}:T{
-The new field for the cloned MAC address\&. It can be either a hardware address in ASCII representation, or one of the special values "preserve", "permanent", "random" or "stable"\&. This field replaces the deprecated "cloned\-mac\-address" on D\-Bus, which can only contain explict hardware addresses\&. Note that this property only exists in D\-Bus API\&. libnm and nmcli continue to call this property "cloned\-mac\-address"\&.
+The new field for the cloned MAC address\&. It can be either a hardware address in ASCII representation, or one of the special values "preserve", "permanent", "random" or "stable"\&. This field replaces the deprecated "cloned\-mac\-address" on D\-Bus, which can only contain explicit hardware addresses\&. Note that this property only exists in D\-Bus API\&. libnm and nmcli continue to call this property "cloned\-mac\-address"\&.
 T}
 T{
 band
@@ -4553,8 +4553,19 @@ T}
 .T&
 l l l l
 l l l l
+l l l l
+l l l l
 l l l l.
 T{
+channel
+T}:T{
+int32
+T}:T{
+\-1
+T}:T{
+IEEE 802\&.15\&.4 channel\&. A positive integer or \-1, meaning "do not set, use whatever the device is already set to"\&.
+T}
+T{
 mac\-address
 T}:T{
 string
@@ -4564,6 +4575,15 @@ T}:T{
 If specified, this connection will only apply to the IEEE 802\&.15\&.4 (WPAN) MAC layer device whose permanent MAC address matches\&.
 T}
 T{
+page
+T}:T{
+int32
+T}:T{
+\-1
+T}:T{
+IEEE 802\&.15\&.4 channel page\&. A positive integer or \-1, meaning "do not set, use whatever the device is already set to"\&.
+T}
+T{
 pan\-id
 T}:T{
 uint32
diff --git a/man/nm-settings.xml b/man/nm-settings.xml
index bd255cb1..30895be0 100644
--- a/man/nm-settings.xml
+++ b/man/nm-settings.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0"?>
 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.3//EN" "http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd">
-<refentry id="nm-settings"><refentryinfo><title>nm-settings</title><author>NetworkManager developers</author></refentryinfo><refmeta><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum><refmiscinfo class="source">NetworkManager</refmiscinfo><refmiscinfo class="manual">Configuration</refmiscinfo><refmiscinfo class="version">1.14.4</refmiscinfo></refmeta><refnamediv><refname>nm-settings</refname><refpurpose>Description of settings and properties of NetworkManager connection profiles</refpurpose></refnamediv><refsect1 id="description"><title>Description</title><para>
+<refentry id="nm-settings"><refentryinfo><title>nm-settings</title><author>NetworkManager developers</author></refentryinfo><refmeta><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum><refmiscinfo class="source">NetworkManager</refmiscinfo><refmiscinfo class="manual">Configuration</refmiscinfo><refmiscinfo class="version">1.15.2</refmiscinfo></refmeta><refnamediv><refname>nm-settings</refname><refpurpose>Description of settings and properties of NetworkManager connection profiles</refpurpose></refnamediv><refsect1 id="description"><title>Description</title><para>
           NetworkManager is based on a concept of connection profiles, sometimes referred to as
           connections only. These connection profiles contain a network configuration. When
           NetworkManager activates a connection profile on a network device the configuration will
@@ -52,7 +52,7 @@
     <row><entry align="left" id="nm-settings.property.connection.read-only">read-only</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>FALSE if the connection can be modified using the provided settings service's D-Bus interface with the right privileges, or TRUE if the connection is read-only and cannot be modified.</entry></row>
     <row><entry align="left" id="nm-settings.property.connection.secondaries">secondaries</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>List of connection UUIDs that should be activated when the base connection itself is activated. Currently only VPN connections are supported.</entry></row>
     <row><entry align="left" id="nm-settings.property.connection.slave-type">slave-type</entry><entry align="left">string</entry><entry align="left"/><entry>Setting name of the device type of this slave's master connection (eg, "bond"), or NULL if this connection is not a slave.</entry></row>
-    <row><entry align="left" id="nm-settings.property.connection.stable-id">stable-id</entry><entry align="left">string</entry><entry align="left"/><entry>This represents the identity of the connection used for various purposes. It allows to configure multiple profiles to share the identity. Also, the stable-id can contain placeholders that are substituted dynamically and deterministically depending on the context. The stable-id is used for generating IPv6 stable private addresses with ipv6.addr-gen-mode=stable-privacy. It is also used to seed the generated cloned MAC address for ethernet.cloned-mac-address=stable and wifi.cloned-mac-address=stable. It is also used as DHCP client identifier with ipv4.dhcp-client-id=stable and to derive the DHCP DUID with ipv6.dhcp-duid=stable-[llt,ll,uuid]. Note that depending on the context where it is used, other parameters are also seeded into the generation algorithm. For example, a per-host key is commonly also included, so that different systems end up generating different IDs. Or with ipv6.addr-gen-mode=stable-privacy, also the device's name is included, so that different interfaces yield different addresses. The '$' character is treated special to perform dynamic substitutions at runtime. Currently supported are "${CONNECTION}", "${DEVICE}", "${BOOT}", "${RANDOM}". These effectively create unique IDs per-connection, per-device, per-boot, or every time. Note that "${DEVICE}" corresponds the the interface name of the device. Any unrecognized patterns following '$' are treated verbatim, however are reserved for future use. You are thus advised to avoid '$' or escape it as "$$". For example, set it to "${CONNECTION}-${BOOT}-${DEVICE}" to create a unique id for this connection that changes with every reboot and differs depending on the interface where the profile activates. If the value is unset, a global connection default is consulted. If the value is still unset, the default is similar to "${CONNECTION}" and uses a unique, fixed ID for the connection.</entry></row>
+    <row><entry align="left" id="nm-settings.property.connection.stable-id">stable-id</entry><entry align="left">string</entry><entry align="left"/><entry>This represents the identity of the connection used for various purposes. It allows to configure multiple profiles to share the identity. Also, the stable-id can contain placeholders that are substituted dynamically and deterministically depending on the context. The stable-id is used for generating IPv6 stable private addresses with ipv6.addr-gen-mode=stable-privacy. It is also used to seed the generated cloned MAC address for ethernet.cloned-mac-address=stable and wifi.cloned-mac-address=stable. It is also used as DHCP client identifier with ipv4.dhcp-client-id=stable and to derive the DHCP DUID with ipv6.dhcp-duid=stable-[llt,ll,uuid]. Note that depending on the context where it is used, other parameters are also seeded into the generation algorithm. For example, a per-host key is commonly also included, so that different systems end up generating different IDs. Or with ipv6.addr-gen-mode=stable-privacy, also the device's name is included, so that different interfaces yield different addresses. The '$' character is treated special to perform dynamic substitutions at runtime. Currently supported are "${CONNECTION}", "${DEVICE}", "${MAC}", "${BOOT}", "${RANDOM}". These effectively create unique IDs per-connection, per-device, per-boot, or every time. Note that "${DEVICE}" corresponds the the interface name of the device and "${MAC}" is the permanent MAC address of the device. Any unrecognized patterns following '$' are treated verbatim, however are reserved for future use. You are thus advised to avoid '$' or escape it as "$$". For example, set it to "${CONNECTION}-${BOOT}-${DEVICE}" to create a unique id for this connection that changes with every reboot and differs depending on the interface where the profile activates. If the value is unset, a global connection default is consulted. If the value is still unset, the default is similar to "${CONNECTION}" and uses a unique, fixed ID for the connection.</entry></row>
     <row><entry align="left" id="nm-settings.property.connection.timestamp">timestamp</entry><entry align="left">uint64</entry><entry align="left">0</entry><entry>The time, in seconds since the Unix Epoch, that the connection was last _successfully_ fully activated. NetworkManager updates the connection timestamp periodically when the connection is active to ensure that an active connection has the latest timestamp. The property is only meant for reading (changes to this property will not be preserved).</entry></row>
     <row><entry align="left" id="nm-settings.property.connection.type">type</entry><entry align="left">string</entry><entry align="left"/><entry>Base type of the connection. For hardware-dependent connections, should contain the setting name of the hardware-type specific setting (ie, "802-3-ethernet" or "802-11-wireless" or "bluetooth", etc), and for non-hardware dependent connections like VPN or otherwise, should contain the setting name of that setting type (ie, "vpn" or "bridge", etc).</entry></row>
     <row><entry align="left" id="nm-settings.property.connection.uuid">uuid</entry><entry align="left">string</entry><entry align="left"/><entry>A universally unique identifier for the connection, for example generated with libuuid.  It should be assigned when the connection is created, and never changed as long as the connection still applies to the same network.  For example, it should not be changed when the "id" property or NMSettingIP4Config changes, but might need to be re-created when the Wi-Fi SSID, mobile broadband network provider, or "type" property changes. The UUID must be in the format "2815492f-7e56-435e-b2e9-246bd7cdc664" (ie, contains only hexadecimal characters and "-").</entry></row>
@@ -177,7 +177,7 @@
     <row><entry align="left" id="nm-settings.property.gsm.home-only">home-only</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>When TRUE, only connections to the home network will be allowed. Connections to roaming networks will not be made.</entry></row>
     <row><entry align="left" id="nm-settings.property.gsm.mtu">mtu</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>If non-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple frames.</entry></row>
     <row><entry align="left" id="nm-settings.property.gsm.network-id">network-id</entry><entry align="left">string</entry><entry align="left"/><entry>The Network ID (GSM LAI format, ie MCC-MNC) to force specific network registration.  If the Network ID is specified, NetworkManager will attempt to force the device to register only on the specified network. This can be used to ensure that the device does not roam when direct roaming control of the device is not otherwise possible.</entry></row>
-    <row><entry align="left" id="nm-settings.property.gsm.number">number</entry><entry align="left">string</entry><entry align="left"/><entry>Number to dial when establishing a PPP data session with the GSM-based mobile broadband network.  Many modems do not require PPP for connections to the mobile network and thus this property should be left blank, which allows NetworkManager to select the appropriate settings automatically.</entry></row>
+    <row><entry align="left" id="nm-settings.property.gsm.number">number</entry><entry align="left">string</entry><entry align="left"/><entry>Legacy setting that used to help establishing PPP data sessions for GSM-based modems. Deprecated: 1</entry></row>
     <row><entry align="left" id="nm-settings.property.gsm.password">password</entry><entry align="left">string</entry><entry align="left"/><entry>The password used to authenticate with the network, if required.  Many providers do not require a password, or accept any password.  But if a password is required, it is specified here.</entry></row>
     <row><entry align="left" id="nm-settings.property.gsm.password-flags">password-flags</entry><entry align="left">NMSettingSecretFlags (uint32)</entry><entry align="left"/><entry>Flags indicating how to handle the "password" property. (see <xref linkend="secrets-flags"/> for flag values)</entry></row>
     <row><entry align="left" id="nm-settings.property.gsm.pin">pin</entry><entry align="left">string</entry><entry align="left"/><entry>If the SIM is locked with a PIN it must be unlocked before any other operations are requested.  Specify the PIN here to allow operation of the device.</entry></row>
@@ -197,14 +197,14 @@
     <row><entry align="left" id="nm-settings.property.ipv4.address-data">address-data</entry><entry align="left">array of vardict</entry><entry align="left"/><entry>Array of IPv4 addresses. Each address dictionary contains at least 'address' and 'prefix' entries, containing the IP address as a string, and the prefix length as a uint32. Additional attributes may also exist on some addresses.</entry></row>
     <row><entry align="left" id="nm-settings.property.ipv4.addresses">addresses</entry><entry align="left">array of array of uint32</entry><entry align="left">[]</entry><entry>Deprecated in favor of the 'address-data' and 'gateway' properties, but this can be used for backward-compatibility with older daemons. Note that if you send this property the daemon will ignore 'address-data' and 'gateway'.  Array of IPv4 address structures.  Each IPv4 address structure is composed of 3 32-bit values; the first being the IPv4 address (network byte order), the second the prefix (1 - 32), and last the IPv4 gateway (network byte order). The gateway may be left as 0 if no gateway exists for that subnet.</entry></row>
     <row><entry align="left" id="nm-settings.property.ipv4.dad-timeout">dad-timeout</entry><entry align="left">int32</entry><entry align="left">-1</entry><entry>Timeout in milliseconds used to check for the presence of duplicate IP addresses on the network.  If an address conflict is detected, the activation will fail.  A zero value means that no duplicate address detection is performed, -1 means the default value (either configuration ipvx.dad-timeout override or zero).  A value greater than zero is a timeout in milliseconds. The property is currently implemented only for IPv4.</entry></row>
-    <row><entry align="left" id="nm-settings.property.ipv4.dhcp-client-id">dhcp-client-id</entry><entry align="left">string</entry><entry align="left"/><entry>A string sent to the DHCP server to identify the local machine which the DHCP server may use to customize the DHCP lease and options. When the property is a hex string ('aa:bb:cc') it is interpreted as a binary client ID, in which case the first byte is assumed to be the 'type' field as per RFC 2132 section 9.14 and the remaining bytes may be an hardware address (e.g. '01:xx:xx:xx:xx:xx:xx' where 1 is the Ethernet ARP type and the rest is a MAC address). If the property is not a hex string it is considered as a non-hardware-address client ID and the 'type' field is set to 0. The special values "mac" and "perm-mac" are supported, which use the current or permanent MAC address of the device to generate a client identifier with type ethernet (01). Currently, these options only work for ethernet type of links. The special value "stable" is supported to generate a type 0 client identifier based on the stable-id (see connection.stable-id) and a per-host key. If unset, a globally configured default is used. If still unset, the client-id from the last lease is reused.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv4.dhcp-client-id">dhcp-client-id</entry><entry align="left">string</entry><entry align="left"/><entry>A string sent to the DHCP server to identify the local machine which the DHCP server may use to customize the DHCP lease and options. When the property is a hex string ('aa:bb:cc') it is interpreted as a binary client ID, in which case the first byte is assumed to be the 'type' field as per RFC 2132 section 9.14 and the remaining bytes may be an hardware address (e.g. '01:xx:xx:xx:xx:xx:xx' where 1 is the Ethernet ARP type and the rest is a MAC address). If the property is not a hex string it is considered as a non-hardware-address client ID and the 'type' field is set to 0. The special values "mac" and "perm-mac" are supported, which use the current or permanent MAC address of the device to generate a client identifier with type ethernet (01). Currently, these options only work for ethernet type of links. The special value "duid" generates a RFC4361-compliant client identifier based on a hash of the interface name as IAID and /etc/machine-id. The special value "stable" is supported to generate a type 0 client identifier based on the stable-id (see connection.stable-id) and a per-host key. If you set the stable-id, you may want to include the "${DEVICE}" or "${MAC}" specifier to get a per-device key. If unset, a globally configured default is used. If still unset, the default depends on the DHCP plugin.</entry></row>
     <row><entry align="left" id="nm-settings.property.ipv4.dhcp-fqdn">dhcp-fqdn</entry><entry align="left">string</entry><entry align="left"/><entry>If the "dhcp-send-hostname" property is TRUE, then the specified FQDN will be sent to the DHCP server when acquiring a lease. This property and "dhcp-hostname" are mutually exclusive and cannot be set at the same time.</entry></row>
     <row><entry align="left" id="nm-settings.property.ipv4.dhcp-hostname">dhcp-hostname</entry><entry align="left">string</entry><entry align="left"/><entry>If the "dhcp-send-hostname" property is TRUE, then the specified name will be sent to the DHCP server when acquiring a lease. This property and "dhcp-fqdn" are mutually exclusive and cannot be set at the same time.</entry></row>
     <row><entry align="left" id="nm-settings.property.ipv4.dhcp-send-hostname">dhcp-send-hostname</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>If TRUE, a hostname is sent to the DHCP server when acquiring a lease. Some DHCP servers use this hostname to update DNS databases, essentially providing a static hostname for the computer.  If the "dhcp-hostname" property is NULL and this property is TRUE, the current persistent hostname of the computer is sent.</entry></row>
     <row><entry align="left" id="nm-settings.property.ipv4.dhcp-timeout">dhcp-timeout</entry><entry align="left">int32</entry><entry align="left">0</entry><entry>A timeout for a DHCP transaction in seconds.</entry></row>
     <row><entry align="left" id="nm-settings.property.ipv4.dns">dns</entry><entry align="left">array of uint32</entry><entry align="left">[]</entry><entry>Array of IP addresses of DNS servers (as network-byte-order integers)</entry></row>
     <row><entry align="left" id="nm-settings.property.ipv4.dns-options">dns-options</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>Array of DNS options as described in man 5 resolv.conf. NULL means that the options are unset and left at the default. In this case NetworkManager will use default options. This is distinct from an empty list of properties.</entry></row>
-    <row><entry align="left" id="nm-settings.property.ipv4.dns-priority">dns-priority</entry><entry align="left">int32</entry><entry align="left">0</entry><entry>DNS servers priority. The relative priority for DNS servers specified by this setting.  A lower value is better (higher priority).  Zero selects the default value, which is 50 for VPNs and 100 for other connections. Note that the priority is to order DNS settings for multiple active connections.  It does not disambiguate multiple DNS servers within the same connection profile. When using dns=default, servers with higher priority will be on top of resolv.conf.  To prioritize a given server over another one within the same connection, just specify them in the desired order.  When multiple devices have configurations with the same priority, the one with an active default route will be preferred.  Negative values have the special effect of excluding other configurations with a greater priority value; so in presence of at least a negative priority, only DNS servers from connections with the lowest priority value will be used. When using a DNS resolver that supports split-DNS as dns=dnsmasq or dns=systemd-resolved, each connection is used to query domains in its search list.  Queries for domains not present in any search list are routed through connections having the '~.' special wildcard domain, which is added automatically to connections with the default route (or can be added manually).  When multiple connections specify the same domain, the one with the highest priority (lowest numerical value) wins.  If a connection specifies a domain which is subdomain of another domain with a negative DNS priority value, the subdomain is ignored.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv4.dns-priority">dns-priority</entry><entry align="left">int32</entry><entry align="left">0</entry><entry>DNS servers priority. The relative priority for DNS servers specified by this setting.  A lower value is better (higher priority). Zero selects a globally configured default value. If the latter is missing or zero too, it defaults to 50 for VPNs and 100 for other connections. Note that the priority is to order DNS settings for multiple active connections.  It does not disambiguate multiple DNS servers within the same connection profile. When using dns=default, servers with higher priority will be on top of resolv.conf.  To prioritize a given server over another one within the same connection, just specify them in the desired order.  When multiple devices have configurations with the same priority, the one with an active default route will be preferred.  Negative values have the special effect of excluding other configurations with a greater priority value; so in presence of at least a negative priority, only DNS servers from connections with the lowest priority value will be used. When using a DNS resolver that supports split-DNS as dns=dnsmasq or dns=systemd-resolved, each connection is used to query domains in its search list.  Queries for domains not present in any search list are routed through connections having the '~.' special wildcard domain, which is added automatically to connections with the default route (or can be added manually).  When multiple connections specify the same domain, the one with the highest priority (lowest numerical value) wins.  If a connection specifies a domain which is subdomain of another domain with a negative DNS priority value, the subdomain is ignored.</entry></row>
     <row><entry align="left" id="nm-settings.property.ipv4.dns-search">dns-search</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>Array of DNS search domains. Domains starting with a tilde ('~') are considered 'routing' domains and are used only to decide the interface over which a query must be forwarded; they are not used to complete unqualified host names.</entry></row>
     <row><entry align="left" id="nm-settings.property.ipv4.gateway">gateway</entry><entry align="left">string</entry><entry align="left"/><entry>The gateway associated with this configuration. This is only meaningful if "addresses" is also set.</entry></row>
     <row><entry align="left" id="nm-settings.property.ipv4.ignore-auto-dns">ignore-auto-dns</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>When "method" is set to "auto" and this property to TRUE, automatically configured nameservers and search domains are ignored and only nameservers and search domains specified in the "dns" and "dns-search" properties, if any, are used.</entry></row>
@@ -222,13 +222,13 @@
     <row><entry align="left" id="nm-settings.property.ipv6.address-data">address-data</entry><entry align="left">array of vardict</entry><entry align="left"/><entry>Array of IPv6 addresses. Each address dictionary contains at least 'address' and 'prefix' entries, containing the IP address as a string, and the prefix length as a uint32. Additional attributes may also exist on some addresses.</entry></row>
     <row><entry align="left" id="nm-settings.property.ipv6.addresses">addresses</entry><entry align="left">array of legacy IPv6 address struct (a(ayuay))</entry><entry align="left">[]</entry><entry>Deprecated in favor of the 'address-data' and 'gateway' properties, but this can be used for backward-compatibility with older daemons. Note that if you send this property the daemon will ignore 'address-data' and 'gateway'.  Array of IPv6 address structures.  Each IPv6 address structure is composed of an IPv6 address, a prefix length (1 - 128), and an IPv6 gateway address. The gateway may be zeroed out if no gateway exists for that subnet.</entry></row>
     <row><entry align="left" id="nm-settings.property.ipv6.dad-timeout">dad-timeout</entry><entry align="left">int32</entry><entry align="left">-1</entry><entry>Timeout in milliseconds used to check for the presence of duplicate IP addresses on the network.  If an address conflict is detected, the activation will fail.  A zero value means that no duplicate address detection is performed, -1 means the default value (either configuration ipvx.dad-timeout override or zero).  A value greater than zero is a timeout in milliseconds. The property is currently implemented only for IPv4.</entry></row>
-    <row><entry align="left" id="nm-settings.property.ipv6.dhcp-duid">dhcp-duid</entry><entry align="left">string</entry><entry align="left"/><entry>A string containing the DHCPv6 Unique Identifier (DUID) used by the dhcp client to identify itself to DHCPv6 servers (RFC 3315). The DUID is carried in the Client Identifier option. If the property is a hex string ('aa:bb:cc') it is interpreted as a binary DUID and filled as an opaque value in the Client Identifier option. The special value "lease" will retrieve the DUID previously used from the lease file belonging to the connection. If no DUID is found and "dhclient" is the configured dhcp client, the DUID is searched in the system-wide dhclient lease file. If still no DUID is found, or another dhcp client is used, a global and permanent DUID-UUID (RFC 6355) will be generated based on the machine-id. The special values "llt" and "ll" will generate a DUID of type LLT or LL (see RFC 3315) based on the current MAC address of the device. In order to try providing a stable DUID-LLT, the time field will contain a constant timestamp that is used globally (for all profiles) and persisted to disk. The special values "stable-llt", "stable-ll" and "stable-uuid" will generate a DUID of the corresponding type, derived from the connection's stable-id and a per-host unique key. So, the link-layer address of "stable-ll" and "stable-llt" will be a generated address derived from the stable id. The DUID-LLT time value in the "stable-llt" option will be picked among a static timespan of three years (the upper bound of the interval is the same constant timestamp used in "llt"). When the property is unset, the global value provided for "ipv6.dhcp-duid" is used. If no global value is provided, the default "lease" value is assumed.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv6.dhcp-duid">dhcp-duid</entry><entry align="left">string</entry><entry align="left"/><entry>A string containing the DHCPv6 Unique Identifier (DUID) used by the dhcp client to identify itself to DHCPv6 servers (RFC 3315). The DUID is carried in the Client Identifier option. If the property is a hex string ('aa:bb:cc') it is interpreted as a binary DUID and filled as an opaque value in the Client Identifier option. The special value "lease" will retrieve the DUID previously used from the lease file belonging to the connection. If no DUID is found and "dhclient" is the configured dhcp client, the DUID is searched in the system-wide dhclient lease file. If still no DUID is found, or another dhcp client is used, a global and permanent DUID-UUID (RFC 6355) will be generated based on the machine-id. The special values "llt" and "ll" will generate a DUID of type LLT or LL (see RFC 3315) based on the current MAC address of the device. In order to try providing a stable DUID-LLT, the time field will contain a constant timestamp that is used globally (for all profiles) and persisted to disk. The special values "stable-llt", "stable-ll" and "stable-uuid" will generate a DUID of the corresponding type, derived from the connection's stable-id and a per-host unique key. You may want to include the "${DEVICE}" or "${MAC}" specifier in the stable-id, in case this profile gets activated on multiple devices. So, the link-layer address of "stable-ll" and "stable-llt" will be a generated address derived from the stable id. The DUID-LLT time value in the "stable-llt" option will be picked among a static timespan of three years (the upper bound of the interval is the same constant timestamp used in "llt"). When the property is unset, the global value provided for "ipv6.dhcp-duid" is used. If no global value is provided, the default "lease" value is assumed.</entry></row>
     <row><entry align="left" id="nm-settings.property.ipv6.dhcp-hostname">dhcp-hostname</entry><entry align="left">string</entry><entry align="left"/><entry>If the "dhcp-send-hostname" property is TRUE, then the specified name will be sent to the DHCP server when acquiring a lease. This property and "dhcp-fqdn" are mutually exclusive and cannot be set at the same time.</entry></row>
     <row><entry align="left" id="nm-settings.property.ipv6.dhcp-send-hostname">dhcp-send-hostname</entry><entry align="left">boolean</entry><entry align="left">TRUE</entry><entry>If TRUE, a hostname is sent to the DHCP server when acquiring a lease. Some DHCP servers use this hostname to update DNS databases, essentially providing a static hostname for the computer.  If the "dhcp-hostname" property is NULL and this property is TRUE, the current persistent hostname of the computer is sent.</entry></row>
     <row><entry align="left" id="nm-settings.property.ipv6.dhcp-timeout">dhcp-timeout</entry><entry align="left">int32</entry><entry align="left">0</entry><entry>A timeout for a DHCP transaction in seconds.</entry></row>
     <row><entry align="left" id="nm-settings.property.ipv6.dns">dns</entry><entry align="left">array of byte array</entry><entry align="left">[]</entry><entry>Array of IP addresses of DNS servers (in network byte order)</entry></row>
     <row><entry align="left" id="nm-settings.property.ipv6.dns-options">dns-options</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>Array of DNS options as described in man 5 resolv.conf. NULL means that the options are unset and left at the default. In this case NetworkManager will use default options. This is distinct from an empty list of properties.</entry></row>
-    <row><entry align="left" id="nm-settings.property.ipv6.dns-priority">dns-priority</entry><entry align="left">int32</entry><entry align="left">0</entry><entry>DNS servers priority. The relative priority for DNS servers specified by this setting.  A lower value is better (higher priority).  Zero selects the default value, which is 50 for VPNs and 100 for other connections. Note that the priority is to order DNS settings for multiple active connections.  It does not disambiguate multiple DNS servers within the same connection profile. When using dns=default, servers with higher priority will be on top of resolv.conf.  To prioritize a given server over another one within the same connection, just specify them in the desired order.  When multiple devices have configurations with the same priority, the one with an active default route will be preferred.  Negative values have the special effect of excluding other configurations with a greater priority value; so in presence of at least a negative priority, only DNS servers from connections with the lowest priority value will be used. When using a DNS resolver that supports split-DNS as dns=dnsmasq or dns=systemd-resolved, each connection is used to query domains in its search list.  Queries for domains not present in any search list are routed through connections having the '~.' special wildcard domain, which is added automatically to connections with the default route (or can be added manually).  When multiple connections specify the same domain, the one with the highest priority (lowest numerical value) wins.  If a connection specifies a domain which is subdomain of another domain with a negative DNS priority value, the subdomain is ignored.</entry></row>
+    <row><entry align="left" id="nm-settings.property.ipv6.dns-priority">dns-priority</entry><entry align="left">int32</entry><entry align="left">0</entry><entry>DNS servers priority. The relative priority for DNS servers specified by this setting.  A lower value is better (higher priority). Zero selects a globally configured default value. If the latter is missing or zero too, it defaults to 50 for VPNs and 100 for other connections. Note that the priority is to order DNS settings for multiple active connections.  It does not disambiguate multiple DNS servers within the same connection profile. When using dns=default, servers with higher priority will be on top of resolv.conf.  To prioritize a given server over another one within the same connection, just specify them in the desired order.  When multiple devices have configurations with the same priority, the one with an active default route will be preferred.  Negative values have the special effect of excluding other configurations with a greater priority value; so in presence of at least a negative priority, only DNS servers from connections with the lowest priority value will be used. When using a DNS resolver that supports split-DNS as dns=dnsmasq or dns=systemd-resolved, each connection is used to query domains in its search list.  Queries for domains not present in any search list are routed through connections having the '~.' special wildcard domain, which is added automatically to connections with the default route (or can be added manually).  When multiple connections specify the same domain, the one with the highest priority (lowest numerical value) wins.  If a connection specifies a domain which is subdomain of another domain with a negative DNS priority value, the subdomain is ignored.</entry></row>
     <row><entry align="left" id="nm-settings.property.ipv6.dns-search">dns-search</entry><entry align="left">array of string</entry><entry align="left">[]</entry><entry>Array of DNS search domains. Domains starting with a tilde ('~') are considered 'routing' domains and are used only to decide the interface over which a query must be forwarded; they are not used to complete unqualified host names.</entry></row>
     <row><entry align="left" id="nm-settings.property.ipv6.gateway">gateway</entry><entry align="left">string</entry><entry align="left"/><entry>The gateway associated with this configuration. This is only meaningful if "addresses" is also set.</entry></row>
     <row><entry align="left" id="nm-settings.property.ipv6.ignore-auto-dns">ignore-auto-dns</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>When "method" is set to "auto" and this property to TRUE, automatically configured nameservers and search domains are ignored and only nameservers and search domains specified in the "dns" and "dns-search" properties, if any, are used.</entry></row>
@@ -345,8 +345,8 @@
   </tbody></tgroup></informaltable></refsect2>
   <refsect2><title>sriov setting</title><para>SR-IOV settings..</para><informaltable><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
     <row><entry align="left" id="nm-settings.property.sriov.autoprobe-drivers">autoprobe-drivers</entry><entry align="left">NMTernary (int32)</entry><entry align="left"/><entry>Whether to autoprobe virtual functions by a compatible driver. If set to NM_TERNARY_TRUE (1), the kernel will try to bind VFs to a compatible driver and if this succeeds a new network interface will be instantiated for each VF. If set to NM_TERNARY_FALSE (0), VFs will not be claimed and no network interfaces will be created for them. When set to NM_TERNARY_DEFAULT (-1), the global default is used; in case the global default is unspecified it is assumed to be NM_TERNARY_TRUE (1).</entry></row>
-    <row><entry align="left" id="nm-settings.property.sriov.total-vfs">total-vfs</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>The total number of virtual functions to create.</entry></row>
-    <row><entry align="left" id="nm-settings.property.sriov.vfs">vfs</entry><entry align="left">array of vardict</entry><entry align="left">[]</entry><entry>Array of virtual function descriptors. Each VF descriptor is a dictionary mapping attribute names to GVariant values. The 'index' entry is mandatory for each VF. When represented as string a VF is in the form: "INDEX [ATTR=VALUE[ ATTR=VALUE]...]". for example: "2 mac=00:11:22:33:44:55 spoof-check=true". The "vlans" attribute is represented as a semicolor-separated list of VLAN descriptors, where each descriptor has the form "ID[.PRIORITY[.PROTO]]". PROTO can be either 'q' for 802.1Q (the default) or 'ad' for 802.1ad.</entry></row>
+    <row><entry align="left" id="nm-settings.property.sriov.total-vfs">total-vfs</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>The total number of virtual functions to create. Note that when the sriov setting is present NetworkManager enforces the number of virtual functions on the interface also when it is zero. To prevent any changes to SR-IOV parameters don't add a sriov setting to the connection.</entry></row>
+    <row><entry align="left" id="nm-settings.property.sriov.vfs">vfs</entry><entry align="left">array of vardict</entry><entry align="left">[]</entry><entry>Array of virtual function descriptors. Each VF descriptor is a dictionary mapping attribute names to GVariant values. The 'index' entry is mandatory for each VF. When represented as string a VF is in the form: "INDEX [ATTR=VALUE[ ATTR=VALUE]...]". for example: "2 mac=00:11:22:33:44:55 spoof-check=true". Multiple VFs can be specified using a comma as separator. Currently the following attributes are supported: mac, spoof-check, trust, min-tx-rate, max-tx-rate, vlans. The "vlans" attribute is represented as a semicolon-separated list of VLAN descriptors, where each descriptor has the form "ID[.PRIORITY[.PROTO]]". PROTO can be either 'q' for 802.1Q (the default) or 'ad' for 802.1ad.</entry></row>
   </tbody></tgroup></informaltable></refsect2>
   <refsect2><title>tc setting</title><para>Linux Traffic Control Settings..</para><informaltable><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
     <row><entry align="left" id="nm-settings.property.tc.qdiscs">qdiscs</entry><entry align="left">array of vardict</entry><entry align="left">[]</entry><entry>Array of TC queueing disciplines.</entry></row>
@@ -355,7 +355,7 @@
   <refsect2><title>team setting</title><para>Teaming Settings.</para><informaltable><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
     <row><entry align="left" id="nm-settings.property.team.config">config</entry><entry align="left">string</entry><entry align="left"/><entry>The JSON configuration for the team network interface.  The property should contain raw JSON configuration data suitable for teamd, because the value is passed directly to teamd. If not specified, the default configuration is used.  See man teamd.conf for the format details.</entry></row>
     <row><entry align="left" id="nm-settings.property.team.interface-name">interface-name</entry><entry align="left">string</entry><entry align="left"/><entry>Deprecated in favor of connection.interface-name, but can be used for backward-compatibility with older daemons, to set the team's interface name.</entry></row>
-    <row><entry align="left" id="nm-settings.property.team.link-watchers">link-watchers</entry><entry align="left">array of vardict</entry><entry align="left">[]</entry><entry>Link watchers configuration for the connection: each link watcher is defined by a dictionary, whose keys depend upon the selected link watcher. Available link watchers are 'ethtool', 'nsna_ping' and 'arp_ping' and it is specified in the dictionary with the key 'name'. Available keys are:   ethtool: 'delay-up', 'delay-down', 'init-wait'; nsna_ping: 'init-wait', 'interval', 'missed-max', 'target-host'; arp_ping: all the ones in nsna_ping and 'source-host', 'validate-active', 'validate-incative', 'send-always'. See teamd.conf man for more details.</entry></row>
+    <row><entry align="left" id="nm-settings.property.team.link-watchers">link-watchers</entry><entry align="left">array of vardict</entry><entry align="left">[]</entry><entry>Link watchers configuration for the connection: each link watcher is defined by a dictionary, whose keys depend upon the selected link watcher. Available link watchers are 'ethtool', 'nsna_ping' and 'arp_ping' and it is specified in the dictionary with the key 'name'. Available keys are:   ethtool: 'delay-up', 'delay-down', 'init-wait'; nsna_ping: 'init-wait', 'interval', 'missed-max', 'target-host'; arp_ping: all the ones in nsna_ping and 'source-host', 'validate-active', 'validate-inactive', 'send-always'. See teamd.conf man for more details.</entry></row>
     <row><entry align="left" id="nm-settings.property.team.mcast-rejoin-count">mcast-rejoin-count</entry><entry align="left">int32</entry><entry align="left">0</entry><entry>Corresponds to the teamd mcast_rejoin.count.</entry></row>
     <row><entry align="left" id="nm-settings.property.team.mcast-rejoin-interval">mcast-rejoin-interval</entry><entry align="left">int32</entry><entry align="left">0</entry><entry>Corresponds to the teamd mcast_rejoin.interval.</entry></row>
     <row><entry align="left" id="nm-settings.property.team.notify-peers-count">notify-peers-count</entry><entry align="left">int32</entry><entry align="left">0</entry><entry>Corresponds to the teamd notify_peers.count.</entry></row>
@@ -375,7 +375,7 @@
     <row><entry align="left" id="nm-settings.property.team-port.config">config</entry><entry align="left">string</entry><entry align="left"/><entry>The JSON configuration for the team port. The property should contain raw JSON configuration data suitable for teamd, because the value is passed directly to teamd. If not specified, the default configuration is used. See man teamd.conf for the format details.</entry></row>
     <row><entry align="left" id="nm-settings.property.team-port.lacp-key">lacp-key</entry><entry align="left">int32</entry><entry align="left">0</entry><entry>Corresponds to the teamd ports.PORTIFNAME.lacp_key.</entry></row>
     <row><entry align="left" id="nm-settings.property.team-port.lacp-prio">lacp-prio</entry><entry align="left">int32</entry><entry align="left">255</entry><entry>Corresponds to the teamd ports.PORTIFNAME.lacp_prio.</entry></row>
-    <row><entry align="left" id="nm-settings.property.team-port.link-watchers">link-watchers</entry><entry align="left">array of vardict</entry><entry align="left">[]</entry><entry>Link watchers configuration for the connection: each link watcher is defined by a dictionary, whose keys depend upon the selected link watcher. Available link watchers are 'ethtool', 'nsna_ping' and 'arp_ping' and it is specified in the dictionary with the key 'name'. Available keys are:   ethtool: 'delay-up', 'delay-down', 'init-wait'; nsna_ping: 'init-wait', 'interval', 'missed-max', 'target-host'; arp_ping: all the ones in nsna_ping and 'source-host', 'validate-active', 'validate-incative', 'send-always'. See teamd.conf man for more details.</entry></row>
+    <row><entry align="left" id="nm-settings.property.team-port.link-watchers">link-watchers</entry><entry align="left">array of vardict</entry><entry align="left">[]</entry><entry>Link watchers configuration for the connection: each link watcher is defined by a dictionary, whose keys depend upon the selected link watcher. Available link watchers are 'ethtool', 'nsna_ping' and 'arp_ping' and it is specified in the dictionary with the key 'name'. Available keys are:   ethtool: 'delay-up', 'delay-down', 'init-wait'; nsna_ping: 'init-wait', 'interval', 'missed-max', 'target-host'; arp_ping: all the ones in nsna_ping and 'source-host', 'validate-active', 'validate-inactive', 'send-always'. See teamd.conf man for more details.</entry></row>
     <row><entry align="left" id="nm-settings.property.team-port.prio">prio</entry><entry align="left">int32</entry><entry align="left">0</entry><entry>Corresponds to the teamd ports.PORTIFNAME.prio.</entry></row>
     <row><entry align="left" id="nm-settings.property.team-port.queue-id">queue-id</entry><entry align="left">int32</entry><entry align="left">-1</entry><entry>Corresponds to the teamd ports.PORTIFNAME.queue_id. When set to -1 means the parameter is skipped from the json config.</entry></row>
     <row><entry align="left" id="nm-settings.property.team-port.sticky">sticky</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>Corresponds to the teamd ports.PORTIFNAME.sticky.</entry></row>
@@ -430,7 +430,7 @@
     <row><entry align="left" id="nm-settings.property.wimax.network-name">network-name</entry><entry align="left">string</entry><entry align="left"/><entry>Network Service Provider (NSP) name of the WiMAX network this connection should use. Deprecated: 1</entry></row>
   </tbody></tgroup></informaltable></refsect2>
   <refsect2><title>802-3-ethernet setting</title><para>Wired Ethernet Settings.</para><informaltable><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
-    <row><entry align="left" id="nm-settings.property.802-3-ethernet.assigned-mac-address">assigned-mac-address</entry><entry align="left">string</entry><entry align="left"/><entry>The new field for the cloned MAC address. It can be either a hardware address in ASCII representation, or one of the special values "preserve", "permanent", "random" or "stable". This field replaces the deprecated "cloned-mac-address" on D-Bus, which can only contain explict hardware addresses. Note that this property only exists in D-Bus API. libnm and nmcli continue to call this property "cloned-mac-address".</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-3-ethernet.assigned-mac-address">assigned-mac-address</entry><entry align="left">string</entry><entry align="left"/><entry>The new field for the cloned MAC address. It can be either a hardware address in ASCII representation, or one of the special values "preserve", "permanent", "random" or "stable". This field replaces the deprecated "cloned-mac-address" on D-Bus, which can only contain explicit hardware addresses. Note that this property only exists in D-Bus API. libnm and nmcli continue to call this property "cloned-mac-address".</entry></row>
     <row><entry align="left" id="nm-settings.property.802-3-ethernet.auto-negotiate">auto-negotiate</entry><entry align="left">boolean</entry><entry align="left">FALSE</entry><entry>When TRUE, enforce auto-negotiation of speed and duplex mode. If "speed" and "duplex" properties are both specified, only that single mode will be advertised and accepted during the link auto-negotiation process: this works only for BASE-T 802.3 specifications and is useful for enforcing gigabits modes, as in these cases link negotiation is mandatory. When FALSE, "speed" and "duplex" properties should be both set or link configuration will be skipped.</entry></row>
     <row><entry align="left" id="nm-settings.property.802-3-ethernet.cloned-mac-address">cloned-mac-address</entry><entry align="left">byte array</entry><entry align="left"/><entry>This D-Bus field is deprecated in favor of "assigned-mac-address" which is more flexible and allows specifying special variants like "random". For libnm and nmcli, this field is called "cloned-mac-address".</entry></row>
     <row><entry align="left" id="nm-settings.property.802-3-ethernet.duplex">duplex</entry><entry align="left">string</entry><entry align="left"/><entry>When a value is set, either "half" or "full", configures the device to use the specified duplex mode. If "auto-negotiate" is "yes" the specified duplex mode will be the only one advertised during link negotiation: this works only for BASE-T 802.3 specifications and is useful for enforcing gigabits modes, as in these cases link negotiation is mandatory. If the value is unset (the default), the link configuration will be either skipped (if "auto-negotiate" is "no", the default) or will be auto-negotiated (if "auto-negotiate" is "yes") and the local device will advertise all the supported duplex modes. Must be set together with the "speed" property if specified. Before specifying a duplex mode be sure your device supports it.</entry></row>
@@ -447,7 +447,7 @@
     <row><entry align="left" id="nm-settings.property.802-3-ethernet.wake-on-lan-password">wake-on-lan-password</entry><entry align="left">string</entry><entry align="left"/><entry>If specified, the password used with magic-packet-based Wake-on-LAN, represented as an Ethernet MAC address.  If NULL, no password will be required.</entry></row>
   </tbody></tgroup></informaltable></refsect2>
   <refsect2><title>802-11-wireless setting</title><para>Wi-Fi Settings.</para><informaltable><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
-    <row><entry align="left" id="nm-settings.property.802-11-wireless.assigned-mac-address">assigned-mac-address</entry><entry align="left">string</entry><entry align="left"/><entry>The new field for the cloned MAC address. It can be either a hardware address in ASCII representation, or one of the special values "preserve", "permanent", "random" or "stable". This field replaces the deprecated "cloned-mac-address" on D-Bus, which can only contain explict hardware addresses. Note that this property only exists in D-Bus API. libnm and nmcli continue to call this property "cloned-mac-address".</entry></row>
+    <row><entry align="left" id="nm-settings.property.802-11-wireless.assigned-mac-address">assigned-mac-address</entry><entry align="left">string</entry><entry align="left"/><entry>The new field for the cloned MAC address. It can be either a hardware address in ASCII representation, or one of the special values "preserve", "permanent", "random" or "stable". This field replaces the deprecated "cloned-mac-address" on D-Bus, which can only contain explicit hardware addresses. Note that this property only exists in D-Bus API. libnm and nmcli continue to call this property "cloned-mac-address".</entry></row>
     <row><entry align="left" id="nm-settings.property.802-11-wireless.band">band</entry><entry align="left">string</entry><entry align="left"/><entry>802.11 frequency band of the network.  One of "a" for 5GHz 802.11a or "bg" for 2.4GHz 802.11.  This will lock associations to the Wi-Fi network to the specific band, i.e. if "a" is specified, the device will not associate with the same network in the 2.4GHz band even if the network's settings are compatible.  This setting depends on specific driver capability and may not work with all drivers.</entry></row>
     <row><entry align="left" id="nm-settings.property.802-11-wireless.bssid">bssid</entry><entry align="left">byte array</entry><entry align="left"/><entry>If specified, directs the device to only associate with the given access point.  This capability is highly driver dependent and not supported by all devices.  Note: this property does not control the BSSID used when creating an Ad-Hoc network and is unlikely to in the future.</entry></row>
     <row><entry align="left" id="nm-settings.property.802-11-wireless.channel">channel</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>Wireless channel to use for the Wi-Fi connection.  The device will only join (or create for Ad-Hoc networks) a Wi-Fi network on the specified channel.  Because channel numbers overlap between bands, this property also requires the "band" property to be set.</entry></row>
@@ -490,7 +490,9 @@
     <row><entry align="left" id="nm-settings.property.802-11-wireless-security.wps-method">wps-method</entry><entry align="left">uint32</entry><entry align="left">0</entry><entry>Flags indicating which mode of WPS is to be used if any. There's little point in changing the default setting as NetworkManager will automatically determine whether it's feasible to start WPS enrollment from the Access Point capabilities. WPS can be disabled by setting this property to a value of 1.</entry></row>
   </tbody></tgroup></informaltable></refsect2>
   <refsect2><title>wpan setting</title><para>IEEE 802.15.4 (WPAN) MAC Settings.</para><informaltable><tgroup cols="4"><thead><row><entry>Key Name</entry><entry>Value Type</entry><entry>Default Value</entry><entry>Value Description</entry></row></thead><tbody>
+    <row><entry align="left" id="nm-settings.property.wpan.channel">channel</entry><entry align="left">int32</entry><entry align="left">-1</entry><entry>IEEE 802.15.4 channel. A positive integer or -1, meaning "do not set, use whatever the device is already set to".</entry></row>
     <row><entry align="left" id="nm-settings.property.wpan.mac-address">mac-address</entry><entry align="left">string</entry><entry align="left"/><entry>If specified, this connection will only apply to the IEEE 802.15.4 (WPAN) MAC layer device whose permanent MAC address matches.</entry></row>
+    <row><entry align="left" id="nm-settings.property.wpan.page">page</entry><entry align="left">int32</entry><entry align="left">-1</entry><entry>IEEE 802.15.4 channel page. A positive integer or -1, meaning "do not set, use whatever the device is already set to".</entry></row>
     <row><entry align="left" id="nm-settings.property.wpan.pan-id">pan-id</entry><entry align="left">uint32</entry><entry align="left">65535</entry><entry>IEEE 802.15.4 Personal Area Network (PAN) identifier.</entry></row>
     <row><entry align="left" id="nm-settings.property.wpan.short-address">short-address</entry><entry align="left">uint32</entry><entry align="left">65535</entry><entry>Short IEEE 802.15.4 address to be used within a restricted environment.</entry></row>
   </tbody></tgroup></informaltable></refsect2>
diff --git a/man/nmcli-examples.7 b/man/nmcli-examples.7
index b5a5e7d3..08018e68 100644
--- a/man/nmcli-examples.7
+++ b/man/nmcli-examples.7
@@ -2,12 +2,12 @@
 .\"     Title: nmcli-examples
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
-.\"      Date: 10/24/2018
+.\"      Date: 01/22/2019
 .\"    Manual: Examples
-.\"    Source: NetworkManager 1.14.4
+.\"    Source: NetworkManager 1.15.2
 .\"  Language: English
 .\"
-.TH "NMCLI\-EXAMPLES" "7" "" "NetworkManager 1\&.14\&.4" "Examples"
+.TH "NMCLI\-EXAMPLES" "7" "" "NetworkManager 1\&.15\&.2" "Examples"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -200,7 +200,25 @@ The first command makes NetworkManager log in DEBUG level, and only for CORE, ET
 \fBNetworkManager.conf\fR(5)
 manual page for available logging levels and domains\&.
 .PP
-\fBExample\ \&6.\ \&Adding a bonding master and two slave connection profiles\fR
+\fBExample\ \&6.\ \&Activating a VPN connection profile requiring interactive password input\fR
+.sp
+.if n \{\
+.RS 4
+.\}
+.nf
+$ \fBnmcli \-\-ask con up my\-vpn\-con\fR
+.fi
+.if n \{\
+.RE
+.\}
+.PP
+This command activates a VPN connection profile enabling nmcli to interact with the user (\*(Aq\-\-ask\*(Aq): this will allow nmcli to prompt for the VPN password on the command line when the
+\fIpassword\-flags\fR
+are set to \*(Aq0x02\*(Aq (\*(Aqalways ask\*(Aq, see
+\fBnm-settings\fR(5)
+)\&. This is particularly useful for OTP based VPNs, as the user needs to be prompted for the password each time the connection is activated\&.
+.PP
+\fBExample\ \&7.\ \&Adding a bonding master and two slave connection profiles\fR
 .sp
 .if n \{\
 .RS 4
@@ -224,7 +242,7 @@ mode\&. The next two commands add slaves connections, both enslaved to
 interface, the second to
 \fIeth2\fR\&.
 .PP
-\fBExample\ \&7.\ \&Adding a team master and two slave connection profiles\fR
+\fBExample\ \&8.\ \&Adding a team master and two slave connection profiles\fR
 .sp
 .if n \{\
 .RS 4
@@ -266,7 +284,7 @@ will use its default configuration\&. You will activate the whole setup by activ
 .sp
 By default, the created profiles are marked for auto\-activation\&. But if another connection has been activated on the device, the new profile won\*(Aqt activate automatically and you need to activate it manually\&.
 .PP
-\fBExample\ \&8.\ \&Adding a bridge and two slave profiles\fR
+\fBExample\ \&9.\ \&Adding a bridge and two slave profiles\fR
 .sp
 .if n \{\
 .RS 4
@@ -288,7 +306,7 @@ This example demonstrates adding a bridge master connection and two slaves\&. Th
 interface, the second to
 \fIens4\fR\&. The last command will disable 802\&.1D STP for the TowerBridge profile\&.
 .PP
-\fBExample\ \&9.\ \&Adding an ethernet connection profile with manual IP configuration\fR
+\fBExample\ \&10.\ \&Adding an ethernet connection profile with manual IP configuration\fR
 .sp
 .if n \{\
 .RS 4
@@ -312,7 +330,7 @@ that is bound to interface name
 \fIcon show\fR
 command displays the profile so that all parameters can be reviewed\&.
 .PP
-\fBExample\ \&10.\ \&Convenient field values retrieval for scripting\fR
+\fBExample\ \&11.\ \&Convenient field values retrieval for scripting\fR
 .sp
 .if n \{\
 .RS 4
@@ -352,7 +370,30 @@ This example shows retrieval of ip4 connection field values via the \-\-get\-val
 \fBnmcli\fR(1)
 manual page for more customized output\&.
 .PP
-\fBExample\ \&11.\ \&Escaping colon characters in tabular mode\fR
+\fBExample\ \&12.\ \&Adding an Ethernet connection and configuring SR\-IOV VFs\fR
+.sp
+.if n \{\
+.RS 4
+.\}
+.nf
+$ \fBnmcli con add type ethernet con\-name EthernetPF ifname em1\fR
+$ \fBnmcli con modify EthernetPF sriov\&.total\-vfs 3 sriov\&.autoprobe\-drivers false\fR
+$ \fBnmcli con modify EthernetPF sriov\&.vfs \*(Aq0 mac=00:11:22:33:44:55 vlans=10, 1 trust=true spoof\-check=false\*(Aq\fR
+$ \fBnmcli con modify EthernetPF +sriov\&.vfs \*(Aq2 max\-tx\-rate=20\*(Aq\fR
+.fi
+.if n \{\
+.RE
+.\}
+.PP
+This example demonstrates adding an Ethernet connection for physical function (PF)
+\fIens4\fR
+and configuring 3 SR\-IOV virtual functions (VFs) on it\&. The first VF is configured with MAC address 00:11:22:33:44:55 and VLAN 10, the second one has the
+\fItrust\fR
+and
+\fIspoof\-check\fR
+features respectively enabled and disabled\&. VF number 2 has a maximux transmission rate of 20Mbps\&. The kernel is instructed to not automatically instantiate a network interface for the VFs\&.
+.PP
+\fBExample\ \&13.\ \&Escaping colon characters in tabular mode\fR
 .sp
 .if n \{\
 .RS 4
@@ -371,7 +412,7 @@ nager/ActiveConnection/9
 .PP
 This example shows escaping colon characters in tabular mode\&. It may be useful for script processing, because \*(Aq:\*(Aq is used as a field separator\&.
 .PP
-\fBExample\ \&12.\ \&nmcli usage in a NetworkManager dispatcher script to make Ethernet and Wi\-Fi mutually exclusive\fR
+\fBExample\ \&14.\ \&nmcli usage in a NetworkManager dispatcher script to make Ethernet and Wi\-Fi mutually exclusive\fR
 .sp
 .if n \{\
 .RS 4
@@ -409,7 +450,7 @@ manual page for more information about NetworkManager dispatcher scripts\&.
 .PP
 \fBExample sessions of interactive connection editor\fR
 .PP
-\fBExample\ \&13.\ \&Adding an ethernet connection profile in interactive editor (a)\fR
+\fBExample\ \&15.\ \&Adding an ethernet connection profile in interactive editor (a)\fR
 .sp
 .if n \{\
 .RS 4
diff --git a/man/nmcli-examples.xml b/man/nmcli-examples.xml
index 0b15f112..e777c326 100644
--- a/man/nmcli-examples.xml
+++ b/man/nmcli-examples.xml
@@ -178,6 +178,19 @@ B,DISPATCH</screen>
       </para>
     </example>
 
+    <example><title>Activating a VPN connection profile requiring interactive password input</title>
+<screen><prompt>$ </prompt><userinput>nmcli --ask con up my-vpn-con</userinput></screen>
+      <para>
+        This command activates a VPN connection profile enabling nmcli to interact with the user
+        ('--ask'): this will allow nmcli to prompt for the VPN password on the command line when
+        the <emphasis>password-flags</emphasis> are set to '0x02' ('always ask', see
+        <link linkend='nm-settings'><citerefentry><refentrytitle>nm-settings</refentrytitle><manvolnum>5</manvolnum></citerefentry></link>
+        ).
+        This is particularly useful for OTP based VPNs, as the user needs to be prompted for the
+        password each time the connection is activated.
+      </para>
+    </example>
+
     <example><title>Adding a bonding master and two slave connection profiles</title>
 <screen><prompt>$ </prompt><userinput>nmcli con add type bond ifname mybond0 mode active-backup</userinput>
 <prompt>$ </prompt><userinput>nmcli con add type ethernet ifname eth1 master mybond0</userinput>
@@ -272,6 +285,23 @@ IP4:192.168.1.12/24:192.168.1.1::192.168.1.1::</screen>
       </para>
     </example>
 
+    <example><title>Adding an Ethernet connection and configuring SR-IOV VFs</title>
+<screen><prompt>$ </prompt><userinput>nmcli con add type ethernet con-name EthernetPF ifname em1</userinput>
+<prompt>$ </prompt><userinput>nmcli con modify EthernetPF sriov.total-vfs 3 sriov.autoprobe-drivers false</userinput>
+<prompt>$ </prompt><userinput>nmcli con modify EthernetPF sriov.vfs '0 mac=00:11:22:33:44:55 vlans=10, 1 trust=true spoof-check=false'</userinput>
+<prompt>$ </prompt><userinput>nmcli con modify EthernetPF +sriov.vfs '2 max-tx-rate=20'</userinput></screen>
+      <para>
+        This example demonstrates adding an Ethernet connection for
+        physical function (PF) <emphasis>ens4</emphasis> and
+        configuring 3 SR-IOV virtual functions (VFs) on it. The first
+        VF is configured with MAC address 00:11:22:33:44:55 and VLAN
+        10, the second one has the <emphasis>trust</emphasis> and
+        <emphasis>spoof-check</emphasis> features respectively enabled
+        and disabled. VF number 2 has a maximux transmission rate of
+        20Mbps. The kernel is instructed to not automatically
+        instantiate a network interface for the VFs.
+      </para>
+    </example>
 
     <example><title>Escaping colon characters in tabular mode</title>
 <screen><prompt>$ </prompt><userinput>nmcli -t -f general -e yes -m tab dev show eth0</userinput>
diff --git a/man/nmcli.1 b/man/nmcli.1
index 00fdcdd4..86a546c7 100644
--- a/man/nmcli.1
+++ b/man/nmcli.1
@@ -2,12 +2,12 @@
 .\"     Title: nmcli
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
-.\"      Date: 10/24/2018
+.\"      Date: 01/22/2019
 .\"    Manual: General Commands Manual
-.\"    Source: NetworkManager 1.14.4
+.\"    Source: NetworkManager 1.15.2
 .\"  Language: English
 .\"
-.TH "NMCLI" "1" "" "NetworkManager 1\&.14\&.4" "General Commands Manual"
+.TH "NMCLI" "1" "" "NetworkManager 1\&.15\&.2" "General Commands Manual"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -39,7 +39,9 @@ is a command\-line tool for controlling NetworkManager and reporting network sta
 \fBnm\-applet\fR
 or other graphical clients\&.
 \fBnmcli\fR
-is used to create, display, edit, delete, activate, and deactivate network connections, as well as control and display network device status\&.
+is used to create, display, edit, delete, activate, and deactivate network connections, as well as control and display network device status\&. See
+\fBnmcli-examples\fR(7)
+for ready to run nmcli examples\&.
 .PP
 Typical uses include:
 .sp
@@ -74,16 +76,83 @@ can be used to control NetworkManager without a GUI, including creating, editing
 .RE
 .SH "OPTIONS"
 .PP
-\fB\-t\fR | \fB\-\-terse\fR
+\fB\-a\fR | \fB\-\-ask\fR
 .RS 4
-Output is terse\&. This mode is designed and suitable for computer (script) processing\&.
+When using this option
+\fBnmcli\fR
+will stop and ask for any missing required arguments, so do not use this option for non\-interactive purposes like scripts\&. This option controls, for example, whether you will be prompted for a password if it is required for connecting to a network\&.
 .RE
 .PP
-\fB\-p\fR | \fB\-\-pretty\fR
+\fB\-c\fR | \fB\-\-colors\fR {yes | no | auto}
 .RS 4
-Output is pretty\&. This causes
+This option controls color output (using terminal escape sequences)\&.
+yes
+enables colors,
+no
+disables them,
+auto
+only produces colors when standard output is directed to a terminal\&. The default value is
+auto\&.
+.sp
+The actual colors used are configured as described in
+\fBterminal-colors.d\fR(5)\&. Please refer to the
+COLORS
+section for a list of color names supported by
+\fBnmcli\fR\&.
+.RE
+.PP
+\fB\-\-complete\-args\fR
+.RS 4
+Instead of conducting the desired action,
 \fBnmcli\fR
-to produce easily readable outputs for humans, i\&.e\&. values are aligned, headers are printed, etc\&.
+will list possible completions for the last argument\&. This is useful to implement argument completion in shell\&.
+.sp
+The
+exit status
+will indicate success or return a code 65 to indicate the last argument is a file name\&.
+.sp
+NetworkManager ships with command completion support for GNU Bash\&.
+.RE
+.PP
+\fB\-e\fR | \fB\-\-escape\fR {yes | no}
+.RS 4
+Whether to escape
+:
+and
+\e
+characters in terse tabular mode\&. The escape character is
+\e\&.
+.sp
+If omitted, default is
+yes\&.
+.RE
+.PP
+\fB\-f\fR | \fB\-\-fields\fR {\fIfield1\fR,\fIfield2\fR... | all | common}
+.RS 4
+This option is used to specify what fields (column names) should be printed\&. Valid field names differ for specific commands\&. List available fields by providing an invalid value to the
+\fB\-\-fields\fR
+option\&.
+all
+is used to print all valid field values of the command\&.
+common
+is used to print common field values of the command\&.
+.sp
+If omitted, default is
+common\&.
+.RE
+.PP
+\fB\-g\fR | \fB\-\-get\-values\fR {\fIfield1\fR,\fIfield2\fR... | all | common}
+.RS 4
+This option is used to print values from specific fields\&. It is basically a shortcut for
+\-\-mode tabular \-\-terse \-\-fields
+and is a convenient way to retrieve values for particular fields\&. The values are printed one per line without headers\&.
+.sp
+If a section is specified instead of a field, the section name will be printed followed by colon separated values of the fields belonging to that section, all on the same line\&.
+.RE
+.PP
+\fB\-h\fR | \fB\-\-help\fR
+.RS 4
+Print help information\&.
 .RE
 .PP
 \fB\-m\fR | \fB\-\-mode\fR {tabular | multiline}
@@ -128,72 +197,30 @@ nmcli device show
 .RE
 .RE
 .PP
-\fB\-c\fR | \fB\-\-colors\fR {yes | no | auto}
-.RS 4
-This option controls color output (using terminal escape sequences)\&.
-yes
-enables colors,
-no
-disables them,
-auto
-only produces colors when standard output is directed to a terminal\&. The default value is
-auto\&.
-.sp
-The actual colors used are configured as described in
-\fBterminal-colors.d\fR(5)\&. Please refer to the
-COLORS
-section for a list of color names supported by
-\fBnmcli\fR\&.
-.RE
-.PP
-\fB\-f\fR | \fB\-\-fields\fR {\fIfield1\fR,\fIfield2\fR... | all | common}
-.RS 4
-This option is used to specify what fields (column names) should be printed\&. Valid field names differ for specific commands\&. List available fields by providing an invalid value to the
-\fB\-\-fields\fR
-option\&.
-all
-is used to print all valid field values of the command\&.
-common
-is used to print common field values of the command\&.
-.sp
-If omitted, default is
-common\&.
-.RE
-.PP
-\fB\-g\fR | \fB\-\-get\-values\fR {\fIfield1\fR,\fIfield2\fR... | all | common}
+\fB\-p\fR | \fB\-\-pretty\fR
 .RS 4
-This option is used to print values from specific fields\&. It is basically a shortcut for
-\-\-mode tabular \-\-terse \-\-fields
-and is a convenient way to retrieve values for particular fields\&. The values are printed one per line without headers\&.
-.sp
-If a section is specified instead of a field, the section name will be printed followed by colon separated values of the fields belonging to that section, all on the same line\&.
+Output is pretty\&. This causes
+\fBnmcli\fR
+to produce easily readable outputs for humans, i\&.e\&. values are aligned, headers are printed, etc\&.
 .RE
 .PP
-\fB\-e\fR | \fB\-\-escape\fR {yes | no}
+\fB\-s\fR | \fB\-\-show\-secrets\fR
 .RS 4
-Whether to escape
-:
-and
-\e
-characters in terse tabular mode\&. The escape character is
-\e\&.
-.sp
-If omitted, default is
-yes\&.
+When using this option
+\fBnmcli\fR
+will display passwords and secrets that might be present in an output of an operation\&. This option also influences echoing passwords typed by user as an input\&.
 .RE
 .PP
-\fB\-a\fR | \fB\-\-ask\fR
+\fB\-t\fR | \fB\-\-terse\fR
 .RS 4
-When using this option
-\fBnmcli\fR
-will stop and ask for any missing required arguments, so do not use this option for non\-interactive purposes like scripts\&. This option controls, for example, whether you will be prompted for a password if it is required for connecting to a network\&.
+Output is terse\&. This mode is designed and suitable for computer (script) processing\&.
 .RE
 .PP
-\fB\-s\fR | \fB\-\-show\-secrets\fR
+\fB\-v\fR | \fB\-\-version\fR
 .RS 4
-When using this option
+Show
 \fBnmcli\fR
-will display passwords and secrets that might be present in an output of an operation\&. This option also influences echoing passwords typed by user as an input\&.
+version\&.
 .RE
 .PP
 \fB\-w\fR | \fB\-\-wait\fR \fIseconds\fR
@@ -208,31 +235,6 @@ instructs
 \fBnmcli\fR
 not to wait but to exit immediately with a status of success\&. The default value depends on the executed command\&.
 .RE
-.PP
-\fB\-\-complete\-args\fR
-.RS 4
-Instead of conducting the desired action,
-\fBnmcli\fR
-will list possible completions for the last argument\&. This is useful to implement argument completion in shell\&.
-.sp
-The
-exit status
-will indicate success or return a code 65 to indicate the last argument is a file name\&.
-.sp
-NetworkManager ships with command completion support for GNU Bash\&.
-.RE
-.PP
-\fB\-v\fR | \fB\-\-version\fR
-.RS 4
-Show
-\fBnmcli\fR
-version\&.
-.RE
-.PP
-\fB\-h\fR | \fB\-\-help\fR
-.RS 4
-Print help information\&.
-.RE
 .SH "GENERAL COMMANDS"
 .HP \w'\fBnmcli\ general\fR\ 'u
 \fBnmcli general\fR {\fBstatus\fR | \fBhostname\fR | \fBpermissions\fR | \fBlogging\fR} [\fIARGUMENTS\fR...]
@@ -558,7 +560,7 @@ was not passed, NetworkManager can ask another secret agent that may be running
 .RS 4
 Deactivate a connection from a device without preventing the device from further auto\-activation\&. Multiple connections can be passed to the command\&.
 .sp
-Be aware that this command deactivates the specified active connection, but the device on which the connection was active, is still ready to connect and will perform auto\-activation by looking for a suitable connection that has the \*(Aqautoconnect\*(Aq flag set\&. This includes the just deactivated connection\&. So if the connection is set to auto\-connect, it will be automatically started on the disconnected device again\&.
+Be aware that this command deactivates the specified active connection, but the device on which the connection was active, is still ready to connect and will perform auto\-activation by looking for a suitable connection that has the \*(Aqautoconnect\*(Aq flag set\&. Note that the deactivating connection profile is internally blocked from autoconnecting again\&. Hence it will not autoconnect until reboot or until the user performs an action that unblocks autoconnect, like modifying the profile or explicitly activating it\&.
 .sp
 In most cases you may want to use
 \fBdevice disconnect\fR
@@ -1162,8 +1164,8 @@ can be used to either force or disable the scan regardless of how fresh the acce
 .PP
 \fBwifi\fR \fBconnect\fR \fI(B)SSID\fR [\fBpassword\fR\ \fIpassword\fR] [\fBwep\-key\-type\fR\ {key\ |\ phrase}] [\fBifname\fR\ \fIifname\fR] [\fBbssid\fR\ \fIBSSID\fR] [\fBname\fR\ \fIname\fR] [\fBprivate\fR\ {yes\ |\ no}] [\fBhidden\fR\ {yes\ |\ no}]
 .RS 4
-Connect to a Wi\-Fi network specified by SSID or BSSID\&. The command creates a new connection and then activates it on a device\&. This is a command\-line counterpart of clicking an SSID in a GUI client\&. The command always creates a new connection and thus it is mainly useful for connecting to new Wi\-Fi networks\&. If a connection for the network already exists, it is better to bring up (activate) the existing connection as follows:
-\fBnmcli con up id \fR\fB\fIname\fR\fR\&. Note that only open, WEP and WPA\-PSK networks are supported at the moment\&. It is also supposed that IP configuration is obtained via DHCP\&.
+Connect to a Wi\-Fi network specified by SSID or BSSID\&. The command finds a matching connnection or creates one and then activates it on a device\&. This is a command\-line counterpart of clicking an SSID in a GUI client\&. If a connection for the network already exists, it is possible to bring up (activate) the existing profile as follows:
+\fBnmcli con up id \fR\fB\fIname\fR\fR\&. Note that only open, WEP and WPA\-PSK networks are supported if no previous connection exists\&. It is also assumed that IP configuration is obtained via DHCP\&.
 .sp
 If
 \fB\-\-wait\fR
@@ -2818,9 +2820,9 @@ shows all connection profile names and their auto\-connect property\&.
 shows details for "My default em1" connection profile\&.
 .RE
 .PP
-\fBnmcli \-\-show\-secrets connection show "My Home WiFi"\fR
+\fBnmcli \-\-show\-secrets connection show "My Home Wi\-Fi"\fR
 .RS 4
-shows details for "My Home WiFi" connection profile with all passwords\&. Without
+shows details for "My Home Wi\-Fi" connection profile with all passwords\&. Without
 \fB\-\-show\-secrets\fR
 option, secrets would not be displayed\&.
 .RE
diff --git a/man/nmcli.xml b/man/nmcli.xml
index 2a0765d0..f092a2e4 100644
--- a/man/nmcli.xml
+++ b/man/nmcli.xml
@@ -68,7 +68,9 @@
     replacement for <command>nm-applet</command> or other graphical clients.
     <command>nmcli</command> is used to create, display, edit, delete, activate,
     and deactivate network connections, as well as control and display network
-    device status.</para>
+    device status. See
+    <link linkend='nmcli-examples'><citerefentry><refentrytitle>nmcli-examples</refentrytitle><manvolnum>7</manvolnum></citerefentry></link>
+    for ready to run nmcli examples.</para>
 
     <para>Typical uses include:</para>
     <itemizedlist>
@@ -95,98 +97,73 @@
 
       <varlistentry>
         <term><group choice='plain'>
-          <arg choice='plain'><option>-t</option></arg>
-          <arg choice='plain'><option>--terse</option></arg>
+          <arg choice='plain'><option>-a</option></arg>
+          <arg choice='plain'><option>--ask</option></arg>
         </group></term>
 
         <listitem>
-          <para>Output is terse. This mode is designed and suitable for computer (script)
-          processing.</para>
+          <para>When using this option <command>nmcli</command> will stop and ask for any
+          missing required arguments, so do not use this option for non-interactive
+          purposes like scripts. This option controls, for example, whether you will be
+          prompted for a password if it is required for connecting to a network.</para>
         </listitem>
       </varlistentry>
 
       <varlistentry>
         <term><group choice='plain'>
-          <arg choice='plain'><option>-p</option></arg>
-          <arg choice='plain'><option>--pretty</option></arg>
+          <arg choice='plain'><option>-c</option></arg>
+          <arg choice='plain'><option>--colors</option></arg>
+          <group choice='req'>
+            <arg choice='plain'>yes</arg>
+            <arg choice='plain'>no</arg>
+            <arg choice='plain'>auto</arg>
+          </group>
         </group></term>
 
         <listitem>
-          <para>Output is pretty. This causes <command>nmcli</command> to produce easily
-          readable outputs for humans, i.e. values are aligned, headers are printed,
-          etc.</para>
+          <para>This option controls color output (using terminal escape sequences).
+          <literal>yes</literal> enables colors, <literal>no</literal> disables them,
+          <literal>auto</literal> only produces colors when standard output is directed
+          to a terminal. The default value is <literal>auto</literal>.</para>
+          <para>The actual colors used are configured as described in
+          <citerefentry><refentrytitle>terminal-colors.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
+          Please refer to the <link linkend='colors' endterm='colors.title' /> section for a
+          list of color names supported by <command>nmcli</command>.</para>
         </listitem>
       </varlistentry>
 
       <varlistentry>
         <term><group choice='plain'>
-          <arg choice='plain'><option>-m</option></arg>
-          <arg choice='plain'><option>--mode</option></arg>
-          <group choice='req'>
-            <arg choice='plain'>tabular</arg>
-            <arg choice='plain'>multiline</arg>
-          </group>
+          <arg choice='plain'><option>--complete-args</option></arg>
         </group></term>
 
         <listitem>
-          <para>Switch between tabular and multiline output:</para>
-
-          <variablelist>
-            <varlistentry>
-              <term><arg choice='plain'>tabular</arg></term>
-              <listitem>
-                <para>Output is a table where each line describes a single entry.
-                Columns define particular properties of the entry.</para>
-              </listitem>
-            </varlistentry>
-
-            <varlistentry>
-              <term><arg choice='plain'>multiline</arg></term>
-              <listitem>
-                <para>Each entry comprises multiple lines, each property on its
-                own line. The values are prefixed with the property name.</para>
-              </listitem>
-            </varlistentry>
-          </variablelist>
-
-          <para>If omitted, default is <literal>tabular</literal> for most commands.
-          For the commands producing more structured information, that cannot be
-          displayed on a single line, default is <literal>multiline</literal>.
-          Currently, they are:</para>
-
-          <itemizedlist>
-            <listitem>
-              <para><literal>nmcli connection show <replaceable>ID</replaceable></literal></para>
-            </listitem>
+          <para>Instead of conducting the desired action, <command>nmcli</command>
+          will list possible completions for the last argument. This is useful to implement
+          argument completion in shell.</para>
 
-            <listitem>
-              <para><literal>nmcli device show</literal></para>
-            </listitem>
-          </itemizedlist>
+          <para>The <link linkend='exit_status'>exit status</link> will indicate success
+          or return a code 65 to indicate the last argument is a file name.</para>
 
+          <para>NetworkManager ships with command completion support for GNU Bash.</para>
         </listitem>
       </varlistentry>
 
       <varlistentry>
         <term><group choice='plain'>
-          <arg choice='plain'><option>-c</option></arg>
-          <arg choice='plain'><option>--colors</option></arg>
+          <arg choice='plain'><option>-e</option></arg>
+          <arg choice='plain'><option>--escape</option></arg>
           <group choice='req'>
             <arg choice='plain'>yes</arg>
             <arg choice='plain'>no</arg>
-            <arg choice='plain'>auto</arg>
           </group>
         </group></term>
 
         <listitem>
-          <para>This option controls color output (using terminal escape sequences).
-          <literal>yes</literal> enables colors, <literal>no</literal> disables them,
-          <literal>auto</literal> only produces colors when standard output is directed
-          to a terminal. The default value is <literal>auto</literal>.</para>
-          <para>The actual colors used are configured as described in
-          <citerefentry><refentrytitle>terminal-colors.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
-          Please refer to the <link linkend='colors' endterm='colors.title' /> section for a
-          list of color names supported by <command>nmcli</command>.</para>
+          <para>Whether to escape <literal>:</literal> and <literal>\</literal> characters in terse tabular mode. The
+          escape character is <literal>\</literal>.</para>
+
+          <para>If omitted, default is <literal>yes</literal>.</para>
         </listitem>
       </varlistentry>
 
@@ -238,33 +215,74 @@
 
       <varlistentry>
         <term><group choice='plain'>
-          <arg choice='plain'><option>-e</option></arg>
-          <arg choice='plain'><option>--escape</option></arg>
+          <arg choice='plain'><option>-h</option></arg>
+          <arg choice='plain'><option>--help</option></arg>
+        </group></term>
+
+        <listitem>
+          <para>Print help information.</para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><group choice='plain'>
+          <arg choice='plain'><option>-m</option></arg>
+          <arg choice='plain'><option>--mode</option></arg>
           <group choice='req'>
-            <arg choice='plain'>yes</arg>
-            <arg choice='plain'>no</arg>
+            <arg choice='plain'>tabular</arg>
+            <arg choice='plain'>multiline</arg>
           </group>
         </group></term>
 
         <listitem>
-          <para>Whether to escape <literal>:</literal> and <literal>\</literal> characters in terse tabular mode. The
-          escape character is <literal>\</literal>.</para>
+          <para>Switch between tabular and multiline output:</para>
+
+          <variablelist>
+            <varlistentry>
+              <term><arg choice='plain'>tabular</arg></term>
+              <listitem>
+                <para>Output is a table where each line describes a single entry.
+                Columns define particular properties of the entry.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><arg choice='plain'>multiline</arg></term>
+              <listitem>
+                <para>Each entry comprises multiple lines, each property on its
+                own line. The values are prefixed with the property name.</para>
+              </listitem>
+            </varlistentry>
+          </variablelist>
+
+          <para>If omitted, default is <literal>tabular</literal> for most commands.
+          For the commands producing more structured information, that cannot be
+          displayed on a single line, default is <literal>multiline</literal>.
+          Currently, they are:</para>
+
+          <itemizedlist>
+            <listitem>
+              <para><literal>nmcli connection show <replaceable>ID</replaceable></literal></para>
+            </listitem>
+
+            <listitem>
+              <para><literal>nmcli device show</literal></para>
+            </listitem>
+          </itemizedlist>
 
-          <para>If omitted, default is <literal>yes</literal>.</para>
         </listitem>
       </varlistentry>
 
       <varlistentry>
         <term><group choice='plain'>
-          <arg choice='plain'><option>-a</option></arg>
-          <arg choice='plain'><option>--ask</option></arg>
+          <arg choice='plain'><option>-p</option></arg>
+          <arg choice='plain'><option>--pretty</option></arg>
         </group></term>
 
         <listitem>
-          <para>When using this option <command>nmcli</command> will stop and ask for any
-          missing required arguments, so do not use this option for non-interactive
-          purposes like scripts. This option controls, for example, whether you will be
-          prompted for a password if it is required for connecting to a network.</para>
+          <para>Output is pretty. This causes <command>nmcli</command> to produce easily
+          readable outputs for humans, i.e. values are aligned, headers are printed,
+          etc.</para>
         </listitem>
       </varlistentry>
 
@@ -283,37 +301,13 @@
 
       <varlistentry>
         <term><group choice='plain'>
-          <arg choice='plain'><option>-w</option></arg>
-          <arg choice='plain'><option>--wait</option></arg></group>
-          <arg choice='plain'><replaceable>seconds</replaceable></arg>
-        </term>
-
-        <listitem>
-          <para>This option sets a timeout period for which <command>nmcli</command> will
-          wait for NetworkManager to finish operations. It is
-          especially useful for commands that may take a longer time to complete, e.g.
-          connection activation.</para>
-
-          <para>Specifying a value of <literal>0</literal> instructs
-          <command>nmcli</command> not to wait but to exit immediately with a status of
-          success. The default value depends on the executed command.</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><group choice='plain'>
-          <arg choice='plain'><option>--complete-args</option></arg>
+          <arg choice='plain'><option>-t</option></arg>
+          <arg choice='plain'><option>--terse</option></arg>
         </group></term>
 
         <listitem>
-          <para>Instead of conducting the desired action, <command>nmcli</command>
-          will list possible completions for the last argument. This is useful to implement
-          argument completion in shell.</para>
-
-          <para>The <link linkend='exit_status'>exit status</link> will indicate success
-          or return a code 65 to indicate the last argument is a file name.</para>
-
-          <para>NetworkManager ships with command completion support for GNU Bash.</para>
+          <para>Output is terse. This mode is designed and suitable for computer (script)
+          processing.</para>
         </listitem>
       </varlistentry>
 
@@ -330,12 +324,20 @@
 
       <varlistentry>
         <term><group choice='plain'>
-          <arg choice='plain'><option>-h</option></arg>
-          <arg choice='plain'><option>--help</option></arg>
-        </group></term>
+          <arg choice='plain'><option>-w</option></arg>
+          <arg choice='plain'><option>--wait</option></arg></group>
+          <arg choice='plain'><replaceable>seconds</replaceable></arg>
+        </term>
 
         <listitem>
-          <para>Print help information.</para>
+          <para>This option sets a timeout period for which <command>nmcli</command> will
+          wait for NetworkManager to finish operations. It is
+          especially useful for commands that may take a longer time to complete, e.g.
+          connection activation.</para>
+
+          <para>Specifying a value of <literal>0</literal> instructs
+          <command>nmcli</command> not to wait but to exit immediately with a status of
+          success. The default value depends on the executed command.</para>
         </listitem>
       </varlistentry>
 
@@ -831,9 +833,10 @@
           <para>Be aware that this command deactivates the specified active connection,
           but the device on which the connection was active, is still ready to connect
           and will perform auto-activation by looking for a suitable connection that has
-          the 'autoconnect' flag set. This includes the just deactivated connection. So
-          if the connection is set to auto-connect, it will be automatically started on
-          the disconnected device again.</para>
+          the 'autoconnect' flag set. Note that the deactivating connection profile is
+          internally blocked from autoconnecting again. Hence it will not autoconnect
+          until reboot or until the user performs an action that unblocks autoconnect,
+          like modifying the profile or explicitly activating it.</para>
 
           <para>In most cases you may want to use <command>device disconnect</command>
           command instead.</para>
@@ -1442,14 +1445,13 @@
 
         <listitem>
           <para>Connect to a Wi-Fi network specified by SSID or BSSID. The command
-          creates a new connection and then activates it on a device. This is a
-          command-line counterpart of clicking an SSID in a GUI client. The command
-          always creates a new connection and thus it is mainly useful for connecting to
-          new Wi-Fi networks. If a connection for the network already exists, it is
-          better to bring up (activate) the existing connection as follows:
+          finds a matching connnection or creates one and then activates it on a device.
+          This is a command-line counterpart of clicking an SSID in a GUI client. If
+          a connection for the network already exists, it is possible to bring up
+          (activate) the existing profile as follows:
           <command>nmcli con up id <replaceable>name</replaceable></command>. Note that
-          only open, WEP and WPA-PSK networks are supported at the moment. It is also
-          supposed that IP configuration is obtained via DHCP.</para>
+          only open, WEP and WPA-PSK networks are supported if no previous connection
+          exists. It is also assumed that IP configuration is obtained via DHCP.</para>
 
           <para>If <option>--wait</option> option is not specified, the default timeout will be 90
           seconds.</para>
@@ -2537,9 +2539,9 @@ It's equivalent to the <literal>+bond.options 'option=value'</literal> syntax.</
       </varlistentry>
 
       <varlistentry>
-        <term><userinput>nmcli --show-secrets connection show "My Home WiFi"</userinput></term>
+        <term><userinput>nmcli --show-secrets connection show "My Home Wi-Fi"</userinput></term>
         <listitem>
-          <para>shows details for "My Home WiFi" connection profile with all passwords.
+          <para>shows details for "My Home Wi-Fi" connection profile with all passwords.
           Without <option>--show-secrets</option> option, secrets would not be
           displayed.</para>
         </listitem>
diff --git a/man/nmtui.1 b/man/nmtui.1
index 7a27832b..f9fa109e 100644
--- a/man/nmtui.1
+++ b/man/nmtui.1
@@ -2,12 +2,12 @@
 .\"     Title: nmtui
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
-.\"      Date: 10/24/2018
+.\"      Date: 01/22/2019
 .\"    Manual: General Commands Manual
-.\"    Source: NetworkManager 1.14.4
+.\"    Source: NetworkManager 1.15.2
 .\"  Language: English
 .\"
-.TH "NMTUI" "1" "" "NetworkManager 1\&.14\&.4" "General Commands Manual"
+.TH "NMTUI" "1" "" "NetworkManager 1\&.15\&.2" "General Commands Manual"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------