summary refs log tree commit diff
path: root/src/libnm-core-impl/tests
diff options
context:
space:
mode:
Diffstat (limited to 'src/libnm-core-impl/tests')
-rw-r--r--src/libnm-core-impl/tests/certs/ca-no-ending-newline.pem15
-rw-r--r--src/libnm-core-impl/tests/certs/pkcs8-decrypted.derbin0 -> 1194 bytes
-rw-r--r--src/libnm-core-impl/tests/certs/pkcs8-enc-key.pem29
-rw-r--r--src/libnm-core-impl/tests/certs/pkcs8-noenc-key.pem28
-rw-r--r--src/libnm-core-impl/tests/certs/test-aes-128-key.pem30
-rw-r--r--src/libnm-core-impl/tests/certs/test-aes-256-key.pem54
-rw-r--r--src/libnm-core-impl/tests/certs/test-ca-cert.pem27
-rw-r--r--src/libnm-core-impl/tests/certs/test-cert.p12bin0 -> 4092 bytes
-rw-r--r--src/libnm-core-impl/tests/certs/test-key-and-cert.pem118
-rw-r--r--src/libnm-core-impl/tests/certs/test-key-only-decrypted.derbin0 -> 1192 bytes
-rw-r--r--src/libnm-core-impl/tests/certs/test-key-only-decrypted.pem27
-rw-r--r--src/libnm-core-impl/tests/certs/test-key-only.pem92
-rw-r--r--src/libnm-core-impl/tests/certs/test-tpm2wrapped-key.pem14
-rw-r--r--src/libnm-core-impl/tests/certs/test2-cert.p12bin0 -> 4136 bytes
-rw-r--r--src/libnm-core-impl/tests/certs/test2_ca_cert.pem27
-rw-r--r--src/libnm-core-impl/tests/certs/test2_key_and_cert.pem119
-rw-r--r--src/libnm-core-impl/tests/certs/test_ca_cert.derbin0 -> 1162 bytes
-rw-r--r--src/libnm-core-impl/tests/certs/test_ca_cert.pem27
-rw-r--r--src/libnm-core-impl/tests/certs/test_key_and_cert.pem119
-rw-r--r--src/libnm-core-impl/tests/meson.build49
-rw-r--r--src/libnm-core-impl/tests/nm-core-tests-enum-types.c.template35
-rw-r--r--src/libnm-core-impl/tests/nm-core-tests-enum-types.h.template21
-rw-r--r--src/libnm-core-impl/tests/test-compare.c231
-rw-r--r--src/libnm-core-impl/tests/test-crypto.c455
-rw-r--r--src/libnm-core-impl/tests/test-general-enums.h35
-rw-r--r--src/libnm-core-impl/tests/test-general.c10854
-rw-r--r--src/libnm-core-impl/tests/test-keyfile.c909
-rw-r--r--src/libnm-core-impl/tests/test-secrets.c686
-rw-r--r--src/libnm-core-impl/tests/test-setting.c4830
-rw-r--r--src/libnm-core-impl/tests/test-settings-defaults.c109
30 files changed, 18940 insertions, 0 deletions
diff --git a/src/libnm-core-impl/tests/certs/ca-no-ending-newline.pem b/src/libnm-core-impl/tests/certs/ca-no-ending-newline.pem
new file mode 100644
index 00000000..664e299a
--- /dev/null
+++ b/src/libnm-core-impl/tests/certs/ca-no-ending-newline.pem
@@ -0,0 +1,15 @@
+-----BEGIN CERTIFICATE-----

+MIICWjCCAcMCAgGlMA0GCSqGSIb3DQEBBAUAMHUxCzAJBgNVBAYTAlVTMRgwFgYD

+VQQKEw9HVEUgQ29ycG9yYXRpb24xJzAlBgNVBAsTHkdURSBDeWJlclRydXN0IFNv

+bHV0aW9ucywgSW5jLjEjMCEGA1UEAxMaR1RFIEN5YmVyVHJ1c3QgR2xvYmFsIFJv

+b3QwHhcNOTgwODEzMDAyOTAwWhcNMTgwODEzMjM1OTAwWjB1MQswCQYDVQQGEwJV

+UzEYMBYGA1UEChMPR1RFIENvcnBvcmF0aW9uMScwJQYDVQQLEx5HVEUgQ3liZXJU

+cnVzdCBTb2x1dGlvbnMsIEluYy4xIzAhBgNVBAMTGkdURSBDeWJlclRydXN0IEds

+b2JhbCBSb290MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCVD6C28FCc6HrH

+iM3dFw4usJTQGz0O9pTAipTHBsiQl8i4ZBp6fmw8U+E3KHNgf7KXUwefU/ltWJTS

+r41tiGeA5u2ylc9yMcqlHHK6XALnZELn+aks1joNrI1CqiQBOeacPwGFVw1Yh0X4

+04Wqk2kmhXBIgD8SFcd5tB8FLztimQIDAQABMA0GCSqGSIb3DQEBBAUAA4GBAG3r

+GwnpXtlR22ciYaQqPEh346B8pt5zohQDhT37qw4wxYMWM4ETCJ57NE7fQMh017l9

+3PR2VX2bY1QY6fDq81yx2YtCHrnAlU66+tXifPVoYb+O7AWXX1uw16OFNMQkpw0P

+lZPvy5TYnh+dXIVtx6quTx8itc2VrbqnzPmrC3p/

+-----END CERTIFICATE-----
\ No newline at end of file
diff --git a/src/libnm-core-impl/tests/certs/pkcs8-decrypted.der b/src/libnm-core-impl/tests/certs/pkcs8-decrypted.der
new file mode 100644
index 00000000..2cbdeb5e
--- /dev/null
+++ b/src/libnm-core-impl/tests/certs/pkcs8-decrypted.der
Binary files differdiff --git a/src/libnm-core-impl/tests/certs/pkcs8-enc-key.pem b/src/libnm-core-impl/tests/certs/pkcs8-enc-key.pem
new file mode 100644
index 00000000..0d08f2d2
--- /dev/null
+++ b/src/libnm-core-impl/tests/certs/pkcs8-enc-key.pem
@@ -0,0 +1,29 @@
+-----BEGIN ENCRYPTED PRIVATE KEY-----
+MIIE6TAbBgkqhkiG9w0BBQMwDgQIwiGFT4Jz6RsCAggABIIEyJNMddDYofbhydUp
+J3VyrYIjv3LziJ7dkTXE3+mEYRCQrGLgljWBbib2JOLVCFt8melL6Yv1RcoVR7X7
+vrRqyycu0DumI4f5+Bf4wc234JNVhSaLYsw244fFtcnK2Gyn4IaVmWmrNvrwfX/w
+SKcVmO30D5C5PCKzv2bou5FmnJLKdDQV1t816cr9T8pTx7MHvBzSZXbh86334BhF
+T3zNwo8j2/+Gq2NBWUn+2GTTV8/r26aIwPcFi4QH6I2ghBwFmFHqU3/PoRm6nkmg
+CqJj2Dggy+8zE5qg0iId7lrio0OjCH+Qed6NGwIa2lgv/bhuJVP3FOk4gqamJWHi
+WMaq9McmS+03q2iokYeSQGbx85x+I90RTFZKhFx4dkerf6oTC/YoL4F++ff0e91v
+sOrQsBkgRhrRtFwa9OFCzbsknlixONdd+ITkyX490xz1wcZTDkKtMDRLIPWa2O0b
+MEq75jPYThZ5pF1vc5r+rqPafN7SfI+DDmhzJYEQNRoCWA4pH9Gwv0ayKnOgoj4K
+TuFhXvcyWzTnVXmcqEFyf3CRrB0Ti+Z61enupC+FCuYV5lGsx9kJaTumTk2UPD02
+9Ap3asDLozdEPSXBG3+oCM2s01/IJlxtR84C97r9rpmWTc9K6DCBScETe9KnIghW
+PU7XFogueG5Gwpe+x+IlTDq+qiyUNVX1uMGDcIaCC3VsoWqZrpnGGBhsovwBaXKt
+T9fT2nE27Fd6DRWso4fgos6PPx7RVveu17BTMVQeUq9L8GrV4JNrE3a9aoXdbUhc
+6gMiyAqxh/HEyciYoXsR9oVNi+VM0y8q3hL5nIcgDrCZr/c9aQ8+fuQBDXRrmrQd
+bR2iwNLCBnbmQmM/vM333VhJ4MSOKd3SGw/j41K+Nr3uP5KRZUwV+5yy3ef/hGxU
+i9JjCmSUt2bfWRUFlNaf1hCTYaKD0xnVr1SLFU4snIgh2qKawyqVc9EE2f+FcOM5
+0RtwQ3ku6FOk3cy6/xeKpResCHbWDS6nQaIKYyLukV+gm5MJIhOMkj2z4T1eXGUr
+Nu/L7Gz+ps7ct0lM8W82n5lzSEa5/l1eNGM0wtQoAwutFEZp7Nx/IBKK87jVttr6
+82UVJeRk7rO2Mpobfw2LbKwga4rsuLrx3UwVDBWdLx7dNIc1rGoAxhsc72+skFgF
+Uztwy4Yv1Uiji4T6v+mObPZD/HiIDL0vF02Pz08rNlgB0DgaTKrpql2FutIuQAdf
+AciffQIoh9VGERlJoWuunG/UTxg2XRl2m1vCDrgBMInax+PXCv7/5Vh21AQc3fWP
+uf4k6JSy46hYni7VTVKn6C/Di9z7oIrGl/jDkDsaenAbToyX9VWr3s7EBwnhTQ/I
+OQ9bkWCagHIQlwJbu4M4/VAbiR26NrcR0C3JXBlPlT0qvFFB8gKbJAQEXtwIFS2h
+m2fe0k6mQASMwdbJYXZ/wfsg5PPAWsKtny1aMvi0mTPSD5uRhIfEGEuR+AT4UbEW
+BkEIE0lgGly4P1SpunKDQQE6m/e7h8Nl4pi8SMSme3YoX5MJwCP/CNkLBDVenAZI
+oBrdoVox86SjwnUozVG192lcEAULlk+3ZGt6T9JXLBQl9hpNtyTC6SFh84R+5RoN
+AevNl1bDfO+Vci0uJw==
+-----END ENCRYPTED PRIVATE KEY-----
diff --git a/src/libnm-core-impl/tests/certs/pkcs8-noenc-key.pem b/src/libnm-core-impl/tests/certs/pkcs8-noenc-key.pem
new file mode 100644
index 00000000..f73fb55a
--- /dev/null
+++ b/src/libnm-core-impl/tests/certs/pkcs8-noenc-key.pem
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEwAIBADANBgkqhkiG9w0BAQEFAASCBKowggSmAgEAAoIBAQC80HGgFdlFIL2F
+W5rHQ99xOkMrWcZ7an9YurDebAE3M0UwqxM24+5mWbxc8FJ8yYugdMzuI5Nq77IA
+DwJpv9ZjMfnKC1VDMj3bmmMdPurfx8pLdLw/jhk3wBaYk6vMvh4z66Yvmb7valGq
+Pxh6CRTnekNGI9XA7me4JNBlisl0Qasn9g4pl9PiGJAruEamS4Pk6dSWbfw58bs7
+/Yo5ejyt/Mn1n0Q/r3Gv/lAS0qRvmrW6GE1rMtANMfuGRNlAln21TzNcJzykm+sp
+RWptxXEI0NY7u9+RP4M3C1mJxWir7AZDbtinpOZH6vF+92yMzgEYOLK/WZVdSPdW
+tROv9xtPAgMBAAECggEBAJAfp+vjYZJjuGaYEuAxjdhW+biYcWn5U7V9484TsSXa
+i+DnZOZMO8iCjMaAZuZ7zYmwPlE0dK12w29KBbSEy3eySRIRboa5TgBXq3pCcXRZ
+g6/vLlZw+AzXIiha6BODt3g4UwUYnWcQx79lJCDa18sNR1a9ucbn8+Har/wiYT3M
+JjTbUT6wR6rKEXchB58ZugYGhOTfugSDQg4U/dwEHPIaJ/wme++JUV5B/tjeGCG3
+F43o2Oos5vjfrDSpUKIYZn+2BdhP434jkwj22wQ2sy0ruU/kQx8nogMTRfP1v4GU
+9QmNXj/DB24K388ZxcDmcxBJxrGAJ0MohYFo28DqRBECgYEA6hyKEqe2UbJx/+B6
+8mYgHb+pS2j0M4jPl11q9MMLVxLnDY9xZ85IEyWHQEC0GavPSAois0oiDeGAm32c
+j6TFyV3/oPTmZSyV93/agWgnH9Xtc481pbNAb0GMfyotvRRE/+6ti9+Cl7oH9Qmm
+ldMk7Hn6sK9t2mUOW8idPjKqlqcCgYEAzne25BryLJoIinbRMZg9KTfxfgUE6EKc
+Tk5+9CFQn0/AItQJuKbIUyggYH4psWW5hWq6hFlmMYMR48FKv9ry7pZTB0djaoYD
+lN+wSuhzUYWXedkAjvPmekITmf6rbnPfwOZvsr8CGMEUekqJPnPLzsQy+Ea2y/fb
+QY4SHe7gExkCgYEAr+1scOJpZvFjK7ckjT3jipd6ADpJsORxo7zG4FImFnQU/6K4
+xRpGHWVJQyaccOIkrW04cGUYPDgmrjJx0ZwwKceijvEaphMgS1JgAHklVY4sl3ea
+CAAxPqoSi4lFv94Yj/9rmT4IZD6fNivfbJ20FKUBl37tXX4tkRmr2I64lOcCgYEA
+x3eqzrclrmdlxvfBZOuScwbkHP6WXhk0TwbQ6eRhsnfmxP8bITSoJoaGuRJKD2Oa
+l0WkSobgDwd0uhecsrvBpTS/pDGY32n3fdWZyNTHzEOHMyWtv23tBcJek5ERaBU0
+X3WBBiw4x1eKBBeMfjR6+xhbsbcHlQiw36V05UxJWMkCgYEAhtcYvrfU4K48IJTU
+qp03nvd+dMY3IUTdZNOCh8bswLKyn3aq3MfWF9Vp7kDAI3cfyMpSrAQnmg4nVcn6
+Gf3wakG8bpiSRbJnGN+iLm8JsD+3Vw9KzvKOOQVmpT7xt5Kupx1hWvLHQWvfYgOG
+qEtTM8/+LD7W3I7midJNt50CD8A=
+-----END PRIVATE KEY-----
diff --git a/src/libnm-core-impl/tests/certs/test-aes-128-key.pem b/src/libnm-core-impl/tests/certs/test-aes-128-key.pem
new file mode 100644
index 00000000..aab8f463
--- /dev/null
+++ b/src/libnm-core-impl/tests/certs/test-aes-128-key.pem
@@ -0,0 +1,30 @@
+-----BEGIN RSA PRIVATE KEY-----
+Proc-Type: 4,ENCRYPTED
+DEK-Info: AES-128-CBC,800391B7DD72364B4C2562E0B6AEA000
+
+E9dgNCIATOr4CN5c8o6B+8wdqq/I1BLmPmW2qT7YZepoF7E+RUb8ZLjo1VO2XsJw
+Ir4EzuH7837zBD9dP5CjlY8cWfR63gZpEWRY5Jub8kzvqiL4UZ0Qr8IHOZxAkKEz
+EL1Pn7e+tYt4kA372LPZHWO3vRCgmL1iSJj2/k3avPWAx7NUie4bzGI+00WNv699
+ClKzsJbWB1eiQvYgOr4aVV26oWfa896JkBoGhgZQ6ckqFpsdAos8m46iOSVZrwgq
+Y2/d1CvfQod+87c8LRatwAjf+d6YAJJaeMyxjCGuAY6/JyDsorUkM2OlvbTt6WOA
+gSPWO8I+Ov6THb4IuPhpIJ30Sl88tc6MlIByW49EWu2G1jPw3L8iqRzZ50Z85dyz
+N9yFP91wEwi5F0Zed4iEpg3NVfklEe/VYqCldc5f9fZ84G5V98ZlAdNSqwd/UNBU
+iPTflGqVpp1u+J2isOk+Agpj1MCxh2q0RNuvY9KHzOYBScirfbG4DKNbQgS/5Zw7
+3g9YL5Wbo7BczHLiXf/2adu6T8wI1LKRjkeLV9dK1Vw3ZaGy3mB9oFhCgjh9BNHw
+wC78CVcUErjtOXdQagiCQn5k5EGeAB97QFROoAFjAmGvq3xCi4EHd9Sk6fcMm7Oi
+1fuVR5EXUubF4Llq06lFzQp01s2F73noH49bs3qwdf0n8nrL2XhKB0XCOV/I3K5c
+Y3W+YSl361QGjZ/NUcFLIIy+Uro90MmUBNk6af+wGHRJeflpVnK0ATX1PtpNHziz
+jiMiIZicjgfVLxl1a5zTl6KUmGWKlZb533adQ0s6q9Qmi5Vk5L5W/GdMjcFtZbM6
+GU7EOkwihMLb3DVsNbm7vb8tUXqe/e5RmXtij8Yb+2a6/M9yaOHa0VjHzdiKHecr
+eEYaKQDj7NCWLslNnRRh9GmgXcu2pqBhqRM3HAt3cEaHKKWHTcoWcz11pFwMHNtn
+bU9GjGRVc3lCGhVNRiloO0zrKHmcBpDVLw2+ycXXpj/RaBW2fy0xRLKolyla+jEr
+zdLzVI61O50ZMycOtPmE7DVZpkokn32hGer1eCOFnsN1lywi4cWLvU0jbQC+CJyw
+T9vS8zB3WgOl8rC1AHsfQ4KYajlKleQm89deurQymnt/Qx49SiQA+TpwG9Xvx2TP
+3Vc1NwZfM9ZZ1+6xit/rTuS3LhnmhEnGnV5ZyvAdmkCcV2iHjOnLnQWWQn24MHU3
+8Y9D4AdpI5V7Igwr3vH2NZMiw1W2Yc5EJuPAT8nIs5sgOYhXB/QLPJvulvOQhuNC
+NPwJ6A505JrVNfHuEaoGUyA+mPeWuLwQo8y8cM6ZdFMG3RrwFNzuYTrc1Z/9GsmA
+C0UfHf5dL0r7oWZ1SbpSvsmHYqc8sIypq0ohuLEbpegS/hWP8b2/XDRTjfTiJOrM
+4LsUH9PMOJSxDlwS+7e3FdcGfgXfsMgB3aOjQvNpKEolOuv4A5LVFeMrrwtw4Xo1
+EuhstZwyarUTJenDUXzkakhA+8Yw/g2a7RsnANVTkeBuv2PbqFL4zdlsWvcpkz41
+ESxx1siSeU1E9beOII0zSi8vUD0IAevRHaWSlfU2po600IzX1FN97pa4DJV2ycgn
+-----END RSA PRIVATE KEY-----
diff --git a/src/libnm-core-impl/tests/certs/test-aes-256-key.pem b/src/libnm-core-impl/tests/certs/test-aes-256-key.pem
new file mode 100644
index 00000000..e51bafd3
--- /dev/null
+++ b/src/libnm-core-impl/tests/certs/test-aes-256-key.pem
@@ -0,0 +1,54 @@
+-----BEGIN RSA PRIVATE KEY-----
+Proc-Type: 4,ENCRYPTED
+DEK-Info: AES-256-CBC,5FF6BD2D4E57E8933D4A6814DEF5305A
+
+9Br+xw6XOg7qUqfeE5PJ4g/PAm7eTcPMb4FzSKkaEosLo6oj4f37TwXuojJZeAmi
+1EytpqM1vdYHCLdjg+qYaTIq6mzMZIyoaREokcOhcNrq5S0J39gJLVV9LjiXhCAH
+GQgDBnbRT6HGz70AyTRLcW9aj6uBzTv/m92sLUw2txFeBXK8n2AA1oHJTgsFNYjf
+/ZvTCE1VMQHDPx31Vn5WXSUHNc0hx4MTIwpHqWI17ohr8IiWCs5HXVfVaqrNeNEw
+haD7fg8oNxjLs46/4dDWmfWXhDsMFSweZv03gZdyVjwn1IOqeVGmTdLpllfgOW7E
++XE8Y/d55s5nkOxu6eXNMtWgjclKBGr2iMxxnODmEsUt2WcV98cPS+25o3hOfy3s
+NIcfxtWVRFUtjqf3ragyGLuXFqATkj1slj4LVMeewRJ1g+Z6ti0mwBN+ZrYtKdec
+FRNb4zr5FW+3SqkIIJVfxJEYJDB4zODhMg8tySEHLKuT0uz42YQ4aoOHTzO5WDBY
+2BI7TjRppXcExPnkAk5jqbKA6BjT9KcAVyypfxDKvCeXKdjDcL6ISOBSm6cQBh8D
+HxsFzMy9PF6kKNeiNiEsVPnKYvhvs1hTBtp+IAgJ6KZnCDKplZFxo/mBAlV2KyCT
+x+Mhmme3fXdLJkvxlVJAoAhwgXvomVCVTGI3JhcQIqVgxPIKYpqlHVFC7JjG+yQX
+tvzCPtr9G9+Ofrm6zXjlDD7zNyl/KfFtEWhO2ePHkQlCEuKJnsnRIf/wQ0viG0yY
+MH31Z/84o2pKLBKY5fq8+eYuYoP9Rk4W2LpjGMvdkKhEHL26kZofeFyqD+JcaxHc
+kQh7/SbWAsREGb9Jp7I2q1mo749mse1oSFIQa5gN3jB0mgHZd6edRYeW2Up+rqEK
+k6Xd6uqs7bZd5W9sP7Cf6yJOFEjqFVLQEVEXWSchgeta/JNrjGr3UzLFN2S+vhvX
+XgDa41y2UdXHRqj2s864u0ZDPyGXYZnVbvQn/8xHQ7rvxHowpTn+XXUEf0AQnk3j
+9h++3McwP8GuVxkwc6o9TfOL+ell5jup7F3SekwEiE3hqY8x87g6X2zD5VSnfCy3
+0t0LmPGI1b3LABeYjA1WEdhoTlHrNLkwOR4gsudrJ5nxIzfGy+IHaloXLJy4YKfX
+pJ+qyGRUR42YD9IhiEmmmO1VoJgVEYfBiz50Jg8emddku6eKdmv9IKjiSb2pTbDS
+4oUYKg109OOn+krk67dNXofAXrBa8v7QusC0yz9N25H05Xyou1iqpGk+uBrTqEO6
+lW9lWQo57BQU9og40xMKH/xQgIxfQRktUKsPizj8mKil4izo5KgjPSqBeEbj+Q3c
+0FKlrpTXQlXfX5Z5esqMuCSiwQEzoJR+V+SUaSVcg1av0k/CJMin4Cr8roai+OjK
+lhaQIvx35Bzd02yERYsfpDjmQCXmIeiDm8JtB6znbQPUJ4d8kzWR+5ACOZW/dUss
+YhWJRkZpkIwTY+/sDU4mnP2R37MNo+OH4CwZyUDHjlkRPGW+6JBEpnnlI9a/1Vb1
+pjAGpi/8u/luvZGTzCzxQG2dZc5YQR869U+wFsFbLRiD0aP2SpdOH0QxxPOcdR8+
+HWyL01BJBKyK/wZWJhe+63zlk1L5CA0XYpoNkYpMlPNZkcqR7QzUOATfuBgI2aPM
+AXaweaAWhpPCDsc2RypIs9DhTiCCkt8tq8Au15hVUKAoshLeewPtv0t75MEC0hVB
+z6FVnNlqq0cqqcSVqvUG6JUGtFOGgG3ifEMXggq5k12+wGzY63DLR8dFPNpOL6/1
+nocOayHJIU9M8PP817PzhAUAePRRUKRg8kkbKKeZnCJxoF7O15AFVEJnl9Vyokkz
+bULYhzYVx3xh8THMi+5jsnKWPJyMeYHbHH3C658SIw6Ff9fgEWscv5ZkGYdKMg+l
+8hBn+++SoqIO+F3lOGco+s8qlYox106lUwJEtORXcBxmkaHSo/X2AVO8Owt4vYli
+mjWnY6V9vooBgOuCMcY780pcoj2lSf9JPHDYK0j8t5VumDUSLyLt+tCj0yv/vl5L
+9L++vbu2akZRC9ChijYpfhTvXoG36ePhoT7AGGnhpFjjw1VqG80GY4XSODKzH86w
+kUcZoErb8swUPYOtsybtuPb+6c/YofQ8GfpVosPZgSRD4+U7v+zA3/z8xF2B0xt6
+uV8hXbropuni8KmbFuKrPZK3p2v2aZ8F0+GITwS75/hbT6D7ruUSr5q4V0VKeE8G
+k3QSI0s6+74stPv3S/ByCxu8q51ffYqVw00wzPpEc4SmHEa0R7IczJKXupmDdZZM
+1rASSBNzS5TZDBXP6S7npYQ8nHhgXTdCFO7eM3bp24B/i2o0s7+gkKrz0DkEbv9I
+UrCJjTL8OIIP4qSLMILzZ8pB28c+zyM482ZqFY/2b7j6WlTiqa9P1adrD1gLxTQ0
+Sw9xY+sY3PAJqcnPA5NjDZL/h5plgHhCqDa9pEtdBVG2Mxcl9bXbphwD1MIzj4gr
+xtlW1HUJ/iOhFcXldOJ1MCt++Bm5av4mL5adQ/oUnL5Q0oZZFwqT09k7xe7lZ98N
+uj2Lfl8NN7N3ama9KatgbX5g6IALuk/rJN/4KEiiu24m+lR7c5L0pg/cG6LIFjmk
+HlTsc0ANCgeZBhDJ8kvjcXDhFOqoYE/+D2VO6ZEHRsDibQ+kjpaH+DiD01/gh0N0
+HM6GGtm3GbOyZUhw5OFz04xzcyFYo2xaqzgaZieAOcrt2s6XyPVf1gww08/HtTMR
+gLg14MUQvRXV6kPJfdu4OLZ//b6J0KnzVyLDRdOrWIj2raLWmKwQN9qv05/yskcD
+Y6x7wq3v6iZpFjDc53sslhwp2XRsoWT9X5alVspz8WvP/kqgkTdzpPFdp1vIovOQ
+kRXdzzKICDGDJUIcTL8cJ3Dv4XqNR/sVyuB4dfndzQQApbdYTDNpwX0VJDBjMkQy
+Up6aiUknxa6Cbp7b1ZfUQY8yNBAIZL+R8dmobT3nAHW61DaASHSxn+elCD2Ja/6b
+EiWikskyN6crMAv35ILr5ySsZK97ttNNmRoGFbt8bTjRd83Ie+UfH445kCKsY83x
+aDCvWm+bbV6M9rSgjhJ3bWOudiw+EBMGvSamSnS7CYnRmwq4t+4bM2sh2nYKY0qw
+-----END RSA PRIVATE KEY-----
diff --git a/src/libnm-core-impl/tests/certs/test-ca-cert.pem b/src/libnm-core-impl/tests/certs/test-ca-cert.pem
new file mode 100644
index 00000000..ef1be20d
--- /dev/null
+++ b/src/libnm-core-impl/tests/certs/test-ca-cert.pem
@@ -0,0 +1,27 @@
+-----BEGIN CERTIFICATE-----
+MIIEjzCCA3egAwIBAgIJAOvnZPt59yIZMA0GCSqGSIb3DQEBBQUAMIGLMQswCQYD
+VQQGEwJVUzESMBAGA1UECBMJQmVya3NoaXJlMRAwDgYDVQQHEwdOZXdidXJ5MRcw
+FQYDVQQKEw5NeSBDb21wYW55IEx0ZDEQMA4GA1UECxMHVGVzdGluZzENMAsGA1UE
+AxMEdGVzdDEcMBoGCSqGSIb3DQEJARYNdGVzdEB0ZXN0LmNvbTAeFw0wOTAzMTAx
+NTEyMTRaFw0xOTAzMDgxNTEyMTRaMIGLMQswCQYDVQQGEwJVUzESMBAGA1UECBMJ
+QmVya3NoaXJlMRAwDgYDVQQHEwdOZXdidXJ5MRcwFQYDVQQKEw5NeSBDb21wYW55
+IEx0ZDEQMA4GA1UECxMHVGVzdGluZzENMAsGA1UEAxMEdGVzdDEcMBoGCSqGSIb3
+DQEJARYNdGVzdEB0ZXN0LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
+ggEBAKot9j+/+CX1/gZLgJHIXCRgCItKLGnf7qGbgqB9T2ACBqR0jllKWwDKrcWU
+xjXNIc+GF9Wnv+lX6G0Okn4Zt3/uRNobL+2b/yOF7M3Td3/9W873zdkQQX930YZc
+Rr8uxdRPP5bxiCgtcw632y21sSEbG9mjccAUnV/0jdvfmMNj0i8gN6E0fMBiJ9S3
+FkxX/KFvt9JWE9CtoyL7ki7UIDq+6vj7Gd5N0B3dOa1y+rRHZzKlJPcSXQSEYUS4
+HmKDwiKSVahft8c4tDn7KPi0vex91hlgZVd3usL2E/Vq7o5D9FAZ5kZY0AdFXwdm
+J4lO4Mj7ac7GE4vNERNcXVIX59sCAwEAAaOB8zCB8DAdBgNVHQ4EFgQUuDU3Mr7P
+T3n1e3Sy8hBauoDFahAwgcAGA1UdIwSBuDCBtYAUuDU3Mr7PT3n1e3Sy8hBauoDF
+ahChgZGkgY4wgYsxCzAJBgNVBAYTAlVTMRIwEAYDVQQIEwlCZXJrc2hpcmUxEDAO
+BgNVBAcTB05ld2J1cnkxFzAVBgNVBAoTDk15IENvbXBhbnkgTHRkMRAwDgYDVQQL
+EwdUZXN0aW5nMQ0wCwYDVQQDEwR0ZXN0MRwwGgYJKoZIhvcNAQkBFg10ZXN0QHRl
+c3QuY29tggkA6+dk+3n3IhkwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOC
+AQEAVRG4aALIvCXCiKfe7K+iJxjBVRDFPEf7JWA9LGgbFOn6pNvbxonrR+0BETdc
+JV1ET4ct2xsE7QNFIkp9GKRC+6J32zCo8qtLCD5+v436r8TUG2/t2JRMkb9I2XVT
+p7RJoot6M0Ltf8KNQUPYh756xmKZ4USfQUwc58MOSDGY8VWEXJOYij9Pf0e0c52t
+qiCEjXH7uXiS8Pgq9TYm7AkWSOrglYhSa83x0f8mtT8Q15nBESIHZ6o8FAS2bBgn
+B0BkrKRjtBUkuJG3vTox+bYINh2Gxi1JZHWSV1tN5z3hd4VFcKqanW5OgQwToBqp
+3nniskIjbH0xjgZf/nVMyLnjxg==
+-----END CERTIFICATE-----
diff --git a/src/libnm-core-impl/tests/certs/test-cert.p12 b/src/libnm-core-impl/tests/certs/test-cert.p12
new file mode 100644
index 00000000..ae4a6830
--- /dev/null
+++ b/src/libnm-core-impl/tests/certs/test-cert.p12
Binary files differdiff --git a/src/libnm-core-impl/tests/certs/test-key-and-cert.pem b/src/libnm-core-impl/tests/certs/test-key-and-cert.pem
new file mode 100644
index 00000000..dec9aa1b
--- /dev/null
+++ b/src/libnm-core-impl/tests/certs/test-key-and-cert.pem
@@ -0,0 +1,118 @@
+-----BEGIN RSA PRIVATE KEY-----
+Proc-Type: 4,ENCRYPTED
+DEK-Info: DES-EDE3-CBC,4DE0615F23D82107
+
+QPNCO5Dobvz9dDhN32KkZRoEifW+HDm2PCbRQhKDiscGwB6LgypvVjHNsZiFKwzz
+L4R51UqgQeJx7GSGJqE626e9z9J+UNBhop02aOO2X0eSPdvBzr/uJ6Umiyr1xqD7
+zWf7u9l5kXElDJRhK+87GMBewp4Ie9NeXDjhF8hzC5Kiulen4AH3AYnfH3S7DimU
+h8GFMg8inrudrTbcjBhCdPeHG2jCygOxw3InRFz7uaN6LIhOaPQvmvpP4Cc1WRnW
+ZPq9o+eU3fPWPD5t+Op/VzYLvKwgBy/yK1rQXUm6ZMO7MhhRJ94ZCsJv+nVWpJlv
+QyBlxDKxwfkfYbDELdnnDQdHdMbKatLqa0KhSkgpp8LywBtanPz731tyT0r7b3na
+eLdra59lRU7ZQLPEdS3lPZd2O/KQvWf8wbg7MjXS9LxQ7R5HOPu6DNJlwXVZBmmo
+cAfu2q8ubU2IePvWLD1GOrBi6hE9TiGvFJkw+wBK+t72sz3njv9Xm/zlxruaEk5m
+RW/kybU3FP4PtjriBbskz3/VZaaxuRN7OoOYTkmyHmG1ADgcRUV6fea19qqsBlN8
+xb+SRtoH28oT/JVWU5neE2dbNzk5LeVO+w70NNdR5s5xqkBhbGGaJxvXwNP4ltFr
+T06SMh8znOLKwWB00aRtwfU7jOwR3mOleQO4ugIHmau3zp1TqzAHW8XtpuV7qVeI
+ESZOZuf0vW43BtNzgLXt1+r+bmsMsRwhnyomL9M0TUyyBdVYY9GkzTG9pOESheRo
+RSvAZ8qKGUliTpgBcbt2v1+NqkszcHa6FxuvS8YU4uo5/GqsgTxHTNIB232hIrrZ
+EIm6QL9TC5oFXMjy6UNqoCm5Nb8DBJ6aErt7pt7aoktqUW3O3QIzQT3IbZ4nAcTt
+lVF4d7j29I9t7bcC8GOVU1neilguZUss4ghJg9x4zI5UZdR7hZ8fbFT47TyxB+j5
+r0YdmjbjVTaSyaN2JGh1wvb4TzawGNVx/U2EJE16HigOtPfsfQRJ3x+FROKBdVa4
+aIFYXkRBeIPxX6n9pcw0lBCsnXo6/5iTjQSk2VqO3rHO/wyWiEjNczhL33dY2A8W
+GG5ECMO5SqXZHQQzpABqK94dxe3UC8aEESO5NhEqDuV7qQGol0qPKrUA3wb0jb2e
+DrejJ9HS2m1SUDmjpvvmEGy6GN7CRibbKt5rNZdJNNvWArOF5d0F6wkixQLl73oE
+lq5gLQQk9n7ClleKLhlQpBCorxilBbzmSUekkJLi0eaZiBBFWBX9udqnUZloXTgO
+8qwuO8K/GPR9Jy1/UH2Vh1H+wivaqKTVgEb0NotzgzECgTEFKJafl7rUNs1OZRZ3
+VBjevi6+iDpxVFgF71kXfdUC4ph0E1XDl0ja2rrKQGivMkUhWJ57+4EV5+hBkAnt
+G0RV45NwHXLrK2bd8F9PlRk2XHW6mIcFRXsW1DjeBhk/sQjvlO9R01GRSgcXtekJ
+tmX17FWrMrzXHpvy1IC3fk4RVnSjpzQ8O+17YE8/la9wVaeZZzHyYFmMT7VXjIhW
+QozJQ0vJ2jxJRh5GYn3tpJzdaeRfvTBik0pChNdUTnWP+BJ35xoCTs8iwJbmgVZ1
+-----END RSA PRIVATE KEY-----
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+        Signature Algorithm: md5WithRSAEncryption
+        Issuer: C=US, ST=Berkshire, L=Newbury, O=My Company Ltd, OU=Testing, CN=test/emailAddress=test@test.com
+        Validity
+            Not Before: Mar 10 15:13:16 2009 GMT
+            Not After : Mar  8 15:13:16 2019 GMT
+        Subject: C=US, ST=Berkshire, O=My Company Ltd, OU=Testing, CN=test1/emailAddress=test@test.com
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (2048 bit)
+                Modulus (2048 bit):
+                    00:cd:34:b1:2e:b0:04:c6:f4:2b:a2:c0:a0:39:7a:
+                    82:ed:96:c4:f7:19:83:91:5c:b4:e7:9c:de:ec:48:
+                    ec:2d:e4:51:08:26:42:ac:d3:98:26:7a:72:f7:49:
+                    c2:9e:66:05:c6:47:29:fe:3b:ac:6b:af:6f:5e:a8:
+                    03:5a:73:33:ba:19:03:00:35:f5:00:bc:a8:be:14:
+                    ce:46:69:e3:6d:ed:34:37:85:55:87:62:b3:b7:c9:
+                    c0:cc:9a:aa:61:05:5b:cd:a2:17:42:d3:e5:6f:1c:
+                    60:8d:c2:15:41:46:f8:12:54:d0:38:57:e1:fd:8d:
+                    44:c8:fb:56:b3:b9:6c:e9:f8:9e:21:11:57:1b:8b:
+                    f9:cf:e3:17:e7:d8:fd:ac:d1:01:c6:92:30:f3:2d:
+                    c9:d6:c1:f0:3d:fd:ca:30:dd:75:74:e7:d1:6b:75:
+                    d8:c5:4d:43:61:fe:f6:ad:7e:4c:63:7c:03:17:a2:
+                    06:8f:d0:8b:69:d3:7a:07:0f:0b:a2:cf:0c:70:38:
+                    ba:cc:55:35:60:84:58:d8:d2:be:1f:ef:76:a9:ba:
+                    ae:6a:dc:08:97:80:de:42:00:b7:d4:ce:9a:b0:36:
+                    2a:c7:6f:45:04:7c:ea:41:19:d8:b9:19:04:1f:11:
+                    a9:22:80:bd:69:08:15:0d:3c:de:cd:7e:88:6c:0f:
+                    a3:43
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Comment: 
+                OpenSSL Generated Certificate
+            X509v3 Subject Key Identifier: 
+                CE:03:7E:EF:E7:DE:C9:87:BF:DE:56:F4:C8:A3:40:F6:C8:6F:05:8C
+            X509v3 Authority Key Identifier: 
+                keyid:B8:35:37:32:BE:CF:4F:79:F5:7B:74:B2:F2:10:5A:BA:80:C5:6A:10
+                DirName:/C=US/ST=Berkshire/L=Newbury/O=My Company Ltd/OU=Testing/CN=test/emailAddress=test@test.com
+                serial:EB:E7:64:FB:79:F7:22:19
+
+    Signature Algorithm: md5WithRSAEncryption
+        7a:20:93:63:40:73:7d:33:01:2e:c0:13:52:a4:a7:e1:4d:82:
+        f4:fb:b2:7b:d0:2b:5a:3f:0e:3c:28:61:71:ab:01:4d:fe:89:
+        b5:cd:2f:97:59:93:53:9d:51:86:48:dd:b9:e4:73:5e:22:0b:
+        12:0d:25:39:76:16:44:06:0c:40:45:21:6b:a6:b1:e0:bf:76:
+        1b:36:f3:1e:41:82:57:d9:59:b7:60:40:43:1c:1d:79:f6:48:
+        32:5c:4e:e2:06:89:96:41:d2:54:1f:4a:6f:f6:78:a5:3c:02:
+        85:21:e2:65:e1:8a:6d:24:19:95:f8:c0:35:ab:bd:ff:3d:f1:
+        fb:50:2d:30:1e:67:a6:7c:50:f9:d5:77:66:77:5a:14:0f:5c:
+        cd:21:09:9b:a3:92:57:19:dd:01:a4:18:c5:f9:70:e4:17:43:
+        8d:b1:e6:61:e9:50:89:83:4f:ce:a4:57:68:58:40:70:ae:71:
+        1c:47:66:d2:30:54:50:ea:3a:87:32:64:3b:18:42:fe:5a:19:
+        07:64:f7:f1:b1:10:07:fd:a7:d2:a7:a8:05:79:5b:25:ba:69:
+        7b:1a:3e:b1:3e:e4:17:17:01:ba:eb:54:ae:83:00:ed:66:62:
+        8d:c0:3e:8a:b4:27:5f:e9:01:ce:20:c3:34:a9:28:c0:6f:c7:
+        3b:65:fe:f9
+-----BEGIN CERTIFICATE-----
+MIIEojCCA4qgAwIBAgIBATANBgkqhkiG9w0BAQQFADCBizELMAkGA1UEBhMCVVMx
+EjAQBgNVBAgTCUJlcmtzaGlyZTEQMA4GA1UEBxMHTmV3YnVyeTEXMBUGA1UEChMO
+TXkgQ29tcGFueSBMdGQxEDAOBgNVBAsTB1Rlc3RpbmcxDTALBgNVBAMTBHRlc3Qx
+HDAaBgkqhkiG9w0BCQEWDXRlc3RAdGVzdC5jb20wHhcNMDkwMzEwMTUxMzE2WhcN
+MTkwMzA4MTUxMzE2WjB6MQswCQYDVQQGEwJVUzESMBAGA1UECBMJQmVya3NoaXJl
+MRcwFQYDVQQKEw5NeSBDb21wYW55IEx0ZDEQMA4GA1UECxMHVGVzdGluZzEOMAwG
+A1UEAxMFdGVzdDExHDAaBgkqhkiG9w0BCQEWDXRlc3RAdGVzdC5jb20wggEiMA0G
+CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDNNLEusATG9CuiwKA5eoLtlsT3GYOR
+XLTnnN7sSOwt5FEIJkKs05gmenL3ScKeZgXGRyn+O6xrr29eqANaczO6GQMANfUA
+vKi+FM5GaeNt7TQ3hVWHYrO3ycDMmqphBVvNohdC0+VvHGCNwhVBRvgSVNA4V+H9
+jUTI+1azuWzp+J4hEVcbi/nP4xfn2P2s0QHGkjDzLcnWwfA9/cow3XV059FrddjF
+TUNh/vatfkxjfAMXogaP0Itp03oHDwuizwxwOLrMVTVghFjY0r4f73apuq5q3AiX
+gN5CALfUzpqwNirHb0UEfOpBGdi5GQQfEakigL1pCBUNPN7NfohsD6NDAgMBAAGj
+ggEfMIIBGzAJBgNVHRMEAjAAMCwGCWCGSAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVy
+YXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUzgN+7+feyYe/3lb0yKNA9shvBYww
+gcAGA1UdIwSBuDCBtYAUuDU3Mr7PT3n1e3Sy8hBauoDFahChgZGkgY4wgYsxCzAJ
+BgNVBAYTAlVTMRIwEAYDVQQIEwlCZXJrc2hpcmUxEDAOBgNVBAcTB05ld2J1cnkx
+FzAVBgNVBAoTDk15IENvbXBhbnkgTHRkMRAwDgYDVQQLEwdUZXN0aW5nMQ0wCwYD
+VQQDEwR0ZXN0MRwwGgYJKoZIhvcNAQkBFg10ZXN0QHRlc3QuY29tggkA6+dk+3n3
+IhkwDQYJKoZIhvcNAQEEBQADggEBAHogk2NAc30zAS7AE1Kkp+FNgvT7snvQK1o/
+DjwoYXGrAU3+ibXNL5dZk1OdUYZI3bnkc14iCxINJTl2FkQGDEBFIWumseC/dhs2
+8x5BglfZWbdgQEMcHXn2SDJcTuIGiZZB0lQfSm/2eKU8AoUh4mXhim0kGZX4wDWr
+vf898ftQLTAeZ6Z8UPnVd2Z3WhQPXM0hCZujklcZ3QGkGMX5cOQXQ42x5mHpUImD
+T86kV2hYQHCucRxHZtIwVFDqOocyZDsYQv5aGQdk9/GxEAf9p9KnqAV5WyW6aXsa
+PrE+5BcXAbrrVK6DAO1mYo3APoq0J1/pAc4gwzSpKMBvxztl/vk=
+-----END CERTIFICATE-----
diff --git a/src/libnm-core-impl/tests/certs/test-key-only-decrypted.der b/src/libnm-core-impl/tests/certs/test-key-only-decrypted.der
new file mode 100644
index 00000000..c8652537
--- /dev/null
+++ b/src/libnm-core-impl/tests/certs/test-key-only-decrypted.der
Binary files differdiff --git a/src/libnm-core-impl/tests/certs/test-key-only-decrypted.pem b/src/libnm-core-impl/tests/certs/test-key-only-decrypted.pem
new file mode 100644
index 00000000..1a25da5e
--- /dev/null
+++ b/src/libnm-core-impl/tests/certs/test-key-only-decrypted.pem
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEAztLp+/SkzmaHzIst0sO4+r7qUwiVnidKBHgxoTbS5UL1dvck
+cbjTEP23V4ZoKQIb6ZMrr8B+PVgWNBAlhX4oLUL8NH/WTwrntrlAUcjliWDNc1Fj
+Z+FZNjFe0IdLXZeKQiLTQvKDYnmERVvYIJfi0TQjXuy/ikF8rYBQ85scUV3kKRzB
+xnyhAHAP9nl3AyL1S6t2yiCr4U5TbIZo6dYPbpVLtbXP02zUc9vAPR0gIHKrPiW7
+P81fLXf91wuo6wxzwD90JxdWzzGaqe3BOSfHqul3SPRtVok1XHlb9i+Mn5O8ExzQ
+dF8wGxVDcY7/Gt9lZWnCilqrBEqA3iApjUgcgwIDAQABAoIBAQC77HCmepf04ryp
+Yhz00NoXG7mWUMqBtXlPrlaKAWKG5dxbiBwZKLK/UYlxgbLK8BuklBCx1Nnfq1Yh
+YDp3nTWsSp0WpsF3eJUqNhD3Pu8xcD+9dEo6bUu+LgXUu9oC5Fq/1RzYS7qNk5RX
+4Sf0FY4GQLWS3tL7MJ20mE71yg5k7qRbDydOyhTh1m1CpRYONWxSsWVLM8KGRDJp
+iF0cdPfD5yoPFpgDk8gwzrnXJH2Wqzv8GvyYykRK5AW7tE50y0rTAM42WZ7YS6aZ
+FNMmtYxeyzXLY3LgPP0uko5anz3OXRcqCfHfFANG0y7B9MehbrjMgI6S1BbzFl07
+V1zVQVqhAoGBAPIfrWMlh1fHlRh4iRGXK2Hvxyv2oNz9KvQ4qRaLV9ejRDzdt7Pi
+/utbi5LGBuDw9016nXM3I77b6PukHzsHFnWGRnyRSbkMMt6mE17nggmNqcpFWfE8
+E7HcKMhk4gbuo5AHD3Ee1Gac2AUDnzYiE+sS6WI3O9d77cc5ych5jZ+nAoGBANqt
+VZCttjY0E+hEyTP37eaE8u0jfdK8AflTJlNUHWKXglES525iu8I/Bso8KaQYsYF3
+SezGRd3KQepQhtMjFKfSpF+tbnboP57Y3XGo8xhbxqV4kRX+XGsVoW3Vg2nPKBrR
++dIY5nMwua+gkHWp9RDcemD2reiIZBVx95fK8dfFAoGAdCSH2pBs/MlrFqLzNTHr
+iH4pb0hN39O9YAsx6POMfo79s6izbyHLIID4Ub6WHB7ashrIHjVr+yin+NXAeWMr
+/dIcS7Kxx4c3e5/0mMi6kvSWZsWfoF0uIVo3YfEqjyK36OXKHXwpbNN9t+IF5ESy
+g0e+FfPiy7nR1Ig+5+CO8+8CgYEAp/75+Ug677FaidouaMpT7gC9UAkwJLFjItQK
+YYIBgTi8WOSY/2jCrhwVb1CA/RwrYjbuiARasGUt9oEe0x3kRHnC5e4rKxaJqdMZ
+bLRK7a+0EHNrouXiwjG/7s1VQ/ht6wzdS9btVBlezdogoQSMzQNU0SExwa7mlMMV
+X3v+B7ECgYAK+Yt4jnLH1LNWoDTU0Ug5hyXsQXV8lVBSnrkvS7GtP6ZA/4OqG7lJ
+/bTYFZGoiAGzOnC+YlAqSIu45CEnpr2xBsThQiWUVxspmQD1lEWWFcd77DPUwn3C
+59pLgx0AqJE3n6lBOwehiXbFKBdVzX8PfPZpuCK6qc/RiTILktwURA==
+-----END RSA PRIVATE KEY-----
diff --git a/src/libnm-core-impl/tests/certs/test-key-only.pem b/src/libnm-core-impl/tests/certs/test-key-only.pem
new file mode 100644
index 00000000..5ef530e9
--- /dev/null
+++ b/src/libnm-core-impl/tests/certs/test-key-only.pem
@@ -0,0 +1,92 @@
+-----BEGIN RSA PRIVATE KEY-----
+Proc-Type: 4,ENCRYPTED
+DEK-Info: DES-EDE3-CBC,B29FCA6ECB7C0C48
+
+KuRV4sEVQkY0r0E+E81Se2qpm54HeboUMIJcMVqAt/HIeYwpjEzmXHUywXgayA5k
+r5Uvru95vymFz80q/rl6i4Mt3ckEQ3/VHmBI4pPj/JeRbiDhqTyLqpB5zMgbuti+
+PsEemlbiaCMZFdJk8rJBWADTkirGbXs5ciLwTJyrJXhkBVTqoHtphSWMELxcrnQj
+5bAXZ+rnApWA7LR3yCY1UE0Nj39Yu8lkzDJtbsSXPJVO//OQiGuQRcY6roAUzeS/
+amLdIYqoZm3OF83Ro88XZCIDCG6XjgKoqojtekClVIytB6mHWk+IHhI7DgU/pDBj
+yOskzVRMja9ECnqaVX+bmlmJGZBgcd7+XiebCXNY9IAx/ZQDMbDJDoJusvH6npJR
+PBgag8QBSzwpFyEP/1LrlyVyggZcGuXDWfUiM2rt2UvLm8QYeT5WGfUI+QwW6JRV
+xEz2QwRiPsmj0uK2fXLKHbY0Pv79IMLqgesCAUbndWsi94kjAhpJGa/WfKVb8Dpg
+T+mVa2OT0pgewPWJ3h5f47ag27WDJthsIUHAvNZ03uM23DIqDh6o03/B3/4r1Uab
+HzsLWhUOzbLihO08qcPk/JqtDVCv579mpgvy7bL2ZsZUzefnmg+ah+1bhLguryZu
+Zrt1hTu5WTz27UbYwWNtkxWnWcM9sSF9y+KVwumYhIUGTvg3Jds/jmp/Z5ad8tev
+0RQuWmqnXVD51Y92tOXobJH7JwGbQ4GeRNG/UX7DS9Lvb6rPgmmxvGbXMcjEMapB
+m5DLjCD7Lz4++sfzhCic3/nL8e8fjoYZmCbL/SpYjGjTrfoNaGYaT0De8MxCSjPf
+rNT+ldWFD0oAOTmT0uqOFkeIx3vxczSQUyRfzGOLqtb9mAXk8lvdb8Myb5atfe8f
+FNBL5ocz6Szv2AmKmjZE5P6NKSllyryCYl+H2QU0e3OyY8S9aG2aG8fqeVKaA01S
+uOOjsK6IKMpkit+VFDP7RWvS8p1FTwTVRdbMZzASW8+D98OHsTlOENtQuuFyvNaN
+vPHrbHltTkwDlYVab9UpFr/ZRW3cNJrmcl0hyeCJxk5u8B9UwW6yZmd24hxda2xt
+1QjnxfWlX0i5KTmfWFyPmRYt1WH9rdVaH6wqRbGNbMRT7Lez0E/2+LXjFiiEe0Vh
+ZuryhyhUXpHY8yyHxFY92XT504Z3wPUaJ1tQxGhdziZ7HcqFT8f4oTNJdBNtzqNw
+l63gSTaKUkSB14CBOyR84cqpgSMwZvWZb3RQFYY4GSALWwhnn6PWeRhjWAXPms2v
+tRmfEyDUCyPxDarezvS9kUir3XbvnCkoJOrK/lw4a8ygGBCBqRKOdI0SRUf1Nnjm
+aZBrKrXHv5vP66fyC7cGMTq35+iiHbE//rRDGPrf9vpmw3ki3FlDMyAXOC5yWDco
+0n+cNDyHJDdIW3+3nfZvSgPPMwmTdfNO90X3YczSmMTGjnIuhQMf7FMFmMZOSrqD
+u234vYCjIIlph3aVpbzjOqKg3d4nuP9oouyAgRAr+vShgHRmq0jvsAiGH3Q6RqEj
+DvkM1NgoloMy5RhKF4hIeaQM/UlgoXrcEx0RGCJHykQcQmVa5cf5EwjrO7b+w2Lg
+-----END RSA PRIVATE KEY-----
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+        Signature Algorithm: md5WithRSAEncryption
+        Issuer: C=US, ST=Berkshire, L=Newbury, O=My Company Ltd, OU=test, CN=test/emailAddress=test@test.com
+        Validity
+            Not Before: Feb  2 02:22:25 2009 GMT
+            Not After : Jan 31 02:22:25 2019 GMT
+        Subject: C=US, ST=Berkshire, O=My Company Ltd, OU=test-client, CN=test-client/emailAddress=test-client@test.com
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (2048 bit)
+                Modulus (2048 bit):
+                    00:ce:d2:e9:fb:f4:a4:ce:66:87:cc:8b:2d:d2:c3:
+                    b8:fa:be:ea:53:08:95:9e:27:4a:04:78:31:a1:36:
+                    d2:e5:42:f5:76:f7:24:71:b8:d3:10:fd:b7:57:86:
+                    68:29:02:1b:e9:93:2b:af:c0:7e:3d:58:16:34:10:
+                    25:85:7e:28:2d:42:fc:34:7f:d6:4f:0a:e7:b6:b9:
+                    40:51:c8:e5:89:60:cd:73:51:63:67:e1:59:36:31:
+                    5e:d0:87:4b:5d:97:8a:42:22:d3:42:f2:83:62:79:
+                    84:45:5b:d8:20:97:e2:d1:34:23:5e:ec:bf:8a:41:
+                    7c:ad:80:50:f3:9b:1c:51:5d:e4:29:1c:c1:c6:7c:
+                    a1:00:70:0f:f6:79:77:03:22:f5:4b:ab:76:ca:20:
+                    ab:e1:4e:53:6c:86:68:e9:d6:0f:6e:95:4b:b5:b5:
+                    cf:d3:6c:d4:73:db:c0:3d:1d:20:20:72:ab:3e:25:
+                    bb:3f:cd:5f:2d:77:fd:d7:0b:a8:eb:0c:73:c0:3f:
+                    74:27:17:56:cf:31:9a:a9:ed:c1:39:27:c7:aa:e9:
+                    77:48:f4:6d:56:89:35:5c:79:5b:f6:2f:8c:9f:93:
+                    bc:13:1c:d0:74:5f:30:1b:15:43:71:8e:ff:1a:df:
+                    65:65:69:c2:8a:5a:ab:04:4a:80:de:20:29:8d:48:
+                    1c:83
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Comment: 
+                OpenSSL Generated Certificate
+            X509v3 Subject Key Identifier: 
+                34:E9:5C:D8:FC:C7:AF:F7:5D:F4:13:D3:82:1A:CD:52:0F:4A:BB:0B
+            X509v3 Authority Key Identifier: 
+                keyid:52:33:2E:22:66:79:82:E5:41:2E:8D:3B:B2:E5:CC:FA:BE:99:33:8E
+                DirName:/C=US/ST=Berkshire/L=Newbury/O=My Company Ltd/OU=test/CN=test/emailAddress=test@test.com
+                serial:E6:4C:5C:96:26:5E:D6:D0
+
+    Signature Algorithm: md5WithRSAEncryption
+        88:c4:dd:c5:4a:a6:8e:1f:36:62:80:31:6b:2b:85:34:0d:6c:
+        a7:dc:e1:5a:3c:dd:74:57:db:59:be:8b:f2:79:40:2d:bd:9b:
+        e1:ab:0e:03:75:20:75:2f:ea:97:f9:d4:7e:15:75:c2:82:f5:
+        b1:37:e4:8b:24:d4:ef:02:3b:19:6a:56:bb:9f:c3:a5:b4:c4:
+        39:a0:64:96:5b:c3:a8:19:74:ec:0b:cf:33:df:f3:12:f3:e2:
+        ab:1d:7d:de:21:64:cd:b1:a0:6f:7a:77:84:d4:62:8a:50:e6:
+        76:5d:af:3a:ef:1a:87:0e:1a:38:c4:f9:0d:2f:14:e0:20:32:
+        4c:2e:70:d2:71:82:d5:e5:c9:13:2c:4e:b4:c8:63:65:1d:48:
+        e8:c3:56:6d:88:84:57:65:13:1e:42:48:b4:03:25:71:4e:12:
+        9d:1a:88:65:d5:71:21:3b:0e:be:37:1c:f0:88:6b:45:0c:0e:
+        6c:e5:60:cb:86:bf:bf:40:30:c4:cf:94:f8:1c:60:d4:1b:df:
+        88:02:7a:45:7e:d1:c6:f3:07:b9:b1:8f:2a:55:2f:be:77:9f:
+        d1:46:64:05:b7:67:c5:b2:ac:8c:42:8f:6a:51:a4:0d:2b:16:
+        a4:d6:39:a5:f8:25:ed:68:25:13:b5:19:ac:6c:e9:ec:ee:03:
+        6b:80:38:6e
+
diff --git a/src/libnm-core-impl/tests/certs/test-tpm2wrapped-key.pem b/src/libnm-core-impl/tests/certs/test-tpm2wrapped-key.pem
new file mode 100644
index 00000000..f3fd271c
--- /dev/null
+++ b/src/libnm-core-impl/tests/certs/test-tpm2wrapped-key.pem
@@ -0,0 +1,14 @@
+-----BEGIN TSS2 PRIVATE KEY-----
+MIICEwYGZ4EFCgEDoAMBAQECBQCBAAABBIIBGAEWAAEACwACBEAAAAAQABAIAAAA
+AAABAOJdEXw1LO6JWskHBSYQc1NfJAe9DOAyLA4XbXI5asQ8aNbmL51DP9mQQpqq
+a1CSRZAIuuorMxyRBBAFpF4OZqjNd/Nskp3iMmifr5yqAYZ3M31MqlBFiiyctqKp
+VwIChwsIbKelrsXbty1icP2CH+k4w/nPymPjnfYtgpMe8QW8n6U156ujIdJcISds
+QFcl3nrDnD1IumX0/LfanQrRDVSI+m6szvTrdsPMtGeaNMnlz0gx74auo7/CgEjX
+69xjPvQpNLHO/nV4EHSdfXH3LamcpWO8aEAVne3MFFA9V0bpv7uKoGhRjssD9kSr
+PQzNXfjHpkcOLeH4pzxDMFXDIGUEgeAA3gAgrCL3RRcBryFXToo9ZN3/f4EeeEjK
+58ejYomsxqvckhgAEMxbT26fo2h27b4KPlnUpoiL2JPLB0Xz6PJAF8n0YdJUO381
+xhzPTIQop81BxljTLV2C9WGns5bWDPW9ItEbv4UalEwFfxsW4Ma5smLWn3A1UwVN
+Z1cW/oUx+3nOCF1TZgbMPszToqCPlpIHd9vO709qpSyULIUkZLHS6PUM7ESY5U81
+f4BITxJR+aYaqErni/FDLsDVP0MQ3CuFHeUDHI0uEzzbfurYFjpp9+caaoWuZzpg
+VYV5pjPdgg==
+-----END TSS2 PRIVATE KEY-----
diff --git a/src/libnm-core-impl/tests/certs/test2-cert.p12 b/src/libnm-core-impl/tests/certs/test2-cert.p12
new file mode 100644
index 00000000..9d5732b0
--- /dev/null
+++ b/src/libnm-core-impl/tests/certs/test2-cert.p12
Binary files differdiff --git a/src/libnm-core-impl/tests/certs/test2_ca_cert.pem b/src/libnm-core-impl/tests/certs/test2_ca_cert.pem
new file mode 100644
index 00000000..9a487ca4
--- /dev/null
+++ b/src/libnm-core-impl/tests/certs/test2_ca_cert.pem
@@ -0,0 +1,27 @@
+-----BEGIN CERTIFICATE-----
+MIIEpDCCA4ygAwIBAgIJANDnVhixAO1GMA0GCSqGSIb3DQEBBQUAMIGSMQswCQYD
+VQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVzZXR0czERMA8GA1UEBxMIV2VzdGZv
+cmQxFjAUBgNVBAoTDVJlZCBIYXQsIEluYy4xFDASBgNVBAsTC0VuZ2luZWVyaW5n
+MRAwDgYDVQQDEwdlYXB0ZXN0MRgwFgYJKoZIhvcNAQkBFglpdEBpdC5jb20wHhcN
+MDcxMTA5MTU0ODI1WhcNMTcxMTA2MTU0ODI1WjCBkjELMAkGA1UEBhMCVVMxFjAU
+BgNVBAgTDU1hc3NhY2h1c2V0dHMxETAPBgNVBAcTCFdlc3Rmb3JkMRYwFAYDVQQK
+Ew1SZWQgSGF0LCBJbmMuMRQwEgYDVQQLEwtFbmdpbmVlcmluZzEQMA4GA1UEAxMH
+ZWFwdGVzdDEYMBYGCSqGSIb3DQEJARYJaXRAaXQuY29tMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEAz9zRLSiQyQangDgEliEP8xSpnPJS7GjXzrkZS3sk
+gZLuVuwoFeZRq3Hsrq/wGd/vM0KUFNmEaMc+47jnuv0UHQcQ45ZACO7s4/Aflhzj
+lkmud/z06hVknIzjXmvS6q2ttCviHsXnfokl+wAxuUhsd+le0xjP9H1jXny4YBuS
+jP+yGUz7PL4w1sFFghKIPrlB7m4GkFbQRqvH7FSJg86GWopPwJvNvIzhOZiO1a1D
+CAAL4Ru3jxtNFxqWT87C/qUEe/2Qb7jtNyqFcKfwZyZh4u1bo0c8bjErlUZERbWz
+zM3hTFypuw+i2v+0h3A8/Xb0hTjcHkUoJgfSdbsOLC5TOwIDAQABo4H6MIH3MB0G
+A1UdDgQWBBR+UOaH4e8nrEuMcEXJl7UN5r/wDTCBxwYDVR0jBIG/MIG8gBR+UOaH
+4e8nrEuMcEXJl7UN5r/wDaGBmKSBlTCBkjELMAkGA1UEBhMCVVMxFjAUBgNVBAgT
+DU1hc3NhY2h1c2V0dHMxETAPBgNVBAcTCFdlc3Rmb3JkMRYwFAYDVQQKEw1SZWQg
+SGF0LCBJbmMuMRQwEgYDVQQLEwtFbmdpbmVlcmluZzEQMA4GA1UEAxMHZWFwdGVz
+dDEYMBYGCSqGSIb3DQEJARYJaXRAaXQuY29tggkA0OdWGLEA7UYwDAYDVR0TBAUw
+AwEB/zANBgkqhkiG9w0BAQUFAAOCAQEAmE2jqUymfxN2Vv7bPafoK/EpZwGPxu+z
+phRFsgUgWVzidc/GtOxN81LduJ+ow8MEbQIabo4JV/MdKzuPuhAHToAQdeb0LIWa
+p59vTIZiVhUt0cMAbQwKcTnfmDnXw9wytvtKgeAXJq0Jd6F+uNXTiR1btlYLZqmF
+oSu54cHQlXpUT9z0BnQ8eXd7m0TwfzGQkTHQI7xBa87lZDAkJaTlhv7fR5vPmJYY
+0LiXii71ce+4hxdlp7hQfwQ2sb8FPY3RlVboTRD0CvGaWypWhdSZnS790dBXgZOs
+NCge6NGuHzW5LtiZE9ppuv8qJysVcIFdAqt8dkx58ksOqFcARCerXw==
+-----END CERTIFICATE-----
diff --git a/src/libnm-core-impl/tests/certs/test2_key_and_cert.pem b/src/libnm-core-impl/tests/certs/test2_key_and_cert.pem
new file mode 100644
index 00000000..a668596e
--- /dev/null
+++ b/src/libnm-core-impl/tests/certs/test2_key_and_cert.pem
@@ -0,0 +1,119 @@
+-----BEGIN RSA PRIVATE KEY-----
+Proc-Type: 4,ENCRYPTED
+DEK-Info: DES-EDE3-CBC,5FA2D6D6242C26D0
+
+dyNdbh115sczbUEhiaGYJ6fazyvJss5thPFEmkP6aftYlvXY6vPtc++xFCCktiSd
+qFVEyi6oDyV4iGPmX7pCJ0e+pSI6uFNXKFtxh5/+/wXZcOEMCvfu7w2IrvYF2LHY
+qJDljcISSRxeINuYO7TETD5fLLRKj2X9vwwkwVN02b2N5jsrm6Bt//WbatqSB3ln
+FHyQhVKkvdl9Hr1XNmEfgGfZSxxDoPu1DjhtZ5ja2LZj64C2CXdI0oq2wcAVvQNn
+rZeeg9sinQJkz9rwsNaWqlYw4X+YD2JRSwZuvwkWRydYMwgb1XS/jCxtuFF8NXWP
+RBAOAZZUy7onzohsJHVVa05wCKQ4klo+PEfI3vn7BeuHyciCc0eFqGRvz8eFDybH
+ZdPbU/3vGp+mOB7gd27TptttTCQQy9uM5CIyovNSYsAIw1Z583Ea4q8eXgzkgD6D
+isCqkGXMfPbNXU3myQGDnQwWRi2CqX+rXM8PJUhdewLAlmHRz/aYSuql2BRixJKx
+eASzmFBYdAjrvafda5D+xTyJwXEwdq/HlqMK9cY28ZbNrzA2Kor2X23EKC1+VG8k
+B67OsfUhW27j4u6aV5JdLf87OtF3mHFRR+Lzs7i7LYvJ8ACE+jiIi7PboZjK5Oiv
+JqTK0BwDaeNYjkd6jiJh8It/ReMbLk65J3eldOklN0VMPYiqcQnHvSPC2DD1YAy+
+Rv/JVj6TvzvgEAj+hgH6MAAF6u3ARj6+10DlvhUubkOC5RztLKReu8B+427TuuDb
+T03gFpHD6X9IqSiq/QfYFyHFojCVSrv6wDZOcHc1s71kpJ8R14YIVe+DrrZN/0D4
+M631jdNg3JARMZXcXTHrghGIdPmOtrsRyTTRZuGoVup/DW9MRzOzCTMSNCX8T+eq
+13HMSNQEO9lMwy0sYeO5c7sjHY4K1ubZuVE1mvXq4JLz3YxXJIvgp8TUvqDnAsK+
+Fv63bDoTg5Tq63XvnaKc7Lawneyg5ZAMzPN3nM0/1EZcn/2ICI5c4Yepc5t63EI5
+KytuXx86Mcx234enj3uMeuM22POQ1SnKOef6dFzK/CE8J8eUEY/aDhX4eBl/s3nd
+U4+aaFKYz3HTazePayt2SC6rP/KKMmS14q59bOQA1DiWxCvmA2ypRyP87fV5DstH
+I53RD5xp1P38iaO8U/divD0W2dkv748s9DQqYrHPtWALT9esxNU07CgB8Zt070si
+7pzjQ8FDCZ8ygDmwWGNSBz1nA90Cpd6gAFDrep7HAtDE4qgNfokycpaJZkXBei/U
+tC4tWYRbqDEsEbeBHvQRJzzqWzk9e/P4fQoelM3aryKzKLG5z7KvywVifKMLECQ+
+tIpzoRp06nuTA/O+iLFdkCy3JEWszfvvOwTwtIIV6+3s8TU0k9MmzEe3rGL+QqT/
+Tf+9/dN5LK+LWyc99BfmCOrBuFtQmHyEXkfe6EuFYEwj0B2ZfnLCon6cdRujjK7H
+IJslC1B/cBVqG3KCrbBzjeygKfJ5Ijo72oXZJOCFTLeJefZKGGWJCp9nG9h9Wrcf
+fEN/mj3wBvTa90/PYFj9NuaBtrvMF8Rn9XDeYPq2JGL8YkNdPuO8A+2Yko8wcvST
+-----END RSA PRIVATE KEY-----
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 2 (0x2)
+        Signature Algorithm: md5WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, L=Westford, O=Red Hat, Inc., OU=Engineering, CN=eaptest/emailAddress=it@it.com
+        Validity
+            Not Before: Nov  9 15:50:14 2007 GMT
+            Not After : Nov  6 15:50:14 2017 GMT
+        Subject: C=US, ST=Massachusetts, O=Red Hat, Inc., OU=Engineering, CN=client/emailAddress=it@it.com
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (2048 bit)
+                Modulus (2048 bit):
+                    00:b0:8f:4f:1c:93:d4:43:e7:87:b7:22:33:55:a8:
+                    35:a1:c4:01:b0:f1:ed:26:23:96:ab:65:c2:c2:54:
+                    db:79:22:03:ad:3f:6f:22:e3:63:3f:f4:21:6d:fa:
+                    88:c8:8f:1a:ce:55:49:7c:98:33:6a:67:8a:8d:d9:
+                    34:b0:c3:42:f4:72:a4:45:43:05:72:5d:0c:d3:42:
+                    f8:9c:66:3b:b8:f8:77:ea:f6:b6:94:d7:cc:5d:62:
+                    34:2a:14:48:0a:bc:65:94:f5:7a:63:98:6c:88:4c:
+                    25:d8:95:f1:40:3d:00:d2:fb:43:28:fa:02:fb:2c:
+                    80:b3:e1:33:e7:8c:ce:8a:a0:1b:3d:04:4d:bc:a1:
+                    b6:a2:42:8b:8e:f3:5b:4a:72:34:7d:8d:ba:d8:46:
+                    22:35:da:5c:f8:dd:fc:6d:9e:59:22:b7:6b:e7:78:
+                    56:54:9f:4c:d1:e2:4a:23:a3:bc:04:ea:46:6b:70:
+                    8a:fb:fe:8a:73:ca:36:d5:f3:e9:17:e3:22:d5:b3:
+                    70:05:e7:f7:37:b7:21:b5:90:53:27:27:ea:36:9b:
+                    00:ff:35:b0:66:3d:dc:a9:2f:95:d2:21:18:98:4f:
+                    28:07:09:70:20:a8:b1:82:aa:a5:df:ae:0f:e3:36:
+                    be:68:8c:9e:80:d3:33:d0:f5:84:17:d9:0f:eb:9d:
+                    af:0b
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Comment: 
+                OpenSSL Generated Certificate
+            X509v3 Subject Key Identifier: 
+                71:AB:BB:91:B7:04:DE:43:35:36:07:8A:35:CA:BE:5C:3E:EB:B1:09
+            X509v3 Authority Key Identifier: 
+                keyid:7E:50:E6:87:E1:EF:27:AC:4B:8C:70:45:C9:97:B5:0D:E6:BF:F0:0D
+                DirName:/C=US/ST=Massachusetts/L=Westford/O=Red Hat, Inc./OU=Engineering/CN=eaptest/emailAddress=it@it.com
+                serial:D0:E7:56:18:B1:00:ED:46
+
+    Signature Algorithm: md5WithRSAEncryption
+        ce:43:6d:f7:f8:4a:66:fd:8a:2c:41:a6:e0:03:0e:60:30:d4:
+        41:01:ba:46:ba:81:97:64:68:83:25:9c:e1:2c:03:8b:2d:ca:
+        85:cf:bc:fa:ca:22:c4:59:28:23:8f:ff:50:94:60:1c:90:dd:
+        75:f4:d4:ea:8c:fa:61:61:08:35:4a:8f:aa:a7:e9:3d:76:e9:
+        08:28:55:01:c4:03:42:c7:ad:58:bb:ee:94:f7:09:b3:9a:9b:
+        8b:d0:25:95:18:a6:22:d5:2c:fc:b7:bb:91:0c:7c:03:7f:9b:
+        85:de:b0:e4:95:a8:73:94:27:0a:11:4e:e3:67:ae:2b:cc:e7:
+        51:29:10:23:57:5c:3e:e7:ea:47:e0:f0:8f:5b:a2:9f:26:cf:
+        7f:b5:7c:44:b1:7b:83:67:3c:41:ae:c6:66:64:e0:d2:ef:57:
+        a4:5c:1b:94:11:ce:28:e5:91:51:ef:e1:98:b7:3b:9a:cc:f7:
+        b9:85:76:eb:a8:2b:15:4a:cc:1a:a3:42:fa:be:1c:ce:b8:eb:
+        ee:12:d7:2f:e4:a8:cf:eb:2a:8f:78:e8:91:88:fa:c2:98:75:
+        6a:4c:92:3f:2e:0d:e1:20:39:36:c6:2c:be:67:30:c3:f3:c3:
+        65:81:ac:e3:3c:19:6a:21:ee:ea:f5:22:66:74:b2:07:53:7c:
+        9a:0c:24:a6
+-----BEGIN CERTIFICATE-----
+MIIEtDCCA5ygAwIBAgIBAjANBgkqhkiG9w0BAQQFADCBkjELMAkGA1UEBhMCVVMx
+FjAUBgNVBAgTDU1hc3NhY2h1c2V0dHMxETAPBgNVBAcTCFdlc3Rmb3JkMRYwFAYD
+VQQKEw1SZWQgSGF0LCBJbmMuMRQwEgYDVQQLEwtFbmdpbmVlcmluZzEQMA4GA1UE
+AxMHZWFwdGVzdDEYMBYGCSqGSIb3DQEJARYJaXRAaXQuY29tMB4XDTA3MTEwOTE1
+NTAxNFoXDTE3MTEwNjE1NTAxNFowfjELMAkGA1UEBhMCVVMxFjAUBgNVBAgTDU1h
+c3NhY2h1c2V0dHMxFjAUBgNVBAoTDVJlZCBIYXQsIEluYy4xFDASBgNVBAsTC0Vu
+Z2luZWVyaW5nMQ8wDQYDVQQDEwZjbGllbnQxGDAWBgkqhkiG9w0BCQEWCWl0QGl0
+LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALCPTxyT1EPnh7ci
+M1WoNaHEAbDx7SYjlqtlwsJU23kiA60/byLjYz/0IW36iMiPGs5VSXyYM2pnio3Z
+NLDDQvRypEVDBXJdDNNC+JxmO7j4d+r2tpTXzF1iNCoUSAq8ZZT1emOYbIhMJdiV
+8UA9ANL7Qyj6AvssgLPhM+eMzoqgGz0ETbyhtqJCi47zW0pyNH2NuthGIjXaXPjd
+/G2eWSK3a+d4VlSfTNHiSiOjvATqRmtwivv+inPKNtXz6RfjItWzcAXn9ze3IbWQ
+Uycn6jabAP81sGY93KkvldIhGJhPKAcJcCCosYKqpd+uD+M2vmiMnoDTM9D1hBfZ
+D+udrwsCAwEAAaOCASYwggEiMAkGA1UdEwQCMAAwLAYJYIZIAYb4QgENBB8WHU9w
+ZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRlMB0GA1UdDgQWBBRxq7uRtwTeQzU2
+B4o1yr5cPuuxCTCBxwYDVR0jBIG/MIG8gBR+UOaH4e8nrEuMcEXJl7UN5r/wDaGB
+mKSBlTCBkjELMAkGA1UEBhMCVVMxFjAUBgNVBAgTDU1hc3NhY2h1c2V0dHMxETAP
+BgNVBAcTCFdlc3Rmb3JkMRYwFAYDVQQKEw1SZWQgSGF0LCBJbmMuMRQwEgYDVQQL
+EwtFbmdpbmVlcmluZzEQMA4GA1UEAxMHZWFwdGVzdDEYMBYGCSqGSIb3DQEJARYJ
+aXRAaXQuY29tggkA0OdWGLEA7UYwDQYJKoZIhvcNAQEEBQADggEBAM5Dbff4Smb9
+iixBpuADDmAw1EEBuka6gZdkaIMlnOEsA4styoXPvPrKIsRZKCOP/1CUYByQ3XX0
+1OqM+mFhCDVKj6qn6T126QgoVQHEA0LHrVi77pT3CbOam4vQJZUYpiLVLPy3u5EM
+fAN/m4XesOSVqHOUJwoRTuNnrivM51EpECNXXD7n6kfg8I9bop8mz3+1fESxe4Nn
+PEGuxmZk4NLvV6RcG5QRzijlkVHv4Zi3O5rM97mFduuoKxVKzBqjQvq+HM646+4S
+1y/kqM/rKo946JGI+sKYdWpMkj8uDeEgOTbGLL5nMMPzw2WBrOM8GWoh7ur1ImZ0
+sgdTfJoMJKY=
+-----END CERTIFICATE-----
diff --git a/src/libnm-core-impl/tests/certs/test_ca_cert.der b/src/libnm-core-impl/tests/certs/test_ca_cert.der
new file mode 100644
index 00000000..e844f65b
--- /dev/null
+++ b/src/libnm-core-impl/tests/certs/test_ca_cert.der
Binary files differdiff --git a/src/libnm-core-impl/tests/certs/test_ca_cert.pem b/src/libnm-core-impl/tests/certs/test_ca_cert.pem
new file mode 100644
index 00000000..faa3fc29
--- /dev/null
+++ b/src/libnm-core-impl/tests/certs/test_ca_cert.pem
@@ -0,0 +1,27 @@
+-----BEGIN CERTIFICATE-----
+MIIEhjCCA26gAwIBAgIJAOZMXJYmXtbQMA0GCSqGSIb3DQEBBQUAMIGIMQswCQYD
+VQQGEwJVUzESMBAGA1UECBMJQmVya3NoaXJlMRAwDgYDVQQHEwdOZXdidXJ5MRcw
+FQYDVQQKEw5NeSBDb21wYW55IEx0ZDENMAsGA1UECxMEdGVzdDENMAsGA1UEAxME
+dGVzdDEcMBoGCSqGSIb3DQEJARYNdGVzdEB0ZXN0LmNvbTAeFw0wOTAyMDIwMjIx
+NTJaFw0xOTAxMzEwMjIxNTJaMIGIMQswCQYDVQQGEwJVUzESMBAGA1UECBMJQmVy
+a3NoaXJlMRAwDgYDVQQHEwdOZXdidXJ5MRcwFQYDVQQKEw5NeSBDb21wYW55IEx0
+ZDENMAsGA1UECxMEdGVzdDENMAsGA1UEAxMEdGVzdDEcMBoGCSqGSIb3DQEJARYN
+dGVzdEB0ZXN0LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANZz
+iHfFR6Gqdz5Gq1elSaf7J2tznfialPyMkRoqngSItrM3JWlkfBu3ZIpGSYG8+Z8H
+JjaKh/zkCCH73HcjADCocm/XtgxlOlccDtBvfDqifb2dBikcmcfh0tX0o4JU9L+z
+WP7sVcUkJG7C5811lA5pAsLVooJxrZnrta6XstGvFgTSxI2Y4Jowf0syM5b/AHIQ
++htsVhSyj1DWM9day3QsEMZl55SCxCLTB6ZIJLF6NmTYwdnzWWTQf4k7kcptZJU8
+Fqv60b/ATvvUf7S+ZMGLopFIIlmc1Kkn7VTseIKy4ycYuDpyimQy3Yw4flC00vhl
+hTijH+5dlVOUFrRh0bsCAwEAAaOB8DCB7TAdBgNVHQ4EFgQUUjMuImZ5guVBLo07
+suXM+r6ZM44wgb0GA1UdIwSBtTCBsoAUUjMuImZ5guVBLo07suXM+r6ZM46hgY6k
+gYswgYgxCzAJBgNVBAYTAlVTMRIwEAYDVQQIEwlCZXJrc2hpcmUxEDAOBgNVBAcT
+B05ld2J1cnkxFzAVBgNVBAoTDk15IENvbXBhbnkgTHRkMQ0wCwYDVQQLEwR0ZXN0
+MQ0wCwYDVQQDEwR0ZXN0MRwwGgYJKoZIhvcNAQkBFg10ZXN0QHRlc3QuY29tggkA
+5kxcliZe1tAwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOCAQEAZsWzGp9D
+10NWf8ts3A9mhcEb8oDgKNpCOZF9gqr2usZygJjY9MX2n0n81T8XaWDk1wZLlcDW
+hzIalCY8rpE57Dj3MEmdCmYr3BrAy6GVlc/MO7ffTHxogl9ouScSYo8ETTtNMKCg
+zwkDnXjGzmb1e59DIXMVHBBbTmJXJbM8XP9A2azJkVUyE2fSdWksXMP0XklGbW2p
+DksJ+8G1IWkyRhnINV5GZLLNAT5gBA6sUv/iqQKwk8r2dsweMPtLoLWZPAaZErYh
+sthGy00Q0GJkmkJpQl8QIlPq5vylNcMUhvc8tmzwk+rDVUj3jTJWqFwMtnHAaNyC
+FXl9ynWpe5J28w==
+-----END CERTIFICATE-----
diff --git a/src/libnm-core-impl/tests/certs/test_key_and_cert.pem b/src/libnm-core-impl/tests/certs/test_key_and_cert.pem
new file mode 100644
index 00000000..c00495d0
--- /dev/null
+++ b/src/libnm-core-impl/tests/certs/test_key_and_cert.pem
@@ -0,0 +1,119 @@
+-----BEGIN RSA PRIVATE KEY-----
+Proc-Type: 4,ENCRYPTED
+DEK-Info: DES-EDE3-CBC,B29FCA6ECB7C0C48
+
+KuRV4sEVQkY0r0E+E81Se2qpm54HeboUMIJcMVqAt/HIeYwpjEzmXHUywXgayA5k
+r5Uvru95vymFz80q/rl6i4Mt3ckEQ3/VHmBI4pPj/JeRbiDhqTyLqpB5zMgbuti+
+PsEemlbiaCMZFdJk8rJBWADTkirGbXs5ciLwTJyrJXhkBVTqoHtphSWMELxcrnQj
+5bAXZ+rnApWA7LR3yCY1UE0Nj39Yu8lkzDJtbsSXPJVO//OQiGuQRcY6roAUzeS/
+amLdIYqoZm3OF83Ro88XZCIDCG6XjgKoqojtekClVIytB6mHWk+IHhI7DgU/pDBj
+yOskzVRMja9ECnqaVX+bmlmJGZBgcd7+XiebCXNY9IAx/ZQDMbDJDoJusvH6npJR
+PBgag8QBSzwpFyEP/1LrlyVyggZcGuXDWfUiM2rt2UvLm8QYeT5WGfUI+QwW6JRV
+xEz2QwRiPsmj0uK2fXLKHbY0Pv79IMLqgesCAUbndWsi94kjAhpJGa/WfKVb8Dpg
+T+mVa2OT0pgewPWJ3h5f47ag27WDJthsIUHAvNZ03uM23DIqDh6o03/B3/4r1Uab
+HzsLWhUOzbLihO08qcPk/JqtDVCv579mpgvy7bL2ZsZUzefnmg+ah+1bhLguryZu
+Zrt1hTu5WTz27UbYwWNtkxWnWcM9sSF9y+KVwumYhIUGTvg3Jds/jmp/Z5ad8tev
+0RQuWmqnXVD51Y92tOXobJH7JwGbQ4GeRNG/UX7DS9Lvb6rPgmmxvGbXMcjEMapB
+m5DLjCD7Lz4++sfzhCic3/nL8e8fjoYZmCbL/SpYjGjTrfoNaGYaT0De8MxCSjPf
+rNT+ldWFD0oAOTmT0uqOFkeIx3vxczSQUyRfzGOLqtb9mAXk8lvdb8Myb5atfe8f
+FNBL5ocz6Szv2AmKmjZE5P6NKSllyryCYl+H2QU0e3OyY8S9aG2aG8fqeVKaA01S
+uOOjsK6IKMpkit+VFDP7RWvS8p1FTwTVRdbMZzASW8+D98OHsTlOENtQuuFyvNaN
+vPHrbHltTkwDlYVab9UpFr/ZRW3cNJrmcl0hyeCJxk5u8B9UwW6yZmd24hxda2xt
+1QjnxfWlX0i5KTmfWFyPmRYt1WH9rdVaH6wqRbGNbMRT7Lez0E/2+LXjFiiEe0Vh
+ZuryhyhUXpHY8yyHxFY92XT504Z3wPUaJ1tQxGhdziZ7HcqFT8f4oTNJdBNtzqNw
+l63gSTaKUkSB14CBOyR84cqpgSMwZvWZb3RQFYY4GSALWwhnn6PWeRhjWAXPms2v
+tRmfEyDUCyPxDarezvS9kUir3XbvnCkoJOrK/lw4a8ygGBCBqRKOdI0SRUf1Nnjm
+aZBrKrXHv5vP66fyC7cGMTq35+iiHbE//rRDGPrf9vpmw3ki3FlDMyAXOC5yWDco
+0n+cNDyHJDdIW3+3nfZvSgPPMwmTdfNO90X3YczSmMTGjnIuhQMf7FMFmMZOSrqD
+u234vYCjIIlph3aVpbzjOqKg3d4nuP9oouyAgRAr+vShgHRmq0jvsAiGH3Q6RqEj
+DvkM1NgoloMy5RhKF4hIeaQM/UlgoXrcEx0RGCJHykQcQmVa5cf5EwjrO7b+w2Lg
+-----END RSA PRIVATE KEY-----
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+        Signature Algorithm: md5WithRSAEncryption
+        Issuer: C=US, ST=Berkshire, L=Newbury, O=My Company Ltd, OU=test, CN=test/emailAddress=test@test.com
+        Validity
+            Not Before: Feb  2 02:22:25 2009 GMT
+            Not After : Jan 31 02:22:25 2019 GMT
+        Subject: C=US, ST=Berkshire, O=My Company Ltd, OU=test-client, CN=test-client/emailAddress=test-client@test.com
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (2048 bit)
+                Modulus (2048 bit):
+                    00:ce:d2:e9:fb:f4:a4:ce:66:87:cc:8b:2d:d2:c3:
+                    b8:fa:be:ea:53:08:95:9e:27:4a:04:78:31:a1:36:
+                    d2:e5:42:f5:76:f7:24:71:b8:d3:10:fd:b7:57:86:
+                    68:29:02:1b:e9:93:2b:af:c0:7e:3d:58:16:34:10:
+                    25:85:7e:28:2d:42:fc:34:7f:d6:4f:0a:e7:b6:b9:
+                    40:51:c8:e5:89:60:cd:73:51:63:67:e1:59:36:31:
+                    5e:d0:87:4b:5d:97:8a:42:22:d3:42:f2:83:62:79:
+                    84:45:5b:d8:20:97:e2:d1:34:23:5e:ec:bf:8a:41:
+                    7c:ad:80:50:f3:9b:1c:51:5d:e4:29:1c:c1:c6:7c:
+                    a1:00:70:0f:f6:79:77:03:22:f5:4b:ab:76:ca:20:
+                    ab:e1:4e:53:6c:86:68:e9:d6:0f:6e:95:4b:b5:b5:
+                    cf:d3:6c:d4:73:db:c0:3d:1d:20:20:72:ab:3e:25:
+                    bb:3f:cd:5f:2d:77:fd:d7:0b:a8:eb:0c:73:c0:3f:
+                    74:27:17:56:cf:31:9a:a9:ed:c1:39:27:c7:aa:e9:
+                    77:48:f4:6d:56:89:35:5c:79:5b:f6:2f:8c:9f:93:
+                    bc:13:1c:d0:74:5f:30:1b:15:43:71:8e:ff:1a:df:
+                    65:65:69:c2:8a:5a:ab:04:4a:80:de:20:29:8d:48:
+                    1c:83
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Comment: 
+                OpenSSL Generated Certificate
+            X509v3 Subject Key Identifier: 
+                34:E9:5C:D8:FC:C7:AF:F7:5D:F4:13:D3:82:1A:CD:52:0F:4A:BB:0B
+            X509v3 Authority Key Identifier: 
+                keyid:52:33:2E:22:66:79:82:E5:41:2E:8D:3B:B2:E5:CC:FA:BE:99:33:8E
+                DirName:/C=US/ST=Berkshire/L=Newbury/O=My Company Ltd/OU=test/CN=test/emailAddress=test@test.com
+                serial:E6:4C:5C:96:26:5E:D6:D0
+
+    Signature Algorithm: md5WithRSAEncryption
+        88:c4:dd:c5:4a:a6:8e:1f:36:62:80:31:6b:2b:85:34:0d:6c:
+        a7:dc:e1:5a:3c:dd:74:57:db:59:be:8b:f2:79:40:2d:bd:9b:
+        e1:ab:0e:03:75:20:75:2f:ea:97:f9:d4:7e:15:75:c2:82:f5:
+        b1:37:e4:8b:24:d4:ef:02:3b:19:6a:56:bb:9f:c3:a5:b4:c4:
+        39:a0:64:96:5b:c3:a8:19:74:ec:0b:cf:33:df:f3:12:f3:e2:
+        ab:1d:7d:de:21:64:cd:b1:a0:6f:7a:77:84:d4:62:8a:50:e6:
+        76:5d:af:3a:ef:1a:87:0e:1a:38:c4:f9:0d:2f:14:e0:20:32:
+        4c:2e:70:d2:71:82:d5:e5:c9:13:2c:4e:b4:c8:63:65:1d:48:
+        e8:c3:56:6d:88:84:57:65:13:1e:42:48:b4:03:25:71:4e:12:
+        9d:1a:88:65:d5:71:21:3b:0e:be:37:1c:f0:88:6b:45:0c:0e:
+        6c:e5:60:cb:86:bf:bf:40:30:c4:cf:94:f8:1c:60:d4:1b:df:
+        88:02:7a:45:7e:d1:c6:f3:07:b9:b1:8f:2a:55:2f:be:77:9f:
+        d1:46:64:05:b7:67:c5:b2:ac:8c:42:8f:6a:51:a4:0d:2b:16:
+        a4:d6:39:a5:f8:25:ed:68:25:13:b5:19:ac:6c:e9:ec:ee:03:
+        6b:80:38:6e
+-----BEGIN CERTIFICATE-----
+MIIErjCCA5agAwIBAgIBATANBgkqhkiG9w0BAQQFADCBiDELMAkGA1UEBhMCVVMx
+EjAQBgNVBAgTCUJlcmtzaGlyZTEQMA4GA1UEBxMHTmV3YnVyeTEXMBUGA1UEChMO
+TXkgQ29tcGFueSBMdGQxDTALBgNVBAsTBHRlc3QxDTALBgNVBAMTBHRlc3QxHDAa
+BgkqhkiG9w0BCQEWDXRlc3RAdGVzdC5jb20wHhcNMDkwMjAyMDIyMjI1WhcNMTkw
+MTMxMDIyMjI1WjCBizELMAkGA1UEBhMCVVMxEjAQBgNVBAgTCUJlcmtzaGlyZTEX
+MBUGA1UEChMOTXkgQ29tcGFueSBMdGQxFDASBgNVBAsTC3Rlc3QtY2xpZW50MRQw
+EgYDVQQDEwt0ZXN0LWNsaWVudDEjMCEGCSqGSIb3DQEJARYUdGVzdC1jbGllbnRA
+dGVzdC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDO0un79KTO
+ZofMiy3Sw7j6vupTCJWeJ0oEeDGhNtLlQvV29yRxuNMQ/bdXhmgpAhvpkyuvwH49
+WBY0ECWFfigtQvw0f9ZPCue2uUBRyOWJYM1zUWNn4Vk2MV7Qh0tdl4pCItNC8oNi
+eYRFW9ggl+LRNCNe7L+KQXytgFDzmxxRXeQpHMHGfKEAcA/2eXcDIvVLq3bKIKvh
+TlNshmjp1g9ulUu1tc/TbNRz28A9HSAgcqs+Jbs/zV8td/3XC6jrDHPAP3QnF1bP
+MZqp7cE5J8eq6XdI9G1WiTVceVv2L4yfk7wTHNB0XzAbFUNxjv8a32VlacKKWqsE
+SoDeICmNSByDAgMBAAGjggEcMIIBGDAJBgNVHRMEAjAAMCwGCWCGSAGG+EIBDQQf
+Fh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUNOlc2PzH
+r/dd9BPTghrNUg9Kuwswgb0GA1UdIwSBtTCBsoAUUjMuImZ5guVBLo07suXM+r6Z
+M46hgY6kgYswgYgxCzAJBgNVBAYTAlVTMRIwEAYDVQQIEwlCZXJrc2hpcmUxEDAO
+BgNVBAcTB05ld2J1cnkxFzAVBgNVBAoTDk15IENvbXBhbnkgTHRkMQ0wCwYDVQQL
+EwR0ZXN0MQ0wCwYDVQQDEwR0ZXN0MRwwGgYJKoZIhvcNAQkBFg10ZXN0QHRlc3Qu
+Y29tggkA5kxcliZe1tAwDQYJKoZIhvcNAQEEBQADggEBAIjE3cVKpo4fNmKAMWsr
+hTQNbKfc4Vo83XRX21m+i/J5QC29m+GrDgN1IHUv6pf51H4VdcKC9bE35Isk1O8C
+OxlqVrufw6W0xDmgZJZbw6gZdOwLzzPf8xLz4qsdfd4hZM2xoG96d4TUYopQ5nZd
+rzrvGocOGjjE+Q0vFOAgMkwucNJxgtXlyRMsTrTIY2UdSOjDVm2IhFdlEx5CSLQD
+JXFOEp0aiGXVcSE7Dr43HPCIa0UMDmzlYMuGv79AMMTPlPgcYNQb34gCekV+0cbz
+B7mxjypVL753n9FGZAW3Z8WyrIxCj2pRpA0rFqTWOaX4Je1oJRO1Gaxs6ezuA2uA
+OG4=
+-----END CERTIFICATE-----
diff --git a/src/libnm-core-impl/tests/meson.build b/src/libnm-core-impl/tests/meson.build
new file mode 100644
index 00000000..988c60db
--- /dev/null
+++ b/src/libnm-core-impl/tests/meson.build
@@ -0,0 +1,49 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+enum_sources = gnome.mkenums_simple(
+  'nm-core-tests-enum-types',
+  sources: 'test-general-enums.h',
+  identifier_prefix: nm_id_prefix,
+  body_prefix: '#include "libnm-core-impl/nm-default-libnm-core.h"',
+)
+
+test_units = [
+  'test-compare',
+  'test-crypto',
+  'test-general',
+  'test-keyfile',
+  'test-secrets',
+  'test-setting',
+  'test-settings-defaults',
+]
+
+foreach test_unit: test_units
+  exe = executable(
+    'libnm-core-' + test_unit,
+    [test_unit + '.c'] + enum_sources,
+    include_directories: [
+      libnm_core_impl_inc,
+    ],
+    dependencies: [
+      libnm_core_public_dep,
+    ],
+    link_with: [
+      libnm_core_aux_intern,
+      libnm_core_impl,
+      libnm_crypto,
+      libnm_base,
+      libnm_systemd_shared,
+      libnm_log_null,
+      libnm_glib_aux,
+      libnm_std_aux,
+      libc_siphash,
+    ],
+  )
+
+  test(
+    'src/libnm-core-impl/tests/' + test_unit,
+    test_script,
+    args: test_args + [exe.full_path()],
+    timeout: default_test_timeout,
+  )
+endforeach
diff --git a/src/libnm-core-impl/tests/nm-core-tests-enum-types.c.template b/src/libnm-core-impl/tests/nm-core-tests-enum-types.c.template
new file mode 100644
index 00000000..1160be86
--- /dev/null
+++ b/src/libnm-core-impl/tests/nm-core-tests-enum-types.c.template
@@ -0,0 +1,35 @@
+/*** BEGIN file-header ***/
+#include "config.h"
+
+#include "nm-core-tests-enum-types.h"
+
+#include "test-general-enums.h"
+/*** END file-header ***/
+
+/*** BEGIN value-header ***/
+GType
+@enum_name@_get_type (void)
+{
+  static volatile gsize g_define_type_id__volatile = 0;
+
+  if (g_once_init_enter (&g_define_type_id__volatile))
+    {
+      static const G@Type@Value values[] = {
+/*** END value-header ***/
+
+/*** BEGIN value-production ***/
+        { @VALUENAME@, "@VALUENAME@", "@valuenick@" },
+/*** END value-production ***/
+
+/*** BEGIN value-tail ***/
+        { 0, NULL, NULL }
+      };
+      GType g_define_type_id =
+        g_@type@_register_static (g_intern_static_string ("@EnumName@"), values);
+      g_once_init_leave (&g_define_type_id__volatile, g_define_type_id);
+    }
+
+  return g_define_type_id__volatile;
+}
+
+/*** END value-tail ***/
diff --git a/src/libnm-core-impl/tests/nm-core-tests-enum-types.h.template b/src/libnm-core-impl/tests/nm-core-tests-enum-types.h.template
new file mode 100644
index 00000000..62e82b77
--- /dev/null
+++ b/src/libnm-core-impl/tests/nm-core-tests-enum-types.h.template
@@ -0,0 +1,21 @@
+/*** BEGIN file-header ***/
+#ifndef __NM_CORE_TESTS_ENUM_TYPES_H__
+#define __NM_CORE_TESTS_ENUM_TYPES_H__
+
+#include <glib-object.h>
+
+G_BEGIN_DECLS
+
+/*** END file-header ***/
+
+/*** BEGIN enumeration-production ***/
+GType @enum_name@_get_type (void) G_GNUC_CONST;
+#define @ENUMPREFIX@_TYPE_@ENUMSHORT@ (@enum_name@_get_type ())
+
+/*** END enumeration-production ***/
+
+/*** BEGIN file-tail ***/
+G_END_DECLS
+
+#endif /* __NM_CORE_TESTS_ENUM_TYPES_H__ */
+/*** END file-tail ***/
diff --git a/src/libnm-core-impl/tests/test-compare.c b/src/libnm-core-impl/tests/test-compare.c
new file mode 100644
index 00000000..3716399a
--- /dev/null
+++ b/src/libnm-core-impl/tests/test-compare.c
@@ -0,0 +1,231 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+/*
+ * Copyright (C) 2007 - 2014 Red Hat, Inc.
+ * Copyright (C) 2007 - 2008 Novell, Inc.
+ */
+
+#include "libnm-core-impl/nm-default-libnm-core.h"
+
+#include <arpa/inet.h>
+#include <netinet/in.h>
+
+#include "nm-property-compare.h"
+
+#include "libnm-glib-aux/nm-test-utils.h"
+
+static void
+compare_ints(void)
+{
+    GVariant *value1, *value2;
+
+    value1 = g_variant_new_int32(5);
+    value2 = g_variant_new_int32(5);
+    g_assert(nm_property_compare(value1, value2) == 0);
+
+    g_variant_unref(value2);
+    value2 = g_variant_new_int32(10);
+    g_assert(nm_property_compare(value1, value2) < 0);
+
+    g_variant_unref(value2);
+    value2 = g_variant_new_int32(-1);
+    g_assert(nm_property_compare(value1, value2) > 0);
+
+    g_variant_unref(value1);
+    g_variant_unref(value2);
+}
+
+static void
+compare_strings(void)
+{
+    GVariant *  value1, *value2;
+    const char *str1 = "hello";
+    const char *str2 = "world";
+
+    value1 = g_variant_new_string(str1);
+    value2 = g_variant_new_string(str1);
+    g_assert(nm_property_compare(value1, value2) == 0);
+
+    g_variant_unref(value2);
+    value2 = g_variant_new_string(str2);
+    g_assert(nm_property_compare(value1, value2) < 0);
+
+    g_assert(nm_property_compare(value2, value1) > 0);
+
+    g_variant_unref(value1);
+    g_variant_unref(value2);
+}
+
+static void
+compare_strv(void)
+{
+    GVariant *        value1, *value2;
+    const char *const strv1[] = {"foo", "bar", "baz", NULL};
+    const char *const strv2[] = {"foo", "bar", "bar", NULL};
+    const char *const strv3[] = {"foo", "bar", NULL};
+    const char *const strv4[] = {"foo", "bar", "baz", "bam", NULL};
+
+    value1 = g_variant_new_strv(strv1, -1);
+    value2 = g_variant_new_strv(strv1, -1);
+    g_assert(nm_property_compare(value1, value2) == 0);
+
+    g_variant_unref(value2);
+    value2 = g_variant_new_strv(strv2, -1);
+    g_assert(nm_property_compare(value1, value2) != 0);
+
+    g_variant_unref(value2);
+    value2 = g_variant_new_strv(strv3, -1);
+    g_assert(nm_property_compare(value1, value2) != 0);
+
+    g_variant_unref(value2);
+    value2 = g_variant_new_strv(strv4, -1);
+    g_assert(nm_property_compare(value1, value2) != 0);
+
+    g_variant_unref(value1);
+    g_variant_unref(value2);
+}
+
+static void
+compare_arrays(void)
+{
+    GVariant *value1, *value2;
+    guint32   array[] = {0, 1, 2, 3, 4};
+
+    value1 = g_variant_new_fixed_array(G_VARIANT_TYPE_UINT32,
+                                       array,
+                                       G_N_ELEMENTS(array),
+                                       sizeof(guint32));
+    value2 = g_variant_new_fixed_array(G_VARIANT_TYPE_UINT32,
+                                       array,
+                                       G_N_ELEMENTS(array),
+                                       sizeof(guint32));
+
+    g_assert(nm_property_compare(value1, value2) == 0);
+
+    g_variant_unref(value2);
+    value2 = g_variant_new_fixed_array(G_VARIANT_TYPE_UINT32,
+                                       array + 1,
+                                       G_N_ELEMENTS(array) - 1,
+                                       sizeof(guint32));
+    g_assert(nm_property_compare(value1, value2) != 0);
+
+    array[0] = 7;
+    g_variant_unref(value2);
+    value2 = g_variant_new_fixed_array(G_VARIANT_TYPE_UINT32,
+                                       array,
+                                       G_N_ELEMENTS(array),
+                                       sizeof(guint32));
+    g_assert(nm_property_compare(value1, value2) != 0);
+
+    g_variant_unref(value1);
+    g_variant_unref(value2);
+}
+
+static void
+compare_str_hash(void)
+{
+    GVariant *      value1, *value2;
+    GVariantBuilder builder;
+
+    g_variant_builder_init(&builder, G_VARIANT_TYPE("a{ss}"));
+    g_variant_builder_add(&builder, "{ss}", "key1", "hello");
+    g_variant_builder_add(&builder, "{ss}", "key2", "world");
+    g_variant_builder_add(&builder, "{ss}", "key3", "!");
+    value1 = g_variant_builder_end(&builder);
+
+    g_variant_builder_init(&builder, G_VARIANT_TYPE("a{ss}"));
+    g_variant_builder_add(&builder, "{ss}", "key3", "!");
+    g_variant_builder_add(&builder, "{ss}", "key2", "world");
+    g_variant_builder_add(&builder, "{ss}", "key1", "hello");
+    value2 = g_variant_builder_end(&builder);
+
+    g_assert(nm_property_compare(value1, value2) == 0);
+
+    g_variant_unref(value2);
+    g_variant_builder_init(&builder, G_VARIANT_TYPE("a{ss}"));
+    g_variant_builder_add(&builder, "{ss}", "key1", "hello");
+    g_variant_builder_add(&builder, "{ss}", "key3", "!");
+    value2 = g_variant_builder_end(&builder);
+
+    g_assert(nm_property_compare(value1, value2) != 0);
+    g_assert(nm_property_compare(value2, value1) != 0);
+
+    g_variant_unref(value2);
+    g_variant_builder_init(&builder, G_VARIANT_TYPE("a{ss}"));
+    g_variant_builder_add(&builder, "{ss}", "key1", "hello");
+    g_variant_builder_add(&builder, "{ss}", "key2", "moon");
+    g_variant_builder_add(&builder, "{ss}", "key3", "!");
+    value2 = g_variant_builder_end(&builder);
+
+    g_assert(nm_property_compare(value1, value2) != 0);
+
+    g_variant_unref(value1);
+    g_variant_unref(value2);
+}
+
+static void
+compare_ip6_addresses(void)
+{
+    GVariant *      value1, *value2;
+    struct in6_addr addr1;
+    struct in6_addr addr2;
+    struct in6_addr addr3;
+    guint32         prefix1 = 64;
+    guint32         prefix2 = 64;
+    guint32         prefix3 = 0;
+
+    inet_pton(AF_INET6, "1:2:3:4:5:6:7:8", &addr1);
+    inet_pton(AF_INET6, "ffff:2:3:4:5:6:7:8", &addr2);
+    inet_pton(AF_INET6, "::", &addr3);
+
+    value1 = g_variant_new(
+        "(@ayu@ay)",
+        g_variant_new_fixed_array(G_VARIANT_TYPE_BYTE, (guint8 *) addr1.s6_addr, 16, 1),
+        prefix1,
+        g_variant_new_fixed_array(G_VARIANT_TYPE_BYTE, (guint8 *) addr3.s6_addr, 16, 1));
+
+    value2 = g_variant_new(
+        "(@ayu@ay)",
+        g_variant_new_fixed_array(G_VARIANT_TYPE_BYTE, (guint8 *) addr1.s6_addr, 16, 1),
+        prefix1,
+        g_variant_new_fixed_array(G_VARIANT_TYPE_BYTE, (guint8 *) addr3.s6_addr, 16, 1));
+
+    g_assert(nm_property_compare(value1, value2) == 0);
+
+    g_variant_unref(value2);
+    value2 = g_variant_new(
+        "(@ayu@ay)",
+        g_variant_new_fixed_array(G_VARIANT_TYPE_BYTE, (guint8 *) addr2.s6_addr, 16, 1),
+        prefix2,
+        g_variant_new_fixed_array(G_VARIANT_TYPE_BYTE, (guint8 *) addr3.s6_addr, 16, 1));
+
+    g_assert(nm_property_compare(value1, value2) != 0);
+
+    g_variant_unref(value2);
+    value2 = g_variant_new(
+        "(@ayu@ay)",
+        g_variant_new_fixed_array(G_VARIANT_TYPE_BYTE, (guint8 *) addr3.s6_addr, 16, 1),
+        prefix3,
+        g_variant_new_fixed_array(G_VARIANT_TYPE_BYTE, (guint8 *) addr3.s6_addr, 16, 1));
+
+    g_assert(nm_property_compare(value1, value2) != 0);
+
+    g_variant_unref(value1);
+    g_variant_unref(value2);
+}
+
+NMTST_DEFINE();
+
+int
+main(int argc, char *argv[])
+{
+    nmtst_init(&argc, &argv, TRUE);
+
+    g_test_add_func("/libnm/compare/ints", compare_ints);
+    g_test_add_func("/libnm/compare/strings", compare_strings);
+    g_test_add_func("/libnm/compare/strv", compare_strv);
+    g_test_add_func("/libnm/compare/arrays", compare_arrays);
+    g_test_add_func("/libnm/compare/str_hash", compare_str_hash);
+    g_test_add_func("/libnm/compare/ip6_addresses", compare_ip6_addresses);
+
+    return g_test_run();
+}
diff --git a/src/libnm-core-impl/tests/test-crypto.c b/src/libnm-core-impl/tests/test-crypto.c
new file mode 100644
index 00000000..bdbcd0f3
--- /dev/null
+++ b/src/libnm-core-impl/tests/test-crypto.c
@@ -0,0 +1,455 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+/*
+ * Dan Williams <dcbw@redhat.com>
+ * Copyright (C) 2007 - 2011 Red Hat, Inc.
+ */
+
+#include "libnm-core-impl/nm-default-libnm-core.h"
+
+#include <unistd.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+#include "nm-crypto-impl.h"
+#include "nm-utils.h"
+#include "nm-errors.h"
+#include "libnm-core-intern/nm-core-internal.h"
+
+#include "libnm-glib-aux/nm-test-utils.h"
+
+#define TEST_CERT_DIR NM_BUILD_SRCDIR "/src/libnm-core-impl/tests/certs"
+
+#if 0
+static const char *pem_rsa_key_begin = "-----BEGIN RSA PRIVATE KEY-----";
+static const char *pem_rsa_key_end = "-----END RSA PRIVATE KEY-----";
+
+static const char *pem_dsa_key_begin = "-----BEGIN DSA PRIVATE KEY-----";
+static const char *pem_dsa_key_end = "-----END DSA PRIVATE KEY-----";
+
+static void
+dump_key_to_pem (const char *key, gsize key_len, int key_type)
+{
+    char *b64 = NULL;
+    GString *str = NULL;
+    const char *start_tag;
+    const char *end_tag;
+    char *p;
+
+    switch (key_type) {
+    case NM_CRYPTO_KEY_TYPE_RSA:
+        start_tag = pem_rsa_key_begin;
+        end_tag = pem_rsa_key_end;
+        break;
+    case NM_CRYPTO_KEY_TYPE_DSA:
+        start_tag = pem_dsa_key_begin;
+        end_tag = pem_dsa_key_end;
+        break;
+    default:
+        g_warning ("Unknown key type %d", key_type);
+        return;
+    }
+
+    b64 = g_base64_encode ((const unsigned char *) key, key_len);
+    if (!b64) {
+        g_warning ("Couldn't base64 encode the key.");
+        goto out;
+    }
+
+    str = g_string_new (NULL);
+
+    g_string_append (str, start_tag);
+    g_string_append_c (str, '\n');
+
+    for (p = b64; p < (b64 + strlen (b64)); p += 64) {
+        g_string_append_len (str, p, strnlen (p, 64));
+        g_string_append_c (str, '\n');
+    }
+
+    g_string_append (str, end_tag);
+    g_string_append_c (str, '\n');
+
+    g_message ("Decrypted private key:\n\n%s", str->str);
+
+out:
+    g_free (b64);
+    if (str)
+        g_string_free (str, TRUE);
+}
+#endif
+
+static void
+test_cert(gconstpointer test_data)
+{
+    gs_free char * path           = NULL;
+    gs_unref_bytes GBytes *cert   = NULL;
+    NMCryptoFileFormat     format = NM_CRYPTO_FILE_FORMAT_UNKNOWN;
+    GError *               error  = NULL;
+    gboolean               success;
+
+    path = g_build_filename(TEST_CERT_DIR, (const char *) test_data, NULL);
+
+    success = nm_crypto_load_and_verify_certificate(path, &format, &cert, &error);
+    nmtst_assert_success(success, error);
+    g_assert_cmpint(format, ==, NM_CRYPTO_FILE_FORMAT_X509);
+
+    g_assert(nm_utils_file_is_certificate(path));
+}
+
+static void
+test_load_private_key(const char *path,
+                      const char *password,
+                      const char *decrypted_path,
+                      int         expected_error)
+{
+    NMCryptoKeyType key_type     = NM_CRYPTO_KEY_TYPE_UNKNOWN;
+    gboolean        is_encrypted = FALSE;
+    gs_unref_bytes GBytes *array = NULL;
+    GError *               error = NULL;
+
+    g_assert(nm_utils_file_is_private_key(path, &is_encrypted));
+    g_assert(is_encrypted);
+
+    array = nmtst_crypto_decrypt_openssl_private_key(path, password, &key_type, &error);
+    /* Even if the password is wrong, we should determine the key type */
+    g_assert_cmpint(key_type, ==, NM_CRYPTO_KEY_TYPE_RSA);
+
+    if (expected_error != -1) {
+        g_assert(array == NULL);
+        g_assert_error(error, NM_CRYPTO_ERROR, expected_error);
+        g_clear_error(&error);
+        return;
+    }
+
+    if (password == NULL) {
+        g_assert(array == NULL);
+        g_assert_no_error(error);
+        return;
+    }
+
+    g_assert(array != NULL);
+
+    if (decrypted_path) {
+        gs_free char *contents = NULL;
+        gsize         length;
+
+        /* Compare the crypto decrypted key against a known-good decryption */
+        if (!g_file_get_contents(decrypted_path, &contents, &length, NULL))
+            g_assert_not_reached();
+        g_assert(nm_utils_gbytes_equal_mem(array, contents, length));
+    }
+}
+
+static void
+test_load_pkcs12(const char *path, const char *password, int expected_error)
+{
+    NMCryptoFileFormat format       = NM_CRYPTO_FILE_FORMAT_UNKNOWN;
+    gboolean           is_encrypted = FALSE;
+    GError *           error        = NULL;
+
+    g_assert(nm_utils_file_is_private_key(path, NULL));
+
+    format = nm_crypto_verify_private_key(path, password, &is_encrypted, &error);
+    if (expected_error != -1) {
+        g_assert_error(error, NM_CRYPTO_ERROR, expected_error);
+        g_assert_cmpint(format, ==, NM_CRYPTO_FILE_FORMAT_UNKNOWN);
+        g_clear_error(&error);
+    } else {
+        g_assert_no_error(error);
+        g_assert_cmpint(format, ==, NM_CRYPTO_FILE_FORMAT_PKCS12);
+        g_assert(is_encrypted);
+    }
+}
+
+static void
+test_load_pkcs12_no_password(const char *path)
+{
+    NMCryptoFileFormat format       = NM_CRYPTO_FILE_FORMAT_UNKNOWN;
+    gboolean           is_encrypted = FALSE;
+    GError *           error        = NULL;
+
+    g_assert(nm_utils_file_is_private_key(path, NULL));
+
+    /* We should still get a valid returned crypto file format */
+    format = nm_crypto_verify_private_key(path, NULL, &is_encrypted, &error);
+    g_assert_no_error(error);
+    g_assert_cmpint(format, ==, NM_CRYPTO_FILE_FORMAT_PKCS12);
+    g_assert(is_encrypted);
+}
+
+static void
+test_is_pkcs12(const char *path, gboolean expect_fail)
+{
+    gboolean is_pkcs12;
+    GError * error = NULL;
+
+    is_pkcs12 = nm_crypto_is_pkcs12_file(path, &error);
+
+    if (expect_fail) {
+        g_assert_error(error, NM_CRYPTO_ERROR, NM_CRYPTO_ERROR_INVALID_DATA);
+        g_assert(!is_pkcs12);
+        g_clear_error(&error);
+    } else {
+        g_assert_no_error(error);
+        g_assert(is_pkcs12);
+    }
+}
+
+static void
+test_load_pkcs8(const char *path, const char *password, int expected_error)
+{
+    NMCryptoFileFormat format       = NM_CRYPTO_FILE_FORMAT_UNKNOWN;
+    gboolean           is_encrypted = FALSE;
+    GError *           error        = NULL;
+
+    g_assert(nm_utils_file_is_private_key(path, NULL));
+
+    format = nm_crypto_verify_private_key(path, password, &is_encrypted, &error);
+    if (expected_error != -1) {
+        g_assert_error(error, NM_CRYPTO_ERROR, expected_error);
+        g_assert_cmpint(format, ==, NM_CRYPTO_FILE_FORMAT_UNKNOWN);
+        g_clear_error(&error);
+    } else {
+        g_assert_no_error(error);
+        g_assert_cmpint(format, ==, NM_CRYPTO_FILE_FORMAT_RAW_KEY);
+        g_assert(is_encrypted);
+    }
+}
+
+static void
+test_encrypt_private_key(const char *path, const char *password)
+{
+    NMCryptoKeyType key_type            = NM_CRYPTO_KEY_TYPE_UNKNOWN;
+    gs_unref_bytes GBytes *array        = NULL;
+    gs_unref_bytes GBytes *encrypted    = NULL;
+    gs_unref_bytes GBytes *re_decrypted = NULL;
+    GError *               error        = NULL;
+
+    array = nmtst_crypto_decrypt_openssl_private_key(path, password, &key_type, &error);
+    nmtst_assert_success(array, error);
+    g_assert_cmpint(key_type, ==, NM_CRYPTO_KEY_TYPE_RSA);
+
+    /* Now re-encrypt the private key */
+    encrypted = nmtst_crypto_rsa_key_encrypt(g_bytes_get_data(array, NULL),
+                                             g_bytes_get_size(array),
+                                             password,
+                                             NULL,
+                                             &error);
+    nmtst_assert_success(encrypted, error);
+
+    /* Then re-decrypt the private key */
+    key_type     = NM_CRYPTO_KEY_TYPE_UNKNOWN;
+    re_decrypted = nmtst_crypto_decrypt_openssl_private_key_data(g_bytes_get_data(encrypted, NULL),
+                                                                 g_bytes_get_size(encrypted),
+                                                                 password,
+                                                                 &key_type,
+                                                                 &error);
+    nmtst_assert_success(re_decrypted, error);
+    g_assert_cmpint(key_type, ==, NM_CRYPTO_KEY_TYPE_RSA);
+
+    /* Compare the original decrypted key with the re-decrypted key */
+    g_assert(g_bytes_equal(array, re_decrypted));
+}
+
+static void
+test_key(gconstpointer test_data)
+{
+    char **parts, *path, *password, *decrypted_path;
+    int    len;
+
+    parts = g_strsplit((const char *) test_data, ", ", -1);
+    len   = g_strv_length(parts);
+    if (len != 2 && len != 3)
+        g_error("wrong number of arguments (<key file>, <password>, [<decrypted key file>])");
+
+    path           = g_build_filename(TEST_CERT_DIR, parts[0], NULL);
+    password       = parts[1];
+    decrypted_path = parts[2] ? g_build_filename(TEST_CERT_DIR, parts[2], NULL) : NULL;
+
+    test_is_pkcs12(path, TRUE);
+    test_load_private_key(path, password, decrypted_path, -1);
+    test_load_private_key(path, "blahblahblah", NULL, NM_CRYPTO_ERROR_DECRYPTION_FAILED);
+    test_load_private_key(path, NULL, NULL, -1);
+    test_encrypt_private_key(path, password);
+
+    g_free(path);
+    g_free(decrypted_path);
+    g_strfreev(parts);
+}
+
+static void
+test_key_decrypted(gconstpointer test_data)
+{
+    const char *file         = (const char *) test_data;
+    gboolean    is_encrypted = FALSE;
+    char *      path;
+
+    path = g_build_filename(TEST_CERT_DIR, file, NULL);
+
+    g_assert(nm_utils_file_is_private_key(path, &is_encrypted));
+    g_assert(!is_encrypted);
+
+    g_free(path);
+}
+
+static void
+test_pkcs12(gconstpointer test_data)
+{
+    char **parts, *path, *password;
+
+    parts = g_strsplit((const char *) test_data, ", ", -1);
+    if (g_strv_length(parts) != 2)
+        g_error("wrong number of arguments (<file>, <password>)");
+
+    path     = g_build_filename(TEST_CERT_DIR, parts[0], NULL);
+    password = parts[1];
+
+    test_is_pkcs12(path, FALSE);
+    test_load_pkcs12(path, password, -1);
+    test_load_pkcs12(path, "blahblahblah", NM_CRYPTO_ERROR_DECRYPTION_FAILED);
+    test_load_pkcs12_no_password(path);
+
+    g_free(path);
+    g_strfreev(parts);
+}
+
+static void
+test_pkcs8(gconstpointer test_data)
+{
+    char **parts, *path, *password;
+
+    parts = g_strsplit((const char *) test_data, ", ", -1);
+    if (g_strv_length(parts) != 2)
+        g_error("wrong number of arguments (<file>, <password>)");
+
+    path     = g_build_filename(TEST_CERT_DIR, parts[0], NULL);
+    password = parts[1];
+
+    test_is_pkcs12(path, TRUE);
+    /* Note: NSS and gnutls < 3.5.4 don't support all the ciphers that openssl
+     * can use with PKCS#8 and thus the password can't be actually verified with
+     * such libraries.
+     */
+    test_load_pkcs8(path, password, -1);
+
+    g_free(path);
+    g_strfreev(parts);
+}
+
+#define SALT           "sodium chloride"
+#define SHORT_PASSWORD "short"
+#define LONG_PASSWORD  "this is a longer password than the short one"
+#define SHORT_DIGEST   16
+#define LONG_DIGEST    57
+
+struct {
+    const char *salt, *password;
+    gsize       digest_size;
+    const char *result;
+} md5_tests[] = {
+    {NULL, SHORT_PASSWORD, SHORT_DIGEST, "4f09daa9d95bcb166a302407a0e0babe"},
+    {NULL,
+     SHORT_PASSWORD,
+     LONG_DIGEST,
+     "4f09daa9d95bcb166a302407a0e0babeb7d62e5baf706830d007c253f0fe7584ad7e92dc00a599ec277293c298ae7"
+     "0ee3904c348e23be61c91"},
+    {SALT, SHORT_PASSWORD, SHORT_DIGEST, "774771f7292210233b5724991d1f9894"},
+    {SALT,
+     SHORT_PASSWORD,
+     LONG_DIGEST,
+     "774771f7292210233b5724991d1f98941a6ffdb45e4dc7fa04b1fa6aceed379c1ade0577bc8f261d109942ed57369"
+     "21c052664d72e0d5bade9"},
+    {NULL, LONG_PASSWORD, SHORT_DIGEST, "e9c03517f81ff29bb777dac21fb1699c"},
+    {NULL,
+     LONG_PASSWORD,
+     LONG_DIGEST,
+     "e9c03517f81ff29bb777dac21fb1699c50968c7ccd8db4f0a59d00ffd87b05876d45f25a927d51a8400c35af60fbd"
+     "64584349a8b7435d62fd9"},
+    {SALT, LONG_PASSWORD, SHORT_DIGEST, "4e5c076e2f85f5e03994acbf3a9e10d6"},
+    {SALT,
+     LONG_PASSWORD,
+     LONG_DIGEST,
+     "4e5c076e2f85f5e03994acbf3a9e10d61a6969c9fdf47ae8b1f7e2725b3767b05cc974bfcb5344b630c91761e015e"
+     "09d7794b5065662533bc9"},
+    {NULL, "", SHORT_DIGEST, "d41d8cd98f00b204e9800998ecf8427e"},
+    {SALT, "", SHORT_DIGEST, "7df1e0494c977195005d82a1809685e4"},
+};
+
+static void
+test_md5(void)
+{
+    char digest[LONG_DIGEST], *hex;
+    int  i;
+
+    for (i = 0; i < G_N_ELEMENTS(md5_tests); i++) {
+        memset(digest, 0, sizeof(digest));
+        nm_crypto_md5_hash((const guint8 *) md5_tests[i].salt,
+                           /* nm_crypto_md5_hash() used to clamp salt_len to 8.  It
+                            * doesn't any more, so we need to do it here now to
+                            * get output that matches md5_tests[i].result.
+                            */
+                           md5_tests[i].salt ? 8 : 0,
+                           (const guint8 *) md5_tests[i].password,
+                           strlen(md5_tests[i].password),
+                           (guint8 *) digest,
+                           md5_tests[i].digest_size);
+
+        hex = nm_utils_bin2hexstr(digest, md5_tests[i].digest_size, -1);
+        g_assert_cmpstr(hex, ==, md5_tests[i].result);
+        g_free(hex);
+    }
+}
+
+NMTST_DEFINE();
+
+int
+main(int argc, char **argv)
+{
+    GError * error = NULL;
+    gboolean success;
+    int      ret;
+
+    nmtst_init(&argc, &argv, TRUE);
+
+    success = _nm_crypto_init(&error);
+    g_assert_no_error(error);
+    g_assert(success);
+
+    g_test_add_data_func("/libnm/crypto/cert/pem", "test_ca_cert.pem", test_cert);
+    g_test_add_data_func("/libnm/crypto/cert/pem-2", "test2_ca_cert.pem", test_cert);
+    g_test_add_data_func("/libnm/crypto/cert/der", "test_ca_cert.der", test_cert);
+    g_test_add_data_func("/libnm/crypto/cert/pem-no-ending-newline",
+                         "ca-no-ending-newline.pem",
+                         test_cert);
+    g_test_add_data_func("/libnm/crypto/cert/pem-combined", "test_key_and_cert.pem", test_cert);
+    g_test_add_data_func("/libnm/crypto/cert/pem-combined-2", "test2_key_and_cert.pem", test_cert);
+
+    g_test_add_data_func("/libnm/crypto/key/padding-6",
+                         "test_key_and_cert.pem, test, test-key-only-decrypted.der",
+                         test_key);
+    g_test_add_data_func("/libnm/crypto/key/key-only",
+                         "test-key-only.pem, test, test-key-only-decrypted.der",
+                         test_key);
+    g_test_add_data_func("/libnm/crypto/key/padding-8",
+                         "test2_key_and_cert.pem, 12345testing",
+                         test_key);
+    g_test_add_data_func("/libnm/crypto/key/aes-128",
+                         "test-aes-128-key.pem, test-aes-password",
+                         test_key);
+    g_test_add_data_func("/libnm/crypto/key/aes-256",
+                         "test-aes-256-key.pem, test-aes-password",
+                         test_key);
+    g_test_add_data_func("/libnm/crypto/key/decrypted",
+                         "test-key-only-decrypted.pem",
+                         test_key_decrypted);
+
+    g_test_add_data_func("/libnm/crypto/PKCS#12/1", "test-cert.p12, test", test_pkcs12);
+    g_test_add_data_func("/libnm/crypto/PKCS#12/2", "test2-cert.p12, 12345testing", test_pkcs12);
+
+    g_test_add_data_func("/libnm/crypto/PKCS#8", "pkcs8-enc-key.pem, 1234567890", test_pkcs8);
+
+    g_test_add_func("/libnm/crypto/md5", test_md5);
+
+    ret = g_test_run();
+
+    return ret;
+}
diff --git a/src/libnm-core-impl/tests/test-general-enums.h b/src/libnm-core-impl/tests/test-general-enums.h
new file mode 100644
index 00000000..b3163e23
--- /dev/null
+++ b/src/libnm-core-impl/tests/test-general-enums.h
@@ -0,0 +1,35 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+/*
+ * Copyright (C) 2015 Red Hat, Inc.
+ */
+
+#ifndef _NM_TEST_GENERAL_ENUMS_H_
+#define _NM_TEST_GENERAL_ENUMS_H_
+
+typedef enum {
+    NM_TEST_GENERAL_BOOL_ENUM_NO      = 0,
+    NM_TEST_GENERAL_BOOL_ENUM_YES     = 1,
+    NM_TEST_GENERAL_BOOL_ENUM_MAYBE   = 2,
+    NM_TEST_GENERAL_BOOL_ENUM_UNKNOWN = 3,
+    NM_TEST_GENERAL_BOOL_ENUM_INVALID = 4, /*< skip >*/
+    NM_TEST_GENERAL_BOOL_ENUM_67      = 67,
+    NM_TEST_GENERAL_BOOL_ENUM_46      = 64,
+} NMTestGeneralBoolEnum;
+
+typedef enum {
+    NM_TEST_GENERAL_META_FLAGS_NONE = 0,
+    NM_TEST_GENERAL_META_FLAGS_FOO  = (1 << 0),
+    NM_TEST_GENERAL_META_FLAGS_BAR  = (1 << 1),
+    NM_TEST_GENERAL_META_FLAGS_BAZ  = (1 << 2),
+    NM_TEST_GENERAL_META_FLAGS_0x8  = (1 << 3),
+    NM_TEST_GENERAL_META_FLAGS_0x4  = (1 << 4),
+} NMTestGeneralMetaFlags;
+
+typedef enum {                                        /*< flags >*/
+               NM_TEST_GENERAL_COLOR_FLAGS_WHITE = 1, /*< skip >*/
+               NM_TEST_GENERAL_COLOR_FLAGS_BLUE  = 2,
+               NM_TEST_GENERAL_COLOR_FLAGS_RED   = 4,
+               NM_TEST_GENERAL_COLOR_FLAGS_GREEN = 8,
+} NMTestGeneralColorFlags;
+
+#endif /* _NM_TEST_GENERAL_ENUMS_H_ */
diff --git a/src/libnm-core-impl/tests/test-general.c b/src/libnm-core-impl/tests/test-general.c
new file mode 100644
index 00000000..57864948
--- /dev/null
+++ b/src/libnm-core-impl/tests/test-general.c
@@ -0,0 +1,10854 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Copyright (C) 2008 - 2018 Red Hat, Inc.
+ */
+
+#define NM_GLIB_COMPAT_H_TEST
+
+#include "libnm-core-impl/nm-default-libnm-core.h"
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <linux/if_ether.h>
+#include <linux/if_infiniband.h>
+
+#include "libnm-std-aux/c-list-util.h"
+#include "libnm-glib-aux/nm-uuid.h"
+#include "libnm-glib-aux/nm-enum-utils.h"
+#include "libnm-glib-aux/nm-str-buf.h"
+#include "libnm-glib-aux/nm-json-aux.h"
+#include "libnm-base/nm-base.h"
+#include "libnm-systemd-shared/nm-sd-utils-shared.h"
+
+#include "nm-utils.h"
+#include "nm-setting-private.h"
+#include "nm-utils.h"
+#include "nm-utils-private.h"
+#include "libnm-core-intern/nm-core-internal.h"
+#include "nm-core-tests-enum-types.h"
+#include "nm-team-utils.h"
+
+#include "nm-setting-8021x.h"
+#include "nm-setting-adsl.h"
+#include "nm-setting-bluetooth.h"
+#include "nm-setting-bond.h"
+#include "nm-setting-bridge.h"
+#include "nm-setting-bridge-port.h"
+#include "nm-setting-cdma.h"
+#include "nm-setting-connection.h"
+#include "nm-setting-ethtool.h"
+#include "nm-setting-generic.h"
+#include "nm-setting-gsm.h"
+#include "nm-setting-infiniband.h"
+#include "nm-setting-ip4-config.h"
+#include "nm-setting-ip6-config.h"
+#include "nm-setting-olpc-mesh.h"
+#include "nm-setting-ppp.h"
+#include "nm-setting-pppoe.h"
+#include "nm-setting-serial.h"
+#include "nm-setting-team.h"
+#include "nm-setting-team-port.h"
+#include "nm-setting-user.h"
+#include "nm-setting-vlan.h"
+#include "nm-setting-vpn.h"
+#include "nm-setting-wimax.h"
+#include "nm-setting-wired.h"
+#include "nm-setting-wireless.h"
+#include "nm-setting-wireless-security.h"
+#include "nm-setting-wpan.h"
+#include "nm-simple-connection.h"
+#include "libnm-core-intern/nm-keyfile-internal.h"
+#include "libnm-glib-aux/nm-dedup-multi.h"
+#include "libnm-base/nm-ethtool-base.h"
+#include "libnm-base/nm-ethtool-utils-base.h"
+
+#include "test-general-enums.h"
+
+#include "libnm-glib-aux/nm-test-utils.h"
+
+/* When passing a "bool" typed argument to a variadic function that
+ * expects a gboolean, the compiler will promote the integer type
+ * to have at least size (int). That way:
+ *   g_object_set (obj, PROP_BOOL, bool_val, NULL);
+ * will just work correctly. */
+G_STATIC_ASSERT(sizeof(gboolean) == sizeof(int));
+G_STATIC_ASSERT(sizeof(bool) <= sizeof(int));
+
+/*****************************************************************************/
+
+/* NM_UTILS_HWADDR_LEN_MAX is public API of libnm(-core) and _NM_UTILS_HWADDR_LEN_MAX
+ * is internal API. They are the same, but the latter can be used without including libnm-core. */
+G_STATIC_ASSERT(NM_UTILS_HWADDR_LEN_MAX == _NM_UTILS_HWADDR_LEN_MAX);
+
+/*****************************************************************************/
+
+static void
+test_nm_ascii_spaces(void)
+{
+    int               i;
+    const char *const S = NM_ASCII_SPACES;
+
+    for (i = 0; S[i]; i++)
+        g_assert(!strchr(&S[i + 1], S[i]));
+
+    for (i = 0; S[i] != '\0'; i++)
+        g_assert(g_ascii_isspace(S[i]));
+
+    g_assert(!g_ascii_isspace((char) 0));
+    for (i = 1; i < 0x100; i++) {
+        if (g_ascii_isspace((char) i))
+            g_assert(strchr(S, (char) i));
+        else
+            g_assert(!strchr(S, (char) i));
+    }
+}
+
+/*****************************************************************************/
+
+static void
+test_wired_wake_on_lan_enum(void)
+{
+    nm_auto_unref_gtypeclass GFlagsClass *flags_class = NULL;
+    gs_unref_hashtable GHashTable *vals               = g_hash_table_new(nm_direct_hash, NULL);
+    guint                          i;
+
+    G_STATIC_ASSERT_EXPR(sizeof(NMSettingWiredWakeOnLan) == sizeof(_NMSettingWiredWakeOnLan));
+    G_STATIC_ASSERT_EXPR(sizeof(NMSettingWiredWakeOnLan) < sizeof(gint64));
+
+    G_STATIC_ASSERT_EXPR(sizeof(NMSettingWiredWakeOnLan) < sizeof(gint64));
+    g_assert((((gint64) ((NMSettingWiredWakeOnLan) -1)) < 0)
+             == (((gint64) ((_NMSettingWiredWakeOnLan) -1)) < 0));
+
+#define _E(n)                                                    \
+    G_STMT_START                                                 \
+    {                                                            \
+        G_STATIC_ASSERT_EXPR(n == (gint64) _##n);                \
+        G_STATIC_ASSERT_EXPR(_##n == (gint64) n);                \
+        g_assert(_##n == _NM_SETTING_WIRED_WAKE_ON_LAN_CAST(n)); \
+        if (!g_hash_table_add(vals, GUINT_TO_POINTER(n)))        \
+            g_assert_not_reached();                              \
+    }                                                            \
+    G_STMT_END
+    _E(NM_SETTING_WIRED_WAKE_ON_LAN_NONE);
+    _E(NM_SETTING_WIRED_WAKE_ON_LAN_PHY);
+    _E(NM_SETTING_WIRED_WAKE_ON_LAN_UNICAST);
+    _E(NM_SETTING_WIRED_WAKE_ON_LAN_MULTICAST);
+    _E(NM_SETTING_WIRED_WAKE_ON_LAN_BROADCAST);
+    _E(NM_SETTING_WIRED_WAKE_ON_LAN_ARP);
+    _E(NM_SETTING_WIRED_WAKE_ON_LAN_MAGIC);
+    _E(NM_SETTING_WIRED_WAKE_ON_LAN_ALL);
+    _E(NM_SETTING_WIRED_WAKE_ON_LAN_DEFAULT);
+    _E(NM_SETTING_WIRED_WAKE_ON_LAN_IGNORE);
+    _E(NM_SETTING_WIRED_WAKE_ON_LAN_EXCLUSIVE_FLAGS);
+#undef _E
+
+    flags_class = G_FLAGS_CLASS(g_type_class_ref(NM_TYPE_SETTING_WIRED_WAKE_ON_LAN));
+    for (i = 0; i < flags_class->n_values; i++) {
+        const GFlagsValue *value = &flags_class->values[i];
+
+        if (!g_hash_table_contains(vals, GUINT_TO_POINTER(value->value))) {
+            g_error("The enum value %s from NMSettingWiredWakeOnLan is not checked for "
+                    "_NMSettingWiredWakeOnLan",
+                    value->value_name);
+        }
+    }
+}
+
+/*****************************************************************************/
+
+static void
+test_wireless_wake_on_wlan_enum(void)
+{
+    nm_auto_unref_gtypeclass GFlagsClass *flags_class = NULL;
+    gs_unref_hashtable GHashTable *vals               = g_hash_table_new(nm_direct_hash, NULL);
+    guint                          i;
+
+    G_STATIC_ASSERT_EXPR(sizeof(NMSettingWirelessWakeOnWLan)
+                         == sizeof(_NMSettingWirelessWakeOnWLan));
+    G_STATIC_ASSERT_EXPR(sizeof(NMSettingWirelessWakeOnWLan) < sizeof(gint64));
+
+    G_STATIC_ASSERT_EXPR(sizeof(NMSettingWirelessWakeOnWLan) < sizeof(gint64));
+    g_assert((((gint64) ((NMSettingWirelessWakeOnWLan) -1)) < 0)
+             == (((gint64) ((_NMSettingWirelessWakeOnWLan) -1)) < 0));
+
+#define _E(n)                                                        \
+    G_STMT_START                                                     \
+    {                                                                \
+        G_STATIC_ASSERT_EXPR(n == (gint64) _##n);                    \
+        G_STATIC_ASSERT_EXPR(_##n == (gint64) n);                    \
+        g_assert(_##n == _NM_SETTING_WIRELESS_WAKE_ON_WLAN_CAST(n)); \
+        if (!g_hash_table_add(vals, GUINT_TO_POINTER(n)))            \
+            g_assert_not_reached();                                  \
+    }                                                                \
+    G_STMT_END
+    _E(NM_SETTING_WIRELESS_WAKE_ON_WLAN_NONE);
+    _E(NM_SETTING_WIRELESS_WAKE_ON_WLAN_ANY);
+    _E(NM_SETTING_WIRELESS_WAKE_ON_WLAN_DISCONNECT);
+    _E(NM_SETTING_WIRELESS_WAKE_ON_WLAN_MAGIC);
+    _E(NM_SETTING_WIRELESS_WAKE_ON_WLAN_GTK_REKEY_FAILURE);
+    _E(NM_SETTING_WIRELESS_WAKE_ON_WLAN_EAP_IDENTITY_REQUEST);
+    _E(NM_SETTING_WIRELESS_WAKE_ON_WLAN_4WAY_HANDSHAKE);
+    _E(NM_SETTING_WIRELESS_WAKE_ON_WLAN_RFKILL_RELEASE);
+    _E(NM_SETTING_WIRELESS_WAKE_ON_WLAN_TCP);
+    _E(NM_SETTING_WIRELESS_WAKE_ON_WLAN_ALL);
+    _E(NM_SETTING_WIRELESS_WAKE_ON_WLAN_DEFAULT);
+    _E(NM_SETTING_WIRELESS_WAKE_ON_WLAN_IGNORE);
+    _E(NM_SETTING_WIRELESS_WAKE_ON_WLAN_EXCLUSIVE_FLAGS);
+#undef _E
+
+    flags_class = G_FLAGS_CLASS(g_type_class_ref(NM_TYPE_SETTING_WIRELESS_WAKE_ON_WLAN));
+    for (i = 0; i < flags_class->n_values; i++) {
+        const GFlagsValue *value = &flags_class->values[i];
+
+        if (!g_hash_table_contains(vals, GUINT_TO_POINTER(value->value))) {
+            g_error("The enum value %s from NMSettingWirelessWakeOnWLan is not checked for "
+                    "_NMSettingWirelessWakeOnWLan",
+                    value->value_name);
+        }
+    }
+}
+
+/*****************************************************************************/
+
+static void
+test_device_wifi_capabilities(void)
+{
+    nm_auto_unref_gtypeclass GFlagsClass *flags_class = NULL;
+    gs_unref_hashtable GHashTable *vals               = g_hash_table_new(nm_direct_hash, NULL);
+    guint                          i;
+
+    G_STATIC_ASSERT_EXPR(sizeof(NMDeviceWifiCapabilities) == sizeof(_NMDeviceWifiCapabilities));
+    G_STATIC_ASSERT_EXPR(sizeof(NMDeviceWifiCapabilities) < sizeof(gint64));
+
+    G_STATIC_ASSERT_EXPR(sizeof(NMDeviceWifiCapabilities) < sizeof(gint64));
+    g_assert((((gint64) ((NMDeviceWifiCapabilities) -1)) < 0)
+             == (((gint64) ((_NMDeviceWifiCapabilities) -1)) < 0));
+
+#define _E(n)                                             \
+    G_STMT_START                                          \
+    {                                                     \
+        G_STATIC_ASSERT_EXPR(n == (gint64) _##n);         \
+        G_STATIC_ASSERT_EXPR(_##n == (gint64) n);         \
+        if (!g_hash_table_add(vals, GUINT_TO_POINTER(n))) \
+            g_assert_not_reached();                       \
+    }                                                     \
+    G_STMT_END
+    _E(NM_WIFI_DEVICE_CAP_NONE);
+    _E(NM_WIFI_DEVICE_CAP_CIPHER_WEP40);
+    _E(NM_WIFI_DEVICE_CAP_CIPHER_WEP104);
+    _E(NM_WIFI_DEVICE_CAP_CIPHER_TKIP);
+    _E(NM_WIFI_DEVICE_CAP_CIPHER_CCMP);
+    _E(NM_WIFI_DEVICE_CAP_WPA);
+    _E(NM_WIFI_DEVICE_CAP_RSN);
+    _E(NM_WIFI_DEVICE_CAP_AP);
+    _E(NM_WIFI_DEVICE_CAP_ADHOC);
+    _E(NM_WIFI_DEVICE_CAP_FREQ_VALID);
+    _E(NM_WIFI_DEVICE_CAP_FREQ_2GHZ);
+    _E(NM_WIFI_DEVICE_CAP_FREQ_5GHZ);
+    _E(NM_WIFI_DEVICE_CAP_MESH);
+    _E(NM_WIFI_DEVICE_CAP_IBSS_RSN);
+#undef _E
+
+    flags_class = G_FLAGS_CLASS(g_type_class_ref(NM_TYPE_DEVICE_WIFI_CAPABILITIES));
+    for (i = 0; i < flags_class->n_values; i++) {
+        const GFlagsValue *value = &flags_class->values[i];
+
+        if (!g_hash_table_contains(vals, GUINT_TO_POINTER(value->value))) {
+            g_error("The enum value %s from NMDeviceWifiCapabilities is not checked for "
+                    "_NMDeviceWifiCapabilities",
+                    value->value_name);
+        }
+    }
+}
+
+/*****************************************************************************/
+
+static void
+test_80211_mode(void)
+{
+    nm_auto_unref_gtypeclass GEnumClass *enum_class = NULL;
+    gs_unref_hashtable GHashTable *vals             = g_hash_table_new(nm_direct_hash, NULL);
+    guint                          i;
+
+    G_STATIC_ASSERT_EXPR(sizeof(NM80211Mode) == sizeof(_NM80211Mode));
+    G_STATIC_ASSERT_EXPR(sizeof(NM80211Mode) < sizeof(gint64));
+
+    G_STATIC_ASSERT_EXPR(sizeof(NM80211Mode) < sizeof(gint64));
+    g_assert((((gint64) ((NM80211Mode) -1)) < 0) == (((gint64) ((_NM80211Mode) -1)) < 0));
+
+#define _E(n)                                            \
+    G_STMT_START                                         \
+    {                                                    \
+        G_STATIC_ASSERT_EXPR(n == (gint64) _##n);        \
+        G_STATIC_ASSERT_EXPR(_##n == (gint64) n);        \
+        g_assert(n == NM_802_11_MODE_CAST(_##n));        \
+        if (!g_hash_table_add(vals, GINT_TO_POINTER(n))) \
+            g_assert_not_reached();                      \
+    }                                                    \
+    G_STMT_END
+    _E(NM_802_11_MODE_UNKNOWN);
+    _E(NM_802_11_MODE_ADHOC);
+    _E(NM_802_11_MODE_INFRA);
+    _E(NM_802_11_MODE_AP);
+    _E(NM_802_11_MODE_MESH);
+#undef _E
+
+    enum_class = G_ENUM_CLASS(g_type_class_ref(NM_TYPE_802_11_MODE));
+    for (i = 0; i < enum_class->n_values; i++) {
+        const GEnumValue *value = &enum_class->values[i];
+
+        if (!g_hash_table_contains(vals, GINT_TO_POINTER(value->value))) {
+            g_error("The enum value %s from NM80211Mode is not checked for "
+                    "_NM80211Mode",
+                    value->value_name);
+        }
+    }
+}
+
+/*****************************************************************************/
+
+static void
+test_vlan_flags(void)
+{
+    nm_auto_unref_gtypeclass GFlagsClass *flags_class = NULL;
+    gs_unref_hashtable GHashTable *vals               = g_hash_table_new(nm_direct_hash, NULL);
+    guint                          i;
+
+    G_STATIC_ASSERT_EXPR(sizeof(NMVlanFlags) == sizeof(_NMVlanFlags));
+    G_STATIC_ASSERT_EXPR(sizeof(NMVlanFlags) < sizeof(gint64));
+
+    G_STATIC_ASSERT_EXPR(sizeof(NMVlanFlags) < sizeof(gint64));
+    g_assert((((gint64) ((NMVlanFlags) -1)) < 0) == (((gint64) ((_NMVlanFlags) -1)) < 0));
+
+#define _E(n)                                             \
+    G_STMT_START                                          \
+    {                                                     \
+        G_STATIC_ASSERT_EXPR(n == (gint64) _##n);         \
+        G_STATIC_ASSERT_EXPR(_##n == (gint64) n);         \
+        g_assert(n == NM_VLAN_FLAGS_CAST(_##n));          \
+        if (!g_hash_table_add(vals, GUINT_TO_POINTER(n))) \
+            g_assert_not_reached();                       \
+    }                                                     \
+    G_STMT_END
+    _E(NM_VLAN_FLAG_REORDER_HEADERS);
+    _E(NM_VLAN_FLAG_GVRP);
+    _E(NM_VLAN_FLAG_LOOSE_BINDING);
+    _E(NM_VLAN_FLAG_MVRP);
+    _E(NM_VLAN_FLAGS_ALL);
+#undef _E
+
+    flags_class = G_FLAGS_CLASS(g_type_class_ref(NM_TYPE_VLAN_FLAGS));
+    for (i = 0; i < flags_class->n_values; i++) {
+        const GFlagsValue *value = &flags_class->values[i];
+
+        if (!g_hash_table_contains(vals, GUINT_TO_POINTER(value->value))) {
+            g_error("The enum value %s from NMVlanFlags is not checked for "
+                    "_NMVlanFlags",
+                    value->value_name);
+        }
+    }
+}
+
+/*****************************************************************************/
+
+typedef struct _nm_packed {
+    int    v0;
+    char   v1;
+    double v2;
+    guint8 v3;
+} TestHashStruct;
+
+static void
+_test_hash_struct(int v0, char v1, double v2, guint8 v3)
+{
+    const TestHashStruct s = {
+        .v0 = v0,
+        .v1 = v1,
+        .v2 = v2,
+        .v3 = v3,
+    };
+    NMHashState h;
+    guint       hh;
+
+    nm_hash_init(&h, 100);
+    nm_hash_update(&h, &s, sizeof(s));
+    hh = nm_hash_complete(&h);
+
+    nm_hash_init(&h, 100);
+    nm_hash_update_val(&h, v0);
+    nm_hash_update_val(&h, v1);
+    nm_hash_update_val(&h, v2);
+    nm_hash_update_val(&h, v3);
+    g_assert_cmpint(hh, ==, nm_hash_complete(&h));
+
+    nm_hash_init(&h, 100);
+    nm_hash_update_vals(&h, v0, v1, v2, v3);
+    g_assert_cmpint(hh, ==, nm_hash_complete(&h));
+}
+
+static guint
+_test_hash_str(const char *str)
+{
+    NMHashState h;
+    guint       v, v2;
+    const guint SEED = 10;
+
+    nm_hash_init(&h, SEED);
+    nm_hash_update_str0(&h, str);
+    v = nm_hash_complete(&h);
+
+    /* assert that hashing a string and a buffer yields the
+     * same result.
+     *
+     * I think that is a desirable property. */
+    nm_hash_init(&h, SEED);
+    nm_hash_update_mem(&h, str, strlen(str));
+    v2 = nm_hash_complete(&h);
+
+    g_assert(v == v2);
+    return v;
+}
+
+#define _test_hash_vals(type, ...)                                                 \
+    G_STMT_START                                                                   \
+    {                                                                              \
+        NMHashState h0, h1, h2, h3;                                                \
+        const type  v[] = {__VA_ARGS__};                                           \
+        guint       h;                                                             \
+        guint       i;                                                             \
+                                                                                   \
+        nm_hash_init(&h0, 10);                                                     \
+        nm_hash_init(&h1, 10);                                                     \
+        nm_hash_init(&h2, 10);                                                     \
+        nm_hash_init(&h3, 10);                                                     \
+                                                                                   \
+        /* assert that it doesn't matter, whether we hash the values individually,
+         * or all at once, or via the convenience macros nm_hash_update_val()
+         * and nm_hash_update_vals(). */ \
+        for (i = 0; i < G_N_ELEMENTS(v); i++) {                                    \
+            nm_hash_update(&h0, &v[i], sizeof(type));                              \
+            nm_hash_update_val(&h1, v[i]);                                         \
+        }                                                                          \
+        nm_hash_update_vals(&h2, __VA_ARGS__);                                     \
+        nm_hash_update(&h3, v, sizeof(v));                                         \
+                                                                                   \
+        h = nm_hash_complete(&h0);                                                 \
+        g_assert_cmpint(h, ==, nm_hash_complete(&h1));                             \
+        g_assert_cmpint(h, ==, nm_hash_complete(&h2));                             \
+        g_assert_cmpint(h, ==, nm_hash_complete(&h3));                             \
+    }                                                                              \
+    G_STMT_END
+
+static void
+test_nm_hash(void)
+{
+    g_assert(nm_hash_static(0));
+    g_assert(nm_hash_static(777));
+
+    g_assert(nm_hash_str(NULL));
+    g_assert(nm_hash_str(""));
+    g_assert(nm_hash_str("a"));
+
+    g_assert(nm_hash_ptr(NULL));
+    g_assert(nm_hash_ptr(""));
+    g_assert(nm_hash_ptr("a"));
+
+    _test_hash_str("");
+    _test_hash_str("a");
+    _test_hash_str("aa");
+    _test_hash_str("diceros bicornis longipes");
+
+    /* assert that nm_hash_update_vals() is the same as calling nm_hash_update_val() multiple times. */
+    _test_hash_vals(int, 1);
+    _test_hash_vals(int, 1, 2);
+    _test_hash_vals(int, 1, 2, 3);
+    _test_hash_vals(int, 1, 2, 3, 4);
+    _test_hash_vals(long, 1l);
+    _test_hash_vals(long, 1l, 2l, 3l, 4l, 5l);
+
+    _test_hash_struct(10, 'a', 5.4, 7);
+    _test_hash_struct(-10, '\0', -5.4e49, 255);
+
+    g_assert_cmpint(NM_HASH_COMBINE_BOOLS(guint8, 1, 0), ==, 0x002);
+    g_assert_cmpint(NM_HASH_COMBINE_BOOLS(guint8, 1, 1), ==, 0x003);
+    g_assert_cmpint(NM_HASH_COMBINE_BOOLS(guint8, 1, 1, 0, 0, 0, 0), ==, 0x030);
+    g_assert_cmpint(NM_HASH_COMBINE_BOOLS(guint8, 1, 1, 0, 0, 0, 1), ==, 0x031);
+    g_assert_cmpint(NM_HASH_COMBINE_BOOLS(guint8, 0, 0, 1, 1, 0, 0, 0, 1), ==, 0x031);
+    g_assert_cmpint(NM_HASH_COMBINE_BOOLS(guint16, 0, 0, 1, 1, 0, 0, 0, 1), ==, 0x031);
+    g_assert_cmpint(NM_HASH_COMBINE_BOOLS(guint16, 0, 0, 0, 1, 1, 0, 0, 0, 1), ==, 0x031);
+    g_assert_cmpint(NM_HASH_COMBINE_BOOLS(guint16, 1, 0, 0, 1, 1, 0, 0, 0, 1), ==, 0x131);
+}
+
+/*****************************************************************************/
+
+static void
+test_nm_g_slice_free_fcn(void)
+{
+    gpointer p;
+    struct {
+        char a1;
+        char a2;
+    } xx;
+
+    p = g_slice_new(gint64);
+    (nm_g_slice_free_fcn(gint64))(p);
+
+    p = g_slice_new(gint32);
+    (nm_g_slice_free_fcn(gint32))(p);
+
+    p = g_slice_new(int);
+    (nm_g_slice_free_fcn(int))(p);
+
+    p = g_slice_new(gint64);
+    nm_g_slice_free_fcn_gint64(p);
+
+    p = g_slice_alloc(sizeof(xx));
+    (nm_g_slice_free_fcn(xx))(p);
+}
+
+/*****************************************************************************/
+
+static void
+_do_test_nm_utils_strsplit_set_f_one(NMUtilsStrsplitSetFlags flags,
+                                     const char *            str,
+                                     gsize                   words_len,
+                                     const char *const *     exp_words)
+{
+#define DELIMITERS   " \n"
+#define DELIMITERS_C ' ', '\n'
+
+    gs_free const char **words = NULL;
+    gsize                i, j, k;
+    const gboolean       f_allow_escaping =
+        NM_FLAGS_HAS(flags, NM_UTILS_STRSPLIT_SET_FLAGS_ALLOW_ESCAPING);
+    const gboolean f_preserve_empty =
+        NM_FLAGS_HAS(flags, NM_UTILS_STRSPLIT_SET_FLAGS_PRESERVE_EMPTY);
+    const char *       s1;
+    gsize              initial_offset;
+    gs_strfreev char **words_g = NULL;
+
+    g_assert(!NM_FLAGS_ANY(flags,
+                           ~(NM_UTILS_STRSPLIT_SET_FLAGS_ALLOW_ESCAPING
+                             | NM_UTILS_STRSPLIT_SET_FLAGS_PRESERVE_EMPTY)));
+
+    /* assert that the expected words are valid (and don't contain unescaped delimiters). */
+    for (i = 0; i < words_len; i++) {
+        const char *w = exp_words[i];
+
+        g_assert(w);
+        if (!f_preserve_empty)
+            g_assert(w[0]);
+        for (k = 0; w[k];) {
+            if (f_allow_escaping && w[k] == '\\') {
+                k++;
+                if (w[k] == '\0')
+                    break;
+                k++;
+                continue;
+            }
+            g_assert(!NM_IN_SET(w[k], DELIMITERS_C));
+            k++;
+        }
+        if (!f_allow_escaping)
+            g_assert(!NM_STRCHAR_ANY(w, ch, NM_IN_SET(ch, DELIMITERS_C)));
+    }
+
+    initial_offset = (f_preserve_empty || !str) ? 0u : strspn(str, DELIMITERS);
+
+    /* first compare our expected values with what g_strsplit_set() would
+     * do. */
+    words_g = str ? g_strsplit_set(str, DELIMITERS, -1) : NULL;
+    if (str == NULL) {
+        g_assert_cmpint(words_len, ==, 0);
+        g_assert(!words_g);
+    } else if (nm_streq0(str, "")) {
+        g_assert_cmpint(words_len, ==, 0);
+        g_assert(words_g);
+        g_assert(!words_g[0]);
+    } else {
+        g_assert(words_g);
+        g_assert(words_g[0]);
+        if (!f_allow_escaping) {
+            if (!f_preserve_empty) {
+                for (i = 0, j = 0; words_g[i]; i++) {
+                    if (words_g[i][0] == '\0')
+                        g_free(words_g[i]);
+                    else
+                        words_g[j++] = words_g[i];
+                }
+                words_g[j] = NULL;
+            }
+            if (f_preserve_empty)
+                g_assert_cmpint(words_len, >, 0);
+            for (i = 0; i < words_len; i++) {
+                g_assert(exp_words[i]);
+                g_assert_cmpstr(exp_words[i], ==, words_g[i]);
+            }
+            g_assert(words_g[words_len] == NULL);
+            g_assert_cmpint(NM_PTRARRAY_LEN(words_g), ==, words_len);
+            g_assert(nm_utils_strv_cmp_n(exp_words, words_len, words_g, -1) == 0);
+        }
+    }
+
+    if (flags == NM_UTILS_STRSPLIT_SET_FLAGS_NONE && nmtst_get_rand_bool())
+        words = nm_utils_strsplit_set(str, DELIMITERS);
+    else if (flags == NM_UTILS_STRSPLIT_SET_FLAGS_PRESERVE_EMPTY && nmtst_get_rand_bool())
+        words = nm_utils_strsplit_set_with_empty(str, DELIMITERS);
+    else
+        words = nm_utils_strsplit_set_full(str, DELIMITERS, flags);
+
+    g_assert_cmpint(NM_PTRARRAY_LEN(words), ==, words_len);
+
+    if (words_len == 0) {
+        g_assert(!words);
+        g_assert(!str || NM_STRCHAR_ALL(str, ch, NM_IN_SET(ch, DELIMITERS_C)));
+        return;
+    }
+
+    g_assert(words);
+    for (i = 0; i < words_len; i++)
+        g_assert_cmpstr(exp_words[i], ==, words[i]);
+    g_assert(words[words_len] == NULL);
+
+    g_assert(nm_utils_strv_cmp_n(exp_words, words_len, words, -1) == 0);
+
+    s1 = words[0];
+    g_assert(s1 >= (char *) &words[words_len + 1]);
+    s1 = &s1[strlen(str)];
+    for (i = 1; i < words_len; i++) {
+        g_assert(&(words[i - 1])[strlen(words[i - 1])] < words[i]);
+        g_assert(words[i] <= s1);
+    }
+
+    /* while strsplit removes all delimiters, we can relatively easily find them
+     * in the original string. Assert that the original string and the pointer offsets
+     * of words correspond. In particular, find idx_delim_after and idx_delim_before
+     * to determine which delimiter was after/before a word. */
+    {
+        gsize idx_word_start;
+        gsize idx_delim_after_old = G_MAXSIZE;
+
+        idx_word_start = initial_offset;
+        for (i = 0; i < words_len; i++) {
+            const gsize l_i = strlen(words[i]);
+            gsize       idx_delim_after;
+            gsize       idx_delim_before;
+
+            /* find the delimiter *after* words[i]. We can do that by looking at the next
+             * word and calculating the pointer difference.
+             *
+             * The delimiter after the very last word is '\0' and requires strlen() to find. */
+            idx_delim_after = initial_offset + ((words[i] - words[0]) + l_i);
+            if (idx_delim_after != idx_word_start + l_i) {
+                g_assert(!f_preserve_empty);
+                g_assert_cmpint(idx_word_start + l_i, <, idx_delim_after);
+                idx_word_start = idx_delim_after - l_i;
+            }
+            if (i + 1 < words_len) {
+                gsize x = initial_offset + ((words[i + 1] - words[0]) - 1);
+
+                if (idx_delim_after != x) {
+                    g_assert(!f_preserve_empty);
+                    g_assert_cmpint(idx_delim_after, <, x);
+                    for (k = idx_delim_after; k <= x; k++)
+                        g_assert(NM_IN_SET(str[k], DELIMITERS_C));
+                }
+                g_assert(NM_IN_SET(str[idx_delim_after], DELIMITERS_C));
+            } else {
+                if (f_preserve_empty)
+                    g_assert(NM_IN_SET(str[idx_delim_after], '\0'));
+                else
+                    g_assert(NM_IN_SET(str[idx_delim_after], '\0', DELIMITERS_C));
+            }
+
+            /* find the delimiter *before* words[i]. */
+            if (i == 0) {
+                /* there is only a delimiter *before*, with !f_preserve_empty and leading
+                 * delimiters. */
+                idx_delim_before = G_MAXSIZE;
+                if (initial_offset > 0) {
+                    g_assert(!f_preserve_empty);
+                    idx_delim_before = initial_offset - 1;
+                }
+            } else
+                idx_delim_before = initial_offset + (words[i] - words[0]) - 1;
+            if (idx_delim_before != G_MAXSIZE)
+                g_assert(NM_IN_SET(str[idx_delim_before], DELIMITERS_C));
+            if (idx_delim_after_old != idx_delim_before) {
+                g_assert(!f_preserve_empty);
+                if (i == 0) {
+                    g_assert_cmpint(initial_offset, >, 0);
+                    g_assert_cmpint(idx_delim_before, !=, G_MAXSIZE);
+                    g_assert_cmpint(idx_delim_before, ==, initial_offset - 1);
+                } else {
+                    g_assert_cmpint(idx_delim_after_old, !=, G_MAXSIZE);
+                    g_assert_cmpint(idx_delim_before, !=, G_MAXSIZE);
+                    g_assert_cmpint(idx_delim_after_old, <, idx_delim_before);
+                    for (k = idx_delim_after_old; k <= idx_delim_before; k++)
+                        g_assert(NM_IN_SET(str[k], DELIMITERS_C));
+                }
+            }
+
+            for (k = 0; k < l_i;) {
+                if (f_allow_escaping && str[idx_word_start + k] == '\\') {
+                    k++;
+                    if (k >= l_i)
+                        break;
+                    k++;
+                    continue;
+                }
+                g_assert(!NM_IN_SET(str[idx_word_start + k], DELIMITERS_C));
+                k++;
+            }
+            g_assert(strncmp(words[i], &str[idx_word_start], l_i) == 0);
+
+            if (i > 0) {
+                const char *s = &(words[i - 1])[strlen(words[i - 1]) + 1];
+
+                if (s != words[i]) {
+                    g_assert(!f_preserve_empty);
+                    g_assert(s < words[i]);
+                }
+            }
+
+            idx_word_start += l_i + 1;
+            idx_delim_after_old = idx_delim_after;
+        }
+    }
+}
+
+static void
+_do_test_nm_utils_strsplit_set_f(NMUtilsStrsplitSetFlags flags,
+                                 const char *            str,
+                                 gsize                   words_len,
+                                 const char *const *     exp_words)
+{
+    _do_test_nm_utils_strsplit_set_f_one(flags, str, words_len, exp_words);
+
+    if (NM_FLAGS_HAS(flags, NM_UTILS_STRSPLIT_SET_FLAGS_PRESERVE_EMPTY)) {
+        gs_unref_ptrarray GPtrArray *exp_words2 = NULL;
+        gsize                        k;
+
+        exp_words2 = g_ptr_array_new();
+        for (k = 0; k < words_len; k++) {
+            if (exp_words[k][0] != '\0')
+                g_ptr_array_add(exp_words2, (gpointer) exp_words[k]);
+        }
+
+        _do_test_nm_utils_strsplit_set_f_one(flags & (~NM_UTILS_STRSPLIT_SET_FLAGS_PRESERVE_EMPTY),
+                                             str,
+                                             exp_words2->len,
+                                             (const char *const *) exp_words2->pdata);
+    }
+}
+
+#define do_test_nm_utils_strsplit_set_f(flags, str, ...) \
+    _do_test_nm_utils_strsplit_set_f(flags, str, NM_NARG(__VA_ARGS__), NM_MAKE_STRV(__VA_ARGS__))
+
+#define do_test_nm_utils_strsplit_set(allow_escaping, str, ...)                                   \
+    do_test_nm_utils_strsplit_set_f((allow_escaping) ? NM_UTILS_STRSPLIT_SET_FLAGS_ALLOW_ESCAPING \
+                                                     : NM_UTILS_STRSPLIT_SET_FLAGS_NONE,          \
+                                    str,                                                          \
+                                    ##__VA_ARGS__)
+
+static void
+_do_test_nm_utils_strsplit_set_simple(NMUtilsStrsplitSetFlags flags,
+                                      const char *            str,
+                                      gsize                   words_len,
+                                      const char *const *     exp_words)
+{
+    gs_free const char **tokens = NULL;
+    gsize                n_tokens;
+
+    tokens = nm_utils_strsplit_set_full(str, DELIMITERS, flags);
+
+    if (!tokens) {
+        g_assert_cmpint(words_len, ==, 0);
+        return;
+    }
+
+    g_assert(str && str[0]);
+    g_assert_cmpint(words_len, >, 0);
+    n_tokens = NM_PTRARRAY_LEN(tokens);
+
+    if (nm_utils_strv_cmp_n(exp_words, words_len, tokens, -1) != 0) {
+        gsize i;
+
+        g_print(">>> split \"%s\" (flags %x) got %zu tokens (%zu expected)\n",
+                str,
+                (guint) flags,
+                n_tokens,
+                words_len);
+        for (i = 0; i < NM_MAX(n_tokens, words_len); i++) {
+            const char *s1 = i < n_tokens ? tokens[i] : NULL;
+            const char *s2 = i < words_len ? exp_words[i] : NULL;
+
+            g_print(">>> [%zu]: %s - %s%s%s vs. %s%s%s\n",
+                    i,
+                    nm_streq0(s1, s2) ? "same" : "diff",
+                    NM_PRINT_FMT_QUOTE_STRING(s1),
+                    NM_PRINT_FMT_QUOTE_STRING(s2));
+        }
+        g_assert_not_reached();
+    }
+    g_assert_cmpint(words_len, ==, NM_PTRARRAY_LEN(tokens));
+}
+#define do_test_nm_utils_strsplit_set_simple(flags, str, ...)   \
+    _do_test_nm_utils_strsplit_set_simple((flags),              \
+                                          (str),                \
+                                          NM_NARG(__VA_ARGS__), \
+                                          NM_MAKE_STRV(__VA_ARGS__))
+
+static void
+test_nm_utils_strsplit_set(void)
+{
+    gs_unref_ptrarray GPtrArray *words_exp = NULL;
+    guint                        test_run;
+
+    do_test_nm_utils_strsplit_set_f(NM_UTILS_STRSPLIT_SET_FLAGS_NONE, NULL);
+    do_test_nm_utils_strsplit_set_f(NM_UTILS_STRSPLIT_SET_FLAGS_NONE, "");
+    do_test_nm_utils_strsplit_set_f(NM_UTILS_STRSPLIT_SET_FLAGS_NONE, " ");
+    do_test_nm_utils_strsplit_set_f(NM_UTILS_STRSPLIT_SET_FLAGS_NONE, "a  b", "a", "b");
+
+    do_test_nm_utils_strsplit_set_f(NM_UTILS_STRSPLIT_SET_FLAGS_PRESERVE_EMPTY, NULL);
+    do_test_nm_utils_strsplit_set_f(NM_UTILS_STRSPLIT_SET_FLAGS_PRESERVE_EMPTY, "");
+    do_test_nm_utils_strsplit_set_f(NM_UTILS_STRSPLIT_SET_FLAGS_PRESERVE_EMPTY, " ", "", "");
+    do_test_nm_utils_strsplit_set_f(NM_UTILS_STRSPLIT_SET_FLAGS_PRESERVE_EMPTY, "  ", "", "", "");
+    do_test_nm_utils_strsplit_set_f(NM_UTILS_STRSPLIT_SET_FLAGS_PRESERVE_EMPTY, "a  ", "a", "", "");
+    do_test_nm_utils_strsplit_set_f(NM_UTILS_STRSPLIT_SET_FLAGS_PRESERVE_EMPTY,
+                                    "a  b",
+                                    "a",
+                                    "",
+                                    "b");
+    do_test_nm_utils_strsplit_set_f(NM_UTILS_STRSPLIT_SET_FLAGS_PRESERVE_EMPTY,
+                                    " ab  b",
+                                    "",
+                                    "ab",
+                                    "",
+                                    "b");
+    do_test_nm_utils_strsplit_set_f(NM_UTILS_STRSPLIT_SET_FLAGS_PRESERVE_EMPTY,
+                                    "ab  b",
+                                    "ab",
+                                    "",
+                                    "b");
+    do_test_nm_utils_strsplit_set_f(NM_UTILS_STRSPLIT_SET_FLAGS_PRESERVE_EMPTY, "abb", "abb");
+    do_test_nm_utils_strsplit_set_f(NM_UTILS_STRSPLIT_SET_FLAGS_PRESERVE_EMPTY,
+                                    "abb  bb ",
+                                    "abb",
+                                    "",
+                                    "bb",
+                                    "");
+    do_test_nm_utils_strsplit_set_f(NM_UTILS_STRSPLIT_SET_FLAGS_PRESERVE_EMPTY,
+                                    "abb bcb ",
+                                    "abb",
+                                    "bcb",
+                                    "");
+
+    do_test_nm_utils_strsplit_set(FALSE, NULL);
+    do_test_nm_utils_strsplit_set(FALSE, "");
+    do_test_nm_utils_strsplit_set(FALSE, "\n");
+    do_test_nm_utils_strsplit_set(TRUE, " \t\n", "\t");
+    do_test_nm_utils_strsplit_set(FALSE, "a", "a");
+    do_test_nm_utils_strsplit_set(FALSE, "a b", "a", "b");
+    do_test_nm_utils_strsplit_set(FALSE, "a\rb", "a\rb");
+    do_test_nm_utils_strsplit_set(FALSE, "  a\rb  ", "a\rb");
+    do_test_nm_utils_strsplit_set(FALSE, "  a bbbd afds ere", "a", "bbbd", "afds", "ere");
+    do_test_nm_utils_strsplit_set(FALSE,
+                                  "1 2 3 4 5 6 7 8 9 0 "
+                                  "1 2 3 4 5 6 7 8 9 0 "
+                                  "1 2 3 4 5 6 7 8 9 0",
+                                  "1",
+                                  "2",
+                                  "3",
+                                  "4",
+                                  "5",
+                                  "6",
+                                  "7",
+                                  "8",
+                                  "9",
+                                  "0",
+                                  "1",
+                                  "2",
+                                  "3",
+                                  "4",
+                                  "5",
+                                  "6",
+                                  "7",
+                                  "8",
+                                  "9",
+                                  "0",
+                                  "1",
+                                  "2",
+                                  "3",
+                                  "4",
+                                  "5",
+                                  "6",
+                                  "7",
+                                  "8",
+                                  "9",
+                                  "0");
+    do_test_nm_utils_strsplit_set(TRUE, "\\", "\\");
+    do_test_nm_utils_strsplit_set(TRUE, "\\ ", "\\ ");
+    do_test_nm_utils_strsplit_set(TRUE, "\\\\", "\\\\");
+    do_test_nm_utils_strsplit_set(TRUE, "\\\t", "\\\t");
+    do_test_nm_utils_strsplit_set(TRUE, "foo\\", "foo\\");
+    do_test_nm_utils_strsplit_set(TRUE, "bar foo\\", "bar", "foo\\");
+    do_test_nm_utils_strsplit_set(TRUE, "\\ a b\\ \\  c", "\\ a", "b\\ \\ ", "c");
+
+    words_exp = g_ptr_array_new_with_free_func(g_free);
+    for (test_run = 0; test_run < 100; test_run++) {
+        gboolean      f_allow_escaping = nmtst_get_rand_bool();
+        guint         words_len        = nmtst_get_rand_uint32() % 100;
+        gs_free char *str              = NULL;
+        guint         i;
+
+        g_ptr_array_set_size(words_exp, 0);
+        for (i = 0; i < words_len; i++) {
+            guint word_len;
+            char *word;
+            guint j;
+
+            word_len = nmtst_get_rand_uint32();
+            if ((word_len % 100) < 30)
+                word_len = 0;
+            else
+                word_len = (word_len >> 10) % 100;
+            word = g_new(char, word_len + 3);
+            for (j = 0; j < word_len;) {
+                guint32           p                = nmtst_get_rand_uint32();
+                static const char delimiters_arr[] = {DELIMITERS_C};
+                static const char regular_chars[]  = "abcdefghijklmnopqrstuvwxyz";
+
+                if (!f_allow_escaping || (p % 1000) < 700) {
+                    if (((p >> 20) % 100) < 20)
+                        word[j++] = '\\';
+                    word[j++] = regular_chars[(p >> 11) % (G_N_ELEMENTS(regular_chars) - 1)];
+                    continue;
+                }
+                word[j++] = '\\';
+                word[j++] = delimiters_arr[(p >> 11) % G_N_ELEMENTS(delimiters_arr)];
+            }
+            word[j] = '\0';
+            g_ptr_array_add(words_exp, word);
+        }
+        g_ptr_array_add(words_exp, NULL);
+
+        str = g_strjoinv(" ", (char **) words_exp->pdata);
+
+        if (str[0] == '\0' && words_len > 0) {
+            g_assert(words_len == 1);
+            g_assert_cmpstr(words_exp->pdata[0], ==, "");
+            words_len = 0;
+        }
+
+        _do_test_nm_utils_strsplit_set_f((f_allow_escaping
+                                              ? NM_UTILS_STRSPLIT_SET_FLAGS_ALLOW_ESCAPING
+                                              : NM_UTILS_STRSPLIT_SET_FLAGS_NONE)
+                                             | NM_UTILS_STRSPLIT_SET_FLAGS_PRESERVE_EMPTY,
+                                         str,
+                                         words_len,
+                                         (const char *const *) words_exp->pdata);
+    }
+
+    do_test_nm_utils_strsplit_set_simple(NM_UTILS_STRSPLIT_SET_FLAGS_ESCAPED, "\t", "\t");
+    do_test_nm_utils_strsplit_set_simple(NM_UTILS_STRSPLIT_SET_FLAGS_ESCAPED
+                                             | NM_UTILS_STRSPLIT_SET_FLAGS_STRSTRIP,
+                                         "\t");
+    do_test_nm_utils_strsplit_set_simple(NM_UTILS_STRSPLIT_SET_FLAGS_ESCAPED
+                                             | NM_UTILS_STRSPLIT_SET_FLAGS_STRSTRIP
+                                             | NM_UTILS_STRSPLIT_SET_FLAGS_PRESERVE_EMPTY,
+                                         "\t",
+                                         "");
+    do_test_nm_utils_strsplit_set_simple(NM_UTILS_STRSPLIT_SET_FLAGS_ESCAPED
+                                             | NM_UTILS_STRSPLIT_SET_FLAGS_STRSTRIP
+                                             | NM_UTILS_STRSPLIT_SET_FLAGS_PRESERVE_EMPTY,
+                                         "\t\\\t\t\t\\\t",
+                                         "\t\t\t\t");
+
+    do_test_nm_utils_strsplit_set_simple(NM_UTILS_STRSPLIT_SET_FLAGS_ESCAPED, "\ta", "\ta");
+    do_test_nm_utils_strsplit_set_simple(NM_UTILS_STRSPLIT_SET_FLAGS_ESCAPED
+                                             | NM_UTILS_STRSPLIT_SET_FLAGS_STRSTRIP,
+                                         "\ta",
+                                         "a");
+    do_test_nm_utils_strsplit_set_simple(NM_UTILS_STRSPLIT_SET_FLAGS_ESCAPED,
+                                         "\ta\\ b\t\\ ",
+                                         "\ta b\t ");
+    do_test_nm_utils_strsplit_set_simple(NM_UTILS_STRSPLIT_SET_FLAGS_ESCAPED
+                                             | NM_UTILS_STRSPLIT_SET_FLAGS_STRSTRIP,
+                                         "\ta\\ b\t\\ \t",
+                                         "a b\t ");
+    do_test_nm_utils_strsplit_set_simple(NM_UTILS_STRSPLIT_SET_FLAGS_ESCAPED, "a\\  b", "a ", "b");
+    do_test_nm_utils_strsplit_set_simple(NM_UTILS_STRSPLIT_SET_FLAGS_ESCAPED,
+                                         "\ta\\  b",
+                                         "\ta ",
+                                         "b");
+    do_test_nm_utils_strsplit_set_simple(NM_UTILS_STRSPLIT_SET_FLAGS_ESCAPED
+                                             | NM_UTILS_STRSPLIT_SET_FLAGS_STRSTRIP,
+                                         "\ta\\  b",
+                                         "a ",
+                                         "b");
+}
+
+/*****************************************************************************/
+
+static char *
+_escaped_tokens_create_random_word_full(const char *const *tokens, gsize n_tokens, gsize len)
+{
+    GString *gstr = g_string_new(NULL);
+    gsize    i;
+    char     random_token[2] = {0};
+
+    for (i = 0; i < len; i++) {
+        const char *token = tokens[nmtst_get_rand_uint32() % n_tokens];
+
+        if (!token[0]) {
+            do {
+                random_token[0] = nmtst_get_rand_uint32();
+            } while (random_token[0] == '\0');
+            token = random_token;
+        }
+        g_string_append(gstr, token);
+    }
+
+    /* reallocate the string, so that we don't have any excess memory from
+     * the GString buffer. This is so that valgrind may better detect an out
+     * or range access. */
+    return nm_str_realloc(g_string_free(gstr, FALSE));
+}
+
+/* set to 1 to exclude characters that are annoying to see in the debugger
+ * and printf() output. */
+#define ESCAPED_TOKENS_ONLY_NICE_CHARS 0
+
+static char *
+_escaped_tokens_create_random_whitespace(void)
+{
+    static const char *tokens[] = {
+        " ",
+#if !ESCAPED_TOKENS_ONLY_NICE_CHARS
+        "\n",
+        "\t",
+        "\r",
+        "\f",
+#endif
+    };
+
+    return _escaped_tokens_create_random_word_full(tokens,
+                                                   G_N_ELEMENTS(tokens),
+                                                   nmtst_get_rand_word_length(NULL) / 4u);
+}
+
+static char *
+_escaped_tokens_create_random_word(void)
+{
+    static const char *tokens[] = {
+        "a",
+        "b",
+        "c",
+        " ",
+        ",",
+        "=",
+        "\\",
+#if !ESCAPED_TOKENS_ONLY_NICE_CHARS
+        "\n",
+        "\f",
+        ":",
+        "",
+#endif
+    };
+
+    return _escaped_tokens_create_random_word_full(tokens,
+                                                   G_N_ELEMENTS(tokens),
+                                                   nmtst_get_rand_word_length(NULL));
+}
+
+static void
+_escaped_tokens_str_append_delimiter(GString *str, gboolean strict, gboolean needs_delimiter)
+{
+    guint len = nmtst_get_rand_word_length(NULL) / 10u;
+    char *s;
+
+again:
+    if (!strict) {
+        g_string_append(str, (s = _escaped_tokens_create_random_whitespace()));
+        nm_clear_g_free(&s);
+    }
+
+    if (needs_delimiter)
+        g_string_append_c(str, ',');
+
+    if (!strict) {
+        g_string_append(str, (s = _escaped_tokens_create_random_whitespace()));
+        nm_clear_g_free(&s);
+        if (len-- > 0) {
+            needs_delimiter = TRUE;
+            goto again;
+        }
+    }
+}
+
+static void
+_escaped_tokens_split(char *str, const char **out_key, const char **out_val)
+{
+    const char *key;
+    const char *val;
+    gsize       len = strlen(str);
+
+    g_assert(str);
+
+    nm_utils_escaped_tokens_options_split(str, &key, &val);
+    g_assert(key);
+    g_assert(key == str);
+    if (val) {
+        g_assert(val > str);
+        g_assert(val > key);
+        g_assert(val <= &str[len]);
+    }
+    NM_SET_OUT(out_key, key);
+    NM_SET_OUT(out_val, val);
+}
+
+static void
+_escaped_tokens_combine(GString *   combined,
+                        const char *key,
+                        const char *val,
+                        gboolean    strict,
+                        gboolean    allow_append_delimiter_before,
+                        gboolean    needs_delimiter_after)
+{
+    gs_free char *escaped_key = NULL;
+    gs_free char *escaped_val = NULL;
+
+    if (allow_append_delimiter_before)
+        _escaped_tokens_str_append_delimiter(combined, strict, FALSE);
+    g_string_append(combined, nm_utils_escaped_tokens_options_escape_key(key, &escaped_key));
+    if (val) {
+        char *s;
+
+        if (!strict) {
+            g_string_append(combined, (s = _escaped_tokens_create_random_whitespace()));
+            nm_clear_g_free(&s);
+        }
+        g_string_append_c(combined, '=');
+        if (!strict) {
+            g_string_append(combined, (s = _escaped_tokens_create_random_whitespace()));
+            nm_clear_g_free(&s);
+        }
+        g_string_append(combined, nm_utils_escaped_tokens_options_escape_val(val, &escaped_val));
+    }
+    _escaped_tokens_str_append_delimiter(combined, strict, needs_delimiter_after);
+}
+
+static void
+_escaped_tokens_check_one_impl(const char *       expected_key,
+                               const char *       expected_val,
+                               const char *       expected_combination,
+                               const char *const *other,
+                               gsize              n_other)
+{
+    nm_auto_free_gstring GString *combined = g_string_new(NULL);
+    gsize                         i;
+
+    g_assert(expected_key);
+    g_assert(expected_combination);
+    g_assert(other);
+
+    _escaped_tokens_combine(combined, expected_key, expected_val, TRUE, TRUE, FALSE);
+
+    g_assert_cmpstr(combined->str, ==, expected_combination);
+
+    for (i = 0; i < n_other + 2u; i++) {
+        nm_auto_free_gstring GString *str0        = NULL;
+        gs_free const char **         strv_split  = NULL;
+        gs_free char *                strv_split0 = NULL;
+        const char *                  comb;
+        const char *                  key;
+        const char *                  val;
+
+        if (i == 0)
+            comb = expected_combination;
+        else if (i == 1) {
+            _escaped_tokens_combine(nm_gstring_prepare(&str0),
+                                    expected_key,
+                                    expected_val,
+                                    FALSE,
+                                    TRUE,
+                                    FALSE);
+            comb = str0->str;
+        } else
+            comb = other[i - 2];
+
+        strv_split = nm_utils_escaped_tokens_options_split_list(comb);
+        if (!strv_split) {
+            g_assert_cmpstr(expected_key, ==, "");
+            g_assert_cmpstr(expected_val, ==, NULL);
+            continue;
+        }
+        g_assert(expected_val || expected_key[0]);
+
+        g_assert_cmpuint(NM_PTRARRAY_LEN(strv_split), ==, 1u);
+
+        strv_split0 = g_strdup(strv_split[0]);
+
+        _escaped_tokens_split(strv_split0, &key, &val);
+        g_assert_cmpstr(key, ==, expected_key);
+        g_assert_cmpstr(val, ==, expected_val);
+    }
+}
+
+#define _escaped_tokens_check_one(expected_key, expected_val, expected_combination, ...) \
+    _escaped_tokens_check_one_impl(expected_key,                                         \
+                                   expected_val,                                         \
+                                   expected_combination,                                 \
+                                   NM_MAKE_STRV(__VA_ARGS__),                            \
+                                   NM_NARG(__VA_ARGS__))
+
+static void
+test_nm_utils_escaped_tokens(void)
+{
+    int i_run;
+
+    for (i_run = 0; i_run < 1000; i_run++) {
+        const guint       num_options            = nmtst_get_rand_word_length(NULL);
+        gs_unref_ptrarray GPtrArray *options     = g_ptr_array_new_with_free_func(g_free);
+        nm_auto_free_gstring GString *combined   = g_string_new(NULL);
+        gs_free const char **         strv_split = NULL;
+        guint                         i_option;
+        guint                         i;
+
+        /* Generate a list of random words for option key-value pairs. */
+        for (i_option = 0; i_option < 2u * num_options; i_option++) {
+            char *word = NULL;
+
+            if (i_option % 2u == 1 && nmtst_get_rand_uint32() % 5 == 0
+                && strlen(options->pdata[options->len - 1]) > 0u) {
+                /* For some options, leave the value unset and only generate a key.
+                 *
+                 * If key is "", then we cannot do that, because the test below would try
+                 * to append "" to the combined list, which the parser then would drop.
+                 * Only test omitting the value, if strlen() of the key is positive. */
+            } else
+                word = _escaped_tokens_create_random_word();
+            g_ptr_array_add(options, word);
+        }
+
+        /* Combine the options in one comma separated list, with proper escaping. */
+        for (i_option = 0; i_option < num_options; i_option++) {
+            _escaped_tokens_combine(combined,
+                                    options->pdata[2u * i_option + 0u],
+                                    options->pdata[2u * i_option + 1u],
+                                    FALSE,
+                                    i_option == 0,
+                                    i_option != num_options - 1);
+        }
+
+        /* ensure that we can split and parse the options without difference. */
+        strv_split = nm_utils_escaped_tokens_options_split_list(combined->str);
+        for (i_option = 0; i_option < num_options; i_option++) {
+            const char *  expected_key = options->pdata[2u * i_option + 0u];
+            const char *  expected_val = options->pdata[2u * i_option + 1u];
+            gs_free char *s_split =
+                i_option < NM_PTRARRAY_LEN(strv_split) ? g_strdup(strv_split[i_option]) : NULL;
+            const char *key = NULL;
+            const char *val = NULL;
+
+            if (s_split)
+                _escaped_tokens_split(s_split, &key, &val);
+
+            if (!nm_streq0(key, expected_key) || !nm_streq0(val, expected_val)) {
+                g_print(">>> ASSERTION IS ABOUT TO FAIL for item %5d of %5d\n",
+                        i_option,
+                        num_options);
+                g_print(">>> combined =  \"%s\"\n", combined->str);
+                g_print(">>> %c   parsed[%5d].key = \"%s\"\n",
+                        nm_streq0(key, expected_key) ? ' ' : 'X',
+                        i_option,
+                        key);
+                g_print(">>> %c   parsed[%5d].val = %s%s%s\n",
+                        nm_streq0(val, expected_val) ? ' ' : 'X',
+                        i_option,
+                        NM_PRINT_FMT_QUOTE_STRING(val));
+                for (i = 0; i < num_options; i++) {
+                    g_print(">>> %c original[%5d].key = \"%s\"\n",
+                            i == i_option ? '*' : ' ',
+                            i,
+                            (char *) options->pdata[2u * i + 0u]);
+                    g_print(">>> %c original[%5d].val = %s%s%s\n",
+                            i == i_option ? '*' : ' ',
+                            i,
+                            NM_PRINT_FMT_QUOTE_STRING((char *) options->pdata[2u * i + 1u]));
+                }
+                for (i = 0; i < NM_PTRARRAY_LEN(strv_split); i++)
+                    g_print(">>>      split[%5d]     = \"%s\"\n", i, strv_split[i]);
+            }
+
+            g_assert_cmpstr(key, ==, expected_key);
+            g_assert_cmpstr(val, ==, expected_val);
+        }
+        g_assert_cmpint(NM_PTRARRAY_LEN(strv_split), ==, num_options);
+
+        /* Above we show a full round-trip of random option key-value pairs, that they can
+         * without loss escape, concatenate, split-list, and split. This proofed that every
+         * option key-value pair can be represented as a combined string and parsed back.
+         *
+         * Now, just check that we can also parse arbitrary random words in nm_utils_escaped_tokens_options_split().
+         * split() is a non-injective surjective function. As we check the round-trip above for random words, where
+         * options-split() is the last step, we show that every random word can be the output of the function
+         * (which shows, the surjective part).
+         *
+         * But multiple random input arguments, may map to the same output argument (non-injective).
+         * Just test whether we can handle random input words without crashing. For that, just use the
+         * above generate list of random words.
+         */
+        for (i = 0; i < 1u + 2u * i_option; i++) {
+            gs_free char *str = NULL;
+            const char *  cstr;
+
+            if (i == 0)
+                cstr = combined->str;
+            else
+                cstr = options->pdata[i - 1u];
+            if (!cstr)
+                continue;
+
+            str = g_strdup(cstr);
+            _escaped_tokens_split(str, NULL, NULL);
+        }
+    }
+
+    _escaped_tokens_check_one("", NULL, "");
+    _escaped_tokens_check_one("", "", "=", " =");
+    _escaped_tokens_check_one("a", "b", "a=b", "a = b");
+    _escaped_tokens_check_one("a\\=", "b\\=", "a\\\\\\==b\\\\=", "a\\\\\\==b\\\\\\=");
+    _escaped_tokens_check_one("\\=", "\\=", "\\\\\\==\\\\=", "\\\\\\==\\\\\\=");
+    _escaped_tokens_check_one(" ", "bb=", "\\ =bb=", "\\ =bb\\=");
+    _escaped_tokens_check_one(" ", "bb\\=", "\\ =bb\\\\=", "\\ =bb\\\\\\=");
+    _escaped_tokens_check_one("a b", "a  b", "a b=a  b");
+    _escaped_tokens_check_one("a b", "a  b", "a b=a  b");
+    _escaped_tokens_check_one("a = b", "a = b", "a \\= b=a = b", "a \\= b=a \\= b");
+}
+
+/*****************************************************************************/
+
+typedef struct {
+    int   val;
+    CList lst;
+} CListSort;
+
+static int
+_c_list_sort_cmp(const CList *lst_a, const CList *lst_b, const void *user_data)
+{
+    const CListSort *a, *b;
+
+    g_assert(lst_a);
+    g_assert(lst_b);
+    g_assert(lst_a != lst_b);
+
+    a = c_list_entry(lst_a, CListSort, lst);
+    b = c_list_entry(lst_b, CListSort, lst);
+
+    if (a->val < b->val)
+        return -1;
+    if (a->val > b->val)
+        return 1;
+    return 0;
+}
+
+static void
+_do_test_c_list_sort(CListSort *elements, guint n_list, gboolean headless)
+{
+    CList            head, *iter, *iter_prev, *lst;
+    guint            i;
+    const CListSort *el_prev;
+    CListSort *      el;
+
+    c_list_init(&head);
+    for (i = 0; i < n_list; i++) {
+        el      = &elements[i];
+        el->val = nmtst_get_rand_uint32() % (2 * n_list);
+        c_list_link_tail(&head, &el->lst);
+    }
+
+    if (headless) {
+        lst = head.next;
+        c_list_unlink_stale(&head);
+        lst = c_list_sort_headless(lst, _c_list_sort_cmp, NULL);
+        g_assert(lst);
+        g_assert(lst->next);
+        g_assert(lst->prev);
+        g_assert(c_list_length(lst) == n_list - 1);
+        iter_prev = lst->prev;
+        for (iter = lst; iter != lst; iter = iter->next) {
+            g_assert(iter);
+            g_assert(iter->next);
+            g_assert(iter->prev == iter_prev);
+        }
+        c_list_link_before(lst, &head);
+    } else
+        c_list_sort(&head, _c_list_sort_cmp, NULL);
+
+    g_assert(!c_list_is_empty(&head));
+    g_assert(c_list_length(&head) == n_list);
+
+    el_prev = NULL;
+    c_list_for_each (iter, &head) {
+        el = c_list_entry(iter, CListSort, lst);
+        g_assert(el >= elements && el < &elements[n_list]);
+        if (el_prev) {
+            if (el_prev->val == el->val)
+                g_assert(el_prev < el);
+            else
+                g_assert(el_prev->val < el->val);
+            g_assert(iter->prev == &el_prev->lst);
+            g_assert(el_prev->lst.next == iter);
+        }
+        el_prev = el;
+    }
+    g_assert(head.prev == &el_prev->lst);
+}
+
+static void
+test_c_list_sort(void)
+{
+    const guint N_ELEMENTS = 10000;
+    guint       n_list, repeat;
+    gs_free CListSort *elements = NULL;
+
+    {
+        CList head;
+
+        c_list_init(&head);
+        c_list_sort(&head, _c_list_sort_cmp, NULL);
+        g_assert(c_list_length(&head) == 0);
+        g_assert(c_list_is_empty(&head));
+    }
+
+    elements = g_new0(CListSort, N_ELEMENTS);
+    for (n_list = 1; n_list < N_ELEMENTS; n_list++) {
+        if (n_list > 150) {
+            n_list += nmtst_get_rand_uint32() % n_list;
+            if (n_list >= N_ELEMENTS)
+                break;
+        }
+        {
+            const guint N_REPEAT = n_list > 50 ? 1 : 5;
+
+            for (repeat = 0; repeat < N_REPEAT; repeat++)
+                _do_test_c_list_sort(elements, n_list, nmtst_get_rand_uint32() % 2);
+        }
+    }
+}
+
+/*****************************************************************************/
+
+typedef struct {
+    NMDedupMultiObj parent;
+    guint           val;
+    guint           other;
+} DedupObj;
+
+static const NMDedupMultiObjClass dedup_obj_class;
+
+static DedupObj *
+_dedup_obj_assert(const NMDedupMultiObj *obj)
+{
+    DedupObj *o;
+
+    g_assert(obj);
+    o = (DedupObj *) obj;
+    g_assert(o->parent.klass == &dedup_obj_class);
+    g_assert(o->parent._ref_count > 0);
+    g_assert(o->val > 0);
+    return o;
+}
+
+static const NMDedupMultiObj *
+_dedup_obj_clone(const NMDedupMultiObj *obj)
+{
+    DedupObj *o, *o2;
+
+    o                     = _dedup_obj_assert(obj);
+    o2                    = g_slice_new0(DedupObj);
+    o2->parent.klass      = &dedup_obj_class;
+    o2->parent._ref_count = 1;
+    o2->val               = o->val;
+    o2->other             = o->other;
+    return (NMDedupMultiObj *) o2;
+}
+
+static void
+_dedup_obj_destroy(NMDedupMultiObj *obj)
+{
+    DedupObj *o = (DedupObj *) obj;
+
+    g_assert(o->parent._ref_count == 0);
+    o->parent._ref_count = 1;
+    o                    = _dedup_obj_assert(obj);
+    g_slice_free(DedupObj, o);
+}
+
+static void
+_dedup_obj_full_hash_update(const NMDedupMultiObj *obj, NMHashState *h)
+{
+    const DedupObj *o;
+
+    o = _dedup_obj_assert(obj);
+    nm_hash_update_vals(h, o->val, o->other);
+}
+
+static gboolean
+_dedup_obj_full_equal(const NMDedupMultiObj *obj_a, const NMDedupMultiObj *obj_b)
+{
+    const DedupObj *o_a = _dedup_obj_assert(obj_a);
+    const DedupObj *o_b = _dedup_obj_assert(obj_b);
+
+    return o_a->val == o_b->val && o_a->other == o_b->other;
+}
+
+static const NMDedupMultiObjClass dedup_obj_class = {
+    .obj_clone            = _dedup_obj_clone,
+    .obj_destroy          = _dedup_obj_destroy,
+    .obj_full_hash_update = _dedup_obj_full_hash_update,
+    .obj_full_equal       = _dedup_obj_full_equal,
+};
+
+#define DEDUP_OBJ_INIT(val_val, other_other)              \
+    (&((DedupObj){                                        \
+        .parent =                                         \
+            {                                             \
+                .klass      = &dedup_obj_class,           \
+                ._ref_count = NM_OBJ_REF_COUNT_STACKINIT, \
+            },                                            \
+        .val   = (val_val),                               \
+        .other = (other_other),                           \
+    }))
+
+typedef struct {
+    NMDedupMultiIdxType parent;
+    guint               partition_size;
+    guint               val_mod;
+} DedupIdxType;
+
+static const NMDedupMultiIdxTypeClass dedup_idx_type_class;
+
+static const DedupIdxType *
+_dedup_idx_assert(const NMDedupMultiIdxType *idx_type)
+{
+    DedupIdxType *t;
+
+    g_assert(idx_type);
+    t = (DedupIdxType *) idx_type;
+    g_assert(t->parent.klass == &dedup_idx_type_class);
+    g_assert(t->partition_size > 0);
+    g_assert(t->val_mod > 0);
+    return t;
+}
+
+static void
+_dedup_idx_obj_id_hash_update(const NMDedupMultiIdxType *idx_type,
+                              const NMDedupMultiObj *    obj,
+                              NMHashState *              h)
+{
+    const DedupIdxType *t;
+    const DedupObj *    o;
+
+    t = _dedup_idx_assert(idx_type);
+    o = _dedup_obj_assert(obj);
+
+    nm_hash_update_val(h, o->val / t->partition_size);
+    nm_hash_update_val(h, o->val % t->val_mod);
+}
+
+static gboolean
+_dedup_idx_obj_id_equal(const NMDedupMultiIdxType *idx_type,
+                        const NMDedupMultiObj *    obj_a,
+                        const NMDedupMultiObj *    obj_b)
+{
+    const DedupIdxType *t;
+    const DedupObj *    o_a;
+    const DedupObj *    o_b;
+
+    t   = _dedup_idx_assert(idx_type);
+    o_a = _dedup_obj_assert(obj_a);
+    o_b = _dedup_obj_assert(obj_b);
+
+    return (o_a->val / t->partition_size) == (o_b->val / t->partition_size)
+           && (o_a->val % t->val_mod) == (o_b->val % t->val_mod);
+}
+
+static void
+_dedup_idx_obj_partition_hash_update(const NMDedupMultiIdxType *idx_type,
+                                     const NMDedupMultiObj *    obj,
+                                     NMHashState *              h)
+{
+    const DedupIdxType *t;
+    const DedupObj *    o;
+
+    t = _dedup_idx_assert(idx_type);
+    o = _dedup_obj_assert(obj);
+
+    nm_hash_update_val(h, o->val / t->partition_size);
+}
+
+static gboolean
+_dedup_idx_obj_partition_equal(const NMDedupMultiIdxType *idx_type,
+                               const NMDedupMultiObj *    obj_a,
+                               const NMDedupMultiObj *    obj_b)
+{
+    const DedupIdxType *t;
+    const DedupObj *    o_a;
+    const DedupObj *    o_b;
+
+    t   = _dedup_idx_assert(idx_type);
+    o_a = _dedup_obj_assert(obj_a);
+    o_b = _dedup_obj_assert(obj_b);
+
+    return (o_a->val / t->partition_size) == (o_b->val / t->partition_size);
+}
+
+static const NMDedupMultiIdxTypeClass dedup_idx_type_class = {
+    .idx_obj_id_hash_update        = _dedup_idx_obj_id_hash_update,
+    .idx_obj_id_equal              = _dedup_idx_obj_id_equal,
+    .idx_obj_partition_hash_update = _dedup_idx_obj_partition_hash_update,
+    .idx_obj_partition_equal       = _dedup_idx_obj_partition_equal,
+};
+
+static const DedupIdxType *
+DEDUP_IDX_TYPE_INIT(DedupIdxType *idx_type, guint partition_size, guint val_mod)
+{
+    nm_dedup_multi_idx_type_init((NMDedupMultiIdxType *) idx_type, &dedup_idx_type_class);
+    idx_type->val_mod        = val_mod;
+    idx_type->partition_size = partition_size;
+    return idx_type;
+}
+
+static gboolean
+_dedup_idx_add(NMDedupMultiIndex *       idx,
+               const DedupIdxType *      idx_type,
+               const DedupObj *          obj,
+               NMDedupMultiIdxMode       mode,
+               const NMDedupMultiEntry **out_entry)
+{
+    g_assert(idx);
+    _dedup_idx_assert((NMDedupMultiIdxType *) idx_type);
+    if (obj)
+        _dedup_obj_assert((NMDedupMultiObj *) obj);
+    return nm_dedup_multi_index_add(idx,
+                                    (NMDedupMultiIdxType *) idx_type,
+                                    obj,
+                                    mode,
+                                    out_entry,
+                                    NULL);
+}
+
+static void
+_dedup_head_entry_assert(const NMDedupMultiHeadEntry *entry)
+{
+    g_assert(entry);
+    g_assert(entry->len > 0);
+    g_assert(entry->len == c_list_length(&entry->lst_entries_head));
+    g_assert(entry->idx_type);
+    g_assert(entry->is_head);
+}
+
+static const DedupObj *
+_dedup_entry_assert(const NMDedupMultiEntry *entry)
+{
+    g_assert(entry);
+    g_assert(!c_list_is_empty(&entry->lst_entries));
+    g_assert(entry->head);
+    g_assert(!entry->is_head);
+    g_assert(entry->head != (gpointer) entry);
+    _dedup_head_entry_assert(entry->head);
+    return _dedup_obj_assert(entry->obj);
+}
+
+static const DedupIdxType *
+_dedup_entry_get_idx_type(const NMDedupMultiEntry *entry)
+{
+    _dedup_entry_assert(entry);
+
+    g_assert(entry->head);
+    g_assert(entry->head->idx_type);
+    return _dedup_idx_assert(entry->head->idx_type);
+}
+
+static void
+_dedup_entry_assert_all(const NMDedupMultiEntry *entry,
+                        gssize                   expected_idx,
+                        const DedupObj *const *  expected_obj)
+{
+    gsize  n, i;
+    CList *iter;
+
+    g_assert(entry);
+    _dedup_entry_assert(entry);
+
+    g_assert(expected_obj);
+    n = NM_PTRARRAY_LEN(expected_obj);
+
+    g_assert(n == c_list_length(&entry->lst_entries));
+
+    g_assert(expected_idx >= -1 && expected_idx < n);
+    g_assert(entry->head);
+    if (expected_idx == -1)
+        g_assert(entry->head == (gpointer) entry);
+    else
+        g_assert(entry->head != (gpointer) entry);
+
+    i = 0;
+    c_list_for_each (iter, &entry->head->lst_entries_head) {
+        const NMDedupMultiEntry *entry_current = c_list_entry(iter, NMDedupMultiEntry, lst_entries);
+        const DedupObj *         obj_current;
+        const DedupIdxType *     idx_type = _dedup_entry_get_idx_type(entry_current);
+
+        obj_current = _dedup_entry_assert(entry_current);
+        g_assert(obj_current);
+        g_assert(i < n);
+        if (expected_idx == i)
+            g_assert(entry_current == entry);
+        g_assert(idx_type->parent.klass->idx_obj_partition_equal(
+            &idx_type->parent,
+            entry_current->obj,
+            c_list_entry(entry->head->lst_entries_head.next, NMDedupMultiEntry, lst_entries)->obj));
+        i++;
+    }
+}
+#define _dedup_entry_assert_all(entry, expected_idx, ...) \
+    _dedup_entry_assert_all(entry, expected_idx, (const DedupObj *const[]){__VA_ARGS__, NULL})
+
+static void
+test_dedup_multi(void)
+{
+    NMDedupMultiIndex *       idx;
+    DedupIdxType              IDX_20_3_a_stack;
+    const DedupIdxType *const IDX_20_3_a = DEDUP_IDX_TYPE_INIT(&IDX_20_3_a_stack, 20, 3);
+    const NMDedupMultiEntry * entry1;
+
+    idx = nm_dedup_multi_index_new();
+
+    g_assert(_dedup_idx_add(idx,
+                            IDX_20_3_a,
+                            DEDUP_OBJ_INIT(1, 1),
+                            NM_DEDUP_MULTI_IDX_MODE_APPEND,
+                            &entry1));
+    _dedup_entry_assert_all(entry1, 0, DEDUP_OBJ_INIT(1, 1));
+
+    g_assert(nm_dedup_multi_index_obj_find(idx, (NMDedupMultiObj *) DEDUP_OBJ_INIT(1, 1)));
+    g_assert(!nm_dedup_multi_index_obj_find(idx, (NMDedupMultiObj *) DEDUP_OBJ_INIT(1, 2)));
+
+    g_assert(_dedup_idx_add(idx,
+                            IDX_20_3_a,
+                            DEDUP_OBJ_INIT(1, 2),
+                            NM_DEDUP_MULTI_IDX_MODE_APPEND,
+                            &entry1));
+    _dedup_entry_assert_all(entry1, 0, DEDUP_OBJ_INIT(1, 2));
+
+    g_assert(!nm_dedup_multi_index_obj_find(idx, (NMDedupMultiObj *) DEDUP_OBJ_INIT(1, 1)));
+    g_assert(nm_dedup_multi_index_obj_find(idx, (NMDedupMultiObj *) DEDUP_OBJ_INIT(1, 2)));
+
+    g_assert(_dedup_idx_add(idx,
+                            IDX_20_3_a,
+                            DEDUP_OBJ_INIT(2, 2),
+                            NM_DEDUP_MULTI_IDX_MODE_APPEND,
+                            &entry1));
+    _dedup_entry_assert_all(entry1, 1, DEDUP_OBJ_INIT(1, 2), DEDUP_OBJ_INIT(2, 2));
+
+    nm_dedup_multi_index_unref(idx);
+}
+
+/*****************************************************************************/
+
+static NMConnection *
+_connection_new_from_dbus(GVariant *dict, GError **error)
+{
+    return _nm_simple_connection_new_from_dbus(dict, NM_SETTING_PARSE_FLAGS_NORMALIZE, error);
+}
+
+static void
+vpn_check_func(const char *key, const char *value, gpointer user_data)
+{
+    if (!strcmp(key, "foobar1")) {
+        g_assert_cmpstr(value, ==, "blahblah1");
+        return;
+    }
+
+    if (!strcmp(key, "foobar2")) {
+        g_assert_cmpstr(value, ==, "blahblah2");
+        return;
+    }
+
+    if (!strcmp(key, "foobar3")) {
+        g_assert_cmpstr(value, ==, "blahblah3");
+        return;
+    }
+
+    if (!strcmp(key, "foobar4")) {
+        g_assert_cmpstr(value, ==, "blahblah4");
+        return;
+    }
+
+    g_assert_not_reached();
+}
+
+static void
+vpn_check_empty_func(const char *key, const char *value, gpointer user_data)
+{
+    g_assert_not_reached();
+}
+
+static void
+test_setting_vpn_items(void)
+{
+    gs_unref_object NMConnection *connection = NULL;
+    NMSettingVpn *                s_vpn;
+
+    connection =
+        nmtst_create_minimal_connection("vpn-items", NULL, NM_SETTING_VPN_SETTING_NAME, NULL);
+
+    s_vpn = nm_connection_get_setting_vpn(connection);
+
+    nm_setting_vpn_add_data_item(s_vpn, "foobar1", "blahblah1");
+    nm_setting_vpn_add_data_item(s_vpn, "foobar2", "blahblah2");
+    nm_setting_vpn_add_data_item(s_vpn, "foobar3", "blahblah3");
+    nm_setting_vpn_add_data_item(s_vpn, "foobar4", "blahblah4");
+
+    /* Ensure that added values are all present */
+    nm_setting_vpn_foreach_data_item(s_vpn, vpn_check_func, NULL);
+    nm_setting_vpn_remove_data_item(s_vpn, "foobar1");
+    nm_setting_vpn_remove_data_item(s_vpn, "foobar2");
+    nm_setting_vpn_remove_data_item(s_vpn, "foobar3");
+    nm_setting_vpn_remove_data_item(s_vpn, "foobar4");
+
+    g_assert(!_nm_connection_aggregate(connection, NM_CONNECTION_AGGREGATE_ANY_SECRETS, NULL));
+    g_assert(!_nm_connection_aggregate(connection,
+                                       NM_CONNECTION_AGGREGATE_ANY_SYSTEM_SECRET_FLAGS,
+                                       NULL));
+
+    nm_setting_vpn_add_secret(s_vpn, "foobar1", "blahblah1");
+
+    g_assert(_nm_connection_aggregate(connection, NM_CONNECTION_AGGREGATE_ANY_SECRETS, NULL));
+    g_assert(_nm_connection_aggregate(connection,
+                                      NM_CONNECTION_AGGREGATE_ANY_SYSTEM_SECRET_FLAGS,
+                                      NULL));
+
+    nm_setting_vpn_add_secret(s_vpn, "foobar2", "blahblah2");
+    nm_setting_vpn_add_secret(s_vpn, "foobar3", "blahblah3");
+    nm_setting_vpn_add_secret(s_vpn, "foobar4", "blahblah4");
+
+    /* Ensure that added values are all present */
+    nm_setting_vpn_foreach_secret(s_vpn, vpn_check_func, NULL);
+    nm_setting_vpn_remove_secret(s_vpn, "foobar1");
+    nm_setting_vpn_remove_secret(s_vpn, "foobar2");
+    nm_setting_vpn_remove_secret(s_vpn, "foobar3");
+
+    g_assert(_nm_connection_aggregate(connection, NM_CONNECTION_AGGREGATE_ANY_SECRETS, NULL));
+    g_assert(_nm_connection_aggregate(connection,
+                                      NM_CONNECTION_AGGREGATE_ANY_SYSTEM_SECRET_FLAGS,
+                                      NULL));
+
+    nm_setting_vpn_add_data_item(s_vpn, "foobar4-flags", "blahblah4");
+
+    g_assert(_nm_connection_aggregate(connection,
+                                      NM_CONNECTION_AGGREGATE_ANY_SYSTEM_SECRET_FLAGS,
+                                      NULL));
+
+    nm_setting_vpn_add_data_item(s_vpn, "foobar4-flags", "2");
+
+    g_assert(!_nm_connection_aggregate(connection,
+                                       NM_CONNECTION_AGGREGATE_ANY_SYSTEM_SECRET_FLAGS,
+                                       NULL));
+
+    nm_setting_vpn_remove_secret(s_vpn, "foobar4");
+
+    g_assert(!_nm_connection_aggregate(connection, NM_CONNECTION_AGGREGATE_ANY_SECRETS, NULL));
+    g_assert(!_nm_connection_aggregate(connection,
+                                       NM_CONNECTION_AGGREGATE_ANY_SYSTEM_SECRET_FLAGS,
+                                       NULL));
+
+    nm_setting_vpn_remove_data_item(s_vpn, "foobar4-flags");
+
+    /* Try to add some blank values and make sure they are rejected */
+    NMTST_EXPECT_LIBNM_CRITICAL(NMTST_G_RETURN_MSG(key && key[0]));
+    nm_setting_vpn_add_data_item(s_vpn, NULL, NULL);
+    g_test_assert_expected_messages();
+
+    NMTST_EXPECT_LIBNM_CRITICAL(NMTST_G_RETURN_MSG(key && key[0]));
+    nm_setting_vpn_add_data_item(s_vpn, "", "");
+    g_test_assert_expected_messages();
+
+    nm_setting_vpn_add_data_item(s_vpn, "foobar1", "");
+    g_assert_cmpstr(nm_setting_vpn_get_data_item(s_vpn, "foobar1"), ==, "");
+
+    nm_setting_vpn_add_data_item(s_vpn, "foobar1", NULL);
+    g_assert_cmpstr(nm_setting_vpn_get_data_item(s_vpn, "foobar1"), ==, NULL);
+
+    NMTST_EXPECT_LIBNM_CRITICAL(NMTST_G_RETURN_MSG(key && key[0]));
+    nm_setting_vpn_add_data_item(s_vpn, NULL, "blahblah1");
+    g_test_assert_expected_messages();
+
+    NMTST_EXPECT_LIBNM_CRITICAL(NMTST_G_RETURN_MSG(key && key[0]));
+    nm_setting_vpn_add_data_item(s_vpn, "", "blahblah1");
+    g_test_assert_expected_messages();
+
+    nm_setting_vpn_foreach_data_item(s_vpn, vpn_check_empty_func, NULL);
+
+    /* Try to add some blank secrets and make sure they are rejected */
+    NMTST_EXPECT_LIBNM_CRITICAL(NMTST_G_RETURN_MSG(key && key[0]));
+    nm_setting_vpn_add_secret(s_vpn, NULL, NULL);
+    g_test_assert_expected_messages();
+
+    NMTST_EXPECT_LIBNM_CRITICAL(NMTST_G_RETURN_MSG(key && key[0]));
+    nm_setting_vpn_add_secret(s_vpn, "", "");
+    g_test_assert_expected_messages();
+
+    nm_setting_vpn_add_secret(s_vpn, "foobar1", "");
+
+    nm_setting_vpn_add_secret(s_vpn, "foobar1", NULL);
+
+    NMTST_EXPECT_LIBNM_CRITICAL(NMTST_G_RETURN_MSG(key && key[0]));
+    nm_setting_vpn_add_secret(s_vpn, NULL, "blahblah1");
+    g_test_assert_expected_messages();
+
+    NMTST_EXPECT_LIBNM_CRITICAL(NMTST_G_RETURN_MSG(key && key[0]));
+    nm_setting_vpn_add_secret(s_vpn, "", "blahblah1");
+    g_test_assert_expected_messages();
+
+    nm_setting_vpn_foreach_secret(s_vpn, vpn_check_empty_func, NULL);
+}
+
+static void
+test_setting_vpn_update_secrets(void)
+{
+    NMConnection *  connection;
+    NMSettingVpn *  s_vpn;
+    GVariantBuilder settings_builder, vpn_builder, secrets_builder;
+    GVariant *      settings;
+    gboolean        success;
+    GError *        error = NULL;
+    const char *    tmp;
+    const char *    key1 = "foobar";
+    const char *    key2 = "blahblah";
+    const char *    val1 = "value1";
+    const char *    val2 = "value2";
+
+    connection = nm_simple_connection_new();
+    s_vpn      = (NMSettingVpn *) nm_setting_vpn_new();
+    nm_connection_add_setting(connection, NM_SETTING(s_vpn));
+
+    g_variant_builder_init(&settings_builder, NM_VARIANT_TYPE_CONNECTION);
+    g_variant_builder_init(&vpn_builder, NM_VARIANT_TYPE_SETTING);
+    g_variant_builder_init(&secrets_builder, G_VARIANT_TYPE("a{ss}"));
+
+    g_variant_builder_add(&secrets_builder, "{ss}", key1, val1);
+    g_variant_builder_add(&secrets_builder, "{ss}", key2, val2);
+
+    g_variant_builder_add(&vpn_builder,
+                          "{sv}",
+                          NM_SETTING_VPN_SECRETS,
+                          g_variant_builder_end(&secrets_builder));
+    g_variant_builder_add(&settings_builder, "{sa{sv}}", NM_SETTING_VPN_SETTING_NAME, &vpn_builder);
+    settings = g_variant_builder_end(&settings_builder);
+
+    success =
+        nm_connection_update_secrets(connection, NM_SETTING_VPN_SETTING_NAME, settings, &error);
+    g_assert_no_error(error);
+    g_assert(success);
+
+    /* Read the secrets back out */
+    tmp = nm_setting_vpn_get_secret(s_vpn, key1);
+    g_assert(tmp);
+    g_assert_cmpstr(tmp, ==, val1);
+
+    tmp = nm_setting_vpn_get_secret(s_vpn, key2);
+    g_assert(tmp);
+    g_assert_cmpstr(tmp, ==, val2);
+
+    g_variant_unref(settings);
+    g_object_unref(connection);
+}
+
+#define TO_DEL_NUM 50
+typedef struct {
+    NMSettingVpn *s_vpn;
+    char *        to_del[TO_DEL_NUM];
+    guint         called;
+} IterInfo;
+
+static void
+del_iter_func(const char *key, const char *value, gpointer user_data)
+{
+    IterInfo *info = user_data;
+    int       i;
+
+    /* Record how many times this function gets called; it should get called
+     * exactly as many times as there are keys in the hash table, regardless
+     * of what keys we delete from the table.
+     */
+    info->called++;
+
+    /* During the iteration, remove a bunch of stuff from the table */
+    if (info->called == 1) {
+        for (i = 0; i < TO_DEL_NUM; i++)
+            nm_setting_vpn_remove_data_item(info->s_vpn, info->to_del[i]);
+    }
+}
+
+static void
+test_setting_vpn_modify_during_foreach(void)
+{
+    NMSettingVpn *s_vpn;
+    IterInfo      info;
+    char *        key, *val;
+    int           i, u = 0;
+
+    s_vpn = (NMSettingVpn *) nm_setting_vpn_new();
+    g_assert(s_vpn);
+
+    for (i = 0; i < TO_DEL_NUM * 2; i++) {
+        key = g_strdup_printf("adsfasdfadf%d", i);
+        val = g_strdup_printf("42263236236awt%d", i);
+        nm_setting_vpn_add_data_item(s_vpn, key, val);
+
+        /* Cache some keys to delete */
+        if (i % 2)
+            info.to_del[u++] = g_strdup(key);
+
+        g_free(key);
+        g_free(val);
+    }
+
+    /* Iterate over current table keys */
+    info.s_vpn  = s_vpn;
+    info.called = 0;
+    nm_setting_vpn_foreach_data_item(s_vpn, del_iter_func, &info);
+
+    /* Make sure all the things we removed during iteration are really gone */
+    for (i = 0; i < TO_DEL_NUM; i++) {
+        g_assert_cmpstr(nm_setting_vpn_get_data_item(s_vpn, info.to_del[i]), ==, NULL);
+        g_free(info.to_del[i]);
+    }
+
+    /* And make sure the foreach callback was called the same number of times
+     * as there were keys in the table at the beginning of the foreach.
+     */
+    g_assert_cmpint(info.called, ==, TO_DEL_NUM * 2);
+
+    g_object_unref(s_vpn);
+}
+
+static void
+test_setting_ip4_config_labels(void)
+{
+    NMSettingIPConfig *s_ip4;
+    NMIPAddress *      addr;
+    GVariant *         label;
+    GPtrArray *        addrs;
+    char **            labels;
+    NMConnection *     conn;
+    GVariant *         dict, *dict2, *setting_dict, *value;
+    GError *           error = NULL;
+
+    s_ip4 = (NMSettingIPConfig *) nm_setting_ip4_config_new();
+    g_object_set(G_OBJECT(s_ip4),
+                 NM_SETTING_IP_CONFIG_METHOD,
+                 NM_SETTING_IP4_CONFIG_METHOD_MANUAL,
+                 NULL);
+
+    /* addr 1 */
+    addr = nm_ip_address_new(AF_INET, "1.2.3.4", 24, &error);
+    g_assert_no_error(error);
+
+    nm_setting_ip_config_add_address(s_ip4, addr);
+    nm_ip_address_unref(addr);
+    nmtst_assert_setting_verifies(NM_SETTING(s_ip4));
+
+    addr  = nm_setting_ip_config_get_address(s_ip4, 0);
+    label = nm_ip_address_get_attribute(addr, NM_IP_ADDRESS_ATTRIBUTE_LABEL);
+    g_assert(label == NULL);
+
+    /* The 'address-labels' property should be omitted from the serialization if
+     * there are no non-NULL labels.
+     */
+    conn = nmtst_create_minimal_connection("label test", NULL, NM_SETTING_WIRED_SETTING_NAME, NULL);
+    nm_connection_add_setting(conn, nm_setting_duplicate(NM_SETTING(s_ip4)));
+    dict = nm_connection_to_dbus(conn, NM_CONNECTION_SERIALIZE_ALL);
+    g_object_unref(conn);
+
+    setting_dict =
+        g_variant_lookup_value(dict, NM_SETTING_IP4_CONFIG_SETTING_NAME, NM_VARIANT_TYPE_SETTING);
+    g_assert(setting_dict != NULL);
+
+    value = g_variant_lookup_value(setting_dict, "address-labels", NULL);
+    g_assert(value == NULL);
+
+    g_variant_unref(setting_dict);
+    g_variant_unref(dict);
+
+    /* Now back to constructing the original s_ip4... */
+
+    /* addr 2 */
+    addr = nm_ip_address_new(AF_INET, "2.3.4.5", 24, &error);
+    g_assert_no_error(error);
+    nm_ip_address_set_attribute(addr,
+                                NM_IP_ADDRESS_ATTRIBUTE_LABEL,
+                                g_variant_new_string("eth0:1"));
+
+    nm_setting_ip_config_add_address(s_ip4, addr);
+    nm_ip_address_unref(addr);
+    nmtst_assert_setting_verifies(NM_SETTING(s_ip4));
+
+    addr  = nm_setting_ip_config_get_address(s_ip4, 1);
+    label = nm_ip_address_get_attribute(addr, NM_IP_ADDRESS_ATTRIBUTE_LABEL);
+    g_assert(label != NULL);
+    g_assert_cmpstr(g_variant_get_string(label, NULL), ==, "eth0:1");
+
+    /* addr 3 */
+    addr = nm_ip_address_new(AF_INET, "3.4.5.6", 24, &error);
+    g_assert_no_error(error);
+    nm_ip_address_set_attribute(addr, NM_IP_ADDRESS_ATTRIBUTE_LABEL, NULL);
+
+    nm_setting_ip_config_add_address(s_ip4, addr);
+    nm_ip_address_unref(addr);
+    nmtst_assert_setting_verifies(NM_SETTING(s_ip4));
+
+    addr  = nm_setting_ip_config_get_address(s_ip4, 2);
+    label = nm_ip_address_get_attribute(addr, NM_IP_ADDRESS_ATTRIBUTE_LABEL);
+    g_assert(label == NULL);
+
+    /* Remove addr 1 and re-verify remaining addresses */
+    nm_setting_ip_config_remove_address(s_ip4, 0);
+    nmtst_assert_setting_verifies(NM_SETTING(s_ip4));
+
+    addr = nm_setting_ip_config_get_address(s_ip4, 0);
+    g_assert_cmpstr(nm_ip_address_get_address(addr), ==, "2.3.4.5");
+    label = nm_ip_address_get_attribute(addr, NM_IP_ADDRESS_ATTRIBUTE_LABEL);
+    g_assert(label != NULL);
+    g_assert_cmpstr(g_variant_get_string(label, NULL), ==, "eth0:1");
+
+    addr = nm_setting_ip_config_get_address(s_ip4, 1);
+    g_assert_cmpstr(nm_ip_address_get_address(addr), ==, "3.4.5.6");
+    label = nm_ip_address_get_attribute(addr, NM_IP_ADDRESS_ATTRIBUTE_LABEL);
+    g_assert(label == NULL);
+
+    /* If we serialize as the daemon, the labels should appear in the D-Bus
+     * serialization under both 'address-labels' and 'address-data'.
+     */
+    conn = nmtst_create_minimal_connection("label test", NULL, NM_SETTING_WIRED_SETTING_NAME, NULL);
+    nm_connection_add_setting(conn, NM_SETTING(s_ip4));
+    _nm_utils_is_manager_process = TRUE;
+    dict                         = nm_connection_to_dbus(conn, NM_CONNECTION_SERIALIZE_ALL);
+    _nm_utils_is_manager_process = FALSE;
+    g_object_unref(conn);
+
+    setting_dict =
+        g_variant_lookup_value(dict, NM_SETTING_IP4_CONFIG_SETTING_NAME, NM_VARIANT_TYPE_SETTING);
+    g_assert(setting_dict != NULL);
+
+    value = g_variant_lookup_value(setting_dict, "address-labels", G_VARIANT_TYPE_STRING_ARRAY);
+    g_assert(value != NULL);
+    g_variant_get(value, "^as", &labels);
+    g_assert_cmpint(g_strv_length(labels), ==, 2);
+    g_assert_cmpstr(labels[0], ==, "eth0:1");
+    g_assert_cmpstr(labels[1], ==, "");
+    g_variant_unref(value);
+    g_strfreev(labels);
+
+    value = g_variant_lookup_value(setting_dict, "address-data", G_VARIANT_TYPE("aa{sv}"));
+    addrs = nm_utils_ip_addresses_from_variant(value, AF_INET);
+    g_variant_unref(value);
+    g_assert(addrs != NULL);
+    g_assert_cmpint(addrs->len, ==, 2);
+    addr  = addrs->pdata[0];
+    label = nm_ip_address_get_attribute(addr, NM_IP_ADDRESS_ATTRIBUTE_LABEL);
+    g_assert(label != NULL);
+    g_assert_cmpstr(g_variant_get_string(label, NULL), ==, "eth0:1");
+    addr  = addrs->pdata[1];
+    label = nm_ip_address_get_attribute(addr, NM_IP_ADDRESS_ATTRIBUTE_LABEL);
+    g_assert(label == NULL);
+    g_ptr_array_unref(addrs);
+
+    g_variant_unref(setting_dict);
+
+    /* We should be able to deserialize the labels from either 'address-labels'
+     * or 'address-data'.
+     */
+    dict2 = g_variant_ref(dict);
+
+    NMTST_VARIANT_EDITOR(
+        dict, NMTST_VARIANT_DROP_PROPERTY(NM_SETTING_IP4_CONFIG_SETTING_NAME, "address-data"););
+    conn = _connection_new_from_dbus(dict, &error);
+    g_assert_no_error(error);
+    g_variant_unref(dict);
+
+    s_ip4 = nm_connection_get_setting_ip4_config(conn);
+
+    addr = nm_setting_ip_config_get_address(s_ip4, 0);
+    g_assert_cmpstr(nm_ip_address_get_address(addr), ==, "2.3.4.5");
+    label = nm_ip_address_get_attribute(addr, NM_IP_ADDRESS_ATTRIBUTE_LABEL);
+    g_assert(label != NULL);
+    g_assert_cmpstr(g_variant_get_string(label, NULL), ==, "eth0:1");
+
+    addr = nm_setting_ip_config_get_address(s_ip4, 1);
+    g_assert_cmpstr(nm_ip_address_get_address(addr), ==, "3.4.5.6");
+    label = nm_ip_address_get_attribute(addr, NM_IP_ADDRESS_ATTRIBUTE_LABEL);
+    g_assert(label == NULL);
+
+    g_object_unref(conn);
+
+    NMTST_VARIANT_EDITOR(
+        dict2, NMTST_VARIANT_DROP_PROPERTY(NM_SETTING_IP4_CONFIG_SETTING_NAME, "address-labels"););
+    conn = _connection_new_from_dbus(dict2, &error);
+    g_assert_no_error(error);
+    g_variant_unref(dict2);
+
+    s_ip4 = nm_connection_get_setting_ip4_config(conn);
+
+    addr = nm_setting_ip_config_get_address(s_ip4, 0);
+    g_assert_cmpstr(nm_ip_address_get_address(addr), ==, "2.3.4.5");
+    label = nm_ip_address_get_attribute(addr, NM_IP_ADDRESS_ATTRIBUTE_LABEL);
+    g_assert_cmpstr(g_variant_get_string(label, NULL), ==, "eth0:1");
+
+    addr = nm_setting_ip_config_get_address(s_ip4, 1);
+    g_assert_cmpstr(nm_ip_address_get_address(addr), ==, "3.4.5.6");
+    label = nm_ip_address_get_attribute(addr, NM_IP_ADDRESS_ATTRIBUTE_LABEL);
+    g_assert(label == NULL);
+
+    /* Test explicit property assignment */
+    g_object_get(G_OBJECT(s_ip4), NM_SETTING_IP_CONFIG_ADDRESSES, &addrs, NULL);
+
+    nm_setting_ip_config_clear_addresses(s_ip4);
+    g_assert_cmpint(nm_setting_ip_config_get_num_addresses(s_ip4), ==, 0);
+
+    g_object_set(G_OBJECT(s_ip4), NM_SETTING_IP_CONFIG_ADDRESSES, addrs, NULL);
+    g_ptr_array_unref(addrs);
+    nmtst_assert_setting_verifies(NM_SETTING(s_ip4));
+    g_assert_cmpint(nm_setting_ip_config_get_num_addresses(s_ip4), ==, 2);
+
+    addr = nm_setting_ip_config_get_address(s_ip4, 0);
+    g_assert_cmpstr(nm_ip_address_get_address(addr), ==, "2.3.4.5");
+    label = nm_ip_address_get_attribute(addr, NM_IP_ADDRESS_ATTRIBUTE_LABEL);
+    g_assert(label != NULL);
+    g_assert_cmpstr(g_variant_get_string(label, NULL), ==, "eth0:1");
+
+    addr = nm_setting_ip_config_get_address(s_ip4, 1);
+    g_assert_cmpstr(nm_ip_address_get_address(addr), ==, "3.4.5.6");
+    label = nm_ip_address_get_attribute(addr, NM_IP_ADDRESS_ATTRIBUTE_LABEL);
+    g_assert(label == NULL);
+
+    g_object_unref(conn);
+}
+
+static void
+test_setting_ip4_config_address_data(void)
+{
+    NMSettingIPConfig *s_ip4;
+    NMIPAddress *      addr;
+    GPtrArray *        addrs;
+    NMConnection *     conn;
+    GVariant *         dict, *setting_dict, *value;
+    GError *           error = NULL;
+
+    s_ip4 = (NMSettingIPConfig *) nm_setting_ip4_config_new();
+    g_object_set(G_OBJECT(s_ip4),
+                 NM_SETTING_IP_CONFIG_METHOD,
+                 NM_SETTING_IP4_CONFIG_METHOD_MANUAL,
+                 NULL);
+
+    /* addr 1 */
+    addr = nm_ip_address_new(AF_INET, "1.2.3.4", 24, &error);
+    g_assert_no_error(error);
+    nm_ip_address_set_attribute(addr, "one", g_variant_new_string("foo"));
+    nm_ip_address_set_attribute(addr, "two", g_variant_new_int32(42));
+
+    nm_setting_ip_config_add_address(s_ip4, addr);
+    nm_ip_address_unref(addr);
+    nmtst_assert_setting_verifies(NM_SETTING(s_ip4));
+
+    /* addr 2 */
+    addr = nm_ip_address_new(AF_INET, "2.3.4.5", 24, &error);
+    g_assert_no_error(error);
+
+    nm_setting_ip_config_add_address(s_ip4, addr);
+    nm_ip_address_unref(addr);
+    nmtst_assert_setting_verifies(NM_SETTING(s_ip4));
+
+    /* The client-side D-Bus serialization should include the attributes in
+     * "address-data", and should not have an "addresses" property.
+     */
+    conn = nmtst_create_minimal_connection("address-data test",
+                                           NULL,
+                                           NM_SETTING_WIRED_SETTING_NAME,
+                                           NULL);
+    nm_connection_add_setting(conn, NM_SETTING(s_ip4));
+    dict = nm_connection_to_dbus(conn, NM_CONNECTION_SERIALIZE_ALL);
+
+    setting_dict =
+        g_variant_lookup_value(dict, NM_SETTING_IP4_CONFIG_SETTING_NAME, NM_VARIANT_TYPE_SETTING);
+    g_assert(setting_dict != NULL);
+
+    value = g_variant_lookup_value(setting_dict, "addresses", NULL);
+    g_assert(value == NULL);
+
+    value = g_variant_lookup_value(setting_dict, "address-data", G_VARIANT_TYPE("aa{sv}"));
+    addrs = nm_utils_ip_addresses_from_variant(value, AF_INET);
+    g_variant_unref(value);
+    g_assert(addrs != NULL);
+    g_assert_cmpint(addrs->len, ==, 2);
+
+    addr = addrs->pdata[0];
+    g_assert_cmpstr(nm_ip_address_get_address(addr), ==, "1.2.3.4");
+    value = nm_ip_address_get_attribute(addr, "one");
+    g_assert(value != NULL);
+    g_assert_cmpstr(g_variant_get_string(value, NULL), ==, "foo");
+    value = nm_ip_address_get_attribute(addr, "two");
+    g_assert(value != NULL);
+    g_assert_cmpint(g_variant_get_int32(value), ==, 42);
+
+    g_ptr_array_unref(addrs);
+    g_variant_unref(setting_dict);
+    g_variant_unref(dict);
+
+    /* The daemon-side serialization should include both 'addresses' and 'address-data' */
+    _nm_utils_is_manager_process = TRUE;
+    dict                         = nm_connection_to_dbus(conn, NM_CONNECTION_SERIALIZE_ALL);
+    _nm_utils_is_manager_process = FALSE;
+
+    setting_dict =
+        g_variant_lookup_value(dict, NM_SETTING_IP4_CONFIG_SETTING_NAME, NM_VARIANT_TYPE_SETTING);
+    g_assert(setting_dict != NULL);
+
+    value = g_variant_lookup_value(setting_dict, "addresses", G_VARIANT_TYPE("aau"));
+    g_assert(value != NULL);
+    g_variant_unref(value);
+
+    value = g_variant_lookup_value(setting_dict, "address-data", G_VARIANT_TYPE("aa{sv}"));
+    g_assert(value != NULL);
+    g_variant_unref(value);
+
+    g_variant_unref(setting_dict);
+    g_object_unref(conn);
+
+    /* When we reserialize that dictionary as a client, 'address-data' will be preferred. */
+    conn = _connection_new_from_dbus(dict, &error);
+    g_assert_no_error(error);
+
+    s_ip4 = nm_connection_get_setting_ip4_config(conn);
+
+    addr = nm_setting_ip_config_get_address(s_ip4, 0);
+    g_assert_cmpstr(nm_ip_address_get_address(addr), ==, "1.2.3.4");
+    value = nm_ip_address_get_attribute(addr, "one");
+    g_assert(value != NULL);
+    g_assert_cmpstr(g_variant_get_string(value, NULL), ==, "foo");
+    value = nm_ip_address_get_attribute(addr, "two");
+    g_assert(value != NULL);
+    g_assert_cmpint(g_variant_get_int32(value), ==, 42);
+
+    /* But on the server side, 'addresses' will have precedence. */
+    _nm_utils_is_manager_process = TRUE;
+    conn                         = _connection_new_from_dbus(dict, &error);
+    _nm_utils_is_manager_process = FALSE;
+    g_assert_no_error(error);
+    g_variant_unref(dict);
+
+    s_ip4 = nm_connection_get_setting_ip4_config(conn);
+
+    addr = nm_setting_ip_config_get_address(s_ip4, 0);
+    g_assert_cmpstr(nm_ip_address_get_address(addr), ==, "1.2.3.4");
+    value = nm_ip_address_get_attribute(addr, "one");
+    g_assert(value == NULL);
+    value = nm_ip_address_get_attribute(addr, "two");
+    g_assert(value == NULL);
+
+    g_object_unref(conn);
+}
+
+static void
+test_setting_ip_route_attributes(void)
+{
+    GVariant *variant;
+    gboolean  res, known;
+
+#define TEST_ATTR(name, type, value, family, exp_res, exp_known)                   \
+    variant = g_variant_new_##type(value);                                         \
+    res     = nm_ip_route_attribute_validate(name, variant, family, &known, NULL); \
+    g_assert(res == exp_res);                                                      \
+    g_assert(known == exp_known);                                                  \
+    g_variant_unref(variant);
+
+    TEST_ATTR("foo", uint32, 12, AF_INET, FALSE, FALSE);
+
+    TEST_ATTR("tos", byte, 127, AF_INET, TRUE, TRUE);
+    TEST_ATTR("tos", string, "0x28", AF_INET, FALSE, TRUE);
+
+    TEST_ATTR("cwnd", uint32, 10, AF_INET, TRUE, TRUE);
+    TEST_ATTR("cwnd", string, "11", AF_INET, FALSE, TRUE);
+
+    TEST_ATTR("lock-mtu", boolean, TRUE, AF_INET, TRUE, TRUE);
+    TEST_ATTR("lock-mtu", uint32, 1, AF_INET, FALSE, TRUE);
+
+    TEST_ATTR("from", string, "fd01::1", AF_INET6, TRUE, TRUE);
+    TEST_ATTR("from", string, "fd01::1/64", AF_INET6, TRUE, TRUE);
+    TEST_ATTR("from", string, "fd01::1/128", AF_INET6, TRUE, TRUE);
+    TEST_ATTR("from", string, "fd01::1/129", AF_INET6, FALSE, TRUE);
+    TEST_ATTR("from", string, "fd01::1/a", AF_INET6, FALSE, TRUE);
+    TEST_ATTR("from", string, "abc/64", AF_INET6, FALSE, TRUE);
+    TEST_ATTR("from", string, "1.2.3.4", AF_INET, FALSE, TRUE);
+    TEST_ATTR("from", string, "1.2.3.4", AF_INET6, FALSE, TRUE);
+
+    TEST_ATTR("src", string, "1.2.3.4", AF_INET, TRUE, TRUE);
+    TEST_ATTR("src", string, "1.2.3.4", AF_INET6, FALSE, TRUE);
+    TEST_ATTR("src", string, "1.2.3.0/24", AF_INET, FALSE, TRUE);
+    TEST_ATTR("src", string, "fd01::12", AF_INET6, TRUE, TRUE);
+
+    TEST_ATTR("type", string, "local", AF_INET, TRUE, TRUE);
+    TEST_ATTR("type", string, "local", AF_INET6, TRUE, TRUE);
+    TEST_ATTR("type", string, "unicast", AF_INET, TRUE, TRUE);
+    TEST_ATTR("type", string, "unicast", AF_INET6, TRUE, TRUE);
+
+#undef TEST_ATTR
+}
+
+static void
+test_setting_gsm_apn_spaces(void)
+{
+    gs_unref_object NMSettingGsm *s_gsm = NULL;
+    const char *                  tmp;
+
+    s_gsm = (NMSettingGsm *) nm_setting_gsm_new();
+    g_assert(s_gsm);
+
+    /* Trailing space */
+    g_object_set(s_gsm, NM_SETTING_GSM_APN, "foobar ", NULL);
+    tmp = nm_setting_gsm_get_apn(s_gsm);
+    g_assert_cmpstr(tmp, ==, "foobar");
+
+    /* Leading space */
+    g_object_set(s_gsm, NM_SETTING_GSM_APN, " foobar", NULL);
+    tmp = nm_setting_gsm_get_apn(s_gsm);
+    g_assert_cmpstr(tmp, ==, "foobar");
+}
+
+static void
+test_setting_gsm_apn_bad_chars(void)
+{
+    gs_unref_object NMSettingGsm *s_gsm = NULL;
+
+    s_gsm = (NMSettingGsm *) nm_setting_gsm_new();
+    g_assert(s_gsm);
+
+    /* Make sure a valid APN works */
+    g_object_set(s_gsm, NM_SETTING_GSM_APN, "foobar123.-baz", NULL);
+    g_assert(nm_setting_verify(NM_SETTING(s_gsm), NULL, NULL));
+
+    /* Random invalid chars */
+    g_object_set(s_gsm, NM_SETTING_GSM_APN, "@#%$@#%@#%", NULL);
+    g_assert(!nm_setting_verify(NM_SETTING(s_gsm), NULL, NULL));
+
+    /* Spaces */
+    g_object_set(s_gsm, NM_SETTING_GSM_APN, "foobar baz", NULL);
+    g_assert(!nm_setting_verify(NM_SETTING(s_gsm), NULL, NULL));
+
+    /* 0 characters long */
+    g_object_set(s_gsm, NM_SETTING_GSM_APN, "", NULL);
+    g_assert(nm_setting_verify(NM_SETTING(s_gsm), NULL, NULL));
+
+    /* 65-character long */
+    g_object_set(s_gsm,
+                 NM_SETTING_GSM_APN,
+                 "abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijkl1",
+                 NULL);
+    g_assert(!nm_setting_verify(NM_SETTING(s_gsm), NULL, NULL));
+}
+
+static void
+test_setting_gsm_apn_underscore(void)
+{
+    gs_unref_object NMSettingGsm *s_gsm = NULL;
+
+    s_gsm = (NMSettingGsm *) nm_setting_gsm_new();
+    g_assert(s_gsm);
+
+    /* 65-character long */
+    g_object_set(s_gsm, NM_SETTING_GSM_APN, "foobar_baz", NULL);
+    nmtst_assert_setting_verifies(NM_SETTING(s_gsm));
+}
+
+static void
+test_setting_gsm_without_number(void)
+{
+    gs_unref_object NMSettingGsm *s_gsm = NULL;
+
+    s_gsm = (NMSettingGsm *) nm_setting_gsm_new();
+    g_assert(s_gsm);
+
+    g_object_set(s_gsm, NM_SETTING_GSM_NUMBER, NULL, NULL);
+    nmtst_assert_setting_verifies(NM_SETTING(s_gsm));
+
+    g_object_set(s_gsm, NM_SETTING_GSM_NUMBER, "", NULL);
+    nmtst_assert_setting_verify_fails(NM_SETTING(s_gsm),
+                                      NM_CONNECTION_ERROR,
+                                      NM_CONNECTION_ERROR_INVALID_PROPERTY);
+}
+
+static void
+test_setting_gsm_sim_operator_id(void)
+{
+    gs_unref_object NMSettingGsm *s_gsm = NULL;
+
+    s_gsm = (NMSettingGsm *) nm_setting_gsm_new();
+    g_assert(s_gsm);
+
+    /* Valid */
+    g_object_set(s_gsm, NM_SETTING_GSM_SIM_OPERATOR_ID, "12345", NULL);
+    nmtst_assert_setting_verifies(NM_SETTING(s_gsm));
+
+    g_object_set(s_gsm, NM_SETTING_GSM_SIM_OPERATOR_ID, "123456", NULL);
+    nmtst_assert_setting_verifies(NM_SETTING(s_gsm));
+
+    /* Invalid */
+    g_object_set(s_gsm, NM_SETTING_GSM_SIM_OPERATOR_ID, "", NULL);
+    nmtst_assert_setting_verify_fails(NM_SETTING(s_gsm),
+                                      NM_CONNECTION_ERROR,
+                                      NM_CONNECTION_ERROR_INVALID_PROPERTY);
+
+    g_object_set(s_gsm, NM_SETTING_GSM_SIM_OPERATOR_ID, "     ", NULL);
+    nmtst_assert_setting_verify_fails(NM_SETTING(s_gsm),
+                                      NM_CONNECTION_ERROR,
+                                      NM_CONNECTION_ERROR_INVALID_PROPERTY);
+
+    g_object_set(s_gsm, NM_SETTING_GSM_SIM_OPERATOR_ID, "abcdef", NULL);
+    nmtst_assert_setting_verify_fails(NM_SETTING(s_gsm),
+                                      NM_CONNECTION_ERROR,
+                                      NM_CONNECTION_ERROR_INVALID_PROPERTY);
+}
+
+static NMSettingWirelessSecurity *
+make_test_wsec_setting(const char *detail)
+{
+    NMSettingWirelessSecurity *s_wsec;
+
+    s_wsec = (NMSettingWirelessSecurity *) nm_setting_wireless_security_new();
+    g_assert(s_wsec);
+
+    g_object_set(s_wsec,
+                 NM_SETTING_WIRELESS_SECURITY_KEY_MGMT,
+                 "wpa-psk",
+                 NM_SETTING_WIRELESS_SECURITY_LEAP_USERNAME,
+                 "foobarbaz",
+                 NM_SETTING_WIRELESS_SECURITY_PSK,
+                 "random psk",
+                 NM_SETTING_WIRELESS_SECURITY_PSK_FLAGS,
+                 NM_SETTING_SECRET_FLAG_NOT_SAVED,
+                 NM_SETTING_WIRELESS_SECURITY_WEP_KEY0,
+                 "aaaaaaaaaa",
+                 NULL);
+    return s_wsec;
+}
+
+static gboolean
+_variant_contains(GVariant *vardict, const char *key)
+{
+    gs_unref_variant GVariant *value = NULL;
+
+    value = g_variant_lookup_value(vardict, key, NULL);
+    return !!value;
+}
+
+static void
+test_setting_to_dbus_all(void)
+{
+    NMSettingWirelessSecurity *s_wsec;
+    GVariant *                 dict;
+
+    s_wsec = make_test_wsec_setting("setting-to-dbus-all");
+
+    dict = _nm_setting_to_dbus(NM_SETTING(s_wsec), NULL, NM_CONNECTION_SERIALIZE_ALL, NULL);
+
+    /* Make sure all keys are there */
+    g_assert(_variant_contains(dict, NM_SETTING_WIRELESS_SECURITY_KEY_MGMT));
+    g_assert(_variant_contains(dict, NM_SETTING_WIRELESS_SECURITY_LEAP_USERNAME));
+    g_assert(_variant_contains(dict, NM_SETTING_WIRELESS_SECURITY_PSK));
+    g_assert(_variant_contains(dict, NM_SETTING_WIRELESS_SECURITY_WEP_KEY0));
+
+    g_variant_unref(dict);
+    g_object_unref(s_wsec);
+}
+
+static void
+test_setting_to_dbus_no_secrets(void)
+{
+    NMSettingWirelessSecurity *s_wsec;
+    GVariant *                 dict;
+
+    s_wsec = make_test_wsec_setting("setting-to-dbus-no-secrets");
+
+    dict = _nm_setting_to_dbus(NM_SETTING(s_wsec),
+                               NULL,
+                               NM_CONNECTION_SERIALIZE_WITH_NON_SECRET,
+                               NULL);
+
+    /* Make sure non-secret keys are there */
+    g_assert(_variant_contains(dict, NM_SETTING_WIRELESS_SECURITY_KEY_MGMT));
+    g_assert(_variant_contains(dict, NM_SETTING_WIRELESS_SECURITY_LEAP_USERNAME));
+
+    /* Make sure secrets are not there */
+    g_assert(!_variant_contains(dict, NM_SETTING_WIRELESS_SECURITY_PSK));
+    g_assert(!_variant_contains(dict, NM_SETTING_WIRELESS_SECURITY_WEP_KEY0));
+
+    g_variant_unref(dict);
+    g_object_unref(s_wsec);
+}
+
+static void
+test_setting_to_dbus_only_secrets(void)
+{
+    NMSettingWirelessSecurity *s_wsec;
+    GVariant *                 dict;
+
+    s_wsec = make_test_wsec_setting("setting-to-dbus-only-secrets");
+
+    dict =
+        _nm_setting_to_dbus(NM_SETTING(s_wsec), NULL, NM_CONNECTION_SERIALIZE_WITH_SECRETS, NULL);
+
+    /* Make sure non-secret keys are not there */
+    g_assert(!_variant_contains(dict, NM_SETTING_WIRELESS_SECURITY_KEY_MGMT));
+    g_assert(!_variant_contains(dict, NM_SETTING_WIRELESS_SECURITY_LEAP_USERNAME));
+
+    /* Make sure secrets are there */
+    g_assert(_variant_contains(dict, NM_SETTING_WIRELESS_SECURITY_PSK));
+    g_assert(_variant_contains(dict, NM_SETTING_WIRELESS_SECURITY_WEP_KEY0));
+
+    g_variant_unref(dict);
+    g_object_unref(s_wsec);
+}
+
+static void
+test_setting_to_dbus_transform(void)
+{
+    NMSetting *   s_wired;
+    GVariant *    dict, *val;
+    const char *  test_mac_address = "11:22:33:44:55:66";
+    const guint8 *dbus_mac_address;
+    guint8        cmp_mac_address[ETH_ALEN];
+    gsize         len;
+
+    s_wired = nm_setting_wired_new();
+    g_object_set(s_wired, NM_SETTING_WIRED_MAC_ADDRESS, test_mac_address, NULL);
+
+    g_assert_cmpstr(nm_setting_wired_get_mac_address(NM_SETTING_WIRED(s_wired)),
+                    ==,
+                    test_mac_address);
+
+    dict = _nm_setting_to_dbus(s_wired, NULL, NM_CONNECTION_SERIALIZE_ALL, NULL);
+    g_assert(dict != NULL);
+
+    val = g_variant_lookup_value(dict, NM_SETTING_WIRED_MAC_ADDRESS, G_VARIANT_TYPE_BYTESTRING);
+    g_assert(val != NULL);
+
+    dbus_mac_address = g_variant_get_fixed_array(val, &len, 1);
+    g_assert_cmpint(len, ==, ETH_ALEN);
+
+    nm_utils_hwaddr_aton(test_mac_address, cmp_mac_address, ETH_ALEN);
+    g_assert(memcmp(dbus_mac_address, cmp_mac_address, ETH_ALEN) == 0);
+
+    g_variant_unref(val);
+    g_variant_unref(dict);
+    g_object_unref(s_wired);
+}
+
+static void
+test_setting_to_dbus_enum(void)
+{
+    NMSetting *s_ip6, *s_wsec, *s_serial;
+    GVariant * dict, *val;
+
+    /* enum */
+    s_ip6 = nm_setting_ip6_config_new();
+    g_object_set(s_ip6,
+                 NM_SETTING_IP6_CONFIG_IP6_PRIVACY,
+                 NM_SETTING_IP6_CONFIG_PRIVACY_PREFER_TEMP_ADDR,
+                 NULL);
+
+    dict = _nm_setting_to_dbus(s_ip6, NULL, NM_CONNECTION_SERIALIZE_ALL, NULL);
+    g_assert(dict != NULL);
+
+    val = g_variant_lookup_value(dict, NM_SETTING_IP6_CONFIG_IP6_PRIVACY, G_VARIANT_TYPE_INT32);
+    g_assert(val != NULL);
+    g_assert_cmpint(g_variant_get_int32(val), ==, NM_SETTING_IP6_CONFIG_PRIVACY_PREFER_TEMP_ADDR);
+    g_variant_unref(val);
+
+    g_variant_unref(dict);
+    g_object_unref(s_ip6);
+
+    /* flags (and a transformed enum) */
+    s_wsec = nm_setting_wireless_security_new();
+    g_object_set(s_wsec,
+                 NM_SETTING_WIRELESS_SECURITY_WEP_KEY_TYPE,
+                 NM_WEP_KEY_TYPE_KEY,
+                 NM_SETTING_WIRELESS_SECURITY_WEP_KEY_FLAGS,
+                 (NM_SETTING_SECRET_FLAG_AGENT_OWNED | NM_SETTING_SECRET_FLAG_NOT_SAVED),
+                 NULL);
+
+    dict = _nm_setting_to_dbus(s_wsec, NULL, NM_CONNECTION_SERIALIZE_ALL, NULL);
+    g_assert(dict != NULL);
+
+    val = g_variant_lookup_value(dict,
+                                 NM_SETTING_WIRELESS_SECURITY_WEP_KEY_TYPE,
+                                 G_VARIANT_TYPE_UINT32);
+    g_assert(val != NULL);
+    g_assert_cmpint(g_variant_get_uint32(val), ==, NM_WEP_KEY_TYPE_KEY);
+    g_variant_unref(val);
+
+    val = g_variant_lookup_value(dict,
+                                 NM_SETTING_WIRELESS_SECURITY_WEP_KEY_FLAGS,
+                                 G_VARIANT_TYPE_UINT32);
+    g_assert(val != NULL);
+    g_assert_cmpint(g_variant_get_uint32(val),
+                    ==,
+                    (NM_SETTING_SECRET_FLAG_AGENT_OWNED | NM_SETTING_SECRET_FLAG_NOT_SAVED));
+    g_variant_unref(val);
+
+    g_variant_unref(dict);
+    g_object_unref(s_wsec);
+
+    /* another transformed enum */
+    s_serial = nm_setting_serial_new();
+    g_object_set(s_serial, NM_SETTING_SERIAL_PARITY, NM_SETTING_SERIAL_PARITY_ODD, NULL);
+
+    dict = _nm_setting_to_dbus(s_serial, NULL, NM_CONNECTION_SERIALIZE_ALL, NULL);
+    g_assert(dict != NULL);
+
+    val = g_variant_lookup_value(dict, NM_SETTING_SERIAL_PARITY, G_VARIANT_TYPE_BYTE);
+    g_assert(val != NULL);
+    g_assert_cmpint(g_variant_get_byte(val), ==, 'o');
+    g_variant_unref(val);
+
+    g_variant_unref(dict);
+    g_object_unref(s_serial);
+}
+
+static void
+test_connection_to_dbus_setting_name(void)
+{
+    NMConnection *             connection;
+    NMSettingWirelessSecurity *s_wsec;
+    GVariant *                 dict;
+
+    connection = nm_simple_connection_new();
+    s_wsec     = make_test_wsec_setting("connection-to-dbus-setting-name");
+    nm_connection_add_setting(connection, NM_SETTING(s_wsec));
+
+    g_assert(_nm_connection_aggregate(connection, NM_CONNECTION_AGGREGATE_ANY_SECRETS, NULL));
+    g_assert(_nm_connection_aggregate(connection,
+                                      NM_CONNECTION_AGGREGATE_ANY_SYSTEM_SECRET_FLAGS,
+                                      NULL));
+
+    g_object_set(s_wsec,
+                 NM_SETTING_WIRELESS_SECURITY_WEP_KEY_FLAGS,
+                 NM_SETTING_SECRET_FLAG_NOT_SAVED,
+                 NM_SETTING_WIRELESS_SECURITY_LEAP_PASSWORD_FLAGS,
+                 NM_SETTING_SECRET_FLAG_NOT_SAVED,
+                 NULL);
+
+    g_assert(_nm_connection_aggregate(connection, NM_CONNECTION_AGGREGATE_ANY_SECRETS, NULL));
+    g_assert(!_nm_connection_aggregate(connection,
+                                       NM_CONNECTION_AGGREGATE_ANY_SYSTEM_SECRET_FLAGS,
+                                       NULL));
+
+    g_object_set(s_wsec,
+                 NM_SETTING_WIRELESS_SECURITY_WEP_KEY_FLAGS,
+                 NM_SETTING_SECRET_FLAG_NONE,
+                 NM_SETTING_WIRELESS_SECURITY_LEAP_PASSWORD_FLAGS,
+                 NM_SETTING_SECRET_FLAG_NONE,
+                 NULL);
+
+    g_assert(_nm_connection_aggregate(connection, NM_CONNECTION_AGGREGATE_ANY_SECRETS, NULL));
+    g_assert(_nm_connection_aggregate(connection,
+                                      NM_CONNECTION_AGGREGATE_ANY_SYSTEM_SECRET_FLAGS,
+                                      NULL));
+
+    dict = nm_connection_to_dbus(connection, NM_CONNECTION_SERIALIZE_ALL);
+
+    /* Make sure the keys of the first level dict are setting names, not
+     * the GType name of the setting objects.
+     */
+    g_assert(_variant_contains(dict, NM_SETTING_WIRELESS_SECURITY_SETTING_NAME));
+
+    g_variant_unref(dict);
+    g_object_unref(connection);
+}
+
+static void
+test_connection_to_dbus_deprecated_props(void)
+{
+    NMConnection *             connection;
+    NMSetting *                s_wireless;
+    GBytes *                   ssid;
+    NMSettingWirelessSecurity *s_wsec;
+    GVariant *                 dict, *wireless_dict, *sec_val;
+
+    connection = nmtst_create_minimal_connection("test-connection-to-dbus-deprecated-props",
+                                                 NULL,
+                                                 NM_SETTING_WIRELESS_SETTING_NAME,
+                                                 NULL);
+
+    s_wireless = nm_setting_wireless_new();
+    ssid       = g_bytes_new("1234567", 7);
+    g_object_set(s_wireless, NM_SETTING_WIRELESS_SSID, ssid, NULL);
+    g_bytes_unref(ssid);
+    nm_connection_add_setting(connection, s_wireless);
+
+    /* Serialization should not have an 802-11-wireless.security property */
+    dict = nm_connection_to_dbus(connection, NM_CONNECTION_SERIALIZE_ALL);
+    g_assert(dict != NULL);
+
+    wireless_dict =
+        g_variant_lookup_value(dict, NM_SETTING_WIRELESS_SETTING_NAME, NM_VARIANT_TYPE_SETTING);
+    g_assert(wireless_dict != NULL);
+
+    sec_val = g_variant_lookup_value(wireless_dict, "security", NULL);
+    g_assert(sec_val == NULL);
+
+    g_variant_unref(wireless_dict);
+    g_variant_unref(dict);
+
+    /* Now add an NMSettingWirelessSecurity and try again */
+    s_wsec = make_test_wsec_setting("test-connection-to-dbus-deprecated-props");
+    nm_connection_add_setting(connection, NM_SETTING(s_wsec));
+
+    dict = nm_connection_to_dbus(connection, NM_CONNECTION_SERIALIZE_ALL);
+    g_assert(dict != NULL);
+
+    wireless_dict =
+        g_variant_lookup_value(dict, NM_SETTING_WIRELESS_SETTING_NAME, NM_VARIANT_TYPE_SETTING);
+    g_assert(wireless_dict != NULL);
+
+    sec_val = g_variant_lookup_value(wireless_dict, "security", NULL);
+    g_assert(g_variant_is_of_type(sec_val, G_VARIANT_TYPE_STRING));
+    g_assert_cmpstr(g_variant_get_string(sec_val, NULL),
+                    ==,
+                    NM_SETTING_WIRELESS_SECURITY_SETTING_NAME);
+
+    g_variant_unref(sec_val);
+    g_variant_unref(wireless_dict);
+    g_variant_unref(dict);
+    g_object_unref(connection);
+}
+
+static void
+test_setting_new_from_dbus(void)
+{
+    NMSettingWirelessSecurity *s_wsec;
+    GVariant *                 dict;
+
+    s_wsec = make_test_wsec_setting("setting-new-from-dbus");
+    dict   = _nm_setting_to_dbus(NM_SETTING(s_wsec), NULL, NM_CONNECTION_SERIALIZE_ALL, NULL);
+    g_object_unref(s_wsec);
+
+    s_wsec =
+        (NMSettingWirelessSecurity *) _nm_setting_new_from_dbus(NM_TYPE_SETTING_WIRELESS_SECURITY,
+                                                                dict,
+                                                                NULL,
+                                                                NM_SETTING_PARSE_FLAGS_NONE,
+                                                                NULL);
+    g_variant_unref(dict);
+
+    g_assert(s_wsec);
+    g_assert_cmpstr(nm_setting_wireless_security_get_key_mgmt(s_wsec), ==, "wpa-psk");
+    g_assert_cmpstr(nm_setting_wireless_security_get_leap_username(s_wsec), ==, "foobarbaz");
+    g_assert_cmpstr(nm_setting_wireless_security_get_psk(s_wsec), ==, "random psk");
+    g_object_unref(s_wsec);
+}
+
+static void
+test_setting_new_from_dbus_transform(void)
+{
+    NMSetting *     s_wired;
+    GVariant *      dict;
+    GVariantBuilder builder;
+    const char *    test_mac_address = "11:22:33:44:55:66";
+    guint8          dbus_mac_address[ETH_ALEN];
+    GError *        error = NULL;
+
+    nm_utils_hwaddr_aton(test_mac_address, dbus_mac_address, ETH_ALEN);
+
+    g_variant_builder_init(&builder, NM_VARIANT_TYPE_SETTING);
+    g_variant_builder_add(
+        &builder,
+        "{sv}",
+        NM_SETTING_WIRED_MAC_ADDRESS,
+        g_variant_new_fixed_array(G_VARIANT_TYPE_BYTE, dbus_mac_address, ETH_ALEN, 1));
+    dict = g_variant_builder_end(&builder);
+
+    s_wired = _nm_setting_new_from_dbus(NM_TYPE_SETTING_WIRED,
+                                        dict,
+                                        NULL,
+                                        NM_SETTING_PARSE_FLAGS_NONE,
+                                        &error);
+    g_assert_no_error(error);
+
+    g_assert_cmpstr(nm_setting_wired_get_mac_address(NM_SETTING_WIRED(s_wired)),
+                    ==,
+                    test_mac_address);
+
+    g_variant_unref(dict);
+    g_object_unref(s_wired);
+}
+
+static void
+test_setting_new_from_dbus_enum(void)
+{
+    NMSettingIP6Config *       s_ip6;
+    NMSettingWirelessSecurity *s_wsec;
+    NMSettingSerial *          s_serial;
+    GVariant *                 dict;
+    GVariantBuilder            builder;
+    GError *                   error = NULL;
+
+    /* enum */
+    g_variant_builder_init(&builder, NM_VARIANT_TYPE_SETTING);
+    g_variant_builder_add(&builder,
+                          "{sv}",
+                          NM_SETTING_IP6_CONFIG_IP6_PRIVACY,
+                          g_variant_new_int32(NM_SETTING_IP6_CONFIG_PRIVACY_PREFER_TEMP_ADDR));
+    dict = g_variant_builder_end(&builder);
+
+    s_ip6 = (NMSettingIP6Config *) _nm_setting_new_from_dbus(NM_TYPE_SETTING_IP6_CONFIG,
+                                                             dict,
+                                                             NULL,
+                                                             NM_SETTING_PARSE_FLAGS_NONE,
+                                                             &error);
+    g_assert_no_error(error);
+
+    g_assert_cmpint(nm_setting_ip6_config_get_ip6_privacy(s_ip6),
+                    ==,
+                    NM_SETTING_IP6_CONFIG_PRIVACY_PREFER_TEMP_ADDR);
+
+    g_variant_unref(dict);
+    g_object_unref(s_ip6);
+
+    /* flags (and a transformed enum) */
+    g_variant_builder_init(&builder, NM_VARIANT_TYPE_SETTING);
+    g_variant_builder_add(&builder,
+                          "{sv}",
+                          NM_SETTING_WIRELESS_SECURITY_WEP_KEY_TYPE,
+                          g_variant_new_uint32(NM_WEP_KEY_TYPE_KEY));
+    g_variant_builder_add(&builder,
+                          "{sv}",
+                          NM_SETTING_WIRELESS_SECURITY_WEP_KEY_FLAGS,
+                          g_variant_new_uint32(NM_SETTING_SECRET_FLAG_AGENT_OWNED
+                                               | NM_SETTING_SECRET_FLAG_NOT_SAVED));
+    dict = g_variant_builder_end(&builder);
+
+    s_wsec =
+        (NMSettingWirelessSecurity *) _nm_setting_new_from_dbus(NM_TYPE_SETTING_WIRELESS_SECURITY,
+                                                                dict,
+                                                                NULL,
+                                                                NM_SETTING_PARSE_FLAGS_NONE,
+                                                                &error);
+    g_assert_no_error(error);
+
+    g_assert_cmpint(nm_setting_wireless_security_get_wep_key_type(s_wsec), ==, NM_WEP_KEY_TYPE_KEY);
+    g_assert_cmpint(nm_setting_wireless_security_get_wep_key_flags(s_wsec),
+                    ==,
+                    (NM_SETTING_SECRET_FLAG_AGENT_OWNED | NM_SETTING_SECRET_FLAG_NOT_SAVED));
+
+    g_variant_unref(dict);
+    g_object_unref(s_wsec);
+
+    /* another transformed enum */
+    g_variant_builder_init(&builder, NM_VARIANT_TYPE_SETTING);
+    g_variant_builder_add(&builder, "{sv}", NM_SETTING_SERIAL_PARITY, g_variant_new_byte('E'));
+    dict = g_variant_builder_end(&builder);
+
+    s_serial = (NMSettingSerial *) _nm_setting_new_from_dbus(NM_TYPE_SETTING_SERIAL,
+                                                             dict,
+                                                             NULL,
+                                                             NM_SETTING_PARSE_FLAGS_NONE,
+                                                             &error);
+    g_assert_no_error(error);
+
+    g_assert_cmpint(nm_setting_serial_get_parity(s_serial), ==, NM_SETTING_SERIAL_PARITY_EVEN);
+
+    g_variant_unref(dict);
+    g_object_unref(s_serial);
+}
+
+static void
+test_setting_new_from_dbus_bad(void)
+{
+    NMSetting *   setting;
+    NMConnection *conn;
+    GBytes *      ssid;
+    GPtrArray *   addrs;
+    GVariant *    orig_dict, *dict;
+    GError *      error = NULL;
+
+    /* We want to test:
+     * - ordinary scalar properties
+     * - string properties
+     * - GBytes-valued properties (which are handled specially by set_property_from_dbus())
+     * - enum/flags-valued properties
+     * - overridden properties
+     * - transformed properties
+     *
+     * No single setting class has examples of all of these, so we need two settings.
+     */
+
+    conn = nm_simple_connection_new();
+
+    setting = nm_setting_connection_new();
+    g_object_set(setting,
+                 NM_SETTING_CONNECTION_ID,
+                 "test",
+                 NM_SETTING_CONNECTION_UUID,
+                 "83c5a841-1759-4cdb-bfce-8d4087956497",
+                 NULL);
+    nm_connection_add_setting(conn, setting);
+
+    setting = nm_setting_wireless_new();
+    ssid    = g_bytes_new("my-ssid", 7);
+    g_object_set(setting,
+                 /* scalar */
+                 NM_SETTING_WIRELESS_RATE,
+                 100,
+                 /* string */
+                 NM_SETTING_WIRELESS_MODE,
+                 NM_SETTING_WIRELESS_MODE_INFRA,
+                 /* GBytes */
+                 NM_SETTING_WIRELESS_SSID,
+                 ssid,
+                 /* transformed */
+                 NM_SETTING_WIRELESS_BSSID,
+                 "00:11:22:33:44:55",
+                 NULL);
+    g_bytes_unref(ssid);
+    nm_connection_add_setting(conn, setting);
+
+    setting = nm_setting_ip6_config_new();
+    addrs   = g_ptr_array_new_with_free_func((GDestroyNotify) nm_ip_address_unref);
+    g_ptr_array_add(addrs, nm_ip_address_new(AF_INET6, "1234::5678", 64, NULL));
+    g_object_set(setting,
+                 /* enum */
+                 NM_SETTING_IP6_CONFIG_IP6_PRIVACY,
+                 NM_SETTING_IP6_CONFIG_PRIVACY_PREFER_PUBLIC_ADDR,
+                 /* overridden */
+                 NM_SETTING_IP_CONFIG_ADDRESSES,
+                 addrs,
+                 /* (needed in order to verify()) */
+                 NM_SETTING_IP_CONFIG_METHOD,
+                 NM_SETTING_IP6_CONFIG_METHOD_AUTO,
+                 NULL);
+    g_ptr_array_unref(addrs);
+    nm_connection_add_setting(conn, setting);
+
+    orig_dict = nm_connection_to_dbus(conn, NM_CONNECTION_SERIALIZE_ALL);
+    g_object_unref(conn);
+
+    /* sanity-check */
+    conn = _connection_new_from_dbus(orig_dict, &error);
+    g_assert_no_error(error);
+    g_assert(conn);
+    g_object_unref(conn);
+
+    /* Compatible mismatches */
+
+    dict = g_variant_ref(orig_dict);
+    NMTST_VARIANT_EDITOR(dict,
+                         NMTST_VARIANT_CHANGE_PROPERTY(NM_SETTING_WIRELESS_SETTING_NAME,
+                                                       NM_SETTING_WIRELESS_RATE,
+                                                       "i",
+                                                       10););
+    conn = _connection_new_from_dbus(dict, &error);
+    g_assert(conn);
+    g_assert_no_error(error);
+    setting = nm_connection_get_setting(conn, NM_TYPE_SETTING_WIRELESS);
+    g_assert(setting);
+    g_assert_cmpint(nm_setting_wireless_get_rate(NM_SETTING_WIRELESS(setting)), ==, 10);
+    g_object_unref(conn);
+    g_variant_unref(dict);
+
+    dict = g_variant_ref(orig_dict);
+    NMTST_VARIANT_EDITOR(
+        dict,
+        NMTST_VARIANT_CHANGE_PROPERTY(NM_SETTING_IP6_CONFIG_SETTING_NAME,
+                                      NM_SETTING_IP6_CONFIG_IP6_PRIVACY,
+                                      "i",
+                                      NM_SETTING_IP6_CONFIG_PRIVACY_PREFER_TEMP_ADDR););
+    conn = _connection_new_from_dbus(dict, &error);
+    g_assert(conn);
+    g_assert_no_error(error);
+    setting = nm_connection_get_setting(conn, NM_TYPE_SETTING_IP6_CONFIG);
+    g_assert(setting);
+    g_assert_cmpint(nm_setting_ip6_config_get_ip6_privacy(NM_SETTING_IP6_CONFIG(setting)),
+                    ==,
+                    NM_SETTING_IP6_CONFIG_PRIVACY_PREFER_TEMP_ADDR);
+    g_object_unref(conn);
+    g_variant_unref(dict);
+
+    /* Incompatible mismatches */
+
+    dict = g_variant_ref(orig_dict);
+    NMTST_VARIANT_EDITOR(dict,
+                         NMTST_VARIANT_CHANGE_PROPERTY(NM_SETTING_WIRELESS_SETTING_NAME,
+                                                       NM_SETTING_WIRELESS_RATE,
+                                                       "s",
+                                                       "ten"););
+    conn = _connection_new_from_dbus(dict, &error);
+    g_assert_error(error, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_INVALID_PROPERTY);
+    g_assert(g_str_has_prefix(error->message, "802-11-wireless.rate:"));
+    g_clear_error(&error);
+    g_variant_unref(dict);
+
+    dict = g_variant_ref(orig_dict);
+    NMTST_VARIANT_EDITOR(dict,
+                         NMTST_VARIANT_CHANGE_PROPERTY(NM_SETTING_WIRELESS_SETTING_NAME,
+                                                       NM_SETTING_WIRELESS_MODE,
+                                                       "b",
+                                                       FALSE););
+    conn = _connection_new_from_dbus(dict, &error);
+    g_assert_error(error, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_INVALID_PROPERTY);
+    g_assert(g_str_has_prefix(error->message, "802-11-wireless.mode:"));
+    g_clear_error(&error);
+    g_variant_unref(dict);
+
+    dict = g_variant_ref(orig_dict);
+    NMTST_VARIANT_EDITOR(dict,
+                         NMTST_VARIANT_CHANGE_PROPERTY(NM_SETTING_WIRELESS_SETTING_NAME,
+                                                       NM_SETTING_WIRELESS_SSID,
+                                                       "s",
+                                                       "fred"););
+    conn = _connection_new_from_dbus(dict, &error);
+    g_assert_error(error, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_INVALID_PROPERTY);
+    g_assert(g_str_has_prefix(error->message, "802-11-wireless.ssid:"));
+    g_clear_error(&error);
+    g_variant_unref(dict);
+
+    dict = g_variant_ref(orig_dict);
+    NMTST_VARIANT_EDITOR(dict,
+                         NMTST_VARIANT_CHANGE_PROPERTY(NM_SETTING_WIRELESS_SETTING_NAME,
+                                                       NM_SETTING_WIRELESS_BSSID,
+                                                       "i",
+                                                       42););
+    conn = _connection_new_from_dbus(dict, &error);
+    g_assert_error(error, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_INVALID_PROPERTY);
+    g_assert(g_str_has_prefix(error->message, "802-11-wireless.bssid:"));
+    g_clear_error(&error);
+    g_variant_unref(dict);
+
+    dict = g_variant_ref(orig_dict);
+    NMTST_VARIANT_EDITOR(dict,
+                         NMTST_VARIANT_CHANGE_PROPERTY(NM_SETTING_IP6_CONFIG_SETTING_NAME,
+                                                       NM_SETTING_IP6_CONFIG_IP6_PRIVACY,
+                                                       "s",
+                                                       "private"););
+    conn = _connection_new_from_dbus(dict, &error);
+    g_assert_error(error, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_INVALID_PROPERTY);
+    g_assert(g_str_has_prefix(error->message, "ipv6.ip6-privacy:"));
+    g_clear_error(&error);
+    g_variant_unref(dict);
+
+    dict = g_variant_ref(orig_dict);
+    NMTST_VARIANT_EDITOR(dict,
+                         NMTST_VARIANT_CHANGE_PROPERTY(NM_SETTING_IP6_CONFIG_SETTING_NAME,
+                                                       NM_SETTING_IP_CONFIG_ADDRESSES,
+                                                       "s",
+                                                       "1234::5678"););
+    conn = _connection_new_from_dbus(dict, &error);
+    g_assert_error(error, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_INVALID_PROPERTY);
+    g_assert(g_str_has_prefix(error->message, "ipv6.addresses:"));
+    g_clear_error(&error);
+    g_variant_unref(dict);
+
+    g_variant_unref(orig_dict);
+}
+
+static NMConnection *
+new_test_connection(void)
+{
+    NMConnection *connection;
+    NMSetting *   setting;
+    char *        uuid;
+    guint64       timestamp = time(NULL);
+
+    connection = nm_simple_connection_new();
+
+    setting = nm_setting_connection_new();
+    uuid    = nm_utils_uuid_generate();
+    g_object_set(G_OBJECT(setting),
+                 NM_SETTING_CONNECTION_ID,
+                 "foobar",
+                 NM_SETTING_CONNECTION_UUID,
+                 uuid,
+                 NM_SETTING_CONNECTION_TYPE,
+                 NM_SETTING_WIRED_SETTING_NAME,
+                 NM_SETTING_CONNECTION_TIMESTAMP,
+                 timestamp,
+                 NULL);
+    g_free(uuid);
+    nm_connection_add_setting(connection, setting);
+
+    setting = nm_setting_wired_new();
+    g_object_set(G_OBJECT(setting), NM_SETTING_WIRED_MTU, 1592, NULL);
+    nm_connection_add_setting(connection, setting);
+
+    setting = nm_setting_ip4_config_new();
+    g_object_set(G_OBJECT(setting),
+                 NM_SETTING_IP_CONFIG_METHOD,
+                 NM_SETTING_IP4_CONFIG_METHOD_AUTO,
+                 NM_SETTING_IP_CONFIG_DHCP_HOSTNAME,
+                 "eyeofthetiger",
+                 NULL);
+    nm_connection_add_setting(connection, setting);
+
+    return connection;
+}
+
+static GVariant *
+new_connection_dict(char **      out_uuid,
+                    const char **out_expected_id,
+                    const char **out_expected_ip6_method)
+{
+    GVariantBuilder conn_builder, setting_builder;
+
+    g_variant_builder_init(&conn_builder, NM_VARIANT_TYPE_CONNECTION);
+
+    *out_uuid                = nm_utils_uuid_generate();
+    *out_expected_id         = "My happy connection";
+    *out_expected_ip6_method = NM_SETTING_IP6_CONFIG_METHOD_LINK_LOCAL;
+
+    /* Connection setting */
+    g_variant_builder_init(&setting_builder, NM_VARIANT_TYPE_SETTING);
+    g_variant_builder_add(&setting_builder,
+                          "{sv}",
+                          NM_SETTING_NAME,
+                          g_variant_new_string(NM_SETTING_CONNECTION_SETTING_NAME));
+    g_variant_builder_add(&setting_builder,
+                          "{sv}",
+                          NM_SETTING_CONNECTION_ID,
+                          g_variant_new_string(*out_expected_id));
+    g_variant_builder_add(&setting_builder,
+                          "{sv}",
+                          NM_SETTING_CONNECTION_UUID,
+                          g_variant_new_string(*out_uuid));
+    g_variant_builder_add(&setting_builder,
+                          "{sv}",
+                          NM_SETTING_CONNECTION_TYPE,
+                          g_variant_new_string(NM_SETTING_WIRED_SETTING_NAME));
+
+    g_variant_builder_add(&conn_builder,
+                          "{sa{sv}}",
+                          NM_SETTING_CONNECTION_SETTING_NAME,
+                          &setting_builder);
+
+    /* Wired setting */
+    g_variant_builder_init(&setting_builder, NM_VARIANT_TYPE_SETTING);
+    g_variant_builder_add(&conn_builder,
+                          "{sa{sv}}",
+                          NM_SETTING_WIRED_SETTING_NAME,
+                          &setting_builder);
+
+    /* IP6 */
+    g_variant_builder_init(&setting_builder, NM_VARIANT_TYPE_SETTING);
+    g_variant_builder_add(&setting_builder,
+                          "{sv}",
+                          NM_SETTING_IP_CONFIG_METHOD,
+                          g_variant_new_string(*out_expected_ip6_method));
+    g_variant_builder_add(&conn_builder,
+                          "{sa{sv}}",
+                          NM_SETTING_IP6_CONFIG_SETTING_NAME,
+                          &setting_builder);
+
+    return g_variant_builder_end(&conn_builder);
+}
+
+static void
+test_connection_replace_settings(void)
+{
+    NMConnection *       connection;
+    GVariant *           new_settings;
+    GError *             error = NULL;
+    gboolean             success;
+    NMSettingConnection *s_con;
+    NMSettingIPConfig *  s_ip6;
+    char *               uuid        = NULL;
+    const char *         expected_id = NULL, *expected_method = NULL;
+
+    connection = new_test_connection();
+
+    new_settings = new_connection_dict(&uuid, &expected_id, &expected_method);
+    g_assert(new_settings);
+
+    /* Replace settings and test */
+    success = nm_connection_replace_settings(connection, new_settings, &error);
+    g_assert_no_error(error);
+    g_assert(success);
+
+    s_con = nm_connection_get_setting_connection(connection);
+    g_assert(s_con);
+    g_assert_cmpstr(nm_setting_connection_get_id(s_con), ==, expected_id);
+    g_assert_cmpstr(nm_setting_connection_get_uuid(s_con), ==, uuid);
+
+    g_assert(nm_connection_get_setting_wired(connection));
+    g_assert(!nm_connection_get_setting_ip4_config(connection));
+
+    s_ip6 = nm_connection_get_setting_ip6_config(connection);
+    g_assert(s_ip6);
+    g_assert_cmpstr(nm_setting_ip_config_get_method(s_ip6), ==, expected_method);
+
+    g_free(uuid);
+    g_variant_unref(new_settings);
+    g_object_unref(connection);
+}
+
+static void
+test_connection_replace_settings_from_connection(void)
+{
+    NMConnection *       connection, *replacement;
+    NMSettingConnection *s_con;
+    NMSetting *          setting;
+    GBytes *             ssid;
+    char *               uuid        = NULL;
+    const char *         expected_id = "Awesome connection";
+
+    connection = new_test_connection();
+    g_assert(connection);
+
+    replacement = nm_simple_connection_new();
+    g_assert(replacement);
+
+    /* New connection setting */
+    setting = nm_setting_connection_new();
+    g_assert(setting);
+
+    uuid = nm_utils_uuid_generate();
+    g_object_set(setting,
+                 NM_SETTING_CONNECTION_ID,
+                 expected_id,
+                 NM_SETTING_CONNECTION_UUID,
+                 uuid,
+                 NM_SETTING_CONNECTION_TYPE,
+                 NM_SETTING_WIRELESS_SETTING_NAME,
+                 NULL);
+    nm_connection_add_setting(replacement, setting);
+
+    /* New wifi setting */
+    setting = nm_setting_wireless_new();
+    g_assert(setting);
+
+    ssid = g_bytes_new("1234567", 7);
+    g_object_set(setting,
+                 NM_SETTING_WIRELESS_SSID,
+                 ssid,
+                 NM_SETTING_WIRELESS_MODE,
+                 "infrastructure",
+                 NULL);
+    g_bytes_unref(ssid);
+    nm_connection_add_setting(replacement, setting);
+
+    /* Replace settings and test */
+    nm_connection_replace_settings_from_connection(connection, replacement);
+
+    s_con = nm_connection_get_setting_connection(connection);
+    g_assert(s_con);
+    g_assert_cmpstr(nm_setting_connection_get_id(s_con), ==, expected_id);
+    g_assert_cmpstr(nm_setting_connection_get_uuid(s_con), ==, uuid);
+
+    g_assert(!nm_connection_get_setting_wired(connection));
+    g_assert(!nm_connection_get_setting_ip6_config(connection));
+    g_assert(nm_connection_get_setting_wireless(connection));
+
+    g_free(uuid);
+    g_object_unref(replacement);
+    g_object_unref(connection);
+}
+
+static void
+test_connection_replace_settings_bad(void)
+{
+    NMConnection *       connection, *new_connection;
+    GVariant *           new_settings;
+    GVariantBuilder      builder, setting_builder;
+    GError *             error = NULL;
+    gboolean             success;
+    NMSettingConnection *s_con;
+
+    new_connection = new_test_connection();
+    g_assert(nm_connection_verify(new_connection, NULL));
+    s_con = nm_connection_get_setting_connection(new_connection);
+    g_object_set(s_con,
+                 NM_SETTING_CONNECTION_UUID,
+                 NULL,
+                 NM_SETTING_CONNECTION_ID,
+                 "bad-connection",
+                 NULL);
+    g_assert(!nm_connection_verify(new_connection, NULL));
+
+    /* nm_connection_replace_settings_from_connection() should succeed */
+    connection = new_test_connection();
+    nm_connection_replace_settings_from_connection(connection, new_connection);
+    g_assert_cmpstr(nm_connection_get_id(connection), ==, "bad-connection");
+    g_assert(!nm_connection_verify(connection, NULL));
+    g_object_unref(connection);
+
+    /* nm_connection_replace_settings() should succeed */
+    new_settings = nm_connection_to_dbus(new_connection, NM_CONNECTION_SERIALIZE_ALL);
+    g_assert(new_settings != NULL);
+
+    connection = new_test_connection();
+    success    = nm_connection_replace_settings(connection, new_settings, &error);
+    g_assert_no_error(error);
+    g_assert(success);
+
+    g_assert_cmpstr(nm_connection_get_id(connection), ==, "bad-connection");
+    g_assert(!nm_connection_verify(connection, NULL));
+    g_object_unref(connection);
+    g_variant_unref(new_settings);
+
+    /* But given an invalid dict, it should fail */
+    g_variant_builder_init(&builder, NM_VARIANT_TYPE_CONNECTION);
+    g_variant_builder_init(&setting_builder, NM_VARIANT_TYPE_SETTING);
+    g_variant_builder_add(&builder, "{sa{sv}}", "ip-over-avian-carrier", &setting_builder);
+    new_settings = g_variant_builder_end(&builder);
+
+    connection = new_test_connection();
+    success    = nm_connection_replace_settings(connection, new_settings, &error);
+    g_assert_error(error, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_INVALID_SETTING);
+    g_clear_error(&error);
+    g_assert(!success);
+
+    g_assert(nm_connection_verify(connection, NULL));
+    g_object_unref(connection);
+
+    g_variant_unref(new_settings);
+    g_object_unref(new_connection);
+}
+
+static void
+test_connection_new_from_dbus(void)
+{
+    NMConnection *       connection;
+    GVariant *           new_settings;
+    GError *             error = NULL;
+    NMSettingConnection *s_con;
+    NMSettingIPConfig *  s_ip6;
+    char *               uuid        = NULL;
+    const char *         expected_id = NULL, *expected_method = NULL;
+
+    new_settings = new_connection_dict(&uuid, &expected_id, &expected_method);
+    g_assert(new_settings);
+
+    /* Replace settings and test */
+    connection = _connection_new_from_dbus(new_settings, &error);
+    g_assert_no_error(error);
+    g_assert(connection);
+
+    s_con = nm_connection_get_setting_connection(connection);
+    g_assert(s_con);
+    g_assert_cmpstr(nm_setting_connection_get_id(s_con), ==, expected_id);
+    g_assert_cmpstr(nm_setting_connection_get_uuid(s_con), ==, uuid);
+
+    g_assert(nm_connection_get_setting_wired(connection));
+    g_assert(nm_connection_get_setting_ip4_config(connection));
+
+    s_ip6 = nm_connection_get_setting_ip6_config(connection);
+    g_assert(s_ip6);
+    g_assert_cmpstr(nm_setting_ip_config_get_method(s_ip6), ==, expected_method);
+
+    g_free(uuid);
+    g_variant_unref(new_settings);
+    g_object_unref(connection);
+}
+
+static void
+check_permission(NMSettingConnection *s_con, guint32 idx, const char *expected_uname)
+{
+    gboolean    success;
+    const char *ptype = NULL, *pitem = NULL, *detail = NULL;
+
+    success = nm_setting_connection_get_permission(s_con, idx, &ptype, &pitem, &detail);
+    g_assert(success);
+
+    g_assert_cmpstr(ptype, ==, "user");
+
+    g_assert(pitem);
+    g_assert_cmpstr(pitem, ==, expected_uname);
+
+    g_assert(!detail);
+}
+
+#define TEST_UNAME "asdfasfasdf"
+
+static void
+test_setting_connection_permissions_helpers(void)
+{
+    NMSettingConnection *s_con;
+    gboolean             success;
+    char                 buf[9] = {0x61, 0x62, 0x63, 0xff, 0xfe, 0xfd, 0x23, 0x01, 0x00};
+    char **              perms;
+    const char *         expected_perm = "user:" TEST_UNAME ":";
+
+    s_con = NM_SETTING_CONNECTION(nm_setting_connection_new());
+
+    /* Ensure a bad [type] is rejected */
+    success = nm_setting_connection_add_permission(s_con, "foobar", "blah", NULL);
+    g_assert(!success);
+    g_assert_cmpint(nm_setting_connection_get_num_permissions(s_con), ==, 0);
+
+    /* Ensure a bad [type] is rejected */
+    NMTST_EXPECT_LIBNM_CRITICAL(NMTST_G_RETURN_MSG(ptype));
+    success = nm_setting_connection_add_permission(s_con, NULL, "blah", NULL);
+    g_test_assert_expected_messages();
+    g_assert(!success);
+    g_assert_cmpint(nm_setting_connection_get_num_permissions(s_con), ==, 0);
+
+    /* Ensure a bad [item] is rejected */
+    NMTST_EXPECT_LIBNM_CRITICAL(NMTST_G_RETURN_MSG(pitem));
+    success = nm_setting_connection_add_permission(s_con, "user", NULL, NULL);
+    g_test_assert_expected_messages();
+    g_assert(!success);
+    g_assert_cmpint(nm_setting_connection_get_num_permissions(s_con), ==, 0);
+
+    /* Ensure a bad [item] is rejected */
+    success = nm_setting_connection_add_permission(s_con, "user", "", NULL);
+    g_assert(!success);
+    g_assert_cmpint(nm_setting_connection_get_num_permissions(s_con), ==, 0);
+
+    /* Ensure an [item] with ':' is rejected */
+    success = nm_setting_connection_add_permission(s_con, "user", "ad:asdf", NULL);
+    g_assert(!success);
+    g_assert_cmpint(nm_setting_connection_get_num_permissions(s_con), ==, 0);
+
+    /* Ensure a non-UTF-8 [item] is rejected */
+    success = nm_setting_connection_add_permission(s_con, "user", buf, NULL);
+    g_assert(!success);
+    g_assert_cmpint(nm_setting_connection_get_num_permissions(s_con), ==, 0);
+
+    /* Ensure a non-NULL [detail] is rejected */
+    success = nm_setting_connection_add_permission(s_con, "user", "dafasdf", "asdf");
+    g_assert(!success);
+    g_assert_cmpint(nm_setting_connection_get_num_permissions(s_con), ==, 0);
+
+    /* Ensure a valid call results in success */
+    success = nm_setting_connection_add_permission(s_con, "user", TEST_UNAME, NULL);
+    g_assert(success);
+
+    g_assert_cmpint(nm_setting_connection_get_num_permissions(s_con), ==, 1);
+
+    check_permission(s_con, 0, TEST_UNAME);
+
+    /* Check the actual GObject property just to be paranoid */
+    g_object_get(G_OBJECT(s_con), NM_SETTING_CONNECTION_PERMISSIONS, &perms, NULL);
+    g_assert(perms);
+    g_assert_cmpint(g_strv_length(perms), ==, 1);
+    g_assert_cmpstr(perms[0], ==, expected_perm);
+    g_strfreev(perms);
+
+    /* Now remove that permission and ensure we have 0 permissions */
+    nm_setting_connection_remove_permission(s_con, 0);
+    g_assert_cmpint(nm_setting_connection_get_num_permissions(s_con), ==, 0);
+
+    g_object_unref(s_con);
+}
+
+static void
+add_permission_property(NMSettingConnection *s_con,
+                        const char *         ptype,
+                        const char *         pitem,
+                        int                  pitem_len,
+                        const char *         detail)
+{
+    GString *str;
+    char *   perms[2];
+
+    str = g_string_sized_new(50);
+    if (ptype)
+        g_string_append(str, ptype);
+    g_string_append_c(str, ':');
+
+    if (pitem) {
+        if (pitem_len >= 0)
+            g_string_append_len(str, pitem, pitem_len);
+        else
+            g_string_append(str, pitem);
+    }
+
+    g_string_append_c(str, ':');
+
+    if (detail)
+        g_string_append(str, detail);
+
+    perms[0] = str->str;
+    perms[1] = NULL;
+    g_object_set(G_OBJECT(s_con), NM_SETTING_CONNECTION_PERMISSIONS, perms, NULL);
+
+    g_string_free(str, TRUE);
+}
+
+static void
+test_setting_connection_permissions_property(void)
+{
+    gs_unref_object NMSettingConnection *s_con = NULL;
+    gboolean                             success;
+    char buf[9] = {0x61, 0x62, 0x63, 0xff, 0xfe, 0xfd, 0x23, 0x01, 0x00};
+
+    s_con = NM_SETTING_CONNECTION(nm_setting_connection_new());
+
+#define _assert_permission_invalid_at_idx(s_con, idx, expected_item)                            \
+    G_STMT_START                                                                                \
+    {                                                                                           \
+        NMSettingConnection *_s_con = (s_con);                                                  \
+        guint                _idx   = (idx);                                                    \
+        const char *         _ptype;                                                            \
+        const char *         _pitem;                                                            \
+        const char *         _detail;                                                           \
+        const char **        _p_ptype  = nmtst_get_rand_bool() ? &_ptype : NULL;                \
+        const char **        _p_pitem  = nmtst_get_rand_bool() ? &_pitem : NULL;                \
+        const char **        _p_detail = nmtst_get_rand_bool() ? &_detail : NULL;               \
+                                                                                                \
+        g_assert_cmpint(_idx, <, nm_setting_connection_get_num_permissions(_s_con));            \
+        g_assert(                                                                               \
+            nm_setting_connection_get_permission(_s_con, _idx, _p_ptype, _p_pitem, _p_detail)); \
+        if (_p_ptype)                                                                           \
+            g_assert_cmpstr(_ptype, ==, "invalid");                                             \
+        if (_p_pitem) {                                                                         \
+            const char *_expected_item = (expected_item);                                       \
+                                                                                                \
+            if (!_expected_item)                                                                \
+                g_assert_cmpstr(_pitem, !=, NULL);                                              \
+            else                                                                                \
+                g_assert_cmpstr(_pitem, ==, _expected_item);                                    \
+        }                                                                                       \
+        if (_p_detail)                                                                          \
+            g_assert_cmpstr(_detail, ==, NULL);                                                 \
+    }                                                                                           \
+    G_STMT_END
+
+    /* Ensure a bad [type] is rejected */
+    add_permission_property(s_con, "foobar", "blah", -1, NULL);
+    g_assert_cmpint(nm_setting_connection_get_num_permissions(s_con), ==, 1);
+    _assert_permission_invalid_at_idx(s_con, 0, "foobar:blah:");
+
+    /* Ensure a bad [type] is rejected */
+    add_permission_property(s_con, NULL, "blah", -1, NULL);
+    g_assert_cmpint(nm_setting_connection_get_num_permissions(s_con), ==, 1);
+    _assert_permission_invalid_at_idx(s_con, 0, ":blah:");
+
+    /* Ensure a bad [item] is rejected */
+    add_permission_property(s_con, "user", NULL, -1, NULL);
+    g_assert_cmpint(nm_setting_connection_get_num_permissions(s_con), ==, 1);
+    _assert_permission_invalid_at_idx(s_con, 0, "user::");
+
+    /* Ensure a bad [item] is rejected */
+    add_permission_property(s_con, "user", "", -1, NULL);
+    g_assert_cmpint(nm_setting_connection_get_num_permissions(s_con), ==, 1);
+    _assert_permission_invalid_at_idx(s_con, 0, "user::");
+
+    /* Ensure an [item] with ':' in the middle is rejected */
+    add_permission_property(s_con, "user", "ad:asdf", -1, NULL);
+    g_assert_cmpint(nm_setting_connection_get_num_permissions(s_con), ==, 1);
+    _assert_permission_invalid_at_idx(s_con, 0, "user:ad:asdf:");
+
+    /* Ensure an [item] with ':' at the end is rejected */
+    add_permission_property(s_con, "user", "adasdfaf:", -1, NULL);
+    g_assert_cmpint(nm_setting_connection_get_num_permissions(s_con), ==, 1);
+    _assert_permission_invalid_at_idx(s_con, 0, "user:adasdfaf::");
+
+    /* Ensure a non-UTF-8 [item] is rejected */
+    add_permission_property(s_con, "user", buf, (int) sizeof(buf), NULL);
+    g_assert_cmpint(nm_setting_connection_get_num_permissions(s_con), ==, 1);
+    _assert_permission_invalid_at_idx(s_con, 0, NULL);
+
+    /* Ensure a non-NULL [detail] is rejected */
+    add_permission_property(s_con, "user", "dafasdf", -1, "asdf");
+    g_assert_cmpint(nm_setting_connection_get_num_permissions(s_con), ==, 1);
+    _assert_permission_invalid_at_idx(s_con, 0, "user:dafasdf:asdf");
+
+    /* Ensure a valid call results in success */
+    success = nm_setting_connection_add_permission(s_con, "user", TEST_UNAME, NULL);
+    g_assert(success);
+    g_assert_cmpint(nm_setting_connection_get_num_permissions(s_con), ==, 2);
+    _assert_permission_invalid_at_idx(s_con, 0, "user:dafasdf:asdf");
+    check_permission(s_con, 1, TEST_UNAME);
+
+    /* Now remove that permission and ensure we have 0 permissions */
+    nm_setting_connection_remove_permission(s_con, 0);
+    g_assert_cmpint(nm_setting_connection_get_num_permissions(s_con), ==, 1);
+}
+
+static void
+test_connection_compare_same(void)
+{
+    NMConnection *a, *b;
+
+    a = new_test_connection();
+    b = nm_simple_connection_new_clone(a);
+    g_assert(nm_connection_compare(a, b, NM_SETTING_COMPARE_FLAG_EXACT));
+    g_object_unref(a);
+    g_object_unref(b);
+}
+
+static void
+test_connection_compare_key_only_in_a(void)
+{
+    NMConnection *       a, *b;
+    NMSettingConnection *s_con;
+
+    a     = new_test_connection();
+    b     = nm_simple_connection_new_clone(a);
+    s_con = (NMSettingConnection *) nm_connection_get_setting(b, NM_TYPE_SETTING_CONNECTION);
+    g_assert(s_con);
+    g_object_set(s_con, NM_SETTING_CONNECTION_TIMESTAMP, (guint64) 0, NULL);
+
+    g_assert(!nm_connection_compare(a, b, NM_SETTING_COMPARE_FLAG_EXACT));
+    g_object_unref(a);
+    g_object_unref(b);
+}
+
+static void
+test_connection_compare_setting_only_in_a(void)
+{
+    NMConnection *a, *b;
+
+    a = new_test_connection();
+    b = nm_simple_connection_new_clone(a);
+    nm_connection_remove_setting(b, NM_TYPE_SETTING_IP4_CONFIG);
+    g_assert(!nm_connection_compare(a, b, NM_SETTING_COMPARE_FLAG_EXACT));
+    g_object_unref(a);
+    g_object_unref(b);
+}
+
+static void
+test_connection_compare_key_only_in_b(void)
+{
+    NMConnection *       a, *b;
+    NMSettingConnection *s_con;
+
+    a     = new_test_connection();
+    b     = nm_simple_connection_new_clone(a);
+    s_con = (NMSettingConnection *) nm_connection_get_setting(b, NM_TYPE_SETTING_CONNECTION);
+    g_assert(s_con);
+    g_object_set(s_con, NM_SETTING_CONNECTION_TIMESTAMP, (guint64) 0, NULL);
+
+    g_assert(!nm_connection_compare(a, b, NM_SETTING_COMPARE_FLAG_EXACT));
+    g_object_unref(a);
+    g_object_unref(b);
+}
+
+static void
+test_connection_compare_setting_only_in_b(void)
+{
+    NMConnection *a, *b;
+
+    a = new_test_connection();
+    b = nm_simple_connection_new_clone(a);
+    nm_connection_remove_setting(a, NM_TYPE_SETTING_IP4_CONFIG);
+    g_assert(!nm_connection_compare(a, b, NM_SETTING_COMPARE_FLAG_EXACT));
+    g_object_unref(a);
+    g_object_unref(b);
+}
+
+typedef struct {
+    const char *key_name;
+    guint32     result;
+} DiffKey;
+
+typedef struct {
+    const char *name;
+    DiffKey     keys[30];
+} DiffSetting;
+
+#define ARRAY_LEN(a) (sizeof(a) / sizeof(a[0]))
+
+static void
+ensure_diffs(GHashTable *diffs, const DiffSetting *check, gsize n_check)
+{
+    guint i;
+
+    g_assert(g_hash_table_size(diffs) == n_check);
+
+    /* Loop through the settings */
+    for (i = 0; i < n_check; i++) {
+        GHashTable *setting_hash;
+        guint       z = 0;
+
+        setting_hash = g_hash_table_lookup(diffs, check[i].name);
+        g_assert(setting_hash);
+
+        /* Get the number of keys to check */
+        while (check[i].keys[z].key_name)
+            z++;
+        g_assert(g_hash_table_size(setting_hash) == z);
+
+        /* Now compare the actual keys */
+        for (z = 0; check[i].keys[z].key_name; z++) {
+            NMSettingDiffResult result;
+
+            result = GPOINTER_TO_UINT(g_hash_table_lookup(setting_hash, check[i].keys[z].key_name));
+            g_assert(result == check[i].keys[z].result);
+        }
+    }
+}
+
+static void
+test_connection_diff_a_only(void)
+{
+    NMConnection *    connection;
+    GHashTable *      out_diffs = NULL;
+    gboolean          same;
+    const DiffSetting settings[] = {
+        {NM_SETTING_CONNECTION_SETTING_NAME,
+         {{NM_SETTING_CONNECTION_ID, NM_SETTING_DIFF_RESULT_IN_A},
+          {NM_SETTING_CONNECTION_UUID, NM_SETTING_DIFF_RESULT_IN_A},
+          {NM_SETTING_CONNECTION_STABLE_ID, NM_SETTING_DIFF_RESULT_IN_A},
+          {NM_SETTING_CONNECTION_INTERFACE_NAME, NM_SETTING_DIFF_RESULT_IN_A},
+          {NM_SETTING_CONNECTION_TYPE, NM_SETTING_DIFF_RESULT_IN_A},
+          {NM_SETTING_CONNECTION_TIMESTAMP, NM_SETTING_DIFF_RESULT_IN_A},
+          {NM_SETTING_CONNECTION_AUTOCONNECT, NM_SETTING_DIFF_RESULT_IN_A},
+          {NM_SETTING_CONNECTION_AUTOCONNECT_PRIORITY, NM_SETTING_DIFF_RESULT_IN_A},
+          {NM_SETTING_CONNECTION_AUTOCONNECT_RETRIES, NM_SETTING_DIFF_RESULT_IN_A},
+          {NM_SETTING_CONNECTION_MULTI_CONNECT, NM_SETTING_DIFF_RESULT_IN_A},
+          {NM_SETTING_CONNECTION_READ_ONLY, NM_SETTING_DIFF_RESULT_IN_A},
+          {NM_SETTING_CONNECTION_PERMISSIONS, NM_SETTING_DIFF_RESULT_IN_A},
+          {NM_SETTING_CONNECTION_ZONE, NM_SETTING_DIFF_RESULT_IN_A},
+          {NM_SETTING_CONNECTION_MASTER, NM_SETTING_DIFF_RESULT_IN_A},
+          {NM_SETTING_CONNECTION_SLAVE_TYPE, NM_SETTING_DIFF_RESULT_IN_A},
+          {NM_SETTING_CONNECTION_AUTOCONNECT_SLAVES, NM_SETTING_DIFF_RESULT_IN_A},
+          {NM_SETTING_CONNECTION_SECONDARIES, NM_SETTING_DIFF_RESULT_IN_A},
+          {NM_SETTING_CONNECTION_GATEWAY_PING_TIMEOUT, NM_SETTING_DIFF_RESULT_IN_A},
+          {NM_SETTING_CONNECTION_METERED, NM_SETTING_DIFF_RESULT_IN_A},
+          {NM_SETTING_CONNECTION_LLDP, NM_SETTING_DIFF_RESULT_IN_A},
+          {NM_SETTING_CONNECTION_AUTH_RETRIES, NM_SETTING_DIFF_RESULT_IN_A},
+          {NM_SETTING_CONNECTION_MDNS, NM_SETTING_DIFF_RESULT_IN_A},
+          {NM_SETTING_CONNECTION_LLMNR, NM_SETTING_DIFF_RESULT_IN_A},
+          {NM_SETTING_CONNECTION_MUD_URL, NM_SETTING_DIFF_RESULT_IN_A},
+          {NM_SETTING_CONNECTION_WAIT_DEVICE_TIMEOUT, NM_SETTING_DIFF_RESULT_IN_A},
+          {NULL, NM_SETTING_DIFF_RESULT_UNKNOWN}}},
+        {NM_SETTING_WIRED_SETTING_NAME,
+         {
+             {NM_SETTING_WIRED_PORT, NM_SETTING_DIFF_RESULT_IN_A},
+             {NM_SETTING_WIRED_SPEED, NM_SETTING_DIFF_RESULT_IN_A},
+             {NM_SETTING_WIRED_DUPLEX, NM_SETTING_DIFF_RESULT_IN_A},
+             {NM_SETTING_WIRED_AUTO_NEGOTIATE, NM_SETTING_DIFF_RESULT_IN_A},
+             {NM_SETTING_WIRED_MAC_ADDRESS, NM_SETTING_DIFF_RESULT_IN_A},
+             {NM_SETTING_WIRED_CLONED_MAC_ADDRESS, NM_SETTING_DIFF_RESULT_IN_A},
+             {NM_SETTING_WIRED_GENERATE_MAC_ADDRESS_MASK, NM_SETTING_DIFF_RESULT_IN_A},
+             {NM_SETTING_WIRED_MAC_ADDRESS_BLACKLIST, NM_SETTING_DIFF_RESULT_IN_A},
+             {NM_SETTING_WIRED_MTU, NM_SETTING_DIFF_RESULT_IN_A},
+             {NM_SETTING_WIRED_S390_SUBCHANNELS, NM_SETTING_DIFF_RESULT_IN_A},
+             {NM_SETTING_WIRED_S390_NETTYPE, NM_SETTING_DIFF_RESULT_IN_A},
+             {NM_SETTING_WIRED_S390_OPTIONS, NM_SETTING_DIFF_RESULT_IN_A},
+             {NM_SETTING_WIRED_WAKE_ON_LAN, NM_SETTING_DIFF_RESULT_IN_A},
+             {NM_SETTING_WIRED_WAKE_ON_LAN_PASSWORD, NM_SETTING_DIFF_RESULT_IN_A},
+             {NM_SETTING_WIRED_ACCEPT_ALL_MAC_ADDRESSES, NM_SETTING_DIFF_RESULT_IN_A},
+             {NULL, NM_SETTING_DIFF_RESULT_UNKNOWN},
+         }},
+        {NM_SETTING_IP4_CONFIG_SETTING_NAME,
+         {
+             {NM_SETTING_IP_CONFIG_METHOD, NM_SETTING_DIFF_RESULT_IN_A},
+             {NM_SETTING_IP_CONFIG_DNS, NM_SETTING_DIFF_RESULT_IN_A},
+             {NM_SETTING_IP_CONFIG_DNS_SEARCH, NM_SETTING_DIFF_RESULT_IN_A},
+             {NM_SETTING_IP_CONFIG_DNS_OPTIONS, NM_SETTING_DIFF_RESULT_IN_A},
+             {NM_SETTING_IP_CONFIG_ADDRESSES, NM_SETTING_DIFF_RESULT_IN_A},
+             {NM_SETTING_IP_CONFIG_GATEWAY, NM_SETTING_DIFF_RESULT_IN_A},
+             {NM_SETTING_IP_CONFIG_ROUTES, NM_SETTING_DIFF_RESULT_IN_A},
+             {NM_SETTING_IP_CONFIG_ROUTE_METRIC, NM_SETTING_DIFF_RESULT_IN_A},
+             {NM_SETTING_IP_CONFIG_ROUTE_TABLE, NM_SETTING_DIFF_RESULT_IN_A},
+             {NM_SETTING_IP_CONFIG_ROUTING_RULES, NM_SETTING_DIFF_RESULT_IN_A},
+             {NM_SETTING_IP_CONFIG_IGNORE_AUTO_ROUTES, NM_SETTING_DIFF_RESULT_IN_A},
+             {NM_SETTING_IP_CONFIG_IGNORE_AUTO_DNS, NM_SETTING_DIFF_RESULT_IN_A},
+             {NM_SETTING_IP4_CONFIG_DHCP_CLIENT_ID, NM_SETTING_DIFF_RESULT_IN_A},
+             {NM_SETTING_IP_CONFIG_DHCP_TIMEOUT, NM_SETTING_DIFF_RESULT_IN_A},
+             {NM_SETTING_IP_CONFIG_DHCP_SEND_HOSTNAME, NM_SETTING_DIFF_RESULT_IN_A},
+             {NM_SETTING_IP_CONFIG_DHCP_HOSTNAME, NM_SETTING_DIFF_RESULT_IN_A},
+             {NM_SETTING_IP_CONFIG_DHCP_HOSTNAME_FLAGS, NM_SETTING_DIFF_RESULT_IN_A},
+             {NM_SETTING_IP4_CONFIG_DHCP_FQDN, NM_SETTING_DIFF_RESULT_IN_A},
+             {NM_SETTING_IP_CONFIG_NEVER_DEFAULT, NM_SETTING_DIFF_RESULT_IN_A},
+             {NM_SETTING_IP_CONFIG_MAY_FAIL, NM_SETTING_DIFF_RESULT_IN_A},
+             {NM_SETTING_IP_CONFIG_DAD_TIMEOUT, NM_SETTING_DIFF_RESULT_IN_A},
+             {NM_SETTING_IP_CONFIG_REQUIRED_TIMEOUT, NM_SETTING_DIFF_RESULT_IN_A},
+             {NM_SETTING_IP_CONFIG_DNS_PRIORITY, NM_SETTING_DIFF_RESULT_IN_A},
+             {NM_SETTING_IP_CONFIG_DHCP_IAID, NM_SETTING_DIFF_RESULT_IN_A},
+             {NM_SETTING_IP4_CONFIG_DHCP_VENDOR_CLASS_IDENTIFIER, NM_SETTING_DIFF_RESULT_IN_A},
+             {NM_SETTING_IP_CONFIG_DHCP_REJECT_SERVERS, NM_SETTING_DIFF_RESULT_IN_A},
+             {NULL, NM_SETTING_DIFF_RESULT_UNKNOWN},
+         }},
+    };
+
+    connection = new_test_connection();
+
+    same = nm_connection_diff(connection, NULL, NM_SETTING_COMPARE_FLAG_EXACT, &out_diffs);
+    g_assert(same == FALSE);
+    g_assert(out_diffs != NULL);
+    g_assert(g_hash_table_size(out_diffs) > 0);
+
+    ensure_diffs(out_diffs, settings, ARRAY_LEN(settings));
+
+    g_hash_table_destroy(out_diffs);
+    g_object_unref(connection);
+}
+
+static void
+test_connection_diff_same(void)
+{
+    NMConnection *a, *b;
+    GHashTable *  out_diffs = NULL;
+    gboolean      same;
+
+    a = new_test_connection();
+    b = nm_simple_connection_new_clone(a);
+
+    same = nm_connection_diff(a, b, NM_SETTING_COMPARE_FLAG_EXACT, &out_diffs);
+    g_assert(same == TRUE);
+    g_assert(out_diffs == NULL);
+    g_object_unref(a);
+    g_object_unref(b);
+}
+
+static void
+test_connection_diff_different(void)
+{
+    NMConnection *     a, *b;
+    GHashTable *       out_diffs = NULL;
+    NMSettingIPConfig *s_ip4;
+    gboolean           same;
+    const DiffSetting  settings[] = {
+        {NM_SETTING_IP4_CONFIG_SETTING_NAME,
+         {
+             {NM_SETTING_IP_CONFIG_METHOD,
+              NM_SETTING_DIFF_RESULT_IN_A | NM_SETTING_DIFF_RESULT_IN_B},
+             {NULL, NM_SETTING_DIFF_RESULT_UNKNOWN},
+         }},
+    };
+
+    a     = new_test_connection();
+    b     = nm_simple_connection_new_clone(a);
+    s_ip4 = nm_connection_get_setting_ip4_config(a);
+    g_assert(s_ip4);
+    g_object_set(G_OBJECT(s_ip4),
+                 NM_SETTING_IP_CONFIG_METHOD,
+                 NM_SETTING_IP4_CONFIG_METHOD_MANUAL,
+                 NULL);
+
+    same = nm_connection_diff(a, b, NM_SETTING_COMPARE_FLAG_EXACT, &out_diffs);
+    g_assert(same == FALSE);
+    g_assert(out_diffs != NULL);
+    g_assert(g_hash_table_size(out_diffs) > 0);
+
+    ensure_diffs(out_diffs, settings, ARRAY_LEN(settings));
+
+    g_hash_table_destroy(out_diffs);
+    g_object_unref(a);
+    g_object_unref(b);
+}
+
+static void
+test_connection_diff_no_secrets(void)
+{
+    NMConnection *    a, *b;
+    GHashTable *      out_diffs = NULL;
+    NMSetting *       s_pppoe;
+    gboolean          same;
+    const DiffSetting settings[] = {
+        {NM_SETTING_PPPOE_SETTING_NAME,
+         {
+             {NM_SETTING_PPPOE_PASSWORD, NM_SETTING_DIFF_RESULT_IN_B},
+             {NULL, NM_SETTING_DIFF_RESULT_UNKNOWN},
+         }},
+    };
+
+    a       = new_test_connection();
+    s_pppoe = nm_setting_pppoe_new();
+    g_object_set(G_OBJECT(s_pppoe), NM_SETTING_PPPOE_USERNAME, "thomas", NULL);
+    nm_connection_add_setting(a, s_pppoe);
+
+    b = nm_simple_connection_new_clone(a);
+
+    /* Add a secret to B */
+    s_pppoe = NM_SETTING(nm_connection_get_setting_pppoe(b));
+    g_assert(s_pppoe);
+    g_object_set(G_OBJECT(s_pppoe), NM_SETTING_PPPOE_PASSWORD, "secretpassword", NULL);
+
+    /* Make sure the diff returns no results as secrets are ignored */
+    same = nm_connection_diff(a, b, NM_SETTING_COMPARE_FLAG_IGNORE_SECRETS, &out_diffs);
+    g_assert(same == TRUE);
+    g_assert(out_diffs == NULL);
+
+    /* Now make sure the diff returns results if secrets are not ignored */
+    same = nm_connection_diff(a, b, NM_SETTING_COMPARE_FLAG_EXACT, &out_diffs);
+    g_assert(same == FALSE);
+    g_assert(out_diffs != NULL);
+    g_assert(g_hash_table_size(out_diffs) > 0);
+
+    ensure_diffs(out_diffs, settings, ARRAY_LEN(settings));
+
+    g_hash_table_destroy(out_diffs);
+    g_object_unref(a);
+    g_object_unref(b);
+}
+
+static void
+test_connection_diff_inferrable(void)
+{
+    NMConnection *       a, *b;
+    GHashTable *         out_diffs = NULL;
+    gboolean             same;
+    NMSettingConnection *s_con;
+    NMSettingWired *     s_wired;
+    NMSettingIPConfig *  s_ip4;
+    char *               uuid;
+    const DiffSetting    settings[] = {
+        {NM_SETTING_CONNECTION_SETTING_NAME,
+         {
+             {NM_SETTING_CONNECTION_INTERFACE_NAME, NM_SETTING_DIFF_RESULT_IN_A},
+             {NULL, NM_SETTING_DIFF_RESULT_UNKNOWN},
+         }},
+    };
+
+    a = new_test_connection();
+    b = nm_simple_connection_new_clone(a);
+
+    /* Change the UUID, wired MTU, and set ignore-auto-dns */
+    s_con = nm_connection_get_setting_connection(a);
+    g_assert(s_con);
+    uuid = nm_utils_uuid_generate();
+    g_object_set(G_OBJECT(s_con),
+                 NM_SETTING_CONNECTION_UUID,
+                 uuid,
+                 NM_SETTING_CONNECTION_ID,
+                 "really neat connection",
+                 NULL);
+    g_free(uuid);
+
+    s_wired = nm_connection_get_setting_wired(a);
+    g_assert(s_wired);
+    g_object_set(G_OBJECT(s_wired), NM_SETTING_WIRED_MTU, 300, NULL);
+
+    s_ip4 = nm_connection_get_setting_ip4_config(a);
+    g_assert(s_ip4);
+    g_object_set(G_OBJECT(s_ip4), NM_SETTING_IP_CONFIG_IGNORE_AUTO_DNS, TRUE, NULL);
+
+    /* Make sure the diff returns no results as secrets are ignored */
+    same = nm_connection_diff(a, b, NM_SETTING_COMPARE_FLAG_INFERRABLE, &out_diffs);
+    g_assert(same == TRUE);
+    g_assert(out_diffs == NULL);
+
+    /* And change a INFERRABLE property to ensure that it shows up in the diff results */
+    g_object_set(G_OBJECT(s_con), NM_SETTING_CONNECTION_INTERFACE_NAME, "usb0", NULL);
+
+    /* Make sure the diff returns no results as secrets are ignored */
+    same = nm_connection_diff(a, b, NM_SETTING_COMPARE_FLAG_INFERRABLE, &out_diffs);
+    g_assert(same == FALSE);
+    g_assert(out_diffs != NULL);
+    g_assert(g_hash_table_size(out_diffs) > 0);
+
+    ensure_diffs(out_diffs, settings, ARRAY_LEN(settings));
+
+    g_hash_table_destroy(out_diffs);
+    g_object_unref(a);
+    g_object_unref(b);
+}
+
+static void
+add_generic_settings(NMConnection *connection, const char *ctype)
+{
+    NMSetting *setting;
+    char *     uuid;
+
+    uuid = nm_utils_uuid_generate();
+
+    setting = nm_setting_connection_new();
+    g_object_set(setting,
+                 NM_SETTING_CONNECTION_ID,
+                 "asdfasdfadf",
+                 NM_SETTING_CONNECTION_TYPE,
+                 ctype,
+                 NM_SETTING_CONNECTION_UUID,
+                 uuid,
+                 NULL);
+    nm_connection_add_setting(connection, setting);
+
+    g_free(uuid);
+
+    setting = nm_setting_ip4_config_new();
+    g_object_set(setting, NM_SETTING_IP_CONFIG_METHOD, NM_SETTING_IP4_CONFIG_METHOD_AUTO, NULL);
+    nm_connection_add_setting(connection, setting);
+
+    setting = nm_setting_ip6_config_new();
+    g_object_set(setting, NM_SETTING_IP_CONFIG_METHOD, NM_SETTING_IP6_CONFIG_METHOD_AUTO, NULL);
+    nm_connection_add_setting(connection, setting);
+}
+
+static void
+test_connection_good_base_types(void)
+{
+    NMConnection *connection;
+    NMSetting *   setting;
+    gboolean      success;
+    GError *      error = NULL;
+    GBytes *      ssid;
+    const char *  bdaddr = "11:22:33:44:55:66";
+
+    /* Try a basic wired connection */
+    connection = nm_simple_connection_new();
+    add_generic_settings(connection, NM_SETTING_WIRED_SETTING_NAME);
+    setting = nm_setting_wired_new();
+    nm_connection_add_setting(connection, setting);
+
+    success = nm_connection_verify(connection, &error);
+    g_assert_no_error(error);
+    g_assert(success);
+    g_object_unref(connection);
+
+    /* Try a wired PPPoE connection */
+    connection = nm_simple_connection_new();
+    add_generic_settings(connection, NM_SETTING_PPPOE_SETTING_NAME);
+    setting = nm_setting_pppoe_new();
+    g_object_set(setting, NM_SETTING_PPPOE_USERNAME, "bob smith", NULL);
+    nm_connection_add_setting(connection, setting);
+
+    success = nm_connection_verify(connection, &error);
+    g_assert_no_error(error);
+    g_assert(success);
+    g_object_unref(connection);
+
+    /* Wifi connection */
+    connection = nm_simple_connection_new();
+    add_generic_settings(connection, NM_SETTING_WIRELESS_SETTING_NAME);
+
+    setting = nm_setting_wireless_new();
+    ssid    = g_bytes_new("1234567", 7);
+    g_object_set(setting,
+                 NM_SETTING_WIRELESS_SSID,
+                 ssid,
+                 NM_SETTING_WIRELESS_MODE,
+                 "infrastructure",
+                 NULL);
+    g_bytes_unref(ssid);
+    nm_connection_add_setting(connection, setting);
+
+    success = nm_connection_verify(connection, &error);
+    g_assert_no_error(error);
+    g_assert(success);
+    g_object_unref(connection);
+
+    /* Bluetooth connection */
+    connection = nm_simple_connection_new();
+    add_generic_settings(connection, NM_SETTING_BLUETOOTH_SETTING_NAME);
+
+    setting = nm_setting_bluetooth_new();
+    g_object_set(setting,
+                 NM_SETTING_BLUETOOTH_BDADDR,
+                 bdaddr,
+                 NM_SETTING_CONNECTION_TYPE,
+                 NM_SETTING_BLUETOOTH_TYPE_PANU,
+                 NULL);
+    nm_connection_add_setting(connection, setting);
+
+    success = nm_connection_verify(connection, &error);
+    g_assert_no_error(error);
+    g_assert(success);
+    g_object_unref(connection);
+
+    /* WiMAX connection */
+    connection = nm_simple_connection_new();
+    add_generic_settings(connection, NM_SETTING_WIMAX_SETTING_NAME);
+    setting = nm_setting_wimax_new();
+    g_object_set(setting, NM_SETTING_WIMAX_NETWORK_NAME, "CLEAR", NULL);
+    nm_connection_add_setting(connection, setting);
+
+    success = nm_connection_verify(connection, &error);
+    g_assert_no_error(error);
+    g_assert(success);
+    g_object_unref(connection);
+
+    /* GSM connection */
+    connection = nm_simple_connection_new();
+    add_generic_settings(connection, NM_SETTING_GSM_SETTING_NAME);
+
+    setting = nm_setting_gsm_new();
+    g_object_set(setting, NM_SETTING_GSM_APN, "metered.billing.sucks", NULL);
+    nm_connection_add_setting(connection, setting);
+
+    /* CDMA connection */
+    connection = nm_simple_connection_new();
+    add_generic_settings(connection, NM_SETTING_CDMA_SETTING_NAME);
+
+    setting = nm_setting_cdma_new();
+    g_object_set(setting,
+                 NM_SETTING_CDMA_NUMBER,
+                 "#777",
+                 NM_SETTING_CDMA_USERNAME,
+                 "foobar@vzw.com",
+                 NULL);
+    nm_connection_add_setting(connection, setting);
+
+    success = nm_connection_verify(connection, &error);
+    g_assert_no_error(error);
+    g_assert(success);
+    g_object_unref(connection);
+}
+
+static void
+test_connection_bad_base_types(void)
+{
+    NMConnection *connection;
+    NMSetting *   setting;
+    gboolean      success;
+    GError *      error = NULL;
+
+    /* Test various non-base connection types to make sure they are rejected;
+     * using a fake 'wired' connection so the rest of it verifies
+     */
+
+    /* Connection setting */
+    connection = nm_simple_connection_new();
+    add_generic_settings(connection, NM_SETTING_CONNECTION_SETTING_NAME);
+    setting = nm_setting_wired_new();
+    nm_connection_add_setting(connection, setting);
+
+    success = nm_connection_verify(connection, &error);
+    g_assert_error(error, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_INVALID_PROPERTY);
+    g_assert(g_str_has_prefix(error->message, "connection.type: "));
+    g_assert(success == FALSE);
+    g_object_unref(connection);
+    g_clear_error(&error);
+
+    /* PPP setting */
+    connection = nm_simple_connection_new();
+    add_generic_settings(connection, NM_SETTING_PPP_SETTING_NAME);
+    setting = nm_setting_wired_new();
+    nm_connection_add_setting(connection, setting);
+    setting = nm_setting_ppp_new();
+    nm_connection_add_setting(connection, setting);
+
+    success = nm_connection_verify(connection, &error);
+    g_assert_error(error, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_INVALID_PROPERTY);
+    g_assert(g_str_has_prefix(error->message, "connection.type: "));
+    g_assert(success == FALSE);
+    g_object_unref(connection);
+    g_clear_error(&error);
+
+    /* Serial setting */
+    connection = nm_simple_connection_new();
+    add_generic_settings(connection, NM_SETTING_SERIAL_SETTING_NAME);
+    setting = nm_setting_wired_new();
+    nm_connection_add_setting(connection, setting);
+    setting = nm_setting_serial_new();
+    nm_connection_add_setting(connection, setting);
+
+    success = nm_connection_verify(connection, &error);
+    g_assert_error(error, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_INVALID_PROPERTY);
+    g_assert(g_str_has_prefix(error->message, "connection.type: "));
+    g_assert(success == FALSE);
+    g_object_unref(connection);
+    g_clear_error(&error);
+
+    /* IP4 setting */
+    connection = nm_simple_connection_new();
+    add_generic_settings(connection, NM_SETTING_IP4_CONFIG_SETTING_NAME);
+    setting = nm_setting_wired_new();
+    nm_connection_add_setting(connection, setting);
+
+    success = nm_connection_verify(connection, &error);
+    g_assert_error(error, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_INVALID_PROPERTY);
+    g_assert(g_str_has_prefix(error->message, "connection.type: "));
+    g_assert(success == FALSE);
+    g_object_unref(connection);
+    g_clear_error(&error);
+
+    /* IP6 setting */
+    connection = nm_simple_connection_new();
+    add_generic_settings(connection, NM_SETTING_IP6_CONFIG_SETTING_NAME);
+    setting = nm_setting_wired_new();
+    nm_connection_add_setting(connection, setting);
+
+    success = nm_connection_verify(connection, &error);
+    g_assert_error(error, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_INVALID_PROPERTY);
+    g_assert(g_str_has_prefix(error->message, "connection.type: "));
+    g_assert(success == FALSE);
+    g_object_unref(connection);
+    g_clear_error(&error);
+}
+
+static void
+test_setting_compare_id(void)
+{
+    gs_unref_object NMSetting *old = NULL, *new = NULL;
+    gboolean                   success;
+
+    old = nm_setting_connection_new();
+    g_object_set(old,
+                 NM_SETTING_CONNECTION_ID,
+                 "really awesome cool connection",
+                 NM_SETTING_CONNECTION_UUID,
+                 "fbbd59d5-acab-4e30-8f86-258d272617e7",
+                 NM_SETTING_CONNECTION_AUTOCONNECT,
+                 FALSE,
+                 NULL);
+
+    new = nm_setting_duplicate(old);
+    g_object_set(new, NM_SETTING_CONNECTION_ID, "some different connection id", NULL);
+
+    /* First make sure they are different */
+    success = nm_setting_compare(old, new, NM_SETTING_COMPARE_FLAG_EXACT);
+    g_assert(success == FALSE);
+
+    success = nm_setting_compare(old, new, NM_SETTING_COMPARE_FLAG_IGNORE_ID);
+    g_assert(success);
+}
+
+static void
+test_setting_compare_addresses(void)
+{
+    gs_unref_object NMSetting *s1 = NULL, *s2 = NULL;
+    gboolean                   success;
+    NMIPAddress *              a;
+    GHashTable *               result = NULL;
+
+    s1 = nm_setting_ip4_config_new();
+    s2 = nm_setting_ip4_config_new();
+
+    a = nm_ip_address_new(AF_INET, "192.168.7.5", 24, NULL);
+
+    nm_ip_address_set_attribute(a, NM_IP_ADDRESS_ATTRIBUTE_LABEL, g_variant_new_string("xoxoxo"));
+    nm_setting_ip_config_add_address((NMSettingIPConfig *) s1, a);
+
+    nm_ip_address_set_attribute(a, NM_IP_ADDRESS_ATTRIBUTE_LABEL, g_variant_new_string("hello"));
+    nm_setting_ip_config_add_address((NMSettingIPConfig *) s2, a);
+
+    nm_ip_address_unref(a);
+
+    if (nmtst_get_rand_uint32() % 2)
+        NM_SWAP(&s1, &s2);
+
+    success = nm_setting_compare(s1, s2, NM_SETTING_COMPARE_FLAG_EXACT);
+    g_assert(!success);
+
+    success = nm_setting_diff(s1, s2, NM_SETTING_COMPARE_FLAG_EXACT, FALSE, &result);
+    g_assert(!success);
+    nm_clear_pointer(&result, g_hash_table_unref);
+}
+
+static void
+test_setting_compare_routes(void)
+{
+    gs_unref_object NMSetting *s1 = NULL, *s2 = NULL;
+    gboolean                   success;
+    NMIPRoute *                r;
+    GHashTable *               result = NULL;
+
+    s1 = nm_setting_ip4_config_new();
+    s2 = nm_setting_ip4_config_new();
+
+    r = nm_ip_route_new(AF_INET, "192.168.12.0", 24, "192.168.11.1", 473, NULL);
+
+    nm_ip_route_set_attribute(r, NM_IP_ADDRESS_ATTRIBUTE_LABEL, g_variant_new_string("xoxoxo"));
+    nm_setting_ip_config_add_route((NMSettingIPConfig *) s1, r);
+
+    nm_ip_route_set_attribute(r, NM_IP_ADDRESS_ATTRIBUTE_LABEL, g_variant_new_string("hello"));
+    nm_setting_ip_config_add_route((NMSettingIPConfig *) s2, r);
+
+    nm_ip_route_unref(r);
+
+    if (nmtst_get_rand_uint32() % 2)
+        NM_SWAP(&s1, &s2);
+
+    success = nm_setting_compare(s1, s2, NM_SETTING_COMPARE_FLAG_EXACT);
+    g_assert(!success);
+
+    success = nm_setting_diff(s1, s2, NM_SETTING_COMPARE_FLAG_EXACT, FALSE, &result);
+    g_assert(!success);
+    nm_clear_pointer(&result, g_hash_table_unref);
+}
+
+static void
+test_setting_compare_wired_cloned_mac_address(void)
+{
+    gs_unref_object NMSetting *old = NULL, *new = NULL;
+    gboolean                   success;
+    gs_free char *             str1 = NULL;
+
+    old = nm_setting_wired_new();
+    g_object_set(old, NM_SETTING_WIRED_CLONED_MAC_ADDRESS, "stable", NULL);
+
+    g_assert_cmpstr("stable", ==, nm_setting_wired_get_cloned_mac_address((NMSettingWired *) old));
+    g_object_get(old, NM_SETTING_WIRED_CLONED_MAC_ADDRESS, &str1, NULL);
+    g_assert_cmpstr("stable", ==, str1);
+    nm_clear_g_free(&str1);
+
+    new = nm_setting_duplicate(old);
+    g_object_set(new, NM_SETTING_WIRED_CLONED_MAC_ADDRESS, "11:22:33:44:55:66", NULL);
+
+    g_assert_cmpstr("11:22:33:44:55:66",
+                    ==,
+                    nm_setting_wired_get_cloned_mac_address((NMSettingWired *) new));
+    g_object_get(new, NM_SETTING_WIRED_CLONED_MAC_ADDRESS, &str1, NULL);
+    g_assert_cmpstr("11:22:33:44:55:66", ==, str1);
+    nm_clear_g_free(&str1);
+
+    success = nm_setting_compare(old, new, NM_SETTING_COMPARE_FLAG_EXACT);
+    g_assert(!success);
+    g_clear_object(&new);
+
+    new = nm_setting_duplicate(old);
+    g_object_set(new, NM_SETTING_WIRED_CLONED_MAC_ADDRESS, "stable-bia", NULL);
+
+    g_assert_cmpstr("stable-bia",
+                    ==,
+                    nm_setting_wired_get_cloned_mac_address((NMSettingWired *) new));
+    g_object_get(new, NM_SETTING_WIRED_CLONED_MAC_ADDRESS, &str1, NULL);
+    g_assert_cmpstr("stable-bia", ==, str1);
+    nm_clear_g_free(&str1);
+
+    success = nm_setting_compare(old, new, NM_SETTING_COMPARE_FLAG_EXACT);
+    g_assert(!success);
+    g_clear_object(&new);
+}
+
+static void
+test_setting_compare_wireless_cloned_mac_address(void)
+{
+    gs_unref_object NMSetting *old = NULL, *new = NULL;
+    gboolean                   success;
+    gs_free char *             str1 = NULL;
+
+    old = nm_setting_wireless_new();
+    g_object_set(old, NM_SETTING_WIRELESS_CLONED_MAC_ADDRESS, "stable", NULL);
+
+    g_assert_cmpstr("stable",
+                    ==,
+                    nm_setting_wireless_get_cloned_mac_address((NMSettingWireless *) old));
+    g_object_get(old, NM_SETTING_WIRELESS_CLONED_MAC_ADDRESS, &str1, NULL);
+    g_assert_cmpstr("stable", ==, str1);
+    nm_clear_g_free(&str1);
+
+    new = nm_setting_duplicate(old);
+    g_object_set(new, NM_SETTING_WIRELESS_CLONED_MAC_ADDRESS, "11:22:33:44:55:66", NULL);
+
+    g_assert_cmpstr("11:22:33:44:55:66",
+                    ==,
+                    nm_setting_wireless_get_cloned_mac_address((NMSettingWireless *) new));
+    g_object_get(new, NM_SETTING_WIRELESS_CLONED_MAC_ADDRESS, &str1, NULL);
+    g_assert_cmpstr("11:22:33:44:55:66", ==, str1);
+    nm_clear_g_free(&str1);
+
+    success = nm_setting_compare(old, new, NM_SETTING_COMPARE_FLAG_EXACT);
+    g_assert(!success);
+    g_clear_object(&new);
+
+    new = nm_setting_duplicate(old);
+    g_object_set(new, NM_SETTING_WIRELESS_CLONED_MAC_ADDRESS, "stable-bia", NULL);
+
+    g_assert_cmpstr("stable-bia",
+                    ==,
+                    nm_setting_wireless_get_cloned_mac_address((NMSettingWireless *) new));
+    g_object_get(new, NM_SETTING_WIRELESS_CLONED_MAC_ADDRESS, &str1, NULL);
+    g_assert_cmpstr("stable-bia", ==, str1);
+    nm_clear_g_free(&str1);
+
+    success = nm_setting_compare(old, new, NM_SETTING_COMPARE_FLAG_EXACT);
+    g_assert(!success);
+    g_clear_object(&new);
+}
+
+static void
+test_setting_compare_timestamp(void)
+{
+    gs_unref_object NMSetting *old = NULL, *new = NULL;
+    gboolean                   success;
+
+    old = nm_setting_connection_new();
+    g_object_set(old,
+                 NM_SETTING_CONNECTION_ID,
+                 "ignore timestamp connection",
+                 NM_SETTING_CONNECTION_UUID,
+                 "b047a198-0e0a-4f0e-a653-eea09bb35e40",
+                 NM_SETTING_CONNECTION_AUTOCONNECT,
+                 FALSE,
+                 NM_SETTING_CONNECTION_TIMESTAMP,
+                 (guint64) 1234567890,
+                 NULL);
+
+    new = nm_setting_duplicate(old);
+    g_object_set(new, NM_SETTING_CONNECTION_TIMESTAMP, (guint64) 1416316539, NULL);
+
+    /* First make sure they are different */
+    success = nm_setting_compare(old, new, NM_SETTING_COMPARE_FLAG_EXACT);
+    g_assert(success == FALSE);
+
+    success = nm_setting_compare(old, new, NM_SETTING_COMPARE_FLAG_IGNORE_TIMESTAMP);
+    g_assert(success);
+}
+
+typedef struct {
+    NMSettingSecretFlags  secret_flags;
+    NMSettingCompareFlags comp_flags;
+    gboolean              remove_secret;
+} TestDataCompareSecrets;
+
+static TestDataCompareSecrets *
+test_data_compare_secrets_new(NMSettingSecretFlags  secret_flags,
+                              NMSettingCompareFlags comp_flags,
+                              gboolean              remove_secret)
+{
+    TestDataCompareSecrets *data = g_new0(TestDataCompareSecrets, 1);
+
+    data->secret_flags  = secret_flags;
+    data->comp_flags    = comp_flags;
+    data->remove_secret = remove_secret;
+    return data;
+}
+
+static void
+_test_compare_secrets_check_diff(NMSetting *           a,
+                                 NMSetting *           b,
+                                 NMSettingCompareFlags flags,
+                                 gboolean              exp_same_psk,
+                                 gboolean              exp_same_psk_flags)
+{
+    gs_unref_hashtable GHashTable *h            = NULL;
+    NMSettingDiffResult            _RESULT_IN_A = NM_SETTING_DIFF_RESULT_IN_A;
+    NMSettingDiffResult            _RESULT_IN_B = NM_SETTING_DIFF_RESULT_IN_B;
+    gboolean                       invert_results;
+    gboolean                       diff_result;
+    NMSettingSecretFlags           a_psk_flags =
+        nm_setting_wireless_security_get_psk_flags(NM_SETTING_WIRELESS_SECURITY(a));
+    NMSettingSecretFlags b_psk_flags =
+        nm_setting_wireless_security_get_psk_flags(NM_SETTING_WIRELESS_SECURITY(b));
+    const char *a_psk = nm_setting_wireless_security_get_psk(NM_SETTING_WIRELESS_SECURITY(a));
+    const char *b_psk = nm_setting_wireless_security_get_psk(NM_SETTING_WIRELESS_SECURITY(b));
+
+    g_assert(NM_IS_SETTING_WIRELESS_SECURITY(a));
+    g_assert(NM_IS_SETTING_WIRELESS_SECURITY(b));
+
+    invert_results = nmtst_get_rand_bool();
+    if (invert_results) {
+        _RESULT_IN_A = NM_SETTING_DIFF_RESULT_IN_B;
+        _RESULT_IN_B = NM_SETTING_DIFF_RESULT_IN_A;
+    }
+
+    diff_result = nm_setting_diff(a, b, flags, invert_results, &h);
+
+    g_assert(exp_same_psk_flags == (a_psk_flags == b_psk_flags));
+
+    if (nm_streq0(a_psk, b_psk))
+        g_assert(exp_same_psk);
+    else {
+        if (flags == NM_SETTING_COMPARE_FLAG_EXACT)
+            g_assert(!exp_same_psk);
+        else if (flags == NM_SETTING_COMPARE_FLAG_IGNORE_AGENT_OWNED_SECRETS) {
+            if (!NM_FLAGS_HAS(a_psk_flags, NM_SETTING_SECRET_FLAG_AGENT_OWNED)
+                && !NM_FLAGS_HAS(b_psk_flags, NM_SETTING_SECRET_FLAG_AGENT_OWNED))
+                g_assert(!exp_same_psk);
+            else if (!NM_FLAGS_HAS(a_psk_flags, NM_SETTING_SECRET_FLAG_AGENT_OWNED)
+                     && NM_FLAGS_HAS(b_psk_flags, NM_SETTING_SECRET_FLAG_AGENT_OWNED))
+                g_assert(!exp_same_psk);
+            else
+                g_assert(exp_same_psk);
+        } else if (flags == NM_SETTING_COMPARE_FLAG_IGNORE_NOT_SAVED_SECRETS) {
+            if (!NM_FLAGS_HAS(a_psk_flags, NM_SETTING_SECRET_FLAG_NOT_SAVED)
+                && !NM_FLAGS_HAS(b_psk_flags, NM_SETTING_SECRET_FLAG_NOT_SAVED))
+                g_assert(!exp_same_psk);
+            else if (!NM_FLAGS_HAS(a_psk_flags, NM_SETTING_SECRET_FLAG_NOT_SAVED)
+                     && NM_FLAGS_HAS(b_psk_flags, NM_SETTING_SECRET_FLAG_NOT_SAVED))
+                g_assert(!exp_same_psk);
+            else
+                g_assert(exp_same_psk);
+        } else if (flags == NM_SETTING_COMPARE_FLAG_IGNORE_SECRETS)
+            g_assert(exp_same_psk);
+        else
+            g_assert_not_reached();
+    }
+
+    g_assert(diff_result == (exp_same_psk && exp_same_psk_flags));
+    g_assert(diff_result == (!h));
+
+    if (!diff_result) {
+        if (flags == NM_SETTING_COMPARE_FLAG_EXACT)
+            g_assert(!exp_same_psk);
+        else if (NM_IN_SET(flags,
+                           NM_SETTING_COMPARE_FLAG_IGNORE_AGENT_OWNED_SECRETS,
+                           NM_SETTING_COMPARE_FLAG_IGNORE_NOT_SAVED_SECRETS)
+                 && (a_psk_flags != b_psk_flags)
+                 && nm_setting_wireless_security_get_psk_flags(NM_SETTING_WIRELESS_SECURITY(a))
+                        == NM_SETTING_SECRET_FLAG_NONE)
+            g_assert(!exp_same_psk);
+        else
+            g_assert(exp_same_psk);
+
+        g_assert((!exp_same_psk) == g_hash_table_contains(h, NM_SETTING_WIRELESS_SECURITY_PSK));
+        if (!exp_same_psk) {
+            if (nm_setting_wireless_security_get_psk(NM_SETTING_WIRELESS_SECURITY(a)))
+                g_assert_cmpint(
+                    GPOINTER_TO_UINT(g_hash_table_lookup(h, NM_SETTING_WIRELESS_SECURITY_PSK)),
+                    ==,
+                    _RESULT_IN_A);
+            else
+                g_assert_cmpint(
+                    GPOINTER_TO_UINT(g_hash_table_lookup(h, NM_SETTING_WIRELESS_SECURITY_PSK)),
+                    ==,
+                    _RESULT_IN_B);
+        }
+
+        g_assert((!exp_same_psk_flags)
+                 == g_hash_table_contains(h, NM_SETTING_WIRELESS_SECURITY_PSK_FLAGS));
+        if (!exp_same_psk_flags) {
+            if (nm_setting_wireless_security_get_psk_flags(NM_SETTING_WIRELESS_SECURITY(a))
+                != NM_SETTING_SECRET_FLAG_NONE)
+                g_assert_cmpint(GPOINTER_TO_UINT(
+                                    g_hash_table_lookup(h, NM_SETTING_WIRELESS_SECURITY_PSK_FLAGS)),
+                                ==,
+                                _RESULT_IN_A);
+            else
+                g_assert_cmpint(GPOINTER_TO_UINT(
+                                    g_hash_table_lookup(h, NM_SETTING_WIRELESS_SECURITY_PSK_FLAGS)),
+                                ==,
+                                _RESULT_IN_B);
+        }
+
+        g_assert_cmpint(g_hash_table_size(h), ==, (!exp_same_psk) + (!exp_same_psk_flags));
+    }
+
+    g_assert(diff_result == nm_setting_compare(a, b, flags));
+    g_assert(diff_result == nm_setting_compare(b, a, flags));
+}
+
+static void
+test_setting_compare_secrets(gconstpointer test_data)
+{
+    const TestDataCompareSecrets *data        = test_data;
+    gs_unref_object NMConnection *conn_old    = NULL;
+    gs_unref_object NMConnection *conn_new    = NULL;
+    gs_unref_object NMSetting *old            = NULL;
+    gs_unref_object            NMSetting *new = NULL;
+
+    /* Make sure that a connection with transient/unsaved secrets compares
+     * successfully to the same connection without those secrets.
+     */
+
+    old = nm_setting_wireless_security_new();
+    g_object_set(old,
+                 NM_SETTING_WIRELESS_SECURITY_KEY_MGMT,
+                 "wpa-psk",
+                 NM_SETTING_WIRELESS_SECURITY_PSK,
+                 "really cool psk",
+                 NULL);
+    nm_setting_set_secret_flags(old, NM_SETTING_WIRELESS_SECURITY_PSK, data->secret_flags, NULL);
+
+    new = nm_setting_duplicate(old);
+    if (data->remove_secret)
+        g_object_set(new, NM_SETTING_WIRELESS_SECURITY_PSK, NULL, NULL);
+
+    g_assert((!data->remove_secret) == nm_setting_compare(old, new, NM_SETTING_COMPARE_FLAG_EXACT));
+    g_assert((!data->remove_secret) == nm_setting_compare(new, old, NM_SETTING_COMPARE_FLAG_EXACT));
+
+    _test_compare_secrets_check_diff(old,
+                                     new,
+                                     NM_SETTING_COMPARE_FLAG_EXACT,
+                                     !data->remove_secret,
+                                     TRUE);
+    _test_compare_secrets_check_diff(new,
+                                     old,
+                                     NM_SETTING_COMPARE_FLAG_EXACT,
+                                     !data->remove_secret,
+                                     TRUE);
+
+    g_assert(nm_setting_compare(old, new, data->comp_flags));
+    g_assert(nm_setting_compare(new, old, data->comp_flags));
+
+    _test_compare_secrets_check_diff(old, new, data->comp_flags, TRUE, TRUE);
+    _test_compare_secrets_check_diff(new, old, data->comp_flags, TRUE, TRUE);
+
+    /* OK. Try again, but this time not only change the secret, also let the secret flags differ... */
+    if (data->secret_flags != NM_SETTING_SECRET_FLAG_NONE) {
+        nm_setting_set_secret_flags(new,
+                                    NM_SETTING_WIRELESS_SECURITY_PSK,
+                                    NM_SETTING_SECRET_FLAG_NONE,
+                                    NULL);
+
+        _test_compare_secrets_check_diff(old, new, NM_SETTING_COMPARE_FLAG_EXACT, FALSE, FALSE);
+        _test_compare_secrets_check_diff(new, old, NM_SETTING_COMPARE_FLAG_EXACT, FALSE, FALSE);
+
+        _test_compare_secrets_check_diff(old, new, data->comp_flags, TRUE, FALSE);
+        _test_compare_secrets_check_diff(new, old, data->comp_flags, FALSE, FALSE);
+
+        nm_setting_set_secret_flags(new,
+                                    NM_SETTING_WIRELESS_SECURITY_PSK,
+                                    data->secret_flags,
+                                    NULL);
+    }
+
+    conn_old = nmtst_create_minimal_connection("test-compare-secrets",
+                                               NULL,
+                                               NM_SETTING_WIRELESS_SETTING_NAME,
+                                               NULL);
+    nm_connection_add_setting(conn_old, nm_setting_duplicate(old));
+    conn_new = nm_simple_connection_new_clone(conn_old);
+    nm_connection_add_setting(conn_new, nm_setting_duplicate(new));
+
+    g_assert((!data->remove_secret)
+             == nm_connection_compare(conn_old, conn_new, NM_SETTING_COMPARE_FLAG_EXACT));
+    g_assert((!data->remove_secret)
+             == nm_connection_compare(conn_new, conn_old, NM_SETTING_COMPARE_FLAG_EXACT));
+
+    g_assert(nm_connection_compare(conn_old, conn_new, data->comp_flags));
+    g_assert(nm_connection_compare(conn_new, conn_old, data->comp_flags));
+}
+
+static void
+test_setting_compare_vpn_secrets(gconstpointer test_data)
+{
+    const TestDataCompareSecrets *data = test_data;
+    gs_unref_object NMSetting *old = NULL, *new = NULL;
+    gboolean                   success;
+
+    /* Make sure that a connection with transient/unsaved secrets compares
+     * successfully to the same connection without those secrets.
+     */
+
+    old = nm_setting_vpn_new();
+    nm_setting_vpn_add_secret(NM_SETTING_VPN(old), "foobarbaz", "really secret password");
+    nm_setting_vpn_add_secret(NM_SETTING_VPN(old), "asdfasdfasdf", "really adfasdfasdfasdf");
+    nm_setting_vpn_add_secret(NM_SETTING_VPN(old), "0123456778", "abcdefghijklmnpqrstuvqxyz");
+    nm_setting_vpn_add_secret(NM_SETTING_VPN(old),
+                              "borkbork",
+                              "yet another really secret password");
+    nm_setting_set_secret_flags(old, "borkbork", data->secret_flags, NULL);
+
+    /* Clear "borkbork" from the duplicated setting */
+    new = nm_setting_duplicate(old);
+    if (data->remove_secret) {
+        nm_setting_vpn_remove_secret(NM_SETTING_VPN(new), "borkbork");
+
+        /* First make sure they are different */
+        success = nm_setting_compare(old, new, NM_SETTING_COMPARE_FLAG_EXACT);
+        g_assert(success == FALSE);
+    }
+
+    success = nm_setting_compare(old, new, data->comp_flags);
+    g_assert(success);
+}
+
+static void
+test_hwaddr_aton_ether_normal(void)
+{
+    guint8 buf[100];
+    guint8 expected[ETH_ALEN] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55};
+
+    g_assert(nm_utils_hwaddr_aton("00:11:22:33:44:55", buf, ETH_ALEN) != NULL);
+    g_assert(memcmp(buf, expected, sizeof(expected)) == 0);
+}
+
+static void
+test_hwaddr_aton_ib_normal(void)
+{
+    guint8      buf[100];
+    const char *source = "00:11:22:33:44:55:66:77:88:99:01:12:23:34:45:56:67:78:89:90";
+    guint8 expected[INFINIBAND_ALEN] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99,
+                                        0x01, 0x12, 0x23, 0x34, 0x45, 0x56, 0x67, 0x78, 0x89, 0x90};
+
+    g_assert(nm_utils_hwaddr_aton(source, buf, INFINIBAND_ALEN) != NULL);
+    g_assert(memcmp(buf, expected, sizeof(expected)) == 0);
+}
+
+static void
+test_hwaddr_aton_no_leading_zeros(void)
+{
+    guint8 buf[100];
+    guint8 expected[ETH_ALEN] = {0x00, 0x1A, 0x2B, 0x03, 0x44, 0x05};
+
+    g_assert(nm_utils_hwaddr_aton("0:1a:2B:3:44:5", buf, ETH_ALEN) != NULL);
+    g_assert(memcmp(buf, expected, sizeof(expected)) == 0);
+}
+
+static void
+test_hwaddr_aton_malformed(void)
+{
+    guint8 buf[100];
+
+    g_assert(nm_utils_hwaddr_aton("0:1a:2B:3:a@%%", buf, ETH_ALEN) == NULL);
+}
+
+static void
+test_hwaddr_equal(void)
+{
+    const char * string                 = "00:1a:2b:03:44:05";
+    const char * upper_string           = "00:1A:2B:03:44:05";
+    const char * bad_string             = "0:1a:2b:3:44:5";
+    const guint8 binary[ETH_ALEN]       = {0x00, 0x1A, 0x2B, 0x03, 0x44, 0x05};
+    const char * other_string           = "1a:2b:03:44:05:00";
+    const guint8 other_binary[ETH_ALEN] = {0x1A, 0x2B, 0x03, 0x44, 0x05, 0x00};
+    const char * long_string            = "00:1a:2b:03:44:05:06:07";
+    const guint8 long_binary[8]         = {0x00, 0x1A, 0x2B, 0x03, 0x44, 0x05, 0x06, 0x07};
+    const char * null_string            = "00:00:00:00:00:00";
+    const guint8 null_binary[ETH_ALEN]  = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
+
+    g_assert(nm_utils_hwaddr_matches(string, -1, string, -1));
+    g_assert(nm_utils_hwaddr_matches(string, -1, upper_string, -1));
+    g_assert(nm_utils_hwaddr_matches(string, -1, bad_string, -1));
+    g_assert(nm_utils_hwaddr_matches(string, -1, binary, sizeof(binary)));
+    g_assert(!nm_utils_hwaddr_matches(string, -1, other_string, -1));
+    g_assert(!nm_utils_hwaddr_matches(string, -1, other_binary, sizeof(other_binary)));
+    g_assert(!nm_utils_hwaddr_matches(string, -1, long_string, -1));
+    g_assert(!nm_utils_hwaddr_matches(string, -1, long_binary, sizeof(long_binary)));
+    g_assert(!nm_utils_hwaddr_matches(string, -1, null_string, -1));
+    g_assert(!nm_utils_hwaddr_matches(string, -1, null_binary, sizeof(null_binary)));
+    g_assert(!nm_utils_hwaddr_matches(string, -1, NULL, ETH_ALEN));
+
+    g_assert(nm_utils_hwaddr_matches(binary, sizeof(binary), string, -1));
+    g_assert(nm_utils_hwaddr_matches(binary, sizeof(binary), upper_string, -1));
+    g_assert(nm_utils_hwaddr_matches(binary, sizeof(binary), bad_string, -1));
+    g_assert(nm_utils_hwaddr_matches(binary, sizeof(binary), binary, sizeof(binary)));
+    g_assert(!nm_utils_hwaddr_matches(binary, sizeof(binary), other_string, -1));
+    g_assert(!nm_utils_hwaddr_matches(binary, sizeof(binary), other_binary, sizeof(other_binary)));
+    g_assert(!nm_utils_hwaddr_matches(binary, sizeof(binary), long_string, -1));
+    g_assert(!nm_utils_hwaddr_matches(binary, sizeof(binary), long_binary, sizeof(long_binary)));
+    g_assert(!nm_utils_hwaddr_matches(binary, sizeof(binary), null_string, -1));
+    g_assert(!nm_utils_hwaddr_matches(binary, sizeof(binary), null_binary, sizeof(null_binary)));
+    g_assert(!nm_utils_hwaddr_matches(binary, sizeof(binary), NULL, ETH_ALEN));
+
+    g_assert(!nm_utils_hwaddr_matches(null_string, -1, string, -1));
+    g_assert(!nm_utils_hwaddr_matches(null_string, -1, upper_string, -1));
+    g_assert(!nm_utils_hwaddr_matches(null_string, -1, bad_string, -1));
+    g_assert(!nm_utils_hwaddr_matches(null_string, -1, binary, sizeof(binary)));
+    g_assert(!nm_utils_hwaddr_matches(null_string, -1, other_string, -1));
+    g_assert(!nm_utils_hwaddr_matches(null_string, -1, other_binary, sizeof(other_binary)));
+    g_assert(!nm_utils_hwaddr_matches(null_string, -1, long_string, -1));
+    g_assert(!nm_utils_hwaddr_matches(null_string, -1, long_binary, sizeof(long_binary)));
+    g_assert(nm_utils_hwaddr_matches(null_string, -1, null_string, -1));
+    g_assert(nm_utils_hwaddr_matches(null_string, -1, null_binary, sizeof(null_binary)));
+    g_assert(nm_utils_hwaddr_matches(null_string, -1, NULL, ETH_ALEN));
+
+    g_assert(!nm_utils_hwaddr_matches(null_binary, sizeof(null_binary), string, -1));
+    g_assert(!nm_utils_hwaddr_matches(null_binary, sizeof(null_binary), upper_string, -1));
+    g_assert(!nm_utils_hwaddr_matches(null_binary, sizeof(null_binary), bad_string, -1));
+    g_assert(!nm_utils_hwaddr_matches(null_binary, sizeof(null_binary), binary, sizeof(binary)));
+    g_assert(!nm_utils_hwaddr_matches(null_binary, sizeof(null_binary), other_string, -1));
+    g_assert(!nm_utils_hwaddr_matches(null_binary,
+                                      sizeof(null_binary),
+                                      other_binary,
+                                      sizeof(other_binary)));
+    g_assert(!nm_utils_hwaddr_matches(null_binary, sizeof(null_binary), long_string, -1));
+    g_assert(!nm_utils_hwaddr_matches(null_binary,
+                                      sizeof(null_binary),
+                                      long_binary,
+                                      sizeof(long_binary)));
+    g_assert(nm_utils_hwaddr_matches(null_binary, sizeof(null_binary), null_string, -1));
+    g_assert(nm_utils_hwaddr_matches(null_binary,
+                                     sizeof(null_binary),
+                                     null_binary,
+                                     sizeof(null_binary)));
+    g_assert(nm_utils_hwaddr_matches(null_binary, sizeof(null_binary), NULL, ETH_ALEN));
+
+    g_assert(!nm_utils_hwaddr_matches(NULL, -1, NULL, -1));
+    g_assert(!nm_utils_hwaddr_matches(NULL, -1, string, -1));
+    g_assert(!nm_utils_hwaddr_matches(string, -1, NULL, -1));
+    g_assert(!nm_utils_hwaddr_matches(NULL, -1, null_string, -1));
+    g_assert(!nm_utils_hwaddr_matches(null_string, -1, NULL, -1));
+    g_assert(!nm_utils_hwaddr_matches(NULL, -1, binary, sizeof(binary)));
+    g_assert(!nm_utils_hwaddr_matches(binary, sizeof(binary), NULL, -1));
+    g_assert(!nm_utils_hwaddr_matches(NULL, -1, null_binary, sizeof(null_binary)));
+    g_assert(!nm_utils_hwaddr_matches(null_binary, sizeof(null_binary), NULL, -1));
+}
+
+static void
+test_hwaddr_canonical(void)
+{
+    const char *string         = "00:1A:2B:03:44:05";
+    const char *lower_string   = "00:1a:2b:03:44:05";
+    const char *short_string   = "0:1a:2b:3:44:5";
+    const char *hyphen_string  = "00-1a-2b-03-44-05";
+    const char *invalid_string = "00:1A:2B";
+    char *      canonical;
+
+    canonical = nm_utils_hwaddr_canonical(string, ETH_ALEN);
+    g_assert_cmpstr(canonical, ==, string);
+    g_free(canonical);
+
+    canonical = nm_utils_hwaddr_canonical(lower_string, ETH_ALEN);
+    g_assert_cmpstr(canonical, ==, string);
+    g_free(canonical);
+
+    canonical = nm_utils_hwaddr_canonical(short_string, ETH_ALEN);
+    g_assert_cmpstr(canonical, ==, string);
+    g_free(canonical);
+
+    canonical = nm_utils_hwaddr_canonical(hyphen_string, ETH_ALEN);
+    g_assert_cmpstr(canonical, ==, string);
+    g_free(canonical);
+
+    canonical = nm_utils_hwaddr_canonical(invalid_string, ETH_ALEN);
+    g_assert_cmpstr(canonical, ==, NULL);
+
+    canonical = nm_utils_hwaddr_canonical(invalid_string, -1);
+    g_assert_cmpstr(canonical, ==, invalid_string);
+    g_free(canonical);
+}
+
+static void
+test_connection_changed_cb(NMConnection *connection, gboolean *data)
+{
+    *data = TRUE;
+}
+
+static guint32
+_netmask_to_prefix(guint32 netmask)
+{
+    guint32       prefix;
+    guint8        v;
+    const guint8 *p = (guint8 *) &netmask;
+
+    if (p[3]) {
+        prefix = 24;
+        v      = p[3];
+    } else if (p[2]) {
+        prefix = 16;
+        v      = p[2];
+    } else if (p[1]) {
+        prefix = 8;
+        v      = p[1];
+    } else {
+        prefix = 0;
+        v      = p[0];
+    }
+
+    while (v) {
+        prefix++;
+        v <<= 1;
+    }
+
+    g_assert_cmpint(prefix, <=, 32);
+
+    /* we re-implemented the netmask-to-prefix code differently. Check
+     * that they agree. */
+    g_assert_cmpint(prefix, ==, nm_utils_ip4_netmask_to_prefix(netmask));
+
+    return prefix;
+}
+
+static void
+test_ip4_prefix_to_netmask(void)
+{
+    int i;
+
+    for (i = 0; i <= 32; i++) {
+        guint32 netmask = _nm_utils_ip4_prefix_to_netmask(i);
+        int     plen    = _netmask_to_prefix(netmask);
+
+        g_assert_cmpint(i, ==, plen);
+        {
+            guint32 msk      = 0x80000000;
+            guint32 netmask2 = 0;
+            guint32 prefix   = i;
+            while (prefix > 0) {
+                netmask2 |= msk;
+                msk >>= 1;
+                prefix--;
+            }
+            g_assert_cmpint(netmask, ==, (guint32) htonl(netmask2));
+        }
+    }
+}
+
+static void
+test_ip4_netmask_to_prefix(void)
+{
+    int i, j;
+
+    GRand *rand = g_rand_new();
+
+    g_rand_set_seed(rand, 1);
+
+    for (i = 2; i <= 32; i++) {
+        guint32 netmask            = _nm_utils_ip4_prefix_to_netmask(i);
+        guint32 netmask_lowest_bit = netmask & ~_nm_utils_ip4_prefix_to_netmask(i - 1);
+
+        g_assert_cmpint(i, ==, _netmask_to_prefix(netmask));
+
+        for (j = 0; j < 2 * i; j++) {
+            guint32 r = g_rand_int(rand);
+            guint32 netmask_holey;
+            guint32 prefix_holey;
+
+            netmask_holey = (netmask & r) | netmask_lowest_bit;
+
+            if (netmask_holey == netmask)
+                continue;
+
+            /* create an invalid netmask with holes and check that the function
+             * returns the longest prefix. */
+            prefix_holey = _netmask_to_prefix(netmask_holey);
+
+            g_assert_cmpint(i, ==, prefix_holey);
+        }
+    }
+
+    g_rand_free(rand);
+}
+
+#define ASSERT_CHANGED(statement) \
+    G_STMT_START                  \
+    {                             \
+        changed = FALSE;          \
+        statement;                \
+        g_assert(changed);        \
+    }                             \
+    G_STMT_END
+
+#define ASSERT_UNCHANGED(statement) \
+    G_STMT_START                    \
+    {                               \
+        changed = FALSE;            \
+        statement;                  \
+        g_assert(!changed);         \
+    }                               \
+    G_STMT_END
+
+static void
+test_connection_changed_signal(void)
+{
+    NMConnection *connection;
+    gboolean      changed = FALSE;
+
+    connection = new_test_connection();
+    g_signal_connect(connection,
+                     NM_CONNECTION_CHANGED,
+                     (GCallback) test_connection_changed_cb,
+                     &changed);
+
+    /* Add new setting */
+    ASSERT_CHANGED(nm_connection_add_setting(connection, nm_setting_vlan_new()));
+
+    /* Remove existing setting */
+    ASSERT_CHANGED(nm_connection_remove_setting(connection, NM_TYPE_SETTING_VLAN));
+
+    /* Remove non-existing setting */
+    ASSERT_UNCHANGED(nm_connection_remove_setting(connection, NM_TYPE_SETTING_VLAN));
+
+    g_object_unref(connection);
+}
+
+static void
+test_setting_connection_changed_signal(void)
+{
+    NMConnection *       connection;
+    gboolean             changed = FALSE;
+    NMSettingConnection *s_con;
+    gs_free char *       uuid = NULL;
+
+    connection = nm_simple_connection_new();
+    g_signal_connect(connection,
+                     NM_CONNECTION_CHANGED,
+                     (GCallback) test_connection_changed_cb,
+                     &changed);
+
+    s_con = (NMSettingConnection *) nm_setting_connection_new();
+    nm_connection_add_setting(connection, NM_SETTING(s_con));
+
+    ASSERT_CHANGED(g_object_set(s_con, NM_SETTING_CONNECTION_ID, "adfadfasdfaf", NULL));
+
+    ASSERT_CHANGED(nm_setting_connection_add_permission(s_con, "user", "billsmith", NULL));
+    ASSERT_CHANGED(nm_setting_connection_remove_permission(s_con, 0));
+
+    NMTST_EXPECT_LIBNM_CRITICAL(NMTST_G_RETURN_MSG(idx < nm_g_array_len(priv->permissions)));
+    ASSERT_UNCHANGED(nm_setting_connection_remove_permission(s_con, 1));
+    g_test_assert_expected_messages();
+
+    uuid = nm_utils_uuid_generate();
+    ASSERT_CHANGED(nm_setting_connection_add_secondary(s_con, uuid));
+    ASSERT_CHANGED(nm_setting_connection_remove_secondary(s_con, 0));
+
+    NMTST_EXPECT_LIBNM_CRITICAL(NMTST_G_RETURN_MSG(idx < nm_g_array_len(priv->secondaries)));
+    ASSERT_UNCHANGED(nm_setting_connection_remove_secondary(s_con, 1));
+    g_test_assert_expected_messages();
+
+    g_object_unref(connection);
+}
+
+static void
+test_setting_bond_changed_signal(void)
+{
+    NMConnection * connection;
+    gboolean       changed = FALSE;
+    NMSettingBond *s_bond;
+
+    connection = nm_simple_connection_new();
+    g_signal_connect(connection,
+                     NM_CONNECTION_CHANGED,
+                     (GCallback) test_connection_changed_cb,
+                     &changed);
+
+    s_bond = (NMSettingBond *) nm_setting_bond_new();
+    nm_connection_add_setting(connection, NM_SETTING(s_bond));
+
+    ASSERT_CHANGED(nm_setting_bond_add_option(s_bond, NM_SETTING_BOND_OPTION_DOWNDELAY, "10"));
+    ASSERT_CHANGED(nm_setting_bond_remove_option(s_bond, NM_SETTING_BOND_OPTION_DOWNDELAY));
+    ASSERT_UNCHANGED(nm_setting_bond_remove_option(s_bond, NM_SETTING_BOND_OPTION_UPDELAY));
+
+    g_object_unref(connection);
+}
+
+static void
+test_setting_ip4_changed_signal(void)
+{
+    NMConnection *     connection;
+    gboolean           changed = FALSE;
+    NMSettingIPConfig *s_ip4;
+    NMIPAddress *      addr;
+    NMIPRoute *        route;
+    GError *           error = NULL;
+
+    connection = nm_simple_connection_new();
+    g_signal_connect(connection,
+                     NM_CONNECTION_CHANGED,
+                     (GCallback) test_connection_changed_cb,
+                     &changed);
+
+    s_ip4 = (NMSettingIPConfig *) nm_setting_ip4_config_new();
+    nm_connection_add_setting(connection, NM_SETTING(s_ip4));
+
+    ASSERT_CHANGED(nm_setting_ip_config_add_dns(s_ip4, "11.22.0.0"));
+    ASSERT_CHANGED(nm_setting_ip_config_remove_dns(s_ip4, 0));
+
+    NMTST_EXPECT_LIBNM_CRITICAL(NMTST_G_RETURN_MSG(idx >= 0 && idx < priv->dns->len));
+    ASSERT_UNCHANGED(nm_setting_ip_config_remove_dns(s_ip4, 1));
+    g_test_assert_expected_messages();
+
+    nm_setting_ip_config_add_dns(s_ip4, "33.44.0.0");
+    ASSERT_CHANGED(nm_setting_ip_config_clear_dns(s_ip4));
+
+    ASSERT_CHANGED(nm_setting_ip_config_add_dns_search(s_ip4, "foobar.com"));
+    ASSERT_CHANGED(nm_setting_ip_config_remove_dns_search(s_ip4, 0));
+
+    NMTST_EXPECT_LIBNM_CRITICAL(NMTST_G_RETURN_MSG(idx >= 0 && idx < priv->dns_search->len));
+    ASSERT_UNCHANGED(nm_setting_ip_config_remove_dns_search(s_ip4, 1));
+    g_test_assert_expected_messages();
+
+    ASSERT_CHANGED(nm_setting_ip_config_add_dns_search(s_ip4, "foobar.com"));
+    ASSERT_CHANGED(nm_setting_ip_config_clear_dns_searches(s_ip4));
+
+    addr = nm_ip_address_new(AF_INET, "22.33.0.0", 24, &error);
+    g_assert_no_error(error);
+    ASSERT_CHANGED(nm_setting_ip_config_add_address(s_ip4, addr));
+    ASSERT_CHANGED(nm_setting_ip_config_remove_address(s_ip4, 0));
+
+    NMTST_EXPECT_LIBNM_CRITICAL(NMTST_G_RETURN_MSG(idx >= 0 && idx < priv->addresses->len));
+    ASSERT_UNCHANGED(nm_setting_ip_config_remove_address(s_ip4, 1));
+    g_test_assert_expected_messages();
+
+    nm_setting_ip_config_add_address(s_ip4, addr);
+    ASSERT_CHANGED(nm_setting_ip_config_clear_addresses(s_ip4));
+
+    route = nm_ip_route_new(AF_INET, "22.33.0.0", 24, NULL, 0, &error);
+    g_assert_no_error(error);
+
+    ASSERT_CHANGED(nm_setting_ip_config_add_route(s_ip4, route));
+    ASSERT_CHANGED(nm_setting_ip_config_remove_route(s_ip4, 0));
+
+    NMTST_EXPECT_LIBNM_CRITICAL(NMTST_G_RETURN_MSG(idx >= 0 && idx < priv->routes->len));
+    ASSERT_UNCHANGED(nm_setting_ip_config_remove_route(s_ip4, 1));
+    g_test_assert_expected_messages();
+
+    nm_setting_ip_config_add_route(s_ip4, route);
+    ASSERT_CHANGED(nm_setting_ip_config_clear_routes(s_ip4));
+
+    ASSERT_CHANGED(nm_setting_ip_config_add_dns_option(s_ip4, "debug"));
+    ASSERT_CHANGED(nm_setting_ip_config_remove_dns_option(s_ip4, 0));
+
+    NMTST_EXPECT_LIBNM_CRITICAL(NMTST_G_RETURN_MSG(idx >= 0 && idx < priv->dns_options->len));
+    ASSERT_UNCHANGED(nm_setting_ip_config_remove_dns_option(s_ip4, 1));
+    g_test_assert_expected_messages();
+
+    nm_ip_address_unref(addr);
+    nm_ip_route_unref(route);
+    g_object_unref(connection);
+}
+
+static void
+test_setting_ip6_changed_signal(void)
+{
+    NMConnection *     connection;
+    gboolean           changed = FALSE;
+    NMSettingIPConfig *s_ip6;
+    NMIPAddress *      addr;
+    NMIPRoute *        route;
+    GError *           error = NULL;
+
+    connection = nm_simple_connection_new();
+    g_signal_connect(connection,
+                     NM_CONNECTION_CHANGED,
+                     (GCallback) test_connection_changed_cb,
+                     &changed);
+
+    s_ip6 = (NMSettingIPConfig *) nm_setting_ip6_config_new();
+    nm_connection_add_setting(connection, NM_SETTING(s_ip6));
+
+    ASSERT_CHANGED(nm_setting_ip_config_add_dns(s_ip6, "1:2:3::4:5:6"));
+    ASSERT_CHANGED(nm_setting_ip_config_remove_dns(s_ip6, 0));
+
+    NMTST_EXPECT_LIBNM_CRITICAL(NMTST_G_RETURN_MSG(idx >= 0 && idx < priv->dns->len));
+    ASSERT_UNCHANGED(nm_setting_ip_config_remove_dns(s_ip6, 1));
+    g_test_assert_expected_messages();
+
+    nm_setting_ip_config_add_dns(s_ip6, "1:2:3::4:5:6");
+    ASSERT_CHANGED(nm_setting_ip_config_clear_dns(s_ip6));
+
+    ASSERT_CHANGED(nm_setting_ip_config_add_dns_search(s_ip6, "foobar.com"));
+    ASSERT_CHANGED(nm_setting_ip_config_remove_dns_search(s_ip6, 0));
+
+    NMTST_EXPECT_LIBNM_CRITICAL(NMTST_G_RETURN_MSG(idx >= 0 && idx < priv->dns_search->len));
+    ASSERT_UNCHANGED(nm_setting_ip_config_remove_dns_search(s_ip6, 1));
+    g_test_assert_expected_messages();
+
+    nm_setting_ip_config_add_dns_search(s_ip6, "foobar.com");
+    ASSERT_CHANGED(nm_setting_ip_config_clear_dns_searches(s_ip6));
+
+    addr = nm_ip_address_new(AF_INET6, "1:2:3::4:5:6", 64, &error);
+    g_assert_no_error(error);
+
+    ASSERT_CHANGED(nm_setting_ip_config_add_address(s_ip6, addr));
+    ASSERT_CHANGED(nm_setting_ip_config_remove_address(s_ip6, 0));
+
+    NMTST_EXPECT_LIBNM_CRITICAL(NMTST_G_RETURN_MSG(idx >= 0 && idx < priv->addresses->len));
+    ASSERT_UNCHANGED(nm_setting_ip_config_remove_address(s_ip6, 1));
+    g_test_assert_expected_messages();
+
+    nm_setting_ip_config_add_address(s_ip6, addr);
+    ASSERT_CHANGED(nm_setting_ip_config_clear_addresses(s_ip6));
+
+    route = nm_ip_route_new(AF_INET6, "1:2:3::4:5:6", 128, NULL, 0, &error);
+    g_assert_no_error(error);
+
+    ASSERT_CHANGED(nm_setting_ip_config_add_route(s_ip6, route));
+    ASSERT_CHANGED(nm_setting_ip_config_remove_route(s_ip6, 0));
+
+    NMTST_EXPECT_LIBNM_CRITICAL(NMTST_G_RETURN_MSG(idx >= 0 && idx < priv->routes->len));
+    ASSERT_UNCHANGED(nm_setting_ip_config_remove_route(s_ip6, 1));
+    g_test_assert_expected_messages();
+
+    nm_setting_ip_config_add_route(s_ip6, route);
+    ASSERT_CHANGED(nm_setting_ip_config_clear_routes(s_ip6));
+
+    nm_ip_address_unref(addr);
+    nm_ip_route_unref(route);
+    g_object_unref(connection);
+}
+
+static void
+test_setting_vlan_changed_signal(void)
+{
+    NMConnection * connection;
+    gboolean       changed = FALSE;
+    NMSettingVlan *s_vlan;
+
+    connection = nm_simple_connection_new();
+    g_signal_connect(connection,
+                     NM_CONNECTION_CHANGED,
+                     (GCallback) test_connection_changed_cb,
+                     &changed);
+
+    s_vlan = (NMSettingVlan *) nm_setting_vlan_new();
+    nm_connection_add_setting(connection, NM_SETTING(s_vlan));
+
+    ASSERT_CHANGED(nm_setting_vlan_add_priority(s_vlan, NM_VLAN_INGRESS_MAP, 1, 3));
+    ASSERT_CHANGED(nm_setting_vlan_remove_priority(s_vlan, NM_VLAN_INGRESS_MAP, 0));
+    NMTST_EXPECT_LIBNM_CRITICAL(NMTST_G_RETURN_MSG(idx < g_slist_length(list)));
+    ASSERT_UNCHANGED(nm_setting_vlan_remove_priority(s_vlan, NM_VLAN_INGRESS_MAP, 1));
+    g_test_assert_expected_messages();
+    ASSERT_CHANGED(nm_setting_vlan_add_priority_str(s_vlan, NM_VLAN_INGRESS_MAP, "1:3"));
+    ASSERT_CHANGED(nm_setting_vlan_clear_priorities(s_vlan, NM_VLAN_INGRESS_MAP));
+
+    ASSERT_CHANGED(nm_setting_vlan_add_priority(s_vlan, NM_VLAN_EGRESS_MAP, 1, 3));
+    ASSERT_CHANGED(nm_setting_vlan_remove_priority(s_vlan, NM_VLAN_EGRESS_MAP, 0));
+    NMTST_EXPECT_LIBNM_CRITICAL(NMTST_G_RETURN_MSG(idx < g_slist_length(list)));
+    ASSERT_UNCHANGED(nm_setting_vlan_remove_priority(s_vlan, NM_VLAN_EGRESS_MAP, 1));
+    g_test_assert_expected_messages();
+    ASSERT_CHANGED(nm_setting_vlan_add_priority_str(s_vlan, NM_VLAN_EGRESS_MAP, "1:3"));
+    ASSERT_CHANGED(nm_setting_vlan_clear_priorities(s_vlan, NM_VLAN_EGRESS_MAP));
+
+    g_object_unref(connection);
+}
+
+static void
+test_setting_vpn_changed_signal(void)
+{
+    NMConnection *connection;
+    gboolean      changed = FALSE;
+    NMSettingVpn *s_vpn;
+
+    connection = nm_simple_connection_new();
+    g_signal_connect(connection,
+                     NM_CONNECTION_CHANGED,
+                     (GCallback) test_connection_changed_cb,
+                     &changed);
+
+    s_vpn = (NMSettingVpn *) nm_setting_vpn_new();
+    nm_connection_add_setting(connection, NM_SETTING(s_vpn));
+
+    ASSERT_CHANGED(nm_setting_vpn_add_data_item(s_vpn, "foobar", "baz"));
+    ASSERT_CHANGED(nm_setting_vpn_remove_data_item(s_vpn, "foobar"));
+    ASSERT_UNCHANGED(nm_setting_vpn_remove_data_item(s_vpn, "not added"));
+
+    ASSERT_CHANGED(nm_setting_vpn_add_secret(s_vpn, "foobar", "baz"));
+    ASSERT_CHANGED(nm_setting_vpn_remove_secret(s_vpn, "foobar"));
+    ASSERT_UNCHANGED(nm_setting_vpn_remove_secret(s_vpn, "not added"));
+
+    g_object_unref(connection);
+}
+
+static void
+test_setting_wired_changed_signal(void)
+{
+    NMConnection *  connection;
+    gboolean        changed = FALSE;
+    NMSettingWired *s_wired;
+
+    connection = nm_simple_connection_new();
+    g_signal_connect(connection,
+                     NM_CONNECTION_CHANGED,
+                     (GCallback) test_connection_changed_cb,
+                     &changed);
+
+    s_wired = (NMSettingWired *) nm_setting_wired_new();
+    nm_connection_add_setting(connection, NM_SETTING(s_wired));
+
+    ASSERT_CHANGED(nm_setting_wired_add_s390_option(s_wired, "portno", "1"));
+    ASSERT_CHANGED(nm_setting_wired_remove_s390_option(s_wired, "portno"));
+    ASSERT_UNCHANGED(nm_setting_wired_remove_s390_option(s_wired, "layer2"));
+
+    g_object_unref(connection);
+}
+
+static void
+test_setting_wireless_changed_signal(void)
+{
+    NMConnection *     connection;
+    gboolean           changed = FALSE;
+    NMSettingWireless *s_wifi;
+
+    connection = nm_simple_connection_new();
+    g_signal_connect(connection,
+                     NM_CONNECTION_CHANGED,
+                     (GCallback) test_connection_changed_cb,
+                     &changed);
+
+    s_wifi = (NMSettingWireless *) nm_setting_wireless_new();
+    nm_connection_add_setting(connection, NM_SETTING(s_wifi));
+
+    ASSERT_CHANGED(nm_setting_wireless_add_seen_bssid(s_wifi, "00:11:22:33:44:55"));
+
+    g_object_unref(connection);
+}
+
+static void
+test_setting_wireless_security_changed_signal(void)
+{
+    NMConnection *             connection;
+    gboolean                   changed = FALSE;
+    NMSettingWirelessSecurity *s_wsec;
+
+    connection = nm_simple_connection_new();
+    g_signal_connect(connection,
+                     NM_CONNECTION_CHANGED,
+                     (GCallback) test_connection_changed_cb,
+                     &changed);
+
+    s_wsec = (NMSettingWirelessSecurity *) nm_setting_wireless_security_new();
+    nm_connection_add_setting(connection, NM_SETTING(s_wsec));
+
+    /* Protos */
+    ASSERT_CHANGED(nm_setting_wireless_security_add_proto(s_wsec, "wpa"));
+    ASSERT_CHANGED(nm_setting_wireless_security_remove_proto(s_wsec, 0));
+    NMTST_EXPECT_LIBNM_CRITICAL(NMTST_G_RETURN_MSG(elt != NULL));
+    ASSERT_UNCHANGED(nm_setting_wireless_security_remove_proto(s_wsec, 1));
+    g_test_assert_expected_messages();
+
+    nm_setting_wireless_security_add_proto(s_wsec, "wep");
+    ASSERT_CHANGED(nm_setting_wireless_security_clear_protos(s_wsec));
+
+    /* Pairwise ciphers */
+    ASSERT_CHANGED(nm_setting_wireless_security_add_pairwise(s_wsec, "tkip"));
+    ASSERT_CHANGED(nm_setting_wireless_security_remove_pairwise(s_wsec, 0));
+    NMTST_EXPECT_LIBNM_CRITICAL(NMTST_G_RETURN_MSG(elt != NULL));
+    ASSERT_UNCHANGED(nm_setting_wireless_security_remove_pairwise(s_wsec, 1));
+    g_test_assert_expected_messages();
+
+    nm_setting_wireless_security_add_pairwise(s_wsec, "tkip");
+    ASSERT_CHANGED(nm_setting_wireless_security_clear_pairwise(s_wsec));
+
+    /* Group ciphers */
+    ASSERT_CHANGED(nm_setting_wireless_security_add_group(s_wsec, "ccmp"));
+    ASSERT_CHANGED(nm_setting_wireless_security_remove_group(s_wsec, 0));
+    NMTST_EXPECT_LIBNM_CRITICAL(NMTST_G_RETURN_MSG(elt != NULL));
+    ASSERT_UNCHANGED(nm_setting_wireless_security_remove_group(s_wsec, 1));
+    g_test_assert_expected_messages();
+
+    nm_setting_wireless_security_add_group(s_wsec, "tkip");
+    ASSERT_CHANGED(nm_setting_wireless_security_clear_groups(s_wsec));
+
+    /* WEP key secret flags */
+    ASSERT_CHANGED(g_assert(nm_setting_set_secret_flags(NM_SETTING(s_wsec),
+                                                        "wep-key0",
+                                                        NM_SETTING_SECRET_FLAG_AGENT_OWNED,
+                                                        NULL)));
+    ASSERT_CHANGED(g_assert(nm_setting_set_secret_flags(NM_SETTING(s_wsec),
+                                                        "wep-key1",
+                                                        NM_SETTING_SECRET_FLAG_AGENT_OWNED,
+                                                        NULL)));
+    ASSERT_CHANGED(g_assert(nm_setting_set_secret_flags(NM_SETTING(s_wsec),
+                                                        "wep-key2",
+                                                        NM_SETTING_SECRET_FLAG_AGENT_OWNED,
+                                                        NULL)));
+    ASSERT_CHANGED(g_assert(nm_setting_set_secret_flags(NM_SETTING(s_wsec),
+                                                        "wep-key3",
+                                                        NM_SETTING_SECRET_FLAG_AGENT_OWNED,
+                                                        NULL)));
+
+    g_object_unref(connection);
+}
+
+static void
+test_setting_802_1x_changed_signal(void)
+{
+    NMConnection *  connection;
+    gboolean        changed = FALSE;
+    NMSetting8021x *s_8021x;
+
+    connection = nm_simple_connection_new();
+    g_signal_connect(connection,
+                     NM_CONNECTION_CHANGED,
+                     (GCallback) test_connection_changed_cb,
+                     &changed);
+
+    s_8021x = (NMSetting8021x *) nm_setting_802_1x_new();
+    nm_connection_add_setting(connection, NM_SETTING(s_8021x));
+
+    /* EAP methods */
+    ASSERT_CHANGED(nm_setting_802_1x_add_eap_method(s_8021x, "tls"));
+    ASSERT_CHANGED(nm_setting_802_1x_remove_eap_method(s_8021x, 0));
+    NMTST_EXPECT_LIBNM_CRITICAL(NMTST_G_RETURN_MSG(elt != NULL));
+    ASSERT_UNCHANGED(nm_setting_802_1x_remove_eap_method(s_8021x, 1));
+    g_test_assert_expected_messages();
+
+    nm_setting_802_1x_add_eap_method(s_8021x, "ttls");
+    ASSERT_CHANGED(nm_setting_802_1x_clear_eap_methods(s_8021x));
+
+    /* alternate subject matches */
+    ASSERT_CHANGED(nm_setting_802_1x_add_altsubject_match(s_8021x, "EMAIL:server@example.com"));
+    ASSERT_CHANGED(nm_setting_802_1x_remove_altsubject_match(s_8021x, 0));
+    NMTST_EXPECT_LIBNM_CRITICAL(NMTST_G_RETURN_MSG(elt != NULL));
+    ASSERT_UNCHANGED(nm_setting_802_1x_remove_altsubject_match(s_8021x, 1));
+    g_test_assert_expected_messages();
+
+    nm_setting_802_1x_add_altsubject_match(s_8021x, "EMAIL:server@example.com");
+    ASSERT_CHANGED(nm_setting_802_1x_clear_altsubject_matches(s_8021x));
+
+    /* phase2 alternate subject matches */
+    ASSERT_CHANGED(
+        nm_setting_802_1x_add_phase2_altsubject_match(s_8021x, "EMAIL:server@example.com"));
+    ASSERT_CHANGED(nm_setting_802_1x_remove_phase2_altsubject_match(s_8021x, 0));
+    NMTST_EXPECT_LIBNM_CRITICAL(NMTST_G_RETURN_MSG(elt != NULL));
+    ASSERT_UNCHANGED(nm_setting_802_1x_remove_phase2_altsubject_match(s_8021x, 1));
+    g_test_assert_expected_messages();
+
+    nm_setting_802_1x_add_phase2_altsubject_match(s_8021x, "EMAIL:server@example.com");
+    ASSERT_CHANGED(nm_setting_802_1x_clear_phase2_altsubject_matches(s_8021x));
+
+    g_object_unref(connection);
+}
+
+static void
+test_setting_old_uuid(void)
+{
+    gs_unref_object NMSetting *setting = NULL;
+
+    /* NetworkManager-0.9.4.0 generated 40-character UUIDs with no dashes,
+     * like this one. Test that we maintain compatibility. */
+    const char *uuid = "f43bec2cdd60e5da381ebb1eb1fa39f3cc52660c";
+
+    setting = nm_setting_connection_new();
+    g_object_set(G_OBJECT(setting),
+                 NM_SETTING_CONNECTION_ID,
+                 "uuidtest",
+                 NM_SETTING_CONNECTION_UUID,
+                 uuid,
+                 NM_SETTING_CONNECTION_TYPE,
+                 NM_SETTING_WIRED_SETTING_NAME,
+                 NULL);
+
+    nmtst_assert_setting_verifies(NM_SETTING(setting));
+}
+
+/*****************************************************************************/
+
+static void
+test_connection_normalize_uuid(void)
+{
+    gs_unref_object NMConnection *con = NULL;
+
+    con = nmtst_create_minimal_connection("test1", NULL, NM_SETTING_WIRED_SETTING_NAME, NULL);
+
+    nmtst_assert_connection_verifies_and_normalizable(con);
+
+    g_object_set(nm_connection_get_setting_connection(con), NM_SETTING_CONNECTION_UUID, NULL, NULL);
+    nmtst_assert_connection_verifies_after_normalization(con,
+                                                         NM_CONNECTION_ERROR,
+                                                         NM_CONNECTION_ERROR_MISSING_PROPERTY);
+}
+
+/*****************************************************************************/
+
+/*
+ * Test normalization of interface-name
+ */
+static void
+test_connection_normalize_virtual_iface_name(void)
+{
+    NMConnection *       con = NULL;
+    NMSettingConnection *s_con;
+    NMSettingVlan *      s_vlan;
+    GVariant *           connection_dict, *setting_dict, *var;
+    GError *             error      = NULL;
+    const char *         IFACE_NAME = "iface";
+    const char *         IFACE_VIRT = "iface-X";
+
+    con = nmtst_create_minimal_connection("test1",
+                                          "22001632-bbb4-4616-b277-363dce3dfb5b",
+                                          NM_SETTING_VLAN_SETTING_NAME,
+                                          &s_con);
+
+    nm_connection_add_setting(con,
+                              g_object_new(NM_TYPE_SETTING_IP4_CONFIG,
+                                           NM_SETTING_IP_CONFIG_METHOD,
+                                           NM_SETTING_IP4_CONFIG_METHOD_AUTO,
+                                           NULL));
+
+    nm_connection_add_setting(con,
+                              g_object_new(NM_TYPE_SETTING_IP6_CONFIG,
+                                           NM_SETTING_IP_CONFIG_METHOD,
+                                           NM_SETTING_IP4_CONFIG_METHOD_AUTO,
+                                           NULL));
+
+    s_vlan = nm_connection_get_setting_vlan(con);
+
+    g_object_set(G_OBJECT(s_vlan), NM_SETTING_VLAN_PARENT, "eth0", NULL);
+
+    g_object_set(G_OBJECT(s_con), NM_SETTING_CONNECTION_INTERFACE_NAME, IFACE_NAME, NULL);
+
+    g_assert_cmpstr(nm_connection_get_interface_name(con), ==, IFACE_NAME);
+
+    connection_dict = nm_connection_to_dbus(con, NM_CONNECTION_SERIALIZE_ALL);
+    g_object_unref(con);
+
+    /* Serialized form should include vlan.interface-name as well. */
+    setting_dict = g_variant_lookup_value(connection_dict,
+                                          NM_SETTING_VLAN_SETTING_NAME,
+                                          NM_VARIANT_TYPE_SETTING);
+    g_assert(setting_dict != NULL);
+    var = g_variant_lookup_value(setting_dict, "interface-name", NULL);
+    g_assert(var != NULL);
+    g_assert(g_variant_is_of_type(var, G_VARIANT_TYPE_STRING));
+    g_assert_cmpstr(g_variant_get_string(var, NULL), ==, IFACE_NAME);
+
+    g_variant_unref(setting_dict);
+    g_variant_unref(var);
+
+    /* If vlan.interface-name will be ignored. */
+    NMTST_VARIANT_EDITOR(
+        connection_dict,
+        NMTST_VARIANT_CHANGE_PROPERTY(NM_SETTING_VLAN_SETTING_NAME,
+                                      "interface-name",
+                                      "s",
+                                      ":::this-is-not-a-valid-interface-name:::"););
+
+    con = _connection_new_from_dbus(connection_dict, &error);
+    nmtst_assert_success(con, error);
+    g_assert_cmpstr(nm_connection_get_interface_name(con), ==, IFACE_NAME);
+    g_clear_object(&con);
+
+    /* If vlan.interface-name is valid, but doesn't match, it will be ignored. */
+    NMTST_VARIANT_EDITOR(connection_dict,
+                         NMTST_VARIANT_CHANGE_PROPERTY(NM_SETTING_VLAN_SETTING_NAME,
+                                                       "interface-name",
+                                                       "s",
+                                                       IFACE_VIRT););
+
+    con = _connection_new_from_dbus(connection_dict, &error);
+    g_assert_no_error(error);
+
+    g_assert_cmpstr(nm_connection_get_interface_name(con), ==, IFACE_NAME);
+    s_con = nm_connection_get_setting_connection(con);
+    g_assert_cmpstr(nm_setting_connection_get_interface_name(s_con), ==, IFACE_NAME);
+    g_object_unref(con);
+
+    /* But removing connection.interface-name should result in vlan.connection-name
+     * being "promoted".
+     */
+    NMTST_VARIANT_EDITOR(connection_dict,
+                         NMTST_VARIANT_DROP_PROPERTY(NM_SETTING_CONNECTION_SETTING_NAME,
+                                                     NM_SETTING_CONNECTION_INTERFACE_NAME););
+
+    con = _connection_new_from_dbus(connection_dict, &error);
+    g_assert_no_error(error);
+
+    g_assert_cmpstr(nm_connection_get_interface_name(con), ==, IFACE_VIRT);
+    s_con = nm_connection_get_setting_connection(con);
+    g_assert_cmpstr(nm_setting_connection_get_interface_name(s_con), ==, IFACE_VIRT);
+    g_object_unref(con);
+
+    g_variant_unref(connection_dict);
+}
+
+static void
+_test_connection_normalize_type_normalizable_setting(
+    const char *type,
+    void (*prepare_normalizable_fcn)(NMConnection *con))
+{
+    NMSettingConnection *s_con;
+    NMSetting *          s_base;
+    GType                base_type;
+    gs_unref_object NMConnection *con = NULL;
+    gs_free char *                id  = g_strdup_printf("%s[%s]", G_STRFUNC, type);
+
+    base_type = nm_setting_lookup_type(type);
+    g_assert(base_type != G_TYPE_INVALID);
+    g_assert(_nm_setting_type_get_base_type_priority(base_type) != NM_SETTING_PRIORITY_INVALID);
+
+    con = nmtst_create_minimal_connection(id, NULL, NULL, &s_con);
+
+    nmtst_assert_connection_unnormalizable(con,
+                                           NM_CONNECTION_ERROR,
+                                           NM_CONNECTION_ERROR_MISSING_PROPERTY);
+
+    g_object_set(s_con, NM_SETTING_CONNECTION_TYPE, type, NULL);
+
+    if (prepare_normalizable_fcn)
+        prepare_normalizable_fcn(con);
+
+    g_assert(!nm_connection_get_setting_by_name(con, type));
+    nmtst_assert_connection_verifies_after_normalization(con,
+                                                         NM_CONNECTION_ERROR,
+                                                         NM_CONNECTION_ERROR_MISSING_SETTING);
+    nmtst_connection_normalize(con);
+
+    s_base = nm_connection_get_setting_by_name(con, type);
+    g_assert(s_base);
+    g_assert(G_OBJECT_TYPE(s_base) == base_type);
+}
+
+static void
+_test_connection_normalize_type_unnormalizable_setting(const char *type)
+{
+    NMSettingConnection *s_con;
+    GType                base_type;
+    gs_unref_object NMConnection *con = NULL;
+    gs_free char *                id  = g_strdup_printf("%s[%s]", G_STRFUNC, type);
+
+    base_type = nm_setting_lookup_type(type);
+    g_assert(base_type != G_TYPE_INVALID);
+    g_assert(_nm_setting_type_get_base_type_priority(base_type) != NM_SETTING_PRIORITY_INVALID);
+
+    con = nmtst_create_minimal_connection(id, NULL, NULL, &s_con);
+
+    nmtst_assert_connection_unnormalizable(con,
+                                           NM_CONNECTION_ERROR,
+                                           NM_CONNECTION_ERROR_MISSING_PROPERTY);
+
+    g_object_set(s_con, NM_SETTING_CONNECTION_TYPE, type, NULL);
+
+    nmtst_assert_connection_unnormalizable(con,
+                                           NM_CONNECTION_ERROR,
+                                           NM_CONNECTION_ERROR_MISSING_SETTING);
+}
+
+static void
+_test_connection_normalize_type_normalizable_type(const char *type,
+                                                  NMSetting *(*add_setting_fcn)(NMConnection *con))
+{
+    NMSettingConnection *s_con;
+    NMSetting *          s_base;
+    GType                base_type;
+    gs_unref_object NMConnection *con = NULL;
+    gs_free char *                id  = g_strdup_printf("%s[%s]", G_STRFUNC, type);
+
+    base_type = nm_setting_lookup_type(type);
+    g_assert(base_type != G_TYPE_INVALID);
+    g_assert(_nm_setting_type_get_base_type_priority(base_type) != NM_SETTING_PRIORITY_INVALID);
+
+    con = nmtst_create_minimal_connection(id, NULL, NULL, &s_con);
+
+    nmtst_assert_connection_unnormalizable(con,
+                                           NM_CONNECTION_ERROR,
+                                           NM_CONNECTION_ERROR_MISSING_PROPERTY);
+
+    if (add_setting_fcn)
+        s_base = add_setting_fcn(con);
+    else {
+        s_base = g_object_new(base_type, NULL);
+        nm_connection_add_setting(con, s_base);
+    }
+
+    g_assert(!nm_setting_connection_get_connection_type(s_con));
+    g_assert(nm_connection_get_setting_by_name(con, type) == s_base);
+
+    nmtst_assert_connection_verifies_after_normalization(con,
+                                                         NM_CONNECTION_ERROR,
+                                                         NM_CONNECTION_ERROR_MISSING_PROPERTY);
+    nmtst_connection_normalize(con);
+
+    g_assert_cmpstr(nm_connection_get_connection_type(con), ==, type);
+    g_assert(nm_connection_get_setting_by_name(con, type) == s_base);
+}
+
+static NMSetting *
+_add_setting_fcn_adsl(NMConnection *con)
+{
+    NMSetting *setting;
+
+    setting = g_object_new(NM_TYPE_SETTING_ADSL,
+                           NM_SETTING_ADSL_USERNAME,
+                           "test-user",
+                           NM_SETTING_ADSL_PROTOCOL,
+                           NM_SETTING_ADSL_PROTOCOL_PPPOA,
+                           NM_SETTING_ADSL_ENCAPSULATION,
+                           NM_SETTING_ADSL_ENCAPSULATION_VCMUX,
+                           NULL);
+
+    nm_connection_add_setting(con, setting);
+    return setting;
+}
+
+static NMSetting *
+_add_setting_fcn_bluetooth(NMConnection *con)
+{
+    NMSetting *setting;
+
+    setting = g_object_new(NM_TYPE_SETTING_BLUETOOTH,
+                           NM_SETTING_BLUETOOTH_BDADDR,
+                           "11:22:33:44:55:66",
+                           NM_SETTING_BLUETOOTH_TYPE,
+                           NM_SETTING_BLUETOOTH_TYPE_PANU,
+                           NULL);
+
+    nm_connection_add_setting(con, setting);
+    return setting;
+}
+
+static NMSetting *
+_add_setting_fcn_bond(NMConnection *con)
+{
+    NMSetting *          setting;
+    NMSettingConnection *s_con;
+
+    setting = g_object_new(NM_TYPE_SETTING_BOND, NULL);
+
+    nm_connection_add_setting(con, setting);
+
+    s_con = nm_connection_get_setting_connection(con);
+
+    g_object_set(s_con, NM_SETTING_CONNECTION_INTERFACE_NAME, "test-bond", NULL);
+
+    return setting;
+}
+
+static NMSetting *
+_add_setting_fcn_bridge(NMConnection *con)
+{
+    NMSetting *          setting;
+    NMSettingConnection *s_con;
+
+    setting = g_object_new(NM_TYPE_SETTING_BRIDGE, NULL);
+
+    nm_connection_add_setting(con, setting);
+
+    s_con = nm_connection_get_setting_connection(con);
+
+    g_object_set(s_con, NM_SETTING_CONNECTION_INTERFACE_NAME, "test-bridge", NULL);
+
+    return setting;
+}
+
+static NMSetting *
+_add_setting_fcn_cdma(NMConnection *con)
+{
+    NMSetting *setting;
+
+    setting = g_object_new(NM_TYPE_SETTING_CDMA, NM_SETTING_CDMA_NUMBER, "test-number", NULL);
+
+    nm_connection_add_setting(con, setting);
+    return setting;
+}
+
+static NMSetting *
+_add_setting_fcn_infiniband(NMConnection *con)
+{
+    NMSetting *setting;
+
+    setting = g_object_new(NM_TYPE_SETTING_INFINIBAND,
+                           NM_SETTING_INFINIBAND_TRANSPORT_MODE,
+                           "connected",
+                           NULL);
+
+    nm_connection_add_setting(con, setting);
+    return setting;
+}
+
+static NMSetting *
+_add_setting_fcn_olpc_mesh(NMConnection *con)
+{
+    NMSetting * setting;
+    const char *ssid_data = "ssid-test";
+    GBytes *    ssid;
+
+    ssid    = g_bytes_new(ssid_data, strlen(ssid_data));
+    setting = g_object_new(NM_TYPE_SETTING_OLPC_MESH,
+                           NM_SETTING_OLPC_MESH_SSID,
+                           ssid,
+                           NM_SETTING_OLPC_MESH_CHANNEL,
+                           1,
+                           NULL);
+    g_bytes_unref(ssid);
+
+    nm_connection_add_setting(con, setting);
+    return setting;
+}
+
+static NMSetting *
+_add_setting_fcn_team(NMConnection *con)
+{
+    NMSetting *          setting;
+    NMSettingConnection *s_con;
+
+    setting = g_object_new(NM_TYPE_SETTING_TEAM, NULL);
+
+    nm_connection_add_setting(con, setting);
+
+    s_con = nm_connection_get_setting_connection(con);
+
+    g_object_set(s_con, NM_SETTING_CONNECTION_INTERFACE_NAME, "test-team", NULL);
+
+    return setting;
+}
+
+static NMSetting *
+_add_setting_fcn_vlan(NMConnection *con)
+{
+    NMSetting *setting;
+
+    setting = g_object_new(NM_TYPE_SETTING_VLAN, NM_SETTING_VLAN_PARENT, "test-parent", NULL);
+
+    nm_connection_add_setting(con, setting);
+    return setting;
+}
+
+static NMSetting *
+_add_setting_fcn_vpn(NMConnection *con)
+{
+    NMSetting *setting;
+
+    setting = g_object_new(NM_TYPE_SETTING_VPN,
+                           NM_SETTING_VPN_SERVICE_TYPE,
+                           "test-vpn-service-type",
+                           NULL);
+
+    nm_connection_add_setting(con, setting);
+    return setting;
+}
+
+static NMSetting *
+_add_setting_fcn_wimax(NMConnection *con)
+{
+    NMSetting *setting;
+
+    setting =
+        g_object_new(NM_TYPE_SETTING_WIMAX, NM_SETTING_WIMAX_NETWORK_NAME, "test-network", NULL);
+
+    nm_connection_add_setting(con, setting);
+    return setting;
+}
+
+static NMSetting *
+_add_setting_fcn_wireless(NMConnection *con)
+{
+    NMSetting * setting;
+    const char *ssid_data = "ssid-test";
+    GBytes *    ssid;
+
+    ssid    = g_bytes_new(ssid_data, strlen(ssid_data));
+    setting = g_object_new(NM_TYPE_SETTING_WIRELESS, NM_SETTING_WIRELESS_SSID, ssid, NULL);
+    g_bytes_unref(ssid);
+
+    nm_connection_add_setting(con, setting);
+    return setting;
+}
+
+static void
+_prepare_normalizable_fcn_vlan(NMConnection *con)
+{
+    nm_connection_add_setting(con,
+                              g_object_new(NM_TYPE_SETTING_WIRED,
+                                           NM_SETTING_WIRED_MAC_ADDRESS,
+                                           "11:22:33:44:55:66",
+                                           NULL));
+}
+
+static void
+test_connection_normalize_type(void)
+{
+    guint i;
+    struct {
+        const char *type;
+        gboolean    normalizable;
+        NMSetting *(*add_setting_fcn)(NMConnection *con);
+        void (*prepare_normalizable_fcn)(NMConnection *con);
+    } types[] = {
+        {NM_SETTING_GENERIC_SETTING_NAME, TRUE},
+        {NM_SETTING_GSM_SETTING_NAME, TRUE},
+        {NM_SETTING_WIRED_SETTING_NAME, TRUE},
+        {NM_SETTING_VLAN_SETTING_NAME, TRUE, _add_setting_fcn_vlan, _prepare_normalizable_fcn_vlan},
+
+        {NM_SETTING_ADSL_SETTING_NAME, FALSE, _add_setting_fcn_adsl},
+        {NM_SETTING_BLUETOOTH_SETTING_NAME, FALSE, _add_setting_fcn_bluetooth},
+        {NM_SETTING_BOND_SETTING_NAME, FALSE, _add_setting_fcn_bond},
+        {NM_SETTING_BRIDGE_SETTING_NAME, FALSE, _add_setting_fcn_bridge},
+        {NM_SETTING_CDMA_SETTING_NAME, FALSE, _add_setting_fcn_cdma},
+        {NM_SETTING_INFINIBAND_SETTING_NAME, FALSE, _add_setting_fcn_infiniband},
+        {NM_SETTING_OLPC_MESH_SETTING_NAME, FALSE, _add_setting_fcn_olpc_mesh},
+        {NM_SETTING_TEAM_SETTING_NAME, FALSE, _add_setting_fcn_team},
+        {NM_SETTING_VLAN_SETTING_NAME, FALSE, _add_setting_fcn_vlan},
+        {NM_SETTING_VPN_SETTING_NAME, FALSE, _add_setting_fcn_vpn},
+        {NM_SETTING_WIMAX_SETTING_NAME, FALSE, _add_setting_fcn_wimax},
+        {NM_SETTING_WIRELESS_SETTING_NAME, FALSE, _add_setting_fcn_wireless},
+        {0},
+    };
+
+    for (i = 0; types[i].type; i++) {
+        const char *type = types[i].type;
+
+        if (types[i].normalizable)
+            _test_connection_normalize_type_normalizable_setting(type,
+                                                                 types[i].prepare_normalizable_fcn);
+        else
+            _test_connection_normalize_type_unnormalizable_setting(type);
+        _test_connection_normalize_type_normalizable_type(type, types[i].add_setting_fcn);
+    }
+}
+
+static void
+test_connection_normalize_slave_type_1(void)
+{
+    gs_unref_object NMConnection *con = NULL;
+    NMSettingConnection *         s_con;
+
+    con = nmtst_create_minimal_connection("test_connection_normalize_slave_type_1",
+                                          "cc4cd5df-45dc-483e-b291-6b76c2338ecb",
+                                          NM_SETTING_WIRED_SETTING_NAME,
+                                          &s_con);
+
+    g_object_set(s_con,
+                 NM_SETTING_CONNECTION_MASTER,
+                 "master0",
+                 NM_SETTING_CONNECTION_SLAVE_TYPE,
+                 "invalid-type",
+                 NULL);
+
+    nmtst_assert_connection_unnormalizable(con,
+                                           NM_CONNECTION_ERROR,
+                                           NM_CONNECTION_ERROR_INVALID_PROPERTY);
+    g_assert(!nm_connection_get_setting_by_name(con, NM_SETTING_BRIDGE_PORT_SETTING_NAME));
+
+    g_object_set(s_con, NM_SETTING_CONNECTION_SLAVE_TYPE, "bridge", NULL);
+
+    g_assert(!nm_connection_get_setting_by_name(con, NM_SETTING_BRIDGE_PORT_SETTING_NAME));
+    nmtst_assert_connection_verifies_after_normalization(con,
+                                                         NM_CONNECTION_ERROR,
+                                                         NM_CONNECTION_ERROR_MISSING_SETTING);
+    nmtst_connection_normalize(con);
+    g_assert(nm_connection_get_setting_by_name(con, NM_SETTING_BRIDGE_PORT_SETTING_NAME));
+    g_assert_cmpstr(nm_setting_connection_get_slave_type(s_con),
+                    ==,
+                    NM_SETTING_BRIDGE_SETTING_NAME);
+}
+
+static void
+test_connection_normalize_slave_type_2(void)
+{
+    gs_unref_object NMConnection *con = NULL;
+    NMSettingConnection *         s_con;
+
+    con = nmtst_create_minimal_connection("test_connection_normalize_slave_type_2",
+                                          "40bea008-ca72-439a-946b-e65f827656f9",
+                                          NM_SETTING_WIRED_SETTING_NAME,
+                                          &s_con);
+
+    g_object_set(s_con,
+                 NM_SETTING_CONNECTION_MASTER,
+                 "master0",
+                 NM_SETTING_CONNECTION_SLAVE_TYPE,
+                 "invalid-type",
+                 NULL);
+
+    nmtst_assert_connection_unnormalizable(con,
+                                           NM_CONNECTION_ERROR,
+                                           NM_CONNECTION_ERROR_INVALID_PROPERTY);
+    g_assert(!nm_connection_get_setting_by_name(con, NM_SETTING_BRIDGE_PORT_SETTING_NAME));
+
+    g_object_set(s_con, NM_SETTING_CONNECTION_SLAVE_TYPE, NULL, NULL);
+    nm_connection_add_setting(con, nm_setting_bridge_port_new());
+
+    g_assert(nm_connection_get_setting_by_name(con, NM_SETTING_BRIDGE_PORT_SETTING_NAME));
+    g_assert_cmpstr(nm_setting_connection_get_slave_type(s_con), ==, NULL);
+    nmtst_assert_connection_verifies_after_normalization(con,
+                                                         NM_CONNECTION_ERROR,
+                                                         NM_CONNECTION_ERROR_MISSING_PROPERTY);
+    nmtst_connection_normalize(con);
+    g_assert(nm_connection_get_setting_by_name(con, NM_SETTING_BRIDGE_PORT_SETTING_NAME));
+    g_assert_cmpstr(nm_setting_connection_get_slave_type(s_con),
+                    ==,
+                    NM_SETTING_BRIDGE_SETTING_NAME);
+}
+
+static void
+test_connection_normalize_infiniband_mtu(void)
+{
+    gs_unref_object NMConnection *con = NULL;
+    NMSettingInfiniband *         s_infini;
+    guint                         mtu_regular = nmtst_rand_select(2044, 2045, 65520);
+
+    con = nmtst_create_minimal_connection("test_connection_normalize_infiniband_mtu",
+                                          NULL,
+                                          NM_SETTING_INFINIBAND_SETTING_NAME,
+                                          NULL);
+
+    s_infini = nm_connection_get_setting_infiniband(con);
+    g_object_set(s_infini, NM_SETTING_INFINIBAND_TRANSPORT_MODE, "connected", NULL);
+    nmtst_assert_connection_verifies_and_normalizable(con);
+
+    g_object_set(s_infini,
+                 NM_SETTING_INFINIBAND_TRANSPORT_MODE,
+                 "datagram",
+                 NM_SETTING_INFINIBAND_MTU,
+                 (guint) mtu_regular,
+                 NULL);
+    nmtst_assert_connection_verifies_and_normalizable(con);
+    nmtst_connection_normalize(con);
+    g_assert_cmpint(mtu_regular, ==, nm_setting_infiniband_get_mtu(s_infini));
+
+    g_object_set(s_infini,
+                 NM_SETTING_INFINIBAND_TRANSPORT_MODE,
+                 "datagram",
+                 NM_SETTING_INFINIBAND_MTU,
+                 (guint) 65521,
+                 NULL);
+    nmtst_assert_connection_verifies_after_normalization(con,
+                                                         NM_CONNECTION_ERROR,
+                                                         NM_CONNECTION_ERROR_INVALID_PROPERTY);
+    nmtst_connection_normalize(con);
+    g_assert_cmpint(65520, ==, nm_setting_infiniband_get_mtu(s_infini));
+
+    g_object_set(s_infini,
+                 NM_SETTING_INFINIBAND_TRANSPORT_MODE,
+                 "connected",
+                 NM_SETTING_INFINIBAND_MTU,
+                 (guint) mtu_regular,
+                 NULL);
+    nmtst_assert_connection_verifies_without_normalization(con);
+    g_assert_cmpint(mtu_regular, ==, nm_setting_infiniband_get_mtu(s_infini));
+
+    g_object_set(s_infini,
+                 NM_SETTING_INFINIBAND_TRANSPORT_MODE,
+                 "connected",
+                 NM_SETTING_INFINIBAND_MTU,
+                 (guint) 65521,
+                 NULL);
+    nmtst_assert_connection_verifies_after_normalization(con,
+                                                         NM_CONNECTION_ERROR,
+                                                         NM_CONNECTION_ERROR_INVALID_PROPERTY);
+    nmtst_connection_normalize(con);
+    g_assert_cmpint(65520, ==, nm_setting_infiniband_get_mtu(s_infini));
+}
+
+static void
+test_connection_normalize_gateway_never_default(void)
+{
+    gs_unref_object NMConnection *con = NULL;
+    NMSettingIPConfig *           s_ip4, *s_ip6;
+    NMIPAddress *                 addr;
+    gs_free_error GError *error = NULL;
+
+    con = nmtst_create_minimal_connection("test1", NULL, NM_SETTING_WIRED_SETTING_NAME, NULL);
+    nmtst_assert_connection_verifies_and_normalizable(con);
+
+    s_ip4 = (NMSettingIPConfig *) nm_setting_ip4_config_new();
+    g_object_set(G_OBJECT(s_ip4),
+                 NM_SETTING_IP_CONFIG_METHOD,
+                 NM_SETTING_IP4_CONFIG_METHOD_MANUAL,
+                 NULL);
+
+    addr = nm_ip_address_new(AF_INET, "1.1.1.1", 24, &error);
+    g_assert_no_error(error);
+    nm_setting_ip_config_add_address(s_ip4, addr);
+    nm_ip_address_unref(addr);
+
+    g_object_set(s_ip4,
+                 NM_SETTING_IP_CONFIG_GATEWAY,
+                 "1.1.1.254",
+                 NM_SETTING_IP_CONFIG_NEVER_DEFAULT,
+                 FALSE,
+                 NULL);
+
+    s_ip6 = (NMSettingIPConfig *) nm_setting_ip6_config_new();
+    g_object_set(s_ip6, NM_SETTING_IP_CONFIG_METHOD, NM_SETTING_IP6_CONFIG_METHOD_AUTO, NULL);
+
+    nm_connection_add_setting(con, (NMSetting *) s_ip4);
+    nm_connection_add_setting(con, (NMSetting *) s_ip6);
+    nm_connection_add_setting(con, nm_setting_proxy_new());
+
+    nmtst_assert_connection_verifies_without_normalization(con);
+    g_assert_cmpstr("1.1.1.254", ==, nm_setting_ip_config_get_gateway(s_ip4));
+
+    /* Now set never-default to TRUE and check that the gateway is
+     * removed during normalization
+     * */
+    g_object_set(s_ip4, NM_SETTING_IP_CONFIG_NEVER_DEFAULT, TRUE, NULL);
+
+    nmtst_assert_connection_verifies_after_normalization(con,
+                                                         NM_CONNECTION_ERROR,
+                                                         NM_CONNECTION_ERROR_INVALID_PROPERTY);
+    nmtst_connection_normalize(con);
+    g_assert_cmpstr(NULL, ==, nm_setting_ip_config_get_gateway(s_ip4));
+}
+
+static void
+test_connection_normalize_may_fail(void)
+{
+    gs_unref_object NMConnection *con = NULL;
+    NMSettingIPConfig *           s_ip4, *s_ip6;
+
+    con = nmtst_create_minimal_connection("test2", NULL, NM_SETTING_WIRED_SETTING_NAME, NULL);
+    nmtst_assert_connection_verifies_and_normalizable(con);
+
+    s_ip4 = (NMSettingIPConfig *) nm_setting_ip4_config_new();
+    g_object_set(G_OBJECT(s_ip4),
+                 NM_SETTING_IP_CONFIG_METHOD,
+                 NM_SETTING_IP4_CONFIG_METHOD_AUTO,
+                 NM_SETTING_IP_CONFIG_MAY_FAIL,
+                 FALSE,
+                 NULL);
+
+    s_ip6 = (NMSettingIPConfig *) nm_setting_ip6_config_new();
+    g_object_set(s_ip6,
+                 NM_SETTING_IP_CONFIG_METHOD,
+                 NM_SETTING_IP6_CONFIG_METHOD_AUTO,
+                 NM_SETTING_IP_CONFIG_MAY_FAIL,
+                 FALSE,
+                 NULL);
+
+    nm_connection_add_setting(con, (NMSetting *) s_ip4);
+    nm_connection_add_setting(con, (NMSetting *) s_ip6);
+
+    nmtst_assert_connection_verifies_and_normalizable(con);
+
+    /* Now set method=disabled/ignore and check that may-fail becomes TRUE
+     * after normalization
+     * */
+    g_object_set(s_ip4, NM_SETTING_IP_CONFIG_METHOD, NM_SETTING_IP4_CONFIG_METHOD_DISABLED, NULL);
+    g_object_set(s_ip6, NM_SETTING_IP_CONFIG_METHOD, NM_SETTING_IP6_CONFIG_METHOD_IGNORE, NULL);
+
+    nmtst_assert_connection_verifies(con);
+    nmtst_connection_normalize(con);
+    g_assert_cmpint(nm_setting_ip_config_get_may_fail(s_ip4), ==, TRUE);
+    g_assert_cmpint(nm_setting_ip_config_get_may_fail(s_ip6), ==, TRUE);
+}
+
+static void
+test_connection_normalize_shared_addresses(void)
+{
+    gs_unref_object NMConnection *con = NULL;
+    NMSettingIPConfig *           s_ip4, *s_ip6;
+    NMIPAddress *                 addr;
+    gs_free_error GError *error = NULL;
+
+    con = nmtst_create_minimal_connection("test1", NULL, NM_SETTING_WIRED_SETTING_NAME, NULL);
+    nmtst_assert_connection_verifies_and_normalizable(con);
+
+    s_ip4 = (NMSettingIPConfig *) nm_setting_ip4_config_new();
+    g_object_set(G_OBJECT(s_ip4),
+                 NM_SETTING_IP_CONFIG_METHOD,
+                 NM_SETTING_IP4_CONFIG_METHOD_SHARED,
+                 NULL);
+
+    addr = nm_ip_address_new(AF_INET, "1.1.1.1", 24, &error);
+    g_assert_no_error(error);
+    nm_setting_ip_config_add_address(s_ip4, addr);
+    nm_ip_address_unref(addr);
+
+    s_ip6 = (NMSettingIPConfig *) nm_setting_ip6_config_new();
+    g_object_set(s_ip6, NM_SETTING_IP_CONFIG_METHOD, NM_SETTING_IP6_CONFIG_METHOD_AUTO, NULL);
+
+    nm_connection_add_setting(con, (NMSetting *) s_ip4);
+    nm_connection_add_setting(con, (NMSetting *) s_ip6);
+
+    nmtst_assert_connection_verifies_and_normalizable(con);
+
+    /* Now we add other addresses and check that they are
+     * removed during normalization
+     * */
+    addr = nm_ip_address_new(AF_INET, "2.2.2.2", 24, &error);
+    g_assert_no_error(error);
+    nm_setting_ip_config_add_address(s_ip4, addr);
+    nm_ip_address_unref(addr);
+
+    addr = nm_ip_address_new(AF_INET, "3.3.3.3", 24, &error);
+    g_assert_no_error(error);
+    nm_setting_ip_config_add_address(s_ip4, addr);
+    nm_ip_address_unref(addr);
+
+    nmtst_assert_connection_verifies_after_normalization(con,
+                                                         NM_CONNECTION_ERROR,
+                                                         NM_CONNECTION_ERROR_INVALID_PROPERTY);
+    nmtst_connection_normalize(con);
+    g_assert_cmpuint(nm_setting_ip_config_get_num_addresses(s_ip4), ==, 1);
+    addr = nm_setting_ip_config_get_address(s_ip4, 0);
+    g_assert_cmpstr(nm_ip_address_get_address(addr), ==, "1.1.1.1");
+}
+
+static void
+test_connection_normalize_ovs_interface_type_system(gconstpointer test_data)
+{
+    const guint     TEST_CASE         = GPOINTER_TO_UINT(test_data);
+    gs_unref_object NMConnection *con = NULL;
+    NMSettingConnection *         s_con;
+    NMSettingOvsInterface *       s_ovs_if;
+
+    con = nmtst_create_minimal_connection("test_connection_normalize_ovs_interface_type_system",
+                                          NULL,
+                                          NM_SETTING_WIRED_SETTING_NAME,
+                                          &s_con);
+
+    switch (TEST_CASE) {
+    case 1:
+        g_object_set(s_con,
+                     NM_SETTING_CONNECTION_MASTER,
+                     "master0",
+                     NM_SETTING_CONNECTION_SLAVE_TYPE,
+                     NM_SETTING_OVS_PORT_SETTING_NAME,
+                     NULL);
+
+        nmtst_assert_connection_verifies_after_normalization(con,
+                                                             NM_CONNECTION_ERROR,
+                                                             NM_CONNECTION_ERROR_MISSING_SETTING);
+
+        nmtst_connection_normalize(con);
+        nmtst_assert_connection_has_settings(con,
+                                             NM_SETTING_CONNECTION_SETTING_NAME,
+                                             NM_SETTING_WIRED_SETTING_NAME,
+                                             NM_SETTING_OVS_INTERFACE_SETTING_NAME);
+        s_ovs_if = nm_connection_get_setting_ovs_interface(con);
+        g_assert(s_ovs_if);
+        g_assert_cmpstr(nm_setting_ovs_interface_get_interface_type(s_ovs_if), ==, "system");
+        break;
+    case 2:
+        g_object_set(s_con,
+                     NM_SETTING_CONNECTION_MASTER,
+                     "master0",
+                     NM_SETTING_CONNECTION_SLAVE_TYPE,
+                     NM_SETTING_OVS_PORT_SETTING_NAME,
+                     NULL);
+
+        s_ovs_if = NM_SETTING_OVS_INTERFACE(nm_setting_ovs_interface_new());
+        nm_connection_add_setting(con, NM_SETTING(s_ovs_if));
+
+        nmtst_assert_connection_verifies_after_normalization(con,
+                                                             NM_CONNECTION_ERROR,
+                                                             NM_CONNECTION_ERROR_MISSING_PROPERTY);
+
+        nmtst_connection_normalize(con);
+        nmtst_assert_connection_has_settings(con,
+                                             NM_SETTING_CONNECTION_SETTING_NAME,
+                                             NM_SETTING_WIRED_SETTING_NAME,
+                                             NM_SETTING_OVS_INTERFACE_SETTING_NAME);
+        g_assert(s_ovs_if == nm_connection_get_setting_ovs_interface(con));
+        g_assert_cmpstr(nm_setting_ovs_interface_get_interface_type(s_ovs_if), ==, "system");
+        break;
+    case 3:
+        g_object_set(s_con,
+                     NM_SETTING_CONNECTION_MASTER,
+                     "master0",
+                     NM_SETTING_CONNECTION_SLAVE_TYPE,
+                     NM_SETTING_OVS_PORT_SETTING_NAME,
+                     NULL);
+
+        s_ovs_if = NM_SETTING_OVS_INTERFACE(nm_setting_ovs_interface_new());
+        nm_connection_add_setting(con, NM_SETTING(s_ovs_if));
+
+        g_object_set(s_ovs_if, NM_SETTING_OVS_INTERFACE_TYPE, "system", NULL);
+        nmtst_assert_connection_verifies_without_normalization(con);
+        nmtst_assert_connection_has_settings(con,
+                                             NM_SETTING_CONNECTION_SETTING_NAME,
+                                             NM_SETTING_WIRED_SETTING_NAME,
+                                             NM_SETTING_OVS_INTERFACE_SETTING_NAME);
+        break;
+    case 4:
+        g_object_set(s_con,
+                     NM_SETTING_CONNECTION_MASTER,
+                     "master0",
+                     NM_SETTING_CONNECTION_SLAVE_TYPE,
+                     NM_SETTING_OVS_PORT_SETTING_NAME,
+                     NULL);
+
+        s_ovs_if = NM_SETTING_OVS_INTERFACE(nm_setting_ovs_interface_new());
+        nm_connection_add_setting(con, NM_SETTING(s_ovs_if));
+
+        g_object_set(s_ovs_if, NM_SETTING_OVS_INTERFACE_TYPE, "internal", NULL);
+        /* the setting doesn't verify, because the interface-type must be "system". */
+        nmtst_assert_connection_unnormalizable(con,
+                                               NM_CONNECTION_ERROR,
+                                               NM_CONNECTION_ERROR_INVALID_PROPERTY);
+        break;
+    case 5:
+        g_object_set(s_con, NM_SETTING_CONNECTION_MASTER, "master0", NULL);
+
+        s_ovs_if = NM_SETTING_OVS_INTERFACE(nm_setting_ovs_interface_new());
+        nm_connection_add_setting(con, NM_SETTING(s_ovs_if));
+
+        g_object_set(s_ovs_if, NM_SETTING_OVS_INTERFACE_TYPE, "system", NULL);
+        nmtst_assert_connection_verifies_after_normalization(con,
+                                                             NM_CONNECTION_ERROR,
+                                                             NM_CONNECTION_ERROR_MISSING_PROPERTY);
+        nmtst_connection_normalize(con);
+        nmtst_assert_connection_has_settings(con,
+                                             NM_SETTING_CONNECTION_SETTING_NAME,
+                                             NM_SETTING_WIRED_SETTING_NAME,
+                                             NM_SETTING_OVS_INTERFACE_SETTING_NAME);
+        g_assert(s_con == nm_connection_get_setting_connection(con));
+        g_assert_cmpstr(nm_setting_connection_get_slave_type(s_con),
+                        ==,
+                        NM_SETTING_OVS_PORT_SETTING_NAME);
+        break;
+    case 6:
+        g_object_set(s_con,
+                     NM_SETTING_CONNECTION_MASTER,
+                     "master0",
+                     NM_SETTING_CONNECTION_SLAVE_TYPE,
+                     NM_SETTING_BRIDGE_SETTING_NAME,
+                     NULL);
+
+        s_ovs_if = NM_SETTING_OVS_INTERFACE(nm_setting_ovs_interface_new());
+        nm_connection_add_setting(con, NM_SETTING(s_ovs_if));
+
+        g_object_set(s_ovs_if, NM_SETTING_OVS_INTERFACE_TYPE, "system", NULL);
+        nmtst_assert_connection_unnormalizable(con,
+                                               NM_CONNECTION_ERROR,
+                                               NM_CONNECTION_ERROR_INVALID_PROPERTY);
+        break;
+    case 7:
+        g_object_set(s_con,
+                     NM_SETTING_CONNECTION_MASTER,
+                     "master0",
+                     NM_SETTING_CONNECTION_SLAVE_TYPE,
+                     NM_SETTING_BRIDGE_SETTING_NAME,
+                     NULL);
+
+        nm_connection_add_setting(con, nm_setting_bridge_port_new());
+
+        s_ovs_if = NM_SETTING_OVS_INTERFACE(nm_setting_ovs_interface_new());
+        nm_connection_add_setting(con, NM_SETTING(s_ovs_if));
+
+        g_object_set(s_ovs_if, NM_SETTING_OVS_INTERFACE_TYPE, "system", NULL);
+        nmtst_assert_connection_unnormalizable(con,
+                                               NM_CONNECTION_ERROR,
+                                               NM_CONNECTION_ERROR_INVALID_PROPERTY);
+        break;
+    default:
+        g_assert_not_reached();
+        break;
+    }
+}
+
+static void
+test_connection_normalize_ovs_interface_type_ovs_interface(gconstpointer test_data)
+{
+    const guint     TEST_CASE         = GPOINTER_TO_UINT(test_data);
+    gs_unref_object NMConnection *con = NULL;
+    NMSettingConnection *         s_con;
+    NMSettingOvsInterface *       s_ovs_if;
+    NMSettingOvsPatch *           s_ovs_patch;
+    NMSettingIP4Config *          s_ip4;
+    NMSettingIP6Config *          s_ip6;
+
+    con = nmtst_create_minimal_connection(
+        "test_connection_normalize_ovs_interface_type_ovs_interface",
+        NULL,
+        NM_SETTING_OVS_INTERFACE_SETTING_NAME,
+        &s_con);
+    s_ovs_if = nm_connection_get_setting_ovs_interface(con);
+    g_assert(s_ovs_if);
+
+    switch (TEST_CASE) {
+    case 1:
+        nmtst_assert_connection_unnormalizable(con,
+                                               NM_CONNECTION_ERROR,
+                                               NM_CONNECTION_ERROR_INVALID_PROPERTY);
+        break;
+    case 2:
+        g_object_set(s_con, NM_SETTING_CONNECTION_MASTER, "master0", NULL);
+        nmtst_assert_connection_verifies_after_normalization(con,
+                                                             NM_CONNECTION_ERROR,
+                                                             NM_CONNECTION_ERROR_MISSING_PROPERTY);
+        nmtst_connection_normalize(con);
+        nmtst_assert_connection_has_settings(con,
+                                             NM_SETTING_CONNECTION_SETTING_NAME,
+                                             NM_SETTING_IP4_CONFIG_SETTING_NAME,
+                                             NM_SETTING_IP6_CONFIG_SETTING_NAME,
+                                             NM_SETTING_PROXY_SETTING_NAME,
+                                             NM_SETTING_OVS_INTERFACE_SETTING_NAME);
+        g_assert(s_con == nm_connection_get_setting_connection(con));
+        g_assert(s_ovs_if == nm_connection_get_setting_ovs_interface(con));
+        g_assert_cmpstr(nm_setting_connection_get_slave_type(s_con),
+                        ==,
+                        NM_SETTING_OVS_PORT_SETTING_NAME);
+        g_assert_cmpstr(nm_setting_ovs_interface_get_interface_type(s_ovs_if), ==, "internal");
+        break;
+    case 3:
+        g_object_set(s_con,
+                     NM_SETTING_CONNECTION_MASTER,
+                     "master0",
+                     NM_SETTING_CONNECTION_SLAVE_TYPE,
+                     NM_SETTING_OVS_PORT_SETTING_NAME,
+                     NULL);
+        nmtst_assert_connection_verifies_after_normalization(con,
+                                                             NM_CONNECTION_ERROR,
+                                                             NM_CONNECTION_ERROR_MISSING_PROPERTY);
+        nmtst_connection_normalize(con);
+        nmtst_assert_connection_has_settings(con,
+                                             NM_SETTING_CONNECTION_SETTING_NAME,
+                                             NM_SETTING_IP4_CONFIG_SETTING_NAME,
+                                             NM_SETTING_IP6_CONFIG_SETTING_NAME,
+                                             NM_SETTING_PROXY_SETTING_NAME,
+                                             NM_SETTING_OVS_INTERFACE_SETTING_NAME);
+        g_assert(s_con == nm_connection_get_setting_connection(con));
+        g_assert(s_ovs_if == nm_connection_get_setting_ovs_interface(con));
+        g_assert_cmpstr(nm_setting_connection_get_slave_type(s_con),
+                        ==,
+                        NM_SETTING_OVS_PORT_SETTING_NAME);
+        g_assert_cmpstr(nm_setting_ovs_interface_get_interface_type(s_ovs_if), ==, "internal");
+        break;
+    case 4:
+        g_object_set(s_con, NM_SETTING_CONNECTION_MASTER, "master0", NULL);
+        g_object_set(s_ovs_if, NM_SETTING_OVS_INTERFACE_TYPE, "internal", NULL);
+        nmtst_assert_connection_verifies_after_normalization(con,
+                                                             NM_CONNECTION_ERROR,
+                                                             NM_CONNECTION_ERROR_MISSING_PROPERTY);
+        nmtst_connection_normalize(con);
+        nmtst_assert_connection_has_settings(con,
+                                             NM_SETTING_CONNECTION_SETTING_NAME,
+                                             NM_SETTING_IP4_CONFIG_SETTING_NAME,
+                                             NM_SETTING_IP6_CONFIG_SETTING_NAME,
+                                             NM_SETTING_PROXY_SETTING_NAME,
+                                             NM_SETTING_OVS_INTERFACE_SETTING_NAME);
+        g_assert(s_con == nm_connection_get_setting_connection(con));
+        g_assert(s_ovs_if == nm_connection_get_setting_ovs_interface(con));
+        g_assert_cmpstr(nm_setting_connection_get_slave_type(s_con),
+                        ==,
+                        NM_SETTING_OVS_PORT_SETTING_NAME);
+        g_assert_cmpstr(nm_setting_ovs_interface_get_interface_type(s_ovs_if), ==, "internal");
+        break;
+    case 5:
+        g_object_set(s_con,
+                     NM_SETTING_CONNECTION_MASTER,
+                     "master0",
+                     NM_SETTING_CONNECTION_SLAVE_TYPE,
+                     NM_SETTING_OVS_PORT_SETTING_NAME,
+                     NULL);
+        g_object_set(s_ovs_if, NM_SETTING_OVS_INTERFACE_TYPE, "internal", NULL);
+        nm_connection_add_setting(con, nm_setting_ip4_config_new());
+        nm_connection_add_setting(con, nm_setting_ip6_config_new());
+        nm_connection_add_setting(con, nm_setting_proxy_new());
+        s_ip4 = NM_SETTING_IP4_CONFIG(nm_connection_get_setting_ip4_config(con));
+        s_ip6 = NM_SETTING_IP6_CONFIG(nm_connection_get_setting_ip6_config(con));
+        g_object_set(s_ip4, NM_SETTING_IP_CONFIG_METHOD, "auto", NULL);
+        g_object_set(s_ip6, NM_SETTING_IP_CONFIG_METHOD, "auto", NULL);
+        nmtst_assert_connection_verifies_without_normalization(con);
+        nmtst_assert_connection_has_settings(con,
+                                             NM_SETTING_CONNECTION_SETTING_NAME,
+                                             NM_SETTING_IP4_CONFIG_SETTING_NAME,
+                                             NM_SETTING_IP6_CONFIG_SETTING_NAME,
+                                             NM_SETTING_PROXY_SETTING_NAME,
+                                             NM_SETTING_OVS_INTERFACE_SETTING_NAME);
+        break;
+    case 6:
+        g_object_set(s_con,
+                     NM_SETTING_CONNECTION_MASTER,
+                     "master0",
+                     NM_SETTING_CONNECTION_SLAVE_TYPE,
+                     NM_SETTING_OVS_PORT_SETTING_NAME,
+                     NULL);
+        g_object_set(s_ovs_if, NM_SETTING_OVS_INTERFACE_TYPE, "internal", NULL);
+        nmtst_assert_connection_verifies_and_normalizable(con);
+        nmtst_connection_normalize(con);
+        nmtst_assert_connection_has_settings(con,
+                                             NM_SETTING_CONNECTION_SETTING_NAME,
+                                             NM_SETTING_IP4_CONFIG_SETTING_NAME,
+                                             NM_SETTING_IP6_CONFIG_SETTING_NAME,
+                                             NM_SETTING_PROXY_SETTING_NAME,
+                                             NM_SETTING_OVS_INTERFACE_SETTING_NAME);
+        g_assert(s_con == nm_connection_get_setting_connection(con));
+        g_assert(s_ovs_if == nm_connection_get_setting_ovs_interface(con));
+        g_assert_cmpstr(nm_setting_connection_get_slave_type(s_con),
+                        ==,
+                        NM_SETTING_OVS_PORT_SETTING_NAME);
+        g_assert_cmpstr(nm_setting_ovs_interface_get_interface_type(s_ovs_if), ==, "internal");
+        break;
+    case 7:
+        g_object_set(s_con,
+                     NM_SETTING_CONNECTION_MASTER,
+                     "master0",
+                     NM_SETTING_CONNECTION_SLAVE_TYPE,
+                     NM_SETTING_OVS_PORT_SETTING_NAME,
+                     NULL);
+        g_object_set(s_ovs_if, NM_SETTING_OVS_INTERFACE_TYPE, "system", NULL);
+        nmtst_assert_connection_unnormalizable(con,
+                                               NM_CONNECTION_ERROR,
+                                               NM_CONNECTION_ERROR_INVALID_PROPERTY);
+        break;
+    case 8:
+        g_object_set(s_con,
+                     NM_SETTING_CONNECTION_MASTER,
+                     "master0",
+                     NM_SETTING_CONNECTION_SLAVE_TYPE,
+                     NM_SETTING_OVS_PORT_SETTING_NAME,
+                     NULL);
+        g_object_set(s_ovs_if, NM_SETTING_OVS_INTERFACE_TYPE, "bogus", NULL);
+        nmtst_assert_connection_unnormalizable(con,
+                                               NM_CONNECTION_ERROR,
+                                               NM_CONNECTION_ERROR_INVALID_PROPERTY);
+        break;
+    case 9:
+        g_object_set(s_con,
+                     NM_SETTING_CONNECTION_MASTER,
+                     "master0",
+                     NM_SETTING_CONNECTION_SLAVE_TYPE,
+                     NM_SETTING_OVS_PORT_SETTING_NAME,
+                     NULL);
+        g_object_set(s_ovs_if, NM_SETTING_OVS_INTERFACE_TYPE, "patch", NULL);
+        nmtst_assert_connection_unnormalizable(con,
+                                               NM_CONNECTION_ERROR,
+                                               NM_CONNECTION_ERROR_MISSING_SETTING);
+        break;
+    case 10:
+        g_object_set(s_con,
+                     NM_SETTING_CONNECTION_MASTER,
+                     "master0",
+                     NM_SETTING_CONNECTION_SLAVE_TYPE,
+                     NM_SETTING_OVS_PORT_SETTING_NAME,
+                     NULL);
+        g_object_set(s_ovs_if, NM_SETTING_OVS_INTERFACE_TYPE, "patch", NULL);
+        nm_connection_add_setting(con, nm_setting_ovs_patch_new());
+        nmtst_assert_connection_unnormalizable(con,
+                                               NM_CONNECTION_ERROR,
+                                               NM_CONNECTION_ERROR_MISSING_PROPERTY);
+        break;
+    case 11:
+        g_object_set(s_con,
+                     NM_SETTING_CONNECTION_MASTER,
+                     "master0",
+                     NM_SETTING_CONNECTION_SLAVE_TYPE,
+                     NM_SETTING_OVS_PORT_SETTING_NAME,
+                     NM_SETTING_CONNECTION_INTERFACE_NAME,
+                     "adsf",
+                     NULL);
+        g_object_set(s_ovs_if, NM_SETTING_OVS_INTERFACE_TYPE, "patch", NULL);
+        nm_connection_add_setting(con, nm_setting_ovs_patch_new());
+        nmtst_assert_connection_unnormalizable(con,
+                                               NM_CONNECTION_ERROR,
+                                               NM_CONNECTION_ERROR_MISSING_PROPERTY);
+        break;
+    case 12:
+        g_object_set(s_con,
+                     NM_SETTING_CONNECTION_MASTER,
+                     "master0",
+                     NM_SETTING_CONNECTION_SLAVE_TYPE,
+                     NM_SETTING_OVS_PORT_SETTING_NAME,
+                     NM_SETTING_CONNECTION_INTERFACE_NAME,
+                     "adsf",
+                     NULL);
+        g_object_set(s_ovs_if, NM_SETTING_OVS_INTERFACE_TYPE, "patch", NULL);
+        s_ovs_patch = NM_SETTING_OVS_PATCH(nm_setting_ovs_patch_new());
+        nm_connection_add_setting(con, NM_SETTING(s_ovs_patch));
+        g_object_set(s_ovs_patch, NM_SETTING_OVS_PATCH_PEER, "1.2.3.4", NULL);
+        nmtst_assert_connection_verifies_and_normalizable(con);
+        nmtst_connection_normalize(con);
+        nmtst_assert_connection_has_settings(con,
+                                             NM_SETTING_CONNECTION_SETTING_NAME,
+                                             NM_SETTING_IP4_CONFIG_SETTING_NAME,
+                                             NM_SETTING_IP6_CONFIG_SETTING_NAME,
+                                             NM_SETTING_PROXY_SETTING_NAME,
+                                             NM_SETTING_OVS_INTERFACE_SETTING_NAME,
+                                             NM_SETTING_OVS_PATCH_SETTING_NAME);
+        g_assert(s_con == nm_connection_get_setting_connection(con));
+        g_assert(s_ovs_if == nm_connection_get_setting_ovs_interface(con));
+        g_assert_cmpstr(nm_setting_connection_get_slave_type(s_con),
+                        ==,
+                        NM_SETTING_OVS_PORT_SETTING_NAME);
+        g_assert_cmpstr(nm_setting_ovs_interface_get_interface_type(s_ovs_if), ==, "patch");
+        break;
+    default:
+        g_assert_not_reached();
+    }
+}
+
+static void
+test_setting_ip4_gateway(void)
+{
+    NMConnection *     conn;
+    NMSettingIPConfig *s_ip4;
+    NMIPAddress *      addr;
+    GVariant *         conn_dict, *ip4_dict, *value;
+    GVariantIter       iter;
+    GVariant *         addr_var;
+    guint32            addr_vals_0[] = {htonl(0xc0a8010a), 0x00000018, htonl(0x00000000)};
+    guint32            addr_vals_1[] = {htonl(0xc0a8010b), 0x00000018, htonl(0xc0a80101)};
+    GVariantBuilder    addrs_builder;
+    GError *           error = NULL;
+
+    nmtst_assert_ip4_address(addr_vals_0[0], "192.168.1.10");
+
+    /* When serializing on the daemon side, ipv4.gateway is copied to the first
+     * entry of ipv4.addresses
+     */
+    conn  = nmtst_create_minimal_connection("test_setting_ip4_gateway",
+                                           NULL,
+                                           NM_SETTING_WIRED_SETTING_NAME,
+                                           NULL);
+    s_ip4 = (NMSettingIPConfig *) nm_setting_ip4_config_new();
+    g_object_set(s_ip4,
+                 NM_SETTING_IP_CONFIG_METHOD,
+                 NM_SETTING_IP4_CONFIG_METHOD_MANUAL,
+                 NM_SETTING_IP_CONFIG_GATEWAY,
+                 "192.168.1.1",
+                 NULL);
+    nm_connection_add_setting(conn, NM_SETTING(s_ip4));
+
+    addr = nm_ip_address_new(AF_INET, "192.168.1.10", 24, &error);
+    g_assert_no_error(error);
+    nm_setting_ip_config_add_address(s_ip4, addr);
+    nm_ip_address_unref(addr);
+
+    _nm_utils_is_manager_process = TRUE;
+    conn_dict                    = nm_connection_to_dbus(conn, NM_CONNECTION_SERIALIZE_ALL);
+    _nm_utils_is_manager_process = FALSE;
+    g_object_unref(conn);
+
+    ip4_dict = g_variant_lookup_value(conn_dict,
+                                      NM_SETTING_IP4_CONFIG_SETTING_NAME,
+                                      NM_VARIANT_TYPE_SETTING);
+    g_assert(ip4_dict != NULL);
+
+    value = g_variant_lookup_value(ip4_dict, NM_SETTING_IP_CONFIG_GATEWAY, G_VARIANT_TYPE_STRING);
+    g_assert(value != NULL);
+    g_assert_cmpstr(g_variant_get_string(value, NULL), ==, "192.168.1.1");
+    g_variant_unref(value);
+
+    value = g_variant_lookup_value(ip4_dict, NM_SETTING_IP_CONFIG_ADDRESSES, G_VARIANT_TYPE("aau"));
+    g_assert(value != NULL);
+
+    g_variant_iter_init(&iter, value);
+    while (g_variant_iter_next(&iter, "@au", &addr_var)) {
+        const guint32 *addr_array;
+        gsize          length;
+
+        addr_array = g_variant_get_fixed_array(addr_var, &length, sizeof(guint32));
+        g_assert_cmpint(length, ==, 3);
+        nmtst_assert_ip4_address(addr_array[2], "192.168.1.1");
+        g_variant_unref(addr_var);
+    }
+    g_variant_unref(value);
+
+    g_variant_unref(ip4_dict);
+
+    /* When deserializing an old-style connection, the first non-0 gateway in
+     * ipv4.addresses is copied to :gateway.
+     */
+    NMTST_VARIANT_EDITOR(
+        conn_dict,
+        NMTST_VARIANT_DROP_PROPERTY(NM_SETTING_IP4_CONFIG_SETTING_NAME,
+                                    NM_SETTING_IP_CONFIG_GATEWAY);
+        NMTST_VARIANT_DROP_PROPERTY(NM_SETTING_IP4_CONFIG_SETTING_NAME, "address-data"););
+
+    conn = _connection_new_from_dbus(conn_dict, &error);
+    g_assert_no_error(error);
+
+    s_ip4 = (NMSettingIPConfig *) nm_connection_get_setting_ip4_config(conn);
+    g_assert_cmpstr(nm_setting_ip_config_get_gateway(s_ip4), ==, "192.168.1.1");
+
+    g_object_unref(conn);
+
+    /* Try again with the gateway in the second address. */
+    g_variant_builder_init(&addrs_builder, G_VARIANT_TYPE("aau"));
+    g_variant_builder_add(&addrs_builder,
+                          "@au",
+                          g_variant_new_fixed_array(G_VARIANT_TYPE_UINT32, addr_vals_0, 3, 4));
+    g_variant_builder_add(&addrs_builder,
+                          "@au",
+                          g_variant_new_fixed_array(G_VARIANT_TYPE_UINT32, addr_vals_1, 3, 4));
+
+    NMTST_VARIANT_EDITOR(conn_dict,
+                         NMTST_VARIANT_CHANGE_PROPERTY(NM_SETTING_IP4_CONFIG_SETTING_NAME,
+                                                       "addresses",
+                                                       "aau",
+                                                       &addrs_builder););
+
+    conn = _connection_new_from_dbus(conn_dict, &error);
+    g_assert_no_error(error);
+    g_variant_unref(conn_dict);
+
+    s_ip4 = (NMSettingIPConfig *) nm_connection_get_setting_ip4_config(conn);
+    g_assert_cmpstr(nm_setting_ip_config_get_gateway(s_ip4), ==, "192.168.1.1");
+
+    g_object_unref(conn);
+}
+
+static void
+test_setting_ip6_gateway(void)
+{
+    NMConnection *     conn;
+    NMSettingIPConfig *s_ip6;
+    NMIPAddress *      addr;
+    GVariant *         conn_dict, *ip6_dict, *value;
+    GVariantIter       iter;
+    GVariant *         gateway_var;
+    GVariantBuilder    addrs_builder;
+    guint8             addr_bytes_0[]    = {0xab,
+                             0xcd,
+                             0x00,
+                             0x00,
+                             0x00,
+                             0x00,
+                             0x00,
+                             0x00,
+                             0x00,
+                             0x00,
+                             0x00,
+                             0x00,
+                             0x00,
+                             0x00,
+                             0x00,
+                             0x0a};
+    guint8             addr_bytes_1[]    = {0xab,
+                             0xcd,
+                             0x00,
+                             0x00,
+                             0x00,
+                             0x00,
+                             0x00,
+                             0x00,
+                             0x00,
+                             0x00,
+                             0x00,
+                             0x00,
+                             0x00,
+                             0x00,
+                             0x00,
+                             0x0b};
+    guint8             gateway_bytes_1[] = {0xab,
+                                0xcd,
+                                0x00,
+                                0x00,
+                                0x00,
+                                0x00,
+                                0x00,
+                                0x00,
+                                0x00,
+                                0x00,
+                                0x00,
+                                0x00,
+                                0x00,
+                                0x00,
+                                0x00,
+                                0x01};
+    GError *           error             = NULL;
+
+    /* When serializing on the daemon side, ipv6.gateway is copied to the first
+     * entry of ipv6.addresses
+     */
+    conn  = nmtst_create_minimal_connection("test_setting_ip6_gateway",
+                                           NULL,
+                                           NM_SETTING_WIRED_SETTING_NAME,
+                                           NULL);
+    s_ip6 = (NMSettingIPConfig *) nm_setting_ip6_config_new();
+    g_object_set(s_ip6,
+                 NM_SETTING_IP_CONFIG_METHOD,
+                 NM_SETTING_IP6_CONFIG_METHOD_MANUAL,
+                 NM_SETTING_IP_CONFIG_GATEWAY,
+                 "abcd::1",
+                 NULL);
+    nm_connection_add_setting(conn, NM_SETTING(s_ip6));
+
+    addr = nm_ip_address_new(AF_INET6, "abcd::10", 64, &error);
+    g_assert_no_error(error);
+    nm_setting_ip_config_add_address(s_ip6, addr);
+    nm_ip_address_unref(addr);
+
+    _nm_utils_is_manager_process = TRUE;
+    conn_dict                    = nm_connection_to_dbus(conn, NM_CONNECTION_SERIALIZE_ALL);
+    _nm_utils_is_manager_process = FALSE;
+    g_object_unref(conn);
+
+    ip6_dict = g_variant_lookup_value(conn_dict,
+                                      NM_SETTING_IP6_CONFIG_SETTING_NAME,
+                                      NM_VARIANT_TYPE_SETTING);
+    g_assert(ip6_dict != NULL);
+
+    value = g_variant_lookup_value(ip6_dict, NM_SETTING_IP_CONFIG_GATEWAY, G_VARIANT_TYPE_STRING);
+    g_assert(value != NULL);
+    g_assert_cmpstr(g_variant_get_string(value, NULL), ==, "abcd::1");
+    g_variant_unref(value);
+
+    value = g_variant_lookup_value(ip6_dict,
+                                   NM_SETTING_IP_CONFIG_ADDRESSES,
+                                   G_VARIANT_TYPE("a(ayuay)"));
+    g_assert(value != NULL);
+
+    g_variant_iter_init(&iter, value);
+    while (g_variant_iter_next(&iter, "(@ayu@ay)", NULL, NULL, &gateway_var)) {
+        const guint8 *gateway_bytes;
+        gsize         length;
+
+        gateway_bytes = g_variant_get_fixed_array(gateway_var, &length, 1);
+        g_assert_cmpint(length, ==, 16);
+        nmtst_assert_ip6_address((struct in6_addr *) gateway_bytes, "abcd::1");
+        g_variant_unref(gateway_var);
+    }
+    g_variant_unref(value);
+
+    g_variant_unref(ip6_dict);
+
+    /* When deserializing an old-style connection, the first non-0 gateway in
+     * ipv6.addresses is copied to :gateway.
+     */
+    NMTST_VARIANT_EDITOR(
+        conn_dict,
+        NMTST_VARIANT_DROP_PROPERTY(NM_SETTING_IP6_CONFIG_SETTING_NAME,
+                                    NM_SETTING_IP_CONFIG_GATEWAY);
+        NMTST_VARIANT_DROP_PROPERTY(NM_SETTING_IP6_CONFIG_SETTING_NAME, "address-data"););
+
+    conn = _connection_new_from_dbus(conn_dict, &error);
+    g_assert_no_error(error);
+
+    s_ip6 = (NMSettingIPConfig *) nm_connection_get_setting_ip6_config(conn);
+    g_assert_cmpstr(nm_setting_ip_config_get_gateway(s_ip6), ==, "abcd::1");
+
+    g_object_unref(conn);
+
+    /* Try again with the gateway in the second address. */
+    g_variant_builder_init(&addrs_builder, G_VARIANT_TYPE("a(ayuay)"));
+    g_variant_builder_add(&addrs_builder,
+                          "(@ayu@ay)",
+                          g_variant_new_fixed_array(G_VARIANT_TYPE_BYTE, addr_bytes_0, 16, 1),
+                          64,
+                          g_variant_new_fixed_array(G_VARIANT_TYPE_BYTE, &in6addr_any, 16, 1));
+    g_variant_builder_add(&addrs_builder,
+                          "(@ayu@ay)",
+                          g_variant_new_fixed_array(G_VARIANT_TYPE_BYTE, addr_bytes_1, 16, 1),
+                          64,
+                          g_variant_new_fixed_array(G_VARIANT_TYPE_BYTE, gateway_bytes_1, 16, 1));
+
+    NMTST_VARIANT_EDITOR(conn_dict,
+                         NMTST_VARIANT_CHANGE_PROPERTY(NM_SETTING_IP6_CONFIG_SETTING_NAME,
+                                                       "addresses",
+                                                       "a(ayuay)",
+                                                       &addrs_builder););
+
+    conn = _connection_new_from_dbus(conn_dict, &error);
+    g_assert_no_error(error);
+    g_variant_unref(conn_dict);
+
+    s_ip6 = (NMSettingIPConfig *) nm_connection_get_setting_ip6_config(conn);
+    g_assert_cmpstr(nm_setting_ip_config_get_gateway(s_ip6), ==, "abcd::1");
+
+    g_object_unref(conn);
+}
+
+typedef struct {
+    const char * str;
+    const guint8 expected[20];
+    const guint  expected_len;
+} HexItem;
+
+static void
+test_setting_compare_default_strv(void)
+{
+    gs_unref_object NMConnection *c1 = NULL, *c2 = NULL;
+    char **                       strv;
+    NMSettingIPConfig *           s_ip2, *s_ip1;
+    gboolean                      compare;
+    GHashTable *                  out_settings = NULL;
+
+    c1 = nmtst_create_minimal_connection("test_compare_default_strv",
+                                         NULL,
+                                         NM_SETTING_WIRED_SETTING_NAME,
+                                         NULL);
+    nmtst_assert_connection_verifies_and_normalizable(c1);
+    nmtst_connection_normalize(c1);
+
+    c2 = nm_simple_connection_new_clone(c1);
+    nmtst_assert_connection_verifies_without_normalization(c2);
+
+    nmtst_assert_connection_equals(c1, FALSE, c2, FALSE);
+
+    s_ip1 = nm_connection_get_setting_ip4_config(c1);
+    s_ip2 = nm_connection_get_setting_ip4_config(c2);
+
+    nm_setting_ip_config_clear_dns_options(s_ip2, FALSE);
+    g_object_get(G_OBJECT(s_ip2), NM_SETTING_IP_CONFIG_DNS_OPTIONS, &strv, NULL);
+    g_assert(!strv);
+    nmtst_assert_connection_equals(c1, FALSE, c2, FALSE);
+
+    nm_setting_ip_config_clear_dns_options(s_ip2, TRUE);
+    g_object_get(G_OBJECT(s_ip2), NM_SETTING_IP_CONFIG_DNS_OPTIONS, &strv, NULL);
+    g_assert(strv && !strv[0]);
+    g_strfreev(strv);
+
+    compare = nm_setting_diff((NMSetting *) s_ip1,
+                              (NMSetting *) s_ip2,
+                              NM_SETTING_COMPARE_FLAG_EXACT,
+                              FALSE,
+                              &out_settings);
+    g_assert(!compare);
+    g_assert(out_settings);
+    g_assert(g_hash_table_contains(out_settings, NM_SETTING_IP_CONFIG_DNS_OPTIONS));
+    g_hash_table_unref(out_settings);
+    out_settings = NULL;
+
+    compare = nm_connection_diff(c1, c2, NM_SETTING_COMPARE_FLAG_EXACT, &out_settings);
+    g_assert(!compare);
+    g_assert(out_settings);
+    g_hash_table_unref(out_settings);
+    out_settings = NULL;
+}
+
+/*****************************************************************************/
+
+static void
+test_setting_user_data(void)
+{
+    gs_unref_object NMSettingUser *s_user = NULL;
+
+    s_user = NM_SETTING_USER(nm_setting_user_new());
+}
+
+/*****************************************************************************/
+
+typedef union {
+    struct sockaddr     sa;
+    struct sockaddr_in  in;
+    struct sockaddr_in6 in6;
+} SockAddrUnion;
+
+static void
+_sock_addr_endpoint(const char *endpoint, const char *host, gint32 port)
+{
+    nm_auto_unref_sockaddrendpoint NMSockAddrEndpoint *ep = NULL;
+    const char *                                       s_endpoint;
+    const char *                                       s_host;
+    gint32                                             s_port;
+    SockAddrUnion                                      sockaddr = {};
+
+    g_assert(endpoint);
+    g_assert((!host) == (port == -1));
+    g_assert(port >= -1 && port <= G_MAXUINT16);
+
+    ep = nm_sock_addr_endpoint_new(endpoint);
+    g_assert(ep);
+
+    s_endpoint = nm_sock_addr_endpoint_get_endpoint(ep);
+    s_host     = nm_sock_addr_endpoint_get_host(ep);
+    s_port     = nm_sock_addr_endpoint_get_port(ep);
+    g_assert_cmpstr(endpoint, ==, s_endpoint);
+    g_assert_cmpstr(host, ==, s_host);
+    g_assert_cmpint(port, ==, s_port);
+
+    g_assert(!nm_sock_addr_endpoint_get_fixed_sockaddr(ep, &sockaddr));
+
+    if (endpoint[0] != ' ') {
+        gs_free char *endpoint2 = NULL;
+
+        /* also test with a leading space */
+        endpoint2 = g_strdup_printf(" %s", endpoint);
+        _sock_addr_endpoint(endpoint2, host, port);
+    }
+
+    if (endpoint[0] && endpoint[strlen(endpoint) - 1] != ' ') {
+        gs_free char *endpoint2 = NULL;
+
+        /* also test with a trailing space */
+        endpoint2 = g_strdup_printf("%s ", endpoint);
+        _sock_addr_endpoint(endpoint2, host, port);
+    }
+}
+
+static void
+_sock_addr_endpoint_fixed(const char *endpoint, const char *host, guint16 port, guint scope_id)
+{
+    nm_auto_unref_sockaddrendpoint NMSockAddrEndpoint *ep = NULL;
+    const char *                                       s_endpoint;
+    const char *                                       s_host;
+    gint32                                             s_port;
+    int                                                addr_family;
+    NMIPAddr                                           addrbin;
+    SockAddrUnion                                      sockaddr = {};
+
+    g_assert(endpoint);
+    g_assert(host);
+    g_assert(port > 0);
+
+    if (!nm_utils_parse_inaddr_bin(AF_UNSPEC, host, &addr_family, &addrbin))
+        g_assert_not_reached();
+
+    ep = nm_sock_addr_endpoint_new(endpoint);
+    g_assert(ep);
+
+    s_endpoint = nm_sock_addr_endpoint_get_endpoint(ep);
+    s_host     = nm_sock_addr_endpoint_get_host(ep);
+    s_port     = nm_sock_addr_endpoint_get_port(ep);
+    g_assert_cmpstr(endpoint, ==, s_endpoint);
+    g_assert_cmpstr(NULL, !=, s_host);
+    g_assert_cmpint(port, ==, s_port);
+
+    if (!nm_sock_addr_endpoint_get_fixed_sockaddr(ep, &sockaddr))
+        g_assert_not_reached();
+
+    g_assert_cmpint(sockaddr.sa.sa_family, ==, addr_family);
+    if (addr_family == AF_INET) {
+        const SockAddrUnion s = {
+            .in =
+                {
+                    .sin_family = AF_INET,
+                    .sin_addr   = addrbin.addr4_struct,
+                    .sin_port   = htons(port),
+                },
+        };
+
+        g_assert_cmpint(sockaddr.in.sin_addr.s_addr, ==, addrbin.addr4);
+        g_assert_cmpint(sockaddr.in.sin_port, ==, htons(port));
+        g_assert(memcmp(&s, &sockaddr, sizeof(s.in)) == 0);
+    } else if (addr_family == AF_INET6) {
+        const SockAddrUnion s = {
+            .in6 =
+                {
+                    .sin6_family   = AF_INET6,
+                    .sin6_addr     = addrbin.addr6,
+                    .sin6_scope_id = scope_id,
+                    .sin6_port     = htons(port),
+                },
+        };
+
+        g_assert(memcmp(&sockaddr.in6.sin6_addr, &addrbin, sizeof(addrbin.addr6)) == 0);
+        g_assert_cmpint(sockaddr.in6.sin6_port, ==, htons(port));
+        g_assert_cmpint(sockaddr.in6.sin6_scope_id, ==, scope_id);
+        g_assert_cmpint(sockaddr.in6.sin6_flowinfo, ==, 0);
+        g_assert(memcmp(&s, &sockaddr, sizeof(s.in6)) == 0);
+    } else
+        g_assert_not_reached();
+}
+
+static void
+test_sock_addr_endpoint(void)
+{
+    _sock_addr_endpoint("", NULL, -1);
+    _sock_addr_endpoint(":", NULL, -1);
+    _sock_addr_endpoint("a", NULL, -1);
+    _sock_addr_endpoint("a:", NULL, -1);
+    _sock_addr_endpoint(":a", NULL, -1);
+    _sock_addr_endpoint("[]:a", NULL, -1);
+    _sock_addr_endpoint("[]a", NULL, -1);
+    _sock_addr_endpoint("[]:", NULL, -1);
+    _sock_addr_endpoint("[a]b", NULL, -1);
+    _sock_addr_endpoint("[a:b", NULL, -1);
+    _sock_addr_endpoint("[a[:b", NULL, -1);
+    _sock_addr_endpoint("a:6", "a", 6);
+    _sock_addr_endpoint("a:6", "a", 6);
+    _sock_addr_endpoint("[a]:6", "a", 6);
+    _sock_addr_endpoint("[a]:6", "a", 6);
+    _sock_addr_endpoint("[a]:655", "a", 655);
+    _sock_addr_endpoint("[ab]:][6", NULL, -1);
+    _sock_addr_endpoint("[ab]:]:[6", NULL, -1);
+    _sock_addr_endpoint("[a[]:b", NULL, -1);
+    _sock_addr_endpoint("[192.169.6.x]:6", "192.169.6.x", 6);
+    _sock_addr_endpoint("[192.169.6.x]:0", NULL, -1);
+    _sock_addr_endpoint("192.169.6.7:0", NULL, -1);
+
+    _sock_addr_endpoint_fixed("192.169.6.7:6", "192.169.6.7", 6, 0);
+    _sock_addr_endpoint_fixed("[192.169.6.7]:6", "192.169.6.7", 6, 0);
+    _sock_addr_endpoint_fixed("[a:b::]:6", "a:b::", 6, 0);
+    _sock_addr_endpoint_fixed("[a:b::%7]:6", "a:b::", 6, 7);
+    _sock_addr_endpoint_fixed("a:b::1%75:6", "a:b::1", 6, 75);
+    _sock_addr_endpoint_fixed("a:b::1%0:64", "a:b::1", 64, 0);
+}
+
+/*****************************************************************************/
+
+static void
+test_hexstr2bin(void)
+{
+    static const HexItem items[] = {
+        {"aaBBCCddDD10496a", {0xaa, 0xbb, 0xcc, 0xdd, 0xdd, 0x10, 0x49, 0x6a}, 8},
+        {"aa:bb:cc:dd:10:49:6a", {0xaa, 0xbb, 0xcc, 0xdd, 0x10, 0x49, 0x6a}, 7},
+        {"0xccddeeff", {0xcc, 0xdd, 0xee, 0xff}, 4},
+        {"1:2:66:77:80", {0x01, 0x02, 0x66, 0x77, 0x80}, 5},
+        {"e", {0x0e}, 1},
+        {"ef", {0xef}, 1},
+        {"efa"},
+        {"efad", {0xef, 0xad}, 2},
+        {"ef:a", {0xef, 0x0a}, 2},
+        {"aabb1199:"},
+        {":aabb1199"},
+        {"aabb$$dd"},
+        {"aab:ccc:ddd"},
+        {"aab::ccc:ddd"},
+    };
+    guint i;
+
+    for (i = 0; i < G_N_ELEMENTS(items); i++) {
+        gs_unref_bytes GBytes *b = NULL;
+
+        b = nm_utils_hexstr2bin(items[i].str);
+        if (items[i].expected_len)
+            g_assert(b);
+        else
+            g_assert(!b);
+        g_assert(nm_utils_gbytes_equal_mem(b, items[i].expected, items[i].expected_len));
+    }
+}
+
+/*****************************************************************************/
+
+static void
+_do_strquote(const char *str, gsize buf_len, const char *expected)
+{
+    char          canary   = (char) nmtst_get_rand_uint32();
+    gs_free char *buf_full = g_malloc(buf_len + 2);
+    char *        buf      = &buf_full[1];
+    const char *  b;
+
+    buf[-1]      = canary;
+    buf[buf_len] = canary;
+
+    if (buf_len == 0) {
+        b = nm_strquote(NULL, 0, str);
+        g_assert(b == NULL);
+        g_assert(expected == NULL);
+        b = nm_strquote(buf, 0, str);
+        g_assert(b == buf);
+    } else {
+        b = nm_strquote(buf, buf_len, str);
+        g_assert(b == buf);
+        g_assert(strlen(b) < buf_len);
+        g_assert_cmpstr(expected, ==, b);
+    }
+
+    g_assert(buf[-1] == canary);
+    g_assert(buf[buf_len] == canary);
+}
+
+static void
+test_nm_strquote(void)
+{
+    _do_strquote(NULL, 0, NULL);
+    _do_strquote("", 0, NULL);
+    _do_strquote("a", 0, NULL);
+    _do_strquote("ab", 0, NULL);
+
+    _do_strquote(NULL, 1, "");
+    _do_strquote(NULL, 2, "(");
+    _do_strquote(NULL, 3, "(n");
+    _do_strquote(NULL, 4, "(nu");
+    _do_strquote(NULL, 5, "(nul");
+    _do_strquote(NULL, 6, "(null");
+    _do_strquote(NULL, 7, "(null)");
+    _do_strquote(NULL, 8, "(null)");
+    _do_strquote(NULL, 100, "(null)");
+
+    _do_strquote("", 1, "");
+    _do_strquote("", 2, "^");
+    _do_strquote("", 3, "\"\"");
+    _do_strquote("", 4, "\"\"");
+    _do_strquote("", 5, "\"\"");
+    _do_strquote("", 100, "\"\"");
+
+    _do_strquote("a", 1, "");
+    _do_strquote("a", 2, "^");
+    _do_strquote("a", 3, "\"^");
+    _do_strquote("a", 4, "\"a\"");
+    _do_strquote("a", 5, "\"a\"");
+    _do_strquote("a", 6, "\"a\"");
+    _do_strquote("a", 100, "\"a\"");
+
+    _do_strquote("ab", 1, "");
+    _do_strquote("ab", 2, "^");
+    _do_strquote("ab", 3, "\"^");
+    _do_strquote("ab", 4, "\"a^");
+    _do_strquote("ab", 5, "\"ab\"");
+    _do_strquote("ab", 6, "\"ab\"");
+    _do_strquote("ab", 7, "\"ab\"");
+    _do_strquote("ab", 100, "\"ab\"");
+
+    _do_strquote("abc", 1, "");
+    _do_strquote("abc", 2, "^");
+    _do_strquote("abc", 3, "\"^");
+    _do_strquote("abc", 4, "\"a^");
+    _do_strquote("abc", 5, "\"ab^");
+    _do_strquote("abc", 6, "\"abc\"");
+    _do_strquote("abc", 7, "\"abc\"");
+    _do_strquote("abc", 100, "\"abc\"");
+}
+
+/*****************************************************************************/
+
+#define UUID_NS_ZERO "00000000-0000-0000-0000-000000000000"
+#define UUID_NS_DNS  "6ba7b810-9dad-11d1-80b4-00c04fd430c8"
+#define UUID_NS_URL  "6ba7b811-9dad-11d1-80b4-00c04fd430c8"
+#define UUID_NS_OID  "6ba7b812-9dad-11d1-80b4-00c04fd430c8"
+#define UUID_NS_X500 "6ba7b814-9dad-11d1-80b4-00c04fd430c8"
+
+static const NMUuid *
+_uuid(const char *str)
+{
+    static NMUuid u;
+
+    g_assert(str);
+    g_assert(nm_uuid_parse(str, &u));
+    return &u;
+}
+
+static void
+_test_uuid(int         uuid_type,
+           const char *expected_uuid,
+           const char *str,
+           gssize      slen,
+           gpointer    type_args)
+{
+    gs_free char *uuid_test = NULL;
+
+    uuid_test = nm_uuid_generate_from_string_str(str, slen, uuid_type, type_args);
+
+    g_assert(uuid_test);
+    g_assert(nm_utils_is_uuid(uuid_test));
+
+    if (!nm_streq(uuid_test, expected_uuid)) {
+        g_error("UUID test failed: type=%d; text=%s, len=%lld, ns=%s, uuid=%s, expected=%s",
+                uuid_type,
+                str,
+                (long long) slen,
+                NM_IN_SET(uuid_type, NM_UUID_TYPE_VERSION3, NM_UUID_TYPE_VERSION5)
+                    ? (((const char *) type_args) ?: "(all-zero)")
+                    : (type_args ? "(unknown)" : "(null)"),
+                uuid_test,
+                expected_uuid);
+    }
+
+    if (slen < 0) {
+        /* also test that passing slen==-1 yields the same result as passing strlen(str). */
+        _test_uuid(uuid_type, expected_uuid, str, strlen(str), type_args);
+    } else if (str && slen == 0) {
+        /* also test if we accept NULL for slen==0 */
+        _test_uuid(uuid_type, expected_uuid, NULL, 0, type_args);
+    }
+
+    if (NM_IN_SET(uuid_type, NM_UUID_TYPE_VERSION3, NM_UUID_TYPE_VERSION5) && !type_args) {
+        /* For version3 and version5, a missing @type_args is equal to UUID_NS_ZERO */
+        _test_uuid(uuid_type, expected_uuid, str, slen, UUID_NS_ZERO);
+    }
+}
+
+typedef struct {
+    const char *uuid3;
+    const char *uuid5;
+} ExpectedUuids;
+
+static void
+test_nm_utils_uuid_generate_from_string(void)
+{
+    const ExpectedUuids zero_uuids[] = {
+        {
+            .uuid3 = "19826852-5007-3022-a72a-212f66e9fac3",
+            .uuid5 = "b6c54489-38a0-5f50-a60a-fd8d76219cae",
+        },
+        {
+            .uuid3 = "9153af2e-fc8e-34f3-9e8b-81f73b33d0cb",
+            .uuid5 = "11116e73-1c03-5de6-9130-5f9925ae8ab4",
+        },
+        {
+            .uuid3 = "2f06a3ae-d78d-30d7-b898-088a0e0b76f6",
+            .uuid5 = "1087ebe8-1ef8-5d97-8873-735b4949004d",
+        },
+        {
+            .uuid3 = "aca948e0-1468-3a51-9f2e-c688a484efd7",
+            .uuid5 = "7e57d004-2b97-5e7a-b45f-5387367791cd",
+        },
+        {
+            .uuid3 = "b74e537a-53e8-3808-9abd-58546a6542bd",
+            .uuid5 = "1dd80df1-492c-5dc5-aec2-6bf0e104f923",
+        },
+        {
+            .uuid3 = "1b00958a-7d76-3d08-8aba-c66c5828658c",
+            .uuid5 = "f797f61e-a392-5acf-af25-b46057f1c8e8",
+        },
+        {
+            .uuid3 = "7ba18f7d-c9cf-3b48-a89e-ad79243135cc",
+            .uuid5 = "e02c9780-2fc5-5d57-b92f-4cc3a64bff16",
+        },
+        {
+            .uuid3 = "9baf0978-1a60-35c5-9e9b-bec8d259fd4e",
+            .uuid5 = "94167980-f909-527e-a4af-bc3155f586d3",
+        },
+        {
+            .uuid3 = "588668c0-7631-39c7-9976-c7d414adf7ba",
+            .uuid5 = "9e3eefda-b56e-56bd-8a3a-0b8009d4a536",
+        },
+        {
+            .uuid3 = "8edb3613-9612-3b32-9dd7-0a01aa8ed453",
+            .uuid5 = "9b75648e-d38c-54e8-adee-1fb295a079c9",
+        },
+        {
+            .uuid3 = "f3b34394-63a5-3773-9014-1f8a50d765b8",
+            .uuid5 = "dd56b598-9e74-58c3-b3e8-2c623780b8ed",
+        },
+        {
+            .uuid3 = "0572965f-05b8-342b-b225-d5c29d449eee",
+            .uuid5 = "5666449a-fb7e-55b7-ae9f-0552e6513a10",
+        },
+        {
+            .uuid3 = "6f7177c3-77b0-3f42-82a8-7031e25fcccf",
+            .uuid5 = "10b38db9-82fc-528e-9ddb-1f09b7dbf907",
+        },
+        {
+            .uuid3 = "d1e0f845-bc1b-368c-b8c8-49ab0b9e486b",
+            .uuid5 = "85492596-9468-5845-9c7f-d4ae999cb751",
+        },
+        {
+            .uuid3 = "46371ea3-c8a3-34d8-b2cf-2fa90bda4378",
+            .uuid5 = "22b1c0dd-aa5d-54a4-8768-5adfd0d112bd",
+        },
+        {
+            .uuid3 = "f1e6b499-9b68-343b-a5c5-ece7acc49a68",
+            .uuid5 = "9cc429f8-200e-52a3-9e3b-ef134afa1e29",
+        },
+        {
+            .uuid3 = "9ed06458-c712-31dd-aba5-6cf79879fabe",
+            .uuid5 = "3949f95c-5d76-5ee2-af60-8e2d8fcf649d",
+        },
+        {
+            .uuid3 = "4ddd5cd7-bc83-36aa-909c-4e660f57c830",
+            .uuid5 = "0e994a02-069b-58fb-b3a4-d7dc94e90fca",
+        },
+        {
+            .uuid3 = "335fa537-0909-395d-a696-6f41827dcbeb",
+            .uuid5 = "17db3a41-de9b-5c6b-904d-833943209b3c",
+        },
+        {
+            .uuid3 = "dbd58444-05ad-3edd-adc7-4393ecbcb43c",
+            .uuid5 = "1bd906f2-05f9-5ab5-a39a-4c17a188f886",
+        },
+        {
+            .uuid3 = "a1c62d82-d13c-361b-8f4e-ca91bc2f7fc5",
+            .uuid5 = "ce6550fd-95b7-57e4-9aa7-461522666be4",
+        },
+        {
+            .uuid3 = "e943d83e-3f82-307f-81ed-b7a7bcd0743e",
+            .uuid5 = "04aa09ee-b420-57ac-8a23-5d99907fb0a1",
+        },
+        {
+            .uuid3 = "cabf46dd-9f09-375c-8f6e-f2a8cf114709",
+            .uuid5 = "8ece2c62-0c31-5c55-b7c6-155381e3780e",
+        },
+        {
+            .uuid3 = "19beddf3-f2fb-340f-96ac-4f394960b7a7",
+            .uuid5 = "5762a9f9-9a21-59ab-b0d2-2cb90027ef7f",
+        },
+        {
+            .uuid3 = "08d835c2-f4ca-394c-ba7f-2494d8b60c6c",
+            .uuid5 = "23c8409d-4b5f-5b6a-b946-41e49bad6c78",
+        },
+        {
+            .uuid3 = "3b8c6847-5331-35bf-9cd9-ced50e53cd7c",
+            .uuid5 = "e8e396be-95d5-5569-8edc-e0b64c2b7613",
+        },
+        {
+            .uuid3 = "e601f160-484b-3254-8f3b-0a25c7203d8a",
+            .uuid5 = "bc8b3cbc-ad5b-5808-a1b0-e0f7a1ad68a3",
+        },
+        {
+            .uuid3 = "e5e492ed-5349-379d-b7de-a370a51e44a3",
+            .uuid5 = "62c5ed3f-9afa-59ad-874f-a9dd8afc69d4",
+        },
+        {
+            .uuid3 = "c40111f6-fe97-305e-bfce-7db730c3d2ec",
+            .uuid5 = "66877a72-7243-59ed-b9e3-b5023b6da9c2",
+        },
+        {
+            .uuid3 = "21e18ea8-95c2-362b-9ca9-25d6a0ff2dff",
+            .uuid5 = "49a49eee-7e86-5d66-837a-8a8810cb5562",
+        },
+        {
+            .uuid3 = "adab623b-1343-307f-80d8-58d005376ad9",
+            .uuid5 = "e4a2a7ed-3bf3-53cf-a2bb-154dbb39a38c",
+        },
+        {
+            .uuid3 = "67e9fc7c-dafe-356d-ac1a-a63ce3f44813",
+            .uuid5 = "50cacfc9-f5d2-52dd-897c-a25a0927b816",
+        },
+        {
+            .uuid3 = "36cc7f20-126c-3e40-94e7-737ac7486547",
+            .uuid5 = "ca629991-3f2b-5e86-9bb7-37a335f7d809",
+        },
+        {
+            .uuid3 = "fe282996-ac5e-3d13-b478-5def30007a8e",
+            .uuid5 = "c1adf8a7-f72a-58ae-82d5-d18807f12e2e",
+        },
+        {
+            .uuid3 = "3bfe339c-05ae-3233-a1a5-ebf1ead589db",
+            .uuid5 = "6120c3cd-24e1-5ce4-987b-f8bfee2e4633",
+        },
+        {
+            .uuid3 = "d1d90bc7-da4a-3cd7-a7c8-a1a89765d8ee",
+            .uuid5 = "433d6a26-c319-5fcf-9a30-5ec6ad59d109",
+        },
+        {
+            .uuid3 = "10b88a02-0102-359b-81e9-7e3b0ff7d25e",
+            .uuid5 = "77d228d9-1b96-59e2-a07e-a8fdd4f62884",
+        },
+        {
+            .uuid3 = "7da5e4f2-6df0-3aca-a1b0-b7f8b1340e1d",
+            .uuid5 = "698259bf-a32b-5e00-9ec6-88b12278c4ad",
+        },
+        {
+            .uuid3 = "cbe24d98-ca20-3058-86b6-24a6b36ceff0",
+            .uuid5 = "60dbca63-704f-5666-9f64-f4e1a630c4aa",
+        },
+        {
+            .uuid3 = "04d84e6a-b793-3993-afbf-bae7cfc42b49",
+            .uuid5 = "79d63ec0-a39d-557d-8299-f4c97acfadc3",
+        },
+        {
+            .uuid3 = "fdd157d8-a537-350a-9cc9-1930e8666c63",
+            .uuid5 = "7df7f75e-a146-5a76-828b-bac052db312b",
+        },
+        {
+            .uuid3 = "0bea36bb-24a7-3ee6-a98d-116433c14cd4",
+            .uuid5 = "2bcca2e9-2879-53e3-b09d-cbbfd58771b2",
+        },
+        {
+            .uuid3 = "52b040a4-1b84-32d2-b758-f82386f7e0f0",
+            .uuid5 = "cb7bdca3-e9f7-50cd-b72e-73cb9ff24f62",
+        },
+        {
+            .uuid3 = "0f0a4e26-e034-3021-acf2-4e886af43092",
+            .uuid5 = "8e428e2b-5da3-5368-b760-5ca07ccbd819",
+        },
+        {
+            .uuid3 = "819d3cd1-afe5-3e4a-9f0c-945e25d09879",
+            .uuid5 = "f340ef4d-139c-567a-b0fc-7c495336674e",
+        },
+        {
+            .uuid3 = "e7df1a3b-c9f8-3e5a-88d6-ba72b2a0f27b",
+            .uuid5 = "7e3f5fd2-3c93-58d6-9f35-6e0192445b11",
+        },
+        {
+            .uuid3 = "0854bedf-74ba-3f2b-b823-dc2c90d27c76",
+            .uuid5 = "bc112b6b-c5de-5ee9-b816-808792743a20",
+        },
+        {
+            .uuid3 = "a1b8c3ba-f821-32ef-a3fd-b97b3855efa8",
+            .uuid5 = "47f8f82d-9fcd-553c-90c5-3f3cb3ad00ad",
+        },
+        {
+            .uuid3 = "9458f819-079b-3033-9430-ba10f576c067",
+            .uuid5 = "bee5c091-5f01-51fa-86bb-e9488fd3b4da",
+        },
+        {
+            .uuid3 = "8e1f240a-e386-3e00-866a-6f9da1e3503f",
+            .uuid5 = "8ea92cea-d741-566f-a44a-d51e65b4c5e4",
+        },
+    };
+    const ExpectedUuids dns_uuids[] = {
+        {
+            .uuid3 = "4385125b-dd1e-3025-880f-3311517cc8d5",
+            .uuid5 = "6af613b6-569c-5c22-9c37-2ed93f31d3af",
+        },
+        {
+            .uuid3 = "afd0b036-625a-3aa8-b639-9dc8c8fff0ff",
+            .uuid5 = "b04965e6-a9bb-591f-8f8a-1adcb2c8dc39",
+        },
+        {
+            .uuid3 = "9c45c2f1-1761-3daa-ad31-1ff8703ae846",
+            .uuid5 = "4b166dbe-d99d-5091-abdd-95b83330ed3a",
+        },
+        {
+            .uuid3 = "15e0ba07-10e4-3d7f-aaff-c00fed873c88",
+            .uuid5 = "98123fde-012f-5ff3-8b50-881449dac91a",
+        },
+        {
+            .uuid3 = "bc27b4db-bc0f-34f9-ae8e-4b72f2d51b60",
+            .uuid5 = "6ed955c6-506a-5343-9be4-2c0afae02eef",
+        },
+        {
+            .uuid3 = "7586bfed-b8b8-3bb3-9c95-09a4a79dc0f7",
+            .uuid5 = "c8691da2-158a-5ed6-8537-0e6f140801f2",
+        },
+        {
+            .uuid3 = "881430b6-8d28-3175-b87d-e81f2f5978c6",
+            .uuid5 = "a6c4fc8f-6950-51de-a9ae-2c519c465071",
+        },
+        {
+            .uuid3 = "24075675-98ae-354e-89ca-0126a9ad36e3",
+            .uuid5 = "a9f96b98-dd44-5216-ab0d-dbfc6b262edf",
+        },
+        {
+            .uuid3 = "2c269ea4-dbfd-32dd-9bd7-a5c22677d18b",
+            .uuid5 = "e99caacd-6c45-5906-bd9f-b79e62f25963",
+        },
+        {
+            .uuid3 = "44eb0948-118f-3f28-87e4-f61c8f889aba",
+            .uuid5 = "e4d80b30-151e-51b5-9f4f-18a3b82718e6",
+        },
+        {
+            .uuid3 = "fc72beeb-f790-36ee-a73d-33888c9d8880",
+            .uuid5 = "0159d6c7-973f-5e7a-a9a0-d195d0ea6fe2",
+        },
+        {
+            .uuid3 = "1e46afa2-6176-3cd3-9750-3015846723df",
+            .uuid5 = "7fef88f7-411d-5669-b42d-bf5fc7f9b58b",
+        },
+        {
+            .uuid3 = "0042b01d-95bd-343f-bd9f-3186bfd63508",
+            .uuid5 = "52524d6e-10dc-5261-aa36-8b2efcbaa5f0",
+        },
+        {
+            .uuid3 = "115ff52f-d605-3b4b-98fe-c0ea57f4930c",
+            .uuid5 = "91c274f2-9a0d-5ce6-ac3d-7529f452df21",
+        },
+        {
+            .uuid3 = "ed0221e8-ac7d-393b-821d-25183567885b",
+            .uuid5 = "0ff1e264-520d-543a-87dd-181a491e667e",
+        },
+        {
+            .uuid3 = "508ef333-85a6-314c-bcf3-17ddc32b2216",
+            .uuid5 = "23986425-d3a5-5e13-8bab-299745777a8d",
+        },
+        {
+            .uuid3 = "a4715ee0-524a-37cc-beb2-a0b5030757b7",
+            .uuid5 = "c15b38c9-9a3e-543c-a703-dd742f25b4d5",
+        },
+        {
+            .uuid3 = "d1c72756-aaec-3470-a2f2-97415f44d72f",
+            .uuid5 = "db680066-c83d-5ed7-89a4-1d79466ea62d",
+        },
+        {
+            .uuid3 = "7aec2f01-586e-3d53-b8f3-6cf7e6b649a4",
+            .uuid5 = "cadb7952-2bba-5609-88d4-8e47ec4e7920",
+        },
+        {
+            .uuid3 = "3d234b88-8d6f-319a-91ea-edb6059fc825",
+            .uuid5 = "35140057-a2a4-5adb-a500-46f8ed8b66a9",
+        },
+        {
+            .uuid3 = "d2568554-93ec-30c7-9e15-f383be19e5bb",
+            .uuid5 = "66e549b7-01e2-5d07-98d5-430f74d8d3b2",
+        },
+        {
+            .uuid3 = "800e59a7-dd0f-3114-8e58-ab7e213895ca",
+            .uuid5 = "292c8e99-2378-55aa-83d8-350e0ac3f1cc",
+        },
+        {
+            .uuid3 = "3b7d03f0-e067-3d72-84f4-e410ac36ef57",
+            .uuid5 = "0e3b230a-0509-55d8-96a0-9875f387a2be",
+        },
+        {
+            .uuid3 = "8762be68-de95-391a-94a0-c5fd0446e037",
+            .uuid5 = "4c507660-a83b-55c0-9b2b-83eccb07723d",
+        },
+        {
+            .uuid3 = "2bd8b4c9-01af-3cd0-aced-94ee6e2004b8",
+            .uuid5 = "a1b9b633-da11-58be-b1a9-5cfa2848f186",
+        },
+        {
+            .uuid3 = "a627d6a4-394a-33f5-b68e-22bfb6488d01",
+            .uuid5 = "c2708a8b-120a-56f5-a30d-990048af87cc",
+        },
+        {
+            .uuid3 = "6a592510-17d9-3925-b321-4a8d4927f8d0",
+            .uuid5 = "e7263999-68b6-5a23-b530-af25b7efd632",
+        },
+        {
+            .uuid3 = "9ee72491-59c4-333c-bb93-fe733a842fdb",
+            .uuid5 = "ce1ae2d5-3454-5952-97ff-36ff935bcfe9",
+        },
+        {
+            .uuid3 = "2591c62c-0a9d-3c28-97bc-fa0401556a3c",
+            .uuid5 = "33677b87-bc8d-5ff6-9a25-fe60225e4bf0",
+        },
+        {
+            .uuid3 = "7912be1e-4562-373b-92e2-3d6d2123bc8e",
+            .uuid5 = "ed2305ae-e8f9-5387-b860-3d80ae6c02f7",
+        },
+        {
+            .uuid3 = "09370cda-89a4-3a48-b592-9c0486e0d5e4",
+            .uuid5 = "604ed872-ae2d-5d91-8e3e-572f3a3aaaa5",
+        },
+        {
+            .uuid3 = "de5980d3-a137-373c-850b-ca3e5f100779",
+            .uuid5 = "8f8173d9-2f8d-5636-a693-24d9f79ba651",
+        },
+        {
+            .uuid3 = "9441501d-f633-365a-8955-9df443edc762",
+            .uuid5 = "36eb8d4d-b854-51f1-9fdf-3735964225d5",
+        },
+        {
+            .uuid3 = "434ada18-13ce-3c08-8b40-a1a1ae030569",
+            .uuid5 = "3493b6ca-f84b-56a9-97cc-c0bd1c46c4c0",
+        },
+        {
+            .uuid3 = "a13b6160-bd23-3710-a150-41d800dd30b4",
+            .uuid5 = "f413ea13-fcd9-5b44-9d22-1fa1f7b063a5",
+        },
+        {
+            .uuid3 = "73a67c12-c5f0-3288-ad6a-c78aea0917b0",
+            .uuid5 = "f468d924-d23b-56c2-b90f-3d1cf4b45337",
+        },
+        {
+            .uuid3 = "a126ee4f-a222-357d-b71b-7d3f226c559f",
+            .uuid5 = "8828c9d6-ed76-5c09-bf64-ba9e9cd90896",
+        },
+        {
+            .uuid3 = "48f4f36b-b015-3137-9b6e-351bb175c7f7",
+            .uuid5 = "facb7618-55ca-5c30-9cba-fd567b6c0611",
+        },
+        {
+            .uuid3 = "3fe8f6a3-fe4a-3487-89d6-dd06c6ad02e3",
+            .uuid5 = "96f3de0e-6412-5434-b406-67ef3352ab85",
+        },
+        {
+            .uuid3 = "d68fa2d4-adc9-3b20-ac77-42585cd1d59f",
+            .uuid5 = "9ebacb89-40ab-52b3-93a2-9054611d8f55",
+        },
+        {
+            .uuid3 = "819f86a3-31d5-3e72-a83e-142c3a3e4832",
+            .uuid5 = "681046ff-9129-5ade-b11c-769864e02184",
+        },
+        {
+            .uuid3 = "9957b433-ddc8-3113-a3e6-5512cf13dab1",
+            .uuid5 = "c13d0b5d-1ca3-57b6-a23f-8586bca44928",
+        },
+        {
+            .uuid3 = "5aab6e0c-b7d3-379c-92e3-2bfbb5572511",
+            .uuid5 = "7c411b5e-9d3f-50b5-9c28-62096e41c4ed",
+        },
+        {
+            .uuid3 = "11c8ff30-3a7d-3547-80a7-d61b8abeeda8",
+            .uuid5 = "f825aafe-6696-5121-b263-6b2c408b7f43",
+        },
+        {
+            .uuid3 = "98799b9f-1c5e-30b3-930f-e412b862cbe4",
+            .uuid5 = "f2b4caea-61c3-5bed-8ce7-d8b9d16e129e",
+        },
+        {
+            .uuid3 = "9bdf2544-31d8-3555-94b0-6a749118a996",
+            .uuid5 = "3593855a-6557-5736-8cab-172c6987f949",
+        },
+        {
+            .uuid3 = "ddcfb9b3-e990-3985-9021-546a2711e7e5",
+            .uuid5 = "36392431-d554-5385-b876-7bc6e1cb26b3",
+        },
+        {
+            .uuid3 = "190d7a78-1484-3136-80a6-40f28852785c",
+            .uuid5 = "7e645493-0898-5501-8155-e8578b4f5224",
+        },
+        {
+            .uuid3 = "6ed693e4-7dc0-3210-856b-a6eb4cc73e13",
+            .uuid5 = "14dc6a81-0491-5683-baaf-7582a61c5798",
+        },
+        {
+            .uuid3 = "b6a14b21-e73a-3ce2-9076-a804c434f5c6",
+            .uuid5 = "883e0a9c-e3b3-5f9c-8073-2913cbbb99ec",
+        },
+    };
+    char  i_str[30];
+    guint i;
+
+    _test_uuid(NM_UUID_TYPE_LEGACY, "d41d8cd9-8f00-b204-e980-0998ecf8427e", "", -1, NULL);
+    _test_uuid(NM_UUID_TYPE_LEGACY, "0cc175b9-c0f1-b6a8-31c3-99e269772661", "a", -1, NULL);
+    _test_uuid(NM_UUID_TYPE_LEGACY, "098f6bcd-4621-d373-cade-4e832627b4f6", "test", -1, NULL);
+    _test_uuid(NM_UUID_TYPE_LEGACY, "70350f60-27bc-e371-3f6b-76473084309b", "a\0b", 3, NULL);
+    _test_uuid(NM_UUID_TYPE_LEGACY,
+               "59c0547b-7fe2-1c15-2cce-e328e8bf6742",
+               "/etc/NetworkManager/system-connections/em1",
+               -1,
+               NULL);
+
+    _test_uuid(NM_UUID_TYPE_VERSION3, "4ae71336-e44b-39bf-b9d2-752e234818a5", "", -1, NULL);
+    _test_uuid(NM_UUID_TYPE_VERSION3, "0531103a-d8fc-3dd4-b972-d98e4750994e", "a", -1, NULL);
+    _test_uuid(NM_UUID_TYPE_VERSION3, "96e17d7a-ac89-38cf-95e1-bf5098da34e1", "test", -1, NULL);
+    _test_uuid(NM_UUID_TYPE_VERSION3, "8156568e-4ae6-3f34-a93e-18e2c6cbbf78", "a\0b", 3, NULL);
+
+    _test_uuid(NM_UUID_TYPE_VERSION3, "c87ee674-4ddc-3efe-a74e-dfe25da5d7b3", "", -1, UUID_NS_DNS);
+    _test_uuid(NM_UUID_TYPE_VERSION3, "4c104dd0-4821-30d5-9ce3-0e7a1f8b7c0d", "a", -1, UUID_NS_DNS);
+    _test_uuid(NM_UUID_TYPE_VERSION3,
+               "45a113ac-c7f2-30b0-90a5-a399ab912716",
+               "test",
+               -1,
+               UUID_NS_DNS);
+    _test_uuid(NM_UUID_TYPE_VERSION3,
+               "002a0ada-f547-375a-bab5-896a11d1927e",
+               "a\0b",
+               3,
+               UUID_NS_DNS);
+    _test_uuid(NM_UUID_TYPE_VERSION3,
+               "9a75f5f2-195e-31a9-9d07-8c18b5d3b285",
+               "test123",
+               -1,
+               UUID_NS_DNS);
+    _test_uuid(NM_UUID_TYPE_VERSION3, "ec794efe-a384-3b11-a0b6-ec8995bc6acc", "x", -1, UUID_NS_DNS);
+
+    _test_uuid(NM_UUID_TYPE_VERSION5, "a7650b9f-f19f-5300-8a13-91160ea8de2c", "a\0b", 3, NULL);
+    _test_uuid(NM_UUID_TYPE_VERSION5, "4f3f2898-69e3-5a0d-820a-c4e87987dbce", "a", -1, UUID_NS_DNS);
+    _test_uuid(NM_UUID_TYPE_VERSION5, "05b16a01-46c6-56dd-bd6e-c6dfb4a1427a", "x", -1, UUID_NS_DNS);
+    _test_uuid(NM_UUID_TYPE_VERSION5,
+               "c9ed566a-6b79-5d3a-b2b7-96a936b48cf3",
+               "test123",
+               -1,
+               UUID_NS_DNS);
+
+    for (i = 0; i < G_N_ELEMENTS(zero_uuids); i++) {
+        nm_sprintf_buf(i_str, "%u", i),
+            _test_uuid(NM_UUID_TYPE_VERSION3, zero_uuids[i].uuid3, i_str, -1, NULL);
+        _test_uuid(NM_UUID_TYPE_VERSION5, zero_uuids[i].uuid5, i_str, -1, NULL);
+    }
+    for (i = 0; i < G_N_ELEMENTS(dns_uuids); i++) {
+        nm_sprintf_buf(i_str, "%u", i),
+            _test_uuid(NM_UUID_TYPE_VERSION3, dns_uuids[i].uuid3, i_str, -1, UUID_NS_DNS);
+        _test_uuid(NM_UUID_TYPE_VERSION5, dns_uuids[i].uuid5, i_str, -1, UUID_NS_DNS);
+    }
+
+    /* examples from cpython unit tests: */
+    _test_uuid(NM_UUID_TYPE_VERSION3,
+               "6fa459ea-ee8a-3ca4-894e-db77e160355e",
+               "python.org",
+               -1,
+               UUID_NS_DNS);
+    _test_uuid(NM_UUID_TYPE_VERSION5,
+               "886313e1-3b8a-5372-9b90-0c9aee199e5d",
+               "python.org",
+               -1,
+               UUID_NS_DNS);
+    _test_uuid(NM_UUID_TYPE_VERSION3,
+               "9fe8e8c4-aaa8-32a9-a55c-4535a88b748d",
+               "http://python.org/",
+               -1,
+               UUID_NS_URL);
+    _test_uuid(NM_UUID_TYPE_VERSION5,
+               "4c565f0d-3f5a-5890-b41b-20cf47701c5e",
+               "http://python.org/",
+               -1,
+               UUID_NS_URL);
+    _test_uuid(NM_UUID_TYPE_VERSION3,
+               "dd1a1cef-13d5-368a-ad82-eca71acd4cd1",
+               "1.3.6.1",
+               -1,
+               UUID_NS_OID);
+    _test_uuid(NM_UUID_TYPE_VERSION5,
+               "1447fa61-5277-5fef-a9b3-fbc6e44f4af3",
+               "1.3.6.1",
+               -1,
+               UUID_NS_OID);
+    _test_uuid(NM_UUID_TYPE_VERSION3,
+               "658d3002-db6b-3040-a1d1-8ddd7d189a4d",
+               "c=ca",
+               -1,
+               UUID_NS_X500);
+    _test_uuid(NM_UUID_TYPE_VERSION5,
+               "cc957dd1-a972-5349-98cd-874190002798",
+               "c=ca",
+               -1,
+               UUID_NS_X500);
+
+    _test_uuid(NM_UUID_TYPE_VERSION5,
+               "74738ff5-5367-5958-9aee-98fffdcd1876",
+               "www.example.org",
+               -1,
+               UUID_NS_DNS);
+}
+
+/*****************************************************************************/
+
+static void
+__test_uuid(const char *expected_uuid, const char *str, gssize slen, char *uuid_test)
+{
+    g_assert(uuid_test);
+    g_assert(nm_uuid_is_normalized(uuid_test));
+
+    if (strcmp(uuid_test, expected_uuid)) {
+        g_error("UUID test failed (1): text=%s, len=%lld, expected=%s, uuid_test=%s",
+                str,
+                (long long) slen,
+                expected_uuid,
+                uuid_test);
+    }
+    g_free(uuid_test);
+
+    uuid_test = nm_uuid_generate_from_string_str(str, slen, NM_UUID_TYPE_VERSION3, NM_UUID_NS1);
+
+    g_assert(uuid_test);
+    g_assert(nm_utils_is_uuid(uuid_test));
+
+    if (strcmp(uuid_test, expected_uuid)) {
+        g_error("UUID test failed (2): text=%s; len=%lld, expected=%s, uuid2=%s",
+                str,
+                (long long) slen,
+                expected_uuid,
+                uuid_test);
+    }
+    g_free(uuid_test);
+}
+
+#define _test_uuid(expected_uuid, str, strlen, ...) \
+    __test_uuid(expected_uuid, str, strlen, nm_uuid_generate_from_strings(__VA_ARGS__, NULL))
+
+static void
+test_nm_utils_uuid_generate_from_strings(void)
+{
+    const NMUuid uuid0 = {};
+
+    g_assert_cmpmem(&uuid0, sizeof(uuid0), _uuid("00000000-0000-0000-0000-000000000000"), 16);
+
+    g_assert(nm_uuid_is_null(NULL));
+    g_assert(nm_uuid_is_null(&uuid0));
+    g_assert(nm_uuid_is_null(_uuid("00000000-0000-0000-0000-000000000000")));
+    g_assert(!nm_uuid_is_null(_uuid("10000000-0000-0000-0000-000000000000")));
+
+    _test_uuid("b07c334a-399b-32de-8d50-58e4e08f98e3", "", 0, NULL);
+    _test_uuid("b8a426cb-bcb5-30a3-bd8f-6786fea72df9", "\0", 1, "");
+    _test_uuid("12a4a982-7aae-39e1-951e-41aeb1250959", "a\0", 2, "a");
+    _test_uuid("69e22c7e-f89f-3a43-b239-1cb52ed8db69", "aa\0", 3, "aa");
+    _test_uuid("59829fd3-5ad5-3d90-a7b0-4911747e4088", "\0\0", 2, "", "");
+    _test_uuid("01ad0e06-6c50-3384-8d86-ddab81421425", "a\0\0", 3, "a", "");
+    _test_uuid("e1ed8647-9ed3-3ec8-8c6d-e8204524d71d", "aa\0\0", 4, "aa", "");
+    _test_uuid("fb1c7cd6-275c-3489-9382-83b900da8af0", "\0a\0", 3, "", "a");
+    _test_uuid("5d79494e-c4ba-31a6-80a2-d6016ccd7e17", "a\0a\0", 4, "a", "a");
+    _test_uuid("fd698d86-1b60-3ebe-855f-7aada9950a8d", "aa\0a\0", 5, "aa", "a");
+    _test_uuid("8c573b48-0f01-30ba-bb94-c5f59f4fe517", "\0aa\0", 4, "", "aa");
+    _test_uuid("2bdd3d46-eb83-3c53-a41b-a724d04b5544", "a\0aa\0", 5, "a", "aa");
+    _test_uuid("13d4b780-07c1-3ba7-b449-81c4844ef039", "aa\0aa\0", 6, "aa", "aa");
+    _test_uuid("dd265bf7-c05a-3037-9939-b9629858a477", "a\0b\0", 4, "a", "b");
+}
+
+/*****************************************************************************/
+
+static void
+test_nm_utils_ascii_str_to_int64_check(const char *str,
+                                       guint       base,
+                                       gint64      min,
+                                       gint64      max,
+                                       gint64      fallback,
+                                       int         exp_errno,
+                                       gint64      exp_val)
+{
+    gint64 v;
+
+    errno = 1;
+    v     = _nm_utils_ascii_str_to_int64(str, base, min, max, fallback);
+    g_assert_cmpint(errno, ==, exp_errno);
+    g_assert_cmpint(v, ==, exp_val);
+}
+
+static void
+test_nm_utils_ascii_str_to_int64_do(const char *str,
+                                    guint       base,
+                                    gint64      min,
+                                    gint64      max,
+                                    gint64      fallback,
+                                    int         exp_errno,
+                                    gint64      exp_val)
+{
+    const char *       sign = "";
+    const char *       val;
+    static const char *whitespaces[] = {
+        "",
+        " ",
+        "\r\n\t",
+        " \r\n\t ",
+        " \r\n\t \t\r\n\t",
+        NULL,
+    };
+    static const char *nulls[] = {
+        "",
+        "0",
+        "00",
+        "0000",
+        "0000000000000000",
+        "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
+        "00000000000000000000000000000000000000",
+        "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
+        "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
+        "00000000000000000000000000000000",
+        NULL,
+    };
+    const char **ws_pre, **ws_post, **null;
+    guint        i;
+
+    if (str == NULL || exp_errno != 0) {
+        test_nm_utils_ascii_str_to_int64_check(str, base, min, max, fallback, exp_errno, exp_val);
+        return;
+    }
+
+    if (strncmp(str, "-", 1) == 0)
+        sign = "-";
+
+    val = str + strlen(sign);
+
+    for (ws_pre = whitespaces; *ws_pre; ws_pre++) {
+        for (ws_post = whitespaces; *ws_post; ws_post++) {
+            for (null = nulls; *null; null++) {
+                for (i = 0;; i++) {
+                    char *      s;
+                    const char *str_base = "";
+
+                    if (base == 16) {
+                        if (i == 1)
+                            str_base = "0x";
+                        else if (i > 1)
+                            break;
+                    } else if (base == 8) {
+                        if (i == 1)
+                            str_base = "0";
+                        else if (i > 1)
+                            break;
+                    } else if (base == 0) {
+                        if (i > 0)
+                            break;
+                        /* with base==0, a leading zero would be interpreted as octal. Only test without *null */
+                        if ((*null)[0])
+                            break;
+                    } else {
+                        if (i > 0)
+                            break;
+                    }
+
+                    s = g_strdup_printf("%s%s%s%s%s%s",
+                                        *ws_pre,
+                                        sign,
+                                        str_base,
+                                        *null,
+                                        val,
+                                        *ws_post);
+
+                    test_nm_utils_ascii_str_to_int64_check(s,
+                                                           base,
+                                                           min,
+                                                           max,
+                                                           fallback,
+                                                           exp_errno,
+                                                           exp_val);
+                    g_free(s);
+                }
+            }
+        }
+    }
+}
+
+static void
+test_nm_utils_ascii_str_to_int64(void)
+{
+    test_nm_utils_ascii_str_to_int64_do(NULL, 10, 0, 10000, -1, EINVAL, -1);
+    test_nm_utils_ascii_str_to_int64_do("", 10, 0, 10000, -1, EINVAL, -1);
+    test_nm_utils_ascii_str_to_int64_do("1x", 10, 0, 10000, -1, EINVAL, -1);
+    test_nm_utils_ascii_str_to_int64_do("4711", 10, 0, 10000, -1, 0, 4711);
+    test_nm_utils_ascii_str_to_int64_do("10000", 10, 0, 10000, -1, 0, 10000);
+    test_nm_utils_ascii_str_to_int64_do("10001", 10, 0, 10000, -1, ERANGE, -1);
+    test_nm_utils_ascii_str_to_int64_do("FF", 16, 0, 10000, -1, 0, 255);
+    test_nm_utils_ascii_str_to_int64_do("FF", 10, 0, 10000, -2, EINVAL, -2);
+    test_nm_utils_ascii_str_to_int64_do("9223372036854775807",
+                                        10,
+                                        0,
+                                        G_MAXINT64,
+                                        -2,
+                                        0,
+                                        G_MAXINT64);
+    test_nm_utils_ascii_str_to_int64_do("7FFFFFFFFFFFFFFF", 16, 0, G_MAXINT64, -2, 0, G_MAXINT64);
+    test_nm_utils_ascii_str_to_int64_do("9223372036854775808", 10, 0, G_MAXINT64, -2, ERANGE, -2);
+    test_nm_utils_ascii_str_to_int64_do("-9223372036854775808",
+                                        10,
+                                        G_MININT64,
+                                        0,
+                                        -2,
+                                        0,
+                                        G_MININT64);
+    test_nm_utils_ascii_str_to_int64_do("-9223372036854775808",
+                                        10,
+                                        G_MININT64 + 1,
+                                        0,
+                                        -2,
+                                        ERANGE,
+                                        -2);
+    test_nm_utils_ascii_str_to_int64_do("-9223372036854775809", 10, G_MININT64, 0, -2, ERANGE, -2);
+    test_nm_utils_ascii_str_to_int64_do("1.0", 10, 1, 1, -1, EINVAL, -1);
+    test_nm_utils_ascii_str_to_int64_do("1x0", 16, -10, 10, -100, EINVAL, -100);
+    test_nm_utils_ascii_str_to_int64_do("0", 16, -10, 10, -100, 0, 0);
+    test_nm_utils_ascii_str_to_int64_do("10001111", 2, -1000, 1000, -100000, 0, 0x8F);
+    test_nm_utils_ascii_str_to_int64_do("-10001111", 2, -1000, 1000, -100000, 0, -0x8F);
+    test_nm_utils_ascii_str_to_int64_do("1111111", 2, G_MININT64, G_MAXINT64, -1, 0, 0x7F);
+    test_nm_utils_ascii_str_to_int64_do("111111111111111",
+                                        2,
+                                        G_MININT64,
+                                        G_MAXINT64,
+                                        -1,
+                                        0,
+                                        0x7FFF);
+    test_nm_utils_ascii_str_to_int64_do("11111111111111111111111111111111111111111111111",
+                                        2,
+                                        G_MININT64,
+                                        G_MAXINT64,
+                                        -1,
+                                        0,
+                                        0x7FFFFFFFFFFF);
+    test_nm_utils_ascii_str_to_int64_do(
+        "111111111111111111111111111111111111111111111111111111111111111",
+        2,
+        G_MININT64,
+        G_MAXINT64,
+        -1,
+        0,
+        0x7FFFFFFFFFFFFFFF);
+    test_nm_utils_ascii_str_to_int64_do(
+        "100000000000000000000000000000000000000000000000000000000000000",
+        2,
+        G_MININT64,
+        G_MAXINT64,
+        -1,
+        0,
+        0x4000000000000000);
+    test_nm_utils_ascii_str_to_int64_do(
+        "1000000000000000000000000000000000000000000000000000000000000000",
+        2,
+        G_MININT64,
+        G_MAXINT64,
+        -1,
+        ERANGE,
+        -1);
+    test_nm_utils_ascii_str_to_int64_do(
+        "-100000000000000000000000000000000000000000000000000000000000000",
+        2,
+        G_MININT64,
+        G_MAXINT64,
+        -1,
+        0,
+        -0x4000000000000000);
+    test_nm_utils_ascii_str_to_int64_do(
+        "111111111111111111111111111111111111111111111111111111111111111",
+        2,
+        G_MININT64,
+        G_MAXINT64,
+        -1,
+        0,
+        0x7FFFFFFFFFFFFFFF);
+    test_nm_utils_ascii_str_to_int64_do(
+        "-100000000000000000000000000000000000000000000000000000000000000",
+        2,
+        G_MININT64,
+        G_MAXINT64,
+        -1,
+        0,
+        -0x4000000000000000);
+    test_nm_utils_ascii_str_to_int64_do("0x70", 10, G_MININT64, G_MAXINT64, -1, EINVAL, -1);
+    test_nm_utils_ascii_str_to_int64_do("4711", 0, G_MININT64, G_MAXINT64, -1, 0, 4711);
+    test_nm_utils_ascii_str_to_int64_do("04711", 0, G_MININT64, G_MAXINT64, -1, 0, 04711);
+    test_nm_utils_ascii_str_to_int64_do("0x4711", 0, G_MININT64, G_MAXINT64, -1, 0, 0x4711);
+    test_nm_utils_ascii_str_to_int64_do("080", 0, G_MININT64, G_MAXINT64, -1, EINVAL, -1);
+    test_nm_utils_ascii_str_to_int64_do("070", 0, G_MININT64, G_MAXINT64, -1, 0, 7 * 8);
+    test_nm_utils_ascii_str_to_int64_do("0x70", 0, G_MININT64, G_MAXINT64, -1, 0, 0x70);
+
+    g_assert_cmpint(21, ==, _nm_utils_ascii_str_to_int64("025", 0, 0, 1000, -1));
+    g_assert_cmpint(21, ==, _nm_utils_ascii_str_to_int64("0025", 0, 0, 1000, -1));
+    g_assert_cmpint(25, ==, _nm_utils_ascii_str_to_int64("025", 10, 0, 1000, -1));
+    g_assert_cmpint(25, ==, _nm_utils_ascii_str_to_int64("0025", 10, 0, 1000, -1));
+}
+
+/*****************************************************************************/
+
+static void
+test_nm_utils_strstrdictkey(void)
+{
+#define _VALUES_STATIC(_v1, _v2)                                                    \
+    {                                                                               \
+        .v1 = _v1, .v2 = _v2, .v_static = _nm_utils_strstrdictkey_static(_v1, _v2), \
+    }
+    const struct {
+        const char *          v1;
+        const char *          v2;
+        NMUtilsStrStrDictKey *v_static;
+    } * val1, *val2,
+        values[] = {
+            {NULL, NULL},
+            {"", NULL},
+            {NULL, ""},
+            {"a", NULL},
+            {NULL, "a"},
+            _VALUES_STATIC("", ""),
+            _VALUES_STATIC("a", ""),
+            _VALUES_STATIC("", "a"),
+            _VALUES_STATIC("a", "b"),
+        };
+    guint i, j;
+
+    for (i = 0; i < G_N_ELEMENTS(values); i++) {
+        gs_free NMUtilsStrStrDictKey *key1 = NULL;
+
+        val1 = &values[i];
+
+        key1 = _nm_utils_strstrdictkey_create(val1->v1, val1->v2);
+        if (val1->v_static) {
+            g_assert(_nm_utils_strstrdictkey_equal(key1, val1->v_static));
+            g_assert(_nm_utils_strstrdictkey_equal(val1->v_static, key1));
+            g_assert_cmpint(_nm_utils_strstrdictkey_hash(key1),
+                            ==,
+                            _nm_utils_strstrdictkey_hash(val1->v_static));
+        }
+
+        for (j = 0; j < G_N_ELEMENTS(values); j++) {
+            gs_free NMUtilsStrStrDictKey *key2 = NULL;
+
+            val2 = &values[j];
+            key2 = _nm_utils_strstrdictkey_create(val2->v1, val2->v2);
+            if (i != j) {
+                g_assert(!_nm_utils_strstrdictkey_equal(key1, key2));
+                g_assert(!_nm_utils_strstrdictkey_equal(key2, key1));
+            }
+        }
+    }
+}
+
+/*****************************************************************************/
+
+static guint
+_g_strv_length(gconstpointer arr)
+{
+    return arr ? g_strv_length((char **) arr) : 0;
+}
+
+static void
+test_nm_ptrarray_len(void)
+{
+#define _PTRARRAY_cmp(len, arr)                         \
+    G_STMT_START                                        \
+    {                                                   \
+        g_assert_cmpint(len, ==, NM_PTRARRAY_LEN(arr)); \
+        g_assert_cmpint(len, ==, _g_strv_length(arr));  \
+    }                                                   \
+    G_STMT_END
+#define _PTRARRAY_LEN0(T)                \
+    G_STMT_START                         \
+    {                                    \
+        T **            vnull  = NULL;   \
+        T *const *      vnull1 = NULL;   \
+        T *const *const vnull2 = NULL;   \
+        T *             v0[]   = {NULL}; \
+        T *const *      v01    = v0;     \
+        T *const *const v02    = v0;     \
+        T **const       v03    = v0;     \
+                                         \
+        _PTRARRAY_cmp(0, vnull);         \
+        _PTRARRAY_cmp(0, vnull1);        \
+        _PTRARRAY_cmp(0, vnull2);        \
+        _PTRARRAY_cmp(0, v0);            \
+        _PTRARRAY_cmp(0, v01);           \
+        _PTRARRAY_cmp(0, v02);           \
+        _PTRARRAY_cmp(0, v03);           \
+    }                                    \
+    G_STMT_END
+
+    _PTRARRAY_LEN0(char);
+    _PTRARRAY_LEN0(const char);
+    _PTRARRAY_LEN0(int);
+    _PTRARRAY_LEN0(const int);
+    _PTRARRAY_LEN0(void *);
+    _PTRARRAY_LEN0(void);
+    _PTRARRAY_LEN0(const void);
+
+#define _PTRARRAY_LENn(T)                            \
+    G_STMT_START                                     \
+    {                                                \
+        T x[5] = {0};                                \
+                                                     \
+        T *             v1[] = {&x[0], NULL};        \
+        T *const *      v11  = v1;                   \
+        T *const *const v12  = v1;                   \
+        T **const       v13  = v1;                   \
+                                                     \
+        T *             v2[] = {&x[0], &x[1], NULL}; \
+        T *const *      v21  = v2;                   \
+        T *const *const v22  = v2;                   \
+        T **const       v23  = v2;                   \
+                                                     \
+        _PTRARRAY_cmp(1, v1);                        \
+        _PTRARRAY_cmp(1, v11);                       \
+        _PTRARRAY_cmp(1, v12);                       \
+        _PTRARRAY_cmp(1, v13);                       \
+                                                     \
+        _PTRARRAY_cmp(2, v2);                        \
+        _PTRARRAY_cmp(2, v21);                       \
+        _PTRARRAY_cmp(2, v22);                       \
+        _PTRARRAY_cmp(2, v23);                       \
+    }                                                \
+    G_STMT_END
+
+    _PTRARRAY_LENn(char);
+    _PTRARRAY_LENn(const char);
+    _PTRARRAY_LENn(int);
+    _PTRARRAY_LENn(const int);
+    _PTRARRAY_LENn(void *);
+}
+
+/*****************************************************************************/
+
+static void
+test_nm_utils_dns_option_validate_do(char *                      option,
+                                     gboolean                    ipv6,
+                                     const NMUtilsDNSOptionDesc *descs,
+                                     gboolean                    exp_result,
+                                     char *                      exp_name,
+                                     gboolean                    exp_value)
+{
+    char *   name;
+    long     value = 0;
+    gboolean result;
+
+    result = _nm_utils_dns_option_validate(option, &name, &value, ipv6, descs);
+
+    g_assert(result == exp_result);
+    g_assert_cmpstr(name, ==, exp_name);
+    g_assert(value == exp_value);
+
+    g_free(name);
+}
+
+static const NMUtilsDNSOptionDesc opt_descs[] = {
+    /* name                   num      ipv6 */
+    {"opt1", FALSE, FALSE},
+    {"opt2", TRUE, FALSE},
+    {"opt3", FALSE, TRUE},
+    {"opt4", TRUE, TRUE},
+    {NULL, FALSE, FALSE}};
+
+static void
+test_nm_utils_dns_option_validate(void)
+{
+    /*                                    opt            ipv6    descs        result name       value */
+    test_nm_utils_dns_option_validate_do("", FALSE, NULL, FALSE, NULL, -1);
+    test_nm_utils_dns_option_validate_do(":", FALSE, NULL, FALSE, NULL, -1);
+    test_nm_utils_dns_option_validate_do(":1", FALSE, NULL, FALSE, NULL, -1);
+    test_nm_utils_dns_option_validate_do(":val", FALSE, NULL, FALSE, NULL, -1);
+    test_nm_utils_dns_option_validate_do("opt", FALSE, NULL, TRUE, "opt", -1);
+    test_nm_utils_dns_option_validate_do("opt:", FALSE, NULL, FALSE, NULL, -1);
+    test_nm_utils_dns_option_validate_do("opt:12", FALSE, NULL, TRUE, "opt", 12);
+    test_nm_utils_dns_option_validate_do("opt:12 ", FALSE, NULL, FALSE, NULL, -1);
+    test_nm_utils_dns_option_validate_do("opt:val", FALSE, NULL, FALSE, NULL, -1);
+    test_nm_utils_dns_option_validate_do("opt:2val", FALSE, NULL, FALSE, NULL, -1);
+    test_nm_utils_dns_option_validate_do("opt:2:3", FALSE, NULL, FALSE, NULL, -1);
+    test_nm_utils_dns_option_validate_do("opt-6", FALSE, NULL, TRUE, "opt-6", -1);
+
+    test_nm_utils_dns_option_validate_do("opt1", FALSE, opt_descs, TRUE, "opt1", -1);
+    test_nm_utils_dns_option_validate_do("opt1", TRUE, opt_descs, TRUE, "opt1", -1);
+    test_nm_utils_dns_option_validate_do("opt1:3", FALSE, opt_descs, FALSE, NULL, -1);
+
+    test_nm_utils_dns_option_validate_do("opt2", FALSE, opt_descs, FALSE, NULL, -1);
+    test_nm_utils_dns_option_validate_do("opt2:5", FALSE, opt_descs, TRUE, "opt2", 5);
+
+    test_nm_utils_dns_option_validate_do("opt3", FALSE, opt_descs, FALSE, NULL, -1);
+    test_nm_utils_dns_option_validate_do("opt3", TRUE, opt_descs, TRUE, "opt3", -1);
+
+    test_nm_utils_dns_option_validate_do("opt4", FALSE, opt_descs, FALSE, NULL, -1);
+    test_nm_utils_dns_option_validate_do("opt4", TRUE, opt_descs, FALSE, NULL, -1);
+    test_nm_utils_dns_option_validate_do("opt4:40", FALSE, opt_descs, FALSE, NULL, -1);
+    test_nm_utils_dns_option_validate_do("opt4:40", TRUE, opt_descs, TRUE, "opt4", 40);
+}
+
+static void
+test_nm_utils_dns_option_find_idx(void)
+{
+    GPtrArray *options;
+
+    options = g_ptr_array_new();
+
+    g_ptr_array_add(options, "debug");
+    g_ptr_array_add(options, "timeout:5");
+    g_ptr_array_add(options, "edns0");
+
+    g_assert_cmpint(_nm_utils_dns_option_find_idx(options, "debug"), ==, 0);
+    g_assert_cmpint(_nm_utils_dns_option_find_idx(options, "debug:1"), ==, 0);
+    g_assert_cmpint(_nm_utils_dns_option_find_idx(options, "timeout"), ==, 1);
+    g_assert_cmpint(_nm_utils_dns_option_find_idx(options, "timeout:5"), ==, 1);
+    g_assert_cmpint(_nm_utils_dns_option_find_idx(options, "timeout:2"), ==, 1);
+    g_assert_cmpint(_nm_utils_dns_option_find_idx(options, "edns0"), ==, 2);
+    g_assert_cmpint(_nm_utils_dns_option_find_idx(options, "rotate"), ==, -1);
+    g_assert_cmpint(_nm_utils_dns_option_find_idx(options, ""), ==, -1);
+
+    g_ptr_array_free(options, TRUE);
+}
+
+/*****************************************************************************/
+
+static void
+_json_config_check_valid(const char *conf, gboolean expected)
+{
+    gs_free_error GError *error = NULL;
+    gboolean              res;
+
+    res = nm_utils_is_json_object(conf, &error);
+    g_assert_cmpint(res, ==, expected);
+    g_assert(res || error);
+}
+
+static void
+test_nm_utils_check_valid_json(void)
+{
+    _json_config_check_valid(NULL, FALSE);
+    _json_config_check_valid("", FALSE);
+
+    /* Without JSON library everything except empty string is considered valid */
+    nmtst_json_vt_reset(FALSE);
+    _json_config_check_valid("{ }", TRUE);
+    _json_config_check_valid("{'%!-a1} ", TRUE);
+    _json_config_check_valid(" {'%!-a1}", TRUE);
+    _json_config_check_valid("{'%!-a1", FALSE);
+
+    if (nmtst_json_vt_reset(TRUE)) {
+        _json_config_check_valid("{ }", TRUE);
+        _json_config_check_valid("{ \"a\" : 1 }", TRUE);
+        _json_config_check_valid("{ \"a\" : }", FALSE);
+    }
+}
+
+static void
+_team_config_equal_check(const char *conf1,
+                         const char *conf2,
+                         gboolean    port_config,
+                         gboolean    expected)
+{
+    nm_auto_free_team_setting NMTeamSetting *team_a = NULL;
+    nm_auto_free_team_setting NMTeamSetting *team_b = NULL;
+    gboolean                                 is_same;
+
+    if (nmtst_get_rand_bool())
+        NM_SWAP(&conf1, &conf2);
+
+    if (!nm_streq0(conf1, conf2)) {
+        _team_config_equal_check(conf1, conf1, port_config, TRUE);
+        _team_config_equal_check(conf2, conf2, port_config, TRUE);
+    }
+
+    team_a = nm_team_setting_new(port_config, conf1);
+    team_b = nm_team_setting_new(port_config, conf2);
+
+    is_same = (nm_team_setting_cmp(team_a, team_b, TRUE) == 0);
+    g_assert_cmpint(is_same, ==, expected);
+
+    if (nm_streq0(conf1, conf2)) {
+        g_assert_cmpint(nm_team_setting_cmp(team_a, team_b, FALSE), ==, 0);
+        g_assert(expected);
+    } else
+        g_assert_cmpint(nm_team_setting_cmp(team_a, team_b, FALSE), !=, 0);
+}
+
+static void
+test_nm_utils_team_config_equal(void)
+{
+    int with_json_vt;
+
+    for (with_json_vt = 0; with_json_vt < 2; with_json_vt++) {
+        const NMJsonVt *vt;
+
+        vt = nmtst_json_vt_reset(!!with_json_vt);
+
+        _team_config_equal_check("", "", TRUE, TRUE);
+        _team_config_equal_check("", " ", TRUE, TRUE);
+        _team_config_equal_check("{}", "{ }", TRUE, TRUE);
+        _team_config_equal_check("{}", "{", TRUE, TRUE);
+        _team_config_equal_check("{ \"a\": 1 }", "{ \"a\": 1 }", TRUE, TRUE);
+        _team_config_equal_check("{ \"a\": 1 }", "{ \"a\":   1 }", TRUE, TRUE);
+
+        /* team config */
+        _team_config_equal_check("{ }", "{ \"runner\" :  { \"name\" : \"random\"} }", FALSE, !vt);
+        _team_config_equal_check("{ \"runner\" :  { \"name\" : \"roundrobin\"} }",
+                                 "{ \"runner\" :  { \"name\" : \"random\"} }",
+                                 FALSE,
+                                 !vt);
+        _team_config_equal_check("{ \"runner\" :  { \"name\" : \"random\"} }",
+                                 "{ \"runner\" :  { \"name\" : \"random\"} }",
+                                 FALSE,
+                                 TRUE);
+        _team_config_equal_check("{ \"runner\" :  { \"name\" : \"loadbalance\"} }",
+                                 "{ \"runner\" :  { \"name\" : \"loadbalance\"} }",
+                                 FALSE,
+                                 TRUE);
+        _team_config_equal_check(
+            "{ \"runner\" :  { \"name\" : \"random\"}, \"ports\" : { \"eth0\" : {} } }",
+            "{ \"runner\" :  { \"name\" : \"random\"}, \"ports\" : { \"eth1\" : {} } }",
+            FALSE,
+            TRUE);
+        _team_config_equal_check("{ \"runner\" :  { \"name\" : \"lacp\"} }",
+                                 "{ \"runner\" :  { \"name\" : \"lacp\", \"tx_hash\" : [ \"eth\", "
+                                 "\"ipv4\", \"ipv6\" ] } }",
+                                 FALSE,
+                                 !vt);
+        _team_config_equal_check("{ \"runner\" :  { \"name\" : \"roundrobin\"} }",
+                                 "{ \"runner\" :  { \"name\" : \"roundrobin\", \"tx_hash\" : [ "
+                                 "\"eth\", \"ipv4\", \"ipv6\" ] } }",
+                                 FALSE,
+                                 !vt);
+        _team_config_equal_check(
+            "{ \"runner\" :  { \"name\" : \"lacp\"} }",
+            "{ \"runner\" :  { \"name\" : \"lacp\", \"tx_hash\" : [ \"eth\" ] } }",
+            FALSE,
+            !vt);
+
+        /* team port config */
+        _team_config_equal_check("{ }",
+                                 "{ \"link_watch\" :  { \"name\" : \"ethtool\"} }",
+                                 TRUE,
+                                 !vt);
+        _team_config_equal_check("{ }",
+                                 "{ \"link_watch\" :  { \"name\" : \"arp_ping\"} }",
+                                 TRUE,
+                                 TRUE);
+        _team_config_equal_check("{ \"link_watch\" :  { \"name\" : \"ethtool\"} }",
+                                 "{ \"link_watch\" :  { \"name\" : \"arp_ping\"} }",
+                                 TRUE,
+                                 !vt);
+        _team_config_equal_check("{ \"link_watch\" :  { \"name\" : \"arp_ping\"} }",
+                                 "{ \"link_watch\" :  { \"name\" : \"arp_ping\"} }",
+                                 TRUE,
+                                 TRUE);
+        _team_config_equal_check(
+            "{ \"link_watch\" :  { \"name\" : \"arp_ping\"}, \"ports\" : { \"eth0\" : {} } }",
+            "{ \"link_watch\" :  { \"name\" : \"arp_ping\"}, \"ports\" : { \"eth1\" : {} } }",
+            TRUE,
+            TRUE);
+    }
+
+    nmtst_json_vt_reset(TRUE);
+}
+
+/*****************************************************************************/
+
+enum TEST_IS_POWER_OF_TWP_ENUM_SIGNED {
+    _DUMMY_1 = -1,
+};
+
+enum TEST_IS_POWER_OF_TWP_ENUM_UNSIGNED {
+    _DUMMY_2,
+};
+
+enum TEST_IS_POWER_OF_TWP_ENUM_SIGNED_64 {
+    _DUMMY_3 = (1LL << 40),
+};
+
+enum TEST_IS_POWER_OF_TWP_ENUM_UNSIGNED_64 {
+    _DUMMY_4a = -1,
+    _DUMMY_4b = (1LL << 40),
+};
+
+#define test_nm_utils_is_power_of_two_do(type, x, expect)                   \
+    G_STMT_START                                                            \
+    {                                                                       \
+        typeof(x) x1 = (x);                                                 \
+        type      x2 = (type) x1;                                           \
+        gboolean  val;                                                      \
+                                                                            \
+        val = nm_utils_is_power_of_two(x1);                                 \
+        g_assert_cmpint(expect, ==, val);                                   \
+        if (x1 != 0)                                                        \
+            g_assert_cmpint(val, ==, nm_utils_is_power_of_two_or_zero(x1)); \
+        else {                                                              \
+            g_assert(nm_utils_is_power_of_two_or_zero(x1));                 \
+            g_assert(!val);                                                 \
+        }                                                                   \
+        if (((typeof(x1)) x2) == x1 && ((typeof(x2)) x1) == x2 && x2 > 0) { \
+            /* x2 equals @x, and is positive. Compare to @expect */         \
+            g_assert_cmpint(expect, ==, nm_utils_is_power_of_two(x2));      \
+        } else if (!(x2 > 0)) {                                             \
+            /* a non positive value is always FALSE. */                     \
+            g_assert_cmpint(FALSE, ==, nm_utils_is_power_of_two(x2));       \
+        }                                                                   \
+        if (x2) {                                                           \
+            x2 = -x2;                                                       \
+            if (!(x2 > 0)) {                                                \
+                /* for negative values, we return FALSE. */                 \
+                g_assert_cmpint(FALSE, ==, nm_utils_is_power_of_two(x2));   \
+            }                                                               \
+        }                                                                   \
+    }                                                                       \
+    G_STMT_END
+
+static void
+test_nm_utils_is_power_of_two(void)
+{
+    guint64 xyes, xno;
+    int     i, j;
+    GRand * rand = nmtst_get_rand();
+    int     numbits;
+
+    g_assert(!nm_utils_is_power_of_two(0));
+    g_assert(nm_utils_is_power_of_two_or_zero(0));
+
+    for (i = -1; i < 64; i++) {
+        /* find a (positive) x which is a power of two. */
+        if (i == -1)
+            xyes = 0;
+        else {
+            xyes = (((guint64) 1) << i);
+            g_assert(xyes != 0);
+        }
+
+        xno = xyes;
+        if (xyes != 0) {
+again:
+            /* Find another @xno, that is not a power of two. Do that,
+             * by randomly setting bits. */
+            numbits = g_rand_int_range(rand, 1, 65);
+            while (xno != ~((guint64) 0) && numbits > 0) {
+                guint64 v = (((guint64) 1) << g_rand_int_range(rand, 0, 64));
+
+                if ((xno | v) != xno) {
+                    xno |= v;
+                    --numbits;
+                }
+            }
+            if (xno == xyes)
+                goto again;
+        }
+
+        for (j = 0; j < 2; j++) {
+            gboolean expect = j == 0;
+            guint64  x      = expect ? xyes : xno;
+
+            if (expect && xyes == 0)
+                continue;
+
+            /* check if @x is as @expect, when casted to a certain data type. */
+            test_nm_utils_is_power_of_two_do(gint8, x, expect);
+            test_nm_utils_is_power_of_two_do(guint8, x, expect);
+            test_nm_utils_is_power_of_two_do(gint16, x, expect);
+            test_nm_utils_is_power_of_two_do(guint16, x, expect);
+            test_nm_utils_is_power_of_two_do(gint32, x, expect);
+            test_nm_utils_is_power_of_two_do(guint32, x, expect);
+            test_nm_utils_is_power_of_two_do(gint64, x, expect);
+            test_nm_utils_is_power_of_two_do(guint64, x, expect);
+            test_nm_utils_is_power_of_two_do(char, x, expect);
+            test_nm_utils_is_power_of_two_do(unsigned char, x, expect);
+            test_nm_utils_is_power_of_two_do(signed char, x, expect);
+            test_nm_utils_is_power_of_two_do(enum TEST_IS_POWER_OF_TWP_ENUM_SIGNED, x, expect);
+            test_nm_utils_is_power_of_two_do(enum TEST_IS_POWER_OF_TWP_ENUM_UNSIGNED, x, expect);
+            test_nm_utils_is_power_of_two_do(enum TEST_IS_POWER_OF_TWP_ENUM_SIGNED_64, x, expect);
+            test_nm_utils_is_power_of_two_do(enum TEST_IS_POWER_OF_TWP_ENUM_UNSIGNED_64, x, expect);
+        }
+    }
+}
+
+/*****************************************************************************/
+
+static int
+_test_find_binary_search_cmp(gconstpointer a, gconstpointer b, gpointer dummy)
+{
+    int ia, ib;
+
+    ia = GPOINTER_TO_INT(a);
+    ib = GPOINTER_TO_INT(b);
+
+    if (ia == ib)
+        return 0;
+    if (ia < ib)
+        return -1;
+    return 1;
+}
+
+static void
+_test_find_binary_search_do(const int *array, gsize len)
+{
+    gsize   i;
+    gssize  idx, idx2, idx_first, idx_last;
+    gs_free gconstpointer *parray  = g_new(gconstpointer, len);
+    const int              NEEDLE  = 0;
+    gconstpointer          pneedle = GINT_TO_POINTER(NEEDLE);
+    gssize                 expected_result;
+
+    for (i = 0; i < len; i++)
+        parray[i] = GINT_TO_POINTER(array[i]);
+
+    expected_result = nm_utils_ptrarray_find_first(parray, len, pneedle);
+
+    idx = nm_utils_ptrarray_find_binary_search_range(parray,
+                                                     len,
+                                                     pneedle,
+                                                     _test_find_binary_search_cmp,
+                                                     NULL,
+                                                     &idx_first,
+                                                     &idx_last);
+
+    idx2 = nm_utils_ptrarray_find_binary_search(parray,
+                                                len,
+                                                pneedle,
+                                                _test_find_binary_search_cmp,
+                                                NULL);
+    g_assert_cmpint(idx, ==, idx2);
+
+    if (expected_result >= 0) {
+        g_assert_cmpint(expected_result, ==, idx);
+    } else {
+        idx2 = ~idx;
+
+        g_assert_cmpint(idx, <, 0);
+
+        g_assert(idx2 >= 0);
+        g_assert(idx2 <= len);
+        g_assert(idx2 - 1 < 0 || _test_find_binary_search_cmp(parray[idx2 - 1], pneedle, NULL) < 0);
+        g_assert(idx2 >= len || _test_find_binary_search_cmp(parray[idx2], pneedle, NULL) > 0);
+    }
+    g_assert_cmpint(idx, ==, idx_first);
+    g_assert_cmpint(idx, ==, idx_last);
+    for (i = 0; i < len; i++) {
+        int cmp;
+
+        cmp = _test_find_binary_search_cmp(parray[i], pneedle, NULL);
+        if (cmp == 0) {
+            g_assert(pneedle == parray[i]);
+            g_assert(idx >= 0);
+            g_assert(i == idx);
+        } else {
+            g_assert(pneedle != parray[i]);
+            if (cmp < 0) {
+                if (idx < 0)
+                    g_assert(i < ~idx);
+                else
+                    g_assert(i < idx);
+            } else {
+                if (idx < 0)
+                    g_assert(i >= ~idx);
+                else
+                    g_assert(i >= idx);
+            }
+        }
+    }
+}
+
+static void
+_test_find_binary_search_do_uint32(const int *int_array, gsize len)
+{
+    gssize    idx;
+    const int OFFSET          = 100;
+    const int NEEDLE          = 0 + OFFSET;
+    gssize    expected_result = -1;
+    guint32   array[30];
+
+    g_assert(len <= G_N_ELEMENTS(array));
+
+    /* the test data has negative values. Shift them... */
+    for (idx = 0; idx < len; idx++) {
+        int v = int_array[idx];
+
+        g_assert(v > -OFFSET);
+        g_assert(v < OFFSET);
+        g_assert(idx == 0 || v > int_array[idx - 1]);
+        array[idx] = (guint32) (int_array[idx] + OFFSET);
+        if (array[idx] == NEEDLE)
+            expected_result = idx;
+    }
+
+    idx = nm_utils_array_find_binary_search(array,
+                                            sizeof(guint32),
+                                            len,
+                                            &NEEDLE,
+                                            nm_cmp_uint32_p_with_data,
+                                            NULL);
+    if (expected_result >= 0)
+        g_assert_cmpint(expected_result, ==, idx);
+    else {
+        gssize idx2 = ~idx;
+        g_assert_cmpint(idx, <, 0);
+
+        g_assert(idx2 >= 0);
+        g_assert(idx2 <= len);
+        g_assert(idx2 - 1 < 0 || array[idx2 - 1] < NEEDLE);
+        g_assert(idx2 >= len || array[idx2] > NEEDLE);
+    }
+}
+#define test_find_binary_search_do(...)                                   \
+    G_STMT_START                                                          \
+    {                                                                     \
+        const int _array[] = {__VA_ARGS__};                               \
+        _test_find_binary_search_do(_array, G_N_ELEMENTS(_array));        \
+        _test_find_binary_search_do_uint32(_array, G_N_ELEMENTS(_array)); \
+    }                                                                     \
+    G_STMT_END
+
+static void
+test_nm_utils_ptrarray_find_binary_search(void)
+{
+    test_find_binary_search_do(0);
+    test_find_binary_search_do(-1, 0);
+    test_find_binary_search_do(-2, -1, 0);
+    test_find_binary_search_do(-3, -2, -1, 0);
+    test_find_binary_search_do(0, 1);
+    test_find_binary_search_do(0, 1, 2);
+    test_find_binary_search_do(-1, 0, 1, 2);
+    test_find_binary_search_do(-2, -1, 0, 1, 2);
+    test_find_binary_search_do(-3, -2, -1, 0, 1, 2);
+    test_find_binary_search_do(-3, -2, -1, 0, 1, 2);
+    test_find_binary_search_do(-3, -2, -1, 0, 1, 2, 3);
+    test_find_binary_search_do(-3, -2, -1, 0, 1, 2, 3, 4);
+
+    test_find_binary_search_do(-1);
+    test_find_binary_search_do(-2, -1);
+    test_find_binary_search_do(-3, -2, -1);
+    test_find_binary_search_do(1);
+    test_find_binary_search_do(1, 2);
+    test_find_binary_search_do(-1, 1, 2);
+    test_find_binary_search_do(-2, -1, 1, 2);
+    test_find_binary_search_do(-3, -2, -1, 1, 2);
+    test_find_binary_search_do(-3, -2, -1, 1, 2);
+    test_find_binary_search_do(-3, -2, -1, 1, 2, 3);
+    test_find_binary_search_do(-3, -2, -1, 1, 2, 3, 4);
+}
+
+/*****************************************************************************/
+
+#define BIN_SEARCH_W_DUPS_LEN    100
+#define BIN_SEARCH_W_DUPS_JITTER 10
+
+static int
+_test_bin_search2_cmp(gconstpointer pa, gconstpointer pb, gpointer user_data)
+{
+    int a = GPOINTER_TO_INT(pa);
+    int b = GPOINTER_TO_INT(pb);
+
+    g_assert(a >= 0 && a <= BIN_SEARCH_W_DUPS_LEN + BIN_SEARCH_W_DUPS_JITTER);
+    g_assert(b >= 0 && b <= BIN_SEARCH_W_DUPS_LEN + BIN_SEARCH_W_DUPS_JITTER);
+    NM_CMP_DIRECT(a, b);
+    return 0;
+}
+
+static int
+_test_bin_search2_cmp_p(gconstpointer pa, gconstpointer pb, gpointer user_data)
+{
+    return _test_bin_search2_cmp(*((gpointer *) pa), *((gpointer *) pb), NULL);
+}
+
+static void
+test_nm_utils_ptrarray_find_binary_search_with_duplicates(void)
+{
+    gssize        idx, idx2, idx_first2, idx_first, idx_last;
+    int           i_test, i_len, i;
+    gssize        j;
+    gconstpointer arr[BIN_SEARCH_W_DUPS_LEN];
+    const int     N_TEST = 10;
+
+    for (i_test = 0; i_test < N_TEST; i_test++) {
+        for (i_len = 0; i_len < BIN_SEARCH_W_DUPS_LEN; i_len++) {
+            /* fill with random numbers... surely there are some duplicates
+             * there... or maybe even there are none... */
+            for (i = 0; i < i_len; i++)
+                arr[i] =
+                    GINT_TO_POINTER(nmtst_get_rand_uint32() % (i_len + BIN_SEARCH_W_DUPS_JITTER));
+            g_qsort_with_data(arr, i_len, sizeof(gpointer), _test_bin_search2_cmp_p, NULL);
+            for (i = 0; i < i_len + BIN_SEARCH_W_DUPS_JITTER; i++) {
+                gconstpointer p = GINT_TO_POINTER(i);
+
+                idx = nm_utils_ptrarray_find_binary_search_range(arr,
+                                                                 i_len,
+                                                                 p,
+                                                                 _test_bin_search2_cmp,
+                                                                 NULL,
+                                                                 &idx_first,
+                                                                 &idx_last);
+
+                idx_first2 = nm_utils_ptrarray_find_first(arr, i_len, p);
+
+                idx2 = nm_utils_array_find_binary_search(arr,
+                                                         sizeof(gpointer),
+                                                         i_len,
+                                                         &p,
+                                                         _test_bin_search2_cmp_p,
+                                                         NULL);
+                g_assert_cmpint(idx, ==, idx2);
+
+                idx2 = nm_utils_ptrarray_find_binary_search(arr,
+                                                            i_len,
+                                                            p,
+                                                            _test_bin_search2_cmp,
+                                                            NULL);
+                g_assert_cmpint(idx, ==, idx2);
+
+                if (idx_first2 < 0) {
+                    g_assert_cmpint(idx, <, 0);
+                    g_assert_cmpint(idx, ==, idx_first);
+                    g_assert_cmpint(idx, ==, idx_last);
+                    idx = ~idx;
+                    g_assert_cmpint(idx, >=, 0);
+                    g_assert_cmpint(idx, <=, i_len);
+                    if (i_len == 0)
+                        g_assert_cmpint(idx, ==, 0);
+                    else {
+                        g_assert(idx == i_len || GPOINTER_TO_INT(arr[idx]) > i);
+                        g_assert(idx == 0 || GPOINTER_TO_INT(arr[idx - 1]) < i);
+                    }
+                } else {
+                    g_assert_cmpint(idx_first, ==, idx_first2);
+                    g_assert_cmpint(idx_first, >=, 0);
+                    g_assert_cmpint(idx_last, <, i_len);
+                    g_assert_cmpint(idx_first, <=, idx_last);
+                    g_assert_cmpint(idx, >=, idx_first);
+                    g_assert_cmpint(idx, <=, idx_last);
+                    for (j = idx_first; j < idx_last; j++)
+                        g_assert(GPOINTER_TO_INT(arr[j]) == i);
+                    g_assert(idx_first == 0 || GPOINTER_TO_INT(arr[idx_first - 1]) < i);
+                    g_assert(idx_last == i_len - 1 || GPOINTER_TO_INT(arr[idx_last + 1]) > i);
+                }
+            }
+        }
+    }
+}
+
+/*****************************************************************************/
+
+static void
+_test_nm_utils_enum_to_str_do_full(GType                       type,
+                                   int                         flags,
+                                   const char *                exp_str,
+                                   const NMUtilsEnumValueInfo *value_infos)
+{
+    gs_free char *str = NULL;
+    int           flags2;
+    gs_free char *err_token = NULL;
+    gboolean      result;
+
+    g_assert(exp_str);
+
+    str = _nm_utils_enum_to_str_full(type, flags, ", ", value_infos);
+    g_assert_cmpstr(str, ==, exp_str);
+
+    if (!value_infos) {
+        gs_free char *str2 = NULL;
+
+        str2 = nm_utils_enum_to_str(type, flags);
+        g_assert_cmpstr(str2, ==, exp_str);
+    }
+
+    result = _nm_utils_enum_from_str_full(type, str, &flags2, &err_token, value_infos);
+    g_assert(result == TRUE);
+    g_assert_cmpint(flags2, ==, flags);
+    g_assert_cmpstr(err_token, ==, NULL);
+}
+
+#define _test_nm_utils_enum_to_str_do(...) _test_nm_utils_enum_to_str_do_full(__VA_ARGS__, NULL)
+
+static void
+_test_nm_utils_enum_from_str_do_full(GType                       type,
+                                     const char *                str,
+                                     gboolean                    exp_result,
+                                     int                         exp_flags,
+                                     const char *                exp_err_token,
+                                     const NMUtilsEnumValueInfo *value_infos)
+{
+    int           flags;
+    gs_free char *err_token = NULL;
+    gboolean      result;
+
+    result = _nm_utils_enum_from_str_full(type, str, &flags, &err_token, value_infos);
+
+    g_assert(result == exp_result);
+    g_assert_cmpint(flags, ==, exp_flags);
+    g_assert_cmpstr(err_token, ==, exp_err_token);
+
+    if (!value_infos) {
+        int           flags2;
+        gs_free char *err_token2 = NULL;
+        gboolean      result2;
+
+        result2 = nm_utils_enum_from_str(type, str, &flags2, &err_token2);
+        g_assert(result2 == exp_result);
+        g_assert_cmpint(flags2, ==, exp_flags);
+        g_assert_cmpstr(err_token2, ==, exp_err_token);
+    }
+
+    if (result) {
+        int           flags2;
+        gs_free char *str2       = NULL;
+        gs_free char *err_token2 = NULL;
+
+        str2 = _nm_utils_enum_to_str_full(type, flags, ", ", value_infos);
+        g_assert(str2);
+
+        result = _nm_utils_enum_from_str_full(type, str2, &flags2, &err_token2, value_infos);
+        g_assert(result == TRUE);
+        g_assert_cmpint(flags2, ==, flags);
+        g_assert_cmpstr(err_token, ==, NULL);
+    }
+}
+
+#define _test_nm_utils_enum_from_str_do(...) _test_nm_utils_enum_from_str_do_full(__VA_ARGS__, NULL)
+
+static void
+_test_nm_utils_enum_get_values_do(GType type, int from, int to, const char *exp_str)
+{
+    gs_free const char **strv = NULL;
+    gs_free char *       str  = NULL;
+
+    g_assert(exp_str);
+
+    strv = nm_utils_enum_get_values(type, from, to);
+    g_assert(strv);
+    str = g_strjoinv(",", (char **) strv);
+    g_assert_cmpstr(str, ==, exp_str);
+}
+
+static void
+test_nm_utils_enum(void)
+{
+    GType                             bool_enum           = nm_test_general_bool_enum_get_type();
+    GType                             meta_flags          = nm_test_general_meta_flags_get_type();
+    GType                             color_flags         = nm_test_general_color_flags_get_type();
+    static const NMUtilsEnumValueInfo color_value_infos[] = {
+        {
+            .nick  = "nick-4d",
+            .value = 0x4D,
+        },
+        {
+            .nick  = "nick-5",
+            .value = 5,
+        },
+        {
+            .nick  = "nick-red",
+            .value = NM_TEST_GENERAL_COLOR_FLAGS_RED,
+        },
+        {0},
+    };
+
+    _test_nm_utils_enum_to_str_do(bool_enum, NM_TEST_GENERAL_BOOL_ENUM_YES, "yes");
+    _test_nm_utils_enum_to_str_do(bool_enum, NM_TEST_GENERAL_BOOL_ENUM_UNKNOWN, "unknown");
+    _test_nm_utils_enum_to_str_do(bool_enum, NM_TEST_GENERAL_BOOL_ENUM_INVALID, "4");
+    _test_nm_utils_enum_to_str_do(bool_enum, NM_TEST_GENERAL_BOOL_ENUM_67, "67");
+    _test_nm_utils_enum_to_str_do(bool_enum, NM_TEST_GENERAL_BOOL_ENUM_46, "64");
+
+    _test_nm_utils_enum_to_str_do(meta_flags, NM_TEST_GENERAL_META_FLAGS_NONE, "none");
+    _test_nm_utils_enum_to_str_do(meta_flags, NM_TEST_GENERAL_META_FLAGS_BAZ, "baz");
+    _test_nm_utils_enum_to_str_do(meta_flags,
+                                  NM_TEST_GENERAL_META_FLAGS_FOO | NM_TEST_GENERAL_META_FLAGS_BAR
+                                      | NM_TEST_GENERAL_META_FLAGS_BAZ,
+                                  "foo, bar, baz");
+    _test_nm_utils_enum_to_str_do(meta_flags, 0xFF, "foo, bar, baz, 0xf8");
+    _test_nm_utils_enum_to_str_do(meta_flags, NM_TEST_GENERAL_META_FLAGS_0x8, "0x8");
+    _test_nm_utils_enum_to_str_do(meta_flags, NM_TEST_GENERAL_META_FLAGS_0x4, "0x10");
+
+    _test_nm_utils_enum_to_str_do(color_flags, NM_TEST_GENERAL_COLOR_FLAGS_RED, "red");
+    _test_nm_utils_enum_to_str_do(color_flags, NM_TEST_GENERAL_COLOR_FLAGS_WHITE, "0x1");
+    _test_nm_utils_enum_to_str_do(color_flags,
+                                  NM_TEST_GENERAL_COLOR_FLAGS_RED
+                                      | NM_TEST_GENERAL_COLOR_FLAGS_GREEN,
+                                  "red, green");
+
+    _test_nm_utils_enum_to_str_do_full(color_flags,
+                                       NM_TEST_GENERAL_COLOR_FLAGS_RED
+                                           | NM_TEST_GENERAL_COLOR_FLAGS_GREEN,
+                                       "nick-red, green",
+                                       color_value_infos);
+
+    _test_nm_utils_enum_to_str_do_full(color_flags,
+                                       0x4D | NM_TEST_GENERAL_COLOR_FLAGS_RED
+                                           | NM_TEST_GENERAL_COLOR_FLAGS_GREEN,
+                                       "nick-4d",
+                                       color_value_infos);
+
+    _test_nm_utils_enum_to_str_do_full(color_flags,
+                                       5 | NM_TEST_GENERAL_COLOR_FLAGS_GREEN,
+                                       "nick-5, green",
+                                       color_value_infos);
+
+    _test_nm_utils_enum_from_str_do(bool_enum, "", FALSE, 0, NULL);
+    _test_nm_utils_enum_from_str_do(bool_enum, " ", FALSE, 0, NULL);
+    _test_nm_utils_enum_from_str_do(bool_enum, "invalid", FALSE, 0, "invalid");
+    _test_nm_utils_enum_from_str_do(bool_enum, "yes", TRUE, NM_TEST_GENERAL_BOOL_ENUM_YES, NULL);
+    _test_nm_utils_enum_from_str_do(bool_enum, "no", TRUE, NM_TEST_GENERAL_BOOL_ENUM_NO, NULL);
+    _test_nm_utils_enum_from_str_do(bool_enum, "yes,no", FALSE, 0, "yes,no");
+
+    _test_nm_utils_enum_from_str_do(meta_flags, "", TRUE, 0, NULL);
+    _test_nm_utils_enum_from_str_do(meta_flags, " ", TRUE, 0, NULL);
+    _test_nm_utils_enum_from_str_do(meta_flags, "foo", TRUE, NM_TEST_GENERAL_META_FLAGS_FOO, NULL);
+    _test_nm_utils_enum_from_str_do(meta_flags,
+                                    "foo,baz",
+                                    TRUE,
+                                    NM_TEST_GENERAL_META_FLAGS_FOO | NM_TEST_GENERAL_META_FLAGS_BAZ,
+                                    NULL);
+    _test_nm_utils_enum_from_str_do(meta_flags,
+                                    "foo, baz",
+                                    TRUE,
+                                    NM_TEST_GENERAL_META_FLAGS_FOO | NM_TEST_GENERAL_META_FLAGS_BAZ,
+                                    NULL);
+    _test_nm_utils_enum_from_str_do(meta_flags,
+                                    "foo,,bar",
+                                    TRUE,
+                                    NM_TEST_GENERAL_META_FLAGS_FOO | NM_TEST_GENERAL_META_FLAGS_BAR,
+                                    NULL);
+    _test_nm_utils_enum_from_str_do(meta_flags, "foo,baz,quux,bar", FALSE, 0, "quux");
+    _test_nm_utils_enum_from_str_do(meta_flags,
+                                    "foo,0x6",
+                                    TRUE,
+                                    NM_TEST_GENERAL_META_FLAGS_FOO | 0x6,
+                                    NULL);
+    _test_nm_utils_enum_from_str_do(meta_flags, "0x30,0x08,foo", TRUE, 0x39, NULL);
+
+    _test_nm_utils_enum_from_str_do(color_flags,
+                                    "green",
+                                    TRUE,
+                                    NM_TEST_GENERAL_COLOR_FLAGS_GREEN,
+                                    NULL);
+    _test_nm_utils_enum_from_str_do(color_flags,
+                                    "blue,red",
+                                    TRUE,
+                                    NM_TEST_GENERAL_COLOR_FLAGS_BLUE
+                                        | NM_TEST_GENERAL_COLOR_FLAGS_RED,
+                                    NULL);
+    _test_nm_utils_enum_from_str_do(color_flags, "blue,white", FALSE, 0, "white");
+
+    _test_nm_utils_enum_from_str_do_full(color_flags,
+                                         "nick-red",
+                                         TRUE,
+                                         NM_TEST_GENERAL_COLOR_FLAGS_RED,
+                                         NULL,
+                                         color_value_infos);
+
+    _test_nm_utils_enum_from_str_do_full(color_flags, "0x4D", TRUE, 0x4D, NULL, color_value_infos);
+
+    _test_nm_utils_enum_from_str_do_full(color_flags,
+                                         "green,nick-4d",
+                                         TRUE,
+                                         0x4D | NM_TEST_GENERAL_COLOR_FLAGS_GREEN,
+                                         NULL,
+                                         color_value_infos);
+
+    _test_nm_utils_enum_from_str_do_full(color_flags,
+                                         "nick-4d,nick-red,nick-5,green,nick-red",
+                                         TRUE,
+                                         0x4D | NM_TEST_GENERAL_COLOR_FLAGS_GREEN,
+                                         NULL,
+                                         color_value_infos);
+
+    _test_nm_utils_enum_from_str_do_full(NM_TYPE_SETTING_CONNECTION_LLMNR,
+                                         "-1",
+                                         TRUE,
+                                         -1,
+                                         NULL,
+                                         NULL);
+
+    _test_nm_utils_enum_from_str_do_full(NM_TYPE_SETTING_CONNECTION_LLMNR,
+                                         "-0x1",
+                                         TRUE,
+                                         -1,
+                                         NULL,
+                                         NULL);
+
+    _test_nm_utils_enum_get_values_do(bool_enum, 0, G_MAXINT, "no,yes,maybe,unknown,67,64");
+    _test_nm_utils_enum_get_values_do(bool_enum,
+                                      NM_TEST_GENERAL_BOOL_ENUM_YES,
+                                      NM_TEST_GENERAL_BOOL_ENUM_MAYBE,
+                                      "yes,maybe");
+    _test_nm_utils_enum_get_values_do(meta_flags, 0, G_MAXINT, "none,foo,bar,baz,0x8,0x10");
+    _test_nm_utils_enum_get_values_do(color_flags, 0, G_MAXINT, "blue,red,green");
+}
+
+/*****************************************************************************/
+
+static void
+_do_test_utils_str_utf8safe_unescape(const char *str, const char *expected, gsize expected_len)
+{
+    gsize            l;
+    const char *     s;
+    gs_free gpointer buf_free_1 = NULL;
+    gs_free char *   str_free_1 = NULL;
+
+    s = nm_utils_buf_utf8safe_unescape(str, NM_UTILS_STR_UTF8_SAFE_FLAG_NONE, &l, &buf_free_1);
+    g_assert_cmpint(expected_len, ==, l);
+    g_assert_cmpstr(s, ==, expected);
+
+    if (str == NULL) {
+        g_assert(!s);
+        g_assert(!buf_free_1);
+        g_assert_cmpint(l, ==, 0);
+    } else {
+        g_assert(s);
+        if (!strchr(str, '\\')) {
+            g_assert(!buf_free_1);
+            g_assert(s == str);
+            g_assert_cmpint(l, ==, strlen(str));
+        } else {
+            g_assert(buf_free_1);
+            g_assert(s == buf_free_1);
+            g_assert(memcmp(s, expected, expected_len) == 0);
+        }
+    }
+
+    if (expected && l == strlen(expected)) {
+        /* there are no embedded NULs. Check that nm_utils_str_utf8safe_unescape() yields the same result. */
+        s = nm_utils_str_utf8safe_unescape(str, NM_UTILS_STR_UTF8_SAFE_FLAG_NONE, &str_free_1);
+        g_assert_cmpstr(s, ==, expected);
+        g_assert(str);
+        if (strchr(str, '\\')) {
+            g_assert(str_free_1 != str);
+            g_assert(s == str_free_1);
+        } else
+            g_assert(s == str);
+    }
+}
+
+#define do_test_utils_str_utf8safe_unescape(str, expected) \
+    _do_test_utils_str_utf8safe_unescape("" str "", expected, NM_STRLEN(expected))
+
+static void
+_do_test_utils_str_utf8safe(const char *            str,
+                            gsize                   str_len,
+                            const char *            expected,
+                            NMUtilsStrUtf8SafeFlags flags)
+{
+    const char *  str_safe;
+    const char *  buf_safe;
+    const char *  s;
+    gs_free char *str_free_1  = NULL;
+    gs_free char *str_free_2  = NULL;
+    gs_free char *str_free_3  = NULL;
+    gs_free char *str_free_4  = NULL;
+    gs_free char *str_free_5  = NULL;
+    gs_free char *str_free_6  = NULL;
+    gs_free char *str_free_7  = NULL;
+    gs_free char *str_free_8  = NULL;
+    gboolean      str_has_nul = FALSE;
+#define RND_FLAG                                                \
+    ((nmtst_get_rand_bool()) ? NM_UTILS_STR_UTF8_SAFE_FLAG_NONE \
+                             : NM_UTILS_STR_UTF8_SAFE_FLAG_SECRET)
+
+    if (expected && strlen(expected) == str_len && memcmp(str, expected, str_len) == 0) {
+        g_error("Test error: pass expected as NULL (instead of \"%s\", if the escaping will "
+                "produce no difference.",
+                expected);
+    }
+
+    buf_safe = nm_utils_buf_utf8safe_escape(str, str_len, flags | RND_FLAG, &str_free_1);
+
+    str_safe = nm_utils_str_utf8safe_escape(str, flags | RND_FLAG, &str_free_2);
+
+    if (str_len == 0) {
+        g_assert(buf_safe == NULL);
+        g_assert(str_free_1 == NULL);
+        g_assert(str_safe == str);
+        g_assert(str == NULL || str[0] == '\0');
+        g_assert(str_free_2 == NULL);
+    } else if (str_len == strlen(str)) {
+        g_assert(buf_safe);
+        g_assert_cmpstr(buf_safe, ==, str_safe);
+
+        /* nm_utils_buf_utf8safe_escape() can only return a pointer equal to the input string,
+         * if and only if str_len is negative. Otherwise, the input str won't be NUL terminated
+         * and cannot be returned. */
+        g_assert(buf_safe != str);
+        g_assert(buf_safe == str_free_1);
+    } else
+        str_has_nul = TRUE;
+
+    str_free_3 = nm_utils_str_utf8safe_escape_cp(str, flags | RND_FLAG);
+    g_assert_cmpstr(str_free_3, ==, str_safe);
+    g_assert((!str && !str_free_3) || (str != str_free_3));
+
+    if (str_len > 0)
+        _do_test_utils_str_utf8safe_unescape(buf_safe, str, str_len);
+
+    if (expected == NULL) {
+        g_assert(!str_has_nul);
+
+        g_assert(str_safe == str);
+        g_assert(!str_free_2);
+        if (str) {
+            g_assert(!strchr(str, '\\'));
+            g_assert(g_utf8_validate(str, -1, NULL));
+        }
+
+        g_assert(str
+                 == nm_utils_str_utf8safe_unescape(str_safe,
+                                                   NM_UTILS_STR_UTF8_SAFE_FLAG_NONE,
+                                                   &str_free_4));
+        g_assert(!str_free_4);
+
+        str_free_5 = nm_utils_str_utf8safe_unescape_cp(str_safe, NM_UTILS_STR_UTF8_SAFE_FLAG_NONE);
+        if (str) {
+            g_assert(str_free_5 != str);
+            g_assert_cmpstr(str_free_5, ==, str);
+        } else
+            g_assert(!str_free_5);
+        return;
+    }
+
+    if (!str_has_nul) {
+        g_assert(str);
+        g_assert(str_safe != str);
+        g_assert(str_safe == str_free_2);
+        g_assert(strchr(str, '\\') || !g_utf8_validate(str, -1, NULL)
+                 || (NM_FLAGS_HAS(flags, NM_UTILS_STR_UTF8_SAFE_FLAG_ESCAPE_NON_ASCII)
+                     && NM_STRCHAR_ANY(str, ch, (guchar) ch >= 127))
+                 || (NM_FLAGS_HAS(flags, NM_UTILS_STR_UTF8_SAFE_FLAG_ESCAPE_CTRL)
+                     && NM_STRCHAR_ANY(str, ch, (guchar) ch < ' ')));
+        g_assert(g_utf8_validate(str_safe, -1, NULL));
+
+        str_free_6 = g_strcompress(str_safe);
+        g_assert_cmpstr(str, ==, str_free_6);
+
+        str_free_7 = nm_utils_str_utf8safe_unescape_cp(str_safe, NM_UTILS_STR_UTF8_SAFE_FLAG_NONE);
+        g_assert(str_free_7 != str);
+        g_assert_cmpstr(str_free_7, ==, str);
+
+        s = nm_utils_str_utf8safe_unescape(str_safe, NM_UTILS_STR_UTF8_SAFE_FLAG_NONE, &str_free_8);
+        g_assert(str_free_8 != str);
+        g_assert(s == str_free_8);
+        g_assert_cmpstr(str_free_8, ==, str);
+
+        g_assert_cmpstr(str_safe, ==, expected);
+
+        return;
+    }
+
+    g_assert_cmpstr(buf_safe, ==, expected);
+}
+#define do_test_utils_str_utf8safe(str, expected, flags) \
+    _do_test_utils_str_utf8safe("" str "", NM_STRLEN(str), expected, flags)
+
+static void
+test_utils_str_utf8safe(void)
+{
+    _do_test_utils_str_utf8safe(NULL, 0, NULL, NM_UTILS_STR_UTF8_SAFE_FLAG_NONE);
+
+    do_test_utils_str_utf8safe("", NULL, NM_UTILS_STR_UTF8_SAFE_FLAG_NONE);
+    do_test_utils_str_utf8safe("\\", "\\\\", NM_UTILS_STR_UTF8_SAFE_FLAG_NONE);
+    do_test_utils_str_utf8safe("\\a", "\\\\a", NM_UTILS_STR_UTF8_SAFE_FLAG_NONE);
+    do_test_utils_str_utf8safe("\314", "\\314", NM_UTILS_STR_UTF8_SAFE_FLAG_NONE);
+    do_test_utils_str_utf8safe("\314\315x\315\315x",
+                               "\\314\\315x\\315\\315x",
+                               NM_UTILS_STR_UTF8_SAFE_FLAG_NONE);
+    do_test_utils_str_utf8safe("\314\315xx", "\\314\\315xx", NM_UTILS_STR_UTF8_SAFE_FLAG_NONE);
+    do_test_utils_str_utf8safe("\314xx", "\\314xx", NM_UTILS_STR_UTF8_SAFE_FLAG_NONE);
+    do_test_utils_str_utf8safe("\xa0", "\\240", NM_UTILS_STR_UTF8_SAFE_FLAG_NONE);
+    do_test_utils_str_utf8safe("\xe2\x91\xa0", NULL, NM_UTILS_STR_UTF8_SAFE_FLAG_NONE);
+    do_test_utils_str_utf8safe("\xe2\xe2\x91\xa0",
+                               "\\342\xe2\x91\xa0",
+                               NM_UTILS_STR_UTF8_SAFE_FLAG_NONE);
+    do_test_utils_str_utf8safe("\xe2\xe2\x91\xa0\xa0",
+                               "\\342\xe2\x91\xa0\\240",
+                               NM_UTILS_STR_UTF8_SAFE_FLAG_NONE);
+    do_test_utils_str_utf8safe("a", NULL, NM_UTILS_STR_UTF8_SAFE_FLAG_NONE);
+    do_test_utils_str_utf8safe("ab", NULL, NM_UTILS_STR_UTF8_SAFE_FLAG_NONE);
+    do_test_utils_str_utf8safe("ab\314", "ab\\314", NM_UTILS_STR_UTF8_SAFE_FLAG_NONE);
+    do_test_utils_str_utf8safe("ab\314adsf", "ab\\314adsf", NM_UTILS_STR_UTF8_SAFE_FLAG_NONE);
+    do_test_utils_str_utf8safe("abadsf", NULL, NM_UTILS_STR_UTF8_SAFE_FLAG_NONE);
+    do_test_utils_str_utf8safe("abäb", NULL, NM_UTILS_STR_UTF8_SAFE_FLAG_NONE);
+    do_test_utils_str_utf8safe("x\xa0", "x\\240", NM_UTILS_STR_UTF8_SAFE_FLAG_NONE);
+    do_test_utils_str_utf8safe("Ä\304ab\\äb", "Ä\\304ab\\\\äb", NM_UTILS_STR_UTF8_SAFE_FLAG_NONE);
+    do_test_utils_str_utf8safe("Äab\\äb", "Äab\\\\äb", NM_UTILS_STR_UTF8_SAFE_FLAG_NONE);
+    do_test_utils_str_utf8safe("ÄÄab\\äb", "ÄÄab\\\\äb", NM_UTILS_STR_UTF8_SAFE_FLAG_NONE);
+    do_test_utils_str_utf8safe("㈞abä㈞b", NULL, NM_UTILS_STR_UTF8_SAFE_FLAG_NONE);
+    do_test_utils_str_utf8safe("abäb",
+                               "ab\\303\\244b",
+                               NM_UTILS_STR_UTF8_SAFE_FLAG_ESCAPE_NON_ASCII);
+    do_test_utils_str_utf8safe("ab\ab", "ab\\007b", NM_UTILS_STR_UTF8_SAFE_FLAG_ESCAPE_CTRL);
+
+    do_test_utils_str_utf8safe("\0", "\\000", NM_UTILS_STR_UTF8_SAFE_FLAG_NONE);
+    do_test_utils_str_utf8safe("\0a\0", "\\000a\\000", NM_UTILS_STR_UTF8_SAFE_FLAG_NONE);
+    do_test_utils_str_utf8safe("\\\0", "\\\\\\000", NM_UTILS_STR_UTF8_SAFE_FLAG_NONE);
+    do_test_utils_str_utf8safe("\n\0", "\n\\000", NM_UTILS_STR_UTF8_SAFE_FLAG_NONE);
+    do_test_utils_str_utf8safe("\n\0", "\\012\\000", NM_UTILS_STR_UTF8_SAFE_FLAG_ESCAPE_CTRL);
+
+    do_test_utils_str_utf8safe_unescape("\n\\0", "\n\0");
+    do_test_utils_str_utf8safe_unescape("\n\\01", "\n\01");
+    do_test_utils_str_utf8safe_unescape("\n\\012", "\n\012");
+    do_test_utils_str_utf8safe_unescape("\n\\.", "\n.");
+    do_test_utils_str_utf8safe_unescape("\\n\\.3\\r", "\n.3\r");
+
+    do_test_utils_str_utf8safe("ab∞c", NULL, NM_UTILS_STR_UTF8_SAFE_FLAG_ESCAPE_CTRL);
+    do_test_utils_str_utf8safe("ab\ab∞c", "ab\\007b∞c", NM_UTILS_STR_UTF8_SAFE_FLAG_ESCAPE_CTRL);
+    do_test_utils_str_utf8safe("ab\ab∞c",
+                               "ab\\007b\\342\\210\\236c",
+                               NM_UTILS_STR_UTF8_SAFE_FLAG_ESCAPE_CTRL
+                                   | NM_UTILS_STR_UTF8_SAFE_FLAG_ESCAPE_NON_ASCII);
+}
+
+/*****************************************************************************/
+
+static int
+_test_nm_in_set_get(int *call_counter, gboolean allow_called, int value)
+{
+    g_assert(call_counter);
+    *call_counter += 1;
+    if (!allow_called)
+        g_assert_not_reached();
+    return value;
+}
+
+static void
+_test_nm_in_set_assert(int *call_counter, int expected)
+{
+    g_assert(call_counter);
+    g_assert_cmpint(expected, ==, *call_counter);
+    *call_counter = 0;
+}
+
+static void
+test_nm_in_set(void)
+{
+    int call_counter = 0;
+
+#define G(x) _test_nm_in_set_get(&call_counter, TRUE, x)
+#define N(x) _test_nm_in_set_get(&call_counter, FALSE, x)
+#define _ASSERT(expected, expr)                            \
+    G_STMT_START                                           \
+    {                                                      \
+        _test_nm_in_set_assert(&call_counter, 0);          \
+        g_assert(expr);                                    \
+        _test_nm_in_set_assert(&call_counter, (expected)); \
+    }                                                      \
+    G_STMT_END
+    _ASSERT(1, !NM_IN_SET(-1, G(1)));
+    _ASSERT(1, NM_IN_SET(-1, G(-1)));
+
+    _ASSERT(2, !NM_IN_SET(-1, G(1), G(2)));
+    _ASSERT(1, NM_IN_SET(-1, G(-1), N(2)));
+    _ASSERT(2, NM_IN_SET(-1, G(1), G(-1)));
+    _ASSERT(1, NM_IN_SET(-1, G(-1), N(-1)));
+
+    _ASSERT(3, !NM_IN_SET(-1, G(1), G(2), G(3)));
+    _ASSERT(1, NM_IN_SET(-1, G(-1), N(2), N(3)));
+    _ASSERT(2, NM_IN_SET(-1, G(1), G(-1), N(3)));
+    _ASSERT(3, NM_IN_SET(-1, G(1), G(2), G(-1)));
+    _ASSERT(2, NM_IN_SET(-1, G(1), G(-1), N(-1)));
+    _ASSERT(1, NM_IN_SET(-1, G(-1), N(2), N(-1)));
+    _ASSERT(1, NM_IN_SET(-1, G(-1), N(-1), N(3)));
+    _ASSERT(1, NM_IN_SET(-1, G(-1), N(-1), N(-1)));
+
+    _ASSERT(4, !NM_IN_SET(-1, G(1), G(2), G(3), G(4)));
+    _ASSERT(1, NM_IN_SET(-1, G(-1), N(2), N(3), N(4)));
+    _ASSERT(2, NM_IN_SET(-1, G(1), G(-1), N(3), N(4)));
+    _ASSERT(3, NM_IN_SET(-1, G(1), G(2), G(-1), N(4)));
+    _ASSERT(4, NM_IN_SET(-1, G(1), G(2), G(3), G(-1)));
+
+    _ASSERT(4, NM_IN_SET(-1, G(1), G(2), G(3), G(-1), G(5)));
+    _ASSERT(5, NM_IN_SET(-1, G(1), G(2), G(3), G(4), G(-1)));
+    _ASSERT(6, NM_IN_SET(-1, G(1), G(2), G(3), G(4), G(5), G(-1)));
+
+    _ASSERT(1, !NM_IN_SET_SE(-1, G(1)));
+    _ASSERT(1, NM_IN_SET_SE(-1, G(-1)));
+
+    _ASSERT(2, !NM_IN_SET_SE(-1, G(1), G(2)));
+    _ASSERT(2, NM_IN_SET_SE(-1, G(-1), G(2)));
+    _ASSERT(2, NM_IN_SET_SE(-1, G(1), G(-1)));
+    _ASSERT(2, NM_IN_SET_SE(-1, G(-1), G(-1)));
+
+    _ASSERT(3, !NM_IN_SET_SE(-1, G(1), G(2), G(3)));
+    _ASSERT(3, NM_IN_SET_SE(-1, G(-1), G(2), G(3)));
+    _ASSERT(3, NM_IN_SET_SE(-1, G(1), G(-1), G(3)));
+    _ASSERT(3, NM_IN_SET_SE(-1, G(1), G(2), G(-1)));
+    _ASSERT(3, NM_IN_SET_SE(-1, G(1), G(-1), G(-1)));
+    _ASSERT(3, NM_IN_SET_SE(-1, G(-1), G(2), G(-1)));
+    _ASSERT(3, NM_IN_SET_SE(-1, G(-1), G(-1), G(3)));
+    _ASSERT(3, NM_IN_SET_SE(-1, G(-1), G(-1), G(-1)));
+
+    _ASSERT(4, !NM_IN_SET_SE(-1, G(1), G(2), G(3), G(4)));
+    _ASSERT(4, NM_IN_SET_SE(-1, G(-1), G(2), G(3), G(4)));
+    _ASSERT(4, NM_IN_SET_SE(-1, G(1), G(-1), G(3), G(4)));
+    _ASSERT(4, NM_IN_SET_SE(-1, G(1), G(2), G(-1), G(4)));
+    _ASSERT(4, NM_IN_SET_SE(-1, G(1), G(2), G(3), G(-1)));
+
+    _ASSERT(5, NM_IN_SET_SE(-1, G(1), G(2), G(3), G(-1), G(5)));
+    _ASSERT(6, NM_IN_SET_SE(-1, G(1), G(2), G(3), G(4), G(5), G(-1)));
+
+    g_assert(!NM_IN_SET(0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16));
+#undef G
+#undef N
+#undef _ASSERT
+}
+
+/*****************************************************************************/
+
+static const char *
+_test_nm_in_set_getstr(int *call_counter, gboolean allow_called, const char *value)
+{
+    g_assert(call_counter);
+    *call_counter += 1;
+    if (!allow_called)
+        g_assert_not_reached();
+    return value;
+}
+
+static void
+test_nm_in_strset(void)
+{
+    int call_counter = 0;
+
+#define G(x) _test_nm_in_set_getstr(&call_counter, TRUE, x)
+#define N(x) _test_nm_in_set_getstr(&call_counter, FALSE, x)
+#define _ASSERT(expected, expr)                            \
+    G_STMT_START                                           \
+    {                                                      \
+        _test_nm_in_set_assert(&call_counter, 0);          \
+        g_assert(expr);                                    \
+        _test_nm_in_set_assert(&call_counter, (expected)); \
+    }                                                      \
+    G_STMT_END
+    _ASSERT(1, NM_IN_STRSET(NULL, G(NULL)));
+    _ASSERT(1, !NM_IN_STRSET("a", G(NULL)));
+    _ASSERT(1, !NM_IN_STRSET(NULL, G("a")));
+
+    _ASSERT(1, NM_IN_STRSET_SE(NULL, G(NULL)));
+    _ASSERT(1, !NM_IN_STRSET_SE("a", G(NULL)));
+    _ASSERT(1, !NM_IN_STRSET_SE(NULL, G("a")));
+
+    _ASSERT(1, NM_IN_STRSET(NULL, G(NULL), N(NULL)));
+    _ASSERT(2, !NM_IN_STRSET("a", G(NULL), G(NULL)));
+    _ASSERT(2, NM_IN_STRSET(NULL, G("a"), G(NULL)));
+    _ASSERT(1, NM_IN_STRSET(NULL, G(NULL), N("a")));
+    _ASSERT(2, NM_IN_STRSET("a", G(NULL), G("a")));
+    _ASSERT(2, !NM_IN_STRSET(NULL, G("a"), G("a")));
+    _ASSERT(1, NM_IN_STRSET(NULL, G(NULL), N("b")));
+    _ASSERT(2, !NM_IN_STRSET("a", G(NULL), G("b")));
+    _ASSERT(2, !NM_IN_STRSET(NULL, G("a"), G("b")));
+
+    _ASSERT(2, NM_IN_STRSET_SE(NULL, G(NULL), G(NULL)));
+    _ASSERT(2, !NM_IN_STRSET_SE("a", G(NULL), G(NULL)));
+    _ASSERT(2, NM_IN_STRSET_SE(NULL, G("a"), G(NULL)));
+    _ASSERT(2, NM_IN_STRSET_SE(NULL, G(NULL), G("a")));
+    _ASSERT(2, NM_IN_STRSET_SE("a", G(NULL), G("a")));
+    _ASSERT(2, !NM_IN_STRSET_SE(NULL, G("a"), G("a")));
+    _ASSERT(2, NM_IN_STRSET_SE(NULL, G(NULL), G("b")));
+    _ASSERT(2, !NM_IN_STRSET_SE("a", G(NULL), G("b")));
+    _ASSERT(2, !NM_IN_STRSET_SE(NULL, G("a"), G("b")));
+
+    _ASSERT(1, NM_IN_STRSET(NULL, G(NULL), N(NULL), N(NULL)));
+    _ASSERT(3, !NM_IN_STRSET("a", G(NULL), G(NULL), G(NULL)));
+    _ASSERT(2, NM_IN_STRSET(NULL, G("a"), G(NULL), N(NULL)));
+    _ASSERT(1, NM_IN_STRSET(NULL, G(NULL), N("a"), N(NULL)));
+    _ASSERT(2, NM_IN_STRSET("a", G(NULL), G("a"), N(NULL)));
+    _ASSERT(3, NM_IN_STRSET(NULL, G("a"), G("a"), G(NULL)));
+    _ASSERT(1, NM_IN_STRSET(NULL, G(NULL), N("b"), N(NULL)));
+    _ASSERT(3, !NM_IN_STRSET("a", G(NULL), G("b"), G(NULL)));
+    _ASSERT(3, NM_IN_STRSET(NULL, G("a"), G("b"), G(NULL)));
+    _ASSERT(1, NM_IN_STRSET(NULL, G(NULL), N(NULL), N("a")));
+    _ASSERT(3, NM_IN_STRSET("a", G(NULL), G(NULL), G("a")));
+    _ASSERT(2, NM_IN_STRSET(NULL, G("a"), G(NULL), N("a")));
+    _ASSERT(1, NM_IN_STRSET(NULL, G(NULL), N("a"), N("a")));
+    _ASSERT(2, NM_IN_STRSET("a", G(NULL), G("a"), N("a")));
+    _ASSERT(3, !NM_IN_STRSET(NULL, G("a"), G("a"), G("a")));
+    _ASSERT(1, NM_IN_STRSET(NULL, G(NULL), N("b"), N("a")));
+    _ASSERT(3, NM_IN_STRSET("a", G(NULL), G("b"), G("a")));
+    _ASSERT(3, !NM_IN_STRSET(NULL, G("a"), G("b"), G("a")));
+    _ASSERT(1, NM_IN_STRSET(NULL, G(NULL), N(NULL), N("b")));
+    _ASSERT(3, !NM_IN_STRSET("a", G(NULL), G(NULL), G("b")));
+    _ASSERT(2, NM_IN_STRSET(NULL, G("a"), G(NULL), N("b")));
+    _ASSERT(1, NM_IN_STRSET(NULL, G(NULL), N("a"), N("b")));
+    _ASSERT(2, NM_IN_STRSET("a", G(NULL), G("a"), N("b")));
+    _ASSERT(3, !NM_IN_STRSET(NULL, G("a"), G("a"), G("b")));
+    _ASSERT(1, NM_IN_STRSET(NULL, G(NULL), N("b"), N("b")));
+    _ASSERT(3, !NM_IN_STRSET("a", G(NULL), G("b"), G("b")));
+    _ASSERT(3, !NM_IN_STRSET(NULL, G("a"), G("b"), G("b")));
+
+    _ASSERT(3, NM_IN_STRSET_SE(NULL, G(NULL), G(NULL), G(NULL)));
+    _ASSERT(3, !NM_IN_STRSET_SE("a", G(NULL), G(NULL), G(NULL)));
+    _ASSERT(3, NM_IN_STRSET_SE(NULL, G("a"), G(NULL), G(NULL)));
+    _ASSERT(3, NM_IN_STRSET_SE(NULL, G(NULL), G("a"), G(NULL)));
+    _ASSERT(3, NM_IN_STRSET_SE("a", G(NULL), G("a"), G(NULL)));
+    _ASSERT(3, NM_IN_STRSET_SE(NULL, G("a"), G("a"), G(NULL)));
+    _ASSERT(3, NM_IN_STRSET_SE(NULL, G(NULL), G("b"), G(NULL)));
+    _ASSERT(3, !NM_IN_STRSET_SE("a", G(NULL), G("b"), G(NULL)));
+    _ASSERT(3, NM_IN_STRSET_SE(NULL, G("a"), G("b"), G(NULL)));
+    _ASSERT(3, NM_IN_STRSET_SE(NULL, G(NULL), G(NULL), G("a")));
+    _ASSERT(3, NM_IN_STRSET_SE("a", G(NULL), G(NULL), G("a")));
+    _ASSERT(3, NM_IN_STRSET_SE(NULL, G("a"), G(NULL), G("a")));
+    _ASSERT(3, NM_IN_STRSET_SE(NULL, G(NULL), G("a"), G("a")));
+    _ASSERT(3, NM_IN_STRSET_SE("a", G(NULL), G("a"), G("a")));
+    _ASSERT(3, !NM_IN_STRSET_SE(NULL, G("a"), G("a"), G("a")));
+    _ASSERT(3, NM_IN_STRSET_SE(NULL, G(NULL), G("b"), G("a")));
+    _ASSERT(3, NM_IN_STRSET_SE("a", G(NULL), G("b"), G("a")));
+    _ASSERT(3, !NM_IN_STRSET_SE(NULL, G("a"), G("b"), G("a")));
+    _ASSERT(3, NM_IN_STRSET_SE(NULL, G(NULL), G(NULL), G("b")));
+    _ASSERT(3, !NM_IN_STRSET_SE("a", G(NULL), G(NULL), G("b")));
+    _ASSERT(3, NM_IN_STRSET_SE(NULL, G("a"), G(NULL), G("b")));
+    _ASSERT(3, NM_IN_STRSET_SE(NULL, G(NULL), G("a"), G("b")));
+    _ASSERT(3, NM_IN_STRSET_SE("a", G(NULL), G("a"), G("b")));
+    _ASSERT(3, !NM_IN_STRSET_SE(NULL, G("a"), G("a"), G("b")));
+    _ASSERT(3, NM_IN_STRSET_SE(NULL, G(NULL), G("b"), G("b")));
+    _ASSERT(3, !NM_IN_STRSET_SE("a", G(NULL), G("b"), G("b")));
+    _ASSERT(3, !NM_IN_STRSET_SE(NULL, G("a"), G("b"), G("b")));
+
+    _ASSERT(3, NM_IN_STRSET("a", G(NULL), G("b"), G("a"), N("a")));
+    _ASSERT(4, NM_IN_STRSET("a", G(NULL), G("b"), G("c"), G("a")));
+    _ASSERT(4, !NM_IN_STRSET("a", G(NULL), G("b"), G("c"), G("d")));
+
+    _ASSERT(4, NM_IN_STRSET("a", G(NULL), G("b"), G("c"), G("a"), N("a")));
+    _ASSERT(5, NM_IN_STRSET("a", G(NULL), G("b"), G("c"), G("d"), G("a")));
+    _ASSERT(5, !NM_IN_STRSET("a", G(NULL), G("b"), G("c"), G("d"), G("e")));
+
+    _ASSERT(5, NM_IN_STRSET("a", G(NULL), G("b"), G("c"), G("d"), G("a"), N("a")));
+    _ASSERT(6, NM_IN_STRSET("a", G(NULL), G("b"), G("c"), G("d"), G("e"), G("a")));
+    _ASSERT(6, !NM_IN_STRSET("a", G(NULL), G("b"), G("c"), G("d"), G("e"), G("f")));
+
+    g_assert(!NM_IN_STRSET(NULL,
+                           "1",
+                           "2",
+                           "3",
+                           "4",
+                           "5",
+                           "6",
+                           "7",
+                           "8",
+                           "9",
+                           "10",
+                           "11",
+                           "12",
+                           "13",
+                           "14",
+                           "15",
+                           "16"));
+    g_assert(!NM_IN_STRSET("_",
+                           "1",
+                           "2",
+                           "3",
+                           "4",
+                           "5",
+                           "6",
+                           "7",
+                           "8",
+                           "9",
+                           "10",
+                           "11",
+                           "12",
+                           "13",
+                           "14",
+                           "15",
+                           "16"));
+    g_assert(NM_IN_STRSET("10",
+                          "1",
+                          "2",
+                          "3",
+                          "4",
+                          "5",
+                          "6",
+                          "7",
+                          "8",
+                          "9",
+                          "10",
+                          "11",
+                          "12",
+                          "13",
+                          "14",
+                          "15",
+                          "16"));
+#undef G
+#undef N
+#undef _ASSERT
+}
+
+static void
+test_route_attributes_parse(void)
+{
+    GHashTable *ht;
+    GError *    error = NULL;
+    GVariant *  variant;
+
+    ht = nm_utils_parse_variant_attributes("mtu=1400  src=1.2.3.4 cwnd=14",
+                                           ' ',
+                                           '=',
+                                           FALSE,
+                                           nm_ip_route_get_variant_attribute_spec(),
+                                           &error);
+    g_assert_no_error(error);
+    g_assert(ht);
+    g_hash_table_unref(ht);
+
+    ht = nm_utils_parse_variant_attributes("mtu=1400 src=1.2.3.4 cwnd=14 \\",
+                                           ' ',
+                                           '=',
+                                           FALSE,
+                                           nm_ip_route_get_variant_attribute_spec(),
+                                           &error);
+    g_assert_error(error, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_FAILED);
+    g_assert(!ht);
+    g_clear_error(&error);
+
+    ht = nm_utils_parse_variant_attributes("mtu.1400 src.1\\.2\\.3\\.4 ",
+                                           ' ',
+                                           '.',
+                                           FALSE,
+                                           nm_ip_route_get_variant_attribute_spec(),
+                                           &error);
+    g_assert(ht);
+    g_assert_no_error(error);
+    variant = g_hash_table_lookup(ht, NM_IP_ROUTE_ATTRIBUTE_MTU);
+    g_assert(variant);
+    g_assert(g_variant_is_of_type(variant, G_VARIANT_TYPE_UINT32));
+    g_assert_cmpuint(g_variant_get_uint32(variant), ==, 1400);
+
+    variant = g_hash_table_lookup(ht, NM_IP_ROUTE_ATTRIBUTE_SRC);
+    g_assert(variant);
+    g_assert(g_variant_is_of_type(variant, G_VARIANT_TYPE_STRING));
+    g_assert_cmpstr(g_variant_get_string(variant, NULL), ==, "1.2.3.4");
+    g_hash_table_unref(ht);
+
+    ht = nm_utils_parse_variant_attributes("from:fd01\\:\\:42\\/64/initrwnd:21",
+                                           '/',
+                                           ':',
+                                           FALSE,
+                                           nm_ip_route_get_variant_attribute_spec(),
+                                           &error);
+    g_assert(ht);
+    g_assert_no_error(error);
+    variant = g_hash_table_lookup(ht, NM_IP_ROUTE_ATTRIBUTE_INITRWND);
+    g_assert(variant);
+    g_assert(g_variant_is_of_type(variant, G_VARIANT_TYPE_UINT32));
+    g_assert_cmpuint(g_variant_get_uint32(variant), ==, 21);
+
+    variant = g_hash_table_lookup(ht, NM_IP_ROUTE_ATTRIBUTE_FROM);
+    g_assert(variant);
+    g_assert(g_variant_is_of_type(variant, G_VARIANT_TYPE_STRING));
+    g_assert_cmpstr(g_variant_get_string(variant, NULL), ==, "fd01::42/64");
+    g_hash_table_unref(ht);
+}
+
+static void
+test_route_attributes_format(void)
+{
+    gs_unref_hashtable GHashTable *ht = NULL;
+    char *                         str;
+
+    ht = g_hash_table_new_full(nm_str_hash, g_str_equal, NULL, (GDestroyNotify) g_variant_unref);
+
+    str = nm_utils_format_variant_attributes(NULL, ' ', '=');
+    g_assert_cmpstr(str, ==, NULL);
+
+    str = nm_utils_format_variant_attributes(ht, ' ', '=');
+    g_assert_cmpstr(str, ==, NULL);
+
+    g_hash_table_insert(ht, NM_IP_ROUTE_ATTRIBUTE_MTU, g_variant_new_uint32(5000));
+    g_hash_table_insert(ht, NM_IP_ROUTE_ATTRIBUTE_INITRWND, g_variant_new_uint32(20));
+    g_hash_table_insert(ht, NM_IP_ROUTE_ATTRIBUTE_LOCK_MTU, g_variant_new_boolean(TRUE));
+    g_hash_table_insert(ht, NM_IP_ROUTE_ATTRIBUTE_SRC, g_variant_new_string("aaaa:bbbb::1"));
+    str = nm_utils_format_variant_attributes(ht, ' ', '=');
+    g_assert_cmpstr(str, ==, "initrwnd=20 lock-mtu=true mtu=5000 src=aaaa:bbbb::1");
+    g_hash_table_remove_all(ht);
+    g_free(str);
+
+    g_hash_table_insert(ht, NM_IP_ROUTE_ATTRIBUTE_WINDOW, g_variant_new_uint32(30000));
+    g_hash_table_insert(ht, NM_IP_ROUTE_ATTRIBUTE_INITCWND, g_variant_new_uint32(21));
+    g_hash_table_insert(ht,
+                        NM_IP_ROUTE_ATTRIBUTE_FROM,
+                        g_variant_new_string("aaaa:bbbb:cccc:dddd::/64"));
+    str = nm_utils_format_variant_attributes(ht, '/', ':');
+    g_assert_cmpstr(str, ==, "from:aaaa\\:bbbb\\:cccc\\:dddd\\:\\:\\/64/initcwnd:21/window:30000");
+    g_hash_table_remove_all(ht);
+    g_free(str);
+}
+
+/*****************************************************************************/
+
+static void
+test_variant_attribute_spec(void)
+{
+    const NMVariantAttributeSpec *const *const specs_list[] = {
+        nm_ip_route_get_variant_attribute_spec(),
+    };
+    int i_specs;
+
+    for (i_specs = 0; i_specs < G_N_ELEMENTS(specs_list); i_specs++) {
+        const NMVariantAttributeSpec *const *const specs = specs_list[i_specs];
+        gsize                                      len;
+        gsize                                      i;
+
+        g_assert(specs);
+
+        len = NM_PTRARRAY_LEN(specs);
+        g_assert_cmpint(len, >, 0u);
+
+        _nmtst_variant_attribute_spec_assert_sorted(specs, len);
+        for (i = 0; i < len; i++)
+            g_assert(specs[i]
+                     == _nm_variant_attribute_spec_find_binary_search(specs, len, specs[i]->name));
+        g_assert(!_nm_variant_attribute_spec_find_binary_search(specs, len, "bogus"));
+    }
+}
+
+/*****************************************************************************/
+
+static gboolean
+do_test_nm_set_out_called(int *call_count)
+{
+    (*call_count)++;
+    return TRUE;
+}
+
+static void
+test_nm_set_out(void)
+{
+    gboolean  val;
+    gboolean *p_val;
+    int       call_count;
+
+    /* NM_SET_OUT() has an unexpected non-function like behavior
+     * wrt. side-effects of the value argument. Test it */
+
+    p_val      = &val;
+    call_count = 0;
+    NM_SET_OUT(p_val, do_test_nm_set_out_called(&call_count));
+    g_assert_cmpint(call_count, ==, 1);
+
+    p_val      = NULL;
+    call_count = 0;
+    NM_SET_OUT(p_val, do_test_nm_set_out_called(&call_count));
+    g_assert_cmpint(call_count, ==, 0);
+
+    /* test that we successfully re-defined _G_BOOLEAN_EXPR() */
+#define _T1(a)           \
+    ({                   \
+        g_assert(a > 2); \
+        a;               \
+    })
+    g_assert(_T1(3) > 1);
+#undef _T1
+}
+
+/*****************************************************************************/
+
+static void
+test_get_start_time_for_pid(void)
+{
+    guint64 x_start_time;
+    char    x_state;
+    pid_t   x_ppid;
+
+    x_start_time = nm_utils_get_start_time_for_pid(getpid(), &x_state, &x_ppid);
+
+    g_assert(x_start_time > 0);
+    g_assert(x_ppid == getppid());
+    g_assert(!NM_IN_SET(x_state, '\0', ' '));
+}
+
+/*****************************************************************************/
+
+static void
+test_nm_va_args_macros(void)
+{
+#define GET_NARG_1(...) NM_NARG(__VA_ARGS__)
+
+    g_assert_cmpint(0, ==, GET_NARG_1());
+    g_assert_cmpint(1, ==, GET_NARG_1(x));
+    g_assert_cmpint(2, ==, GET_NARG_1(, ));
+    g_assert_cmpint(2, ==, GET_NARG_1(, x));
+    g_assert_cmpint(2, ==, GET_NARG_1(x, ));
+    g_assert_cmpint(2, ==, GET_NARG_1(x, x));
+    g_assert_cmpint(3, ==, GET_NARG_1(, , ));
+    g_assert_cmpint(3, ==, GET_NARG_1(, , x));
+    g_assert_cmpint(3, ==, GET_NARG_1(, x, ));
+    g_assert_cmpint(3, ==, GET_NARG_1(, x, x));
+    g_assert_cmpint(3, ==, GET_NARG_1(x, , ));
+    g_assert_cmpint(3, ==, GET_NARG_1(x, , x));
+    g_assert_cmpint(3, ==, GET_NARG_1(x, x, ));
+    g_assert_cmpint(3, ==, GET_NARG_1(x, x, x));
+    g_assert_cmpint(4, ==, GET_NARG_1(, , , ));
+    g_assert_cmpint(4, ==, GET_NARG_1(, , , x));
+    g_assert_cmpint(4, ==, GET_NARG_1(, , x, ));
+    g_assert_cmpint(4, ==, GET_NARG_1(, , x, x));
+    g_assert_cmpint(4, ==, GET_NARG_1(, x, , ));
+    g_assert_cmpint(4, ==, GET_NARG_1(, x, , x));
+    g_assert_cmpint(4, ==, GET_NARG_1(, x, x, ));
+    g_assert_cmpint(4, ==, GET_NARG_1(, x, x, x));
+    g_assert_cmpint(4, ==, GET_NARG_1(x, , , ));
+    g_assert_cmpint(4, ==, GET_NARG_1(x, , , x));
+    g_assert_cmpint(4, ==, GET_NARG_1(x, , x, ));
+    g_assert_cmpint(4, ==, GET_NARG_1(x, , x, x));
+    g_assert_cmpint(4, ==, GET_NARG_1(x, x, , ));
+    g_assert_cmpint(4, ==, GET_NARG_1(x, x, , x));
+    g_assert_cmpint(4, ==, GET_NARG_1(x, x, x, ));
+    g_assert_cmpint(4, ==, GET_NARG_1(x, x, x, x));
+
+    g_assert_cmpint(5, ==, GET_NARG_1(x, x, x, x, x));
+    g_assert_cmpint(6, ==, GET_NARG_1(x, x, x, x, x, x));
+    g_assert_cmpint(7, ==, GET_NARG_1(x, x, x, x, x, x, x));
+    g_assert_cmpint(8, ==, GET_NARG_1(x, x, x, x, x, x, x, x));
+    g_assert_cmpint(9, ==, GET_NARG_1(x, x, x, x, x, x, x, x, x));
+    g_assert_cmpint(10, ==, GET_NARG_1(x, x, x, x, x, x, x, x, x, x));
+
+    G_STATIC_ASSERT_EXPR(0 == GET_NARG_1());
+    G_STATIC_ASSERT_EXPR(1 == GET_NARG_1(x));
+    G_STATIC_ASSERT_EXPR(2 == GET_NARG_1(x, x));
+}
+
+/*****************************************************************************/
+
+static void
+test_ethtool_offload(void)
+{
+    const NMEthtoolData *d;
+
+    g_assert_cmpint(nm_ethtool_id_get_by_name("invalid"), ==, NM_ETHTOOL_ID_UNKNOWN);
+    g_assert_cmpint(nm_ethtool_id_get_by_name("feature-rx"), ==, NM_ETHTOOL_ID_FEATURE_RX);
+
+    d = nm_ethtool_data_get_by_optname(NM_ETHTOOL_OPTNAME_FEATURE_RXHASH);
+    g_assert(d);
+    g_assert_cmpint(d->id, ==, NM_ETHTOOL_ID_FEATURE_RXHASH);
+    g_assert_cmpstr(d->optname, ==, NM_ETHTOOL_OPTNAME_FEATURE_RXHASH);
+
+    /* these features are NETIF_F_NEVER_CHANGE: */
+    g_assert(!nm_ethtool_data_get_by_optname("feature-netns-local"));
+    g_assert(!nm_ethtool_data_get_by_optname("feature-tx-lockless"));
+    g_assert(!nm_ethtool_data_get_by_optname("feature-vlan-challenged"));
+}
+
+/*****************************************************************************/
+
+typedef struct {
+    GMainLoop *   loop1;
+    GMainContext *c2;
+    GSource *     extra_sources[2];
+    bool          got_signal[5];
+    int           fd_2;
+} IntegData;
+
+static gboolean
+_test_integrate_cb_handle(IntegData *d, int signal)
+{
+    int i;
+
+    g_assert(d);
+    g_assert(signal >= 0);
+    g_assert(signal < G_N_ELEMENTS(d->got_signal));
+
+    g_assert(!d->got_signal[signal]);
+    d->got_signal[signal] = TRUE;
+
+    for (i = 0; i < G_N_ELEMENTS(d->got_signal); i++) {
+        if (!d->got_signal[i])
+            break;
+    }
+    if (i == G_N_ELEMENTS(d->got_signal))
+        g_main_loop_quit(d->loop1);
+    return G_SOURCE_REMOVE;
+}
+
+static gboolean
+_test_integrate_cb_timeout_1(gpointer user_data)
+{
+    return _test_integrate_cb_handle(user_data, 0);
+}
+
+static gboolean
+_test_integrate_cb_fd_2(int fd, GIOCondition condition, gpointer user_data)
+
+{
+    IntegData *d = user_data;
+
+    g_assert(d->got_signal[1]);
+    g_assert(d->got_signal[2]);
+    g_assert(d->got_signal[3]);
+    g_assert(d->extra_sources[0]);
+    g_assert(d->extra_sources[1]);
+
+    return _test_integrate_cb_handle(d, 4);
+}
+
+static gboolean
+_test_integrate_cb_idle_2(gpointer user_data)
+{
+    IntegData *d = user_data;
+    GSource *  extra_source;
+
+    g_assert(d->got_signal[1]);
+    g_assert(d->got_signal[2]);
+    g_assert(d->extra_sources[0]);
+    g_assert(!d->extra_sources[1]);
+
+    extra_source = nm_g_unix_fd_source_new(d->fd_2,
+                                           G_IO_IN,
+                                           G_PRIORITY_DEFAULT,
+                                           _test_integrate_cb_fd_2,
+                                           d,
+                                           NULL);
+    g_source_attach(extra_source, d->c2);
+
+    d->extra_sources[1] = extra_source;
+
+    return _test_integrate_cb_handle(d, 3);
+}
+
+static gboolean
+_test_integrate_cb_idle_1(gpointer user_data)
+{
+    IntegData *d = user_data;
+    GSource *  extra_source;
+
+    g_assert(d->got_signal[2]);
+    g_assert(!d->extra_sources[0]);
+
+    extra_source = g_idle_source_new();
+    g_source_set_callback(extra_source, _test_integrate_cb_idle_2, d, NULL);
+    g_source_attach(extra_source, d->c2);
+
+    d->extra_sources[0] = extra_source;
+
+    return _test_integrate_cb_handle(d, 1);
+}
+
+static gboolean
+_test_integrate_cb_fd_1(int fd, GIOCondition condition, gpointer user_data)
+
+{
+    IntegData *d = user_data;
+
+    g_assert(!d->got_signal[1]);
+    return _test_integrate_cb_handle(d, 2);
+}
+
+static gboolean
+_test_integrate_maincontext_cb_idle1(gpointer user_data)
+{
+    guint32 *p_count = user_data;
+
+    g_assert(*p_count < 5);
+    (*p_count)++;
+    return G_SOURCE_CONTINUE;
+}
+
+static void
+test_integrate_maincontext(gconstpointer test_data)
+{
+    const guint                TEST_IDX                     = GPOINTER_TO_UINT(test_data);
+    GMainContext *             c1                           = g_main_context_default();
+    nm_auto_unref_gmaincontext GMainContext *c2             = g_main_context_new();
+    nm_auto_destroy_and_unref_gsource GSource *integ_source = NULL;
+
+    integ_source = nm_utils_g_main_context_create_integrate_source(c2);
+    g_source_attach(integ_source, c1);
+
+    if (TEST_IDX == 1) {
+        nm_auto_destroy_and_unref_gsource GSource *idle_source_1 = NULL;
+        guint32                                    count         = 0;
+
+        idle_source_1 = g_idle_source_new();
+        g_source_set_callback(idle_source_1, _test_integrate_maincontext_cb_idle1, &count, NULL);
+        g_source_attach(idle_source_1, c2);
+
+        nmtst_main_context_iterate_until_assert(c1, 2000, count == 5);
+    }
+
+    if (TEST_IDX == 2) {
+        nm_auto_destroy_and_unref_gsource GSource *main_timeout_source = NULL;
+        nm_auto_destroy_and_unref_gsource GSource *timeout_source_1    = NULL;
+        nm_auto_destroy_and_unref_gsource GSource *idle_source_1       = NULL;
+        nm_auto_destroy_and_unref_gsource GSource *fd_source_1         = NULL;
+        nm_auto_unref_gmainloop GMainLoop *loop1                       = NULL;
+        nm_auto_close int                  fd_1                        = -1;
+        nm_auto_close int                  fd_2                        = -1;
+        IntegData                          d;
+        int                                i;
+
+        main_timeout_source = g_timeout_source_new(3000);
+        g_source_set_callback(main_timeout_source, nmtst_g_source_assert_not_called, NULL, NULL);
+        g_source_attach(main_timeout_source, c1);
+
+        loop1 = g_main_loop_new(c1, FALSE);
+
+        d = (IntegData){
+            .loop1 = loop1,
+            .c2    = c2,
+        };
+
+        fd_1 = open("/dev/null", O_RDONLY | O_CLOEXEC);
+        g_assert(fd_1 >= 0);
+        fd_source_1 = nm_g_unix_fd_source_new(fd_1,
+                                              G_IO_IN,
+                                              G_PRIORITY_DEFAULT,
+                                              _test_integrate_cb_fd_1,
+                                              &d,
+                                              NULL);
+        g_source_attach(fd_source_1, c2);
+
+        fd_2 = open("/dev/null", O_RDONLY | O_CLOEXEC);
+        g_assert(fd_2 >= 0);
+        d.fd_2 = fd_2;
+
+        idle_source_1 = g_idle_source_new();
+        g_source_set_callback(idle_source_1, _test_integrate_cb_idle_1, &d, NULL);
+        g_source_attach(idle_source_1, c2);
+
+        timeout_source_1 = g_timeout_source_new(5);
+        g_source_set_callback(timeout_source_1, _test_integrate_cb_timeout_1, &d, NULL);
+        g_source_attach(timeout_source_1, c2);
+
+        g_main_loop_run(loop1);
+
+        for (i = 0; i < G_N_ELEMENTS(d.extra_sources); i++) {
+            g_assert(d.extra_sources[i]);
+            nm_clear_pointer(&d.extra_sources[i], nm_g_source_destroy_and_unref);
+        }
+    }
+}
+
+/*****************************************************************************/
+
+static void
+test_nm_ip_addr_zero(void)
+{
+    in_addr_t       a4 = nmtst_inet4_from_string("0.0.0.0");
+    struct in6_addr a6 = *nmtst_inet6_from_string("::");
+    char            buf[NM_UTILS_INET_ADDRSTRLEN];
+    NMIPAddr        a = NM_IP_ADDR_INIT;
+
+    g_assert(memcmp(&a, &nm_ip_addr_zero, sizeof(a)) == 0);
+
+    g_assert(IN6_IS_ADDR_UNSPECIFIED(&nm_ip_addr_zero.addr6));
+    g_assert(memcmp(&nm_ip_addr_zero.addr6, &in6addr_any, sizeof(in6addr_any)) == 0);
+
+    g_assert(memcmp(&nm_ip_addr_zero, &a4, sizeof(a4)) == 0);
+    g_assert(memcmp(&nm_ip_addr_zero, &a6, sizeof(a6)) == 0);
+
+    g_assert_cmpstr(_nm_utils_inet4_ntop(nm_ip_addr_zero.addr4, buf), ==, "0.0.0.0");
+    g_assert_cmpstr(_nm_utils_inet6_ntop(&nm_ip_addr_zero.addr6, buf), ==, "::");
+
+    g_assert_cmpstr(nm_utils_inet_ntop(AF_INET, &nm_ip_addr_zero, buf), ==, "0.0.0.0");
+    g_assert_cmpstr(nm_utils_inet_ntop(AF_INET6, &nm_ip_addr_zero, buf), ==, "::");
+
+    G_STATIC_ASSERT_EXPR(sizeof(a) == sizeof(a.array));
+}
+
+static void
+test_connection_ovs_ifname(gconstpointer test_data)
+{
+    const guint     TEST_CASE                    = GPOINTER_TO_UINT(test_data);
+    gs_unref_object NMConnection *con            = NULL;
+    NMSettingConnection *         s_con          = NULL;
+    NMSettingOvsBridge *          s_ovs_bridge   = NULL;
+    NMSettingOvsPort *            s_ovs_port     = NULL;
+    NMSettingOvsInterface *       s_ovs_iface    = NULL;
+    NMSettingOvsPatch *           s_ovs_patch    = NULL;
+    const char *                  ovs_iface_type = NULL;
+
+    switch (TEST_CASE) {
+    case 1:
+        con          = nmtst_create_minimal_connection("test_connection_ovs_ifname_bridge",
+                                              NULL,
+                                              NM_SETTING_OVS_BRIDGE_SETTING_NAME,
+                                              &s_con);
+        s_ovs_bridge = nm_connection_get_setting_ovs_bridge(con);
+        g_assert(s_ovs_bridge);
+        break;
+    case 2:
+        con = nmtst_create_minimal_connection("test_connection_ovs_ifname_port",
+                                              NULL,
+                                              NM_SETTING_OVS_PORT_SETTING_NAME,
+                                              &s_con);
+
+        g_object_set(s_con,
+                     NM_SETTING_CONNECTION_MASTER,
+                     "master0",
+                     NM_SETTING_CONNECTION_SLAVE_TYPE,
+                     NM_SETTING_OVS_BRIDGE_SETTING_NAME,
+                     NULL);
+
+        s_ovs_port = nm_connection_get_setting_ovs_port(con);
+        g_assert(s_ovs_port);
+        break;
+    case 3:
+        con         = nmtst_create_minimal_connection("test_connection_ovs_ifname_interface_patch",
+                                              NULL,
+                                              NM_SETTING_OVS_INTERFACE_SETTING_NAME,
+                                              &s_con);
+        s_ovs_iface = nm_connection_get_setting_ovs_interface(con);
+        g_assert(s_ovs_iface);
+
+        g_object_set(s_con,
+                     NM_SETTING_CONNECTION_MASTER,
+                     "master0",
+                     NM_SETTING_CONNECTION_SLAVE_TYPE,
+                     NM_SETTING_OVS_PORT_SETTING_NAME,
+                     NULL);
+
+        g_object_set(s_ovs_iface, NM_SETTING_OVS_INTERFACE_TYPE, "patch", NULL);
+
+        s_ovs_patch = NM_SETTING_OVS_PATCH(nm_setting_ovs_patch_new());
+        g_assert(s_ovs_patch);
+
+        g_object_set(s_ovs_patch, NM_SETTING_OVS_PATCH_PEER, "1.2.3.4", NULL);
+
+        nm_connection_add_setting(con, NM_SETTING(s_ovs_patch));
+        s_ovs_patch = nm_connection_get_setting_ovs_patch(con);
+        g_assert(s_ovs_patch);
+        ovs_iface_type = "patch";
+        break;
+    case 4:
+        con = nmtst_create_minimal_connection("test_connection_ovs_ifname_interface_internal",
+                                              NULL,
+                                              NM_SETTING_OVS_INTERFACE_SETTING_NAME,
+                                              &s_con);
+        s_ovs_iface = nm_connection_get_setting_ovs_interface(con);
+        g_assert(s_ovs_iface);
+
+        g_object_set(s_con,
+                     NM_SETTING_CONNECTION_MASTER,
+                     "master0",
+                     NM_SETTING_CONNECTION_SLAVE_TYPE,
+                     NM_SETTING_OVS_PORT_SETTING_NAME,
+                     NULL);
+
+        g_object_set(s_ovs_iface, NM_SETTING_OVS_INTERFACE_TYPE, "internal", NULL);
+        ovs_iface_type = "internal";
+        break;
+    case 5:
+        con = nmtst_create_minimal_connection("test_connection_ovs_ifname_interface_system",
+                                              NULL,
+                                              NM_SETTING_WIRED_SETTING_NAME,
+                                              &s_con);
+
+        g_object_set(s_con,
+                     NM_SETTING_CONNECTION_MASTER,
+                     "master0",
+                     NM_SETTING_CONNECTION_SLAVE_TYPE,
+                     NM_SETTING_OVS_PORT_SETTING_NAME,
+                     NULL);
+
+        s_ovs_iface = NM_SETTING_OVS_INTERFACE(nm_setting_ovs_interface_new());
+        g_assert(s_ovs_iface);
+
+        g_object_set(s_ovs_iface, NM_SETTING_OVS_INTERFACE_TYPE, "system", NULL);
+
+        nm_connection_add_setting(con, NM_SETTING(s_ovs_iface));
+        s_ovs_iface = nm_connection_get_setting_ovs_interface(con);
+        g_assert(s_ovs_iface);
+
+        ovs_iface_type = "system";
+        break;
+    case 6:
+        con         = nmtst_create_minimal_connection("test_connection_ovs_ifname_interface_dpdk",
+                                              NULL,
+                                              NM_SETTING_OVS_INTERFACE_SETTING_NAME,
+                                              &s_con);
+        s_ovs_iface = nm_connection_get_setting_ovs_interface(con);
+        g_assert(s_ovs_iface);
+
+        g_object_set(s_con,
+                     NM_SETTING_CONNECTION_MASTER,
+                     "master0",
+                     NM_SETTING_CONNECTION_SLAVE_TYPE,
+                     NM_SETTING_OVS_PORT_SETTING_NAME,
+                     NULL);
+
+        g_object_set(s_ovs_iface, NM_SETTING_OVS_INTERFACE_TYPE, "dpdk", NULL);
+        ovs_iface_type = "dpdk";
+        break;
+    }
+
+    if (!nm_streq0(ovs_iface_type, "system")) {
+        /* wrong: contains backward slash */
+        g_object_set(s_con, NM_SETTING_CONNECTION_INTERFACE_NAME, "ovs\\0", NULL);
+        nmtst_assert_connection_unnormalizable(con,
+                                               NM_CONNECTION_ERROR,
+                                               NM_CONNECTION_ERROR_INVALID_PROPERTY);
+
+        /* wrong: contains forward slash */
+        g_object_set(s_con, NM_SETTING_CONNECTION_INTERFACE_NAME, "ovs/0", NULL);
+        nmtst_assert_connection_unnormalizable(con,
+                                               NM_CONNECTION_ERROR,
+                                               NM_CONNECTION_ERROR_INVALID_PROPERTY);
+    }
+
+    /* wrong: contains space */
+    g_object_set(s_con, NM_SETTING_CONNECTION_INTERFACE_NAME, "ovs 0", NULL);
+    nmtst_assert_connection_unnormalizable(con,
+                                           NM_CONNECTION_ERROR,
+                                           NM_CONNECTION_ERROR_INVALID_PROPERTY);
+
+    /* good */
+    g_object_set(s_con, NM_SETTING_CONNECTION_INTERFACE_NAME, "ovs0", NULL);
+    nmtst_assert_connection_verifies(con);
+
+    g_object_set(s_con, NM_SETTING_CONNECTION_INTERFACE_NAME, "ovs-br0", NULL);
+    nmtst_assert_connection_verifies(con);
+
+    /* good if bridge, port, or patch interface */
+    g_object_set(s_con, NM_SETTING_CONNECTION_INTERFACE_NAME, "ovs123123123123130123123", NULL);
+
+    if (!ovs_iface_type || nm_streq(ovs_iface_type, "patch"))
+        nmtst_assert_connection_verifies(con);
+    else {
+        nmtst_assert_connection_unnormalizable(con,
+                                               NM_CONNECTION_ERROR,
+                                               NM_CONNECTION_ERROR_INVALID_PROPERTY);
+    }
+}
+
+/*****************************************************************************/
+
+static gboolean
+_strsplit_quoted_char_needs_escaping(char ch)
+{
+    return NM_IN_SET(ch, '\'', '\"', '\\') || strchr(NM_ASCII_WHITESPACES, ch);
+}
+
+static char *
+_strsplit_quoted_create_str_rand(gssize len)
+{
+    NMStrBuf strbuf = NM_STR_BUF_INIT(nmtst_get_rand_uint32() % 200, nmtst_get_rand_bool());
+
+    g_assert(len >= -1);
+
+    if (len == -1)
+        len = nmtst_get_rand_word_length(NULL);
+
+    while (len-- > 0) {
+        char ch;
+
+        ch = nmtst_rand_select('a', ' ', '\\', '"', '\'', nmtst_get_rand_uint32() % 255 + 1);
+        g_assert(ch);
+        nm_str_buf_append_c(&strbuf, ch);
+    }
+
+    if (!strbuf.allocated)
+        nm_str_buf_maybe_expand(&strbuf, 1, nmtst_get_rand_bool());
+    return nm_str_buf_finalize(&strbuf, NULL);
+}
+
+static char **
+_strsplit_quoted_create_strv_rand(void)
+{
+    guint  len = nmtst_get_rand_word_length(NULL);
+    char **ptr;
+    guint  i;
+
+    ptr = g_new(char *, len + 1);
+    for (i = 0; i < len; i++)
+        ptr[i] = _strsplit_quoted_create_str_rand(-1);
+    ptr[i] = NULL;
+    return ptr;
+}
+
+static char *
+_strsplit_quoted_join_strv_rand(const char *const *strv)
+{
+    NMStrBuf strbuf = NM_STR_BUF_INIT(nmtst_get_rand_uint32() % 200, nmtst_get_rand_bool());
+    char *   result;
+    gsize    l;
+    gsize    l2;
+    gsize *  p_l2 = nmtst_get_rand_bool() ? &l2 : NULL;
+    gsize    i;
+
+    g_assert(strv);
+
+    nm_str_buf_append_c_repeated(&strbuf, ' ', nmtst_get_rand_word_length(NULL) / 4);
+    for (i = 0; strv[i]; i++) {
+        const char *s = strv[i];
+        gsize       j;
+        char        quote;
+
+        nm_str_buf_append_c_repeated(&strbuf, ' ', 1 + nmtst_get_rand_word_length(NULL) / 4);
+
+        j     = 0;
+        quote = '\0';
+        while (TRUE) {
+            char ch = s[j++];
+
+            /* extract_first_word*/
+            if (quote != '\0') {
+                if (ch == '\0') {
+                    nm_str_buf_append_c(&strbuf, quote);
+                    break;
+                }
+                if (ch == quote || ch == '\\' || nmtst_get_rand_uint32() % 5 == 0)
+                    nm_str_buf_append_c(&strbuf, '\\');
+                nm_str_buf_append_c(&strbuf, ch);
+                if (nmtst_get_rand_uint32() % 3 == 0) {
+                    nm_str_buf_append_c(&strbuf, quote);
+                    quote = '\0';
+                    goto next_maybe_quote;
+                }
+                continue;
+            }
+
+            if (ch == '\0') {
+                if (s == strv[i]) {
+                    quote = nmtst_rand_select('\'', '"');
+                    nm_str_buf_append_c_repeated(&strbuf, quote, 2);
+                }
+                break;
+            }
+
+            if (_strsplit_quoted_char_needs_escaping(ch) || nmtst_get_rand_uint32() % 5 == 0)
+                nm_str_buf_append_c(&strbuf, '\\');
+
+            nm_str_buf_append_c(&strbuf, ch);
+
+next_maybe_quote:
+            if (nmtst_get_rand_uint32() % 5 == 0) {
+                quote = nmtst_rand_select('\'', '\"');
+                nm_str_buf_append_c(&strbuf, quote);
+                if (nmtst_get_rand_uint32() % 5 == 0) {
+                    nm_str_buf_append_c(&strbuf, quote);
+                    quote = '\0';
+                }
+            }
+        }
+    }
+    nm_str_buf_append_c_repeated(&strbuf, ' ', nmtst_get_rand_word_length(NULL) / 4);
+
+    nm_str_buf_maybe_expand(&strbuf, 1, nmtst_get_rand_bool());
+
+    l      = strbuf.len;
+    result = nm_str_buf_finalize(&strbuf, p_l2);
+    g_assert(!p_l2 || l == *p_l2);
+    g_assert(strlen(result) == l);
+    return result;
+}
+
+static void
+_strsplit_quoted_assert_strv(const char *       topic,
+                             const char *       str,
+                             const char *const *strv1,
+                             const char *const *strv2)
+{
+    nm_auto_str_buf NMStrBuf s1          = {};
+    nm_auto_str_buf NMStrBuf s2          = {};
+    gs_free char *           str_escaped = NULL;
+    int                      i;
+
+    g_assert(str);
+    g_assert(strv1);
+    g_assert(strv2);
+
+    if (nm_utils_strv_equal(strv1, strv2))
+        return;
+
+    for (i = 0; strv1[i]; i++) {
+        gs_free char *s = g_strescape(strv1[i], NULL);
+
+        g_print(">>> [%s] strv1[%d] = \"%s\"\n", topic, i, s);
+        if (i > 0)
+            nm_str_buf_append_c(&s1, ' ');
+        nm_str_buf_append_printf(&s1, "\"%s\"", s);
+    }
+
+    for (i = 0; strv2[i]; i++) {
+        gs_free char *s = g_strescape(strv2[i], NULL);
+
+        g_print(">>> [%s] strv2[%d] = \"%s\"\n", topic, i, s);
+        if (i > 0)
+            nm_str_buf_append_c(&s2, ' ');
+        nm_str_buf_append_printf(&s2, "\"%s\"", s);
+    }
+
+    nm_str_buf_maybe_expand(&s1, 1, FALSE);
+    nm_str_buf_maybe_expand(&s2, 1, FALSE);
+
+    str_escaped = g_strescape(str, NULL);
+    g_error("compared words differs: [%s] str=\"%s\"; strv1=%s; strv2=%s",
+            topic,
+            str_escaped,
+            nm_str_buf_get_str(&s1),
+            nm_str_buf_get_str(&s2));
+}
+
+static void
+_strsplit_quoted_test(const char *str, const char *const *strv_expected)
+{
+    gs_strfreev char **strv_systemd = NULL;
+    gs_strfreev char **strv_nm      = NULL;
+    int                r;
+
+    g_assert(str);
+
+    r = nmtst_systemd_extract_first_word_all(str, &strv_systemd);
+    g_assert_cmpint(r, ==, 1);
+    g_assert(strv_systemd);
+
+    if (!strv_expected)
+        strv_expected = (const char *const *) strv_systemd;
+
+    _strsplit_quoted_assert_strv("systemd", str, strv_expected, (const char *const *) strv_systemd);
+
+    strv_nm = nm_utils_strsplit_quoted(str);
+    g_assert(strv_nm);
+    _strsplit_quoted_assert_strv("nm", str, strv_expected, (const char *const *) strv_nm);
+}
+
+static void
+test_strsplit_quoted(void)
+{
+    int i_run;
+
+    _strsplit_quoted_test("", NM_MAKE_STRV());
+    _strsplit_quoted_test(" ", NM_MAKE_STRV());
+    _strsplit_quoted_test("  ", NM_MAKE_STRV());
+    _strsplit_quoted_test("  \t", NM_MAKE_STRV());
+    _strsplit_quoted_test("a b", NM_MAKE_STRV("a", "b"));
+    _strsplit_quoted_test("a\\ b", NM_MAKE_STRV("a b"));
+    _strsplit_quoted_test(" a\\ \"b\"", NM_MAKE_STRV("a b"));
+    _strsplit_quoted_test(" a\\ \"b\" c \n", NM_MAKE_STRV("a b", "c"));
+
+    for (i_run = 0; i_run < 1000; i_run++) {
+        gs_strfreev char **strv = NULL;
+        gs_free char *     str  = NULL;
+
+        /* create random strv array and join them carefully so that splitting
+         * them will yield the original value. */
+        strv = _strsplit_quoted_create_strv_rand();
+        str  = _strsplit_quoted_join_strv_rand((const char *const *) strv);
+        _strsplit_quoted_test(str, (const char *const *) strv);
+    }
+
+    /* Create random words and assert that systemd and our implementation can
+     * both split them (and in the exact same way). */
+    for (i_run = 0; i_run < 1000; i_run++) {
+        gs_free char *s = _strsplit_quoted_create_str_rand(nmtst_get_rand_uint32() % 150);
+
+        _strsplit_quoted_test(s, NULL);
+    }
+}
+
+/*****************************************************************************/
+
+static void
+_do_wifi_ghz_freqs(const guint *freqs, const char *band)
+{
+    int len;
+    int j;
+    int i;
+
+    g_assert(NM_IN_STRSET(band, "a", "bg"));
+    g_assert(freqs);
+    g_assert(freqs[0] != 0);
+
+    for (i = 0; freqs[i]; i++) {
+        for (j = 0; j < i; j++)
+            g_assert(freqs[i] != freqs[j]);
+    }
+    len = i;
+
+    g_assert(nm_utils_wifi_freq_to_channel(0) == 0);
+    g_assert(nm_utils_wifi_channel_to_freq(0, "bg") == -1);
+    g_assert(nm_utils_wifi_channel_to_freq(0, "foo") == 0);
+    g_assert(!nm_utils_wifi_is_channel_valid(0, "bg"));
+    g_assert(!nm_utils_wifi_is_channel_valid(0, "foo"));
+
+    for (i = 0; i < len; i++) {
+        guint   freq = freqs[i];
+        guint32 chan;
+        guint32 freq2;
+
+        chan = nm_utils_wifi_freq_to_channel(freq);
+        g_assert(chan != 0);
+
+        freq2 = nm_utils_wifi_channel_to_freq(chan, band);
+        g_assert(freq2 == freq);
+
+        g_assert(nm_utils_wifi_is_channel_valid(chan, band));
+    }
+
+    g_assert(freqs[len] == 0);
+}
+
+static void
+test_nm_utils_wifi_ghz_freqs(void)
+{
+    _do_wifi_ghz_freqs(nm_utils_wifi_2ghz_freqs(), "bg");
+    _do_wifi_ghz_freqs(nm_utils_wifi_5ghz_freqs(), "a");
+}
+
+/*****************************************************************************/
+
+static void
+test_vpn_connection_state_reason(void)
+{
+#define ASSERT(v1, v2)                                                 \
+    G_STMT_START                                                       \
+    {                                                                  \
+        G_STATIC_ASSERT((gint64) (v1) == v2);                          \
+        G_STATIC_ASSERT((gint64) (v2) == v1);                          \
+                                                                       \
+        nm_assert(((NMActiveConnectionStateReason) (int) (v1)) == v2); \
+        nm_assert(((NMVpnConnectionStateReason) (int) (v2)) == v1);    \
+    }                                                                  \
+    G_STMT_END
+
+    ASSERT(NM_VPN_CONNECTION_STATE_REASON_UNKNOWN, NM_ACTIVE_CONNECTION_STATE_REASON_UNKNOWN);
+    ASSERT(NM_VPN_CONNECTION_STATE_REASON_NONE, NM_ACTIVE_CONNECTION_STATE_REASON_NONE);
+    ASSERT(NM_VPN_CONNECTION_STATE_REASON_USER_DISCONNECTED,
+           NM_ACTIVE_CONNECTION_STATE_REASON_USER_DISCONNECTED);
+    ASSERT(NM_VPN_CONNECTION_STATE_REASON_DEVICE_DISCONNECTED,
+           NM_ACTIVE_CONNECTION_STATE_REASON_DEVICE_DISCONNECTED);
+    ASSERT(NM_VPN_CONNECTION_STATE_REASON_SERVICE_STOPPED,
+           NM_ACTIVE_CONNECTION_STATE_REASON_SERVICE_STOPPED);
+    ASSERT(NM_VPN_CONNECTION_STATE_REASON_IP_CONFIG_INVALID,
+           NM_ACTIVE_CONNECTION_STATE_REASON_IP_CONFIG_INVALID);
+    ASSERT(NM_VPN_CONNECTION_STATE_REASON_CONNECT_TIMEOUT,
+           NM_ACTIVE_CONNECTION_STATE_REASON_CONNECT_TIMEOUT);
+    ASSERT(NM_VPN_CONNECTION_STATE_REASON_SERVICE_START_TIMEOUT,
+           NM_ACTIVE_CONNECTION_STATE_REASON_SERVICE_START_TIMEOUT);
+    ASSERT(NM_VPN_CONNECTION_STATE_REASON_SERVICE_START_FAILED,
+           NM_ACTIVE_CONNECTION_STATE_REASON_SERVICE_START_FAILED);
+    ASSERT(NM_VPN_CONNECTION_STATE_REASON_NO_SECRETS, NM_ACTIVE_CONNECTION_STATE_REASON_NO_SECRETS);
+    ASSERT(NM_VPN_CONNECTION_STATE_REASON_LOGIN_FAILED,
+           NM_ACTIVE_CONNECTION_STATE_REASON_LOGIN_FAILED);
+    ASSERT(NM_VPN_CONNECTION_STATE_REASON_CONNECTION_REMOVED,
+           NM_ACTIVE_CONNECTION_STATE_REASON_CONNECTION_REMOVED);
+}
+
+/*****************************************************************************/
+
+NMTST_DEFINE();
+
+int
+main(int argc, char **argv)
+{
+    nmtst_init(&argc, &argv, TRUE);
+
+    g_test_add_func("/core/general/test_nm_ascii_spaces", test_nm_ascii_spaces);
+    g_test_add_func("/core/general/test_wired_wake_on_lan_enum", test_wired_wake_on_lan_enum);
+    g_test_add_func("/core/general/test_wireless_wake_on_wlan_enum",
+                    test_wireless_wake_on_wlan_enum);
+    g_test_add_func("/core/general/test_device_wifi_capabilities", test_device_wifi_capabilities);
+    g_test_add_func("/core/general/test_80211_mode", test_80211_mode);
+    g_test_add_func("/core/general/test_vlan_flags", test_vlan_flags);
+    g_test_add_func("/core/general/test_nm_hash", test_nm_hash);
+    g_test_add_func("/core/general/test_nm_g_slice_free_fcn", test_nm_g_slice_free_fcn);
+    g_test_add_func("/core/general/test_c_list_sort", test_c_list_sort);
+    g_test_add_func("/core/general/test_dedup_multi", test_dedup_multi);
+    g_test_add_func("/core/general/test_utils_str_utf8safe", test_utils_str_utf8safe);
+    g_test_add_func("/core/general/test_nm_utils_strsplit_set", test_nm_utils_strsplit_set);
+    g_test_add_func("/core/general/test_nm_utils_escaped_tokens", test_nm_utils_escaped_tokens);
+    g_test_add_func("/core/general/test_nm_in_set", test_nm_in_set);
+    g_test_add_func("/core/general/test_nm_in_strset", test_nm_in_strset);
+    g_test_add_func("/core/general/test_setting_vpn_items", test_setting_vpn_items);
+    g_test_add_func("/core/general/test_setting_vpn_update_secrets",
+                    test_setting_vpn_update_secrets);
+    g_test_add_func("/core/general/test_setting_vpn_modify_during_foreach",
+                    test_setting_vpn_modify_during_foreach);
+    g_test_add_func("/core/general/test_setting_ip4_config_labels", test_setting_ip4_config_labels);
+    g_test_add_func("/core/general/test_setting_ip4_config_address_data",
+                    test_setting_ip4_config_address_data);
+    g_test_add_func("/core/general/test_setting_ip_route_attributes",
+                    test_setting_ip_route_attributes);
+    g_test_add_func("/core/general/test_setting_gsm_apn_spaces", test_setting_gsm_apn_spaces);
+    g_test_add_func("/core/general/test_setting_gsm_apn_bad_chars", test_setting_gsm_apn_bad_chars);
+    g_test_add_func("/core/general/test_setting_gsm_apn_underscore",
+                    test_setting_gsm_apn_underscore);
+    g_test_add_func("/core/general/test_setting_gsm_without_number",
+                    test_setting_gsm_without_number);
+    g_test_add_func("/core/general/test_setting_gsm_sim_operator_id",
+                    test_setting_gsm_sim_operator_id);
+    g_test_add_func("/core/general/test_setting_to_dbus_all", test_setting_to_dbus_all);
+    g_test_add_func("/core/general/test_setting_to_dbus_no_secrets",
+                    test_setting_to_dbus_no_secrets);
+    g_test_add_func("/core/general/test_setting_to_dbus_only_secrets",
+                    test_setting_to_dbus_only_secrets);
+    g_test_add_func("/core/general/test_setting_to_dbus_transform", test_setting_to_dbus_transform);
+    g_test_add_func("/core/general/test_setting_to_dbus_enum", test_setting_to_dbus_enum);
+    g_test_add_func("/core/general/test_setting_compare_id", test_setting_compare_id);
+    g_test_add_func("/core/general/test_setting_compare_addresses", test_setting_compare_addresses);
+    g_test_add_func("/core/general/test_setting_compare_routes", test_setting_compare_routes);
+    g_test_add_func("/core/general/test_setting_compare_wired_cloned_mac_address",
+                    test_setting_compare_wired_cloned_mac_address);
+    g_test_add_func("/core/general/test_setting_compare_wirless_cloned_mac_address",
+                    test_setting_compare_wireless_cloned_mac_address);
+    g_test_add_func("/core/general/test_setting_compare_timestamp", test_setting_compare_timestamp);
+#define ADD_FUNC(name, func, secret_flags, comp_flags, remove_secret)           \
+    g_test_add_data_func_full(                                                  \
+        "/core/general/" G_STRINGIFY(func) "_" name,                            \
+        test_data_compare_secrets_new(secret_flags, comp_flags, remove_secret), \
+        func,                                                                   \
+        g_free)
+    ADD_FUNC("agent_owned",
+             test_setting_compare_secrets,
+             NM_SETTING_SECRET_FLAG_AGENT_OWNED,
+             NM_SETTING_COMPARE_FLAG_IGNORE_AGENT_OWNED_SECRETS,
+             TRUE);
+    ADD_FUNC("not_saved",
+             test_setting_compare_secrets,
+             NM_SETTING_SECRET_FLAG_NOT_SAVED,
+             NM_SETTING_COMPARE_FLAG_IGNORE_NOT_SAVED_SECRETS,
+             TRUE);
+    ADD_FUNC("secrets",
+             test_setting_compare_secrets,
+             NM_SETTING_SECRET_FLAG_NONE,
+             NM_SETTING_COMPARE_FLAG_IGNORE_SECRETS,
+             TRUE);
+    ADD_FUNC("exact",
+             test_setting_compare_secrets,
+             NM_SETTING_SECRET_FLAG_NONE,
+             NM_SETTING_COMPARE_FLAG_EXACT,
+             FALSE);
+    ADD_FUNC("agent_owned",
+             test_setting_compare_vpn_secrets,
+             NM_SETTING_SECRET_FLAG_AGENT_OWNED,
+             NM_SETTING_COMPARE_FLAG_IGNORE_AGENT_OWNED_SECRETS,
+             TRUE);
+    ADD_FUNC("not_saved",
+             test_setting_compare_vpn_secrets,
+             NM_SETTING_SECRET_FLAG_NOT_SAVED,
+             NM_SETTING_COMPARE_FLAG_IGNORE_NOT_SAVED_SECRETS,
+             TRUE);
+    ADD_FUNC("secrets",
+             test_setting_compare_vpn_secrets,
+             NM_SETTING_SECRET_FLAG_NONE,
+             NM_SETTING_COMPARE_FLAG_IGNORE_SECRETS,
+             TRUE);
+    ADD_FUNC("exact",
+             test_setting_compare_vpn_secrets,
+             NM_SETTING_SECRET_FLAG_NONE,
+             NM_SETTING_COMPARE_FLAG_EXACT,
+             FALSE);
+    g_test_add_func("/core/general/test_setting_old_uuid", test_setting_old_uuid);
+
+    g_test_add_func("/core/general/test_connection_to_dbus_setting_name",
+                    test_connection_to_dbus_setting_name);
+    g_test_add_func("/core/general/test_connection_to_dbus_deprecated_props",
+                    test_connection_to_dbus_deprecated_props);
+    g_test_add_func("/core/general/test_setting_new_from_dbus", test_setting_new_from_dbus);
+    g_test_add_func("/core/general/test_setting_new_from_dbus_transform",
+                    test_setting_new_from_dbus_transform);
+    g_test_add_func("/core/general/test_setting_new_from_dbus_enum",
+                    test_setting_new_from_dbus_enum);
+    g_test_add_func("/core/general/test_setting_new_from_dbus_bad", test_setting_new_from_dbus_bad);
+    g_test_add_func("/core/general/test_connection_replace_settings",
+                    test_connection_replace_settings);
+    g_test_add_func("/core/general/test_connection_replace_settings_from_connection",
+                    test_connection_replace_settings_from_connection);
+    g_test_add_func("/core/general/test_connection_replace_settings_bad",
+                    test_connection_replace_settings_bad);
+    g_test_add_func("/core/general/test_connection_new_from_dbus", test_connection_new_from_dbus);
+    g_test_add_func("/core/general/test_connection_normalize_virtual_iface_name",
+                    test_connection_normalize_virtual_iface_name);
+    g_test_add_func("/core/general/test_connection_normalize_uuid", test_connection_normalize_uuid);
+    g_test_add_func("/core/general/test_connection_normalize_type", test_connection_normalize_type);
+    g_test_add_func("/core/general/test_connection_normalize_slave_type_1",
+                    test_connection_normalize_slave_type_1);
+    g_test_add_func("/core/general/test_connection_normalize_slave_type_2",
+                    test_connection_normalize_slave_type_2);
+    g_test_add_func("/core/general/test_connection_normalize_infiniband_mtu",
+                    test_connection_normalize_infiniband_mtu);
+    g_test_add_func("/core/general/test_connection_normalize_gateway_never_default",
+                    test_connection_normalize_gateway_never_default);
+    g_test_add_func("/core/general/test_connection_normalize_may_fail",
+                    test_connection_normalize_may_fail);
+    g_test_add_func("/core/general/test_connection_normalize_shared_addresses",
+                    test_connection_normalize_shared_addresses);
+    g_test_add_data_func("/core/general/test_connection_normalize_ovs_interface_type_system/1",
+                         GUINT_TO_POINTER(1),
+                         test_connection_normalize_ovs_interface_type_system);
+    g_test_add_data_func("/core/general/test_connection_normalize_ovs_interface_type_system/2",
+                         GUINT_TO_POINTER(2),
+                         test_connection_normalize_ovs_interface_type_system);
+    g_test_add_data_func("/core/general/test_connection_normalize_ovs_interface_type_system/3",
+                         GUINT_TO_POINTER(3),
+                         test_connection_normalize_ovs_interface_type_system);
+    g_test_add_data_func("/core/general/test_connection_normalize_ovs_interface_type_system/4",
+                         GUINT_TO_POINTER(4),
+                         test_connection_normalize_ovs_interface_type_system);
+    g_test_add_data_func("/core/general/test_connection_normalize_ovs_interface_type_system/5",
+                         GUINT_TO_POINTER(5),
+                         test_connection_normalize_ovs_interface_type_system);
+    g_test_add_data_func("/core/general/test_connection_normalize_ovs_interface_type_system/6",
+                         GUINT_TO_POINTER(6),
+                         test_connection_normalize_ovs_interface_type_system);
+    g_test_add_data_func("/core/general/test_connection_normalize_ovs_interface_type_system/7",
+                         GUINT_TO_POINTER(7),
+                         test_connection_normalize_ovs_interface_type_system);
+    g_test_add_data_func(
+        "/core/general/test_connection_normalize_ovs_interface_type_ovs_interface/1",
+        GUINT_TO_POINTER(1),
+        test_connection_normalize_ovs_interface_type_ovs_interface);
+    g_test_add_data_func(
+        "/core/general/test_connection_normalize_ovs_interface_type_ovs_interface/2",
+        GUINT_TO_POINTER(2),
+        test_connection_normalize_ovs_interface_type_ovs_interface);
+    g_test_add_data_func(
+        "/core/general/test_connection_normalize_ovs_interface_type_ovs_interface/3",
+        GUINT_TO_POINTER(3),
+        test_connection_normalize_ovs_interface_type_ovs_interface);
+    g_test_add_data_func(
+        "/core/general/test_connection_normalize_ovs_interface_type_ovs_interface/4",
+        GUINT_TO_POINTER(4),
+        test_connection_normalize_ovs_interface_type_ovs_interface);
+    g_test_add_data_func(
+        "/core/general/test_connection_normalize_ovs_interface_type_ovs_interface/5",
+        GUINT_TO_POINTER(5),
+        test_connection_normalize_ovs_interface_type_ovs_interface);
+    g_test_add_data_func(
+        "/core/general/test_connection_normalize_ovs_interface_type_ovs_interface/6",
+        GUINT_TO_POINTER(6),
+        test_connection_normalize_ovs_interface_type_ovs_interface);
+    g_test_add_data_func(
+        "/core/general/test_connection_normalize_ovs_interface_type_ovs_interface/7",
+        GUINT_TO_POINTER(7),
+        test_connection_normalize_ovs_interface_type_ovs_interface);
+    g_test_add_data_func(
+        "/core/general/test_connection_normalize_ovs_interface_type_ovs_interface/8",
+        GUINT_TO_POINTER(8),
+        test_connection_normalize_ovs_interface_type_ovs_interface);
+    g_test_add_data_func(
+        "/core/general/test_connection_normalize_ovs_interface_type_ovs_interface/9",
+        GUINT_TO_POINTER(9),
+        test_connection_normalize_ovs_interface_type_ovs_interface);
+    g_test_add_data_func(
+        "/core/general/test_connection_normalize_ovs_interface_type_ovs_interface/10",
+        GUINT_TO_POINTER(10),
+        test_connection_normalize_ovs_interface_type_ovs_interface);
+    g_test_add_data_func(
+        "/core/general/test_connection_normalize_ovs_interface_type_ovs_interface/11",
+        GUINT_TO_POINTER(11),
+        test_connection_normalize_ovs_interface_type_ovs_interface);
+    g_test_add_data_func(
+        "/core/general/test_connection_normalize_ovs_interface_type_ovs_interface/12",
+        GUINT_TO_POINTER(12),
+        test_connection_normalize_ovs_interface_type_ovs_interface);
+
+    g_test_add_data_func("/core/general/test_connection_ovs_ifname/1",
+                         GUINT_TO_POINTER(1),
+                         test_connection_ovs_ifname);
+    g_test_add_data_func("/core/general/test_connection_ovs_ifname/2",
+                         GUINT_TO_POINTER(2),
+                         test_connection_ovs_ifname);
+    g_test_add_data_func("/core/general/test_connection_ovs_ifname/3",
+                         GUINT_TO_POINTER(3),
+                         test_connection_ovs_ifname);
+    g_test_add_data_func("/core/general/test_connection_ovs_ifname/4",
+                         GUINT_TO_POINTER(4),
+                         test_connection_ovs_ifname);
+    g_test_add_data_func("/core/general/test_connection_ovs_ifname/5",
+                         GUINT_TO_POINTER(5),
+                         test_connection_ovs_ifname);
+    g_test_add_data_func("/core/general/test_connection_ovs_ifname/6",
+                         GUINT_TO_POINTER(6),
+                         test_connection_ovs_ifname);
+
+    g_test_add_func("/core/general/test_setting_connection_permissions_helpers",
+                    test_setting_connection_permissions_helpers);
+    g_test_add_func("/core/general/test_setting_connection_permissions_property",
+                    test_setting_connection_permissions_property);
+
+    g_test_add_func("/core/general/test_connection_compare_same", test_connection_compare_same);
+    g_test_add_func("/core/general/test_connection_compare_key_only_in_a",
+                    test_connection_compare_key_only_in_a);
+    g_test_add_func("/core/general/test_connection_compare_setting_only_in_a",
+                    test_connection_compare_setting_only_in_a);
+    g_test_add_func("/core/general/test_connection_compare_key_only_in_b",
+                    test_connection_compare_key_only_in_b);
+    g_test_add_func("/core/general/test_connection_compare_setting_only_in_b",
+                    test_connection_compare_setting_only_in_b);
+
+    g_test_add_func("/core/general/test_connection_diff_a_only", test_connection_diff_a_only);
+    g_test_add_func("/core/general/test_connection_diff_same", test_connection_diff_same);
+    g_test_add_func("/core/general/test_connection_diff_different", test_connection_diff_different);
+    g_test_add_func("/core/general/test_connection_diff_no_secrets",
+                    test_connection_diff_no_secrets);
+    g_test_add_func("/core/general/test_connection_diff_inferrable",
+                    test_connection_diff_inferrable);
+    g_test_add_func("/core/general/test_connection_good_base_types",
+                    test_connection_good_base_types);
+    g_test_add_func("/core/general/test_connection_bad_base_types", test_connection_bad_base_types);
+
+    g_test_add_func("/core/general/test_hwaddr_aton_ether_normal", test_hwaddr_aton_ether_normal);
+    g_test_add_func("/core/general/test_hwaddr_aton_ib_normal", test_hwaddr_aton_ib_normal);
+    g_test_add_func("/core/general/test_hwaddr_aton_no_leading_zeros",
+                    test_hwaddr_aton_no_leading_zeros);
+    g_test_add_func("/core/general/test_hwaddr_aton_malformed", test_hwaddr_aton_malformed);
+    g_test_add_func("/core/general/test_hwaddr_equal", test_hwaddr_equal);
+    g_test_add_func("/core/general/test_hwaddr_canonical", test_hwaddr_canonical);
+
+    g_test_add_func("/core/general/test_ip4_prefix_to_netmask", test_ip4_prefix_to_netmask);
+    g_test_add_func("/core/general/test_ip4_netmask_to_prefix", test_ip4_netmask_to_prefix);
+
+    g_test_add_func("/core/general/test_connection_changed_signal", test_connection_changed_signal);
+    g_test_add_func("/core/general/test_setting_connection_changed_signal",
+                    test_setting_connection_changed_signal);
+    g_test_add_func("/core/general/test_setting_bond_changed_signal",
+                    test_setting_bond_changed_signal);
+    g_test_add_func("/core/general/test_setting_ip4_changed_signal",
+                    test_setting_ip4_changed_signal);
+    g_test_add_func("/core/general/test_setting_ip6_changed_signal",
+                    test_setting_ip6_changed_signal);
+    g_test_add_func("/core/general/test_setting_vlan_changed_signal",
+                    test_setting_vlan_changed_signal);
+    g_test_add_func("/core/general/test_setting_vpn_changed_signal",
+                    test_setting_vpn_changed_signal);
+    g_test_add_func("/core/general/test_setting_wired_changed_signal",
+                    test_setting_wired_changed_signal);
+    g_test_add_func("/core/general/test_setting_wireless_changed_signal",
+                    test_setting_wireless_changed_signal);
+    g_test_add_func("/core/general/test_setting_wireless_security_changed_signal",
+                    test_setting_wireless_security_changed_signal);
+    g_test_add_func("/core/general/test_setting_802_1x_changed_signal",
+                    test_setting_802_1x_changed_signal);
+    g_test_add_func("/core/general/test_setting_ip4_gateway", test_setting_ip4_gateway);
+    g_test_add_func("/core/general/test_setting_ip6_gateway", test_setting_ip6_gateway);
+    g_test_add_func("/core/general/test_setting_compare_default_strv",
+                    test_setting_compare_default_strv);
+    g_test_add_func("/core/general/test_setting_user_data", test_setting_user_data);
+
+    g_test_add_func("/core/general/test_sock_addr_endpoint", test_sock_addr_endpoint);
+
+    g_test_add_func("/core/general/hexstr2bin", test_hexstr2bin);
+    g_test_add_func("/core/general/nm_strquote", test_nm_strquote);
+    g_test_add_func("/core/general/test_nm_utils_uuid_generate_from_string",
+                    test_nm_utils_uuid_generate_from_string);
+    g_test_add_func("/core/general/nm_uuid_generate_from_strings",
+                    test_nm_utils_uuid_generate_from_strings);
+
+    g_test_add_func("/core/general/_nm_utils_ascii_str_to_int64", test_nm_utils_ascii_str_to_int64);
+    g_test_add_func("/core/general/nm_utils_is_power_of_two", test_nm_utils_is_power_of_two);
+    g_test_add_func("/core/general/nm_utils_ptrarray_find_binary_search_range",
+                    test_nm_utils_ptrarray_find_binary_search);
+    g_test_add_func("/core/general/nm_utils_ptrarray_find_binary_search_with_duplicates",
+                    test_nm_utils_ptrarray_find_binary_search_with_duplicates);
+    g_test_add_func("/core/general/_nm_utils_strstrdictkey", test_nm_utils_strstrdictkey);
+    g_test_add_func("/core/general/nm_ptrarray_len", test_nm_ptrarray_len);
+
+    g_test_add_func("/core/general/_nm_utils_dns_option_validate",
+                    test_nm_utils_dns_option_validate);
+    g_test_add_func("/core/general/_nm_utils_dns_option_find_idx",
+                    test_nm_utils_dns_option_find_idx);
+    g_test_add_func("/core/general/_nm_utils_validate_json", test_nm_utils_check_valid_json);
+    g_test_add_func("/core/general/_nm_utils_team_config_equal", test_nm_utils_team_config_equal);
+    g_test_add_func("/core/general/test_nm_utils_enum", test_nm_utils_enum);
+    g_test_add_func("/core/general/nm-set-out", test_nm_set_out);
+    g_test_add_func("/core/general/route_attributes/parse", test_route_attributes_parse);
+    g_test_add_func("/core/general/route_attributes/format", test_route_attributes_format);
+    g_test_add_func("/core/general/test_variant_attribute_spec", test_variant_attribute_spec);
+
+    g_test_add_func("/core/general/get_start_time_for_pid", test_get_start_time_for_pid);
+    g_test_add_func("/core/general/test_nm_va_args_macros", test_nm_va_args_macros);
+    g_test_add_func("/core/general/test_ethtool_offload", test_ethtool_offload);
+
+    g_test_add_data_func("/core/general/test_integrate_maincontext/1",
+                         GUINT_TO_POINTER(1),
+                         test_integrate_maincontext);
+    g_test_add_data_func("/core/general/test_integrate_maincontext/2",
+                         GUINT_TO_POINTER(2),
+                         test_integrate_maincontext);
+
+    g_test_add_func("/core/general/test_nm_ip_addr_zero", test_nm_ip_addr_zero);
+    g_test_add_func("/core/general/test_nm_utils_wifi_ghz_freqs", test_nm_utils_wifi_ghz_freqs);
+
+    g_test_add_func("/core/general/test_strsplit_quoted", test_strsplit_quoted);
+    g_test_add_func("/core/general/test_vpn_connection_state_reason",
+                    test_vpn_connection_state_reason);
+
+    return g_test_run();
+}
diff --git a/src/libnm-core-impl/tests/test-keyfile.c b/src/libnm-core-impl/tests/test-keyfile.c
new file mode 100644
index 00000000..ba7d783b
--- /dev/null
+++ b/src/libnm-core-impl/tests/test-keyfile.c
@@ -0,0 +1,909 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Copyright (C) 2015 Red Hat, Inc.
+ */
+
+#include "libnm-core-impl/nm-default-libnm-core.h"
+
+#include "libnm-glib-aux/nm-json-aux.h"
+#include "libnm-core-intern/nm-keyfile-utils.h"
+#include "libnm-core-intern/nm-keyfile-internal.h"
+#include "nm-simple-connection.h"
+#include "nm-setting-connection.h"
+#include "nm-setting-wired.h"
+#include "nm-setting-8021x.h"
+#include "nm-setting-team.h"
+#include "nm-setting-user.h"
+#include "nm-setting-proxy.h"
+
+#include "libnm-glib-aux/nm-test-utils.h"
+
+#define TEST_CERT_DIR          NM_BUILD_SRCDIR "/src/libnm-core-impl/tests/certs"
+#define TEST_WIRED_TLS_CA_CERT TEST_CERT_DIR "/test-ca-cert.pem"
+#define TEST_WIRED_TLS_PRIVKEY TEST_CERT_DIR "/test-key-and-cert.pem"
+#define TEST_WIRED_TLS_TPM2KEY TEST_CERT_DIR "/test-tpm2wrapped-key.pem"
+
+/*****************************************************************************/
+
+static void
+do_test_encode_key_full(GKeyFile *  kf,
+                        const char *name,
+                        const char *key,
+                        const char *key_decode_encode)
+{
+    gs_free char *to_free1 = NULL;
+    gs_free char *to_free2 = NULL;
+    const char *  key2;
+    const char *  name2;
+
+    g_assert(key);
+
+    if (name) {
+        key2 = nm_keyfile_key_encode(name, &to_free1);
+        g_assert(key2);
+        g_assert(NM_STRCHAR_ALL(key2, ch, (guchar) ch < 127));
+        g_assert_cmpstr(key2, ==, key);
+
+        /* try to add the encoded key to the keyfile. We expect
+         * no g_critical warning about invalid key. */
+        g_key_file_set_value(kf, "group", key, "dummy");
+    }
+
+    name2 = nm_keyfile_key_decode(key, &to_free2);
+    if (name)
+        g_assert_cmpstr(name2, ==, name);
+    else {
+        key2 = nm_keyfile_key_encode(name2, &to_free1);
+        g_assert(key2);
+        g_assert(NM_STRCHAR_ALL(key2, ch, (guchar) ch < 127));
+        if (key_decode_encode)
+            g_assert_cmpstr(key2, ==, key_decode_encode);
+        g_key_file_set_value(kf, "group", key2, "dummy");
+    }
+}
+
+#define do_test_encode_key_bijection(kf, name, key) \
+    do_test_encode_key_full(kf, "" name, "" key, NULL)
+#define do_test_encode_key_identity(kf, name) do_test_encode_key_full(kf, "" name, "" name, NULL)
+#define do_test_encode_key_decode_surjection(kf, key, key_decode_encode) \
+    do_test_encode_key_full(kf, NULL, "" key, "" key_decode_encode)
+
+static void
+test_encode_key(void)
+{
+    nm_auto_unref_keyfile GKeyFile *kf = g_key_file_new();
+
+    do_test_encode_key_identity(kf, "a");
+    do_test_encode_key_bijection(kf, "", "\\00");
+    do_test_encode_key_bijection(kf, " ", "\\20");
+    do_test_encode_key_bijection(kf, "\\ ", "\\\\20");
+    do_test_encode_key_identity(kf, "\\0");
+    do_test_encode_key_identity(kf, "\\a");
+    do_test_encode_key_identity(kf, "\\0g");
+    do_test_encode_key_bijection(kf, "\\0f", "\\5C0f");
+    do_test_encode_key_bijection(kf, "\\0f ", "\\5C0f\\20");
+    do_test_encode_key_bijection(kf, " \\0f ", "\\20\\5C0f\\20");
+    do_test_encode_key_bijection(kf, "\xF5", "\\F5");
+    do_test_encode_key_bijection(kf, "\x7F", "\\7F");
+    do_test_encode_key_bijection(kf, "\x1f", "\\1F");
+    do_test_encode_key_bijection(kf, "  ", "\\20\\20");
+    do_test_encode_key_bijection(kf, "   ", "\\20 \\20");
+    do_test_encode_key_decode_surjection(kf, "f\\20c", "f c");
+    do_test_encode_key_decode_surjection(kf, "\\20\\20\\20", "\\20 \\20");
+
+    do_test_encode_key_bijection(kf, "\t", "\\09");
+    do_test_encode_key_bijection(kf, "\t=x", "\\09\\3Dx");
+    do_test_encode_key_bijection(
+        kf,
+        "(nm-openvpn-auth-dialog:10283): GdkPixbuf-DEBUG: \tCopy pixels == false",
+        "(nm-openvpn-auth-dialog:10283): GdkPixbuf-DEBUG: \\09Copy pixels \\3D\\3D false");
+}
+
+/*****************************************************************************/
+
+#define CLEAR(con, keyfile)                           \
+    G_STMT_START                                      \
+    {                                                 \
+        NMConnection **_con     = (con);              \
+        GKeyFile **    _keyfile = (keyfile);          \
+                                                      \
+        g_clear_object(_con);                         \
+        nm_clear_pointer(_keyfile, g_key_file_unref); \
+    }                                                 \
+    G_STMT_END
+
+static void
+_assert_gbytes(GBytes *bytes, gconstpointer data, gssize len)
+{
+    g_assert((data && len > 0) || !len || (data && len == -1));
+
+    if (len == -1)
+        len = strlen(data);
+
+    if (!len)
+        g_assert(!bytes);
+
+    g_assert(nm_utils_gbytes_equal_mem(bytes, data, len));
+}
+
+static GKeyFile *
+_keyfile_load_from_data(const char *str)
+{
+    GError *  error = NULL;
+    gboolean  success;
+    GKeyFile *keyfile;
+
+    g_assert(str);
+
+    keyfile = g_key_file_new();
+    success = g_key_file_load_from_data(keyfile, str, strlen(str), G_KEY_FILE_NONE, &error);
+    g_assert_no_error(error);
+    g_assert(success);
+
+    return keyfile;
+}
+
+static GKeyFile *
+_nm_keyfile_write(NMConnection *connection, NMKeyfileWriteHandler handler, void *user_data)
+{
+    GError *  error = NULL;
+    GKeyFile *kf;
+
+    g_assert(NM_IS_CONNECTION(connection));
+
+    kf = nm_keyfile_write(connection, NM_KEYFILE_HANDLER_FLAGS_NONE, handler, user_data, &error);
+    g_assert_no_error(error);
+    g_assert(kf);
+    return kf;
+}
+
+static NMConnection *
+_nm_keyfile_read(GKeyFile *           keyfile,
+                 const char *         keyfile_name,
+                 NMKeyfileReadHandler read_handler,
+                 void *               read_data,
+                 gboolean             needs_normalization)
+{
+    GError *      error = NULL;
+    NMConnection *con;
+    gs_free char *filename = NULL;
+    gs_free char *base_dir = NULL;
+
+    g_assert(keyfile);
+    g_assert(!keyfile_name || (keyfile_name[0] == '/'));
+
+    base_dir = g_path_get_dirname(keyfile_name);
+    filename = g_path_get_basename(keyfile_name);
+
+    con = nm_keyfile_read(keyfile,
+                          base_dir,
+                          NM_KEYFILE_HANDLER_FLAGS_NONE,
+                          read_handler,
+                          read_data,
+                          &error);
+    g_assert_no_error(error);
+    g_assert(NM_IS_CONNECTION(con));
+
+    nm_keyfile_read_ensure_id(con, filename);
+    nm_keyfile_read_ensure_uuid(con, keyfile_name);
+
+    if (needs_normalization) {
+        nmtst_assert_connection_verifies_after_normalization(con, 0, 0);
+        nmtst_connection_normalize(con);
+    } else {
+        {
+            NMSettingConnection *s_con;
+
+            /* a non-slave connection must have a proxy setting, but
+             * keyfile reader does not add that (unless a [proxy] section
+             * is present. */
+            s_con = nm_connection_get_setting_connection(con);
+            if (s_con && !nm_setting_connection_get_master(s_con)
+                && !nm_connection_get_setting_proxy(con))
+                nm_connection_add_setting(con, nm_setting_proxy_new());
+        }
+        nmtst_assert_connection_verifies_without_normalization(con);
+    }
+    return con;
+}
+
+static void
+_keyfile_convert(NMConnection **       con,
+                 GKeyFile **           keyfile,
+                 const char *          keyfile_name,
+                 NMKeyfileReadHandler  read_handler,
+                 void *                read_data,
+                 NMKeyfileWriteHandler write_handler,
+                 void *                write_data,
+                 gboolean              needs_normalization)
+{
+    NMConnection *  c0;
+    GKeyFile *      k0;
+    gs_unref_object NMConnection *c0_k1_c2 = NULL, *k0_c1 = NULL, *k0_c1_k2_c3 = NULL;
+    nm_auto_unref_keyfile GKeyFile *k0_c1_k2 = NULL, *c0_k1 = NULL, *c0_k1_c2_k3 = NULL;
+
+    /* convert from @con to @keyfile and check that we can make
+     * full round trips and obtaining the same result. */
+
+    g_assert(con);
+    g_assert(keyfile);
+    g_assert(*con || *keyfile);
+
+    c0 = *con;
+    k0 = *keyfile;
+
+    if (c0) {
+        c0_k1       = _nm_keyfile_write(c0, write_handler, write_data);
+        c0_k1_c2    = _nm_keyfile_read(c0_k1, keyfile_name, read_handler, read_data, FALSE);
+        c0_k1_c2_k3 = _nm_keyfile_write(c0_k1_c2, write_handler, write_data);
+
+        g_assert(_nm_keyfile_equal(c0_k1, c0_k1_c2_k3, TRUE));
+    }
+    if (k0) {
+        NMSetting8021x *s1, *s2;
+
+        k0_c1    = _nm_keyfile_read(k0, keyfile_name, read_handler, read_data, needs_normalization);
+        k0_c1_k2 = _nm_keyfile_write(k0_c1, write_handler, write_data);
+        k0_c1_k2_c3 = _nm_keyfile_read(k0_c1_k2, keyfile_name, read_handler, read_data, FALSE);
+
+        /* It is a expected behavior, that if @k0 contains a relative path ca-cert, @k0_c1 will
+         * contain that path as relative. But @k0_c1_k2 and @k0_c1_k2_c3 will have absolute paths.
+         * In this case, hack up @k0_c1_k2_c3 to contain the same relative path. */
+        s1 = nm_connection_get_setting_802_1x(k0_c1);
+        s2 = nm_connection_get_setting_802_1x(k0_c1_k2_c3);
+        if (s1 || s2) {
+            g_assert_cmpint(nm_setting_802_1x_get_ca_cert_scheme(s1),
+                            ==,
+                            nm_setting_802_1x_get_ca_cert_scheme(s2));
+            switch (nm_setting_802_1x_get_ca_cert_scheme(s1)) {
+            case NM_SETTING_802_1X_CK_SCHEME_PATH:
+            {
+                const char *p1 = nm_setting_802_1x_get_ca_cert_path(s1);
+                const char *p2 = nm_setting_802_1x_get_ca_cert_path(s2);
+
+                nmtst_assert_resolve_relative_path_equals(p1, p2);
+                if (strcmp(p1, p2) != 0) {
+                    gs_free char * puri          = NULL;
+                    gs_unref_bytes GBytes *pfile = NULL;
+
+                    g_assert(p1[0] != '/' && p2[0] == '/');
+
+                    /* one of the paths is a relative path and the other is absolute. This is an
+                         * expected difference.
+                         * Make the paths of s2 identical to s1... */
+                    puri  = g_strconcat(NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PATH, p1, NULL);
+                    pfile = g_bytes_new(puri, strlen(puri) + 1);
+                    g_object_set(s2, NM_SETTING_802_1X_CA_CERT, pfile, NULL);
+                }
+            } break;
+            case NM_SETTING_802_1X_CK_SCHEME_BLOB:
+            {
+                GBytes *b1, *b2;
+
+                b1 = nm_setting_802_1x_get_ca_cert_blob(s1);
+                b2 = nm_setting_802_1x_get_ca_cert_blob(s2);
+                g_assert(b1);
+                g_assert(b2);
+                g_assert(g_bytes_equal(b1, b2));
+                break;
+            }
+            default:
+                break;
+            }
+        }
+
+        nmtst_assert_connection_equals(k0_c1, FALSE, k0_c1_k2_c3, FALSE);
+    }
+
+    if (!k0)
+        *keyfile = g_key_file_ref(c0_k1);
+    else if (!c0)
+        *con = g_object_ref(k0_c1);
+    else {
+        /* finally, if both a keyfile and a connection are given, assert that they are equal
+         * after a round of conversion. */
+        g_assert(_nm_keyfile_equal(c0_k1, k0_c1_k2, TRUE));
+        nmtst_assert_connection_equals(k0_c1, FALSE, c0_k1_c2, FALSE);
+    }
+}
+
+/*****************************************************************************/
+
+static void
+_test_8021x_cert_check(NMConnection *         con,
+                       NMSetting8021xCKScheme expected_scheme,
+                       const void *           value,
+                       gssize                 val_len)
+{
+    GKeyFile *      keyfile = NULL;
+    NMSetting8021x *s_8021x;
+    gs_free char *  kval = NULL;
+
+    _keyfile_convert(&con, &keyfile, "/_test_8021x_cert_check/foo", NULL, NULL, NULL, NULL, FALSE);
+
+    s_8021x = nm_connection_get_setting_802_1x(con);
+
+    g_assert(nm_setting_802_1x_get_ca_cert_scheme(s_8021x) == expected_scheme);
+
+    if (expected_scheme == NM_SETTING_802_1X_CK_SCHEME_PATH) {
+        const char *path = nm_setting_802_1x_get_ca_cert_path(s_8021x);
+
+        g_assert_cmpstr(path, ==, value);
+        g_assert(val_len == -1 || strlen(path) == val_len);
+
+        kval = g_key_file_get_string(keyfile, "802-1x", "ca-cert", NULL);
+        g_assert(kval);
+        g_assert_cmpstr(kval, ==, value);
+    } else if (expected_scheme == NM_SETTING_802_1X_CK_SCHEME_BLOB) {
+        GBytes *      blob      = nm_setting_802_1x_get_ca_cert_blob(s_8021x);
+        gs_free char *file_blob = NULL;
+
+        if (val_len == -1) {
+            gsize    l;
+            gboolean success;
+
+            success = g_file_get_contents(value, &file_blob, &l, NULL);
+            g_assert(success);
+
+            value   = file_blob;
+            val_len = l;
+        }
+
+        g_assert(blob);
+        g_assert(nm_utils_gbytes_equal_mem(blob, value, val_len));
+
+        kval = g_key_file_get_string(keyfile, "802-1x", "ca-cert", NULL);
+        g_assert(kval);
+        g_assert(g_str_has_prefix(kval, NM_KEYFILE_CERT_SCHEME_PREFIX_BLOB));
+    }
+
+    g_key_file_unref(keyfile);
+}
+
+static void
+_test_8021x_cert_check_blob_full(NMConnection *con, const void *data, gsize len)
+{
+    GBytes *        bytes;
+    NMSetting8021x *s_8021x = nm_connection_get_setting_802_1x(con);
+
+    bytes = g_bytes_new(data, len);
+    g_object_set(s_8021x, NM_SETTING_802_1X_CA_CERT, bytes, NULL);
+    _test_8021x_cert_check(con,
+                           NM_SETTING_802_1X_CK_SCHEME_BLOB,
+                           g_bytes_get_data(bytes, NULL),
+                           g_bytes_get_size(bytes));
+    g_bytes_unref(bytes);
+}
+#define _test_8021x_cert_check_blob(con, data) \
+    _test_8021x_cert_check_blob_full(con, data, NM_STRLEN(data))
+
+static void
+_test_8021x_cert_from_files(const char *cert, const char *key)
+{
+    NMSetting8021x *s_8021x;
+    gs_unref_object NMConnection *con =
+        nmtst_create_minimal_connection("test-cert", NULL, NM_SETTING_WIRED_SETTING_NAME, NULL);
+    GError *               error = NULL;
+    gboolean               success;
+    NMSetting8021xCKScheme scheme             = NM_SETTING_802_1X_CK_SCHEME_PATH;
+    gs_free char *full_TEST_WIRED_TLS_CA_CERT = nmtst_file_resolve_relative_path(cert, NULL);
+    gs_free char *full_TEST_WIRED_TLS_PRIVKEY = nmtst_file_resolve_relative_path(key, NULL);
+
+    /* test writing/reading of certificates of NMSetting8021x */
+
+    /* create a valid connection with NMSetting8021x */
+    s_8021x = (NMSetting8021x *) nm_setting_802_1x_new();
+    nm_setting_802_1x_add_eap_method(s_8021x, "tls");
+    g_object_set(s_8021x, NM_SETTING_802_1X_IDENTITY, "Bill Smith", NULL);
+    success =
+        nm_setting_802_1x_set_ca_cert(s_8021x, full_TEST_WIRED_TLS_CA_CERT, scheme, NULL, &error);
+    g_assert_no_error(error);
+    g_assert(success);
+    success = nm_setting_802_1x_set_client_cert(s_8021x,
+                                                full_TEST_WIRED_TLS_CA_CERT,
+                                                scheme,
+                                                NULL,
+                                                &error);
+    g_assert_no_error(error);
+    g_assert(success);
+    success = nm_setting_802_1x_set_private_key(s_8021x,
+                                                full_TEST_WIRED_TLS_PRIVKEY,
+                                                "test1",
+                                                scheme,
+                                                NULL,
+                                                &error);
+    g_assert_no_error(error);
+    g_assert(success);
+
+    /* test resetting ca-cert to different values and see whether we can write/read. */
+
+    nm_connection_add_setting(con, NM_SETTING(s_8021x));
+    nmtst_assert_connection_verifies_and_normalizable(con);
+    nmtst_connection_normalize(con);
+
+    _test_8021x_cert_check(con, scheme, full_TEST_WIRED_TLS_CA_CERT, -1);
+
+    scheme = NM_SETTING_802_1X_CK_SCHEME_BLOB;
+    success =
+        nm_setting_802_1x_set_ca_cert(s_8021x, full_TEST_WIRED_TLS_CA_CERT, scheme, NULL, &error);
+    g_assert_no_error(error);
+    g_assert(success);
+    _test_8021x_cert_check(con, scheme, full_TEST_WIRED_TLS_CA_CERT, -1);
+
+    _test_8021x_cert_check_blob(con, "a");
+    _test_8021x_cert_check_blob(con, "\0");
+    _test_8021x_cert_check_blob(con, "10");
+    _test_8021x_cert_check_blob(con, "data:;base64,a");
+    _test_8021x_cert_check_blob_full(con, "data:;base64,a", NM_STRLEN("data:;base64,a") + 1);
+    _test_8021x_cert_check_blob(con, "data:;base64,file://a");
+    _test_8021x_cert_check_blob(con, "123");
+}
+
+static void
+test_8021x_cert(void)
+{
+    _test_8021x_cert_from_files(TEST_WIRED_TLS_CA_CERT, TEST_WIRED_TLS_PRIVKEY);
+}
+
+static void
+test_8021x_cert_tpm2key(void)
+{
+    _test_8021x_cert_from_files(TEST_WIRED_TLS_CA_CERT, TEST_WIRED_TLS_TPM2KEY);
+}
+
+/*****************************************************************************/
+
+static void
+test_8021x_cert_read(void)
+{
+    GKeyFile *      keyfile           = NULL;
+    gs_unref_object NMConnection *con = NULL;
+    NMSetting8021x *              s_8021x;
+
+    con = nmtst_create_connection_from_keyfile("[connection]\n"
+                                               "type=ethernet",
+                                               "/test_8021x_cert_read/test0");
+    CLEAR(&con, &keyfile);
+
+    keyfile = _keyfile_load_from_data("[connection]\n"
+                                      "type=ethernet");
+    _keyfile_convert(&con, &keyfile, "/test_8021x_cert_read/test1", NULL, NULL, NULL, NULL, TRUE);
+    CLEAR(&con, &keyfile);
+
+    keyfile = _keyfile_load_from_data(
+        "[connection]\n"
+        "type=802-3-ethernet\n"
+
+        "[802-1x]\n"
+        "eap=tls;\n"
+        "identity=Bill Smith\n"
+        "ca-cert=48;130;2;52;48;130;1;161;2;16;2;173;102;126;78;69;254;94;87;111;60;152;25;94;221;"
+        "192;48;13;6;9;42;134;72;134;247;13;1;1;2;5;0;48;95;49;11;48;9;6;3;85;4;6;19;2;85;83;49;32;"
+        "48;30;6;3;85;4;10;19;23;82;83;65;32;68;97;116;97;32;83;101;99;117;114;105;116;121;44;32;"
+        "73;110;99;46;49;46;48;44;6;3;85;4;11;19;37;83;101;99;117;114;101;32;83;101;114;118;101;"
+        "114;32;67;101;114;116;105;102;105;99;97;116;105;111;110;32;65;117;116;104;111;114;105;116;"
+        "121;48;30;23;13;57;52;49;49;48;57;48;48;48;48;48;48;90;23;13;49;48;48;49;48;55;50;51;53;"
+        "57;53;57;90;48;95;49;11;48;9;6;3;85;4;6;19;2;85;83;49;32;48;30;6;3;85;4;10;19;23;82;83;65;"
+        "32;68;97;116;97;32;83;101;99;117;114;105;116;121;44;32;73;110;99;46;49;46;48;44;6;3;85;4;"
+        "11;19;37;83;101;99;117;114;101;32;83;101;114;118;101;114;32;67;101;114;116;105;102;105;99;"
+        "97;116;105;111;110;32;65;117;116;104;111;114;105;116;121;48;129;155;48;13;6;9;42;134;72;"
+        "134;247;13;1;1;1;5;0;3;129;137;0;48;129;133;2;126;0;146;206;122;193;174;131;62;90;170;137;"
+        "131;87;172;37;1;118;12;173;174;142;44;55;206;235;53;120;100;84;3;229;132;64;81;201;191;"
+        "143;8;226;138;130;8;210;22;134;55;85;233;177;33;2;173;118;104;129;154;5;162;75;201;75;37;"
+        "102;34;86;108;136;7;143;247;129;89;109;132;7;101;112;19;113;118;62;155;119;76;227;80;137;"
+        "86;152;72;185;29;167;41;26;19;46;74;17;89;156;30;21;213;73;84;44;115;58;105;130;177;151;"
+        "57;156;109;112;103;72;229;221;45;214;200;30;123;2;3;1;0;1;48;13;6;9;42;134;72;134;247;13;"
+        "1;1;2;5;0;3;126;0;101;221;126;225;178;236;176;226;58;224;236;113;70;154;25;17;184;211;199;"
+        "160;180;3;64;38;2;62;9;156;225;18;179;209;90;246;55;165;183;97;3;182;91;22;105;59;198;68;"
+        "8;12;136;83;12;107;151;73;199;62;53;220;108;185;187;170;223;92;187;58;47;147;96;182;169;"
+        "75;77;242;32;247;205;95;127;100;123;142;220;0;92;215;250;119;202;57;22;89;111;14;234;211;"
+        "181;131;127;77;77;66;86;118;180;201;95;4;248;56;248;235;210;95;117;95;205;123;252;229;142;"
+        "128;124;252;80;\n"
+        "client-cert=102;105;108;101;58;47;47;47;104;111;109;101;47;100;99;98;119;47;68;101;115;"
+        "107;116;111;112;47;99;101;114;116;105;110;102;114;97;47;99;108;105;101;110;116;46;112;101;"
+        "109;0;\n"
+        "private-key=102;105;108;101;58;47;47;47;104;111;109;101;47;100;99;98;119;47;68;101;115;"
+        "107;116;111;112;47;99;101;114;116;105;110;102;114;97;47;99;108;105;101;110;116;46;112;101;"
+        "109;0;\n"
+        "private-key-password=12345testing\n");
+    _keyfile_convert(&con, &keyfile, "/test_8021x_cert_read/test2", NULL, NULL, NULL, NULL, TRUE);
+    CLEAR(&con, &keyfile);
+
+    keyfile =
+        _keyfile_load_from_data("[connection]\n"
+                                "type=802-3-ethernet\n"
+
+                                "[802-1x]\n"
+                                "eap=tls;\n"
+                                "identity=Bill Smith\n"
+                                /* unqualified strings are only recognized as path up to 500 chars*/
+                                "ca-cert="
+                                "/11111111111111111111111111111111111111111111111111111111111111111"
+                                "1111111111111111111111111111111111"
+                                "/11111111111111111111111111111111111111111111111111111111111111111"
+                                "1111111111111111111111111111111111"
+                                "/11111111111111111111111111111111111111111111111111111111111111111"
+                                "1111111111111111111111111111111111"
+                                "/11111111111111111111111111111111111111111111111111111111111111111"
+                                "1111111111111111111111111111111111"
+                                "/11111111111111111111111111111111111111111111111111111111111111111"
+                                "111111111111111111111111111111111\n"
+                                "client-cert=/"
+                                "222222222222222222222222222222222222222222222222222222222222222222"
+                                "222222222222222222222222222222221"
+                                "/22222222222222222222222222222222222222222222222222222222222222222"
+                                "2222222222222222222222222222222221"
+                                "/22222222222222222222222222222222222222222222222222222222222222222"
+                                "2222222222222222222222222222222221"
+                                "/22222222222222222222222222222222222222222222222222222222222222222"
+                                "2222222222222222222222222222222221"
+                                "/22222222222222222222222222222222222222222222222222222222222222222"
+                                "2222222222222222222222222222222222\n"
+                                "private-key=file://"
+                                "/33333333333333333333333333333333333333333333333333333333333333333"
+                                "3333333333333333333333333333333331"
+                                "/33333333333333333333333333333333333333333333333333333333333333333"
+                                "3333333333333333333333333333333331"
+                                "/33333333333333333333333333333333333333333333333333333333333333333"
+                                "3333333333333333333333333333333331"
+                                "/33333333333333333333333333333333333333333333333333333333333333333"
+                                "3333333333333333333333333333333331"
+                                "/33333333333333333333333333333333333333333333333333333333333333333"
+                                "333333333333333333333333333333333111111\n"
+                                "private-key-password=12345testing\n");
+    _keyfile_convert(&con, &keyfile, "/test_8021x_cert_read/test2", NULL, NULL, NULL, NULL, TRUE);
+    s_8021x = nm_connection_get_setting_802_1x(con);
+
+    g_assert(nm_setting_802_1x_get_ca_cert_scheme(s_8021x) == NM_SETTING_802_1X_CK_SCHEME_PATH);
+    g_assert(g_str_has_prefix(nm_setting_802_1x_get_ca_cert_path(s_8021x), "/111111111111"));
+    g_assert_cmpint(strlen(nm_setting_802_1x_get_ca_cert_path(s_8021x)), ==, 499);
+
+    g_assert(nm_setting_802_1x_get_client_cert_scheme(s_8021x) == NM_SETTING_802_1X_CK_SCHEME_BLOB);
+    g_assert(
+        g_str_has_prefix(g_bytes_get_data(nm_setting_802_1x_get_client_cert_blob(s_8021x), NULL),
+                         "/2222222222"));
+    g_assert_cmpint(g_bytes_get_size(nm_setting_802_1x_get_client_cert_blob(s_8021x)),
+                    ==,
+                    500 + 1 /* keyfile reader adds a trailing NUL */);
+
+    g_assert(nm_setting_802_1x_get_private_key_scheme(s_8021x) == NM_SETTING_802_1X_CK_SCHEME_PATH);
+    g_assert(g_str_has_prefix(nm_setting_802_1x_get_private_key_path(s_8021x), "/333333333"));
+    g_assert_cmpint(strlen(nm_setting_802_1x_get_private_key_path(s_8021x)), ==, 505);
+    CLEAR(&con, &keyfile);
+
+    keyfile = _keyfile_load_from_data("[connection]\n"
+                                      "type=802-3-ethernet\n"
+
+                                      "[802-1x]\n"
+                                      "eap=tls;\n"
+                                      "identity=Bill Smith\n"
+                                      "ca-cert=/\n"
+                                      "client-cert=a.pem\n"
+                                      "private-key=data:;base64,aGFsbG8=\n"  // hallo
+                                      "private-key-password=12345testing\n");
+    _keyfile_convert(&con, &keyfile, "/test_8021x_cert_read/test2", NULL, NULL, NULL, NULL, TRUE);
+    s_8021x = nm_connection_get_setting_802_1x(con);
+
+    g_assert(nm_setting_802_1x_get_ca_cert_scheme(s_8021x) == NM_SETTING_802_1X_CK_SCHEME_PATH);
+    g_assert_cmpstr(nm_setting_802_1x_get_ca_cert_path(s_8021x), ==, "/");
+
+    g_assert(nm_setting_802_1x_get_client_cert_scheme(s_8021x) == NM_SETTING_802_1X_CK_SCHEME_PATH);
+    g_assert_cmpstr(nm_setting_802_1x_get_client_cert_path(s_8021x),
+                    ==,
+                    "/test_8021x_cert_read/a.pem");
+
+    g_assert(nm_setting_802_1x_get_private_key_scheme(s_8021x) == NM_SETTING_802_1X_CK_SCHEME_BLOB);
+    _assert_gbytes(nm_setting_802_1x_get_private_key_blob(s_8021x), "hallo", -1);
+    CLEAR(&con, &keyfile);
+
+    keyfile = _keyfile_load_from_data("[connection]\n"
+                                      "type=802-3-ethernet\n"
+
+                                      "[802-1x]\n"
+                                      "eap=tls;\n"
+                                      "identity=Bill Smith\n"
+                                      "ca-cert=file://data:;base64,x\n"
+                                      "client-cert=abc.der\n"
+                                      "private-key=abc.deR\n"
+                                      "private-key-password=12345testing\n");
+    _keyfile_convert(&con, &keyfile, "/test_8021x_cert_read/test2", NULL, NULL, NULL, NULL, TRUE);
+    s_8021x = nm_connection_get_setting_802_1x(con);
+
+    g_assert(nm_setting_802_1x_get_ca_cert_scheme(s_8021x) == NM_SETTING_802_1X_CK_SCHEME_PATH);
+    g_assert_cmpstr(nm_setting_802_1x_get_ca_cert_path(s_8021x), ==, "data:;base64,x");
+
+    g_assert(nm_setting_802_1x_get_client_cert_scheme(s_8021x) == NM_SETTING_802_1X_CK_SCHEME_PATH);
+    g_assert_cmpstr(nm_setting_802_1x_get_client_cert_path(s_8021x),
+                    ==,
+                    "/test_8021x_cert_read/abc.der");
+
+    g_assert(nm_setting_802_1x_get_private_key_scheme(s_8021x) == NM_SETTING_802_1X_CK_SCHEME_BLOB);
+    _assert_gbytes(nm_setting_802_1x_get_private_key_blob(s_8021x), "abc.deR\0", 8);
+    CLEAR(&con, &keyfile);
+
+    keyfile =
+        _keyfile_load_from_data("[connection]\n"
+                                "type=802-3-ethernet\n"
+
+                                "[802-1x]\n"
+                                "eap=tls;\n"
+                                "identity=Bill Smith\n"
+                                "ca-cert=104;97;108;108;111;\n" /* "hallo" without trailing NUL */
+                                "client-cert=104;097;108;108;111;0;\n"
+                                "private-key=hallo\n"
+                                "private-key-password=12345testing\n");
+    _keyfile_convert(&con, &keyfile, "/test_8021x_cert_read/test2", NULL, NULL, NULL, NULL, TRUE);
+    s_8021x = nm_connection_get_setting_802_1x(con);
+
+    g_assert(nm_setting_802_1x_get_ca_cert_scheme(s_8021x) == NM_SETTING_802_1X_CK_SCHEME_BLOB);
+    _assert_gbytes(nm_setting_802_1x_get_ca_cert_blob(s_8021x), "hallo", 5);
+
+    g_assert(nm_setting_802_1x_get_client_cert_scheme(s_8021x) == NM_SETTING_802_1X_CK_SCHEME_BLOB);
+    _assert_gbytes(nm_setting_802_1x_get_client_cert_blob(s_8021x), "hallo\0", 6);
+
+    g_assert(nm_setting_802_1x_get_private_key_scheme(s_8021x) == NM_SETTING_802_1X_CK_SCHEME_BLOB);
+    _assert_gbytes(nm_setting_802_1x_get_private_key_blob(s_8021x), "hallo\0", 6);
+    CLEAR(&con, &keyfile);
+}
+
+static void
+test_team_conf_read_valid(void)
+{
+    GKeyFile *      keyfile           = NULL;
+    gs_unref_object NMConnection *con = NULL;
+    NMSettingTeam *               s_team;
+
+    con = nmtst_create_connection_from_keyfile("[connection]\n"
+                                               "type=team\n"
+                                               "interface-name=nm-team1\n"
+                                               "[team]\n"
+                                               "config={\"foo\":\"bar\"}",
+                                               "/test_team_conf_read/valid");
+
+    g_assert(con);
+    s_team = nm_connection_get_setting_team(con);
+    g_assert(s_team);
+    g_assert_cmpstr(nm_setting_team_get_config(s_team), ==, "{\"foo\":\"bar\"}");
+
+    CLEAR(&con, &keyfile);
+}
+
+static void
+test_team_conf_read_invalid(void)
+{
+    GKeyFile *      keyfile           = NULL;
+    gs_unref_object NMConnection *con = NULL;
+    NMSettingTeam *               s_team;
+
+    if (!nm_json_vt()) {
+        g_test_skip("team test requires JSON validation");
+        return;
+    }
+
+    con = nmtst_create_connection_from_keyfile("[connection]\n"
+                                               "type=team\n"
+                                               "interface-name=nm-team1\n"
+                                               "[team]\n"
+                                               "config={foobar}",
+                                               "/test_team_conf_read/invalid");
+
+    g_assert(con);
+    s_team = nm_connection_get_setting_team(con);
+    g_assert(s_team);
+    g_assert(nm_setting_team_get_config(s_team) == NULL);
+
+    CLEAR(&con, &keyfile);
+}
+
+/*****************************************************************************/
+
+static void
+test_user_1(void)
+{
+    nm_auto_unref_keyfile GKeyFile *keyfile = NULL;
+    gs_unref_object NMConnection *con       = NULL;
+    NMSettingUser *               s_user;
+
+    con = nmtst_create_connection_from_keyfile("[connection]\n"
+                                               "id=t\n"
+                                               "type=ethernet\n"
+                                               "\n"
+                                               "[user]\n"
+                                               "my-value.x=value1\n"
+                                               "",
+                                               "/test_user_1/invalid");
+    g_assert(con);
+    s_user = NM_SETTING_USER(nm_connection_get_setting(con, NM_TYPE_SETTING_USER));
+    g_assert(s_user);
+    g_assert_cmpstr(nm_setting_user_get_data(s_user, "my-value.x"), ==, "value1");
+
+    CLEAR(&con, &keyfile);
+
+    con    = nmtst_create_minimal_connection("user-2",
+                                          "8b85fb8d-3070-48ba-93d9-53eee231d9a2",
+                                          NM_SETTING_WIRED_SETTING_NAME,
+                                          NULL);
+    s_user = NM_SETTING_USER(nm_setting_user_new());
+
+#define _USER_SET_DATA(s_user, key, val)                                      \
+    G_STMT_START                                                              \
+    {                                                                         \
+        GError * _error = NULL;                                               \
+        gboolean _success;                                                    \
+                                                                              \
+        _success = nm_setting_user_set_data((s_user), (key), (val), &_error); \
+        nmtst_assert_success(_success, _error);                               \
+    }                                                                         \
+    G_STMT_END
+
+#define _USER_SET_DATA_X(s_user, key) _USER_SET_DATA(s_user, key, "val=" key "")
+
+    _USER_SET_DATA(s_user, "my.val1", "");
+    _USER_SET_DATA_X(s_user, "my.val2");
+    _USER_SET_DATA_X(s_user, "my.v__al3");
+    _USER_SET_DATA_X(s_user, "my._v");
+    _USER_SET_DATA_X(s_user, "my.v+");
+    _USER_SET_DATA_X(s_user, "my.Av");
+    _USER_SET_DATA_X(s_user, "MY.AV");
+    _USER_SET_DATA_X(s_user, "MY.8V");
+    _USER_SET_DATA_X(s_user, "MY.8-V");
+    _USER_SET_DATA_X(s_user, "MY.8_V");
+    _USER_SET_DATA_X(s_user, "MY.8+V");
+    _USER_SET_DATA_X(s_user, "MY.8/V");
+    _USER_SET_DATA_X(s_user, "MY.8=V");
+    _USER_SET_DATA_X(s_user, "MY.-");
+    _USER_SET_DATA_X(s_user, "MY._");
+    _USER_SET_DATA_X(s_user, "MY.+");
+    _USER_SET_DATA_X(s_user, "MY./");
+    _USER_SET_DATA_X(s_user, "MY.=");
+    _USER_SET_DATA_X(s_user, "my.keys.1");
+    _USER_SET_DATA_X(s_user, "my.other.KEY.42");
+
+    nm_connection_add_setting(con, NM_SETTING(s_user));
+    nmtst_connection_normalize(con);
+
+    _keyfile_convert(&con, &keyfile, "/test_user_1/foo", NULL, NULL, NULL, NULL, FALSE);
+}
+
+/*****************************************************************************/
+
+static void
+test_vpn_1(void)
+{
+    nm_auto_unref_keyfile GKeyFile *keyfile = NULL;
+    gs_unref_object NMConnection *con       = NULL;
+    NMSettingVpn *                s_vpn;
+
+    con = nmtst_create_connection_from_keyfile("[connection]\n"
+                                               "id=t\n"
+                                               "type=vpn\n"
+                                               "\n"
+                                               "[vpn]\n"
+                                               "service-type=a.b.c\n"
+                                               "vpn-key-1=value1\n"
+                                               "",
+                                               "/test_vpn_1/invalid");
+    g_assert(con);
+    s_vpn = NM_SETTING_VPN(nm_connection_get_setting(con, NM_TYPE_SETTING_VPN));
+    g_assert(s_vpn);
+    g_assert_cmpstr(nm_setting_vpn_get_data_item(s_vpn, "vpn-key-1"), ==, "value1");
+
+    CLEAR(&con, &keyfile);
+}
+
+/*****************************************************************************/
+
+static void
+test_bridge_vlans(void)
+{
+    nm_auto_unref_keyfile GKeyFile *keyfile = NULL;
+    gs_unref_object NMConnection *con       = NULL;
+    NMSettingBridge *             s_bridge;
+    NMBridgeVlan *                vlan;
+    guint16                       vid, vid_end;
+
+    con      = nmtst_create_connection_from_keyfile("[connection]\n"
+                                               "id=t\n"
+                                               "type=bridge\n"
+                                               "interface-name=br4\n"
+                                               "\n"
+                                               "[bridge]\n"
+                                               "vlans=900 ,  1 pvid  untagged, 100-123 untagged\n"
+                                               "",
+                                               "/test_bridge_port/vlans");
+    s_bridge = NM_SETTING_BRIDGE(nm_connection_get_setting(con, NM_TYPE_SETTING_BRIDGE));
+    g_assert(s_bridge);
+    g_assert_cmpuint(nm_setting_bridge_get_num_vlans(s_bridge), ==, 3);
+
+    vlan = nm_setting_bridge_get_vlan(s_bridge, 0);
+    g_assert(vlan);
+    nm_bridge_vlan_get_vid_range(vlan, &vid, &vid_end);
+    g_assert_cmpuint(vid, ==, 1);
+    g_assert_cmpuint(vid_end, ==, 1);
+    g_assert_cmpint(nm_bridge_vlan_is_pvid(vlan), ==, TRUE);
+    g_assert_cmpint(nm_bridge_vlan_is_untagged(vlan), ==, TRUE);
+
+    vlan = nm_setting_bridge_get_vlan(s_bridge, 1);
+    g_assert(vlan);
+    nm_bridge_vlan_get_vid_range(vlan, &vid, &vid_end);
+    g_assert_cmpuint(vid, ==, 100);
+    g_assert_cmpuint(vid_end, ==, 123);
+    g_assert_cmpint(nm_bridge_vlan_is_pvid(vlan), ==, FALSE);
+    g_assert_cmpint(nm_bridge_vlan_is_untagged(vlan), ==, TRUE);
+
+    vlan = nm_setting_bridge_get_vlan(s_bridge, 2);
+    g_assert(vlan);
+    nm_bridge_vlan_get_vid_range(vlan, &vid, &vid_end);
+    g_assert_cmpuint(vid, ==, 900);
+    g_assert_cmpuint(vid_end, ==, 900);
+    g_assert_cmpint(nm_bridge_vlan_is_pvid(vlan), ==, FALSE);
+    g_assert_cmpint(nm_bridge_vlan_is_untagged(vlan), ==, FALSE);
+
+    CLEAR(&con, &keyfile);
+}
+
+static void
+test_bridge_port_vlans(void)
+{
+    nm_auto_unref_keyfile GKeyFile *keyfile = NULL;
+    gs_unref_object NMConnection *con       = NULL;
+    NMSettingBridgePort *         s_port;
+    NMBridgeVlan *                vlan;
+    guint16                       vid_start, vid_end;
+
+    con    = nmtst_create_connection_from_keyfile("[connection]\n"
+                                               "id=t\n"
+                                               "type=dummy\n"
+                                               "interface-name=dummy1\n"
+                                               "master=br0\n"
+                                               "slave-type=bridge\n"
+                                               "\n"
+                                               "[bridge-port]\n"
+                                               "vlans=4094 pvid , 10-20 untagged\n"
+                                               "",
+                                               "/test_bridge_port/vlans");
+    s_port = NM_SETTING_BRIDGE_PORT(nm_connection_get_setting(con, NM_TYPE_SETTING_BRIDGE_PORT));
+    g_assert(s_port);
+    g_assert_cmpuint(nm_setting_bridge_port_get_num_vlans(s_port), ==, 2);
+
+    vlan = nm_setting_bridge_port_get_vlan(s_port, 0);
+    g_assert(vlan);
+    nm_bridge_vlan_get_vid_range(vlan, &vid_start, &vid_end);
+    g_assert_cmpuint(vid_start, ==, 10);
+    g_assert_cmpuint(vid_end, ==, 20);
+    g_assert_cmpint(nm_bridge_vlan_is_pvid(vlan), ==, FALSE);
+    g_assert_cmpint(nm_bridge_vlan_is_untagged(vlan), ==, TRUE);
+
+    vlan = nm_setting_bridge_port_get_vlan(s_port, 1);
+    g_assert(vlan);
+    nm_bridge_vlan_get_vid_range(vlan, &vid_start, &vid_end);
+    g_assert_cmpuint(vid_start, ==, 4094);
+    g_assert_cmpuint(vid_end, ==, 4094);
+    g_assert_cmpint(nm_bridge_vlan_is_pvid(vlan), ==, TRUE);
+    g_assert_cmpint(nm_bridge_vlan_is_untagged(vlan), ==, FALSE);
+
+    CLEAR(&con, &keyfile);
+}
+
+/*****************************************************************************/
+
+NMTST_DEFINE();
+
+int
+main(int argc, char **argv)
+{
+    nmtst_init(&argc, &argv, TRUE);
+
+    g_test_add_func("/core/keyfile/encode_key", test_encode_key);
+    g_test_add_func("/core/keyfile/test_8021x_cert", test_8021x_cert);
+    g_test_add_func("/core/keyfile/test_8021x_cert_tpm2key", test_8021x_cert_tpm2key);
+    g_test_add_func("/core/keyfile/test_8021x_cert_read", test_8021x_cert_read);
+    g_test_add_func("/core/keyfile/test_team_conf_read/valid", test_team_conf_read_valid);
+    g_test_add_func("/core/keyfile/test_team_conf_read/invalid", test_team_conf_read_invalid);
+    g_test_add_func("/core/keyfile/test_user/1", test_user_1);
+    g_test_add_func("/core/keyfile/test_vpn/1", test_vpn_1);
+    g_test_add_func("/core/keyfile/bridge/vlans", test_bridge_vlans);
+    g_test_add_func("/core/keyfile/bridge-port/vlans", test_bridge_port_vlans);
+
+    return g_test_run();
+}
diff --git a/src/libnm-core-impl/tests/test-secrets.c b/src/libnm-core-impl/tests/test-secrets.c
new file mode 100644
index 00000000..41dcc4b3
--- /dev/null
+++ b/src/libnm-core-impl/tests/test-secrets.c
@@ -0,0 +1,686 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Copyright (C) 2008 - 2011 Red Hat, Inc.
+ */
+
+#include "libnm-core-impl/nm-default-libnm-core.h"
+
+#include "nm-setting-8021x.h"
+#include "nm-setting-cdma.h"
+#include "nm-setting-connection.h"
+#include "nm-setting-gsm.h"
+#include "nm-setting-ip4-config.h"
+#include "nm-setting-ppp.h"
+#include "nm-setting-pppoe.h"
+#include "nm-setting-vpn.h"
+#include "nm-setting-wired.h"
+#include "nm-setting-wireless-security.h"
+#include "nm-setting-wireless.h"
+#include "nm-simple-connection.h"
+#include "nm-utils.h"
+#include "libnm-core-intern/nm-core-internal.h"
+
+#include "libnm-glib-aux/nm-test-utils.h"
+
+#define TEST_CERT_DIR                         NM_BUILD_SRCDIR "/src/libnm-core-impl/tests/certs"
+#define TEST_NEED_SECRETS_EAP_TLS_CA_CERT     TEST_CERT_DIR "/test_ca_cert.pem"
+#define TEST_NEED_SECRETS_EAP_TLS_CLIENT_CERT TEST_CERT_DIR "/test_key_and_cert.pem"
+#define TEST_NEED_SECRETS_EAP_TLS_PRIVATE_KEY TEST_CERT_DIR "/test_key_and_cert.pem"
+
+static void
+_assert_hints_has(GPtrArray *hints, const char *item)
+{
+    guint i;
+    guint found = 0;
+
+    g_assert(hints);
+    g_assert(item);
+    for (i = 0; i < hints->len; i++) {
+        g_assert(hints->pdata[i]);
+        if (strcmp(hints->pdata[i], item) == 0)
+            found++;
+    }
+    g_assert_cmpint(found, ==, 1);
+}
+
+static NMConnection *
+make_tls_connection(const char *detail, NMSetting8021xCKScheme scheme)
+{
+    NMConnection *       connection;
+    NMSettingConnection *s_con;
+    NMSetting8021x *     s_8021x;
+    NMSettingWired *     s_wired;
+    NMSettingIP4Config * s_ip4;
+    char *               uuid;
+    gboolean             success;
+    GError *             error = NULL;
+
+    connection = nm_simple_connection_new();
+
+    /* Connection setting */
+    s_con = (NMSettingConnection *) nm_setting_connection_new();
+    nm_connection_add_setting(connection, NM_SETTING(s_con));
+
+    uuid = nm_utils_uuid_generate();
+    g_object_set(s_con,
+                 NM_SETTING_CONNECTION_ID,
+                 "Test Need TLS Secrets",
+                 NM_SETTING_CONNECTION_UUID,
+                 uuid,
+                 NM_SETTING_CONNECTION_AUTOCONNECT,
+                 TRUE,
+                 NM_SETTING_CONNECTION_TYPE,
+                 NM_SETTING_WIRED_SETTING_NAME,
+                 NULL);
+    g_free(uuid);
+
+    /* Wired setting */
+    s_wired = (NMSettingWired *) nm_setting_wired_new();
+    nm_connection_add_setting(connection, NM_SETTING(s_wired));
+
+    /* Wireless security setting */
+    s_8021x = (NMSetting8021x *) nm_setting_802_1x_new();
+    nm_connection_add_setting(connection, NM_SETTING(s_8021x));
+
+    g_object_set(s_8021x, NM_SETTING_802_1X_IDENTITY, "Bill Smith", NULL);
+
+    nm_setting_802_1x_add_eap_method(s_8021x, "tls");
+
+    success = nm_setting_802_1x_set_ca_cert(s_8021x,
+                                            TEST_NEED_SECRETS_EAP_TLS_CA_CERT,
+                                            scheme,
+                                            NULL,
+                                            &error);
+    nmtst_assert_success(success, error);
+
+    success = nm_setting_802_1x_set_client_cert(s_8021x,
+                                                TEST_NEED_SECRETS_EAP_TLS_CLIENT_CERT,
+                                                scheme,
+                                                NULL,
+                                                &error);
+    nmtst_assert_success(success, error);
+
+    success = nm_setting_802_1x_set_private_key(s_8021x,
+                                                TEST_NEED_SECRETS_EAP_TLS_PRIVATE_KEY,
+                                                "test",
+                                                scheme,
+                                                NULL,
+                                                &error);
+    nmtst_assert_success(success, error);
+
+    success = nm_setting_set_secret_flags(NM_SETTING(s_8021x),
+                                          NM_SETTING_802_1X_PRIVATE_KEY_PASSWORD,
+                                          NM_SETTING_SECRET_FLAG_AGENT_OWNED,
+                                          &error);
+    nmtst_assert_success(success, error);
+
+    /* IP4 setting */
+    s_ip4 = (NMSettingIP4Config *) nm_setting_ip4_config_new();
+    nm_connection_add_setting(connection, NM_SETTING(s_ip4));
+
+    g_object_set(s_ip4, NM_SETTING_IP_CONFIG_METHOD, NM_SETTING_IP4_CONFIG_METHOD_AUTO, NULL);
+
+    nmtst_assert_connection_verifies_and_normalizable(connection);
+
+    return connection;
+}
+
+static void
+test_need_tls_secrets_path(void)
+{
+    NMConnection *connection;
+    const char *  setting_name;
+    GPtrArray *   hints = NULL;
+
+    connection = make_tls_connection("need-tls-secrets-path-key", NM_SETTING_802_1X_CK_SCHEME_PATH);
+
+    /* Ensure we don't need any secrets since we just set up the connection */
+    setting_name = nm_connection_need_secrets(connection, &hints);
+    g_assert(!setting_name);
+    g_assert(!hints);
+
+    /* Connection is good; clear secrets and ensure private key password is then required */
+    nm_connection_clear_secrets(connection);
+
+    hints        = NULL;
+    setting_name = nm_connection_need_secrets(connection, &hints);
+    g_assert_cmpstr(setting_name, ==, NM_SETTING_802_1X_SETTING_NAME);
+    _assert_hints_has(hints, NM_SETTING_802_1X_PRIVATE_KEY_PASSWORD);
+
+    g_ptr_array_free(hints, TRUE);
+    g_object_unref(connection);
+}
+
+static void
+test_need_tls_secrets_blob(void)
+{
+    NMConnection *connection;
+    const char *  setting_name;
+    GPtrArray *   hints = NULL;
+
+    connection = make_tls_connection("need-tls-secrets-blob-key", NM_SETTING_802_1X_CK_SCHEME_BLOB);
+
+    /* Ensure we don't need any secrets since we just set up the connection */
+    setting_name = nm_connection_need_secrets(connection, &hints);
+    g_assert(!setting_name);
+    g_assert(!hints);
+
+    /* Clear secrets and ensure password is again required */
+    nm_connection_clear_secrets(connection);
+
+    hints        = NULL;
+    setting_name = nm_connection_need_secrets(connection, &hints);
+    g_assert_cmpstr(setting_name, ==, NM_SETTING_802_1X_SETTING_NAME);
+    _assert_hints_has(hints, NM_SETTING_802_1X_PRIVATE_KEY_PASSWORD);
+
+    g_ptr_array_free(hints, TRUE);
+    g_object_unref(connection);
+}
+
+static NMConnection *
+make_tls_phase2_connection(const char *detail, NMSetting8021xCKScheme scheme)
+{
+    NMConnection *       connection;
+    NMSettingConnection *s_con;
+    NMSetting8021x *     s_8021x;
+    NMSettingWired *     s_wired;
+    NMSettingIP4Config * s_ip4;
+    char *               uuid;
+    gboolean             success;
+    GError *             error = NULL;
+
+    connection = nm_simple_connection_new();
+
+    /* Connection setting */
+    s_con = (NMSettingConnection *) nm_setting_connection_new();
+    nm_connection_add_setting(connection, NM_SETTING(s_con));
+
+    uuid = nm_utils_uuid_generate();
+    g_object_set(s_con,
+                 NM_SETTING_CONNECTION_ID,
+                 "Test Need TLS Secrets",
+                 NM_SETTING_CONNECTION_UUID,
+                 uuid,
+                 NM_SETTING_CONNECTION_AUTOCONNECT,
+                 TRUE,
+                 NM_SETTING_CONNECTION_TYPE,
+                 NM_SETTING_WIRED_SETTING_NAME,
+                 NULL);
+    g_free(uuid);
+
+    /* Wired setting */
+    s_wired = (NMSettingWired *) nm_setting_wired_new();
+    nm_connection_add_setting(connection, NM_SETTING(s_wired));
+
+    /* Wireless security setting */
+    s_8021x = (NMSetting8021x *) nm_setting_802_1x_new();
+    nm_connection_add_setting(connection, NM_SETTING(s_8021x));
+
+    g_object_set(s_8021x, NM_SETTING_802_1X_ANONYMOUS_IDENTITY, "blahblah", NULL);
+    g_object_set(s_8021x, NM_SETTING_802_1X_IDENTITY, "Bill Smith", NULL);
+
+    nm_setting_802_1x_add_eap_method(s_8021x, "ttls");
+    g_object_set(s_8021x, NM_SETTING_802_1X_PHASE2_AUTH, "tls", NULL);
+
+    success = nm_setting_802_1x_set_phase2_ca_cert(s_8021x,
+                                                   TEST_NEED_SECRETS_EAP_TLS_CA_CERT,
+                                                   scheme,
+                                                   NULL,
+                                                   &error);
+    nmtst_assert_success(success, error);
+
+    success = nm_setting_802_1x_set_phase2_client_cert(s_8021x,
+                                                       TEST_NEED_SECRETS_EAP_TLS_CLIENT_CERT,
+                                                       scheme,
+                                                       NULL,
+                                                       &error);
+    nmtst_assert_success(success, error);
+
+    success = nm_setting_802_1x_set_phase2_private_key(s_8021x,
+                                                       TEST_NEED_SECRETS_EAP_TLS_PRIVATE_KEY,
+                                                       "test",
+                                                       scheme,
+                                                       NULL,
+                                                       &error);
+    nmtst_assert_success(success, error);
+
+    success = nm_setting_set_secret_flags(NM_SETTING(s_8021x),
+                                          NM_SETTING_802_1X_PHASE2_PRIVATE_KEY_PASSWORD,
+                                          NM_SETTING_SECRET_FLAG_AGENT_OWNED,
+                                          &error);
+    nmtst_assert_success(success, error);
+
+    /* IP4 setting */
+    s_ip4 = (NMSettingIP4Config *) nm_setting_ip4_config_new();
+    nm_connection_add_setting(connection, NM_SETTING(s_ip4));
+
+    g_object_set(s_ip4, NM_SETTING_IP_CONFIG_METHOD, NM_SETTING_IP4_CONFIG_METHOD_AUTO, NULL);
+
+    nmtst_assert_connection_verifies_and_normalizable(connection);
+    return connection;
+}
+
+static void
+test_need_tls_phase2_secrets_path(void)
+{
+    NMConnection *connection;
+    const char *  setting_name;
+    GPtrArray *   hints = NULL;
+
+    connection = make_tls_phase2_connection("need-tls-phase2-secrets-path-key",
+                                            NM_SETTING_802_1X_CK_SCHEME_PATH);
+
+    /* Ensure we don't need any secrets since we just set up the connection */
+    setting_name = nm_connection_need_secrets(connection, &hints);
+    g_assert(!setting_name);
+    g_assert(!hints);
+
+    /* Connection is good; clear secrets and ensure private key password is then required */
+    nm_connection_clear_secrets(connection);
+
+    hints        = NULL;
+    setting_name = nm_connection_need_secrets(connection, &hints);
+    g_assert_cmpstr(setting_name, ==, NM_SETTING_802_1X_SETTING_NAME);
+    _assert_hints_has(hints, NM_SETTING_802_1X_PHASE2_PRIVATE_KEY_PASSWORD);
+
+    g_ptr_array_free(hints, TRUE);
+    g_object_unref(connection);
+}
+
+static void
+test_need_tls_phase2_secrets_blob(void)
+{
+    NMConnection *connection;
+    const char *  setting_name;
+    GPtrArray *   hints = NULL;
+
+    connection = make_tls_phase2_connection("need-tls-phase2-secrets-blob-key",
+                                            NM_SETTING_802_1X_CK_SCHEME_BLOB);
+
+    /* Ensure we don't need any secrets since we just set up the connection */
+    setting_name = nm_connection_need_secrets(connection, &hints);
+    g_assert(!setting_name);
+    g_assert(!hints);
+
+    /* Connection is good; clear secrets and ensure private key password is then required */
+    nm_connection_clear_secrets(connection);
+
+    hints        = NULL;
+    setting_name = nm_connection_need_secrets(connection, &hints);
+    g_assert_cmpstr(setting_name, ==, NM_SETTING_802_1X_SETTING_NAME);
+    _assert_hints_has(hints, NM_SETTING_802_1X_PHASE2_PRIVATE_KEY_PASSWORD);
+
+    g_ptr_array_free(hints, TRUE);
+    g_object_unref(connection);
+}
+
+static NMConnection *
+wifi_connection_new(void)
+{
+    NMConnection *             connection;
+    NMSettingConnection *      s_con;
+    NMSettingWireless *        s_wifi;
+    NMSettingWirelessSecurity *s_wsec;
+    unsigned char              tmpssid[] = {0x31, 0x33, 0x33, 0x37};
+    char *                     uuid;
+    GBytes *                   ssid;
+
+    connection = nm_simple_connection_new();
+    g_assert(connection);
+
+    /* Connection setting */
+    s_con = (NMSettingConnection *) nm_setting_connection_new();
+    g_assert(s_con);
+
+    uuid = nm_utils_uuid_generate();
+    g_object_set(s_con,
+                 NM_SETTING_CONNECTION_ID,
+                 "Test Wireless",
+                 NM_SETTING_CONNECTION_UUID,
+                 uuid,
+                 NM_SETTING_CONNECTION_AUTOCONNECT,
+                 FALSE,
+                 NM_SETTING_CONNECTION_TYPE,
+                 NM_SETTING_WIRELESS_SETTING_NAME,
+                 NULL);
+    g_free(uuid);
+    nm_connection_add_setting(connection, NM_SETTING(s_con));
+
+    /* Wireless setting */
+    s_wifi = (NMSettingWireless *) nm_setting_wireless_new();
+    g_assert(s_wifi);
+
+    ssid = g_bytes_new(tmpssid, sizeof(tmpssid));
+    g_object_set(s_wifi, NM_SETTING_WIRELESS_SSID, ssid, NULL);
+    g_bytes_unref(ssid);
+    nm_connection_add_setting(connection, NM_SETTING(s_wifi));
+
+    /* Wifi security */
+    s_wsec = (NMSettingWirelessSecurity *) nm_setting_wireless_security_new();
+    g_assert(s_wsec);
+
+    g_object_set(G_OBJECT(s_wsec), NM_SETTING_WIRELESS_SECURITY_KEY_MGMT, "none", NULL);
+    nm_connection_add_setting(connection, NM_SETTING(s_wsec));
+
+    return connection;
+}
+
+static GVariant *
+build_wep_secrets(const char *wepkey)
+{
+    GVariantBuilder builder;
+
+    g_variant_builder_init(&builder, G_VARIANT_TYPE("a{sv}"));
+    g_variant_builder_add(&builder,
+                          "{sv}",
+                          NM_SETTING_WIRELESS_SECURITY_WEP_KEY0,
+                          g_variant_new_string(wepkey));
+    g_variant_builder_add(&builder,
+                          "{sv}",
+                          NM_SETTING_WIRELESS_SECURITY_WEP_KEY_TYPE,
+                          g_variant_new_uint32(NM_WEP_KEY_TYPE_KEY));
+
+    return g_variant_builder_end(&builder);
+}
+
+static void
+test_update_secrets_wifi_single_setting(void)
+{
+    NMConnection *             connection;
+    NMSettingWirelessSecurity *s_wsec;
+    GVariant *                 secrets;
+    GError *                   error = NULL;
+    gboolean                   success;
+    const char *               wepkey = "11111111111111111111111111";
+    const char *               tmp;
+
+    /* Test update with a hashed setting of 802-11-wireless secrets */
+
+    connection = wifi_connection_new();
+
+    secrets = build_wep_secrets(wepkey);
+    success = nm_connection_update_secrets(connection,
+                                           NM_SETTING_WIRELESS_SECURITY_SETTING_NAME,
+                                           secrets,
+                                           &error);
+    g_assert_no_error(error);
+    g_assert(success);
+
+    g_variant_unref(secrets);
+
+    /* Make sure the secret is now in the connection */
+    s_wsec = nm_connection_get_setting_wireless_security(connection);
+    g_assert(s_wsec);
+    tmp = nm_setting_wireless_security_get_wep_key(s_wsec, 0);
+    g_assert_cmpstr(tmp, ==, wepkey);
+
+    g_object_unref(connection);
+}
+
+static void
+test_update_secrets_wifi_full_hash(void)
+{
+    NMConnection *             connection;
+    NMSettingWirelessSecurity *s_wsec;
+    GVariantBuilder            builder;
+    GVariant *                 all;
+    GError *                   error = NULL;
+    gboolean                   success;
+    const char *               wepkey = "11111111111111111111111111";
+    const char *               tmp;
+
+    /* Test update with a hashed connection containing only 802-11-wireless
+     * setting and secrets.
+     */
+
+    connection = wifi_connection_new();
+
+    g_variant_builder_init(&builder, NM_VARIANT_TYPE_CONNECTION);
+    g_variant_builder_add(&builder,
+                          "{s@a{sv}}",
+                          NM_SETTING_WIRELESS_SECURITY_SETTING_NAME,
+                          build_wep_secrets(wepkey));
+    all = g_variant_builder_end(&builder);
+
+    success = nm_connection_update_secrets(connection,
+                                           NM_SETTING_WIRELESS_SECURITY_SETTING_NAME,
+                                           all,
+                                           &error);
+    g_assert_no_error(error);
+    g_assert(success);
+
+    g_variant_unref(all);
+
+    /* Make sure the secret is now in the connection */
+    s_wsec = nm_connection_get_setting_wireless_security(connection);
+    g_assert(s_wsec);
+    tmp = nm_setting_wireless_security_get_wep_key(s_wsec, 0);
+    g_assert_cmpstr(tmp, ==, wepkey);
+
+    g_object_unref(connection);
+}
+
+static void
+test_update_secrets_wifi_bad_setting_name(void)
+{
+    NMConnection *connection;
+    GVariant *    secrets;
+    GError *      error = NULL;
+    gboolean      success;
+    const char *  wepkey = "11111111111111111111111111";
+
+    /* Test that passing an invalid setting name to
+     * nm_connection_update_secrets() fails with the correct error.
+     */
+
+    connection = wifi_connection_new();
+
+    secrets = build_wep_secrets(wepkey);
+
+    success = nm_connection_update_secrets(connection, "asdfasdfasdfasf", secrets, &error);
+    g_assert_error(error, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_SETTING_NOT_FOUND);
+    g_assert(success == FALSE);
+
+    g_clear_error(&error);
+    g_variant_unref(secrets);
+    g_object_unref(connection);
+}
+
+static void
+test_update_secrets_whole_connection(void)
+{
+    NMConnection *             connection;
+    NMSettingWirelessSecurity *s_wsec;
+    GVariant *                 secrets;
+    GError *                   error = NULL;
+    gboolean                   success;
+    const char *               wepkey = "11111111111111111111111111";
+
+    /* Test calling nm_connection_update_secrets() with an entire hashed
+     * connection including non-secrets.
+     */
+
+    connection = wifi_connection_new();
+
+    /* Build up the secrets dictionary */
+    secrets = nm_connection_to_dbus(connection, NM_CONNECTION_SERIALIZE_ALL);
+    NMTST_VARIANT_EDITOR(secrets,
+                         NMTST_VARIANT_ADD_PROPERTY(NM_SETTING_WIRELESS_SECURITY_SETTING_NAME,
+                                                    NM_SETTING_WIRELESS_SECURITY_WEP_KEY0,
+                                                    "s",
+                                                    wepkey););
+
+    success = nm_connection_update_secrets(connection, NULL, secrets, &error);
+    g_assert_no_error(error);
+    g_assert(success == TRUE);
+
+    g_variant_unref(secrets);
+
+    s_wsec = nm_connection_get_setting_wireless_security(connection);
+    g_assert(s_wsec);
+    g_assert_cmpstr(nm_setting_wireless_security_get_wep_key(s_wsec, 0), ==, wepkey);
+
+    g_object_unref(connection);
+}
+
+static void
+test_update_secrets_whole_connection_empty_hash(void)
+{
+    gs_unref_object NMConnection *connection = NULL;
+    GVariant *                    secrets;
+    GError *                      error = NULL;
+    gboolean                      success;
+
+    /* Test that updating secrets with an empty connection hash returns success */
+
+    connection = wifi_connection_new();
+    secrets    = g_variant_new_array(G_VARIANT_TYPE("{sa{sv}}"), NULL, 0);
+    success    = nm_connection_update_secrets(connection, NULL, secrets, &error);
+    nmtst_assert_success(success, error);
+    g_variant_unref(secrets);
+
+    g_clear_object(&connection);
+
+    connection = wifi_connection_new();
+    secrets    = nm_g_variant_singleton_aLsaLsvII();
+    success    = nm_connection_update_secrets(connection, NULL, secrets, &error);
+    nmtst_assert_success(success, error);
+}
+
+static void
+test_update_secrets_whole_connection_bad_setting(void)
+{
+    NMConnection *             connection;
+    NMSettingWirelessSecurity *s_wsec;
+    GVariant *                 secrets, *copy, *setting_hash;
+    const char *               setting_name;
+    GVariantBuilder            conn_builder;
+    GVariantIter               conn_iter;
+    GError *                   error = NULL;
+    gboolean                   success;
+    const char *               wepkey = "11111111111111111111111111";
+
+    /* Test that sending a hashed connection containing an invalid setting
+     * name fails with the right error.
+     */
+
+    connection = wifi_connection_new();
+    s_wsec     = nm_connection_get_setting_wireless_security(connection);
+    g_assert(s_wsec != NULL);
+    g_object_set(G_OBJECT(s_wsec), NM_SETTING_WIRELESS_SECURITY_WEP_KEY0, wepkey, NULL);
+
+    /* Build up the secrets hash */
+    secrets = nm_connection_to_dbus(connection, NM_CONNECTION_SERIALIZE_ALL);
+
+    /* Copy the dict, renaming the wireless-security setting in the process
+     * (so we ensure libnm is returning the right error when it finds an entry
+     * in the connection hash that doesn't match any setting in the connection).
+     */
+    g_variant_builder_init(&conn_builder, NM_VARIANT_TYPE_CONNECTION);
+    g_variant_iter_init(&conn_iter, secrets);
+    while (g_variant_iter_next(&conn_iter, "{&s@a{sv}}", &setting_name, &setting_hash)) {
+        if (strcmp(setting_name, NM_SETTING_WIRELESS_SECURITY_SETTING_NAME) == 0)
+            setting_name = "asdfasdfasdfasdf";
+
+        g_variant_builder_add(&conn_builder, "{s@a{sv}}", setting_name, setting_hash);
+        g_variant_unref(setting_hash);
+    }
+    copy = g_variant_builder_end(&conn_builder);
+    g_variant_unref(secrets);
+
+    success = nm_connection_update_secrets(connection, NULL, copy, &error);
+    g_assert_error(error, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_SETTING_NOT_FOUND);
+    g_assert(success == FALSE);
+
+    g_clear_error(&error);
+    g_variant_unref(copy);
+    g_object_unref(connection);
+}
+
+static void
+test_update_secrets_whole_connection_empty_base_setting(void)
+{
+    NMConnection *connection;
+    GVariant *    secrets, *setting;
+    GError *      error = NULL;
+    gboolean      success;
+
+    /* Test that a hashed connection which does not have any hashed secrets
+     * for the requested setting returns success.
+     */
+
+    connection = wifi_connection_new();
+    secrets    = nm_connection_to_dbus(connection, NM_CONNECTION_SERIALIZE_WITH_SECRETS);
+    g_assert_cmpint(g_variant_n_children(secrets), ==, 3);
+
+    setting = g_variant_lookup_value(secrets, NM_SETTING_WIRELESS_SETTING_NAME, NULL);
+    g_assert(setting != NULL);
+    g_variant_unref(setting);
+
+    success = nm_connection_update_secrets(connection,
+                                           NM_SETTING_WIRELESS_SECURITY_SETTING_NAME,
+                                           secrets,
+                                           &error);
+    g_assert_no_error(error);
+    g_assert(success);
+
+    g_variant_unref(secrets);
+    g_object_unref(connection);
+}
+
+static void
+test_update_secrets_null_setting_name_with_setting_hash(void)
+{
+    NMConnection *connection;
+    GVariant *    secrets;
+    GError *      error = NULL;
+    gboolean      success;
+    const char *  wepkey = "11111111111111111111111111";
+
+    /* Ensure that a NULL setting name and only a hashed setting fails */
+
+    connection = wifi_connection_new();
+
+    secrets = build_wep_secrets(wepkey);
+
+    NMTST_EXPECT_LIBNM_CRITICAL(NMTST_G_RETURN_MSG(setting_name || full_connection));
+    success = nm_connection_update_secrets(connection, NULL, secrets, &error);
+    g_test_assert_expected_messages();
+    g_assert_no_error(error);
+    g_assert(!success);
+
+    g_variant_unref(secrets);
+    g_object_unref(connection);
+}
+
+NMTST_DEFINE();
+
+int
+main(int argc, char **argv)
+{
+    nmtst_init(&argc, &argv, TRUE);
+
+    /* The tests */
+    g_test_add_func("/libnm/need_tls_secrets_path", test_need_tls_secrets_path);
+    g_test_add_func("/libnm/need_tls_secrets_blob", test_need_tls_secrets_blob);
+    g_test_add_func("/libnm/need_tls_phase2_secrets_path", test_need_tls_phase2_secrets_path);
+    g_test_add_func("/libnm/need_tls_phase2_secrets_blob", test_need_tls_phase2_secrets_blob);
+
+    g_test_add_func("/libnm/update_secrets_wifi_single_setting",
+                    test_update_secrets_wifi_single_setting);
+    g_test_add_func("/libnm/update_secrets_wifi_full_hash", test_update_secrets_wifi_full_hash);
+    g_test_add_func("/libnm/update_secrets_wifi_bad_setting_name",
+                    test_update_secrets_wifi_bad_setting_name);
+
+    g_test_add_func("/libnm/update_secrets_whole_connection", test_update_secrets_whole_connection);
+    g_test_add_func("/libnm/update_secrets_whole_connection_empty_hash",
+                    test_update_secrets_whole_connection_empty_hash);
+    g_test_add_func("/libnm/update_secrets_whole_connection_bad_setting",
+                    test_update_secrets_whole_connection_bad_setting);
+    g_test_add_func("/libnm/update_secrets_whole_connection_empty_base_setting",
+                    test_update_secrets_whole_connection_empty_base_setting);
+    g_test_add_func("/libnm/update_secrets_null_setting_name_with_setting_hash",
+                    test_update_secrets_null_setting_name_with_setting_hash);
+
+    return g_test_run();
+}
diff --git a/src/libnm-core-impl/tests/test-setting.c b/src/libnm-core-impl/tests/test-setting.c
new file mode 100644
index 00000000..6b65e98d
--- /dev/null
+++ b/src/libnm-core-impl/tests/test-setting.c
@@ -0,0 +1,4830 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Copyright (C) 2008 - 2017 Red Hat, Inc.
+ */
+
+#include "libnm-core-impl/nm-default-libnm-core.h"
+
+#include <linux/pkt_sched.h>
+#include <net/if.h>
+
+#include "libnm-glib-aux/nm-uuid.h"
+#include "libnm-glib-aux/nm-json-aux.h"
+#include "libnm-base/nm-ethtool-utils-base.h"
+#include "libnm-core-intern/nm-core-internal.h"
+#include "nm-utils.h"
+#include "nm-utils-private.h"
+#include "libnm-core-intern/nm-core-internal.h"
+#include "nm-setting-8021x.h"
+#include "nm-setting-bond.h"
+#include "nm-setting-dcb.h"
+#include "nm-setting-ethtool.h"
+#include "nm-setting-team.h"
+#include "nm-setting-team-port.h"
+#include "nm-setting-tc-config.h"
+#include "nm-setting-dummy.h"
+#include "nm-connection.h"
+#include "nm-simple-connection.h"
+#include "nm-setting-connection.h"
+#include "nm-errors.h"
+#include "libnm-core-intern/nm-keyfile-internal.h"
+
+#include "libnm-glib-aux/nm-test-utils.h"
+
+#define TEST_CERT_DIR NM_BUILD_SRCDIR "/src/libnm-core-impl/tests/certs"
+
+/*****************************************************************************/
+
+/* converts @dict to a connection. In this case, @dict must be good, without warnings, so that
+ * NM_SETTING_PARSE_FLAGS_STRICT and NM_SETTING_PARSE_FLAGS_BEST_EFFORT yield the exact same results. */
+static NMConnection *
+_connection_new_from_dbus_strict(GVariant *dict, gboolean normalize)
+{
+    gs_unref_object NMConnection *con_x_0 = NULL;
+    gs_unref_object NMConnection *con_x_s = NULL;
+    gs_unref_object NMConnection *con_x_e = NULL;
+    gs_unref_object NMConnection *con_n_0 = NULL;
+    gs_unref_object NMConnection *con_n_s = NULL;
+    gs_unref_object NMConnection *con_n_e = NULL;
+    gs_free_error GError *error           = NULL;
+    guint                 i;
+
+    g_assert(g_variant_is_of_type(dict, NM_VARIANT_TYPE_CONNECTION));
+
+    con_x_0 = _nm_simple_connection_new_from_dbus(dict, NM_SETTING_PARSE_FLAGS_NONE, &error);
+    nmtst_assert_success(NM_IS_CONNECTION(con_x_0), error);
+
+    con_x_s = _nm_simple_connection_new_from_dbus(dict, NM_SETTING_PARSE_FLAGS_STRICT, &error);
+    nmtst_assert_success(NM_IS_CONNECTION(con_x_s), error);
+
+    con_x_e = _nm_simple_connection_new_from_dbus(dict, NM_SETTING_PARSE_FLAGS_BEST_EFFORT, &error);
+    nmtst_assert_success(NM_IS_CONNECTION(con_x_e), error);
+
+    con_n_0 = _nm_simple_connection_new_from_dbus(dict, NM_SETTING_PARSE_FLAGS_NORMALIZE, &error);
+    nmtst_assert_success(NM_IS_CONNECTION(con_n_0), error);
+
+    con_n_s = _nm_simple_connection_new_from_dbus(dict,
+                                                  NM_SETTING_PARSE_FLAGS_STRICT
+                                                      | NM_SETTING_PARSE_FLAGS_NORMALIZE,
+                                                  &error);
+    nmtst_assert_success(NM_IS_CONNECTION(con_n_s), error);
+
+    con_n_e = _nm_simple_connection_new_from_dbus(dict,
+                                                  NM_SETTING_PARSE_FLAGS_BEST_EFFORT
+                                                      | NM_SETTING_PARSE_FLAGS_NORMALIZE,
+                                                  &error);
+    nmtst_assert_success(NM_IS_CONNECTION(con_n_e), error);
+
+    nmtst_assert_connection_verifies(con_x_0);
+    nmtst_assert_connection_verifies(con_x_e);
+    nmtst_assert_connection_verifies(con_x_s);
+
+    nmtst_assert_connection_verifies_without_normalization(con_n_0);
+    nmtst_assert_connection_verifies_without_normalization(con_n_e);
+    nmtst_assert_connection_verifies_without_normalization(con_n_s);
+
+    /* randomly compare some pairs that we created. They must all be equal,
+     * after accounting for normalization. */
+    for (i = 0; i < 10; i++) {
+        NMConnection *cons[] = {con_x_0, con_x_s, con_x_e, con_n_0, con_n_s, con_n_e};
+        guint         idx_a  = (nmtst_get_rand_uint32() % G_N_ELEMENTS(cons));
+        guint         idx_b  = (nmtst_get_rand_uint32() % G_N_ELEMENTS(cons));
+        gboolean      normalize_a, normalize_b;
+
+        if (idx_a <= 2 && idx_b <= 2) {
+            normalize_a = nmtst_get_rand_bool();
+            normalize_b = normalize_a;
+        } else if (idx_a > 2 && idx_b > 2) {
+            normalize_a = nmtst_get_rand_bool();
+            normalize_b = nmtst_get_rand_bool();
+        } else {
+            normalize_a = (idx_a <= 2) ? TRUE : nmtst_get_rand_bool();
+            normalize_b = (idx_b <= 2) ? TRUE : nmtst_get_rand_bool();
+        }
+        nmtst_assert_connection_equals(cons[idx_a], normalize_a, cons[idx_b], normalize_b);
+    }
+
+    return (normalize) ? g_steal_pointer(&con_x_0) : g_steal_pointer(&con_n_0);
+}
+
+/*****************************************************************************/
+
+static void
+test_nm_meta_setting_types_by_priority(void)
+{
+    gs_unref_ptrarray GPtrArray *arr = NULL;
+    int                          i;
+    int                          j;
+
+    G_STATIC_ASSERT_EXPR(_NM_META_SETTING_TYPE_NUM
+                         == G_N_ELEMENTS(nm_meta_setting_types_by_priority));
+
+    G_STATIC_ASSERT_EXPR(_NM_META_SETTING_TYPE_NUM == 51);
+
+    arr = g_ptr_array_new_with_free_func(g_object_unref);
+
+    for (i = 0; i < _NM_META_SETTING_TYPE_NUM; i++) {
+        const NMMetaSettingType  meta_type = nm_meta_setting_types_by_priority[i];
+        const NMMetaSettingInfo *setting_info;
+        NMSetting *              setting;
+
+        g_assert(_NM_INT_NOT_NEGATIVE(meta_type));
+        g_assert(meta_type < _NM_META_SETTING_TYPE_NUM);
+
+        setting_info = &nm_meta_setting_infos[meta_type];
+        g_assert(setting_info);
+        _nm_assert_setting_info(setting_info, 0);
+
+        for (j = 0; j < i; j++)
+            g_assert_cmpint(nm_meta_setting_types_by_priority[j], !=, meta_type);
+
+        setting = g_object_new(setting_info->get_setting_gtype(), NULL);
+        g_assert(NM_IS_SETTING(setting));
+
+        g_ptr_array_add(arr, setting);
+    }
+
+    for (i = 1; i < _NM_META_SETTING_TYPE_NUM; i++) {
+        NMSetting *setting = arr->pdata[i];
+
+        for (j = 0; j < i; j++) {
+            NMSetting *other = arr->pdata[j];
+
+            if (_nmtst_nm_setting_sort(other, setting) >= 0) {
+                g_error("sort order for nm_meta_setting_types_by_priority[%d vs %d] is wrong: %s "
+                        "should be before %s",
+                        j,
+                        i,
+                        nm_setting_get_name(setting),
+                        nm_setting_get_name(other));
+            }
+        }
+    }
+}
+
+/*****************************************************************************/
+
+static char *
+_create_random_ipaddr(int addr_family, gboolean as_service)
+{
+    char delimiter = as_service ? ':' : '/';
+    int  num;
+
+    if (addr_family == AF_UNSPEC)
+        addr_family = nmtst_rand_select(AF_INET, AF_INET6);
+
+    g_assert(NM_IN_SET(addr_family, AF_INET, AF_INET6));
+
+    if (as_service)
+        num = (nmtst_get_rand_uint32() % 1000) + 30000;
+    else
+        num = addr_family == AF_INET ? 32 : 128;
+
+    if (addr_family == AF_INET)
+        return g_strdup_printf("192.168.%u.%u%c%d",
+                               nmtst_get_rand_uint32() % 256,
+                               nmtst_get_rand_uint32() % 256,
+                               delimiter,
+                               num);
+    else
+        return g_strdup_printf("a:b:c::%02x:%02x%c%d",
+                               nmtst_get_rand_uint32() % 256,
+                               nmtst_get_rand_uint32() % 256,
+                               delimiter,
+                               num);
+}
+
+/*****************************************************************************/
+
+static void
+compare_blob_data(const char *test, const char *key_path, GBytes *key)
+{
+    gs_free char *contents = NULL;
+    gsize         len      = 0;
+    GError *      error    = NULL;
+    gboolean      success;
+
+    g_assert(key && g_bytes_get_size(key) > 0);
+
+    success = g_file_get_contents(key_path, &contents, &len, &error);
+    nmtst_assert_success(success, error);
+
+    g_assert_cmpmem(contents, len, g_bytes_get_data(key, NULL), g_bytes_get_size(key));
+}
+
+static void
+check_scheme_path(GBytes *value, const char *path)
+{
+    const guint8 *p;
+    gsize         l;
+
+    g_assert(value);
+
+    p = g_bytes_get_data(value, &l);
+    g_assert_cmpint(l, ==, strlen(path) + NM_STRLEN(NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PATH) + 1);
+    g_assert(memcmp(p,
+                    NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PATH,
+                    strlen(NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PATH))
+             == 0);
+    p += strlen(NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PATH);
+    g_assert(memcmp(p, path, strlen(path)) == 0);
+    p += strlen(path);
+    g_assert(*p == '\0');
+}
+
+static void
+test_private_key_import(const char *path, const char *password, NMSetting8021xCKScheme scheme)
+{
+    NMSetting8021x *       s_8021x;
+    gboolean               success;
+    NMSetting8021xCKFormat format = NM_SETTING_802_1X_CK_FORMAT_UNKNOWN;
+    NMSetting8021xCKFormat tmp_fmt;
+    GError *               error   = NULL;
+    GBytes *               tmp_key = NULL, *client_cert = NULL;
+    const char *           pw;
+
+    s_8021x = (NMSetting8021x *) nm_setting_802_1x_new();
+    g_assert(s_8021x);
+
+    success = nm_setting_802_1x_set_private_key(s_8021x, path, password, scheme, &format, &error);
+    nmtst_assert_success(success, error);
+    g_assert(format != NM_SETTING_802_1X_CK_FORMAT_UNKNOWN);
+    tmp_fmt = nm_setting_802_1x_get_private_key_format(s_8021x);
+    g_assert(tmp_fmt == format);
+
+    /* Make sure the password is what we expect */
+    pw = nm_setting_802_1x_get_private_key_password(s_8021x);
+    g_assert(pw != NULL);
+    g_assert_cmpstr(pw, ==, password);
+
+    if (scheme == NM_SETTING_802_1X_CK_SCHEME_BLOB) {
+        tmp_key = nm_setting_802_1x_get_private_key_blob(s_8021x);
+        compare_blob_data("private-key-import", path, tmp_key);
+    } else if (scheme == NM_SETTING_802_1X_CK_SCHEME_PATH) {
+        g_object_get(s_8021x, NM_SETTING_802_1X_PRIVATE_KEY, &tmp_key, NULL);
+        check_scheme_path(tmp_key, path);
+        g_bytes_unref(tmp_key);
+    } else
+        g_assert_not_reached();
+
+    /* If it's PKCS#12 ensure the client cert is the same value */
+    if (format == NM_SETTING_802_1X_CK_FORMAT_PKCS12) {
+        g_object_get(s_8021x, NM_SETTING_802_1X_PRIVATE_KEY, &tmp_key, NULL);
+        g_assert(tmp_key);
+
+        g_object_get(s_8021x, NM_SETTING_802_1X_CLIENT_CERT, &client_cert, NULL);
+        g_assert(client_cert);
+
+        /* make sure they are the same */
+        g_assert(g_bytes_equal(tmp_key, client_cert));
+
+        g_bytes_unref(tmp_key);
+        g_bytes_unref(client_cert);
+    }
+
+    g_object_unref(s_8021x);
+}
+
+/*****************************************************************************/
+
+static void
+_do_test_connection_uuid(NMConnection *con, const char *uuid, const char *expected_uuid)
+{
+    NMSettingConnection *s_con;
+    gs_free char *       uuid_old = NULL;
+    gboolean             success;
+    gboolean             is_normalized;
+    char                 uuid_normalized[37];
+
+    nmtst_assert_connection_verifies_without_normalization(con);
+
+    s_con = NM_SETTING_CONNECTION(nm_connection_get_setting(con, NM_TYPE_SETTING_CONNECTION));
+    g_assert(NM_IS_SETTING_CONNECTION(s_con));
+
+    g_assert(uuid);
+
+    uuid_old = g_strdup(nm_setting_connection_get_uuid(s_con));
+
+    g_assert(nm_utils_is_uuid(uuid_old));
+
+    g_object_set(s_con, NM_SETTING_CONNECTION_UUID, uuid, NULL);
+
+    g_assert_cmpstr(uuid, ==, nm_setting_connection_get_uuid(s_con));
+
+    if (nm_streq0(uuid, expected_uuid)) {
+        nmtst_assert_connection_verifies_without_normalization(con);
+        g_assert(nm_utils_is_uuid(uuid));
+        g_assert(nm_uuid_is_valid(uuid));
+        g_assert(nm_uuid_is_valid_nm(uuid, &is_normalized, NULL));
+        g_assert(!is_normalized);
+    } else if (!expected_uuid) {
+        gs_free_error GError *error = NULL;
+
+        success = nm_connection_verify(con, &error);
+        nmtst_assert_no_success(success, error);
+        g_assert_error(error, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_INVALID_PROPERTY);
+
+        g_assert(!nm_utils_is_uuid(uuid));
+        g_assert(!nm_uuid_is_valid(uuid));
+        g_assert(!nm_uuid_is_valid_nmlegacy(uuid));
+        g_assert(!nm_uuid_is_valid_nm(uuid, NULL, NULL));
+    } else {
+        gs_free_error GError *error = NULL;
+
+        nmtst_assert_connection_verifies_and_normalizable(con);
+
+        success = nm_connection_verify(con, &error);
+        nmtst_assert_success(success, error);
+
+        if (!nmtst_connection_normalize(con))
+            g_assert_not_reached();
+
+        g_assert_cmpstr(expected_uuid, ==, nm_setting_connection_get_uuid(s_con));
+        g_assert(nm_uuid_is_valid(expected_uuid));
+
+        g_assert(nm_utils_is_uuid(uuid));
+        g_assert(nm_uuid_is_valid_nmlegacy(uuid));
+        g_assert(nm_uuid_is_valid_nm(uuid, &is_normalized, uuid_normalized));
+
+        g_assert_cmpstr(expected_uuid, ==, uuid_normalized);
+    }
+
+    g_object_set(s_con, NM_SETTING_CONNECTION_UUID, uuid_old, NULL);
+    nmtst_assert_connection_verifies_without_normalization(con);
+
+    if (expected_uuid && !nm_streq(expected_uuid, uuid))
+        _do_test_connection_uuid(con, expected_uuid, expected_uuid);
+}
+
+static void
+test_connection_uuid(void)
+{
+    gs_unref_object NMConnection *con = NULL;
+
+    con = nmtst_create_minimal_connection("test-uuid", NULL, NM_SETTING_WIRED_SETTING_NAME, NULL);
+
+    nmtst_connection_normalize(con);
+
+#define _do_test_connection_uuid_bad(con, uuid) _do_test_connection_uuid((con), "" uuid "", NULL)
+
+#define _do_test_connection_uuid_good(con, uuid) \
+    _do_test_connection_uuid((con), "" uuid "", "" uuid "")
+
+#define _do_test_connection_uuid_norm(con, uuid, expected_uuid) \
+    _do_test_connection_uuid((con), "" uuid "", "" expected_uuid "")
+
+    _do_test_connection_uuid_bad(con, "x1e775e3-a316-4eb2-b4d8-4b0f2bcaea53");
+    _do_test_connection_uuid_bad(con, "1e775e3aa3164eb2b4d84b0f2bcaea53abcdabc");
+    _do_test_connection_uuid_bad(con, "1e775e3aa3164eb2b4d84b0f2bcaea53abcdabcdd");
+
+    _do_test_connection_uuid_good(con, "a1e775e3-a316-4eb2-b4d8-4b0f2bcaea53");
+
+    _do_test_connection_uuid_norm(con,
+                                  "A1E775e3-a316-4eb2-b4d8-4b0f2bcaea53",
+                                  "a1e775e3-a316-4eb2-b4d8-4b0f2bcaea53");
+    _do_test_connection_uuid_norm(con,
+                                  "A1E775E3-A316-4EB2-B4D8-4B0F2BCAEA53",
+                                  "a1e775e3-a316-4eb2-b4d8-4b0f2bcaea53");
+    _do_test_connection_uuid_norm(con,
+                                  "-1e775e3aa316-4eb2-b4d8-4b0f2bcaea53",
+                                  "bdd73688-5c87-5454-917d-f5c3faed39c0");
+    _do_test_connection_uuid_norm(con,
+                                  "----1e775e3aa3164eb2b4d84b0f2bcaea53",
+                                  "8a232814-c6cf-54c9-9384-71a60011d0b2");
+    _do_test_connection_uuid_norm(con,
+                                  "1e775e3aa3164eb2b4d84b0f2bcaea53abcdabcd",
+                                  "ae35a4a8-4029-5770-9fa4-d79a672874c3");
+    _do_test_connection_uuid_norm(con,
+                                  "1e775e3Aa3164eb2b4d84b0f2bcaea53abcdabcd",
+                                  "ae35a4a8-4029-5770-9fa4-d79a672874c3");
+    _do_test_connection_uuid_norm(con,
+                                  "1E775E3AA3164EB2B4D84B0F2BCAEA53ABCDABCD",
+                                  "ae35a4a8-4029-5770-9fa4-d79a672874c3");
+}
+
+/*****************************************************************************/
+
+static void
+test_phase2_private_key_import(const char *           path,
+                               const char *           password,
+                               NMSetting8021xCKScheme scheme)
+{
+    NMSetting8021x *       s_8021x;
+    gboolean               success;
+    NMSetting8021xCKFormat format = NM_SETTING_802_1X_CK_FORMAT_UNKNOWN;
+    NMSetting8021xCKFormat tmp_fmt;
+    GError *               error   = NULL;
+    GBytes *               tmp_key = NULL, *client_cert = NULL;
+    const char *           pw;
+
+    s_8021x = (NMSetting8021x *) nm_setting_802_1x_new();
+    g_assert(s_8021x);
+
+    success =
+        nm_setting_802_1x_set_phase2_private_key(s_8021x, path, password, scheme, &format, &error);
+    nmtst_assert_success(success, error);
+    g_assert(format != NM_SETTING_802_1X_CK_FORMAT_UNKNOWN);
+    tmp_fmt = nm_setting_802_1x_get_phase2_private_key_format(s_8021x);
+    g_assert(tmp_fmt == format);
+
+    /* Make sure the password is what we expect */
+    pw = nm_setting_802_1x_get_phase2_private_key_password(s_8021x);
+    g_assert(pw);
+    g_assert_cmpstr(pw, ==, password);
+
+    if (scheme == NM_SETTING_802_1X_CK_SCHEME_BLOB) {
+        tmp_key = nm_setting_802_1x_get_phase2_private_key_blob(s_8021x);
+        compare_blob_data("phase2-private-key-import", path, tmp_key);
+    } else if (scheme == NM_SETTING_802_1X_CK_SCHEME_PATH) {
+        g_object_get(s_8021x, NM_SETTING_802_1X_PHASE2_PRIVATE_KEY, &tmp_key, NULL);
+        check_scheme_path(tmp_key, path);
+        g_bytes_unref(tmp_key);
+    } else
+        g_assert_not_reached();
+
+    /* If it's PKCS#12 ensure the client cert is the same value */
+    if (format == NM_SETTING_802_1X_CK_FORMAT_PKCS12) {
+        g_object_get(s_8021x, NM_SETTING_802_1X_PHASE2_PRIVATE_KEY, &tmp_key, NULL);
+        g_assert(tmp_key);
+
+        g_object_get(s_8021x, NM_SETTING_802_1X_PHASE2_CLIENT_CERT, &client_cert, NULL);
+        g_assert(client_cert);
+
+        /* make sure they are the same */
+        g_assert(g_bytes_equal(tmp_key, client_cert));
+
+        g_bytes_unref(tmp_key);
+        g_bytes_unref(client_cert);
+    }
+
+    g_object_unref(s_8021x);
+}
+
+static void
+test_wrong_password_keeps_data(const char *path, const char *password)
+{
+    NMSetting8021x *       s_8021x;
+    gboolean               success;
+    NMSetting8021xCKFormat format = NM_SETTING_802_1X_CK_FORMAT_UNKNOWN;
+    GError *               error  = NULL;
+    const char *           pw;
+
+    s_8021x = (NMSetting8021x *) nm_setting_802_1x_new();
+    g_assert(s_8021x);
+
+    success = nm_setting_802_1x_set_private_key(s_8021x,
+                                                path,
+                                                password,
+                                                NM_SETTING_802_1X_CK_SCHEME_BLOB,
+                                                &format,
+                                                &error);
+    nmtst_assert_success(success, error);
+    g_assert(format != NM_SETTING_802_1X_CK_FORMAT_UNKNOWN);
+
+    /* Now try to set it to something that's not a certificate */
+    format  = NM_SETTING_802_1X_CK_FORMAT_UNKNOWN;
+    success = nm_setting_802_1x_set_private_key(s_8021x,
+                                                "Makefile.am",
+                                                password,
+                                                NM_SETTING_802_1X_CK_SCHEME_BLOB,
+                                                &format,
+                                                &error);
+    nmtst_assert_no_success(success, error);
+    g_assert(format == NM_SETTING_802_1X_CK_FORMAT_UNKNOWN);
+    g_clear_error(&error);
+
+    /* Make sure the password hasn't changed */
+    pw = nm_setting_802_1x_get_private_key_password(s_8021x);
+    g_assert(pw);
+    g_assert_cmpstr(pw, ==, password);
+
+    g_object_unref(s_8021x);
+}
+
+static void
+test_clear_private_key(const char *path, const char *password)
+{
+    NMSetting8021x *       s_8021x;
+    gboolean               success;
+    NMSetting8021xCKFormat format = NM_SETTING_802_1X_CK_FORMAT_UNKNOWN;
+    GError *               error  = NULL;
+    const char *           pw;
+
+    s_8021x = (NMSetting8021x *) nm_setting_802_1x_new();
+    g_assert(s_8021x);
+
+    success = nm_setting_802_1x_set_private_key(s_8021x,
+                                                path,
+                                                password,
+                                                NM_SETTING_802_1X_CK_SCHEME_BLOB,
+                                                &format,
+                                                &error);
+    nmtst_assert_success(success, error);
+    g_assert(format != NM_SETTING_802_1X_CK_FORMAT_UNKNOWN);
+
+    /* Make sure the password is what we expect */
+    pw = nm_setting_802_1x_get_private_key_password(s_8021x);
+    g_assert(pw);
+    g_assert_cmpstr(pw, ==, password);
+
+    /* Now clear it */
+    success = nm_setting_802_1x_set_private_key(s_8021x,
+                                                NULL,
+                                                NULL,
+                                                NM_SETTING_802_1X_CK_SCHEME_BLOB,
+                                                NULL,
+                                                &error);
+    nmtst_assert_success(success, error);
+
+    /* Ensure the password is also now clear */
+    g_assert(!nm_setting_802_1x_get_private_key_password(s_8021x));
+
+    g_object_unref(s_8021x);
+}
+
+static void
+test_wrong_phase2_password_keeps_data(const char *path, const char *password)
+{
+    NMSetting8021x *       s_8021x;
+    gboolean               success;
+    NMSetting8021xCKFormat format = NM_SETTING_802_1X_CK_FORMAT_UNKNOWN;
+    GError *               error  = NULL;
+    const char *           pw;
+
+    s_8021x = (NMSetting8021x *) nm_setting_802_1x_new();
+    g_assert(s_8021x);
+
+    success = nm_setting_802_1x_set_phase2_private_key(s_8021x,
+                                                       path,
+                                                       password,
+                                                       NM_SETTING_802_1X_CK_SCHEME_BLOB,
+                                                       &format,
+                                                       &error);
+    nmtst_assert_success(success, error);
+    g_assert(format != NM_SETTING_802_1X_CK_FORMAT_UNKNOWN);
+
+    /* Now try to set it to something that's not a certificate */
+    format  = NM_SETTING_802_1X_CK_FORMAT_UNKNOWN;
+    success = nm_setting_802_1x_set_phase2_private_key(s_8021x,
+                                                       "Makefile.am",
+                                                       password,
+                                                       NM_SETTING_802_1X_CK_SCHEME_BLOB,
+                                                       &format,
+                                                       &error);
+    nmtst_assert_no_success(success, error);
+    g_assert(format == NM_SETTING_802_1X_CK_FORMAT_UNKNOWN);
+    g_clear_error(&error);
+
+    /* Make sure the password hasn't changed */
+    pw = nm_setting_802_1x_get_phase2_private_key_password(s_8021x);
+    g_assert(pw);
+    g_assert_cmpstr(pw, ==, password);
+
+    g_object_unref(s_8021x);
+}
+
+static void
+test_clear_phase2_private_key(const char *path, const char *password)
+{
+    NMSetting8021x *       s_8021x;
+    gboolean               success;
+    NMSetting8021xCKFormat format = NM_SETTING_802_1X_CK_FORMAT_UNKNOWN;
+    GError *               error  = NULL;
+    const char *           pw;
+
+    s_8021x = (NMSetting8021x *) nm_setting_802_1x_new();
+    g_assert(s_8021x);
+
+    success = nm_setting_802_1x_set_phase2_private_key(s_8021x,
+                                                       path,
+                                                       password,
+                                                       NM_SETTING_802_1X_CK_SCHEME_BLOB,
+                                                       &format,
+                                                       &error);
+    nmtst_assert_success(success, error);
+    g_assert(format != NM_SETTING_802_1X_CK_FORMAT_UNKNOWN);
+
+    /* Make sure the password is what we expect */
+    pw = nm_setting_802_1x_get_phase2_private_key_password(s_8021x);
+    g_assert(pw);
+    g_assert_cmpstr(pw, ==, password);
+
+    /* Now clear it */
+    success = nm_setting_802_1x_set_phase2_private_key(s_8021x,
+                                                       NULL,
+                                                       NULL,
+                                                       NM_SETTING_802_1X_CK_SCHEME_BLOB,
+                                                       NULL,
+                                                       &error);
+    nmtst_assert_success(success, error);
+
+    /* Ensure the password is also now clear */
+    g_assert(!nm_setting_802_1x_get_phase2_private_key_password(s_8021x));
+
+    g_object_unref(s_8021x);
+}
+
+static void
+test_8021x(gconstpointer test_data)
+{
+    char **parts, *path, *password;
+
+    parts = g_strsplit((const char *) test_data, ", ", -1);
+    g_assert_cmpint(g_strv_length(parts), ==, 2);
+
+    path     = g_build_filename(TEST_CERT_DIR, parts[0], NULL);
+    password = parts[1];
+
+    /* Test phase1 and phase2 path scheme */
+    test_private_key_import(path, password, NM_SETTING_802_1X_CK_SCHEME_PATH);
+    test_phase2_private_key_import(path, password, NM_SETTING_802_1X_CK_SCHEME_PATH);
+
+    /* Test phase1 and phase2 blob scheme */
+    test_private_key_import(path, password, NM_SETTING_802_1X_CK_SCHEME_BLOB);
+    test_phase2_private_key_import(path, password, NM_SETTING_802_1X_CK_SCHEME_BLOB);
+
+    /* Test that using a wrong password does not change existing data */
+    test_wrong_password_keeps_data(path, password);
+    test_wrong_phase2_password_keeps_data(path, password);
+
+    /* Test clearing the private key */
+    test_clear_private_key(path, password);
+    test_clear_phase2_private_key(path, password);
+
+    g_free(path);
+    g_strfreev(parts);
+}
+
+/*****************************************************************************/
+
+static void
+create_bond_connection(NMConnection **con, NMSettingBond **s_bond)
+{
+    NMSettingConnection *s_con;
+
+    g_assert(con);
+    g_assert(s_bond);
+
+    *con = nmtst_create_minimal_connection("bond", NULL, NM_SETTING_BOND_SETTING_NAME, &s_con);
+
+    g_object_set(s_con, NM_SETTING_CONNECTION_INTERFACE_NAME, "bond0", NULL);
+
+    *s_bond = (NMSettingBond *) nm_setting_bond_new();
+    g_assert(*s_bond);
+
+    nm_connection_add_setting(*con, NM_SETTING(*s_bond));
+}
+
+#define test_verify_options(exp, ...) _test_verify_options(exp, NM_MAKE_STRV(__VA_ARGS__))
+
+static void
+_test_verify_options(gboolean expected_result, const char *const *options)
+{
+    gs_unref_object NMConnection *con = NULL;
+    NMSettingBond *               s_bond;
+    const char *const *           option;
+
+    g_assert(NM_PTRARRAY_LEN(options) % 2 == 0);
+
+    create_bond_connection(&con, &s_bond);
+
+    for (option = options; option[0]; option += 2)
+        g_assert(nm_setting_bond_add_option(s_bond, option[0], option[1]));
+
+    if (expected_result) {
+        nmtst_assert_connection_verifies_and_normalizable(con);
+    } else {
+        nmtst_assert_connection_unnormalizable(con,
+                                               NM_CONNECTION_ERROR,
+                                               NM_CONNECTION_ERROR_INVALID_PROPERTY);
+    }
+}
+
+static void
+test_bond_verify(void)
+{
+    test_verify_options(TRUE, "mode", "3", "arp_interval", "0");
+    test_verify_options(FALSE,
+                        /* arp_interval not supported in balance-alb mode */
+                        "mode",
+                        "balance-alb",
+                        "arp_interval",
+                        "1",
+                        "arp_ip_target",
+                        "1.2.3.4");
+    test_verify_options(FALSE,
+                        /* arp_ip_target requires arp_interval */
+                        "mode",
+                        "balance-rr",
+                        "arp_ip_target",
+                        "1.2.3.4");
+    test_verify_options(TRUE,
+                        "mode",
+                        "balance-rr",
+                        "arp_interval",
+                        "1",
+                        "arp_ip_target",
+                        "1.2.3.4");
+    test_verify_options(FALSE,
+                        /* num_grat_arp, num_unsol_na cannot be different */
+                        "mode",
+                        "balance-rr",
+                        "num_grat_arp",
+                        "3",
+                        "num_unsol_na",
+                        "4");
+    test_verify_options(TRUE, "mode", "balance-rr", "num_grat_arp", "5", "num_unsol_na", "5");
+    test_verify_options(TRUE, "mode", "active-backup", "primary", "eth0");
+    test_verify_options(FALSE,
+                        /* primary requires mode=active-backup */
+                        "mode",
+                        "802.3ad",
+                        "primary",
+                        "eth0");
+    test_verify_options(TRUE, "mode", "802.3ad", "lacp_rate", "fast");
+    test_verify_options(FALSE,
+                        /* lacp_rate=fast requires mode=802.3ad */
+                        "mode",
+                        "balance-rr",
+                        "lacp_rate",
+                        "fast");
+    test_verify_options(TRUE, "mode", "802.3ad", "ad_actor_system", "ae:00:11:33:44:55");
+    test_verify_options(TRUE, "mode", "0", "miimon", "0", "updelay", "0", "downdelay", "0");
+    test_verify_options(TRUE, "mode", "0", "downdelay", "0", "updelay", "0");
+    test_verify_options(TRUE,
+                        "mode",
+                        "0",
+                        "miimon",
+                        "100",
+                        "arp_ip_target",
+                        "1.1.1.1",
+                        "arp_interval",
+                        "200");
+    test_verify_options(TRUE,
+                        "mode",
+                        "0",
+                        "downdelay",
+                        "100",
+                        "arp_ip_target",
+                        "1.1.1.1",
+                        "arp_interval",
+                        "200");
+}
+
+static void
+test_bond_compare_options(gboolean exp_res, const char **opts1, const char **opts2)
+{
+    gs_unref_object NMSettingBond *s_bond1 = NULL, *s_bond2 = NULL;
+    const char **                  p;
+
+    s_bond1 = (NMSettingBond *) nm_setting_bond_new();
+    g_assert(s_bond1);
+    s_bond2 = (NMSettingBond *) nm_setting_bond_new();
+    g_assert(s_bond2);
+
+    for (p = opts1; p[0] && p[1]; p += 2)
+        g_assert(nm_setting_bond_add_option(s_bond1, p[0], p[1]));
+
+    for (p = opts2; p[0] && p[1]; p += 2)
+        g_assert(nm_setting_bond_add_option(s_bond2, p[0], p[1]));
+
+    g_assert_cmpint(nm_setting_compare((NMSetting *) s_bond1,
+                                       (NMSetting *) s_bond2,
+                                       NM_SETTING_COMPARE_FLAG_EXACT),
+                    ==,
+                    exp_res);
+}
+
+static void
+test_bond_compare(void)
+{
+    test_bond_compare_options(TRUE,
+                              ((const char *[]){"mode", "balance-rr", "miimon", "1", NULL}),
+                              ((const char *[]){"mode", "balance-rr", "miimon", "1", NULL}));
+    test_bond_compare_options(FALSE,
+                              ((const char *[]){"mode", "balance-rr", "miimon", "1", NULL}),
+                              ((const char *[]){"mode", "balance-rr", "miimon", "2", NULL}));
+
+    test_bond_compare_options(FALSE,
+                              ((const char *[]){"miimon", "1", NULL}),
+                              ((const char *[]){"miimon", "1", "updelay", "0", NULL}));
+
+    test_bond_compare_options(FALSE,
+                              ((const char *[]){"num_grat_arp", "2", NULL}),
+                              ((const char *[]){"num_grat_arp", "1", NULL}));
+    test_bond_compare_options(FALSE,
+                              ((const char *[]){"num_grat_arp", "3", NULL}),
+                              ((const char *[]){"num_unsol_na", "3", NULL}));
+    test_bond_compare_options(FALSE,
+                              ((const char *[]){"num_grat_arp", "4", NULL}),
+                              ((const char *[]){"num_unsol_na", "4", "num_grat_arp", "4", NULL}));
+
+    test_bond_compare_options(FALSE,
+                              ((const char *[]){"mode", "balance-rr", "miimon", "100", NULL}),
+                              ((const char *[]){"mode", "balance-rr", NULL}));
+}
+
+static void
+test_bond_normalize_options(const char **opts1, const char **opts2)
+{
+    gs_unref_object NMConnection *con = NULL;
+    NMSettingBond *               s_bond;
+    GError *                      error = NULL;
+    gboolean                      success;
+    const char **                 p;
+    int                           num = 0;
+
+    create_bond_connection(&con, &s_bond);
+
+    for (p = opts1; p[0] && p[1]; p += 2)
+        g_assert(nm_setting_bond_add_option(s_bond, p[0], p[1]));
+
+    nmtst_assert_connection_verifies_and_normalizable(con);
+    nmtst_connection_normalize(con);
+    success = nm_setting_verify((NMSetting *) s_bond, con, &error);
+    nmtst_assert_success(success, error);
+
+    for (p = opts2; p[0] && p[1]; p += 2) {
+        g_assert_cmpstr(nm_setting_bond_get_option_by_name(s_bond, p[0]), ==, p[1]);
+        num++;
+    }
+
+    g_assert_cmpint(num, ==, nm_setting_bond_get_num_options(s_bond));
+}
+
+static void
+test_bond_normalize(void)
+{
+    test_bond_normalize_options(
+        ((const char *[]){"mode", "802.3ad", "ad_actor_system", "00:02:03:04:05:06", NULL}),
+        ((const char *[]){"mode", "802.3ad", "ad_actor_system", "00:02:03:04:05:06", NULL}));
+    test_bond_normalize_options(((const char *[]){"mode", "1", "miimon", "1", NULL}),
+                                ((const char *[]){"mode", "active-backup", "miimon", "1", NULL}));
+    test_bond_normalize_options(
+        ((const char *[]){"mode", "balance-alb", "tlb_dynamic_lb", "1", NULL}),
+        ((const char *[]){"mode", "balance-alb", "tlb_dynamic_lb", "1", NULL}));
+    test_bond_normalize_options(
+        ((const char *[]){"mode", "balance-tlb", "tlb_dynamic_lb", "1", NULL}),
+        ((const char *[]){"mode", "balance-tlb", "tlb_dynamic_lb", "1", NULL}));
+    test_bond_normalize_options(
+        ((const char
+              *[]){"mode", "balance-rr", "ad_actor_sys_prio", "4", "packets_per_slave", "3", NULL}),
+        ((const char *[]){"mode", "balance-rr", "packets_per_slave", "3", NULL}));
+}
+
+/*****************************************************************************/
+
+#define DCB_FLAGS_ALL \
+    (NM_SETTING_DCB_FLAG_ENABLE | NM_SETTING_DCB_FLAG_ADVERTISE | NM_SETTING_DCB_FLAG_WILLING)
+
+static void
+test_dcb_flags_valid(void)
+{
+    gs_unref_object NMSettingDcb *s_dcb = NULL;
+    GError *                      error = NULL;
+    gboolean                      success;
+    guint                         i;
+
+    s_dcb = (NMSettingDcb *) nm_setting_dcb_new();
+    g_assert(s_dcb);
+
+    g_assert_cmpint(nm_setting_dcb_get_app_fcoe_flags(s_dcb), ==, 0);
+    g_assert_cmpint(nm_setting_dcb_get_app_iscsi_flags(s_dcb), ==, 0);
+    g_assert_cmpint(nm_setting_dcb_get_app_fip_flags(s_dcb), ==, 0);
+    g_assert_cmpint(nm_setting_dcb_get_priority_flow_control_flags(s_dcb), ==, 0);
+    g_assert_cmpint(nm_setting_dcb_get_priority_group_flags(s_dcb), ==, 0);
+
+    g_object_set(G_OBJECT(s_dcb),
+                 NM_SETTING_DCB_APP_FCOE_FLAGS,
+                 DCB_FLAGS_ALL,
+                 NM_SETTING_DCB_APP_ISCSI_FLAGS,
+                 DCB_FLAGS_ALL,
+                 NM_SETTING_DCB_APP_FIP_FLAGS,
+                 DCB_FLAGS_ALL,
+                 NM_SETTING_DCB_PRIORITY_FLOW_CONTROL_FLAGS,
+                 DCB_FLAGS_ALL,
+                 NM_SETTING_DCB_PRIORITY_GROUP_FLAGS,
+                 DCB_FLAGS_ALL,
+                 NULL);
+    /* Priority Group Bandwidth must total 100% */
+    for (i = 0; i < 7; i++)
+        nm_setting_dcb_set_priority_group_bandwidth(s_dcb, i, 12);
+    nm_setting_dcb_set_priority_group_bandwidth(s_dcb, 7, 16);
+
+    success = nm_setting_verify(NM_SETTING(s_dcb), NULL, &error);
+    g_assert_no_error(error);
+    g_assert(success);
+
+    g_assert_cmpint(nm_setting_dcb_get_app_fcoe_flags(s_dcb), ==, DCB_FLAGS_ALL);
+    g_assert_cmpint(nm_setting_dcb_get_app_iscsi_flags(s_dcb), ==, DCB_FLAGS_ALL);
+    g_assert_cmpint(nm_setting_dcb_get_app_fip_flags(s_dcb), ==, DCB_FLAGS_ALL);
+    g_assert_cmpint(nm_setting_dcb_get_priority_flow_control_flags(s_dcb), ==, DCB_FLAGS_ALL);
+    g_assert_cmpint(nm_setting_dcb_get_priority_group_flags(s_dcb), ==, DCB_FLAGS_ALL);
+}
+
+#define TEST_FLAG(p, f, v)                                                           \
+    {                                                                                \
+        /* GObject property min/max should ensure the property does not get set to \
+     * the invalid value, so we ensure the value we just tried to set is 0 and \
+     * that verify is successful since the property never got set. \
+     */ \
+        g_object_set(G_OBJECT(s_dcb), p, v, NULL);                                   \
+        g_assert_cmpint(f(s_dcb), ==, 0);                                            \
+        success = nm_setting_verify(NM_SETTING(s_dcb), NULL, &error);                \
+        g_assert_no_error(error);                                                    \
+        g_assert(success);                                                           \
+    }
+
+static void
+test_dcb_flags_invalid(void)
+{
+    gs_unref_object NMSettingDcb *s_dcb = NULL;
+    GError *                      error = NULL;
+    gboolean                      success;
+
+    s_dcb = (NMSettingDcb *) nm_setting_dcb_new();
+    g_assert(s_dcb);
+
+    NMTST_EXPECT("GLib-GObject", G_LOG_LEVEL_WARNING, "*invalid or out of range*");
+    TEST_FLAG(NM_SETTING_DCB_APP_FCOE_FLAGS, nm_setting_dcb_get_app_fcoe_flags, 0x332523);
+    g_test_assert_expected_messages();
+
+    NMTST_EXPECT("GLib-GObject", G_LOG_LEVEL_WARNING, "*invalid or out of range*");
+    TEST_FLAG(NM_SETTING_DCB_APP_ISCSI_FLAGS, nm_setting_dcb_get_app_iscsi_flags, 0xFF);
+    g_test_assert_expected_messages();
+
+    NMTST_EXPECT("GLib-GObject", G_LOG_LEVEL_WARNING, "*invalid or out of range*");
+    TEST_FLAG(NM_SETTING_DCB_APP_FIP_FLAGS, nm_setting_dcb_get_app_fip_flags, 0x1111);
+    g_test_assert_expected_messages();
+
+    NMTST_EXPECT("GLib-GObject", G_LOG_LEVEL_WARNING, "*invalid or out of range*");
+    TEST_FLAG(NM_SETTING_DCB_PRIORITY_FLOW_CONTROL_FLAGS,
+              nm_setting_dcb_get_priority_flow_control_flags,
+              G_MAXUINT32);
+    g_test_assert_expected_messages();
+
+    NMTST_EXPECT("GLib-GObject", G_LOG_LEVEL_WARNING, "*invalid or out of range*");
+    TEST_FLAG(
+        NM_SETTING_DCB_PRIORITY_GROUP_FLAGS,
+        nm_setting_dcb_get_priority_group_flags,
+        (NM_SETTING_DCB_FLAG_ENABLE | NM_SETTING_DCB_FLAG_ADVERTISE | NM_SETTING_DCB_FLAG_WILLING)
+            + 1);
+    g_test_assert_expected_messages();
+}
+
+#define TEST_APP_PRIORITY(lcprop, ucprop, v)                                                   \
+    {                                                                                          \
+        g_object_set(G_OBJECT(s_dcb),                                                          \
+                     NM_SETTING_DCB_APP_##ucprop##_FLAGS,                                      \
+                     NM_SETTING_DCB_FLAG_NONE,                                                 \
+                     NULL);                                                                    \
+                                                                                               \
+        g_object_set(G_OBJECT(s_dcb), NM_SETTING_DCB_APP_##ucprop##_PRIORITY, v, NULL);        \
+        g_assert_cmpint(nm_setting_dcb_get_app_##lcprop##_priority(s_dcb), ==, v);             \
+                                                                                               \
+        /* Assert that the setting is invalid while the app is disabled unless v is default */ \
+        success = nm_setting_verify(NM_SETTING(s_dcb), NULL, &error);                          \
+        if (v >= 0) {                                                                          \
+            g_assert_error(error, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_INVALID_PROPERTY);  \
+            g_assert(success == FALSE);                                                        \
+        } else {                                                                               \
+            g_assert_no_error(error);                                                          \
+            g_assert(success);                                                                 \
+        }                                                                                      \
+        g_clear_error(&error);                                                                 \
+                                                                                               \
+        /* Set the enable flag and re-verify, this time it should be valid */                  \
+        g_object_set(G_OBJECT(s_dcb),                                                          \
+                     NM_SETTING_DCB_APP_##ucprop##_FLAGS,                                      \
+                     NM_SETTING_DCB_FLAG_ENABLE,                                               \
+                     NULL);                                                                    \
+        success = nm_setting_verify(NM_SETTING(s_dcb), NULL, &error);                          \
+        g_assert_no_error(error);                                                              \
+        g_assert(success);                                                                     \
+                                                                                               \
+        g_object_set(G_OBJECT(s_dcb), NM_SETTING_DCB_APP_##ucprop##_PRIORITY, 0, NULL);        \
+    }
+
+static void
+test_dcb_app_priorities(void)
+{
+    gs_unref_object NMSettingDcb *s_dcb = NULL;
+    GError *                      error = NULL;
+    gboolean                      success;
+
+    s_dcb = (NMSettingDcb *) nm_setting_dcb_new();
+    g_assert(s_dcb);
+
+    /* Defaults */
+    g_assert_cmpint(nm_setting_dcb_get_app_fcoe_priority(s_dcb), ==, -1);
+    g_assert_cmpint(nm_setting_dcb_get_app_iscsi_priority(s_dcb), ==, -1);
+    g_assert_cmpint(nm_setting_dcb_get_app_fip_priority(s_dcb), ==, -1);
+
+    TEST_APP_PRIORITY(fcoe, FCOE, 6);
+    TEST_APP_PRIORITY(iscsi, ISCSI, 5);
+    TEST_APP_PRIORITY(fip, FIP, 4);
+
+    TEST_APP_PRIORITY(fcoe, FCOE, -1);
+    TEST_APP_PRIORITY(iscsi, ISCSI, -1);
+    TEST_APP_PRIORITY(fip, FIP, -1);
+}
+
+#define TEST_PRIORITY_VALID(fn, id, val, flagsprop, verify)                                       \
+    {                                                                                             \
+        /* Assert that setting the value gets the same value back out */                          \
+        nm_setting_dcb_set_priority_##fn(s_dcb, id, val);                                         \
+        g_assert_cmpint(nm_setting_dcb_get_priority_##fn(s_dcb, id), ==, val);                    \
+                                                                                                  \
+        if (verify) {                                                                             \
+            if (val != 0) {                                                                       \
+                /* Assert that verify fails because the flags do not include 'enabled' \
+             * and a value has been set. \
+             */          \
+                success = nm_setting_verify(NM_SETTING(s_dcb), NULL, &error);                     \
+                g_assert_error(error, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_INVALID_PROPERTY); \
+                g_assert(success == FALSE);                                                       \
+                g_clear_error(&error);                                                            \
+            }                                                                                     \
+                                                                                                  \
+            /* Assert that adding the 'enabled' flag verifies the setting */                      \
+            g_object_set(G_OBJECT(s_dcb),                                                         \
+                         NM_SETTING_DCB_PRIORITY_##flagsprop##_FLAGS,                             \
+                         NM_SETTING_DCB_FLAG_ENABLE,                                              \
+                         NULL);                                                                   \
+            success = nm_setting_verify(NM_SETTING(s_dcb), NULL, &error);                         \
+            g_assert_no_error(error);                                                             \
+            g_assert(success);                                                                    \
+        }                                                                                         \
+                                                                                                  \
+        /* Reset everything */                                                                    \
+        g_object_set(G_OBJECT(s_dcb),                                                             \
+                     NM_SETTING_DCB_PRIORITY_##flagsprop##_FLAGS,                                 \
+                     NM_SETTING_DCB_FLAG_NONE,                                                    \
+                     NULL);                                                                       \
+        nm_setting_dcb_set_priority_##fn(s_dcb, id, 0);                                           \
+    }
+
+/* If Priority Groups are enabled, PG bandwidth must equal 100% */
+#define SET_VALID_PRIORITY_GROUP_BANDWIDTH                             \
+    {                                                                  \
+        guint x;                                                       \
+        for (x = 0; x < 7; x++)                                        \
+            nm_setting_dcb_set_priority_group_bandwidth(s_dcb, x, 12); \
+        nm_setting_dcb_set_priority_group_bandwidth(s_dcb, 7, 16);     \
+    }
+
+static void
+test_dcb_priorities_valid(void)
+{
+    gs_unref_object NMSettingDcb *s_dcb = NULL;
+    GError *                      error = NULL;
+    gboolean                      success;
+    guint                         i;
+
+    s_dcb = (NMSettingDcb *) nm_setting_dcb_new();
+    g_assert(s_dcb);
+
+    for (i = 0; i < 8; i++)
+        TEST_PRIORITY_VALID(flow_control, i, TRUE, FLOW_CONTROL, TRUE);
+
+    SET_VALID_PRIORITY_GROUP_BANDWIDTH
+    for (i = 0; i < 8; i++) {
+        TEST_PRIORITY_VALID(group_id, i, i, GROUP, TRUE);
+        TEST_PRIORITY_VALID(group_id, i, 7 - i, GROUP, TRUE);
+    }
+
+    /* Clear PG bandwidth from earlier tests */
+    for (i = 0; i < 8; i++)
+        nm_setting_dcb_set_priority_group_bandwidth(s_dcb, i, 0);
+
+    /* Priority Group Bandwidth must add up to 100% if enabled, which requires
+     * some dancing for verifying individual values here.
+     */
+    for (i = 0; i < 8; i++) {
+        guint other = 7 - (i % 8);
+
+        /* Set another priority group to the remaining bandwidth */
+        nm_setting_dcb_set_priority_group_bandwidth(s_dcb, other, 100 - i);
+        TEST_PRIORITY_VALID(group_bandwidth, i, i, GROUP, TRUE);
+
+        /* Set another priority group to the remaining bandwidth */
+        nm_setting_dcb_set_priority_group_bandwidth(s_dcb, other, 100 - (7 - i));
+        TEST_PRIORITY_VALID(group_bandwidth, i, 7 - i, GROUP, TRUE);
+
+        /* Clear remaining bandwidth */
+        nm_setting_dcb_set_priority_group_bandwidth(s_dcb, other, 0);
+    }
+
+    SET_VALID_PRIORITY_GROUP_BANDWIDTH
+    for (i = 0; i < 8; i++) {
+        TEST_PRIORITY_VALID(bandwidth, i, i, GROUP, TRUE);
+        TEST_PRIORITY_VALID(bandwidth, i, 7 - i, GROUP, TRUE);
+    }
+
+    SET_VALID_PRIORITY_GROUP_BANDWIDTH
+    for (i = 0; i < 8; i++)
+        TEST_PRIORITY_VALID(strict_bandwidth, i, TRUE, GROUP, TRUE);
+
+    SET_VALID_PRIORITY_GROUP_BANDWIDTH
+    for (i = 0; i < 8; i++) {
+        TEST_PRIORITY_VALID(traffic_class, i, i, GROUP, TRUE);
+        TEST_PRIORITY_VALID(traffic_class, i, 7 - i, GROUP, TRUE);
+    }
+}
+
+static void
+test_dcb_bandwidth_sums(void)
+{
+    gs_unref_object NMSettingDcb *s_dcb = NULL;
+    GError *                      error = NULL;
+    gboolean                      success;
+
+    s_dcb = (NMSettingDcb *) nm_setting_dcb_new();
+    g_assert(s_dcb);
+
+    /* Assert that setting the value gets the same value back out */
+    nm_setting_dcb_set_priority_group_bandwidth(s_dcb, 0, 9);
+    nm_setting_dcb_set_priority_group_bandwidth(s_dcb, 1, 10);
+    nm_setting_dcb_set_priority_group_bandwidth(s_dcb, 2, 11);
+    nm_setting_dcb_set_priority_group_bandwidth(s_dcb, 3, 12);
+    nm_setting_dcb_set_priority_group_bandwidth(s_dcb, 4, 13);
+    nm_setting_dcb_set_priority_group_bandwidth(s_dcb, 5, 14);
+    nm_setting_dcb_set_priority_group_bandwidth(s_dcb, 6, 15);
+    nm_setting_dcb_set_priority_group_bandwidth(s_dcb, 7, 16);
+
+    /* Assert verify success when sums total 100% */
+    g_object_set(G_OBJECT(s_dcb),
+                 NM_SETTING_DCB_PRIORITY_GROUP_FLAGS,
+                 NM_SETTING_DCB_FLAG_ENABLE,
+                 NULL);
+    success = nm_setting_verify(NM_SETTING(s_dcb), NULL, &error);
+    g_assert_no_error(error);
+    g_assert(success);
+
+    /* Assert verify fails when sums do not total 100% */
+    nm_setting_dcb_set_priority_group_bandwidth(s_dcb, 4, 20);
+    success = nm_setting_verify(NM_SETTING(s_dcb), NULL, &error);
+    g_assert_error(error, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_INVALID_PROPERTY);
+    g_assert(success == FALSE);
+    g_clear_error(&error);
+}
+
+/*****************************************************************************/
+
+static void
+test_nm_json(void)
+{
+    g_assert(NM_IN_SET(WITH_JANSSON, 0, 1));
+
+#if WITH_JANSSON
+    g_assert(nm_json_vt());
+#else
+    g_assert(!nm_json_vt());
+#endif
+
+#if WITH_JANSSON != defined(JANSSON_SONAME)
+    #error "WITH_JANSON and JANSSON_SONAME are defined inconsistently."
+#endif
+}
+
+/*****************************************************************************/
+
+static void
+_test_team_config_sync(const char *team_config,
+                       int         notify_peer_count,
+                       int         notify_peers_interval,
+                       int         mcast_rejoin_count,
+                       int         mcast_rejoin_interval,
+                       char *      runner,
+                       char *      runner_hwaddr_policy,        /* activebackup */
+                       GPtrArray * runner_tx_hash,              /* lacp, loadbalance */
+                       char *      runner_tx_balancer,          /* lacp, loadbalance */
+                       int         runner_tx_balancer_interval, /* lacp, loadbalance */
+                       gboolean    runner_active,               /* lacp */
+                       gboolean    runner_fast_rate,            /* lacp */
+                       int         runner_sys_prio,             /* lacp */
+                       int         runner_min_ports,            /* lacp */
+                       char *      runner_agg_select_policy,    /* lacp */
+                       GPtrArray * link_watchers)
+{
+    gs_unref_object NMSettingTeam *s_team = NULL;
+    guint                          i, j;
+    gboolean                       found;
+
+    if (!nm_json_vt()) {
+        g_test_skip("team test requires JSON validation");
+        return;
+    }
+
+    s_team = (NMSettingTeam *) nm_setting_team_new();
+    g_assert(s_team);
+
+    g_object_set(s_team, NM_SETTING_TEAM_CONFIG, team_config, NULL);
+    g_assert_cmpint(nm_setting_team_get_notify_peers_count(s_team), ==, notify_peer_count);
+    g_assert_cmpint(nm_setting_team_get_notify_peers_interval(s_team), ==, notify_peers_interval);
+    g_assert_cmpint(nm_setting_team_get_mcast_rejoin_count(s_team), ==, mcast_rejoin_count);
+    g_assert_cmpint(nm_setting_team_get_mcast_rejoin_interval(s_team), ==, mcast_rejoin_interval);
+    g_assert_cmpint(nm_setting_team_get_runner_tx_balancer_interval(s_team),
+                    ==,
+                    runner_tx_balancer_interval);
+    g_assert_cmpint(nm_setting_team_get_runner_active(s_team), ==, runner_active);
+    g_assert_cmpint(nm_setting_team_get_runner_fast_rate(s_team), ==, runner_fast_rate);
+    g_assert_cmpint(nm_setting_team_get_runner_sys_prio(s_team), ==, runner_sys_prio);
+    g_assert_cmpint(nm_setting_team_get_runner_min_ports(s_team), ==, runner_min_ports);
+    g_assert_cmpstr(nm_setting_team_get_runner(s_team), ==, runner);
+    g_assert_cmpstr(nm_setting_team_get_runner_hwaddr_policy(s_team), ==, runner_hwaddr_policy);
+    g_assert_cmpstr(nm_setting_team_get_runner_tx_balancer(s_team), ==, runner_tx_balancer);
+    g_assert_cmpstr(nm_setting_team_get_runner_agg_select_policy(s_team),
+                    ==,
+                    runner_agg_select_policy);
+
+    if (runner_tx_hash) {
+        g_assert_cmpint(runner_tx_hash->len, ==, nm_setting_team_get_num_runner_tx_hash(s_team));
+        for (i = 0; i < runner_tx_hash->len; i++) {
+            found = FALSE;
+            for (j = 0; j < nm_setting_team_get_num_runner_tx_hash(s_team); j++) {
+                if (nm_streq0(nm_setting_team_get_runner_tx_hash(s_team, j),
+                              runner_tx_hash->pdata[i])) {
+                    found = TRUE;
+                    break;
+                }
+            }
+            g_assert(found);
+        }
+    }
+
+    if (link_watchers) {
+        g_assert_cmpint(link_watchers->len, ==, nm_setting_team_get_num_link_watchers(s_team));
+        for (i = 0; i < link_watchers->len; i++) {
+            found = FALSE;
+            for (j = 0; j < nm_setting_team_get_num_link_watchers(s_team); j++) {
+                if (nm_team_link_watcher_equal(link_watchers->pdata[i],
+                                               nm_setting_team_get_link_watcher(s_team, j))) {
+                    found = TRUE;
+                    break;
+                }
+            }
+            g_assert(found);
+        }
+    }
+
+    g_assert(nm_setting_verify((NMSetting *) s_team, NULL, NULL));
+}
+
+static void
+test_runner_roundrobin_sync_from_config(void)
+{
+    _test_team_config_sync("",
+                           -1,
+                           -1,
+                           -1,
+                           -1,
+                           NULL,
+                           NULL,
+                           NULL,
+                           NULL,
+                           -1,
+                           TRUE,
+                           FALSE,
+                           -1,
+                           -1,
+                           NULL,
+                           NULL);
+}
+
+static void
+test_runner_broadcast_sync_from_config(void)
+{
+    _test_team_config_sync("{\"runner\": {\"name\": \"broadcast\"}}",
+                           -1,
+                           -1,
+                           -1,
+                           -1,
+                           NM_SETTING_TEAM_RUNNER_BROADCAST,
+                           NULL,
+                           NULL,
+                           NULL,
+                           -1,
+                           TRUE,
+                           FALSE,
+                           -1,
+                           -1,
+                           NULL,
+                           NULL);
+}
+
+static void
+test_runner_random_sync_from_config(void)
+{
+    _test_team_config_sync("{\"runner\": {\"name\": \"random\"}}",
+                           -1,
+                           -1,
+                           -1,
+                           -1,
+                           NM_SETTING_TEAM_RUNNER_RANDOM,
+                           NULL,
+                           NULL,
+                           NULL,
+                           -1,
+                           TRUE,
+                           FALSE,
+                           -1,
+                           -1,
+                           NULL,
+                           NULL);
+}
+
+static void
+test_runner_activebackup_sync_from_config(void)
+{
+    _test_team_config_sync("{\"runner\": {\"name\": \"activebackup\"}}",
+                           -1,
+                           -1,
+                           -1,
+                           -1,
+                           NM_SETTING_TEAM_RUNNER_ACTIVEBACKUP,
+                           NULL,
+                           NULL,
+                           NULL,
+                           -1,
+                           TRUE,
+                           FALSE,
+                           -1,
+                           -1,
+                           NULL,
+                           NULL);
+}
+
+static void
+test_runner_loadbalance_sync_from_config(void)
+{
+    gs_unref_ptrarray GPtrArray *tx_hash = NULL;
+
+    tx_hash = g_ptr_array_new_with_free_func(g_free);
+    g_ptr_array_add(tx_hash, g_strdup("eth"));
+    g_ptr_array_add(tx_hash, g_strdup("ipv4"));
+    g_ptr_array_add(tx_hash, g_strdup("ipv6"));
+
+    _test_team_config_sync("{\"runner\": {\"name\": \"loadbalance\"}}",
+                           -1,
+                           -1,
+                           -1,
+                           -1,
+                           NM_SETTING_TEAM_RUNNER_LOADBALANCE,
+                           NULL,
+                           NULL,
+                           NULL,
+                           -1,
+                           TRUE,
+                           FALSE,
+                           -1,
+                           -1,
+                           NULL,
+                           NULL);
+
+    _test_team_config_sync("{\"runner\": {\"name\": \"loadbalance\", "
+                           "\"tx_hash\": [\"eth\", \"ipv4\", \"ipv6\"]}}",
+                           -1,
+                           -1,
+                           -1,
+                           -1,
+                           NM_SETTING_TEAM_RUNNER_LOADBALANCE,
+                           NULL,
+                           tx_hash,
+                           NULL,
+                           -1,
+                           TRUE,
+                           FALSE,
+                           -1,
+                           -1,
+                           NULL,
+                           NULL);
+
+    _test_team_config_sync(
+        "{\"runner\": {\"name\": \"loadbalance\", \"tx_hash\": [\"eth\", \"ipv4\", \"ipv6\"], "
+        "\"tx_balancer\": {\"name\": \"basic\", \"balancing_interval\": 30}}}",
+        -1,
+        -1,
+        -1,
+        -1,
+        NM_SETTING_TEAM_RUNNER_LOADBALANCE,
+        NULL,
+        tx_hash,
+        "basic",
+        30,
+        TRUE,
+        FALSE,
+        -1,
+        -1,
+        NULL,
+        NULL);
+}
+
+static void
+test_runner_lacp_sync_from_config(void)
+{
+    gs_unref_ptrarray GPtrArray *tx_hash = NULL;
+
+    tx_hash = g_ptr_array_new_with_free_func(g_free);
+    g_ptr_array_add(tx_hash, g_strdup("eth"));
+    g_ptr_array_add(tx_hash, g_strdup("ipv4"));
+    g_ptr_array_add(tx_hash, g_strdup("ipv6"));
+
+    _test_team_config_sync(
+        "{\"runner\": {\"name\": \"lacp\", \"tx_hash\": [\"eth\", \"ipv4\", \"ipv6\"]}}",
+        -1,
+        -1,
+        -1,
+        -1,
+        NM_SETTING_TEAM_RUNNER_LACP,
+        NULL,
+        tx_hash,
+        NULL,
+        -1,
+        TRUE,
+        FALSE,
+        -1,
+        -1,
+        NULL,
+        NULL);
+
+    _test_team_config_sync(
+        "{\"runner\": {\"name\": \"lacp\", \"tx_hash\": [\"eth\", \"ipv4\", \"ipv6\"], "
+        "\"active\": false, \"fast_rate\": true, \"sys_prio\": 10, \"min_ports\": 5, "
+        "\"agg_select_policy\": \"port_config\"}}",
+        -1,
+        -1,
+        -1,
+        -1,
+        NM_SETTING_TEAM_RUNNER_LACP,
+        NULL,
+        tx_hash,
+        NULL,
+        -1,
+        FALSE,
+        TRUE,
+        10,
+        5,
+        "port_config",
+        NULL);
+}
+
+static void
+test_watcher_ethtool_sync_from_config(void)
+{
+    gs_unref_ptrarray GPtrArray *link_watchers = NULL;
+
+    link_watchers = g_ptr_array_new_with_free_func((GDestroyNotify) nm_team_link_watcher_unref);
+    g_ptr_array_add(link_watchers, nm_team_link_watcher_new_ethtool(0, 0, NULL));
+    _test_team_config_sync("{\"link_watch\": {\"name\": \"ethtool\"}}",
+                           -1,
+                           -1,
+                           -1,
+                           -1,
+                           NULL,
+                           NULL,
+                           NULL,
+                           NULL,
+                           -1,
+                           TRUE,
+                           FALSE,
+                           -1,
+                           -1,
+                           NULL,
+                           link_watchers);
+}
+
+static void
+test_watcher_nsna_ping_sync_from_config(void)
+{
+    gs_unref_ptrarray GPtrArray *link_watchers = NULL;
+
+    link_watchers = g_ptr_array_new_with_free_func((GDestroyNotify) nm_team_link_watcher_unref);
+    g_ptr_array_add(link_watchers,
+                    nm_team_link_watcher_new_nsna_ping(0, 0, 3, "target.host", NULL));
+    _test_team_config_sync(
+        "{\"link_watch\": {\"name\": \"nsna_ping\", \"target_host\": \"target.host\"}}",
+        -1,
+        -1,
+        -1,
+        -1,
+        NULL,
+        NULL,
+        NULL,
+        NULL,
+        -1,
+        TRUE,
+        FALSE,
+        -1,
+        -1,
+        NULL,
+        link_watchers);
+}
+
+static void
+test_watcher_arp_ping_sync_from_config(void)
+{
+    gs_unref_ptrarray GPtrArray *link_watchers = NULL;
+
+    link_watchers = g_ptr_array_new_with_free_func((GDestroyNotify) nm_team_link_watcher_unref);
+    g_ptr_array_add(
+        link_watchers,
+        nm_team_link_watcher_new_arp_ping(0, 0, 3, "target.host", "source.host", 0, NULL));
+    _test_team_config_sync(
+        "{\"link_watch\": {\"name\": \"arp_ping\", \"target_host\": \"target.host\", "
+        "\"source_host\": \"source.host\"}}",
+        -1,
+        -1,
+        -1,
+        -1,
+        NULL,
+        NULL,
+        NULL,
+        NULL,
+        -1,
+        TRUE,
+        FALSE,
+        -1,
+        -1,
+        NULL,
+        link_watchers);
+}
+
+static void
+test_multiple_watchers_sync_from_config(void)
+{
+    gs_unref_ptrarray GPtrArray *link_watchers = NULL;
+
+    link_watchers = g_ptr_array_new_with_free_func((GDestroyNotify) nm_team_link_watcher_unref);
+    g_ptr_array_add(link_watchers, nm_team_link_watcher_new_ethtool(2, 4, NULL));
+    g_ptr_array_add(link_watchers,
+                    nm_team_link_watcher_new_nsna_ping(3, 6, 9, "target.host", NULL));
+    g_ptr_array_add(
+        link_watchers,
+        nm_team_link_watcher_new_arp_ping(5,
+                                          10,
+                                          15,
+                                          "target.host",
+                                          "source.host",
+                                          NM_TEAM_LINK_WATCHER_ARP_PING_FLAG_VALIDATE_ACTIVE
+                                              | NM_TEAM_LINK_WATCHER_ARP_PING_FLAG_VALIDATE_INACTIVE
+                                              | NM_TEAM_LINK_WATCHER_ARP_PING_FLAG_SEND_ALWAYS,
+                                          NULL));
+    _test_team_config_sync(
+        "{\"link_watch\": ["
+        "{\"name\": \"ethtool\", \"delay_up\": 2, \"delay_down\": 4}, "
+        "{\"name\": \"arp_ping\", \"init_wait\": 5, \"interval\": 10, \"missed_max\": 15, "
+        "\"target_host\": \"target.host\", \"source_host\": \"source.host\", "
+        "\"validate_active\": true, \"validate_inactive\": true, \"send_always\": true}, "
+        "{\"name\": \"nsna_ping\", \"init_wait\": 3, \"interval\": 6, \"missed_max\": 9, "
+        "\"target_host\": \"target.host\"}]}",
+        -1,
+        -1,
+        -1,
+        -1,
+        NULL,
+        NULL,
+        NULL,
+        NULL,
+        -1,
+        TRUE,
+        FALSE,
+        -1,
+        -1,
+        NULL,
+        link_watchers);
+}
+
+/*****************************************************************************/
+
+static void
+_test_team_port_config_sync(const char *team_port_config,
+                            int         queue_id,
+                            int         prio,
+                            gboolean    sticky,
+                            int         lacp_prio,
+                            int         lacp_key,
+                            GPtrArray * link_watchers)
+{
+    gs_unref_object NMSettingTeamPort *s_team_port = NULL;
+    guint                              i, j;
+    gboolean                           found;
+
+    if (!nm_json_vt()) {
+        g_test_skip("team test requires JSON validation");
+        return;
+    }
+
+    s_team_port = (NMSettingTeamPort *) nm_setting_team_port_new();
+    g_assert(s_team_port);
+
+    g_object_set(s_team_port, NM_SETTING_TEAM_CONFIG, team_port_config, NULL);
+    g_assert(nm_setting_team_port_get_queue_id(s_team_port) == queue_id);
+    g_assert(nm_setting_team_port_get_prio(s_team_port) == prio);
+    g_assert(nm_setting_team_port_get_sticky(s_team_port) == sticky);
+    g_assert(nm_setting_team_port_get_lacp_prio(s_team_port) == lacp_prio);
+    g_assert(nm_setting_team_port_get_lacp_key(s_team_port) == lacp_key);
+
+    if (link_watchers) {
+        g_assert(link_watchers->len == nm_setting_team_port_get_num_link_watchers(s_team_port));
+        for (i = 0; i < link_watchers->len; i++) {
+            found = FALSE;
+            for (j = 0; j < nm_setting_team_port_get_num_link_watchers(s_team_port); j++) {
+                if (nm_team_link_watcher_equal(
+                        link_watchers->pdata[i],
+                        nm_setting_team_port_get_link_watcher(s_team_port, j))) {
+                    found = TRUE;
+                    break;
+                }
+            }
+            g_assert(found);
+        }
+    }
+
+    g_assert(nm_setting_verify((NMSetting *) s_team_port, NULL, NULL));
+}
+
+static void
+test_team_port_default(void)
+{
+    _test_team_port_config_sync("", -1, 0, FALSE, -1, -1, NULL);
+}
+
+static void
+test_team_port_queue_id(void)
+{
+    _test_team_port_config_sync("{\"queue_id\": 3}", 3, 0, FALSE, -1, -1, NULL);
+    _test_team_port_config_sync("{\"queue_id\": 0}", 0, 0, FALSE, -1, -1, NULL);
+}
+
+static void
+test_team_port_prio(void)
+{
+    _test_team_port_config_sync("{\"prio\": 6}", -1, 6, FALSE, -1, -1, NULL);
+    _test_team_port_config_sync("{\"prio\": 0}", -1, 0, FALSE, -1, -1, NULL);
+}
+
+static void
+test_team_port_sticky(void)
+{
+    _test_team_port_config_sync("{\"sticky\": true}", -1, 0, TRUE, -1, -1, NULL);
+    _test_team_port_config_sync("{\"sticky\": false}", -1, 0, FALSE, -1, -1, NULL);
+}
+
+static void
+test_team_port_lacp_prio(void)
+{
+    _test_team_port_config_sync("{\"lacp_prio\": 9}", -1, 0, FALSE, 9, -1, NULL);
+    _test_team_port_config_sync("{\"lacp_prio\": 0}", -1, 0, FALSE, 0, -1, NULL);
+}
+
+static void
+test_team_port_lacp_key(void)
+{
+    _test_team_port_config_sync("{\"lacp_key\": 12}", -1, 0, FALSE, -1, 12, NULL);
+    _test_team_port_config_sync("{\"lacp_key\": 0}", -1, 0, FALSE, -1, 0, NULL);
+}
+
+static void
+test_team_port_full_config(void)
+{
+    gs_unref_ptrarray GPtrArray *link_watchers = NULL;
+
+    link_watchers = g_ptr_array_new_with_free_func((GDestroyNotify) nm_team_link_watcher_unref);
+    g_ptr_array_add(
+        link_watchers,
+        nm_team_link_watcher_new_arp_ping(0,
+                                          3,
+                                          3,
+                                          "1.2.3.2",
+                                          "1.2.3.1",
+                                          NM_TEAM_LINK_WATCHER_ARP_PING_FLAG_VALIDATE_INACTIVE,
+                                          NULL));
+    g_ptr_array_add(
+        link_watchers,
+        nm_team_link_watcher_new_arp_ping(1,
+                                          1,
+                                          0,
+                                          "1.2.3.4",
+                                          "1.2.3.1",
+                                          NM_TEAM_LINK_WATCHER_ARP_PING_FLAG_SEND_ALWAYS,
+                                          NULL));
+
+    _test_team_port_config_sync(
+        "{\"queue_id\": 10, \"prio\": 20, \"sticky\": true, \"lacp_prio\": 30, "
+        "\"lacp_key\": 40, \"link_watch\": ["
+        "{\"name\": \"arp_ping\", \"interval\": 3, \"target_host\": \"1.2.3.2\", "
+        "\"source_host\": \"1.2.3.1\", \"validate_inactive\": true}, "
+        "{\"name\": \"arp_ping\", \"init_wait\": 1, \"interval\": 1, "
+        "\"target_host\": \"1.2.3.4\", \"source_host\": \"1.2.3.1\", "
+        "\"send_always\": true}]}",
+        10,
+        20,
+        true,
+        30,
+        40,
+        NULL);
+}
+
+/*****************************************************************************/
+
+static void
+_check_team_setting(NMSetting *setting)
+{
+    gs_unref_object NMSetting *setting2      = NULL;
+    gs_unref_object NMSetting *setting_clone = NULL;
+    gboolean                   is_port       = NM_IS_SETTING_TEAM_PORT(setting);
+    gs_unref_variant GVariant *variant2      = NULL;
+    gs_unref_variant GVariant *variant3      = NULL;
+
+    g_assert(NM_IS_SETTING_TEAM(setting) || is_port);
+
+    setting2 = g_object_new(G_OBJECT_TYPE(setting),
+                            is_port ? NM_SETTING_TEAM_PORT_CONFIG : NM_SETTING_TEAM_CONFIG,
+                            is_port ? nm_setting_team_port_get_config(NM_SETTING_TEAM_PORT(setting))
+                                    : nm_setting_team_get_config(NM_SETTING_TEAM(setting)),
+                            NULL);
+
+    if (nm_json_vt())
+        nmtst_assert_setting_is_equal(setting, setting2, NM_SETTING_COMPARE_FLAG_EXACT);
+
+    g_clear_object(&setting2);
+
+    nmtst_assert_setting_dbus_roundtrip(setting);
+
+    /* OK, now parse the setting only from the D-Bus variant, but removing the JSON config.
+     * For that, we have to "drop" the JSON and we do that by resetting the property.
+     * This causes JSON to be regenerated and it's in a normalized form that will compare
+     * equal. */
+    setting_clone = nm_setting_duplicate(setting);
+    setting       = setting_clone;
+    if (is_port) {
+        g_object_set(setting,
+                     NM_SETTING_TEAM_PORT_STICKY,
+                     nm_setting_team_port_get_sticky(NM_SETTING_TEAM_PORT(setting)),
+                     NULL);
+    } else {
+        g_object_set(setting,
+                     NM_SETTING_TEAM_RUNNER_SYS_PRIO,
+                     nm_setting_team_get_runner_sys_prio(NM_SETTING_TEAM(setting)),
+                     NULL);
+    }
+    variant2 = _nm_setting_to_dbus(setting, NULL, NM_CONNECTION_SERIALIZE_ALL, NULL);
+    variant3 = nm_utils_gvariant_vardict_filter_drop_one(variant2, "config");
+    setting2 = nmtst_assert_setting_dbus_new(G_OBJECT_TYPE(setting), variant3);
+    nmtst_assert_setting_is_equal(setting, setting2, NM_SETTING_COMPARE_FLAG_EXACT);
+}
+
+static void
+test_team_setting(void)
+{
+    gs_unref_variant GVariant *variant = nmtst_variant_from_string(
+        G_VARIANT_TYPE_VARDICT,
+        "{'config': <'{\"link_watch\": {\"name\": \"ethtool\"}}'>, 'interface-name': <'nm-team'>, "
+        "'link-watchers': <[{'name': <'ethtool'>}]>}");
+    gs_free_error GError *error             = NULL;
+    gs_unref_object NMSetting *     setting = NULL;
+    nm_auto_unref_team_link_watcher NMTeamLinkWatcher *watcher1 =
+        nm_team_link_watcher_new_nsna_ping(1, 3, 4, "bbb", NULL);
+    nm_auto_unref_team_link_watcher NMTeamLinkWatcher *watcher2 =
+        nm_team_link_watcher_new_arp_ping2(1, 3, 4, -1, "ccc", "ddd", 0, NULL);
+
+    g_assert(watcher1);
+    g_assert(watcher2);
+
+    setting = _nm_setting_new_from_dbus(NM_TYPE_SETTING_TEAM,
+                                        variant,
+                                        NULL,
+                                        NM_SETTING_PARSE_FLAGS_STRICT,
+                                        &error);
+    nmtst_assert_success(setting, error);
+    _check_team_setting(setting);
+
+    g_assert_cmpstr(nm_setting_team_get_config(NM_SETTING_TEAM(setting)),
+                    ==,
+                    "{\"link_watch\": {\"name\": \"ethtool\"}}");
+    g_assert_cmpint(nm_setting_team_get_num_link_watchers(NM_SETTING_TEAM(setting)), ==, 1);
+
+    g_object_set(setting, NM_SETTING_TEAM_RUNNER_SYS_PRIO, (int) 10, NULL);
+
+    _check_team_setting(setting);
+    g_assert_cmpint(nm_setting_team_get_num_link_watchers(NM_SETTING_TEAM(setting)), ==, 1);
+    g_assert_cmpstr(
+        nm_setting_team_get_config(NM_SETTING_TEAM(setting)),
+        ==,
+        "{ \"runner\": { \"sys_prio\": 10 }, \"link_watch\": { \"name\": \"ethtool\" } }");
+
+    nm_setting_team_remove_link_watcher(NM_SETTING_TEAM(setting), 0);
+
+    _check_team_setting(setting);
+    g_assert_cmpint(nm_setting_team_get_num_link_watchers(NM_SETTING_TEAM(setting)), ==, 0);
+    g_assert_cmpstr(nm_setting_team_get_config(NM_SETTING_TEAM(setting)),
+                    ==,
+                    "{ \"runner\": { \"sys_prio\": 10 } }");
+
+    nm_setting_team_add_link_watcher(NM_SETTING_TEAM(setting), watcher1);
+    _check_team_setting(setting);
+    g_assert_cmpstr(
+        nm_setting_team_get_config(NM_SETTING_TEAM(setting)),
+        ==,
+        "{ \"runner\": { \"sys_prio\": 10 }, \"link_watch\": { \"name\": \"nsna_ping\", "
+        "\"interval\": 3, \"init_wait\": 1, \"missed_max\": 4, \"target_host\": \"bbb\" } }");
+
+    nm_setting_team_add_link_watcher(NM_SETTING_TEAM(setting), watcher2);
+    _check_team_setting(setting);
+    g_assert_cmpstr(
+        nm_setting_team_get_config(NM_SETTING_TEAM(setting)),
+        ==,
+        "{ \"runner\": { \"sys_prio\": 10 }, \"link_watch\": [ { \"name\": \"nsna_ping\", "
+        "\"interval\": 3, \"init_wait\": 1, \"missed_max\": 4, \"target_host\": \"bbb\" }, { "
+        "\"name\": \"arp_ping\", \"interval\": 3, \"init_wait\": 1, \"missed_max\": 4, "
+        "\"source_host\": \"ddd\", \"target_host\": \"ccc\" } ] }");
+
+    nm_setting_team_remove_link_watcher(NM_SETTING_TEAM(setting), 0);
+    nm_setting_team_remove_link_watcher(NM_SETTING_TEAM(setting), 0);
+    g_object_set(setting, NM_SETTING_TEAM_RUNNER_TX_BALANCER_INTERVAL, (int) 5, NULL);
+    g_assert_cmpstr(
+        nm_setting_team_get_config(NM_SETTING_TEAM(setting)),
+        ==,
+        "{ \"runner\": { \"tx_balancer\": { \"balancing_interval\": 5 }, \"sys_prio\": 10 } }");
+
+    g_object_set(setting, NM_SETTING_TEAM_RUNNER, NULL, NULL);
+    _check_team_setting(setting);
+    g_assert_cmpstr(
+        nm_setting_team_get_config(NM_SETTING_TEAM(setting)),
+        ==,
+        "{ \"runner\": { \"tx_balancer\": { \"balancing_interval\": 5 }, \"sys_prio\": 10 } }");
+
+    g_object_set(setting,
+                 NM_SETTING_TEAM_CONFIG,
+                 "{ \"runner\": { \"tx_hash\": [ \"eth\", \"l3\" ] } }",
+                 NULL);
+    _check_team_setting(setting);
+}
+
+/*****************************************************************************/
+
+static void
+_setting_ethtool_set_feature(NMSettingEthtool *s_ethtool, const char *opt_name, NMTernary value)
+{
+    g_assert(NM_IS_SETTING_ETHTOOL(s_ethtool));
+
+    if (nmtst_get_rand_bool()) {
+        nm_setting_ethtool_set_feature(s_ethtool, opt_name, value);
+        return;
+    }
+
+    if (value == NM_TERNARY_DEFAULT) {
+        nm_setting_option_set(NM_SETTING(s_ethtool), opt_name, NULL);
+        return;
+    }
+
+    if (nmtst_get_rand_bool())
+        nm_setting_option_set_boolean(NM_SETTING(s_ethtool), opt_name, value);
+    else
+        nm_setting_option_set(NM_SETTING(s_ethtool), opt_name, g_variant_new_boolean(value));
+}
+
+static NMTernary
+_setting_ethtool_get_feature(NMSettingEthtool *s_ethtool, const char *opt_name)
+{
+    GVariant *v;
+    gboolean  b;
+
+    switch (nmtst_get_rand_uint32() % 3) {
+    case 0:
+        return nm_setting_ethtool_get_feature(s_ethtool, opt_name);
+    case 1:
+        if (!nm_setting_option_get_boolean(NM_SETTING(s_ethtool), opt_name, &b))
+            return NM_TERNARY_DEFAULT;
+        return b;
+    default:
+        v = nm_setting_option_get(NM_SETTING(s_ethtool), opt_name);
+        if (!v || !g_variant_is_of_type(v, G_VARIANT_TYPE_BOOLEAN))
+            return NM_TERNARY_DEFAULT;
+        return g_variant_get_boolean(v);
+    }
+}
+
+static void
+test_ethtool_features(void)
+{
+    gs_unref_object NMConnection *con       = NULL;
+    gs_unref_object NMConnection *con2      = NULL;
+    gs_unref_object NMConnection *con3      = NULL;
+    gs_unref_variant GVariant *variant      = NULL;
+    gs_free_error GError *error             = NULL;
+    nm_auto_unref_keyfile GKeyFile *keyfile = NULL;
+    NMSettingConnection *           s_con;
+    NMSettingEthtool *              s_ethtool;
+    NMSettingEthtool *              s_ethtool2;
+    NMSettingEthtool *              s_ethtool3;
+
+    con = nmtst_create_minimal_connection("ethtool-1", NULL, NM_SETTING_WIRED_SETTING_NAME, &s_con);
+    s_ethtool = NM_SETTING_ETHTOOL(nm_setting_ethtool_new());
+    nm_connection_add_setting(con, NM_SETTING(s_ethtool));
+
+    _setting_ethtool_set_feature(s_ethtool, NM_ETHTOOL_OPTNAME_FEATURE_RX, NM_TERNARY_TRUE);
+    _setting_ethtool_set_feature(s_ethtool, NM_ETHTOOL_OPTNAME_FEATURE_LRO, NM_TERNARY_FALSE);
+
+    g_assert_cmpint(_setting_ethtool_get_feature(s_ethtool, NM_ETHTOOL_OPTNAME_FEATURE_RX),
+                    ==,
+                    NM_TERNARY_TRUE);
+    g_assert_cmpint(_setting_ethtool_get_feature(s_ethtool, NM_ETHTOOL_OPTNAME_FEATURE_LRO),
+                    ==,
+                    NM_TERNARY_FALSE);
+    g_assert_cmpint(_setting_ethtool_get_feature(s_ethtool, NM_ETHTOOL_OPTNAME_FEATURE_SG),
+                    ==,
+                    NM_TERNARY_DEFAULT);
+
+    nmtst_connection_normalize(con);
+
+    variant = nm_connection_to_dbus(con, NM_CONNECTION_SERIALIZE_ALL);
+
+    con2 = nm_simple_connection_new_from_dbus(variant, &error);
+    nmtst_assert_success(con2, error);
+
+    s_ethtool2 = NM_SETTING_ETHTOOL(nm_connection_get_setting(con2, NM_TYPE_SETTING_ETHTOOL));
+
+    g_assert_cmpint(_setting_ethtool_get_feature(s_ethtool2, NM_ETHTOOL_OPTNAME_FEATURE_RX),
+                    ==,
+                    NM_TERNARY_TRUE);
+    g_assert_cmpint(_setting_ethtool_get_feature(s_ethtool2, NM_ETHTOOL_OPTNAME_FEATURE_LRO),
+                    ==,
+                    NM_TERNARY_FALSE);
+    g_assert_cmpint(_setting_ethtool_get_feature(s_ethtool2, NM_ETHTOOL_OPTNAME_FEATURE_SG),
+                    ==,
+                    NM_TERNARY_DEFAULT);
+
+    nmtst_assert_connection_verifies_without_normalization(con2);
+
+    nmtst_assert_connection_equals(con, FALSE, con2, FALSE);
+
+    keyfile = nm_keyfile_write(con, NM_KEYFILE_HANDLER_FLAGS_NONE, NULL, NULL, &error);
+    nmtst_assert_success(keyfile, error);
+
+    con3 = nm_keyfile_read(keyfile,
+                           "/ignored/current/working/directory/for/loading/relative/paths",
+                           NM_KEYFILE_HANDLER_FLAGS_NONE,
+                           NULL,
+                           NULL,
+                           &error);
+    nmtst_assert_success(con3, error);
+
+    nm_keyfile_read_ensure_id(con3, "unused-because-already-has-id");
+    nm_keyfile_read_ensure_uuid(con3, "unused-because-already-has-uuid");
+
+    nmtst_connection_normalize(con3);
+
+    nmtst_assert_connection_equals(con, FALSE, con3, FALSE);
+
+    s_ethtool3 = NM_SETTING_ETHTOOL(nm_connection_get_setting(con3, NM_TYPE_SETTING_ETHTOOL));
+
+    g_assert_cmpint(_setting_ethtool_get_feature(s_ethtool3, NM_ETHTOOL_OPTNAME_FEATURE_RX),
+                    ==,
+                    NM_TERNARY_TRUE);
+    g_assert_cmpint(_setting_ethtool_get_feature(s_ethtool3, NM_ETHTOOL_OPTNAME_FEATURE_LRO),
+                    ==,
+                    NM_TERNARY_FALSE);
+    g_assert_cmpint(_setting_ethtool_get_feature(s_ethtool3, NM_ETHTOOL_OPTNAME_FEATURE_SG),
+                    ==,
+                    NM_TERNARY_DEFAULT);
+}
+
+static void
+test_ethtool_coalesce(void)
+{
+    gs_unref_object NMConnection *con       = NULL;
+    gs_unref_object NMConnection *con2      = NULL;
+    gs_unref_object NMConnection *con3      = NULL;
+    gs_unref_variant GVariant *variant      = NULL;
+    gs_free_error GError *error             = NULL;
+    nm_auto_unref_keyfile GKeyFile *keyfile = NULL;
+    NMSettingConnection *           s_con;
+    NMSettingEthtool *              s_ethtool;
+    NMSettingEthtool *              s_ethtool2;
+    NMSettingEthtool *              s_ethtool3;
+    guint32                         u32;
+
+    con       = nmtst_create_minimal_connection("ethtool-coalesce",
+                                          NULL,
+                                          NM_SETTING_WIRED_SETTING_NAME,
+                                          &s_con);
+    s_ethtool = NM_SETTING_ETHTOOL(nm_setting_ethtool_new());
+    nm_connection_add_setting(con, NM_SETTING(s_ethtool));
+
+    nm_setting_option_set_uint32(NM_SETTING(s_ethtool), NM_ETHTOOL_OPTNAME_COALESCE_RX_FRAMES, 4);
+
+    g_assert_true(nm_setting_option_get_uint32(NM_SETTING(s_ethtool),
+                                               NM_ETHTOOL_OPTNAME_COALESCE_RX_FRAMES,
+                                               &u32));
+    g_assert_cmpuint(u32, ==, 4);
+
+    nmtst_connection_normalize(con);
+
+    variant = nm_connection_to_dbus(con, NM_CONNECTION_SERIALIZE_ALL);
+
+    con2 = nm_simple_connection_new_from_dbus(variant, &error);
+    nmtst_assert_success(con2, error);
+
+    s_ethtool2 = NM_SETTING_ETHTOOL(nm_connection_get_setting(con2, NM_TYPE_SETTING_ETHTOOL));
+
+    g_assert_true(nm_setting_option_get_uint32(NM_SETTING(s_ethtool2),
+                                               NM_ETHTOOL_OPTNAME_COALESCE_RX_FRAMES,
+                                               &u32));
+    g_assert_cmpuint(u32, ==, 4);
+
+    nmtst_assert_connection_verifies_without_normalization(con2);
+
+    nmtst_assert_connection_equals(con, FALSE, con2, FALSE);
+
+    keyfile = nm_keyfile_write(con, NM_KEYFILE_HANDLER_FLAGS_NONE, NULL, NULL, &error);
+    nmtst_assert_success(keyfile, error);
+
+    con3 = nm_keyfile_read(keyfile,
+                           "/ignored/current/working/directory/for/loading/relative/paths",
+                           NM_KEYFILE_HANDLER_FLAGS_NONE,
+                           NULL,
+                           NULL,
+                           &error);
+    nmtst_assert_success(con3, error);
+
+    nm_keyfile_read_ensure_id(con3, "unused-because-already-has-id");
+    nm_keyfile_read_ensure_uuid(con3, "unused-because-already-has-uuid");
+
+    nmtst_connection_normalize(con3);
+
+    nmtst_assert_connection_equals(con, FALSE, con3, FALSE);
+
+    s_ethtool3 = NM_SETTING_ETHTOOL(nm_connection_get_setting(con3, NM_TYPE_SETTING_ETHTOOL));
+
+    g_assert_true(nm_setting_option_get_uint32(NM_SETTING(s_ethtool3),
+                                               NM_ETHTOOL_OPTNAME_COALESCE_RX_FRAMES,
+                                               &u32));
+    g_assert_cmpuint(u32, ==, 4);
+
+    nm_setting_option_set(NM_SETTING(s_ethtool), NM_ETHTOOL_OPTNAME_COALESCE_RX_FRAMES, NULL);
+    g_assert_false(nm_setting_option_get_uint32(NM_SETTING(s_ethtool),
+                                                NM_ETHTOOL_OPTNAME_COALESCE_RX_FRAMES,
+                                                NULL));
+
+    nm_setting_option_set_uint32(NM_SETTING(s_ethtool), NM_ETHTOOL_OPTNAME_COALESCE_TX_FRAMES, 8);
+
+    g_assert_true(nm_setting_option_get_uint32(NM_SETTING(s_ethtool),
+                                               NM_ETHTOOL_OPTNAME_COALESCE_TX_FRAMES,
+                                               &u32));
+    g_assert_cmpuint(u32, ==, 8);
+
+    nm_setting_option_clear_by_name(NM_SETTING(s_ethtool), nm_ethtool_optname_is_coalesce);
+    g_assert_false(nm_setting_option_get_uint32(NM_SETTING(s_ethtool),
+                                                NM_ETHTOOL_OPTNAME_COALESCE_RX_FRAMES,
+                                                NULL));
+    g_assert_false(nm_setting_option_get_uint32(NM_SETTING(s_ethtool),
+                                                NM_ETHTOOL_OPTNAME_COALESCE_TX_FRAMES,
+                                                NULL));
+    g_assert_false(nm_setting_option_get_uint32(NM_SETTING(s_ethtool),
+                                                NM_ETHTOOL_OPTNAME_COALESCE_TX_USECS,
+                                                NULL));
+}
+
+static void
+test_ethtool_ring(void)
+{
+    gs_unref_object NMConnection *con       = NULL;
+    gs_unref_object NMConnection *con2      = NULL;
+    gs_unref_object NMConnection *con3      = NULL;
+    gs_unref_variant GVariant *variant      = NULL;
+    gs_free_error GError *error             = NULL;
+    nm_auto_unref_keyfile GKeyFile *keyfile = NULL;
+    NMSettingConnection *           s_con;
+    NMSettingEthtool *              s_ethtool;
+    NMSettingEthtool *              s_ethtool2;
+    NMSettingEthtool *              s_ethtool3;
+    guint32                         out_value;
+
+    con       = nmtst_create_minimal_connection("ethtool-ring",
+                                          NULL,
+                                          NM_SETTING_WIRED_SETTING_NAME,
+                                          &s_con);
+    s_ethtool = NM_SETTING_ETHTOOL(nm_setting_ethtool_new());
+    nm_connection_add_setting(con, NM_SETTING(s_ethtool));
+
+    nm_setting_option_set_uint32(NM_SETTING(s_ethtool), NM_ETHTOOL_OPTNAME_RING_RX_JUMBO, 4);
+
+    g_assert_true(nm_setting_option_get_uint32(NM_SETTING(s_ethtool),
+                                               NM_ETHTOOL_OPTNAME_RING_RX_JUMBO,
+                                               &out_value));
+    g_assert_cmpuint(out_value, ==, 4);
+
+    nmtst_connection_normalize(con);
+
+    variant = nm_connection_to_dbus(con, NM_CONNECTION_SERIALIZE_ALL);
+
+    con2 = nm_simple_connection_new_from_dbus(variant, &error);
+    nmtst_assert_success(con2, error);
+
+    s_ethtool2 = NM_SETTING_ETHTOOL(nm_connection_get_setting(con2, NM_TYPE_SETTING_ETHTOOL));
+
+    g_assert_true(nm_setting_option_get_uint32(NM_SETTING(s_ethtool2),
+                                               NM_ETHTOOL_OPTNAME_RING_RX_JUMBO,
+                                               &out_value));
+    g_assert_cmpuint(out_value, ==, 4);
+
+    nmtst_assert_connection_verifies_without_normalization(con2);
+
+    nmtst_assert_connection_equals(con, FALSE, con2, FALSE);
+
+    keyfile = nm_keyfile_write(con, NM_KEYFILE_HANDLER_FLAGS_NONE, NULL, NULL, &error);
+    nmtst_assert_success(keyfile, error);
+
+    con3 = nm_keyfile_read(keyfile,
+                           "/ignored/current/working/directory/for/loading/relative/paths",
+                           NM_KEYFILE_HANDLER_FLAGS_NONE,
+                           NULL,
+                           NULL,
+                           &error);
+    nmtst_assert_success(con3, error);
+
+    nm_keyfile_read_ensure_id(con3, "unused-because-already-has-id");
+    nm_keyfile_read_ensure_uuid(con3, "unused-because-already-has-uuid");
+
+    nmtst_connection_normalize(con3);
+
+    nmtst_assert_connection_equals(con, FALSE, con3, FALSE);
+
+    s_ethtool3 = NM_SETTING_ETHTOOL(nm_connection_get_setting(con3, NM_TYPE_SETTING_ETHTOOL));
+
+    g_assert_true(nm_setting_option_get_uint32(NM_SETTING(s_ethtool3),
+                                               NM_ETHTOOL_OPTNAME_RING_RX_JUMBO,
+                                               &out_value));
+    g_assert_cmpuint(out_value, ==, 4);
+
+    nm_setting_option_set(NM_SETTING(s_ethtool), NM_ETHTOOL_OPTNAME_RING_RX_JUMBO, NULL);
+    g_assert_false(nm_setting_option_get_uint32(NM_SETTING(s_ethtool),
+                                                NM_ETHTOOL_OPTNAME_RING_RX_JUMBO,
+                                                NULL));
+
+    nm_setting_option_set_uint32(NM_SETTING(s_ethtool), NM_ETHTOOL_OPTNAME_RING_RX_JUMBO, 8);
+
+    g_assert_true(nm_setting_option_get_uint32(NM_SETTING(s_ethtool),
+                                               NM_ETHTOOL_OPTNAME_RING_RX_JUMBO,
+                                               &out_value));
+    g_assert_cmpuint(out_value, ==, 8);
+
+    nm_setting_option_clear_by_name(NM_SETTING(s_ethtool), nm_ethtool_optname_is_ring);
+    g_assert_false(nm_setting_option_get_uint32(NM_SETTING(s_ethtool),
+                                                NM_ETHTOOL_OPTNAME_RING_RX_JUMBO,
+                                                NULL));
+    g_assert_false(
+        nm_setting_option_get_uint32(NM_SETTING(s_ethtool), NM_ETHTOOL_OPTNAME_RING_RX, NULL));
+    g_assert_false(
+        nm_setting_option_get_uint32(NM_SETTING(s_ethtool), NM_ETHTOOL_OPTNAME_RING_TX, NULL));
+}
+
+static void
+test_ethtool_pause(void)
+{
+    gs_unref_object NMConnection *con       = NULL;
+    gs_unref_object NMConnection *con2      = NULL;
+    gs_unref_object NMConnection *con3      = NULL;
+    gs_unref_variant GVariant *variant      = NULL;
+    gs_free_error GError *error             = NULL;
+    nm_auto_unref_keyfile GKeyFile *keyfile = NULL;
+    NMSettingConnection *           s_con;
+    NMSettingEthtool *              s_ethtool;
+    NMSettingEthtool *              s_ethtool2;
+    NMSettingEthtool *              s_ethtool3;
+    gboolean                        out_value;
+
+    con       = nmtst_create_minimal_connection("ethtool-pause",
+                                          NULL,
+                                          NM_SETTING_WIRED_SETTING_NAME,
+                                          &s_con);
+    s_ethtool = NM_SETTING_ETHTOOL(nm_setting_ethtool_new());
+    nm_connection_add_setting(con, NM_SETTING(s_ethtool));
+
+    nm_setting_option_set_boolean(NM_SETTING(s_ethtool), NM_ETHTOOL_OPTNAME_PAUSE_AUTONEG, FALSE);
+    nm_setting_option_set_boolean(NM_SETTING(s_ethtool), NM_ETHTOOL_OPTNAME_PAUSE_RX, TRUE);
+    nm_setting_option_set_boolean(NM_SETTING(s_ethtool), NM_ETHTOOL_OPTNAME_PAUSE_TX, TRUE);
+
+    g_assert_true(nm_setting_option_get_boolean(NM_SETTING(s_ethtool),
+                                                NM_ETHTOOL_OPTNAME_PAUSE_AUTONEG,
+                                                &out_value));
+    g_assert_true(!out_value);
+    g_assert_true(nm_setting_option_get_boolean(NM_SETTING(s_ethtool),
+                                                NM_ETHTOOL_OPTNAME_PAUSE_RX,
+                                                &out_value));
+    g_assert_true(out_value);
+    g_assert_true(nm_setting_option_get_boolean(NM_SETTING(s_ethtool),
+                                                NM_ETHTOOL_OPTNAME_PAUSE_TX,
+                                                &out_value));
+    g_assert_true(out_value);
+
+    nmtst_connection_normalize(con);
+
+    variant = nm_connection_to_dbus(con, NM_CONNECTION_SERIALIZE_ALL);
+
+    con2 = nm_simple_connection_new_from_dbus(variant, &error);
+    nmtst_assert_success(con2, error);
+
+    s_ethtool2 = NM_SETTING_ETHTOOL(nm_connection_get_setting(con2, NM_TYPE_SETTING_ETHTOOL));
+
+    g_assert_true(nm_setting_option_get_boolean(NM_SETTING(s_ethtool2),
+                                                NM_ETHTOOL_OPTNAME_PAUSE_AUTONEG,
+                                                &out_value));
+    g_assert_true(!out_value);
+
+    nmtst_assert_connection_verifies_without_normalization(con2);
+
+    nmtst_assert_connection_equals(con, FALSE, con2, FALSE);
+
+    con2 = nm_simple_connection_new_from_dbus(variant, &error);
+    nmtst_assert_success(con2, error);
+
+    keyfile = nm_keyfile_write(con, NM_KEYFILE_HANDLER_FLAGS_NONE, NULL, NULL, &error);
+    nmtst_assert_success(keyfile, error);
+
+    con3 = nm_keyfile_read(keyfile,
+                           "/ignored/current/working/directory/for/loading/relative/paths",
+                           NM_KEYFILE_HANDLER_FLAGS_NONE,
+                           NULL,
+                           NULL,
+                           &error);
+    nmtst_assert_success(con3, error);
+
+    nm_keyfile_read_ensure_id(con3, "unused-because-already-has-id");
+    nm_keyfile_read_ensure_uuid(con3, "unused-because-already-has-uuid");
+
+    nmtst_connection_normalize(con3);
+
+    nmtst_assert_connection_equals(con, FALSE, con3, FALSE);
+
+    s_ethtool3 = NM_SETTING_ETHTOOL(nm_connection_get_setting(con3, NM_TYPE_SETTING_ETHTOOL));
+
+    g_assert_true(nm_setting_option_get_boolean(NM_SETTING(s_ethtool3),
+                                                NM_ETHTOOL_OPTNAME_PAUSE_AUTONEG,
+                                                &out_value));
+    g_assert_true(!out_value);
+    g_assert_true(nm_setting_option_get_boolean(NM_SETTING(s_ethtool3),
+                                                NM_ETHTOOL_OPTNAME_PAUSE_RX,
+                                                &out_value));
+    g_assert_true(out_value);
+    g_assert_true(nm_setting_option_get_boolean(NM_SETTING(s_ethtool3),
+                                                NM_ETHTOOL_OPTNAME_PAUSE_TX,
+                                                &out_value));
+    g_assert_true(out_value);
+}
+
+/*****************************************************************************/
+
+static void
+test_sriov_vf(void)
+{
+    NMSriovVF *vf1, *vf2;
+    GError *   error = NULL;
+    char *     str;
+
+    vf1 = nm_sriov_vf_new(1);
+    nm_sriov_vf_set_attribute(vf1,
+                              NM_SRIOV_VF_ATTRIBUTE_MAC,
+                              g_variant_new_string("00:11:22:33:44:55"));
+    nm_sriov_vf_set_attribute(vf1, NM_SRIOV_VF_ATTRIBUTE_SPOOF_CHECK, g_variant_new_boolean(TRUE));
+    nm_sriov_vf_set_attribute(vf1, NM_SRIOV_VF_ATTRIBUTE_TRUST, g_variant_new_boolean(FALSE));
+    nm_sriov_vf_set_attribute(vf1, NM_SRIOV_VF_ATTRIBUTE_MIN_TX_RATE, g_variant_new_uint32(100));
+    nm_sriov_vf_set_attribute(vf1, NM_SRIOV_VF_ATTRIBUTE_MAX_TX_RATE, g_variant_new_uint32(500));
+
+    str = nm_utils_sriov_vf_to_str(vf1, FALSE, &error);
+    g_assert_no_error(error);
+    g_assert_cmpstr(
+        str,
+        ==,
+        "1 mac=00:11:22:33:44:55 max-tx-rate=500 min-tx-rate=100 spoof-check=true trust=false");
+    g_free(str);
+
+    vf2 = nm_utils_sriov_vf_from_str(" 1  mac=00:11:22:33:44:55  max-tx-rate=500 min-tx-rate=100",
+                                     &error);
+    nmtst_assert_success(vf2, error);
+    nm_sriov_vf_set_attribute(vf2, NM_SRIOV_VF_ATTRIBUTE_SPOOF_CHECK, g_variant_new_boolean(FALSE));
+    nm_sriov_vf_set_attribute(vf2, NM_SRIOV_VF_ATTRIBUTE_SPOOF_CHECK, g_variant_new_boolean(TRUE));
+    nm_sriov_vf_set_attribute(vf2, NM_SRIOV_VF_ATTRIBUTE_TRUST, g_variant_new_boolean(TRUE));
+    nm_sriov_vf_set_attribute(vf2, NM_SRIOV_VF_ATTRIBUTE_TRUST, NULL);
+    nm_sriov_vf_set_attribute(vf2, NM_SRIOV_VF_ATTRIBUTE_TRUST, g_variant_new_boolean(FALSE));
+
+    g_assert(nm_sriov_vf_equal(vf1, vf2));
+
+    nm_sriov_vf_unref(vf1);
+    nm_sriov_vf_unref(vf2);
+}
+
+static void
+test_sriov_vf_dup(void)
+{
+    NMSriovVF *vf1, *vf2;
+
+    vf1 = nm_sriov_vf_new(1);
+    nm_sriov_vf_set_attribute(vf1, NM_SRIOV_VF_ATTRIBUTE_MAC, g_variant_new_string("foobar"));
+    nm_sriov_vf_set_attribute(vf1, NM_SRIOV_VF_ATTRIBUTE_TRUST, g_variant_new_boolean(FALSE));
+    nm_sriov_vf_set_attribute(vf1, NM_SRIOV_VF_ATTRIBUTE_MIN_TX_RATE, g_variant_new_uint32(10));
+    nm_sriov_vf_set_attribute(vf1, NM_SRIOV_VF_ATTRIBUTE_MAX_TX_RATE, g_variant_new_uint32(1000));
+    nm_sriov_vf_add_vlan(vf1, 80);
+    nm_sriov_vf_set_vlan_qos(vf1, 80, NM_SRIOV_VF_VLAN_PROTOCOL_802_1AD);
+
+    vf2 = nm_sriov_vf_dup(vf1);
+    g_assert(nm_sriov_vf_equal(vf1, vf2));
+
+    nm_sriov_vf_unref(vf1);
+    nm_sriov_vf_unref(vf2);
+}
+
+static void
+test_sriov_vf_vlan(void)
+{
+    NMSriovVF *   vf;
+    const guint * vlan_ids;
+    guint         num;
+    GError *      error = NULL;
+    gs_free char *str   = NULL;
+
+    vf = nm_sriov_vf_new(19);
+    nm_sriov_vf_set_attribute(vf, NM_SRIOV_VF_ATTRIBUTE_MAC, g_variant_new_string("00:11:22"));
+    g_assert(nm_sriov_vf_add_vlan(vf, 80));
+    g_assert(!nm_sriov_vf_add_vlan(vf, 80));
+    g_assert(nm_sriov_vf_add_vlan(vf, 82));
+    g_assert(nm_sriov_vf_add_vlan(vf, 83));
+    g_assert(nm_sriov_vf_add_vlan(vf, 81));
+    g_assert(!nm_sriov_vf_remove_vlan(vf, 100));
+    g_assert(nm_sriov_vf_remove_vlan(vf, 82));
+    nm_sriov_vf_set_vlan_qos(vf, 81, 0xabba);
+    nm_sriov_vf_set_vlan_protocol(vf, 81, NM_SRIOV_VF_VLAN_PROTOCOL_802_1AD);
+
+    vlan_ids = nm_sriov_vf_get_vlan_ids(vf, &num);
+    g_assert(vlan_ids);
+    g_assert_cmpint(num, ==, 3);
+    g_assert_cmpint(vlan_ids[0], ==, 80);
+    g_assert_cmpint(vlan_ids[1], ==, 81);
+    g_assert_cmpint(vlan_ids[2], ==, 83);
+    g_assert_cmpint(nm_sriov_vf_get_vlan_qos(vf, 80), ==, 0x0);
+    g_assert_cmpint(nm_sriov_vf_get_vlan_protocol(vf, 80), ==, NM_SRIOV_VF_VLAN_PROTOCOL_802_1Q);
+    g_assert_cmpint(nm_sriov_vf_get_vlan_qos(vf, 81), ==, 0xabba);
+    g_assert_cmpint(nm_sriov_vf_get_vlan_protocol(vf, 81), ==, NM_SRIOV_VF_VLAN_PROTOCOL_802_1AD);
+
+    nm_sriov_vf_unref(vf);
+
+    vf = nm_utils_sriov_vf_from_str("20 spoof-check=false vlans=85.0.q;4000.0x20.ad;81.10;83",
+                                    &error);
+    nmtst_assert_success(vf, error);
+    vlan_ids = nm_sriov_vf_get_vlan_ids(vf, &num);
+    g_assert(vlan_ids);
+    g_assert_cmpint(num, ==, 4);
+    g_assert_cmpint(vlan_ids[0], ==, 81);
+    g_assert_cmpint(nm_sriov_vf_get_vlan_qos(vf, 81), ==, 10);
+    g_assert_cmpint(nm_sriov_vf_get_vlan_protocol(vf, 81), ==, NM_SRIOV_VF_VLAN_PROTOCOL_802_1Q);
+    g_assert_cmpint(vlan_ids[1], ==, 83);
+    g_assert_cmpint(nm_sriov_vf_get_vlan_qos(vf, 83), ==, 0);
+    g_assert_cmpint(nm_sriov_vf_get_vlan_protocol(vf, 83), ==, NM_SRIOV_VF_VLAN_PROTOCOL_802_1Q);
+    g_assert_cmpint(vlan_ids[2], ==, 85);
+    g_assert_cmpint(nm_sriov_vf_get_vlan_qos(vf, 85), ==, 0);
+    g_assert_cmpint(nm_sriov_vf_get_vlan_protocol(vf, 85), ==, NM_SRIOV_VF_VLAN_PROTOCOL_802_1Q);
+    g_assert_cmpint(vlan_ids[3], ==, 4000);
+    g_assert_cmpint(nm_sriov_vf_get_vlan_qos(vf, 4000), ==, 0x20);
+    g_assert_cmpint(nm_sriov_vf_get_vlan_protocol(vf, 4000), ==, NM_SRIOV_VF_VLAN_PROTOCOL_802_1AD);
+
+    str = nm_utils_sriov_vf_to_str(vf, FALSE, &error);
+    nmtst_assert_success(str, error);
+    g_assert_cmpstr(str, ==, "20 spoof-check=false vlans=81.10;83;85;4000.32.ad");
+
+    nm_sriov_vf_unref(vf);
+}
+
+static void
+test_sriov_setting(void)
+{
+    gs_unref_object NMConnection *con = NULL;
+    NMSettingConnection *         s_con;
+    NMSettingSriov *              s_sriov = NULL;
+    NMSriovVF *                   vf1, *vf2, *vf3;
+    GError *                      error = NULL;
+    gboolean                      success;
+
+    con = nm_simple_connection_new();
+
+    s_con = (NMSettingConnection *) nm_setting_connection_new();
+    nm_connection_add_setting(con, NM_SETTING(s_con));
+
+    g_object_set(s_con,
+                 NM_SETTING_CONNECTION_ID,
+                 "Test SR-IOV connection",
+                 NM_SETTING_CONNECTION_UUID,
+                 nm_uuid_generate_random_str_a(),
+                 NM_SETTING_CONNECTION_AUTOCONNECT,
+                 TRUE,
+                 NM_SETTING_CONNECTION_INTERFACE_NAME,
+                 "eth0",
+                 NM_SETTING_CONNECTION_TYPE,
+                 NM_SETTING_WIRED_SETTING_NAME,
+                 NULL);
+
+    nm_connection_add_setting(con, nm_setting_wired_new());
+
+    s_sriov = (NMSettingSriov *) nm_setting_sriov_new();
+    nm_connection_add_setting(con, NM_SETTING(s_sriov));
+
+    g_object_set(s_sriov, NM_SETTING_SRIOV_TOTAL_VFS, 16, NULL);
+    nm_setting_sriov_add_vf(s_sriov, (vf1 = nm_sriov_vf_new(0)));
+    nm_setting_sriov_add_vf(s_sriov, (vf2 = nm_sriov_vf_new(4)));
+    nm_setting_sriov_add_vf(s_sriov, (vf3 = nm_sriov_vf_new(10)));
+    g_assert(nm_setting_sriov_remove_vf_by_index(s_sriov, 4));
+    nm_sriov_vf_unref(vf2);
+    nm_setting_sriov_add_vf(s_sriov, (vf2 = nm_sriov_vf_new(2)));
+
+    nmtst_assert_connection_verifies_and_normalizable(con);
+    nmtst_connection_normalize(con);
+    success = nm_setting_verify((NMSetting *) s_sriov, con, &error);
+    nmtst_assert_success(success, error);
+
+    g_assert_cmpint(nm_setting_sriov_get_num_vfs(s_sriov), ==, 3);
+    g_assert_cmpint(nm_sriov_vf_get_index(nm_setting_sriov_get_vf(s_sriov, 0)), ==, 0);
+    g_assert_cmpint(nm_sriov_vf_get_index(nm_setting_sriov_get_vf(s_sriov, 1)), ==, 2);
+    g_assert_cmpint(nm_sriov_vf_get_index(nm_setting_sriov_get_vf(s_sriov, 2)), ==, 10);
+
+    nm_sriov_vf_unref(vf1);
+    nm_sriov_vf_unref(vf2);
+    nm_sriov_vf_unref(vf3);
+}
+
+typedef struct {
+    guint id;
+    guint qos;
+    bool  proto_ad;
+} VlanData;
+
+static void
+_test_sriov_parse_vlan_one(const char *string, gboolean exp_res, VlanData *data, guint data_length)
+{
+    NMSriovVF *  vf;
+    gboolean     res;
+    guint        i, num_vlans;
+    const guint *vlan_ids;
+
+    vf = nm_sriov_vf_new(1);
+    g_assert(vf);
+
+    res = _nm_sriov_vf_parse_vlans(vf, string, NULL);
+    g_assert_cmpint(res, ==, exp_res);
+
+    if (exp_res) {
+        vlan_ids = nm_sriov_vf_get_vlan_ids(vf, &num_vlans);
+        g_assert_cmpint(num_vlans, ==, data_length);
+        for (i = 0; i < num_vlans; i++) {
+            g_assert_cmpint(vlan_ids[i], ==, data[i].id);
+            g_assert_cmpint(nm_sriov_vf_get_vlan_qos(vf, vlan_ids[i]), ==, data[i].qos);
+            g_assert_cmpint(nm_sriov_vf_get_vlan_protocol(vf, vlan_ids[i]),
+                            ==,
+                            data[i].proto_ad ? NM_SRIOV_VF_VLAN_PROTOCOL_802_1AD
+                                             : NM_SRIOV_VF_VLAN_PROTOCOL_802_1Q);
+        }
+    }
+
+    nm_sriov_vf_unref(vf);
+}
+
+#define test_sriov_parse_vlan_one(string, result, ...)              \
+    {                                                               \
+        VlanData _data[] = {__VA_ARGS__};                           \
+        guint    _length = G_N_ELEMENTS(_data);                     \
+                                                                    \
+        _test_sriov_parse_vlan_one(string, result, _data, _length); \
+    }
+
+static void
+test_sriov_parse_vlans(void)
+{
+    test_sriov_parse_vlan_one("", FALSE, {});
+    test_sriov_parse_vlan_one("1", TRUE, {1, 0, 0});
+    test_sriov_parse_vlan_one("1;2", TRUE, {1, 0, 0}, {2, 0, 0});
+    test_sriov_parse_vlan_one("4095;;2", TRUE, {2, 0, 0}, {4095, 0, 0});
+    test_sriov_parse_vlan_one("1 2", FALSE, {});
+    test_sriov_parse_vlan_one("4096", FALSE, {});
+    test_sriov_parse_vlan_one("1.10", TRUE, {1, 10, 0});
+    test_sriov_parse_vlan_one("1.20.ad", TRUE, {1, 20, 1});
+    test_sriov_parse_vlan_one("1.21.q", TRUE, {1, 21, 0});
+    test_sriov_parse_vlan_one("9.20.foo", FALSE, {});
+    test_sriov_parse_vlan_one("1.20.ad.12", FALSE, {});
+    test_sriov_parse_vlan_one("1;1.10", FALSE, {});
+    test_sriov_parse_vlan_one("1..1;2", FALSE, {});
+    test_sriov_parse_vlan_one("1..ad;2", FALSE, {});
+    test_sriov_parse_vlan_one("1.2.ad;2.0.q;5;3", TRUE, {1, 2, 1}, {2, 0, 0}, {3, 0, 0}, {5, 0, 0});
+}
+
+static void
+test_bridge_vlans(void)
+{
+    NMBridgeVlan *v1, *v2;
+    GError *      error = NULL;
+    guint16       vid_start, vid_end;
+    char *        str;
+
+    v1 = nm_bridge_vlan_from_str("1 foobar", &error);
+    nmtst_assert_no_success(v1, error);
+    g_clear_error(&error);
+
+    v1 = nm_bridge_vlan_from_str("4095", &error);
+    nmtst_assert_no_success(v1, error);
+    g_clear_error(&error);
+
+    /* test ranges */
+    v1 = nm_bridge_vlan_from_str("2-1000 untagged", &error);
+    nmtst_assert_success(v1, error);
+    g_assert_cmpint(nm_bridge_vlan_get_vid_range(v1, &vid_start, &vid_end), ==, TRUE);
+    g_assert_cmpuint(vid_start, ==, 2);
+    g_assert_cmpuint(vid_end, ==, 1000);
+    g_assert_cmpint(nm_bridge_vlan_is_pvid(v1), ==, FALSE);
+    g_assert_cmpint(nm_bridge_vlan_is_untagged(v1), ==, TRUE);
+    nm_bridge_vlan_unref(v1);
+
+    /* test comparison (1) */
+    v1 = nm_bridge_vlan_from_str("10 untagged", &error);
+    nmtst_assert_success(v1, error);
+
+    g_assert_cmpint(nm_bridge_vlan_get_vid_range(v1, &vid_start, &vid_end), ==, FALSE);
+    g_assert_cmpuint(vid_start, ==, 10);
+    g_assert_cmpuint(vid_end, ==, 10);
+    g_assert_cmpint(nm_bridge_vlan_is_sealed(v1), ==, FALSE);
+    g_assert_cmpint(nm_bridge_vlan_is_pvid(v1), ==, FALSE);
+    g_assert_cmpint(nm_bridge_vlan_is_untagged(v1), ==, TRUE);
+
+    nm_bridge_vlan_set_pvid(v1, TRUE);
+    nm_bridge_vlan_set_untagged(v1, FALSE);
+    nm_bridge_vlan_seal(v1);
+
+    g_assert_cmpint(nm_bridge_vlan_is_sealed(v1), ==, TRUE);
+    g_assert_cmpint(nm_bridge_vlan_is_pvid(v1), ==, TRUE);
+    g_assert_cmpint(nm_bridge_vlan_is_untagged(v1), ==, FALSE);
+
+    str = nm_bridge_vlan_to_str(v1, &error);
+    nmtst_assert_success(str, error);
+    g_assert_cmpstr(str, ==, "10 pvid");
+    nm_clear_g_free(&str);
+
+    v2 = nm_bridge_vlan_from_str("  10  pvid  ", &error);
+    nmtst_assert_success(v2, error);
+
+    g_assert_cmpint(nm_bridge_vlan_cmp(v1, v2), ==, 0);
+
+    nm_bridge_vlan_unref(v1);
+    nm_bridge_vlan_unref(v2);
+
+    /* test comparison (2) */
+    v1 = nm_bridge_vlan_from_str("10", &error);
+    nmtst_assert_success(v1, error);
+    v2 = nm_bridge_vlan_from_str("20", &error);
+    nmtst_assert_success(v2, error);
+
+    g_assert_cmpint(nm_bridge_vlan_cmp(v1, v2), <, 0);
+
+    nm_bridge_vlan_unref(v1);
+    nm_bridge_vlan_unref(v2);
+}
+
+static void
+create_bridge_connection(NMConnection **con, NMSettingBridge **s_bridge)
+{
+    NMSettingConnection *s_con;
+
+    g_assert(con);
+    g_assert(s_bridge);
+
+    *con = nmtst_create_minimal_connection("bridge", NULL, NM_SETTING_BOND_SETTING_NAME, &s_con);
+
+    g_object_set(s_con, NM_SETTING_CONNECTION_INTERFACE_NAME, "bridge0", NULL);
+
+    *s_bridge = (NMSettingBridge *) nm_setting_bridge_new();
+    g_assert(*s_bridge);
+
+    nm_connection_add_setting(*con, NM_SETTING(*s_bridge));
+}
+
+#define test_verify_options_bridge(exp, ...) \
+    _test_verify_options_bridge(exp, NM_MAKE_STRV(__VA_ARGS__))
+
+static void
+_test_verify_options_bridge(gboolean expected_result, const char *const *options)
+{
+    gs_unref_object NMConnection *con = NULL;
+    NMSettingBridge *             s_bridge;
+    const char *const *           option;
+
+    g_assert(NM_PTRARRAY_LEN(options) % 2 == 0);
+
+    create_bridge_connection(&con, &s_bridge);
+
+    for (option = options; option[0]; option += 2) {
+        const char *option_key = option[0];
+        const char *option_val = option[1];
+        GParamSpec *pspec = g_object_class_find_property(G_OBJECT_GET_CLASS(s_bridge), option_key);
+
+        g_assert(pspec);
+        g_assert(option_val);
+
+        switch (G_PARAM_SPEC_VALUE_TYPE(pspec)) {
+        case G_TYPE_UINT:
+        {
+            guint uvalue;
+
+            uvalue = _nm_utils_ascii_str_to_uint64(option_val, 10, 0, G_MAXUINT, -1);
+            g_assert(errno == 0);
+            g_object_set(s_bridge, option_key, uvalue, NULL);
+        } break;
+        case G_TYPE_BOOLEAN:
+        {
+            int bvalue;
+
+            bvalue = _nm_utils_ascii_str_to_bool(option_val, -1);
+            g_assert(bvalue != -1);
+            g_object_set(s_bridge, option_key, bvalue, NULL);
+        } break;
+        case G_TYPE_STRING:
+            g_object_set(s_bridge, option_key, option_val, NULL);
+            break;
+        default:
+            g_assert_not_reached();
+            break;
+        }
+    }
+
+    if (expected_result)
+        nmtst_assert_connection_verifies_and_normalizable(con);
+    else {
+        nmtst_assert_connection_unnormalizable(con,
+                                               NM_CONNECTION_ERROR,
+                                               NM_CONNECTION_ERROR_INVALID_PROPERTY);
+    }
+}
+
+static void
+test_bridge_verify(void)
+{
+    /* group-address */
+    test_verify_options_bridge(FALSE, "group-address", "nonsense");
+    test_verify_options_bridge(FALSE, "group-address", "FF:FF:FF:FF:FF:FF");
+    test_verify_options_bridge(FALSE, "group-address", "01:02:03:04:05:06");
+    test_verify_options_bridge(TRUE, "group-address", "01:80:C2:00:00:00");
+    test_verify_options_bridge(FALSE, "group-address", "01:80:C2:00:00:02");
+    test_verify_options_bridge(FALSE, "group-address", "01:80:C2:00:00:03");
+    test_verify_options_bridge(TRUE, "group-address", "01:80:C2:00:00:00");
+    test_verify_options_bridge(TRUE, "group-address", "01:80:C2:00:00:0A");
+    /* vlan-protocol */
+    test_verify_options_bridge(FALSE, "vlan-protocol", "nonsense124");
+    test_verify_options_bridge(FALSE, "vlan-protocol", "802.11");
+    test_verify_options_bridge(FALSE, "vlan-protocol", "802.1Q1");
+    test_verify_options_bridge(TRUE, "vlan-protocol", "802.1Q");
+    test_verify_options_bridge(TRUE, "vlan-protocol", "802.1ad");
+    /* multicast-router */
+    test_verify_options_bridge(FALSE, "multicast-router", "nonsense");
+    test_verify_options_bridge(TRUE, "multicast-snooping", "no", "multicast-router", "auto");
+    test_verify_options_bridge(TRUE, "multicast-snooping", "no", "multicast-router", "enabled");
+    test_verify_options_bridge(TRUE, "multicast-snooping", "no", "multicast-router", "disabled");
+    test_verify_options_bridge(TRUE, "multicast-snooping", "yes", "multicast-router", "enabled");
+    test_verify_options_bridge(TRUE, "multicast-snooping", "yes", "multicast-router", "auto");
+    test_verify_options_bridge(TRUE, "multicast-snooping", "yes", "multicast-router", "disabled");
+    /* multicast-hash-max */
+    test_verify_options_bridge(TRUE, "multicast-hash-max", "1024");
+    test_verify_options_bridge(TRUE, "multicast-hash-max", "8192");
+    test_verify_options_bridge(FALSE, "multicast-hash-max", "3");
+}
+
+/*****************************************************************************/
+
+static void
+test_tc_config_qdisc(void)
+{
+    NMTCQdisc *qdisc1, *qdisc2;
+    char *     str;
+    GError *   error = NULL;
+    GVariant * variant;
+
+    qdisc1 = nm_tc_qdisc_new("fq_codel", TC_H_ROOT, &error);
+    nmtst_assert_success(qdisc1, error);
+
+    qdisc2 = nm_tc_qdisc_new("fq_codel", TC_H_ROOT, &error);
+    nmtst_assert_success(qdisc2, error);
+
+    g_assert(nm_tc_qdisc_equal(qdisc1, qdisc2));
+
+    nm_tc_qdisc_unref(qdisc2);
+    qdisc2 = nm_tc_qdisc_dup(qdisc1);
+
+    g_assert(nm_tc_qdisc_equal(qdisc1, qdisc2));
+
+    g_assert_cmpstr(nm_tc_qdisc_get_kind(qdisc1), ==, "fq_codel");
+    g_assert(nm_tc_qdisc_get_handle(qdisc1) == TC_H_UNSPEC);
+    g_assert(nm_tc_qdisc_get_parent(qdisc1) == TC_H_ROOT);
+
+    str = nm_utils_tc_qdisc_to_str(qdisc1, &error);
+    nmtst_assert_success(str, error);
+    g_assert_cmpstr(str, ==, "root fq_codel");
+    g_free(str);
+
+    nm_tc_qdisc_unref(qdisc1);
+    qdisc1 = nm_tc_qdisc_new("ingress", TC_H_INGRESS, &error);
+    nmtst_assert_success(qdisc1, error);
+
+    g_assert(!nm_tc_qdisc_equal(qdisc1, qdisc2));
+
+    str = nm_utils_tc_qdisc_to_str(qdisc1, &error);
+    nmtst_assert_success(str, error);
+    g_assert_cmpstr(str, ==, "ingress");
+    g_free(str);
+
+    nm_tc_qdisc_unref(qdisc1);
+    qdisc1 = nm_utils_tc_qdisc_from_str("narodil sa kristus pan", &error);
+    nmtst_assert_no_success(qdisc1, error);
+    g_clear_error(&error);
+
+    qdisc1 = nm_utils_tc_qdisc_from_str("handle 1234 parent fff1:1 pfifo_fast", &error);
+    nmtst_assert_success(qdisc1, error);
+
+    g_assert_cmpstr(nm_tc_qdisc_get_kind(qdisc1), ==, "pfifo_fast");
+    g_assert(nm_tc_qdisc_get_handle(qdisc1) == TC_H_MAKE(0x1234u << 16, 0x0000u));
+    g_assert(nm_tc_qdisc_get_parent(qdisc1) == TC_H_MAKE(0xfff1u << 16, 0x0001u));
+
+    str = nm_utils_tc_qdisc_to_str(qdisc1, &error);
+    nmtst_assert_success(str, error);
+    g_assert_cmpstr(str, ==, "parent fff1:1 handle 1234: pfifo_fast");
+    g_free(str);
+
+    nm_tc_qdisc_unref(qdisc2);
+    str = nm_utils_tc_qdisc_to_str(qdisc1, &error);
+    nmtst_assert_success(str, error);
+    qdisc2 = nm_utils_tc_qdisc_from_str(str, &error);
+    nmtst_assert_success(qdisc2, error);
+    g_free(str);
+
+    g_assert(nm_tc_qdisc_equal(qdisc1, qdisc2));
+
+    nm_tc_qdisc_unref(qdisc1);
+    nm_tc_qdisc_unref(qdisc2);
+
+    qdisc1 = nm_utils_tc_qdisc_from_str("clsact", &error);
+    nmtst_assert_success(qdisc1, error);
+    str = nm_utils_tc_qdisc_to_str(qdisc1, &error);
+    nmtst_assert_success(str, error);
+    g_assert_cmpstr(str, ==, "clsact");
+    nm_tc_qdisc_unref(qdisc1);
+    g_free(str);
+
+#define CHECK_ATTRIBUTE(qdisc, name, vtype, type, value) \
+    variant = nm_tc_qdisc_get_attribute(qdisc, name);    \
+    g_assert(variant);                                   \
+    g_assert(g_variant_is_of_type(variant, vtype));      \
+    g_assert_cmpint(g_variant_get_##type(variant), ==, value);
+
+    qdisc1 = nm_utils_tc_qdisc_from_str("handle 1235 root sfq perturb 10 quantum 1480 "
+                                        "limit 9000 flows 1024 divisor 500 depth 12",
+                                        &error);
+    nmtst_assert_success(qdisc1, error);
+
+    g_assert_cmpstr(nm_tc_qdisc_get_kind(qdisc1), ==, "sfq");
+    g_assert(nm_tc_qdisc_get_handle(qdisc1) == TC_H_MAKE(0x1235u << 16, 0x0000u));
+    g_assert(nm_tc_qdisc_get_parent(qdisc1) == TC_H_ROOT);
+    CHECK_ATTRIBUTE(qdisc1, "perturb", G_VARIANT_TYPE_INT32, int32, 10);
+    CHECK_ATTRIBUTE(qdisc1, "quantum", G_VARIANT_TYPE_UINT32, uint32, 1480);
+    CHECK_ATTRIBUTE(qdisc1, "limit", G_VARIANT_TYPE_UINT32, uint32, 9000);
+    CHECK_ATTRIBUTE(qdisc1, "flows", G_VARIANT_TYPE_UINT32, uint32, 1024);
+    CHECK_ATTRIBUTE(qdisc1, "divisor", G_VARIANT_TYPE_UINT32, uint32, 500);
+    CHECK_ATTRIBUTE(qdisc1, "depth", G_VARIANT_TYPE_UINT32, uint32, 12);
+    nm_tc_qdisc_unref(qdisc1);
+
+    qdisc1 = nm_utils_tc_qdisc_from_str("handle 1235 root tbf rate 1000000 burst 5000 limit 10000",
+                                        &error);
+    nmtst_assert_success(qdisc1, error);
+
+    g_assert_cmpstr(nm_tc_qdisc_get_kind(qdisc1), ==, "tbf");
+    g_assert(nm_tc_qdisc_get_handle(qdisc1) == TC_H_MAKE(0x1235u << 16, 0x0000u));
+    g_assert(nm_tc_qdisc_get_parent(qdisc1) == TC_H_ROOT);
+    CHECK_ATTRIBUTE(qdisc1, "rate", G_VARIANT_TYPE_UINT64, uint64, 1000000);
+    CHECK_ATTRIBUTE(qdisc1, "burst", G_VARIANT_TYPE_UINT32, uint32, 5000);
+    CHECK_ATTRIBUTE(qdisc1, "limit", G_VARIANT_TYPE_UINT32, uint32, 10000);
+    nm_tc_qdisc_unref(qdisc1);
+
+#undef CHECK_ATTRIBUTE
+}
+
+static void
+test_tc_config_action(void)
+{
+    NMTCAction *action1, *action2;
+    char *      str;
+    GError *    error = NULL;
+
+    action1 = nm_tc_action_new("drop", &error);
+    nmtst_assert_success(action1, error);
+    action2 = nm_tc_action_new("drop", &error);
+    nmtst_assert_success(action2, error);
+
+    g_assert(nm_tc_action_equal(action1, action2));
+    g_assert_cmpstr(nm_tc_action_get_kind(action1), ==, "drop");
+
+    nm_tc_action_unref(action1);
+    action1 = nm_tc_action_new("simple", &error);
+    nmtst_assert_success(action1, error);
+    nm_tc_action_set_attribute(action1, "sdata", g_variant_new_bytestring("Hello"));
+
+    g_assert(!nm_tc_action_equal(action1, action2));
+
+    str = nm_utils_tc_action_to_str(action1, &error);
+    nmtst_assert_success(str, error);
+    g_assert_cmpstr(str, ==, "simple sdata Hello");
+    g_free(str);
+
+    str = nm_utils_tc_action_to_str(action2, &error);
+    nmtst_assert_success(str, error);
+    g_assert_cmpstr(str, ==, "drop");
+    g_free(str);
+
+    nm_tc_action_unref(action2);
+    action2 = nm_tc_action_dup(action1);
+
+    g_assert(nm_tc_action_equal(action1, action2));
+
+    nm_tc_action_unref(action1);
+    action1 = nm_utils_tc_action_from_str("narodil sa kristus pan", &error);
+    nmtst_assert_no_success(action1, error);
+    g_clear_error(&error);
+
+    action1 = nm_utils_tc_action_from_str("simple sdata Hello", &error);
+    nmtst_assert_success(action1, error);
+
+    g_assert_cmpstr(nm_tc_action_get_kind(action1), ==, "simple");
+    g_assert_cmpstr(g_variant_get_bytestring(nm_tc_action_get_attribute(action1, "sdata")),
+                    ==,
+                    "Hello");
+
+    nm_tc_action_unref(action1);
+    nm_tc_action_unref(action2);
+}
+
+static void
+test_tc_config_tfilter_matchall_sdata(void)
+{
+    NMTCAction * action1;
+    NMTCTfilter *tfilter1, *tfilter2;
+    char *       str;
+    GError *     error = NULL;
+
+    tfilter1 = nm_tc_tfilter_new("matchall", TC_H_MAKE(0x1234u << 16, 0x0000u), &error);
+    nmtst_assert_success(tfilter1, error);
+
+    tfilter2 = nm_tc_tfilter_new("matchall", TC_H_MAKE(0x1234u << 16, 0x0000u), &error);
+    nmtst_assert_success(tfilter2, error);
+
+    g_assert(nm_tc_tfilter_equal(tfilter1, tfilter2));
+
+    action1 = nm_tc_action_new("simple", &error);
+    nmtst_assert_success(action1, error);
+    nm_tc_action_set_attribute(action1, "sdata", g_variant_new_bytestring("Hello"));
+    nm_tc_tfilter_set_action(tfilter1, action1);
+    nm_tc_action_unref(action1);
+
+    g_assert(!nm_tc_tfilter_equal(tfilter1, tfilter2));
+
+    str = nm_utils_tc_tfilter_to_str(tfilter1, &error);
+    nmtst_assert_success(str, error);
+    g_assert_cmpstr(str, ==, "parent 1234: matchall action simple sdata Hello");
+    g_free(str);
+
+    nm_tc_tfilter_unref(tfilter2);
+    tfilter2 = nm_tc_tfilter_dup(tfilter1);
+
+    g_assert(nm_tc_tfilter_equal(tfilter1, tfilter2));
+
+    nm_tc_tfilter_unref(tfilter1);
+    tfilter1 = nm_utils_tc_tfilter_from_str("narodil sa kristus pan", &error);
+    nmtst_assert_no_success(tfilter1, error);
+    g_clear_error(&error);
+
+    str = nm_utils_tc_tfilter_to_str(tfilter2, &error);
+    nmtst_assert_success(str, error);
+    tfilter1 = nm_utils_tc_tfilter_from_str(str, &error);
+    nmtst_assert_success(tfilter1, error);
+    g_free(str);
+
+    g_assert(nm_tc_tfilter_equal(tfilter1, tfilter2));
+
+    nm_tc_tfilter_unref(tfilter1);
+    nm_tc_tfilter_unref(tfilter2);
+}
+
+static void
+test_tc_config_tfilter_matchall_mirred(void)
+{
+    NMTCAction *       action;
+    NMTCTfilter *      tfilter1;
+    GError *           error      = NULL;
+    gs_strfreev char **attr_names = NULL;
+    gs_free char *     str;
+    GVariant *         variant;
+
+    tfilter1 =
+        nm_utils_tc_tfilter_from_str("parent ffff: matchall action mirred ingress mirror dev eth0",
+                                     &error);
+    nmtst_assert_success(tfilter1, error);
+    g_assert_cmpint(nm_tc_tfilter_get_parent(tfilter1), ==, TC_H_MAKE(0xffff << 16, 0));
+    g_assert_cmpstr(nm_tc_tfilter_get_kind(tfilter1), ==, "matchall");
+
+    action = nm_tc_tfilter_get_action(tfilter1);
+    nm_assert(action);
+    g_assert_cmpstr(nm_tc_action_get_kind(action), ==, "mirred");
+    attr_names = nm_tc_action_get_attribute_names(action);
+    g_assert(attr_names);
+    g_assert_cmpint(g_strv_length(attr_names), ==, 3);
+
+    variant = nm_tc_action_get_attribute(action, "ingress");
+    g_assert(variant);
+    g_assert(g_variant_is_of_type(variant, G_VARIANT_TYPE_BOOLEAN));
+    g_assert(g_variant_get_boolean(variant));
+
+    variant = nm_tc_action_get_attribute(action, "mirror");
+    g_assert(variant);
+    g_assert(g_variant_is_of_type(variant, G_VARIANT_TYPE_BOOLEAN));
+    g_assert(g_variant_get_boolean(variant));
+
+    variant = nm_tc_action_get_attribute(action, "dev");
+    g_assert(variant);
+    g_assert(g_variant_is_of_type(variant, G_VARIANT_TYPE_STRING));
+    g_assert_cmpstr(g_variant_get_string(variant, NULL), ==, "eth0");
+
+    str = nm_utils_tc_tfilter_to_str(tfilter1, &error);
+    nmtst_assert_success(str, error);
+    g_assert_cmpstr(str, ==, "parent ffff: matchall action mirred dev eth0 ingress mirror");
+
+    nm_tc_tfilter_unref(tfilter1);
+}
+
+static void
+test_tc_config_setting_valid(void)
+{
+    gs_unref_object NMSettingTCConfig *s_tc = NULL;
+    NMTCQdisc *                        qdisc1, *qdisc2;
+    GError *                           error = NULL;
+
+    s_tc = (NMSettingTCConfig *) nm_setting_tc_config_new();
+
+    qdisc1 = nm_tc_qdisc_new("fq_codel", TC_H_ROOT, &error);
+    nmtst_assert_success(qdisc1, error);
+
+    qdisc2 = nm_tc_qdisc_new("pfifo_fast", TC_H_MAKE(0xfff1u << 16, 0x0001u), &error);
+    nmtst_assert_success(qdisc2, error);
+    nm_tc_qdisc_set_handle(qdisc2, TC_H_MAKE(0x1234u << 16, 0x0000u));
+
+    g_assert(nm_setting_tc_config_get_num_qdiscs(s_tc) == 0);
+    g_assert(nm_setting_tc_config_add_qdisc(s_tc, qdisc1) == TRUE);
+    g_assert(nm_setting_tc_config_get_num_qdiscs(s_tc) == 1);
+    g_assert(nm_setting_tc_config_get_qdisc(s_tc, 0) != NULL);
+    g_assert(nm_setting_tc_config_remove_qdisc_by_value(s_tc, qdisc2) == FALSE);
+    g_assert(nm_setting_tc_config_add_qdisc(s_tc, qdisc2) == TRUE);
+    g_assert(nm_setting_tc_config_get_num_qdiscs(s_tc) == 2);
+    g_assert(nm_setting_tc_config_remove_qdisc_by_value(s_tc, qdisc1) == TRUE);
+    g_assert(nm_setting_tc_config_get_num_qdiscs(s_tc) == 1);
+    nm_setting_tc_config_clear_qdiscs(s_tc);
+    g_assert(nm_setting_tc_config_get_num_qdiscs(s_tc) == 0);
+
+    nm_tc_qdisc_unref(qdisc1);
+    nm_tc_qdisc_unref(qdisc2);
+}
+
+static void
+test_tc_config_setting_duplicates(void)
+{
+    gs_unref_ptrarray GPtrArray *qdiscs   = NULL;
+    gs_unref_ptrarray GPtrArray *tfilters = NULL;
+    NMSettingConnection *        s_con;
+    NMConnection *               con;
+    NMSetting *                  s_tc;
+    NMTCQdisc *                  qdisc;
+    NMTCTfilter *                tfilter;
+    GError *                     error = NULL;
+
+    con = nmtst_create_minimal_connection("dummy", NULL, NM_SETTING_DUMMY_SETTING_NAME, &s_con);
+    g_object_set(s_con, NM_SETTING_CONNECTION_INTERFACE_NAME, "dummy1", NULL);
+
+    s_tc = nm_setting_tc_config_new();
+    nm_connection_add_setting(con, s_tc);
+    qdiscs   = g_ptr_array_new_with_free_func((GDestroyNotify) nm_tc_qdisc_unref);
+    tfilters = g_ptr_array_new_with_free_func((GDestroyNotify) nm_tc_tfilter_unref);
+
+    /* 1. add duplicate qdiscs */
+    qdisc = nm_utils_tc_qdisc_from_str("handle 1234 parent fff1:1 pfifo_fast", &error);
+    nmtst_assert_success(qdisc, error);
+    g_ptr_array_add(qdiscs, qdisc);
+
+    qdisc = nm_utils_tc_qdisc_from_str("handle 1234 parent fff1:1 pfifo_fast", &error);
+    nmtst_assert_success(qdisc, error);
+    g_ptr_array_add(qdiscs, qdisc);
+
+    g_object_set(s_tc, NM_SETTING_TC_CONFIG_QDISCS, qdiscs, NULL);
+    nmtst_assert_connection_unnormalizable(con,
+                                           NM_CONNECTION_ERROR,
+                                           NM_CONNECTION_ERROR_INVALID_PROPERTY);
+
+    /* 2. make qdiscs unique */
+    g_ptr_array_remove_index(qdiscs, 0);
+    g_object_set(s_tc, NM_SETTING_TC_CONFIG_QDISCS, qdiscs, NULL);
+    nmtst_assert_connection_verifies_and_normalizable(con);
+
+    /* 3. add duplicate filters */
+    tfilter =
+        nm_utils_tc_tfilter_from_str("parent 1234: matchall action simple sdata Hello", &error);
+    nmtst_assert_success(tfilter, error);
+    g_ptr_array_add(tfilters, tfilter);
+
+    tfilter =
+        nm_utils_tc_tfilter_from_str("parent 1234: matchall action simple sdata Hello", &error);
+    nmtst_assert_success(tfilter, error);
+    g_ptr_array_add(tfilters, tfilter);
+
+    g_object_set(s_tc, NM_SETTING_TC_CONFIG_TFILTERS, tfilters, NULL);
+    nmtst_assert_connection_unnormalizable(con,
+                                           NM_CONNECTION_ERROR,
+                                           NM_CONNECTION_ERROR_INVALID_PROPERTY);
+
+    /* 4. make filters unique */
+    g_ptr_array_remove_index(tfilters, 0);
+    g_object_set(s_tc, NM_SETTING_TC_CONFIG_TFILTERS, tfilters, NULL);
+    nmtst_assert_connection_verifies_and_normalizable(con);
+}
+
+static void
+test_tc_config_dbus(void)
+{
+    NMConnection *connection1, *connection2;
+    NMSetting *   s_tc;
+    NMTCQdisc *   qdisc1, *qdisc2;
+    NMTCTfilter * tfilter1, *tfilter2;
+    NMTCAction *  action;
+    GVariant *    dbus, *tc_dbus, *var1, *var2;
+    GError *      error = NULL;
+    gboolean      success;
+
+    connection1 =
+        nmtst_create_minimal_connection("dummy", NULL, NM_SETTING_DUMMY_SETTING_NAME, NULL);
+
+    s_tc = nm_setting_tc_config_new();
+
+    qdisc1 = nm_tc_qdisc_new("fq_codel", TC_H_ROOT, &error);
+    nmtst_assert_success(qdisc1, error);
+    nm_tc_qdisc_set_handle(qdisc1, TC_H_MAKE(0x1234u << 16, 0x0000u));
+    nm_setting_tc_config_add_qdisc(NM_SETTING_TC_CONFIG(s_tc), qdisc1);
+
+    qdisc2 = nm_tc_qdisc_new("ingress", TC_H_INGRESS, &error);
+    nmtst_assert_success(qdisc2, error);
+    nm_tc_qdisc_set_handle(qdisc2, TC_H_MAKE(TC_H_INGRESS, 0u));
+    nm_setting_tc_config_add_qdisc(NM_SETTING_TC_CONFIG(s_tc), qdisc2);
+
+    tfilter1 = nm_tc_tfilter_new("matchall", TC_H_MAKE(0x1234u << 16, 0x0000u), &error);
+    nmtst_assert_success(tfilter1, error);
+    action = nm_tc_action_new("drop", &error);
+    nmtst_assert_success(action, error);
+    nm_tc_tfilter_set_action(tfilter1, action);
+    nm_tc_action_unref(action);
+    nm_setting_tc_config_add_tfilter(NM_SETTING_TC_CONFIG(s_tc), tfilter1);
+    nm_tc_tfilter_unref(tfilter1);
+
+    tfilter2 = nm_tc_tfilter_new("matchall", TC_H_MAKE(TC_H_INGRESS, 0u), &error);
+    nmtst_assert_success(tfilter2, error);
+    action = nm_tc_action_new("simple", &error);
+    nmtst_assert_success(action, error);
+    nm_tc_action_set_attribute(action, "sdata", g_variant_new_bytestring("Hello"));
+    nm_tc_tfilter_set_action(tfilter2, action);
+    nm_tc_action_unref(action);
+    nm_setting_tc_config_add_tfilter(NM_SETTING_TC_CONFIG(s_tc), tfilter2);
+    nm_tc_tfilter_unref(tfilter2);
+
+    nm_connection_add_setting(connection1, s_tc);
+
+    dbus = nm_connection_to_dbus(connection1, NM_CONNECTION_SERIALIZE_ALL);
+
+    tc_dbus = g_variant_lookup_value(dbus, "tc", G_VARIANT_TYPE_VARDICT);
+    g_assert(tc_dbus);
+
+    var1 = g_variant_lookup_value(tc_dbus, "qdiscs", G_VARIANT_TYPE("aa{sv}"));
+    var2 = g_variant_new_parsed("[{'kind':   <'fq_codel'>,"
+                                "  'handle': <uint32 0x12340000>,"
+                                "  'parent': <uint32 0xffffffff>},"
+                                " {'kind':   <'ingress'>,"
+                                "  'handle': <uint32 0xffff0000>,"
+                                "  'parent': <uint32 0xfffffff1>}]");
+    g_assert(g_variant_equal(var1, var2));
+    g_variant_unref(var1);
+    g_variant_unref(var2);
+
+    var1 = g_variant_lookup_value(tc_dbus, "tfilters", G_VARIANT_TYPE("aa{sv}"));
+    var2 = g_variant_new_parsed("[{'kind':   <'matchall'>,"
+                                "  'handle': <uint32 0>,"
+                                "  'parent': <uint32 0x12340000>,"
+                                "  'action': <{'kind': <'drop'>}>},"
+                                " {'kind':   <'matchall'>,"
+                                "  'handle': <uint32 0>,"
+                                "  'parent': <uint32 0xffff0000>,"
+                                "  'action': <{'kind':  <'simple'>,"
+                                "              'sdata': <b'Hello'>}>}]");
+    g_variant_unref(var1);
+    g_variant_unref(var2);
+
+    g_variant_unref(tc_dbus);
+
+    connection2 = nm_simple_connection_new();
+    success     = nm_connection_replace_settings(connection2, dbus, &error);
+    nmtst_assert_success(success, error);
+
+    g_assert(nm_connection_diff(connection1, connection2, NM_SETTING_COMPARE_FLAG_EXACT, NULL));
+
+    g_variant_unref(dbus);
+
+    nm_tc_qdisc_unref(qdisc1);
+    nm_tc_qdisc_unref(qdisc2);
+
+    g_object_unref(connection1);
+    g_object_unref(connection2);
+}
+
+/*****************************************************************************/
+
+static void
+_rndt_wired_add_s390_options(NMSettingWired *s_wired, char **out_keyfile_entries)
+{
+    gsize                n_opts;
+    gsize                i, j;
+    const char *const *  option_names;
+    gs_free const char **opt_keys  = NULL;
+    gs_strfreev char **  opt_vals  = NULL;
+    gs_free bool *       opt_found = NULL;
+    GString *            keyfile_entries;
+    nm_auto_free_gstring GString *str_tmp = NULL;
+
+    option_names = nm_setting_wired_get_valid_s390_options(nmtst_get_rand_bool() ? NULL : s_wired);
+
+    n_opts   = NM_PTRARRAY_LEN(option_names);
+    opt_keys = g_new(const char *, (n_opts + 1));
+    nmtst_rand_perm(NULL, opt_keys, option_names, sizeof(const char *), n_opts);
+    n_opts           = nmtst_get_rand_uint32() % (n_opts + 1);
+    opt_keys[n_opts] = NULL;
+
+    opt_vals  = g_new0(char *, n_opts + 1);
+    opt_found = g_new0(bool, n_opts + 1);
+    for (i = 0; i < n_opts; i++) {
+        if (nm_streq(opt_keys[i], "bridge_role"))
+            opt_vals[i] = g_strdup(nmtst_rand_select_str("primary", "secondary", "none"));
+        else {
+            guint p = nmtst_get_rand_uint32() % 1000;
+            if (p < 200)
+                opt_vals[i] = nm_strdup_int(i);
+            else {
+                opt_vals[i] = g_strdup_printf("%s%s%s%s-%zu",
+                                              ((p % 5) % 2) ? "\n" : "",
+                                              ((p % 7) % 2) ? "\t" : "",
+                                              ((p % 11) % 2) ? "x" : "",
+                                              ((p % 13) % 2) ? "=" : "",
+                                              i);
+            }
+        }
+    }
+
+    if (nmtst_get_rand_bool()) {
+        gs_unref_hashtable GHashTable *hash = NULL;
+
+        hash = g_hash_table_new(nm_str_hash, g_str_equal);
+        for (i = 0; i < n_opts; i++)
+            g_hash_table_insert(hash, (char *) opt_keys[i], opt_vals[i]);
+        g_object_set(s_wired, NM_SETTING_WIRED_S390_OPTIONS, hash, NULL);
+    } else {
+        _nm_setting_wired_clear_s390_options(s_wired);
+        for (i = 0; i < n_opts; i++) {
+            if (!nm_setting_wired_add_s390_option(s_wired, opt_keys[i], opt_vals[i]))
+                g_assert_not_reached();
+        }
+    }
+
+    g_assert_cmpint(nm_setting_wired_get_num_s390_options(s_wired), ==, n_opts);
+
+    keyfile_entries = g_string_new(NULL);
+    str_tmp         = g_string_new(NULL);
+    if (n_opts > 0)
+        g_string_append_printf(keyfile_entries, "[ethernet-s390-options]\n");
+    for (i = 0; i < n_opts; i++) {
+        gssize      idx;
+        const char *k, *v;
+
+        nm_setting_wired_get_s390_option(s_wired, i, &k, &v);
+        g_assert(k);
+        g_assert(v);
+
+        idx = nm_utils_strv_find_first((char **) opt_keys, n_opts, k);
+        g_assert(idx >= 0);
+        g_assert(!opt_found[idx]);
+        opt_found[idx] = TRUE;
+        g_assert_cmpstr(opt_keys[idx], ==, k);
+        g_assert_cmpstr(opt_vals[idx], ==, v);
+
+        g_string_truncate(str_tmp, 0);
+        for (j = 0; v[j] != '\0'; j++) {
+            if (v[j] == '\n')
+                g_string_append(str_tmp, "\\n");
+            else if (v[j] == '\t')
+                g_string_append(str_tmp, "\\t");
+            else
+                g_string_append_c(str_tmp, v[j]);
+        }
+
+        g_string_append_printf(keyfile_entries, "%s=%s\n", k, str_tmp->str);
+    }
+    for (i = 0; i < n_opts; i++)
+        g_assert(opt_found[i]);
+    if (n_opts > 0)
+        g_string_append_printf(keyfile_entries, "\n");
+    *out_keyfile_entries = g_string_free(keyfile_entries, FALSE);
+}
+
+static GPtrArray *
+_rndt_wg_peers_create(void)
+{
+    GPtrArray *wg_peers;
+    guint      i, n;
+
+    wg_peers = g_ptr_array_new_with_free_func((GDestroyNotify) nm_wireguard_peer_unref);
+
+    n = nmtst_get_rand_uint32() % 10;
+    for (i = 0; i < n; i++) {
+        NMWireGuardPeer *peer;
+        guint8           public_key_buf[NM_WIREGUARD_PUBLIC_KEY_LEN];
+        guint8           preshared_key_buf[NM_WIREGUARD_SYMMETRIC_KEY_LEN];
+        gs_free char *   public_key    = NULL;
+        gs_free char *   preshared_key = NULL;
+        gs_free char *   s_endpoint    = NULL;
+        guint            i_aip, n_aip;
+
+        /* we don't bother to create a valid curve25519 public key. Of course, libnm cannot
+         * check whether the public key is bogus or not. Hence, for our purpose a random
+         * bogus key is good enough. */
+        public_key = g_base64_encode(nmtst_rand_buf(NULL, public_key_buf, sizeof(public_key_buf)),
+                                     sizeof(public_key_buf));
+
+        preshared_key =
+            g_base64_encode(nmtst_rand_buf(NULL, preshared_key_buf, sizeof(preshared_key_buf)),
+                            sizeof(preshared_key_buf));
+
+        s_endpoint = _create_random_ipaddr(AF_UNSPEC, TRUE);
+
+        peer = nm_wireguard_peer_new();
+        if (!nm_wireguard_peer_set_public_key(peer, public_key, TRUE))
+            g_assert_not_reached();
+
+        if (!nm_wireguard_peer_set_preshared_key(peer,
+                                                 nmtst_rand_select(NULL, preshared_key),
+                                                 TRUE))
+            g_assert_not_reached();
+
+        nm_wireguard_peer_set_preshared_key_flags(
+            peer,
+            nmtst_rand_select(NM_SETTING_SECRET_FLAG_NONE,
+                              NM_SETTING_SECRET_FLAG_NOT_SAVED,
+                              NM_SETTING_SECRET_FLAG_AGENT_OWNED));
+
+        nm_wireguard_peer_set_persistent_keepalive(
+            peer,
+            nmtst_rand_select((guint32) 0, nmtst_get_rand_uint32()));
+
+        if (!nm_wireguard_peer_set_endpoint(peer, nmtst_rand_select(s_endpoint, NULL), TRUE))
+            g_assert_not_reached();
+
+        n_aip = nmtst_rand_select(0, nmtst_get_rand_uint32() % 10);
+        for (i_aip = 0; i_aip < n_aip; i_aip++) {
+            gs_free char *aip = NULL;
+
+            aip = _create_random_ipaddr(AF_UNSPEC, FALSE);
+            if (!nm_wireguard_peer_append_allowed_ip(peer, aip, FALSE))
+                g_assert_not_reached();
+        }
+
+        g_assert(nm_wireguard_peer_is_valid(peer, TRUE, TRUE, NULL));
+
+        nm_wireguard_peer_seal(peer);
+        g_ptr_array_add(wg_peers, peer);
+    }
+
+    return wg_peers;
+}
+
+static const char *
+_rndt_wg_peers_to_keyfile(GPtrArray *wg_peers, gboolean strict, char **out_str)
+{
+    nm_auto_free_gstring GString *gstr     = NULL;
+    nm_auto_free_gstring GString *gstr_aip = NULL;
+    guint                         i, j;
+
+    g_assert(wg_peers);
+    g_assert(out_str && !*out_str);
+
+    nm_gstring_prepare(&gstr);
+    for (i = 0; i < wg_peers->len; i++) {
+        const NMWireGuardPeer *peer                   = wg_peers->pdata[i];
+        gs_free char *         s_endpoint             = NULL;
+        gs_free char *         s_preshared_key        = NULL;
+        gs_free char *         s_preshared_key_flags  = NULL;
+        gs_free char *         s_persistent_keepalive = NULL;
+        gs_free char *         s_allowed_ips          = NULL;
+
+        if (nm_wireguard_peer_get_endpoint(peer))
+            s_endpoint = g_strdup_printf("endpoint=%s\n", nm_wireguard_peer_get_endpoint(peer));
+        else if (!strict)
+            s_endpoint = g_strdup_printf("endpoint=\n");
+
+        if (nm_wireguard_peer_get_preshared_key(peer) || !strict) {
+            if (nm_wireguard_peer_get_preshared_key_flags(peer) == NM_SETTING_SECRET_FLAG_NONE)
+                s_preshared_key = g_strdup_printf("preshared-key=%s\n",
+                                                  nm_wireguard_peer_get_preshared_key(peer) ?: "");
+        }
+
+        if (nm_wireguard_peer_get_preshared_key_flags(peer) != NM_SETTING_SECRET_FLAG_NOT_REQUIRED
+            || !strict)
+            s_preshared_key_flags =
+                g_strdup_printf("preshared-key-flags=%d\n",
+                                (int) nm_wireguard_peer_get_preshared_key_flags(peer));
+
+        if (nm_wireguard_peer_get_persistent_keepalive(peer) != 0 || !strict)
+            s_persistent_keepalive =
+                g_strdup_printf("persistent-keepalive=%u\n",
+                                nm_wireguard_peer_get_persistent_keepalive(peer));
+
+        if (nm_wireguard_peer_get_allowed_ips_len(peer) > 0 || !strict) {
+            nm_gstring_prepare(&gstr_aip);
+            for (j = 0; j < nm_wireguard_peer_get_allowed_ips_len(peer); j++)
+                g_string_append_printf(gstr_aip,
+                                       "%s;",
+                                       nm_wireguard_peer_get_allowed_ip(peer, j, NULL));
+            s_allowed_ips = g_strdup_printf("allowed-ips=%s\n", gstr_aip->str);
+        }
+
+        if (!s_endpoint && !s_preshared_key && !s_preshared_key_flags && !s_persistent_keepalive
+            && !s_allowed_ips)
+            s_endpoint = g_strdup_printf("endpoint=\n");
+
+        g_string_append_printf(gstr,
+                               "\n"
+                               "[wireguard-peer.%s]\n"
+                               "%s" /* endpoint */
+                               "%s" /* preshared-key */
+                               "%s" /* preshared-key-flags */
+                               "%s" /* persistent-keepalive */
+                               "%s" /* allowed-ips */
+                               "",
+                               nm_wireguard_peer_get_public_key(peer),
+                               s_endpoint ?: "",
+                               s_preshared_key ?: "",
+                               s_preshared_key_flags ?: "",
+                               s_persistent_keepalive ?: "",
+                               s_allowed_ips ?: "");
+    }
+
+    return (*out_str = g_string_free(g_steal_pointer(&gstr), FALSE));
+}
+
+static void
+_rndt_wg_peers_assert_equal(NMSettingWireGuard *s_wg,
+                            GPtrArray *         peers,
+                            gboolean            consider_persistent_secrets,
+                            gboolean            consider_all_secrets,
+                            gboolean            expect_no_secrets)
+{
+    guint i;
+
+    g_assert(NM_IS_SETTING_WIREGUARD(s_wg));
+    g_assert(peers);
+
+    g_assert_cmpint(peers->len, ==, nm_setting_wireguard_get_peers_len(s_wg));
+
+    for (i = 0; i < peers->len; i++) {
+        const NMWireGuardPeer *a = peers->pdata[i];
+        const NMWireGuardPeer *b = nm_setting_wireguard_get_peer(s_wg, i);
+        gboolean               consider_secrets;
+
+        g_assert(a);
+        g_assert(b);
+
+        g_assert_cmpint(nm_wireguard_peer_cmp(a, b, NM_SETTING_COMPARE_FLAG_IGNORE_SECRETS), ==, 0);
+
+        if (consider_all_secrets || !nm_wireguard_peer_get_preshared_key(a))
+            consider_secrets = TRUE;
+        else if (nm_wireguard_peer_get_preshared_key(b))
+            consider_secrets = TRUE;
+        else if (consider_persistent_secrets
+                 && nm_wireguard_peer_get_preshared_key_flags(b) == NM_SETTING_SECRET_FLAG_NONE)
+            consider_secrets = TRUE;
+        else
+            consider_secrets = FALSE;
+
+        if (consider_secrets) {
+            g_assert_cmpstr(nm_wireguard_peer_get_preshared_key(a),
+                            ==,
+                            nm_wireguard_peer_get_preshared_key(b));
+            g_assert_cmpint(nm_wireguard_peer_cmp(a, b, NM_SETTING_COMPARE_FLAG_EXACT), ==, 0);
+        }
+
+        if (expect_no_secrets)
+            g_assert_cmpstr(nm_wireguard_peer_get_preshared_key(b), ==, NULL);
+    }
+}
+
+static void
+_rndt_wg_peers_fix_secrets(NMSettingWireGuard *s_wg, GPtrArray *peers)
+{
+    guint i;
+
+    g_assert(NM_IS_SETTING_WIREGUARD(s_wg));
+    g_assert(peers);
+
+    g_assert_cmpint(peers->len, ==, nm_setting_wireguard_get_peers_len(s_wg));
+
+    for (i = 0; i < peers->len; i++) {
+        const NMWireGuardPeer *a                      = peers->pdata[i];
+        const NMWireGuardPeer *b                      = nm_setting_wireguard_get_peer(s_wg, i);
+        nm_auto_unref_wgpeer NMWireGuardPeer *b_clone = NULL;
+
+        g_assert(a);
+        g_assert(b);
+
+        g_assert_cmpint(nm_wireguard_peer_get_preshared_key_flags(a),
+                        ==,
+                        nm_wireguard_peer_get_preshared_key_flags(b));
+        g_assert_cmpint(nm_wireguard_peer_cmp(a, b, NM_SETTING_COMPARE_FLAG_IGNORE_SECRETS), ==, 0);
+
+        if (!nm_streq0(nm_wireguard_peer_get_preshared_key(a),
+                       nm_wireguard_peer_get_preshared_key(b))) {
+            g_assert_cmpstr(nm_wireguard_peer_get_preshared_key(a), !=, NULL);
+            g_assert_cmpstr(nm_wireguard_peer_get_preshared_key(b), ==, NULL);
+            g_assert(NM_IN_SET(nm_wireguard_peer_get_preshared_key_flags(a),
+                               NM_SETTING_SECRET_FLAG_AGENT_OWNED,
+                               NM_SETTING_SECRET_FLAG_NOT_SAVED));
+            b_clone = nm_wireguard_peer_new_clone(b, TRUE);
+            if (!nm_wireguard_peer_set_preshared_key(b_clone,
+                                                     nm_wireguard_peer_get_preshared_key(a),
+                                                     TRUE))
+                g_assert_not_reached();
+            nm_setting_wireguard_set_peer(s_wg, b_clone, i);
+            b = nm_setting_wireguard_get_peer(s_wg, i);
+            g_assert(b == b_clone);
+        } else {
+            if (nm_wireguard_peer_get_preshared_key(a)) {
+                g_assert(NM_IN_SET(nm_wireguard_peer_get_preshared_key_flags(a),
+                                   NM_SETTING_SECRET_FLAG_NONE,
+                                   NM_SETTING_SECRET_FLAG_NOT_REQUIRED));
+            } else {
+                g_assert(NM_IN_SET(nm_wireguard_peer_get_preshared_key_flags(a),
+                                   NM_SETTING_SECRET_FLAG_AGENT_OWNED,
+                                   NM_SETTING_SECRET_FLAG_NONE,
+                                   NM_SETTING_SECRET_FLAG_NOT_SAVED,
+                                   NM_SETTING_SECRET_FLAG_NOT_REQUIRED));
+            }
+        }
+
+        g_assert_cmpstr(nm_wireguard_peer_get_preshared_key(a),
+                        ==,
+                        nm_wireguard_peer_get_preshared_key(b));
+        g_assert_cmpint(nm_wireguard_peer_cmp(a, b, NM_SETTING_COMPARE_FLAG_EXACT), ==, 0);
+    }
+}
+
+static void
+test_roundtrip_conversion(gconstpointer test_data)
+{
+    const int   MODE           = GPOINTER_TO_INT(test_data);
+    const char *ID             = nm_sprintf_bufa(100, "roundtrip-conversion-%d", MODE);
+    const char *UUID           = "63376701-b61e-4318-bf7e-664a1c1eeaab";
+    const char *INTERFACE_NAME = nm_sprintf_bufa(100, "ifname%d", MODE);
+    guint32     ETH_MTU        = nmtst_rand_select((guint32) 0u, nmtst_get_rand_uint32());
+    const char *WG_PRIVATE_KEY =
+        nmtst_get_rand_bool() ? "yGXGK+5bVnxSJUejH4vbpXbq+ZtaG4NB8IHRK/aVtE0=" : NULL;
+    const NMSettingSecretFlags WG_PRIVATE_KEY_FLAGS =
+        nmtst_rand_select(NM_SETTING_SECRET_FLAG_NONE,
+                          NM_SETTING_SECRET_FLAG_NOT_SAVED,
+                          NM_SETTING_SECRET_FLAG_AGENT_OWNED);
+    const guint       WG_LISTEN_PORT = nmtst_rand_select(0u, nmtst_get_rand_uint32() % 0x10000);
+    const guint       WG_FWMARK      = nmtst_rand_select(0u, nmtst_get_rand_uint32());
+    gs_unref_ptrarray GPtrArray *kf_data_arr      = g_ptr_array_new_with_free_func(g_free);
+    gs_unref_ptrarray GPtrArray *        wg_peers = NULL;
+    const NMConnectionSerializationFlags dbus_serialization_flags[] = {
+        NM_CONNECTION_SERIALIZE_ALL,
+        NM_CONNECTION_SERIALIZE_WITH_NON_SECRET,
+        NM_CONNECTION_SERIALIZE_WITH_SECRETS,
+    };
+    guint           dbus_serialization_flags_idx;
+    gs_unref_object NMConnection *con = NULL;
+    gs_free_error GError *error       = NULL;
+    gs_free char *        tmp_str     = NULL;
+    guint                 kf_data_idx;
+    NMSettingConnection * s_con = NULL;
+    NMSettingWired *      s_eth = NULL;
+    NMSettingWireGuard *  s_wg  = NULL;
+    union {
+        struct {
+            NMSettingIPConfig *s_6;
+            NMSettingIPConfig *s_4;
+        };
+        NMSettingIPConfig *s_x[2];
+    } s_ip;
+    int           is_ipv4;
+    guint         i;
+    gboolean      success;
+    gs_free char *s390_keyfile_entries = NULL;
+
+    switch (MODE) {
+    case 0:
+        con = nmtst_create_minimal_connection(ID, UUID, NM_SETTING_WIRED_SETTING_NAME, &s_con);
+        g_object_set(s_con, NM_SETTING_CONNECTION_INTERFACE_NAME, INTERFACE_NAME, NULL);
+        nmtst_connection_normalize(con);
+
+        s_eth = NM_SETTING_WIRED(nm_connection_get_setting(con, NM_TYPE_SETTING_WIRED));
+        g_assert(NM_IS_SETTING_WIRED(s_eth));
+
+        g_object_set(s_eth, NM_SETTING_WIRED_MTU, ETH_MTU, NULL);
+
+        _rndt_wired_add_s390_options(s_eth, &s390_keyfile_entries);
+
+        g_ptr_array_add(
+            kf_data_arr,
+            g_strdup_printf("[connection]\n"
+                            "id=%s\n"
+                            "uuid=%s\n"
+                            "type=ethernet\n"
+                            "interface-name=%s\n"
+                            "permissions=\n"
+                            "\n"
+                            "[ethernet]\n"
+                            "mac-address-blacklist=\n"
+                            "%s" /* mtu */
+                            "\n"
+                            "%s" /* [ethernet-s390-options] */
+                            "[ipv4]\n"
+                            "dns-search=\n"
+                            "method=auto\n"
+                            "\n"
+                            "[ipv6]\n"
+                            "addr-gen-mode=stable-privacy\n"
+                            "dns-search=\n"
+                            "method=auto\n"
+                            "\n"
+                            "[proxy]\n"
+                            "",
+                            ID,
+                            UUID,
+                            INTERFACE_NAME,
+                            (ETH_MTU != 0) ? nm_sprintf_bufa(100, "mtu=%u\n", ETH_MTU) : "",
+                            s390_keyfile_entries));
+
+        g_ptr_array_add(
+            kf_data_arr,
+            g_strdup_printf("[connection]\n"
+                            "id=%s\n"
+                            "uuid=%s\n"
+                            "type=ethernet\n"
+                            "interface-name=%s\n"
+                            "permissions=\n"
+                            "\n"
+                            "[ethernet]\n"
+                            "mac-address-blacklist=\n"
+                            "%s" /* mtu */
+                            "\n"
+                            "%s" /* [ethernet-s390-options] */
+                            "[ipv4]\n"
+                            "dns-search=\n"
+                            "method=auto\n"
+                            "\n"
+                            "[ipv6]\n"
+                            "addr-gen-mode=stable-privacy\n"
+                            "dns-search=\n"
+                            "method=auto\n"
+                            "",
+                            ID,
+                            UUID,
+                            INTERFACE_NAME,
+                            (ETH_MTU != 0) ? nm_sprintf_bufa(100, "mtu=%d\n", (int) ETH_MTU) : "",
+                            s390_keyfile_entries));
+
+        break;
+
+    case 1:
+        con = nmtst_create_minimal_connection(ID, UUID, "wireguard", &s_con);
+        g_object_set(s_con, NM_SETTING_CONNECTION_INTERFACE_NAME, INTERFACE_NAME, NULL);
+        nmtst_connection_normalize(con);
+
+        s_wg = NM_SETTING_WIREGUARD(nm_connection_get_setting(con, NM_TYPE_SETTING_WIREGUARD));
+
+        g_ptr_array_add(kf_data_arr,
+                        g_strdup_printf("[connection]\n"
+                                        "id=%s\n"
+                                        "uuid=%s\n"
+                                        "type=wireguard\n"
+                                        "interface-name=%s\n"
+                                        "permissions=\n"
+                                        "\n"
+                                        "[wireguard]\n"
+                                        "\n"
+                                        "[ipv4]\n"
+                                        "dns-search=\n"
+                                        "method=disabled\n"
+                                        "\n"
+                                        "[ipv6]\n"
+                                        "addr-gen-mode=stable-privacy\n"
+                                        "dns-search=\n"
+                                        "method=ignore\n"
+                                        "\n"
+                                        "[proxy]\n"
+                                        "",
+                                        ID,
+                                        UUID,
+                                        INTERFACE_NAME));
+        break;
+
+    case 2:
+        con = nmtst_create_minimal_connection(ID, UUID, "wireguard", &s_con);
+        g_object_set(s_con, NM_SETTING_CONNECTION_INTERFACE_NAME, INTERFACE_NAME, NULL);
+        nmtst_connection_normalize(con);
+
+        s_wg = NM_SETTING_WIREGUARD(nm_connection_get_setting(con, NM_TYPE_SETTING_WIREGUARD));
+        g_object_set(s_wg,
+                     NM_SETTING_WIREGUARD_PRIVATE_KEY,
+                     WG_PRIVATE_KEY,
+                     NM_SETTING_WIREGUARD_PRIVATE_KEY_FLAGS,
+                     WG_PRIVATE_KEY_FLAGS,
+                     NM_SETTING_WIREGUARD_LISTEN_PORT,
+                     WG_LISTEN_PORT,
+                     NM_SETTING_WIREGUARD_FWMARK,
+                     WG_FWMARK,
+                     NULL);
+
+        wg_peers = _rndt_wg_peers_create();
+
+        for (i = 0; i < wg_peers->len; i++)
+            nm_setting_wireguard_append_peer(s_wg, wg_peers->pdata[i]);
+
+        nm_clear_g_free(&tmp_str);
+
+        g_ptr_array_add(
+            kf_data_arr,
+            g_strdup_printf(
+                "[connection]\n"
+                "id=%s\n"
+                "uuid=%s\n"
+                "type=wireguard\n"
+                "interface-name=%s\n"
+                "permissions=\n"
+                "\n"
+                "[wireguard]\n"
+                "%s" /* fwmark */
+                "%s" /* listen-port */
+                "%s" /* private-key-flags */
+                "%s" /* private-key */
+                "%s" /* [wireguard-peers*] */
+                "\n"
+                "[ipv4]\n"
+                "dns-search=\n"
+                "method=disabled\n"
+                "\n"
+                "[ipv6]\n"
+                "addr-gen-mode=stable-privacy\n"
+                "dns-search=\n"
+                "method=ignore\n"
+                "\n"
+                "[proxy]\n"
+                "",
+                ID,
+                UUID,
+                INTERFACE_NAME,
+                ((WG_FWMARK != 0) ? nm_sprintf_bufa(100, "fwmark=%u\n", WG_FWMARK) : ""),
+                ((WG_LISTEN_PORT != 0) ? nm_sprintf_bufa(100, "listen-port=%u\n", WG_LISTEN_PORT)
+                                       : ""),
+                ((WG_PRIVATE_KEY_FLAGS != NM_SETTING_SECRET_FLAG_NONE)
+                     ? nm_sprintf_bufa(100, "private-key-flags=%u\n", (guint) WG_PRIVATE_KEY_FLAGS)
+                     : ""),
+                ((WG_PRIVATE_KEY && WG_PRIVATE_KEY_FLAGS == NM_SETTING_SECRET_FLAG_NONE)
+                     ? nm_sprintf_bufa(100, "private-key=%s\n", WG_PRIVATE_KEY)
+                     : ""),
+                _rndt_wg_peers_to_keyfile(wg_peers, TRUE, &tmp_str)));
+
+        _rndt_wg_peers_assert_equal(s_wg, wg_peers, TRUE, TRUE, FALSE);
+        break;
+
+    case 3:
+        con = nmtst_create_minimal_connection(ID, UUID, NM_SETTING_WIRED_SETTING_NAME, &s_con);
+        g_object_set(s_con, NM_SETTING_CONNECTION_INTERFACE_NAME, INTERFACE_NAME, NULL);
+        nmtst_connection_normalize(con);
+
+        s_eth = NM_SETTING_WIRED(nm_connection_get_setting(con, NM_TYPE_SETTING_WIRED));
+        g_assert(NM_IS_SETTING_WIRED(s_eth));
+
+        g_object_set(s_eth, NM_SETTING_WIRED_MTU, ETH_MTU, NULL);
+
+        s_ip.s_4 = NM_SETTING_IP_CONFIG(nm_connection_get_setting(con, NM_TYPE_SETTING_IP4_CONFIG));
+        g_assert(NM_IS_SETTING_IP4_CONFIG(s_ip.s_4));
+
+        s_ip.s_6 = NM_SETTING_IP_CONFIG(nm_connection_get_setting(con, NM_TYPE_SETTING_IP6_CONFIG));
+        g_assert(NM_IS_SETTING_IP6_CONFIG(s_ip.s_6));
+
+        for (is_ipv4 = 0; is_ipv4 < 2; is_ipv4++) {
+            g_assert(NM_IS_SETTING_IP_CONFIG(s_ip.s_x[is_ipv4]));
+            for (i = 0; i < 3; i++) {
+                char addrstr[NM_UTILS_INET_ADDRSTRLEN];
+
+                nm_auto_unref_ip_routing_rule NMIPRoutingRule *rr = NULL;
+
+                rr = nm_ip_routing_rule_new(is_ipv4 ? AF_INET : AF_INET6);
+                nm_ip_routing_rule_set_priority(rr, i + 1);
+                if (i > 0) {
+                    if (is_ipv4)
+                        nm_sprintf_buf(addrstr, "192.168.%u.0", i);
+                    else
+                        nm_sprintf_buf(addrstr, "1:2:3:%x::", 10 + i);
+                    nm_ip_routing_rule_set_from(rr, addrstr, is_ipv4 ? 24 + i : 64 + i);
+                }
+                nm_ip_routing_rule_set_table(rr, 1000 + i);
+
+                success = nm_ip_routing_rule_validate(rr, &error);
+                nmtst_assert_success(success, error);
+
+                nm_setting_ip_config_add_routing_rule(s_ip.s_x[is_ipv4], rr);
+            }
+        }
+
+        g_ptr_array_add(
+            kf_data_arr,
+            g_strdup_printf("[connection]\n"
+                            "id=%s\n"
+                            "uuid=%s\n"
+                            "type=ethernet\n"
+                            "interface-name=%s\n"
+                            "permissions=\n"
+                            "\n"
+                            "[ethernet]\n"
+                            "mac-address-blacklist=\n"
+                            "%s" /* mtu */
+                            "\n"
+                            "[ipv4]\n"
+                            "dns-search=\n"
+                            "method=auto\n"
+                            "routing-rule1=priority 1 from 0.0.0.0/0 table 1000\n"
+                            "routing-rule2=priority 2 from 192.168.1.0/25 table 1001\n"
+                            "routing-rule3=priority 3 from 192.168.2.0/26 table 1002\n"
+                            "\n"
+                            "[ipv6]\n"
+                            "addr-gen-mode=stable-privacy\n"
+                            "dns-search=\n"
+                            "method=auto\n"
+                            "routing-rule1=priority 1 from ::/0 table 1000\n"
+                            "routing-rule2=priority 2 from 1:2:3:b::/65 table 1001\n"
+                            "routing-rule3=priority 3 from 1:2:3:c::/66 table 1002\n"
+                            "\n"
+                            "[proxy]\n"
+                            "",
+                            ID,
+                            UUID,
+                            INTERFACE_NAME,
+                            (ETH_MTU != 0) ? nm_sprintf_bufa(100, "mtu=%u\n", ETH_MTU) : ""));
+
+        break;
+
+    default:
+        g_assert_not_reached();
+    }
+
+    /* the first kf_data_arr entry is special: it is the exact result of what we expect
+     * when converting @con to keyfile. Write @con to keyfile and compare the expected result
+     * literally. */
+    {
+        nm_auto_unref_keyfile GKeyFile *kf = NULL;
+
+        kf = nm_keyfile_write(con, NM_KEYFILE_HANDLER_FLAGS_NONE, NULL, NULL, &error);
+        nmtst_assert_success(kf, error);
+
+        /* the first kf_data_arr entry is special: it must be what the writer would
+         * produce again. */
+        nmtst_keyfile_assert_data(kf, kf_data_arr->pdata[0], -1);
+    }
+
+    /* check that reading any of kf_data_arr yields the same result that we expect. */
+    for (kf_data_idx = 0; kf_data_idx < kf_data_arr->len; kf_data_idx++) {
+        gs_unref_object NMConnection *con2   = NULL;
+        NMSettingWireGuard *          s_wg2  = NULL;
+        NMSettingWired *              s_eth2 = NULL;
+
+        con2 = nmtst_create_connection_from_keyfile(kf_data_arr->pdata[kf_data_idx],
+                                                    "/no/where/file.nmconnection");
+
+        switch (MODE) {
+        case 0:
+            s_eth2 = NM_SETTING_WIRED(nm_connection_get_setting(con2, NM_TYPE_SETTING_WIRED));
+            g_assert(NM_IS_SETTING_WIRED(s_eth2));
+
+            if (ETH_MTU > (guint32) G_MAXINT && kf_data_idx == 1) {
+                /* older versions wrote values > 2^21 as signed integers, but the reader would
+                 * always reject such negative values for G_TYPE_UINT.
+                 *
+                 * The test case kf_data_idx #1 still writes the values in the old style.
+                 * The behavior was fixed, but such values are still rejected as invalid.
+                 *
+                 * Patch the setting so that the comparison below succeeds are usual. */
+                g_assert_cmpint(nm_setting_wired_get_mtu(s_eth2), ==, 0);
+                g_object_set(s_eth2, NM_SETTING_WIRED_MTU, ETH_MTU, NULL);
+            }
+
+            g_assert_cmpint(nm_setting_wired_get_mtu(s_eth), ==, ETH_MTU);
+            g_assert_cmpint(nm_setting_wired_get_mtu(s_eth2), ==, ETH_MTU);
+
+            g_assert_cmpint(nm_setting_wired_get_num_s390_options(s_eth2),
+                            ==,
+                            nm_setting_wired_get_num_s390_options(s_eth));
+
+            break;
+
+        case 1:
+            s_wg2 =
+                NM_SETTING_WIREGUARD(nm_connection_get_setting(con2, NM_TYPE_SETTING_WIREGUARD));
+            g_assert(NM_IS_SETTING_WIREGUARD(s_wg2));
+
+            g_assert_cmpstr(nm_setting_wireguard_get_private_key(s_wg), ==, NULL);
+            g_assert_cmpstr(nm_setting_wireguard_get_private_key(s_wg2), ==, NULL);
+            break;
+
+        case 2:
+            s_wg2 =
+                NM_SETTING_WIREGUARD(nm_connection_get_setting(con2, NM_TYPE_SETTING_WIREGUARD));
+            g_assert(NM_IS_SETTING_WIREGUARD(s_wg2));
+
+            /* the private key was lost due to the secret-flags. Patch it. */
+            if (WG_PRIVATE_KEY_FLAGS != NM_SETTING_SECRET_FLAG_NONE) {
+                g_assert_cmpstr(nm_setting_wireguard_get_private_key(s_wg2), ==, NULL);
+                g_object_set(s_wg2, NM_SETTING_WIREGUARD_PRIVATE_KEY, WG_PRIVATE_KEY, NULL);
+            }
+
+            g_assert_cmpstr(nm_setting_wireguard_get_private_key(s_wg), ==, WG_PRIVATE_KEY);
+            g_assert_cmpstr(nm_setting_wireguard_get_private_key(s_wg2), ==, WG_PRIVATE_KEY);
+
+            _rndt_wg_peers_assert_equal(s_wg2, wg_peers, TRUE, FALSE, FALSE);
+            _rndt_wg_peers_fix_secrets(s_wg2, wg_peers);
+            _rndt_wg_peers_assert_equal(s_wg2, wg_peers, TRUE, TRUE, FALSE);
+            break;
+        }
+
+        nmtst_assert_connection_equals(con, nmtst_get_rand_bool(), con2, nmtst_get_rand_bool());
+    }
+
+    for (dbus_serialization_flags_idx = 0;
+         dbus_serialization_flags_idx < G_N_ELEMENTS(dbus_serialization_flags);
+         dbus_serialization_flags_idx++) {
+        NMConnectionSerializationFlags flag =
+            dbus_serialization_flags[dbus_serialization_flags_idx];
+        gs_unref_variant GVariant *con_var  = NULL;
+        gs_unref_object NMConnection *con2  = NULL;
+        NMSettingWireGuard *          s_wg2 = NULL;
+
+        con_var = nm_connection_to_dbus(con, flag);
+        g_assert(g_variant_is_of_type(con_var, NM_VARIANT_TYPE_CONNECTION));
+        g_assert(g_variant_is_floating(con_var));
+        g_variant_ref_sink(con_var);
+
+        if (flag == NM_CONNECTION_SERIALIZE_ALL) {
+            con2 = _connection_new_from_dbus_strict(con_var, TRUE);
+            nmtst_assert_connection_equals(con, nmtst_get_rand_bool(), con2, nmtst_get_rand_bool());
+
+            {
+                nm_auto_unref_keyfile GKeyFile *kf = NULL;
+
+                kf = nm_keyfile_write(con2, NM_KEYFILE_HANDLER_FLAGS_NONE, NULL, NULL, &error);
+                nmtst_assert_success(kf, error);
+                nmtst_keyfile_assert_data(kf, kf_data_arr->pdata[0], -1);
+            }
+        }
+
+        switch (MODE) {
+        case 2:
+            if (flag == NM_CONNECTION_SERIALIZE_ALL) {
+                s_wg2 = NM_SETTING_WIREGUARD(
+                    nm_connection_get_setting(con2, NM_TYPE_SETTING_WIREGUARD));
+
+                if (flag == NM_CONNECTION_SERIALIZE_ALL)
+                    _rndt_wg_peers_assert_equal(s_wg2, wg_peers, TRUE, TRUE, FALSE);
+                else if (flag == NM_CONNECTION_SERIALIZE_WITH_NON_SECRET)
+                    _rndt_wg_peers_assert_equal(s_wg2, wg_peers, FALSE, FALSE, TRUE);
+                else
+                    g_assert_not_reached();
+            }
+            break;
+        }
+    }
+}
+
+/*****************************************************************************/
+
+static NMIPRoutingRule *
+_rr_from_str_get_impl(const char *str, const char *const *aliases)
+{
+    nm_auto_unref_ip_routing_rule NMIPRoutingRule *rr = NULL;
+    gs_free_error GError *       error                = NULL;
+    gboolean                     vbool;
+    int                          addr_family;
+    int                          i;
+    NMIPRoutingRuleAsStringFlags to_string_flags;
+
+    rr = nm_ip_routing_rule_from_string(str,
+                                        NM_IP_ROUTING_RULE_AS_STRING_FLAGS_VALIDATE,
+                                        NULL,
+                                        &error);
+    nmtst_assert_success(rr, error);
+
+    addr_family = nm_ip_routing_rule_get_addr_family(rr);
+    g_assert(NM_IN_SET(addr_family, AF_INET, AF_INET6));
+
+    if (addr_family == AF_INET)
+        to_string_flags = NM_IP_ROUTING_RULE_AS_STRING_FLAGS_AF_INET;
+    else
+        to_string_flags = NM_IP_ROUTING_RULE_AS_STRING_FLAGS_AF_INET6;
+
+    for (i = 0; TRUE; i++) {
+        nm_auto_unref_ip_routing_rule NMIPRoutingRule *rr2  = NULL;
+        gs_free char *                                 str1 = NULL;
+        gs_unref_variant GVariant *variant1                 = NULL;
+        const char *               cstr1;
+
+        switch (i) {
+        case 0:
+            rr2 = nm_ip_routing_rule_ref(rr);
+            break;
+
+        case 1:
+            rr2 = nm_ip_routing_rule_from_string(
+                str,
+                NM_IP_ROUTING_RULE_AS_STRING_FLAGS_VALIDATE
+                    | (nmtst_get_rand_bool() ? to_string_flags
+                                             : NM_IP_ROUTING_RULE_AS_STRING_FLAGS_NONE),
+                NULL,
+                &error);
+            nmtst_assert_success(rr, error);
+            break;
+
+        case 2:
+            str1 = nm_ip_routing_rule_to_string(
+                rr,
+                NM_IP_ROUTING_RULE_AS_STRING_FLAGS_VALIDATE
+                    | (nmtst_get_rand_bool() ? to_string_flags
+                                             : NM_IP_ROUTING_RULE_AS_STRING_FLAGS_NONE),
+                NULL,
+                &error);
+            nmtst_assert_success(str1 && str1[0], error);
+
+            g_assert_cmpstr(str, ==, str1);
+
+            rr2 = nm_ip_routing_rule_from_string(
+                str1,
+                NM_IP_ROUTING_RULE_AS_STRING_FLAGS_VALIDATE
+                    | (nmtst_get_rand_bool() ? to_string_flags
+                                             : NM_IP_ROUTING_RULE_AS_STRING_FLAGS_NONE),
+                NULL,
+                &error);
+            nmtst_assert_success(rr, error);
+            break;
+
+        case 3:
+            variant1 = nm_ip_routing_rule_to_dbus(rr);
+            g_assert(variant1);
+            g_assert(g_variant_is_floating(variant1));
+            g_assert(g_variant_is_of_type(variant1, G_VARIANT_TYPE_VARDICT));
+
+            rr2 = nm_ip_routing_rule_from_dbus(variant1, TRUE, &error);
+            nmtst_assert_success(rr, error);
+            break;
+
+        default:
+            if (!aliases || !aliases[0])
+                goto done;
+            cstr1 = (aliases++)[0];
+            rr2   = nm_ip_routing_rule_from_string(
+                cstr1,
+                NM_IP_ROUTING_RULE_AS_STRING_FLAGS_VALIDATE
+                    | (nmtst_get_rand_bool() ? to_string_flags
+                                               : NM_IP_ROUTING_RULE_AS_STRING_FLAGS_NONE),
+                NULL,
+                &error);
+            nmtst_assert_success(rr, error);
+            break;
+        }
+
+        g_assert(rr2);
+        vbool = nm_ip_routing_rule_validate(rr, &error);
+        nmtst_assert_success(vbool, error);
+        vbool = nm_ip_routing_rule_validate(rr2, &error);
+        nmtst_assert_success(vbool, error);
+
+        g_assert_cmpint(nm_ip_routing_rule_cmp(rr, rr2), ==, 0);
+        g_assert_cmpint(nm_ip_routing_rule_cmp(rr2, rr), ==, 0);
+    }
+
+done:
+    return g_steal_pointer(&rr);
+}
+#define _rr_from_str_get(a, ...) _rr_from_str_get_impl(a, &(NM_MAKE_STRV(NULL, ##__VA_ARGS__))[1])
+
+#define _rr_from_str(...)                                          \
+    G_STMT_START                                                   \
+    {                                                              \
+        nm_auto_unref_ip_routing_rule NMIPRoutingRule *_rr = NULL; \
+                                                                   \
+        _rr = _rr_from_str_get(__VA_ARGS__);                       \
+        g_assert(_rr);                                             \
+    }                                                              \
+    G_STMT_END
+
+static void
+test_routing_rule(gconstpointer test_data)
+{
+    nm_auto_unref_ip_routing_rule NMIPRoutingRule *rr1 = NULL;
+    gboolean                                       success;
+    char                                           ifname_buf[16];
+    gs_free_error GError *error = NULL;
+
+    _rr_from_str("priority 5 from 0.0.0.0 table 1", "  from 0.0.0.0  priority  5 lookup 1 ");
+    _rr_from_str("priority 5 from 0.0.0.0/0 table 4");
+    _rr_from_str("priority 5 to 0.0.0.0 table 6");
+    _rr_from_str("priority 5 to 0.0.0.0 table 254", "priority 5 to 0.0.0.0/32");
+    _rr_from_str("priority 5 from 1.2.3.4 table 15",
+                 "priority 5 from 1.2.3.4/32 table  0xF ",
+                 "priority 5 from 1.2.3.4/32 to 0.0.0.0/0 lookup 15 ");
+    _rr_from_str("priority 5 from 1.2.3.4 to 0.0.0.0 table 8");
+    _rr_from_str("priority 5 to a:b:c:: tos 0x16 table 25",
+                 "priority 5 to a:b:c::/128 table 0x19 tos 16",
+                 "priority 5 to a:b:c::/128 lookup 0x19 dsfield 16",
+                 "priority 5 to a:b:c::/128 lookup 0x19 dsfield 16 fwmark 0/0x00",
+                 "priority 5 to a:b:c:: from all lookup 0x19 dsfield 16 fwmark 0x0/0");
+    _rr_from_str("priority 5 from :: fwmark 0 table 25",
+                 "priority 5 from ::/128 to all table 0x19 fwmark 0/0xFFFFFFFF",
+                 "priority 5 from :: to ::/0 table 0x19 fwmark 0x00/4294967295");
+    _rr_from_str("priority 5 from :: iif aab table 25");
+    _rr_from_str("priority 5 from :: iif aab oif er table 25",
+                 "priority 5 from :: table 0x19 dev aab oif er");
+    _rr_from_str("priority 5 from :: iif a\\\\303b table 25");
+    _rr_from_str("priority 5 to 0.0.0.0 sport 10 table 6",
+                 "priority 5 to 0.0.0.0 sport 10-10 table 6");
+    _rr_from_str("priority 5 not to 0.0.0.0 dport 10-133 table 6",
+                 "not priority 5 to 0.0.0.0 dport 10-133 table 6",
+                 "not priority 5 not to 0.0.0.0 dport 10-133 table 6",
+                 "priority 5 to 0.0.0.0 not dport 10-133 not table 6",
+                 "priority 5 to 0.0.0.0 not dport 10-\\ 133 not table 6");
+    _rr_from_str("priority 5 to 0.0.0.0 ipproto 10 sport 10 table 6");
+    _rr_from_str("priority 5 to 0.0.0.0 type blackhole", "priority 5 to 0.0.0.0 blackhole");
+
+    rr1 = _rr_from_str_get("priority 5 from :: iif aab table 25");
+    g_assert_cmpstr(nm_ip_routing_rule_get_iifname(rr1), ==, "aab");
+    success = nm_ip_routing_rule_get_xifname_bin(rr1, FALSE, ifname_buf);
+    g_assert(!success);
+    success = nm_ip_routing_rule_get_xifname_bin(rr1, TRUE, ifname_buf);
+    g_assert_cmpstr(ifname_buf, ==, "aab");
+    g_assert(success);
+    nm_clear_pointer(&rr1, nm_ip_routing_rule_unref);
+
+    rr1 = _rr_from_str_get("priority 5 from :: iif a\\\\303\\\\261xb table 254");
+    g_assert_cmpstr(nm_ip_routing_rule_get_iifname(rr1), ==, "a\\303\\261xb");
+    success = nm_ip_routing_rule_get_xifname_bin(rr1, FALSE, ifname_buf);
+    g_assert(!success);
+    success = nm_ip_routing_rule_get_xifname_bin(rr1, TRUE, ifname_buf);
+    g_assert_cmpstr(ifname_buf, ==, "a\303\261xb");
+    g_assert(success);
+    nm_clear_pointer(&rr1, nm_ip_routing_rule_unref);
+
+    rr1 = _rr_from_str_get("priority 5 from :: oif \\\\101=\\\\303\\\\261xb table 7");
+    g_assert_cmpstr(nm_ip_routing_rule_get_oifname(rr1), ==, "\\101=\\303\\261xb");
+    success = nm_ip_routing_rule_get_xifname_bin(rr1, FALSE, ifname_buf);
+    g_assert_cmpstr(ifname_buf, ==, "A=\303\261xb");
+    g_assert(success);
+    success = nm_ip_routing_rule_get_xifname_bin(rr1, TRUE, ifname_buf);
+    g_assert(!success);
+    nm_clear_pointer(&rr1, nm_ip_routing_rule_unref);
+
+    rr1 = _rr_from_str_get("priority 5 to 0.0.0.0 tos 0x10 table 7");
+    g_assert_cmpstr(NULL, ==, nm_ip_routing_rule_get_from(rr1));
+    g_assert(!nm_ip_routing_rule_get_from_bin(rr1));
+    g_assert_cmpint(0, ==, nm_ip_routing_rule_get_from_len(rr1));
+    g_assert_cmpstr("0.0.0.0", ==, nm_ip_routing_rule_get_to(rr1));
+    g_assert(nm_ip_addr_is_null(AF_INET, nm_ip_routing_rule_get_to_bin(rr1)));
+    g_assert_cmpint(32, ==, nm_ip_routing_rule_get_to_len(rr1));
+    g_assert_cmpint(7, ==, nm_ip_routing_rule_get_table(rr1));
+    g_assert_cmpint(0x10, ==, nm_ip_routing_rule_get_tos(rr1));
+    nm_clear_pointer(&rr1, nm_ip_routing_rule_unref);
+
+    rr1 = _rr_from_str_get("priority 5 from :: iif a\\\\303\\\\261,x;b table 254",
+                           "priority 5 from :: iif a\\\\303\\\\261,x;b table 254");
+    g_assert_cmpstr(nm_ip_routing_rule_get_iifname(rr1), ==, "a\\303\\261,x;b");
+    success = nm_ip_routing_rule_get_xifname_bin(rr1, FALSE, ifname_buf);
+    g_assert(!success);
+    success = nm_ip_routing_rule_get_xifname_bin(rr1, TRUE, ifname_buf);
+    g_assert_cmpstr(ifname_buf, ==, "a\303\261,x;b");
+    g_assert(success);
+    nm_clear_pointer(&rr1, nm_ip_routing_rule_unref);
+
+    rr1 = nm_ip_routing_rule_from_string("priority   6 blackhole",
+                                         NM_IP_ROUTING_RULE_AS_STRING_FLAGS_AF_INET,
+                                         NULL,
+                                         &error);
+    nmtst_assert_success(rr1, error);
+    nm_clear_pointer(&rr1, nm_ip_routing_rule_unref);
+    nm_clear_error(&error);
+
+    rr1 = nm_ip_routing_rule_from_string("priority   6 bogus",
+                                         NM_IP_ROUTING_RULE_AS_STRING_FLAGS_AF_INET,
+                                         NULL,
+                                         &error);
+    nmtst_assert_no_success(rr1, error);
+    nm_clear_pointer(&rr1, nm_ip_routing_rule_unref);
+    nm_clear_error(&error);
+}
+
+/*****************************************************************************/
+
+static void
+test_parse_tc_handle(void)
+{
+#define _parse_tc_handle(str, exp)                                              \
+    G_STMT_START                                                                \
+    {                                                                           \
+        gs_free_error GError *_error  = NULL;                                   \
+        GError **             _perror = nmtst_get_rand_bool() ? &_error : NULL; \
+        guint32               _v;                                               \
+        const guint32         _v_exp = (exp);                                   \
+                                                                                \
+        _v = _nm_utils_parse_tc_handle("" str "", _perror);                     \
+                                                                                \
+        if (_v != _v_exp)                                                       \
+            g_error("%s:%d: \"%s\" gave %08x but %08x expected.",               \
+                    __FILE__,                                                   \
+                    __LINE__,                                                   \
+                    "" str "",                                                  \
+                    _v,                                                         \
+                    _v_exp);                                                    \
+                                                                                \
+        if (_v == TC_H_UNSPEC)                                                  \
+            g_assert(!_perror || *_perror);                                     \
+        else                                                                    \
+            g_assert(!_perror || !*_perror);                                    \
+    }                                                                           \
+    G_STMT_END
+
+#define _parse_tc_handle_inval(str) _parse_tc_handle(str, TC_H_UNSPEC)
+#define _parse_tc_handle_valid(str, maj, min) \
+    _parse_tc_handle(str, TC_H_MAKE(((guint32) (maj)) << 16, ((guint16) (min))))
+
+    _parse_tc_handle_inval("");
+    _parse_tc_handle_inval(" ");
+    _parse_tc_handle_inval(" \n");
+    _parse_tc_handle_valid("1", 1, 0);
+    _parse_tc_handle_valid(" 1 ", 1, 0);
+    _parse_tc_handle_valid("1:", 1, 0);
+    _parse_tc_handle_valid("1:  ", 1, 0);
+    _parse_tc_handle_valid("1:0", 1, 0);
+    _parse_tc_handle_valid("1   :0", 1, 0);
+    _parse_tc_handle_valid("1   \t\n\f\r:0", 1, 0);
+    _parse_tc_handle_inval("1   \t\n\f\r\v:0");
+    _parse_tc_handle_valid(" 1 : 0  ", 1, 0);
+    _parse_tc_handle_inval(" \t\v\n1: 0");
+    _parse_tc_handle_valid("1:2", 1, 2);
+    _parse_tc_handle_valid("01:02", 1, 2);
+    _parse_tc_handle_inval("0x01:0x02");
+    _parse_tc_handle_valid("  01:   02", 1, 2);
+    _parse_tc_handle_valid("019:   020", 0x19, 0x20);
+    _parse_tc_handle_valid("FFFF:   020", 0xFFFF, 0x20);
+    _parse_tc_handle_valid("FfFF:   ffff", 0xFFFF, 0xFFFF);
+    _parse_tc_handle_valid("FFFF", 0xFFFF, 0);
+    _parse_tc_handle_inval("0xFFFF");
+    _parse_tc_handle_inval("10000");
+    _parse_tc_handle_valid("\t\n\f\r FFFF", 0xFFFF, 0);
+    _parse_tc_handle_inval("\t\n\f\r \vFFFF");
+}
+
+/*****************************************************************************/
+
+static void
+test_empty_setting(void)
+{
+    gs_unref_object NMConnection *con  = NULL;
+    gs_unref_object NMConnection *con2 = NULL;
+    NMSettingBluetooth *          s_bt;
+    NMSettingGsm *                s_gsm;
+    nm_auto_unref_keyfile GKeyFile *kf = NULL;
+    gs_free_error GError *error        = NULL;
+
+    con = nmtst_create_minimal_connection("bt-empty-gsm",
+                                          "dca3192a-f2dc-48eb-b806-d0ff788f122c",
+                                          NM_SETTING_BLUETOOTH_SETTING_NAME,
+                                          NULL);
+
+    s_bt = _nm_connection_get_setting(con, NM_TYPE_SETTING_BLUETOOTH);
+    g_object_set(s_bt,
+                 NM_SETTING_BLUETOOTH_TYPE,
+                 "dun",
+                 NM_SETTING_BLUETOOTH_BDADDR,
+                 "aa:bb:cc:dd:ee:ff",
+                 NULL);
+
+    s_gsm = NM_SETTING_GSM(nm_setting_gsm_new());
+    nm_connection_add_setting(con, NM_SETTING(s_gsm));
+
+    nmtst_connection_normalize(con);
+
+    nmtst_assert_connection_verifies_without_normalization(con);
+
+    kf = nm_keyfile_write(con, NM_KEYFILE_HANDLER_FLAGS_NONE, NULL, NULL, &error);
+    nmtst_assert_success(kf, error);
+
+    g_assert(g_key_file_has_group(kf, "gsm"));
+    g_assert_cmpint(nmtst_keyfile_get_num_keys(kf, "gsm"), ==, 0);
+
+    con2 = nm_keyfile_read(kf,
+                           "/ignored/current/working/directory/for/loading/relative/paths",
+                           NM_KEYFILE_HANDLER_FLAGS_NONE,
+                           NULL,
+                           NULL,
+                           &error);
+    nmtst_assert_success(con2, error);
+
+    g_assert(nm_connection_get_setting(con2, NM_TYPE_SETTING_GSM));
+
+    nmtst_assert_connection_verifies_without_normalization(con2);
+}
+
+/*****************************************************************************/
+
+static guint
+_PROP_IDX_PACK(NMMetaSettingType meta_type, guint idx)
+{
+    return (((guint) meta_type) & 0xFFu) | (idx << 8);
+}
+
+static const char *
+_PROP_IDX_OWNER(GHashTable *h_property_types, const NMSettInfoPropertType *property_type)
+{
+    const NMSettInfoSetting *sett_info_settings = nmtst_sett_info_settings();
+    const NMSettInfoSetting *sis;
+    const NMMetaSettingInfo *msi;
+    GArray *                 arr;
+    guint                    idx;
+    NMMetaSettingType        meta_type;
+    guint                    prop_idx;
+    char                     sbuf[300];
+
+    g_assert(h_property_types);
+    g_assert(property_type);
+
+    arr = g_hash_table_lookup(h_property_types, property_type);
+
+    g_assert(arr);
+    g_assert(arr->len > 0);
+
+    idx = g_array_index(arr, guint, 0);
+
+    meta_type = (idx & 0xFFu);
+    prop_idx  = idx >> 8;
+
+    g_assert(meta_type < _NM_META_SETTING_TYPE_NUM);
+
+    sis = &sett_info_settings[meta_type];
+    msi = &nm_meta_setting_infos[meta_type];
+
+    g_assert(prop_idx < sis->property_infos_len);
+
+    nm_sprintf_buf(sbuf, "%s.%s", msi->setting_name, sis->property_infos[prop_idx].name);
+
+    return g_intern_string(sbuf);
+}
+
+static void
+test_setting_metadata(void)
+{
+    const NMSettInfoSetting *sett_info_settings = nmtst_sett_info_settings();
+    NMMetaSettingType        meta_type;
+    gs_unref_hashtable GHashTable *h_property_types = NULL;
+
+    G_STATIC_ASSERT(_NM_META_SETTING_TYPE_NUM == NM_META_SETTING_TYPE_UNKNOWN);
+
+    h_property_types =
+        g_hash_table_new_full(nm_direct_hash, NULL, NULL, (GDestroyNotify) g_array_unref);
+
+    for (meta_type = 0; meta_type < _NM_META_SETTING_TYPE_NUM; meta_type++) {
+        const NMMetaSettingInfo *msi                   = &nm_meta_setting_infos[meta_type];
+        nm_auto_unref_gtypeclass NMSettingClass *klass = NULL;
+        GType                                    gtype;
+
+        g_assert(msi->setting_name);
+        g_assert(msi->get_setting_gtype);
+        g_assert(msi->meta_type == meta_type);
+        g_assert(msi->setting_priority >= NM_SETTING_PRIORITY_CONNECTION);
+        g_assert(msi->setting_priority <= NM_SETTING_PRIORITY_USER);
+
+        if (meta_type > 0)
+            g_assert_cmpint(
+                strcmp(nm_meta_setting_infos[meta_type - 1].setting_name, msi->setting_name),
+                <,
+                0);
+
+        gtype = msi->get_setting_gtype();
+
+        g_assert(g_type_is_a(gtype, NM_TYPE_SETTING));
+        g_assert(gtype != NM_TYPE_SETTING);
+
+        klass = g_type_class_ref(gtype);
+        g_assert(klass);
+        g_assert(NM_IS_SETTING_CLASS(klass));
+
+        g_assert(msi == klass->setting_info);
+    }
+
+    g_assert(sett_info_settings);
+
+    for (meta_type = 0; meta_type < _NM_META_SETTING_TYPE_NUM; meta_type++) {
+        const NMSettInfoSetting *sis                = &sett_info_settings[meta_type];
+        const NMMetaSettingInfo *msi                = &nm_meta_setting_infos[meta_type];
+        gs_unref_hashtable GHashTable *h_properties = NULL;
+        GType                          gtype;
+        gs_unref_object NMSetting *setting = NULL;
+        guint                      prop_idx;
+        gs_free GParamSpec **property_specs = NULL;
+        guint                n_property_specs;
+
+        g_assert(sis);
+
+        g_assert(NM_IS_SETTING_CLASS(sis->setting_class));
+
+        gtype = msi->get_setting_gtype();
+
+        g_assert(G_TYPE_FROM_CLASS(sis->setting_class) == gtype);
+
+        setting = g_object_new(gtype, NULL);
+
+        g_assert(NM_IS_SETTING(setting));
+
+        g_assert_cmpint(sis->property_infos_len, >, 0);
+        g_assert(sis->property_infos);
+
+        h_properties = g_hash_table_new(nm_str_hash, g_str_equal);
+
+        for (prop_idx = 0; prop_idx < sis->property_infos_len; prop_idx++) {
+            const NMSettInfoProperty *sip = &sis->property_infos[prop_idx];
+            GArray *                  property_types_data;
+            guint                     prop_idx_val;
+            gboolean                  can_set_including_default = FALSE;
+
+            g_assert(sip->name);
+
+            if (prop_idx > 0)
+                g_assert_cmpint(strcmp(sis->property_infos[prop_idx - 1].name, sip->name), <, 0);
+
+            g_assert(sip->property_type);
+            g_assert(sip->property_type->dbus_type);
+            g_assert(g_variant_type_string_is_valid((const char *) sip->property_type->dbus_type));
+
+            if (!sip->property_type->to_dbus_fcn) {
+                /* it's allowed to have no to_dbus_fcn(), to ignore a property. But such
+                 * properties must not have a param_spec and no gprop_to_dbus_fcn. */
+                g_assert(!sip->param_spec);
+                g_assert(!sip->to_dbus_data.none);
+            } else if (sip->property_type->to_dbus_fcn == _nm_setting_property_to_dbus_fcn_gprop) {
+                g_assert(sip->param_spec);
+                switch (sip->property_type->typdata_to_dbus.gprop_type) {
+                case NM_SETTING_PROPERTY_TO_DBUS_FCN_GPROP_TYPE_BYTES:
+                    g_assert(sip->param_spec->value_type == G_TYPE_BYTES);
+                    goto check_done;
+                case NM_SETTING_PROPERTY_TO_DBUS_FCN_GPROP_TYPE_ENUM:
+                    g_assert(g_type_is_a(sip->param_spec->value_type, G_TYPE_ENUM));
+                    goto check_done;
+                case NM_SETTING_PROPERTY_TO_DBUS_FCN_GPROP_TYPE_FLAGS:
+                    g_assert(g_type_is_a(sip->param_spec->value_type, G_TYPE_FLAGS));
+                    goto check_done;
+                case NM_SETTING_PROPERTY_TO_DBUS_FCN_GPROP_TYPE_GARRAY_UINT:
+                    g_assert(sip->param_spec->value_type == G_TYPE_ARRAY);
+                    goto check_done;
+                case NM_SETTING_PROPERTY_TO_DBUS_FCN_GPROP_TYPE_STRDICT:
+                    g_assert(sip->param_spec->value_type == G_TYPE_HASH_TABLE);
+                    goto check_done;
+                case NM_SETTING_PROPERTY_TO_DBUS_FCN_GPROP_TYPE_MAC_ADDRESS:
+                    g_assert(sip->param_spec->value_type == G_TYPE_STRING);
+                    goto check_done;
+                case NM_SETTING_PROPERTY_TO_DBUS_FCN_GPROP_TYPE_DEFAULT:
+                    goto check_done;
+                }
+                g_assert_not_reached();
+check_done:;
+                if (sip->property_type->typdata_to_dbus.gprop_type
+                    != NM_SETTING_PROPERTY_TO_DBUS_FCN_GPROP_TYPE_DEFAULT)
+                    g_assert(!sip->to_dbus_data.gprop_to_dbus_fcn);
+                can_set_including_default = TRUE;
+            } else if (sip->property_type->to_dbus_fcn
+                       == _nm_setting_property_to_dbus_fcn_get_boolean) {
+                g_assert(sip->param_spec);
+                g_assert(sip->param_spec->value_type == G_TYPE_BOOLEAN);
+                g_assert(sip->to_dbus_data.get_boolean);
+                can_set_including_default = TRUE;
+            } else if (sip->property_type->to_dbus_fcn
+                       == _nm_setting_property_to_dbus_fcn_get_string) {
+                g_assert(sip->param_spec);
+                g_assert(sip->param_spec->value_type == G_TYPE_STRING);
+                g_assert(sip->to_dbus_data.get_string);
+            }
+
+            if (!can_set_including_default)
+                g_assert(!sip->to_dbus_data.including_default);
+
+            g_assert(!sip->property_type->from_dbus_fcn
+                     || !sip->property_type->gprop_from_dbus_fcn);
+
+            if (!g_hash_table_insert(h_properties, (char *) sip->name, sip->param_spec))
+                g_assert_not_reached();
+
+            property_types_data = g_hash_table_lookup(h_property_types, sip->property_type);
+            if (!property_types_data) {
+                property_types_data = g_array_new(FALSE, FALSE, sizeof(guint));
+                if (!g_hash_table_insert(h_property_types,
+                                         (gpointer) sip->property_type,
+                                         property_types_data))
+                    g_assert_not_reached();
+            }
+            prop_idx_val = _PROP_IDX_PACK(meta_type, prop_idx);
+            g_array_append_val(property_types_data, prop_idx_val);
+
+            if (sip->param_spec) {
+                nm_auto_unset_gvalue GValue val = G_VALUE_INIT;
+
+                g_assert_cmpstr(sip->name, ==, sip->param_spec->name);
+
+                g_value_init(&val, sip->param_spec->value_type);
+                g_object_get_property(G_OBJECT(setting), sip->name, &val);
+
+                if (sip->param_spec->value_type == G_TYPE_STRING) {
+                    const char *default_value;
+
+                    default_value = ((const GParamSpecString *) sip->param_spec)->default_value;
+                    if (default_value) {
+                        /* having a string property with a default != NULL is really ugly. They
+                         * should be best avoided... */
+                        if (meta_type == NM_META_SETTING_TYPE_DCB
+                            && nm_streq(sip->name, NM_SETTING_DCB_APP_FCOE_MODE)) {
+                            /* Whitelist the properties that have a non-NULL default value. */
+                            g_assert_cmpstr(default_value, ==, NM_SETTING_DCB_FCOE_MODE_FABRIC);
+                        } else
+                            g_assert_not_reached();
+                    }
+
+                    if (nm_streq(sip->name, NM_SETTING_NAME))
+                        g_assert_cmpstr(g_value_get_string(&val), ==, msi->setting_name);
+                    else
+                        g_assert_cmpstr(g_value_get_string(&val), ==, default_value);
+                }
+
+                if (NM_FLAGS_HAS(sip->param_spec->flags, NM_SETTING_PARAM_TO_DBUS_IGNORE_FLAGS))
+                    g_assert(sip->property_type->to_dbus_fcn);
+            }
+        }
+
+        /* check that all GObject based properties are tracked by the settings. */
+        property_specs =
+            g_object_class_list_properties(G_OBJECT_CLASS(sis->setting_class), &n_property_specs);
+        g_assert(property_specs);
+        g_assert_cmpint(n_property_specs, >, 0);
+        for (prop_idx = 0; prop_idx < n_property_specs; prop_idx++) {
+            const GParamSpec *pip = property_specs[prop_idx];
+
+            g_assert(g_hash_table_lookup(h_properties, pip->name) == pip);
+        }
+
+        /* check that property_infos_sorted is as expected. */
+        if (sis->property_infos_sorted) {
+            gs_unref_hashtable GHashTable *h = g_hash_table_new(nm_direct_hash, NULL);
+
+            /* property_infos_sorted is only implemented for [connection] type */
+            g_assert_cmpint(meta_type, ==, NM_META_SETTING_TYPE_CONNECTION);
+
+            /* ensure that there are no duplicates, and that all properties are also
+             * tracked by sis->property_infos. */
+            for (prop_idx = 0; prop_idx < sis->property_infos_len; prop_idx++) {
+                const NMSettInfoProperty *sip = sis->property_infos_sorted[prop_idx];
+
+                if (!g_hash_table_add(h, (gpointer) sip))
+                    g_assert_not_reached();
+            }
+            for (prop_idx = 0; prop_idx < sis->property_infos_len; prop_idx++) {
+                const NMSettInfoProperty *sip = &sis->property_infos[prop_idx];
+
+                g_assert(g_hash_table_contains(h, sip));
+            }
+        } else
+            g_assert_cmpint(meta_type, !=, NM_META_SETTING_TYPE_CONNECTION);
+
+        /* consistency check for gendata-info. */
+        if (sis->detail.gendata_info) {
+            g_assert_cmpint(meta_type, ==, NM_META_SETTING_TYPE_ETHTOOL);
+            g_assert(sis->detail.gendata_info->get_variant_type);
+
+            /* the gendata info based setting has only one regular property: the "name". */
+            g_assert_cmpint(sis->property_infos_len, ==, 1);
+            g_assert_cmpstr(sis->property_infos[0].name, ==, NM_SETTING_NAME);
+        } else
+            g_assert_cmpint(meta_type, !=, NM_META_SETTING_TYPE_ETHTOOL);
+    }
+
+    {
+        gs_free NMSettInfoPropertType **a_property_types = NULL;
+        guint                           a_property_types_len;
+        guint                           prop_idx;
+        guint                           prop_idx_2;
+
+        a_property_types =
+            (NMSettInfoPropertType **) g_hash_table_get_keys_as_array(h_property_types,
+                                                                      &a_property_types_len);
+
+        for (prop_idx = 0; prop_idx < a_property_types_len; prop_idx++) {
+            const NMSettInfoPropertType *pt = a_property_types[prop_idx];
+
+            for (prop_idx_2 = prop_idx + 1; prop_idx_2 < a_property_types_len; prop_idx_2++) {
+                const NMSettInfoPropertType *pt_2 = a_property_types[prop_idx_2];
+
+                if (!g_variant_type_equal(pt->dbus_type, pt_2->dbus_type)
+                    || pt->to_dbus_fcn != pt_2->to_dbus_fcn
+                    || pt->from_dbus_fcn != pt_2->from_dbus_fcn
+                    || pt->missing_from_dbus_fcn != pt_2->missing_from_dbus_fcn
+                    || pt->gprop_from_dbus_fcn != pt_2->gprop_from_dbus_fcn
+                    || memcmp(&pt->typdata_to_dbus,
+                              &pt_2->typdata_to_dbus,
+                              sizeof(pt->typdata_to_dbus))
+                           != 0)
+                    continue;
+
+                if ((pt == &nm_sett_info_propert_type_plain_i
+                     && pt_2 == &nm_sett_info_propert_type_deprecated_ignore_i)
+                    || (pt_2 == &nm_sett_info_propert_type_plain_i
+                        && pt == &nm_sett_info_propert_type_deprecated_ignore_i)
+                    || (pt == &nm_sett_info_propert_type_plain_u
+                        && pt_2 == &nm_sett_info_propert_type_deprecated_ignore_u)
+                    || (pt_2 == &nm_sett_info_propert_type_plain_u
+                        && pt == &nm_sett_info_propert_type_deprecated_ignore_u)) {
+                    /* These are known to be duplicated. This is the case for
+                     *   "gsm.network-type"  and plain properties like "802-11-wireless-security.fils" ("i" D-Bus type)
+                     *   "gsm.allowed-bands" and plain properties like "802-11-olpc-mesh.channel" ("u" D-Bus type)
+                     * While the content/behaviour of the property types are identical, their purpose
+                     * is different. So allow them.
+                     */
+                    continue;
+                }
+
+                /* the property-types with same content should all be shared. Here we have two that
+                 * are the same content, but different instances. Bug. */
+                g_error("The identical property type for D-Bus type \"%s\" is used by: %s and %s. "
+                        "If a NMSettInfoPropertType is identical, it should be shared by creating "
+                        "a common instance of the property type",
+                        (const char *) pt->dbus_type,
+                        _PROP_IDX_OWNER(h_property_types, pt),
+                        _PROP_IDX_OWNER(h_property_types, pt_2));
+            }
+        }
+    }
+}
+
+/*****************************************************************************/
+
+static void
+test_setting_connection_secondaries_verify(void)
+{
+    gs_unref_object NMConnection *con = NULL;
+    NMSettingConnection *         s_con;
+    guint                         i_run;
+    guint                         i_word;
+
+    con = nmtst_create_minimal_connection("test-sec", NULL, NM_SETTING_WIRED_SETTING_NAME, &s_con);
+    nmtst_connection_normalize(con);
+
+    for (i_run = 0; i_run < 100; i_run++) {
+        guint             word_len            = nmtst_get_rand_word_length(NULL);
+        gs_unref_ptrarray GPtrArray *arr      = NULL;
+        gs_unref_ptrarray GPtrArray *arr_norm = NULL;
+        gboolean                     was_normalized;
+        gboolean                     was_normalized2;
+
+        /* create a random list of invalid, normalizable and normalized UUIDs. */
+        arr = g_ptr_array_new();
+        for (i_word = 0; i_word < word_len; i_word++) {
+            g_ptr_array_add(arr,
+                            (char *) nmtst_rand_select((const char *) "",
+                                                       "52c3feb9-3aa2-46f6-a07b-1765918699eb",
+                                                       "52C3feb9-3aa2-46f6-a07b-1765918699eb",
+                                                       "52C3feb9-3aa2-46f6-a07b-1765918699eb",
+                                                       "f86dfb13df764894ab3836b7cdb9d82dde8b27c4",
+                                                       "52C3feb93-aa2-46f6-a07b-1765918699eb",
+                                                       "bogus"));
+        }
+        g_ptr_array_add(arr, NULL);
+
+        /* set the new list of secondaries, and assert that the result is as expected. */
+
+        nmtst_assert_connection_verifies_without_normalization(con);
+
+        g_object_set(s_con, NM_SETTING_CONNECTION_SECONDARIES, arr->pdata, NULL);
+
+#define _assert_secondaries(s_con, expected)                                                       \
+    G_STMT_START                                                                                   \
+    {                                                                                              \
+        NMSettingConnection *const _s_con    = (s_con);                                            \
+        const char *const *        _expected = (expected);                                         \
+        GArray *                   _secondaries;                                                   \
+        const guint                _expected_len = NM_PTRARRAY_LEN(_expected);                     \
+        gs_strfreev char **        _sec_strv     = NULL;                                           \
+        guint                      _i;                                                             \
+                                                                                                   \
+        g_assert(_expected);                                                                       \
+                                                                                                   \
+        if (nmtst_get_rand_bool()) {                                                               \
+            _secondaries = _nm_setting_connection_get_secondaries(_s_con);                         \
+            g_assert_cmpint(_expected_len, ==, nm_g_array_len(_secondaries));                      \
+            g_assert((_expected_len == 0) == (!_secondaries));                                     \
+            g_assert(nm_utils_strv_equal(_expected,                                                \
+                                         _secondaries ? nm_strvarray_get_strv(&_secondaries, NULL) \
+                                                      : NM_PTRARRAY_EMPTY(const char *)));         \
+        }                                                                                          \
+                                                                                                   \
+        if (nmtst_get_rand_bool()) {                                                               \
+            g_object_get(_s_con, NM_SETTING_CONNECTION_SECONDARIES, &_sec_strv, NULL);             \
+            g_assert_cmpint(_expected_len, ==, NM_PTRARRAY_LEN(_sec_strv));                        \
+            g_assert((_expected_len == 0) == (!_sec_strv));                                        \
+            g_assert(nm_utils_strv_equal(_expected, _sec_strv ?: NM_STRV_EMPTY()));                \
+        }                                                                                          \
+                                                                                                   \
+        g_assert_cmpint(nm_setting_connection_get_num_secondaries(_s_con), ==, _expected_len);     \
+        if (nmtst_get_rand_bool()) {                                                               \
+            for (_i = 0; _i < _expected_len; _i++) {                                               \
+                g_assert_cmpstr(nm_setting_connection_get_secondary(_s_con, _i),                   \
+                                ==,                                                                \
+                                _expected[_i]);                                                    \
+            }                                                                                      \
+            g_assert_null(nm_setting_connection_get_secondary(_s_con, _expected_len));             \
+        }                                                                                          \
+    }                                                                                              \
+    G_STMT_END
+
+        _assert_secondaries(s_con, (const char *const *) arr->pdata);
+
+        /* reimplement the normalization that we expect to happen and
+         * create an array @arr_norm with the expected result after normalization. */
+        arr_norm = g_ptr_array_new_with_free_func(g_free);
+        for (i_word = 0; i_word < word_len; i_word++) {
+            const char *s = arr->pdata[i_word];
+            gboolean    is_normalized;
+            char        uuid_normalized[37];
+
+            if (!nm_uuid_is_valid_nm(s, &is_normalized, uuid_normalized))
+                continue;
+
+            if (is_normalized)
+                s = uuid_normalized;
+
+            if (nm_utils_strv_find_first((char **) arr_norm->pdata, arr_norm->len, s) >= 0)
+                continue;
+
+            g_ptr_array_add(arr_norm, g_strdup(s));
+        }
+        g_ptr_array_add(arr_norm, NULL);
+
+        was_normalized = !nm_utils_strv_equal((char **) arr->pdata, (char **) arr_norm->pdata);
+
+        if (was_normalized)
+            nmtst_assert_connection_verifies_and_normalizable(con);
+        else
+            nmtst_assert_connection_verifies_without_normalization(con);
+
+        if (was_normalized || nmtst_get_rand_bool()) {
+            was_normalized2 = nmtst_connection_normalize(con);
+            g_assert(was_normalized == was_normalized2);
+        }
+
+        _assert_secondaries(s_con, (const char *const *) arr_norm->pdata);
+    }
+}
+
+/*****************************************************************************/
+
+NMTST_DEFINE();
+
+int
+main(int argc, char **argv)
+{
+    nmtst_init(&argc, &argv, TRUE);
+
+    g_test_add_func("/libnm/test_connection_uuid", test_connection_uuid);
+
+    g_test_add_func("/libnm/settings/test_nm_meta_setting_types_by_priority",
+                    test_nm_meta_setting_types_by_priority);
+
+    g_test_add_data_func("/libnm/setting-8021x/key-and-cert",
+                         "test_key_and_cert.pem, test",
+                         test_8021x);
+    g_test_add_data_func("/libnm/setting-8021x/key-only", "test-key-only.pem, test", test_8021x);
+    g_test_add_data_func("/libnm/setting-8021x/pkcs8-enc-key",
+                         "pkcs8-enc-key.pem, 1234567890",
+                         test_8021x);
+    g_test_add_data_func("/libnm/setting-8021x/pkcs12", "test-cert.p12, test", test_8021x);
+
+    g_test_add_func("/libnm/settings/test_setting_connection_secondaries_verify",
+                    test_setting_connection_secondaries_verify);
+
+    g_test_add_func("/libnm/settings/bond/verify", test_bond_verify);
+    g_test_add_func("/libnm/settings/bond/compare", test_bond_compare);
+    g_test_add_func("/libnm/settings/bond/normalize", test_bond_normalize);
+
+    g_test_add_func("/libnm/settings/dcb/flags-valid", test_dcb_flags_valid);
+    g_test_add_func("/libnm/settings/dcb/flags-invalid", test_dcb_flags_invalid);
+    g_test_add_func("/libnm/settings/dcb/app-priorities", test_dcb_app_priorities);
+    g_test_add_func("/libnm/settings/dcb/priorities", test_dcb_priorities_valid);
+    g_test_add_func("/libnm/settings/dcb/bandwidth-sums", test_dcb_bandwidth_sums);
+
+    g_test_add_func("/libnm/settings/ethtool/features", test_ethtool_features);
+    g_test_add_func("/libnm/settings/ethtool/coalesce", test_ethtool_coalesce);
+    g_test_add_func("/libnm/settings/ethtool/ring", test_ethtool_ring);
+    g_test_add_func("/libnm/settings/ethtool/pause", test_ethtool_pause);
+
+    g_test_add_func("/libnm/settings/sriov/vf", test_sriov_vf);
+    g_test_add_func("/libnm/settings/sriov/vf-dup", test_sriov_vf_dup);
+    g_test_add_func("/libnm/settings/sriov/vf-vlan", test_sriov_vf_vlan);
+    g_test_add_func("/libnm/settings/sriov/setting", test_sriov_setting);
+    g_test_add_func("/libnm/settings/sriov/vlans", test_sriov_parse_vlans);
+
+    g_test_add_func("/libnm/settings/tc_config/qdisc", test_tc_config_qdisc);
+    g_test_add_func("/libnm/settings/tc_config/action", test_tc_config_action);
+    g_test_add_func("/libnm/settings/tc_config/tfilter/matchall_sdata",
+                    test_tc_config_tfilter_matchall_sdata);
+    g_test_add_func("/libnm/settings/tc_config/tfilter/matchall_mirred",
+                    test_tc_config_tfilter_matchall_mirred);
+    g_test_add_func("/libnm/settings/tc_config/setting/valid", test_tc_config_setting_valid);
+    g_test_add_func("/libnm/settings/tc_config/setting/duplicates",
+                    test_tc_config_setting_duplicates);
+    g_test_add_func("/libnm/settings/tc_config/dbus", test_tc_config_dbus);
+
+    g_test_add_func("/libnm/settings/bridge/vlans", test_bridge_vlans);
+    g_test_add_func("/libnm/settings/bridge/verify", test_bridge_verify);
+
+    g_test_add_func("/libnm/test_nm_json", test_nm_json);
+    g_test_add_func("/libnm/settings/team/sync_runner_from_config_roundrobin",
+                    test_runner_roundrobin_sync_from_config);
+    g_test_add_func("/libnm/settings/team/sync_runner_from_config_broadcast",
+                    test_runner_broadcast_sync_from_config);
+    g_test_add_func("/libnm/settings/team/sync_runner_from_config_random",
+                    test_runner_random_sync_from_config);
+    g_test_add_func("/libnm/settings/team/sync_runner_from_config_activebackup",
+                    test_runner_activebackup_sync_from_config);
+    g_test_add_func("/libnm/settings/team/sync_runner_from_config_loadbalance",
+                    test_runner_loadbalance_sync_from_config);
+    g_test_add_func("/libnm/settings/team/sync_runner_from_config_lacp",
+                    test_runner_lacp_sync_from_config);
+    g_test_add_func("/libnm/settings/team/sync_watcher_from_config_ethtool",
+                    test_watcher_ethtool_sync_from_config);
+    g_test_add_func("/libnm/settings/team/sync_watcher_from_config_nsna_ping",
+                    test_watcher_nsna_ping_sync_from_config);
+    g_test_add_func("/libnm/settings/team/sync_watcher_from_config_arp_ping",
+                    test_watcher_arp_ping_sync_from_config);
+    g_test_add_func("/libnm/settings/team/sync_watcher_from_config_all",
+                    test_multiple_watchers_sync_from_config);
+
+    g_test_add_func("/libnm/settings/team-port/sync_from_config_defaults", test_team_port_default);
+    g_test_add_func("/libnm/settings/team-port/sync_from_config_queue_id", test_team_port_queue_id);
+    g_test_add_func("/libnm/settings/team-port/sync_from_config_prio", test_team_port_prio);
+    g_test_add_func("/libnm/settings/team-port/sync_from_config_sticky", test_team_port_sticky);
+    g_test_add_func("/libnm/settings/team-port/sync_from_config_lacp_prio",
+                    test_team_port_lacp_prio);
+    g_test_add_func("/libnm/settings/team-port/sync_from_config_lacp_key", test_team_port_lacp_key);
+    g_test_add_func("/libnm/settings/team-port/sycn_from_config_full", test_team_port_full_config);
+
+    g_test_add_data_func("/libnm/settings/roundtrip-conversion/general/0",
+                         GINT_TO_POINTER(0),
+                         test_roundtrip_conversion);
+    g_test_add_data_func("/libnm/settings/roundtrip-conversion/wireguard/1",
+                         GINT_TO_POINTER(1),
+                         test_roundtrip_conversion);
+    g_test_add_data_func("/libnm/settings/roundtrip-conversion/wireguard/2",
+                         GINT_TO_POINTER(2),
+                         test_roundtrip_conversion);
+    g_test_add_data_func("/libnm/settings/roundtrip-conversion/general/3",
+                         GINT_TO_POINTER(3),
+                         test_roundtrip_conversion);
+
+    g_test_add_data_func("/libnm/settings/routing-rule/1", GINT_TO_POINTER(0), test_routing_rule);
+
+    g_test_add_func("/libnm/parse-tc-handle", test_parse_tc_handle);
+
+    g_test_add_func("/libnm/test_team_setting", test_team_setting);
+
+    g_test_add_func("/libnm/test_empty_setting", test_empty_setting);
+
+    g_test_add_func("/libnm/test_setting_metadata", test_setting_metadata);
+
+    return g_test_run();
+}
diff --git a/src/libnm-core-impl/tests/test-settings-defaults.c b/src/libnm-core-impl/tests/test-settings-defaults.c
new file mode 100644
index 00000000..b9db7107
--- /dev/null
+++ b/src/libnm-core-impl/tests/test-settings-defaults.c
@@ -0,0 +1,109 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Copyright (C) 2008 - 2011 Red Hat, Inc.
+ */
+
+#include "libnm-core-impl/nm-default-libnm-core.h"
+
+#include "nm-utils.h"
+#include "nm-setting-8021x.h"
+#include "nm-setting-cdma.h"
+#include "nm-setting-connection.h"
+#include "nm-setting-gsm.h"
+#include "nm-setting-ip4-config.h"
+#include "nm-setting-ip6-config.h"
+#include "nm-setting-ppp.h"
+#include "nm-setting-pppoe.h"
+#include "nm-setting-serial.h"
+#include "nm-setting-vpn.h"
+#include "nm-setting-wired.h"
+#include "nm-setting-wireless.h"
+#include "nm-setting-wireless-security.h"
+
+#include "libnm-glib-aux/nm-test-utils.h"
+
+static void
+test_defaults(GType type, const char *name)
+{
+    GParamSpec **property_specs;
+    guint        n_property_specs;
+    GObject *    setting;
+    int          i;
+
+    setting = g_object_new(type, NULL);
+
+    property_specs = g_object_class_list_properties(G_OBJECT_GET_CLASS(setting), &n_property_specs);
+    g_assert(property_specs);
+
+    for (i = 0; i < n_property_specs; i++) {
+        GParamSpec *prop_spec = property_specs[i];
+        GValue      value     = G_VALUE_INIT;
+        GValue      defvalue  = G_VALUE_INIT;
+        char *      actual, *expected;
+        gboolean    ok = FALSE;
+
+        /* Ignore non-fundamental types since they won't really have
+         * defaults.
+         */
+        if (!G_TYPE_IS_FUNDAMENTAL(prop_spec->value_type))
+            continue;
+
+        g_value_init(&value, prop_spec->value_type);
+        g_object_get_property(G_OBJECT(setting), prop_spec->name, &value);
+
+        g_value_init(&defvalue, prop_spec->value_type);
+        g_param_value_set_default(prop_spec, &defvalue);
+
+        actual   = g_strdup_value_contents(&value);
+        expected = g_strdup_value_contents(&defvalue);
+
+        if (!strcmp(prop_spec->name, NM_SETTING_NAME)) {
+            /* 'name' is always the setting name, not the default value */
+            ok = !strcmp(nm_setting_get_name(NM_SETTING(setting)), name);
+            g_free(expected);
+            expected = g_strdup(name);
+        } else
+            ok = g_param_value_defaults(prop_spec, &value);
+
+        g_assert(ok);
+
+        g_free(actual);
+        g_free(expected);
+        g_value_unset(&value);
+        g_value_unset(&defvalue);
+    }
+
+    g_free(property_specs);
+    g_object_unref(setting);
+}
+
+static void
+defaults(void)
+{
+    /* The tests */
+    test_defaults(NM_TYPE_SETTING_CONNECTION, NM_SETTING_CONNECTION_SETTING_NAME);
+    test_defaults(NM_TYPE_SETTING_802_1X, NM_SETTING_802_1X_SETTING_NAME);
+    test_defaults(NM_TYPE_SETTING_CDMA, NM_SETTING_CDMA_SETTING_NAME);
+    test_defaults(NM_TYPE_SETTING_GSM, NM_SETTING_GSM_SETTING_NAME);
+    test_defaults(NM_TYPE_SETTING_IP4_CONFIG, NM_SETTING_IP4_CONFIG_SETTING_NAME);
+    test_defaults(NM_TYPE_SETTING_IP6_CONFIG, NM_SETTING_IP6_CONFIG_SETTING_NAME);
+    test_defaults(NM_TYPE_SETTING_PPP, NM_SETTING_PPP_SETTING_NAME);
+    test_defaults(NM_TYPE_SETTING_PPPOE, NM_SETTING_PPPOE_SETTING_NAME);
+    test_defaults(NM_TYPE_SETTING_SERIAL, NM_SETTING_SERIAL_SETTING_NAME);
+    test_defaults(NM_TYPE_SETTING_VPN, NM_SETTING_VPN_SETTING_NAME);
+    test_defaults(NM_TYPE_SETTING_WIRED, NM_SETTING_WIRED_SETTING_NAME);
+    test_defaults(NM_TYPE_SETTING_WIRELESS, NM_SETTING_WIRELESS_SETTING_NAME);
+    test_defaults(NM_TYPE_SETTING_WIRELESS_SECURITY, NM_SETTING_WIRELESS_SECURITY_SETTING_NAME);
+}
+
+NMTST_DEFINE();
+
+int
+main(int argc, char **argv)
+{
+    nmtst_init(&argc, &argv, TRUE);
+
+    g_test_add_func("/libnm/defaults", defaults);
+
+    return g_test_run();
+}