release: bump version to 1.27.1 (development)1.27.1-dev

66 files changed, 493 insertions, 275 deletions

diff --git a/src/NetworkManagerUtils.c b/src/NetworkManagerUtils.c
index bcb12a564d..7eaffb7dfc 100644
--- a/src/NetworkManagerUtils.c
+++ b/src/NetworkManagerUtils.c
@@ -96,7 +96,7 @@ get_new_connection_name (NMConnection *const*existing_connections,
 	if (preferred)
 		return g_strdup (preferred);
 
-	/* Otherwise find the next available unique connection name using the given
+	/* Otherwise, find the next available unique connection name using the given
 	 * connection name template.
 	 */
 	for (i = 1; TRUE; i++) {
@@ -1096,7 +1096,7 @@ nm_shutdown_wait_obj_unregister (NMShutdownWaitObjHandle *handle)
  * clearly a directory).
  *
  * Returns: if @abs_filename is a file inside @abs_path, returns the
- *   trailing part of @abs_filename which is the filename. Otherwise
+ *   trailing part of @abs_filename which is the filename. Otherwise,
  *   %NULL.
  */
 const char *
diff --git a/src/devices/bluetooth/nm-bluez-manager.c b/src/devices/bluetooth/nm-bluez-manager.c
index 0bbac4c435..ad6187140c 100644
--- a/src/devices/bluetooth/nm-bluez-manager.c
+++ b/src/devices/bluetooth/nm-bluez-manager.c
@@ -935,7 +935,7 @@ _conn_track_update (NMBluezManager *self,
 	}
 
 	if (!cdata_el) {
-		_LOGT ("connecton: track for %s, %s: %s (%s)",
+		_LOGT ("connection: track for %s, %s: %s (%s)",
 		       nm_bluetooth_capability_to_string (bt_type, sbuf_cap, sizeof (sbuf_cap)),
 		       bdaddr,
 		       nm_settings_connection_get_uuid (sett_conn),
@@ -962,7 +962,7 @@ out_remove:
 		GHashTableIter iter;
 		BzDBusObj *bzobj;
 
-		_LOGT ("connecton: untrack for %s, %s: %s (%s)",
+		_LOGT ("connection: untrack for %s, %s: %s (%s)",
 		       nm_bluetooth_capability_to_string (cdata_el_remove->cdata_hd->bt_type, sbuf_cap, sizeof (sbuf_cap)),
 		       cdata_el_remove->cdata_hd->bdaddr,
 		       nm_settings_connection_get_uuid (sett_conn),
@@ -1564,7 +1564,7 @@ _process_change_idle_cb (gpointer user_data)
 	_process_change_idle_all (self, &emit_device_availability_changed);
 
 	if (emit_device_availability_changed)
-		nm_manager_notify_device_availibility_maybe_changed (priv->manager);
+		nm_manager_notify_device_availability_maybe_changed (priv->manager);
 
 	return G_SOURCE_CONTINUE;
 }
@@ -2232,7 +2232,7 @@ _cleanup_for_name_owner (NMBluezManager *self)
 	nm_assert (g_hash_table_size (priv->bzobjs) == 0);
 
 	if (emit_device_availability_changed)
-		nm_manager_notify_device_availibility_maybe_changed (priv->manager);
+		nm_manager_notify_device_availability_maybe_changed (priv->manager);
 }
 
 static void
@@ -2481,7 +2481,7 @@ _connect_dun_step2_cb (NMBluez5DunContext *context,
 	bzobj = user_data;
 
 	if (rfcomm_dev) {
-		/* We want to early notifiy about the rfcomm path. That is because we might still delay
+		/* We want to early notify about the rfcomm path. That is because we might still delay
 		 * to signal full activation longer (asynchronously). But the earliest time the callback
 		 * is invoked with the rfcomm path, we just created the device synchronously.
 		 *
diff --git a/src/devices/bluetooth/nm-bluez5-dun.c b/src/devices/bluetooth/nm-bluez5-dun.c
index c253d4e28d..11f3b85784 100644
--- a/src/devices/bluetooth/nm-bluez5-dun.c
+++ b/src/devices/bluetooth/nm-bluez5-dun.c
@@ -256,7 +256,7 @@ _connect_create_rfcomm (NMBluez5DunContext *context)
 		 * not yet fully connected. However, we notify the caller about "what we learned
 		 * so far". Note that this happens synchronously.
 		 *
-		 * The purpose is that once we proceed synchrnously, modem-manager races with
+		 * The purpose is that once we proceed synchronously, modem-manager races with
 		 * the detection of the modem. We want to notify the caller first about the
 		 * device name. */
 		context->cdat->callback (NULL,
diff --git a/src/devices/bluetooth/nm-device-bt.c b/src/devices/bluetooth/nm-device-bt.c
index a02ce34fec..9ab3810f68 100644
--- a/src/devices/bluetooth/nm-device-bt.c
+++ b/src/devices/bluetooth/nm-device-bt.c
@@ -892,7 +892,7 @@ connect_bz_cb (NMBluezManager *bz_mgr,
 	}
 
 	if (!priv->is_connected) {
-		/* we got the callback from NMBluezManager with succes. We actually should be
+		/* we got the callback from NMBluezManager with success. We actually should be
 		 * connected and this line shouldn't be reached. */
 		nm_assert_not_reached ();
 		_LOGE (LOGD_BT, "bluetooth is unexpectedly not in connected state");
diff --git a/src/devices/nm-device-ethernet.c b/src/devices/nm-device-ethernet.c
index 9e7601f005..9d8207f73d 100644
--- a/src/devices/nm-device-ethernet.c
+++ b/src/devices/nm-device-ethernet.c
@@ -1007,10 +1007,10 @@ act_stage1_prepare (NMDevice *device, NMDeviceStateReason *out_failure_reason)
 
 	/* If we're re-activating a PPPoE connection a short while after
 	 * a previous PPPoE connection was torn down, wait a bit to allow the
-	 * remote side to handle the disconnection.  Otherwise the peer may
+	 * remote side to handle the disconnection.  Otherwise, the peer may
 	 * get confused and fail to negotiate the new connection. (rh #1023503)
 	 *
-	 * FIXME(shutdown): when exiting, we also need to wait before quiting,
+	 * FIXME(shutdown): when exiting, we also need to wait before quitting,
 	 * at least for additional NM_SHUTDOWN_TIMEOUT_MS seconds because
 	 * otherwise after restart the device won't work for the first seconds.
 	 */
diff --git a/src/devices/nm-device-factory.h b/src/devices/nm-device-factory.h
index 7a323d49b7..e044534dc3 100644
--- a/src/devices/nm-device-factory.h
+++ b/src/devices/nm-device-factory.h
@@ -72,7 +72,7 @@ typedef struct {
 	 * UUID, or parent device permanent hardware address for @connection.
 	 *
 	 * Returns: the parent interface name, parent connection UUID, parent
-	 *   device permenent hardware address, or %NULL
+	 *   device permanent hardware address, or %NULL
 	 */
 	const char * (*get_connection_parent) (NMDeviceFactory *factory,
 	                                       NMConnection *connection);
diff --git a/src/devices/nm-device-wireguard.c b/src/devices/nm-device-wireguard.c
index 9f01a76323..d6c6cb78e0 100644
--- a/src/devices/nm-device-wireguard.c
+++ b/src/devices/nm-device-wireguard.c
@@ -32,9 +32,9 @@ _LOG_DECLARE_SELF(NMDeviceWireGuard);
  *   prompt, as the secret is cached (good??). */
 
 /* TODO: unlike for other VPNs, we don't inject a direct route to the peers. That means,
- *   you might get a routing sceneraio where the peer (VPN server) is reachable via the VPN.
+ *   you might get a routing scenario where the peer (VPN server) is reachable via the VPN.
  *   How we handle adding routes to external gateway for other peers, has severe issues
- *   as well. We may use policy-routing like wg-quick does. See also disussions at
+ *   as well. We may use policy-routing like wg-quick does. See also discussions at
  *   https://www.wireguard.com/netns/#improving-the-classic-solutions */
 
 /* TODO: honor the TTL of DNS to determine when to retry resolving endpoints. */
@@ -62,7 +62,7 @@ G_STATIC_ASSERT (NM_WIREGUARD_SYMMETRIC_KEY_LEN == NMP_WIREGUARD_SYMMETRIC_KEY_L
 #define NEXT_TRY_AT_NSEC_PAST ((gint64) 1)
 
 /* like %NEXT_TRY_AT_NSEC_ASAP, but used for indicating to retry ASAP for a @retry_in_msec value.
- * That is a relative time duraction, contrary to @next_try_at_nsec which is an absolute
+ * That is a relative time duration, contrary to @next_try_at_nsec which is an absolute
  * timestamp. */
 #define RETRY_IN_MSEC_ASAP ((gint64) G_MAXINT64)
 
@@ -289,7 +289,7 @@ _auto_default_route_get_auto_priority (const char *uuid)
 	 * - use the connection's UUID as stable seed for the "random" number.
 	 * - have it smaller than RANGE_TOP (32766u - 1000u), where 32766u is the priority of the default
 	 *   rules
-	 * - we add 2 rules (PRIO_WIDTH). Hence only pick even priorites.
+	 * - we add 2 rules (PRIO_WIDTH). Hence only pick even priorities.
 	 * - pick one out of AUTO_RANDOM_RANGE. */
 
 	rnd_seed = c_siphash_hash (NM_HASH_SEED_16 (0x99, 0x22, 0x4d, 0x7c, 0x37, 0xda, 0x8e, 0x7b, 0x2f, 0x55, 0x16, 0x7b, 0x75, 0xda, 0x42, 0xdc),
diff --git a/src/devices/nm-device.c b/src/devices/nm-device.c
index de09e48072..9c8b593993 100644
--- a/src/devices/nm-device.c
+++ b/src/devices/nm-device.c
@@ -2225,7 +2225,7 @@ _stats_refresh_rate_real (guint refresh_rate_ms)
 		return 0;
 
 	if (refresh_rate_ms < STATS_REFRESH_RATE_MS_MIN) {
-		/* you cannot set the refresh-rate arbitrarly small. E.g.
+		/* you cannot set the refresh-rate arbitrarily small. E.g.
 		 * setting to 1ms is just killing. Have a lowest number. */
 		return STATS_REFRESH_RATE_MS_MIN;
 	}
@@ -3296,7 +3296,7 @@ concheck_update_state (NMDevice *self,
 		/* If the connectivity check is disabled and we obtain a fake
 		 * result, make an optimistic guess. */
 		if (priv->state == NM_DEVICE_STATE_ACTIVATED) {
-			/* FIXME: the fake connectivity state depends on the availablility of
+			/* FIXME: the fake connectivity state depends on the availability of
 			 * a default route. However, we have no mechanism that rechecks the
 			 * value if a device route appears/disappears after the device
 			 * was activated. */
@@ -3309,7 +3309,7 @@ concheck_update_state (NMDevice *self,
 	}
 
 	if (priv->concheck_x[IS_IPv4].state == state) {
-		/* we got a connectivty update, but the state didn't change. If we were probing,
+		/* we got a connectivity update, but the state didn't change. If we were probing,
 		 * we bump the probe frequency. */
 		if (allow_periodic_bump)
 			concheck_periodic_schedule_set (self, addr_family, CONCHECK_SCHEDULE_RETURNED_BUMP);
@@ -5052,7 +5052,7 @@ realize_start_setup (NMDevice *self,
 	                               is_unmanaged_external_down (self, TRUE));
 
 	/* Unmanaged the loopback device with an explicit NM_UNMANAGED_BY_TYPE flag.
-	 * Later we might want to manage 'lo' too. Currently that doesn't work because
+	 * Later we might want to manage 'lo' too. Currently, that doesn't work because
 	 * NetworkManager might down the interface or remove the 127.0.0.1 address. */
 	nm_device_set_unmanaged_flags (self,
 	                               NM_UNMANAGED_BY_TYPE,
@@ -5543,7 +5543,7 @@ nm_device_is_master (NMDevice *self)
  * @self: the device
  *
  * If @self has been enslaved by another device, this returns that
- * device. Otherwise it returns %NULL. (In particular, note that if
+ * device. Otherwise, it returns %NULL. (In particular, note that if
  * @self is in the process of activating as a slave, but has not yet
  * been enslaved by its master, this will return %NULL.)
  *
@@ -8930,7 +8930,7 @@ connection_requires_carrier (NMConnection *connection)
 	gboolean ip4_used = FALSE, ip6_used = FALSE;
 
 	/* We can progress to IP_CONFIG now, so that we're enslaved.
-	 * That may actually cause carrier to go up and thus continue acivation. */
+	 * That may actually cause carrier to go up and thus continue activation. */
 	s_con = nm_connection_get_setting_connection (connection);
 	if (nm_setting_connection_get_master (s_con))
 		return FALSE;
@@ -14928,7 +14928,7 @@ nm_device_update_metered (NMDevice *self)
 			value = NM_METERED_GUESS_YES;
 	}
 
-	/* Otherwise look at connection type. For Bluetooth, we look at the type of
+	/* Otherwise, look at connection type. For Bluetooth, we look at the type of
 	 * Bluetooth sharing: for PANU/DUN (where we are receiving internet from
 	 * another device) we set GUESS_YES; for NAP (where we are sharing internet
 	 * to another device) we set GUESS_NO. We ignore WiMAX here as it’s no
@@ -18428,6 +18428,7 @@ nm_device_class_init (NMDeviceClass *klass)
 /* Connection defaults from plugins */
 NM_CON_DEFAULT_NOP ("cdma.mtu");
 NM_CON_DEFAULT_NOP ("gsm.mtu");
+NM_CON_DEFAULT_NOP ("wifi.ap-isolation");
 NM_CON_DEFAULT_NOP ("wifi.powersave");
 NM_CON_DEFAULT_NOP ("wifi.wake-on-wlan");
 NM_CON_DEFAULT_NOP ("wifi-sec.pmf");
diff --git a/src/devices/ovs/nm-ovsdb.c b/src/devices/ovs/nm-ovsdb.c
index 0b3fa3fdb5..f162a49659 100644
--- a/src/devices/ovs/nm-ovsdb.c
+++ b/src/devices/ovs/nm-ovsdb.c
@@ -1052,7 +1052,7 @@ ovsdb_got_update (NMOvsdb *self, json_t *msg)
 				       ovs_interface->connection_uuid ? ", " : "",
 				       ovs_interface->connection_uuid ?: "");
 				if (g_strcmp0 (ovs_interface->type, "internal") == 0) {
-					/* Currently the factory only creates NMDevices for
+					/* Currently, the factory only creates NMDevices for
 					 * internal interfaces. Ignore the rest. */
 					g_signal_emit (self, signals[DEVICE_REMOVED], 0,
 					               ovs_interface->name, NM_DEVICE_TYPE_OVS_INTERFACE);
@@ -1077,7 +1077,7 @@ ovsdb_got_update (NMOvsdb *self, json_t *msg)
 				       ovs_interface->connection_uuid ? ", " : "",
 				       ovs_interface->connection_uuid ?: "");
 				if (g_strcmp0 (ovs_interface->type, "internal") == 0) {
-					/* Currently the factory only creates NMDevices for
+					/* Currently, the factory only creates NMDevices for
 					 * internal interfaces. Ignore the rest. */
 					g_signal_emit (self, signals[DEVICE_ADDED], 0,
 					               ovs_interface->name, NM_DEVICE_TYPE_OVS_INTERFACE);
@@ -1220,7 +1220,7 @@ ovsdb_got_echo (NMOvsdb *self, json_int_t id, json_t *data)
 /**
  * ovsdb_got_msg::
  *
- * Called when when a complete JSON object was seen and unmarshalled.
+ * Called when a complete JSON object was seen and unmarshalled.
  * Either finishes a method call or processes a method call.
  */
 static void
diff --git a/src/devices/wifi/nm-device-iwd.c b/src/devices/wifi/nm-device-iwd.c
index 4b57fa380b..83d2680c6d 100644
--- a/src/devices/wifi/nm-device-iwd.c
+++ b/src/devices/wifi/nm-device-iwd.c
@@ -1110,7 +1110,7 @@ check_scanning_prohibited (NMDeviceIwd *self, gboolean periodic)
  *
  * Check if the connection settings already have the secrets corresponding
  * to the IWD agent method that was invoked.  If they do, send the method reply
- * with the appropriate secrets.  Otherwise return the missing secret's setting
+ * with the appropriate secrets.  Otherwise, return the missing secret's setting
  * name and key so the caller can send a NM secrets request with this data.
  * Return TRUE in either case, return FALSE if an error is detected.
  */
@@ -1922,7 +1922,7 @@ schedule_periodic_scan (NMDeviceIwd *self, gboolean initial_scan)
 	 * (initial_scan && disconnected) override priv->scanning below
 	 * because of an IWD quirk where a device will often be in the
 	 * autoconnect state and scanning at the time of our initial_scan,
-	 * but our logic will the send it a Disconnect() causeing IWD to
+	 * but our logic will the send it a Disconnect() causing IWD to
 	 * exit autoconnect and interrupt the ongoing scan, meaning that
 	 * we still want a new scan ASAP.
 	 */
@@ -2140,7 +2140,7 @@ state_changed (NMDeviceIwd *self, const char *new_state)
 	if (NM_IN_STRSET (new_state, "connecting", "connected", "roaming")) {
 		/* If we were connecting, do nothing, the confirmation of
 		 * a connection success is handled in the Device.Connect
-		 * method return callback.  Otherwise IWD must have connected
+		 * method return callback.  Otherwise, IWD must have connected
 		 * without Network Manager's will so for simplicity force a
 		 * disconnect.
 		 */
diff --git a/src/devices/wifi/nm-device-wifi.c b/src/devices/wifi/nm-device-wifi.c
index 2d97f9b117..d6de33308a 100644
--- a/src/devices/wifi/nm-device-wifi.c
+++ b/src/devices/wifi/nm-device-wifi.c
@@ -2460,7 +2460,7 @@ supplicant_iface_state (NMDeviceWifi *self,
 				break;
 		}
 
-		/* Otherwise it might be a stupid driver or some transient error, so
+		/* Otherwise, it might be a stupid driver or some transient error, so
 		 * let the supplicant try to reconnect a few more times.  Give it more
 		 * time if a scan is in progress since the link might be dropped during
 		 * the scan but will be re-established when the scan is done.
@@ -2564,6 +2564,15 @@ supplicant_iface_notify_current_bss (NMSupplicantInterface *iface,
 		       new_bssid ?: "(none)",
 		       (new_ssid_s = _nm_utils_ssid_to_string (new_ssid)));
 
+		if (new_bssid) {
+			/* The new AP could be in a different layer 3 network
+			 * and so the old DHCP lease could be no longer valid.
+			 * Also, some APs (e.g. Cisco) can be configured to drop
+			 * all traffic until DHCP completes. To support such
+			 * cases, renew the lease when roaming to a new AP. */
+			nm_device_update_dynamic_ip_setup (NM_DEVICE (self));
+		}
+
 		set_current_ap (self, new_ap, TRUE);
 	}
 }
@@ -2801,6 +2810,7 @@ build_supplicant_config (NMDeviceWifi *self,
 	NMSettingWirelessSecurity *s_wireless_sec;
 	NMSettingWirelessSecurityPmf pmf;
 	NMSettingWirelessSecurityFils fils;
+	NMTernary ap_isolation;
 
 	g_return_val_if_fail (priv->sup_iface, NULL);
 
@@ -2828,6 +2838,17 @@ build_supplicant_config (NMDeviceWifi *self,
 		goto error;
 	}
 
+	ap_isolation = nm_setting_wireless_get_ap_isolation (s_wireless);
+	if (ap_isolation == NM_TERNARY_DEFAULT) {
+		ap_isolation = nm_config_data_get_connection_default_int64 (NM_CONFIG_GET_DATA,
+		                                                            "wifi.ap-isolation",
+		                                                            NM_DEVICE (self),
+		                                                            NM_TERNARY_FALSE,
+		                                                            NM_TERNARY_TRUE,
+		                                                            NM_TERNARY_FALSE);
+	}
+	nm_supplicant_config_set_ap_isolation (config, ap_isolation == NM_TERNARY_TRUE);
+
 	s_wireless_sec = nm_connection_get_setting_wireless_security (connection);
 	if (s_wireless_sec) {
 		NMSetting8021x *s_8021x;
diff --git a/src/dhcp/nm-dhcp-client.c b/src/dhcp/nm-dhcp-client.c
index f7324baf6e..1a41f1b343 100644
--- a/src/dhcp/nm-dhcp-client.c
+++ b/src/dhcp/nm-dhcp-client.c
@@ -824,7 +824,7 @@ maybe_add_option (NMDhcpClient *self,
 
 		/* dhclient has no special labels for private dhcp options: it uses "unknown_xyz"
 		 * labels for that. We need to identify those to alias them to our "private_xyz"
-		 * format unsed in the internal dchp plugins.
+		 * format unused in the internal dchp plugins.
 		 */
 		if ((priv_opt_num = label_is_unknown_xyz (key)) > 0) {
 			gs_free guint8 *check_val = NULL;
diff --git a/src/dhcp/nm-dhcp-dhclient-utils.c b/src/dhcp/nm-dhcp-dhclient-utils.c
index 76fc1a898d..1bd8d0ee71 100644
--- a/src/dhcp/nm-dhcp-dhclient-utils.c
+++ b/src/dhcp/nm-dhcp-dhclient-utils.c
@@ -404,7 +404,7 @@ nm_dhcp_dhclient_create_config (const char *interface,
 				if (client_id)
 					continue;
 
-				/* Otherwise capture and return the existing client id */
+				/* Otherwise, capture and return the existing client id */
 				if (out_new_client_id)
 					nm_clear_pointer (out_new_client_id, g_bytes_unref);
 				NM_SET_OUT (out_new_client_id, read_client_id (p));
diff --git a/src/dhcp/nm-dhcp-dhclient.c b/src/dhcp/nm-dhcp-dhclient.c
index 4ad056e548..ad8fc57bb1 100644
--- a/src/dhcp/nm-dhcp-dhclient.c
+++ b/src/dhcp/nm-dhcp-dhclient.c
@@ -627,7 +627,7 @@ get_duid (NMDhcpClient *client)
 			return duid;
 	}
 
-	/* Otherwise read the default machine-wide DUID */
+	/* Otherwise, read the default machine-wide DUID */
 	_LOGD ("looking for default DUID in '%s'", priv->def_leasefile);
 	duid = nm_dhcp_dhclient_read_duid (priv->def_leasefile, &error);
 	if (error) {
diff --git a/src/dhcp/nm-dhcp-manager.c b/src/dhcp/nm-dhcp-manager.c
index 7565bfc8c6..ec89377eec 100644
--- a/src/dhcp/nm-dhcp-manager.c
+++ b/src/dhcp/nm-dhcp-manager.c
@@ -94,7 +94,7 @@ _client_factory_get_gtype (const NMDhcpClientFactory *client_factory,
 	 * Supporting reloading the plugin would also require to re-evalate the decisions from
 	 * the "Device List Format". Likewise, having per-address family plugins would make the
 	 * "main.dhcp" setting and "dhcp-plugin:" match non-sensical because these configurations
-	 * currently are address family independet.
+	 * currently are address family independent.
 	 *
 	 * So actually, we don't want that complexity. We want to phase out all plugins in favor
 	 * of the internal plugin.
diff --git a/src/dhcp/nm-dhcp-nettools.c b/src/dhcp/nm-dhcp-nettools.c
index fe6a4582b8..a8127236c7 100644
--- a/src/dhcp/nm-dhcp-nettools.c
+++ b/src/dhcp/nm-dhcp-nettools.c
@@ -1304,7 +1304,7 @@ ip4_start (NMDhcpClient *client,
 
 	/*
 	 * FIXME:
-	 * Select, or configure, a reasonable start delay, to protect poor servers beeing flooded.
+	 * Select, or configure, a reasonable start delay, to protect poor servers being flooded.
 	 */
 	n_dhcp4_client_probe_config_set_start_delay (config, 1);
 
diff --git a/src/dns/nm-dns-dnsmasq.c b/src/dns/nm-dns-dnsmasq.c
index fdff3af16f..ccdb8baaf8 100644
--- a/src/dns/nm-dns-dnsmasq.c
+++ b/src/dns/nm-dns-dnsmasq.c
@@ -268,7 +268,7 @@ _gl_pid_spawn_register_for_termination (void)
 {
 	if (   gl_pid.pid > 0
 	    && !gl_pid.terminate_handle) {
-		/* Create a shtudown handle as a reminder that the currently running process must be terminated
+		/* Create a shutdown handle as a reminder that the currently running process must be terminated
 		 * first. This also happens to block shutdown... */
 		gl_pid.terminate_handle = nm_shutdown_wait_obj_register_handle_full (g_strdup_printf ("kill-dnsmasq-process-%"G_PID_FORMAT, gl_pid.pid), TRUE);
 	}
@@ -287,7 +287,7 @@ _gl_pid_spawn_register_for_termination (void)
  * for two purposes:
  *
  *  - signal that the dnsmasq process was spawned (or failed to be spawned).
- *  - signal that the dnsmasq process quit (if it was spawned sucessfully before).
+ *  - signal that the dnsmasq process quit (if it was spawned successfully before).
  *
  * Depending on the arguments, the callee can see what's the case.
  */
@@ -540,7 +540,7 @@ _gl_pid_spawn_next_step (void)
  * @dm_binary: the binary name for dnsmasq to spawn. We could
  *   detect it ad-hoc right when needing it. But that would be
  *   asynchronously, and if dnsmasq is not in $PATH, we want to
- *   fail right away (synchrounously). Hence, @dm_binary is
+ *   fail right away (synchronously). Hence, @dm_binary is
  *   an argument.
  * @cancellable: abort the operation. This will invoke the callback
  *   a last time. Also, if the dnsmasq process is currently running,
diff --git a/src/dns/nm-dns-manager.c b/src/dns/nm-dns-manager.c
index 666bad60ca..355d2ee445 100644
--- a/src/dns/nm-dns-manager.c
+++ b/src/dns/nm-dns-manager.c
@@ -625,7 +625,7 @@ create_resolv_conf (const char *const*searches,
 
 			if (search_base_idx > 0) {
 				if (str->len - search_base_idx + 1 + l > 254) {
-					/* this entry crosses the 256 character boundery. Older glibc versions
+					/* this entry crosses the 256 character boundary. Older glibc versions
 					 * would truncate the entry at this point.
 					 *
 					 * Fill the line with spaces to cross the 256 char boundary and continue
@@ -977,7 +977,7 @@ update_resolv_conf (NMDnsManager *self,
 		             RESOLV_CONF_TMP,
 		             nm_strerror_native (errsv));
 		_LOGT ("update-resolv-conf: write internal file %s succeeded "
-		       "but canot delete temporary file %s: %s",
+		       "but cannot delete temporary file %s: %s",
 		       MY_RESOLV_CONF, RESOLV_CONF_TMP, nm_strerror_native (errsv));
 		return SR_ERROR;
 	}
diff --git a/src/dnsmasq/nm-dnsmasq-utils.c b/src/dnsmasq/nm-dnsmasq-utils.c
index 2373b4220b..4f449cb99e 100644
--- a/src/dnsmasq/nm-dnsmasq-utils.c
+++ b/src/dnsmasq/nm-dnsmasq-utils.c
@@ -42,7 +42,7 @@ nm_dnsmasq_utils_get_range (const NMPlatformIP4Address *addr,
 		 *
 		 * In this case, only a /24 portion of the subnet is used.
 		 * No particular reason for that, but it's unlikely that a user
-		 * would use NetworkManager's shared method when having hundered
+		 * would use NetworkManager's shared method when having hundred
 		 * of DHCP clients. So, restrict the range to the same /24 in
 		 * which the host address lies.
 		 */
diff --git a/src/ndisc/nm-lndp-ndisc.c b/src/ndisc/nm-lndp-ndisc.c
index b10adc91f3..25666c2e45 100644
--- a/src/ndisc/nm-lndp-ndisc.c
+++ b/src/ndisc/nm-lndp-ndisc.c
@@ -122,7 +122,7 @@ receive_ra (struct ndp *ndp, struct ndp_msg *msg, gpointer user_data)
 	/* DHCP level:
 	 *
 	 * The problem with DHCP level is what to do if subsequent
-	 * router advertisements carry different flags. Currently we just
+	 * router advertisements carry different flags. Currently, we just
 	 * rewrite the flag with every inbound RA.
 	 */
 	{
diff --git a/src/ndisc/tests/test-ndisc-fake.c b/src/ndisc/tests/test-ndisc-fake.c
index b65511e01e..254110e4c7 100644
--- a/src/ndisc/tests/test-ndisc-fake.c
+++ b/src/ndisc/tests/test-ndisc-fake.c
@@ -61,8 +61,8 @@ match_gateway (const NMNDiscData *rdata, guint idx, const char *addr, guint32 ts
 		_a = &_rdata->addresses[_idx]; \
 		\
 		nmtst_assert_ip6_address (&_a->address, (addr)); \
-		g_assert_cmpint (_a->timestamp, >=, _ts); \
 		g_assert_cmpint (_a->timestamp, <=, _ts + 1); \
+		g_assert_cmpint ((int) _a->timestamp, >=, (int) _ts - 1); \
 		g_assert_cmpint (_a->timestamp + _a->lifetime, ==, _ts + (lt)); \
 		g_assert_cmpint (_a->timestamp + _a->preferred, ==, _ts + (pref)); \
 	} G_STMT_END
diff --git a/src/nm-act-request.c b/src/nm-act-request.c
index 1c252052bb..9398cd0d4a 100644
--- a/src/nm-act-request.c
+++ b/src/nm-act-request.c
@@ -135,7 +135,7 @@ get_secrets_cb (NMSettingsConnection *connection,
  * @callback:
  * @callback_data:
  *
- * Asnychronously starts the request for secrets. This function cannot
+ * Asynchronously starts the request for secrets. This function cannot
  * fail.
  *
  * The return call-id can be used to cancel the request. You are
diff --git a/src/nm-active-connection.c b/src/nm-active-connection.c
index 08037ebe71..a559cda23b 100644
--- a/src/nm-active-connection.c
+++ b/src/nm-active-connection.c
@@ -751,7 +751,7 @@ nm_active_connection_get_master (NMActiveConnection *self)
  * @self: the #NMActiveConnection
  *
  * Returns: %TRUE if the connection has a master connection, and that
- * master connection is ready to accept slaves.  Otherwise %FALSE.
+ * master connection is ready to accept slaves.  Otherwise, %FALSE.
  */
 gboolean
 nm_active_connection_get_master_ready (NMActiveConnection *self)
diff --git a/src/nm-auth-utils.c b/src/nm-auth-utils.c
index b9efff4805..d4728a7f33 100644
--- a/src/nm-auth-utils.c
+++ b/src/nm-auth-utils.c
@@ -280,7 +280,7 @@ nm_auth_chain_set_data_unsafe (NMAuthChain *self,
 	g_return_if_fail (self);
 	g_return_if_fail (tag);
 
-	/* The tag must not yet exist. Otherwise we'd have to first search the
+	/* The tag must not yet exist. Otherwise, we'd have to first search the
 	 * list for an existing entry. That usage pattern is not supported. */
 	nm_assert (!_get_data (self, tag));
 
diff --git a/src/nm-auth-utils.h b/src/nm-auth-utils.h
index a6c6d65965..e79c57be69 100644
--- a/src/nm-auth-utils.h
+++ b/src/nm-auth-utils.h
@@ -80,7 +80,7 @@ nm_auth_chain_parent_lst_list (NMAuthChain *self)
 
 /* Caller must free returned error description */
 gboolean nm_auth_is_subject_in_acl (NMConnection *connection,
-                                    NMAuthSubject *subect,
+                                    NMAuthSubject *subject,
                                     char **out_error_desc);
 
 gboolean nm_auth_is_subject_in_acl_set_error (NMConnection *connection,
diff --git a/src/nm-checkpoint.c b/src/nm-checkpoint.c
index 3a37266751..6851710c54 100644
--- a/src/nm-checkpoint.c
+++ b/src/nm-checkpoint.c
@@ -32,7 +32,7 @@ typedef struct {
 	NMDeviceState state;
 	bool is_software:1;
 	bool realized:1;
-	bool activation_lifetime_bound_to_profile_visiblity:1;
+	bool activation_lifetime_bound_to_profile_visibility:1;
 	NMUnmanFlagOp unmanaged_explicit;
 	NMActivationReason activation_reason;
 	gulong dev_exported_change_id;
@@ -292,7 +292,7 @@ restore_and_activate_connection (NMCheckpoint *self,
 		                                     subject,
 		                                     NM_ACTIVATION_TYPE_MANAGED,
 		                                     dev_checkpoint->activation_reason,
-		                                       dev_checkpoint->activation_lifetime_bound_to_profile_visiblity
+		                                       dev_checkpoint->activation_lifetime_bound_to_profile_visibility
 		                                     ? NM_ACTIVATION_STATE_FLAG_LIFETIME_BOUND_TO_PROFILE_VISIBILITY
 		                                     : NM_ACTIVATION_STATE_FLAG_NONE,
 		                                     &local_error)) {
@@ -550,7 +550,7 @@ device_checkpoint_create (NMCheckpoint *checkpoint, NMDevice *device)
 		dev_checkpoint->settings_connection = nm_simple_connection_new_clone (nm_settings_connection_get_connection (settings_connection));
 		dev_checkpoint->ac_version_id = nm_active_connection_version_id_get (NM_ACTIVE_CONNECTION (act_request));
 		dev_checkpoint->activation_reason = nm_active_connection_get_activation_reason (NM_ACTIVE_CONNECTION (act_request));
-		dev_checkpoint->activation_lifetime_bound_to_profile_visiblity = NM_FLAGS_HAS (nm_active_connection_get_state_flags (NM_ACTIVE_CONNECTION (act_request)),
+		dev_checkpoint->activation_lifetime_bound_to_profile_visibility = NM_FLAGS_HAS (nm_active_connection_get_state_flags (NM_ACTIVE_CONNECTION (act_request)),
 		                                                                               NM_ACTIVATION_STATE_FLAG_LIFETIME_BOUND_TO_PROFILE_VISIBILITY);
 	}
 
diff --git a/src/nm-config.c b/src/nm-config.c
index 4fa8531941..e0b9ce3ce7 100644
--- a/src/nm-config.c
+++ b/src/nm-config.c
@@ -1566,7 +1566,7 @@ intern_config_read (const char *filename,
 out:
 	/*
 	 * If user configuration specifies global DNS options, the DNS
-	 * options in internal configuration must be deleted. Otherwise a
+	 * options in internal configuration must be deleted. Otherwise, a
 	 * deletion of options from user configuration may cause the
 	 * internal options to appear again.
 	 */
diff --git a/src/nm-core-utils.c b/src/nm-core-utils.c
index 3950c3c3a9..66245ec0d6 100644
--- a/src/nm-core-utils.c
+++ b/src/nm-core-utils.c
@@ -266,7 +266,7 @@ nm_utils_array_remove_at_indexes (GArray *array, const guint *indexes_to_delete,
 			mm_len++;
 		else {
 			/* we require indexes_to_delete to contain non-repeated, ascending
-			 * indexes. Otherwise we would need to presort the indexes. */
+			 * indexes. Otherwise, we would need to presort the indexes. */
 			while (TRUE) {
 				guint dd;
 
@@ -631,7 +631,7 @@ _sleep_duration_convert_ms_to_us (guint32 sleep_duration_msec)
  * Set to zero, to use the default (meaning 20 wakeups per seconds).
  *
  * Kill a child process synchronously and wait. The function first checks if the child already terminated
- * and if it did, return the exit status. Otherwise send one @sig signal. @sig  will always be
+ * and if it did, return the exit status. Otherwise, send one @sig signal. @sig  will always be
  * sent unless the child already exited. If the child does not exit within @wait_before_kill_msec milliseconds,
  * the function will send %SIGKILL and waits for the child indefinitely. If @wait_before_kill_msec is zero, no
  * %SIGKILL signal will be sent.
@@ -2475,7 +2475,7 @@ again:
 			gsize seed_len;
 
 			if (!allow_fake) {
-				/* we don't allow generating (and memoizing) a fake key.
+				/* we don't allow generating (and memorizing) a fake key.
 				 * Signal that no valid machine-id exists. */
 				return NULL;
 			}
@@ -3322,14 +3322,14 @@ nm_utils_stable_id_parse (const char *stable_id,
 			_stable_id_append (str, hwaddr);
 		else if (g_str_has_prefix (&stable_id[i], "${RANDOM}")) {
 			/* RANDOM makes not so much sense for cloned-mac-address
-			 * as the result is similar to specyifing "cloned-mac-address=random".
+			 * as the result is similar to specifying "cloned-mac-address=random".
 			 * It makes however sense for RFC 7217 Stable Privacy IPv6 addresses
 			 * where this is effectively the only way to generate a different
 			 * (random) host identifier for each connect.
 			 *
 			 * With RANDOM, the user can switch the lifetime of the
 			 * generated cloned-mac-address and IPv6 host identifier
-			 * by toggeling only the stable-id property of the connection.
+			 * by toggling only the stable-id property of the connection.
 			 * With RANDOM being the most short-lived, ~non-stable~ variant.
 			 */
 			if (str)
@@ -3423,7 +3423,7 @@ _set_stable_privacy (NMUtilsStableType stable_type,
 		 * That is no real problem and it is still impossible to
 		 * force a collision here, because of how the remaining
 		 * fields are hashed. That is, as we also hash @host_id_len
-		 * and the terminating '\0' of @network_id, it is unambigiously
+		 * and the terminating '\0' of @network_id, it is unambiguously
 		 * possible to revert the process and deduce the @stable_type.
 		 */
 		g_checksum_update (sum, &stable_type_uint8, sizeof (stable_type_uint8));
@@ -4228,28 +4228,6 @@ nm_utils_parse_dns_domain (const char *domain, gboolean *is_routing)
 
 /*****************************************************************************/
 
-GVariant *
-nm_utils_strdict_to_variant (GHashTable *options)
-{
-	GVariantBuilder builder;
-	gs_free NMUtilsNamedValue *values = NULL;
-	guint i;
-	guint n;
-
-	values = nm_utils_named_values_from_str_dict (options, &n);
-
-	g_variant_builder_init (&builder, G_VARIANT_TYPE ("a{sv}"));
-	for (i = 0; i < n; i++) {
-		g_variant_builder_add (&builder,
-		                       "{sv}",
-		                       values[i].name,
-		                       g_variant_new_string (values[i].value_str));
-	}
-	return g_variant_builder_end (&builder);
-}
-
-/*****************************************************************************/
-
 static guint32
 get_max_rate_ht_20 (int mcs)
 {
diff --git a/src/nm-core-utils.h b/src/nm-core-utils.h
index 55792d5712..cb6b06208e 100644
--- a/src/nm-core-utils.h
+++ b/src/nm-core-utils.h
@@ -458,8 +458,6 @@ gboolean nm_utils_validate_plugin (const char *path, struct stat *stat, GError *
 char **nm_utils_read_plugin_paths (const char *dirname, const char *prefix);
 char *nm_utils_format_con_diff_for_audit (GHashTable *diff);
 
-GVariant *nm_utils_strdict_to_variant (GHashTable *options);
-
 /*****************************************************************************/
 
 /* this enum is compatible with ICMPV6_ROUTER_PREF_* (from <linux/icmpv6.h>,
diff --git a/src/nm-dbus-manager.c b/src/nm-dbus-manager.c
index 9849656ddd..da632d5e55 100644
--- a/src/nm-dbus-manager.c
+++ b/src/nm-dbus-manager.c
@@ -1003,8 +1003,8 @@ _obj_register (NMDBusManager *self,
 
 	nm_assert (!c_list_is_empty (&obj->internal.registration_lst_head));
 
-	/* Currently the interfaces of an object do not changed and strictly depend on the object glib type.
-	 * We don't need more flixibility, and it simplifies the code. Hence, now emit interface-added
+	/* Currently, the interfaces of an object do not changed and strictly depend on the object glib type.
+	 * We don't need more flexibility, and it simplifies the code. Hence, now emit interface-added
 	 * signal for the new object.
 	 *
 	 * Warning: note that if @obj's notify signal is currently blocked via g_object_freeze_notify(),
diff --git a/src/nm-dhcp-config.c b/src/nm-dhcp-config.c
index 3b9211df99..fd55c3ff43 100644
--- a/src/nm-dhcp-config.c
+++ b/src/nm-dhcp-config.c
@@ -75,7 +75,7 @@ nm_dhcp_config_set_options (NMDhcpConfig *self,
 	priv = NM_DHCP_CONFIG_GET_PRIVATE (self);
 
 	nm_g_variant_unref (priv->options);
-	priv->options = g_variant_ref_sink (nm_utils_strdict_to_variant (options));
+	priv->options = g_variant_ref_sink (nm_utils_strdict_to_variant_asv (options));
 	_notify (self, PROP_OPTIONS);
 }
 
diff --git a/src/nm-firewall-manager.c b/src/nm-firewall-manager.c
index 304b15f99a..6892ef0b3d 100644
--- a/src/nm-firewall-manager.c
+++ b/src/nm-firewall-manager.c
@@ -146,7 +146,7 @@ static gboolean
 _get_running (NMFirewallManagerPrivate *priv)
 {
 	/* when starting, we need to asynchronously check whether there is
-	 * a name owner. During that time we optimistially assume that the
+	 * a name owner. During that time we optimistically assume that the
 	 * service is indeed running. That is the time when we queue the
 	 * requests, and they will be started once the get-name-owner call
 	 * returns. */
diff --git a/src/nm-manager.c b/src/nm-manager.c
index 921125329e..286c9ef35b 100644
--- a/src/nm-manager.c
+++ b/src/nm-manager.c
@@ -700,7 +700,7 @@ initited:
 		/* on systems where a lot of devices are created and go away, the index contains
 		 * a lot of stale entries. We must from time to time clean them up.
 		 *
-		 * Do do this cleanup, whenever we have more enties then 2 times the number of links. */
+		 * Do do this cleanup, whenever we have more entries then 2 times the number of links. */
 		if (G_UNLIKELY (g_hash_table_size (priv->device_route_metrics) > NM_MAX (20, n_links * 2))) {
 			/* from time to time, we need to do some house-keeping and prune stale entries.
 			 * Otherwise, on a system where interfaces frequently come and go (docker), we
@@ -2364,7 +2364,7 @@ nm_manager_rfkill_update (NMManager *self, RfKillType rtype)
 	if (rtype != RFKILL_TYPE_UNKNOWN)
 		manager_rfkill_update_one_type (self, &priv->radio_states[rtype], rtype);
 	else {
-		/* Otherwise sync all radio types */
+		/* Otherwise, sync all radio types */
 		for (i = 0; i < RFKILL_TYPE_MAX; i++)
 			manager_rfkill_update_one_type (self, &priv->radio_states[i], i);
 	}
@@ -2817,7 +2817,7 @@ recheck_assume_connection (NMManager *self,
 			 * We've managed to steal the lease used by initramfs before it
 			 * killed off the dhclient. We need to take ownership of the configured
 			 * connection and act like the device was configured by us.
-			 * Otherwise the address would just expire.
+			 * Otherwise, the address would just expire.
 			 */
 			_LOG2I (LOGD_DEVICE, device, "assume: taking over an initramfs-configured connection");
 			activation_type_assume = TRUE;
@@ -3299,7 +3299,7 @@ _register_device_factory (NMDeviceFactory *factory, gpointer user_data)
 /*****************************************************************************/
 
 void
-nm_manager_notify_device_availibility_maybe_changed (NMManager *self)
+nm_manager_notify_device_availability_maybe_changed (NMManager *self)
 {
 	NMManagerPrivate *priv = NM_MANAGER_GET_PRIVATE (self);
 	NMDevice *device;
@@ -3773,7 +3773,7 @@ found_better:
 		    && g_hash_table_contains (unavailable_devices, device))
 			continue;
 
-		/* determine the priority of this device. Currently this priority is independent
+		/* determine the priority of this device. Currently, this priority is independent
 		 * of the profile (connection) and the device's details (aside the state).
 		 *
 		 * Maybe nm_device_check_connection_available() should instead return a priority,
@@ -5366,7 +5366,7 @@ impl_manager_activate_connection (NMDBusObject *obj,
 	device_path = nm_dbus_path_not_empty (device_path);
 
 	/* If the connection path is given and valid, that connection is activated.
-	 * Otherwise the "best" connection for the device is chosen and activated,
+	 * Otherwise, the "best" connection for the device is chosen and activated,
 	 * regardless of whether that connection is autoconnect-enabled or not
 	 * (since this is an explicit request, not an auto-activation request).
 	 */
diff --git a/src/nm-manager.h b/src/nm-manager.h
index ab08eaa839..ebb7600255 100644
--- a/src/nm-manager.h
+++ b/src/nm-manager.h
@@ -191,7 +191,7 @@ void nm_manager_dbus_set_property_handle (NMDBusObject *obj,
 
 NMMetered nm_manager_get_metered (NMManager *self);
 
-void nm_manager_notify_device_availibility_maybe_changed (NMManager *self);
+void nm_manager_notify_device_availability_maybe_changed (NMManager *self);
 
 /*****************************************************************************/
 
diff --git a/src/nm-policy.c b/src/nm-policy.c
index 62ead24253..148f5618ba 100644
--- a/src/nm-policy.c
+++ b/src/nm-policy.c
@@ -340,7 +340,7 @@ device_ip6_prefix_delegated (NMDevice *device,
 	}
 
 	if (i == priv->ip6_prefix_delegations->len) {
-		/* Allocate a delegation delegation for new prefix. */
+		/* Allocate a delegation for new prefix. */
 		g_array_set_size (priv->ip6_prefix_delegations, i + 1);
 		delegation = &g_array_index (priv->ip6_prefix_delegations, IP6PrefixDelegation, i);
 		delegation->subnets = g_hash_table_new (nm_direct_hash, NULL);
diff --git a/src/platform/nm-linux-platform.c b/src/platform/nm-linux-platform.c
index fbcc2b3136..2ee478cdcf 100644
--- a/src/platform/nm-linux-platform.c
+++ b/src/platform/nm-linux-platform.c
@@ -152,7 +152,7 @@ G_STATIC_ASSERT (RTA_MAX == (__RTA_MAX - 1));
 
 /*****************************************************************************/
 
-/* Appeared in in kernel prior to 3.13 dated 19 January, 2014 */
+/* Appeared in the kernel prior to 3.13 dated 19 January, 2014 */
 #ifndef ARPHRD_6LOWPAN
 #define ARPHRD_6LOWPAN 825
 #endif
@@ -271,7 +271,7 @@ struct _ifla_vf_vlan_info {
 
 /*****************************************************************************/
 
-/* Appeared in in kernel 4.0 dated April 12, 2015 */
+/* Appeared in the kernel 4.0 dated April 12, 2015 */
 #ifndef BRIDGE_VLAN_INFO_RANGE_BEGIN
 #define BRIDGE_VLAN_INFO_RANGE_BEGIN    (1 << 3) /* VLAN is start of vlan range */
 #define BRIDGE_VLAN_INFO_RANGE_END      (1 << 4) /* VLAN is end of vlan range */
@@ -514,7 +514,7 @@ G_DEFINE_TYPE (NMLinuxPlatform, nm_linux_platform, NM_TYPE_PLATFORM)
             /* The %m format specifier (GNU extension) would already allow you to specify the error
              * message conveniently (and nm_log would get that right too). But we don't want to depend
              * on that, so instead append the message at the end.
-             * Currently users are expected not to use %m in the format string. */ \
+             * Currently, users are expected not to use %m in the format string. */ \
             _LOG_print (__level, __domain, __errsv, self, \
                         _NM_UTILS_MACRO_FIRST (__VA_ARGS__) ": %s (%d)" \
                         _NM_UTILS_MACRO_REST (__VA_ARGS__), \
@@ -1050,12 +1050,12 @@ _linktype_get_type (NMPlatform *platform,
 		 * it means that their type may not have been determined correctly
 		 * due to race conditions while accessing sysfs.
 		 *
-		 * This way, we save edditional ethtool/sysctl lookups, but moreover,
+		 * This way, we save additional ethtool/sysctl lookups, but moreover,
 		 * we keep the linktype stable and don't change it as long as the link
 		 * exists.
 		 *
 		 * Note that kernel *can* reuse the ifindex (on integer overflow, and
-		 * when moving interfce to other netns). Thus here there is a tiny potential
+		 * when moving interface to other netns). Thus here there is a tiny potential
 		 * of messing stuff up. */
 		if (   obj
 		    && obj->_link.netlink.is_in_netlink
@@ -2602,7 +2602,7 @@ again:
 						             &p->endpoint) < 0)
 							goto toobig_peers;
 					} else {
-						/* I think there is no way to clear an endpoint, though there shold be. */
+						/* I think there is no way to clear an endpoint, though there should be. */
 						nm_assert (p->endpoint.sa.sa_family == AF_UNSPEC);
 					}
 				}
@@ -2839,7 +2839,7 @@ _new_from_nl_link (NMPlatform *platform, const NMPCache *cache, struct nlmsghdr
 	if (!tb[IFLA_MTU]) {
 		/* Kernel has two places that send RTM_GETLINK messages:
 		 * net/core/rtnetlink.c and net/wireless/ext-core.c.
-		 * Unfotunatelly ext-core.c sets only IFLA_WIRELESS and
+		 * Unfortunately ext-core.c sets only IFLA_WIRELESS and
 		 * IFLA_IFNAME. This confuses code in this function, because
 		 * it cannot get complete set of data for the interface and
 		 * later incomplete object this function creates is used to
@@ -3162,7 +3162,7 @@ _new_from_nl_addr (struct nlmsghdr *nlh, gboolean id_only)
 		 * If IFA_LOCAL is missing, IFA_ADDRESS is @address and @peer_address
 		 * is :: (all-zero).
 		 *
-		 * If unexpectely IFA_ADDRESS is missing, make the best of it -- but it _should_
+		 * If unexpectedly IFA_ADDRESS is missing, make the best of it -- but it _should_
 		 * actually be there. */
 		if (tb[IFA_ADDRESS] || tb[IFA_LOCAL]) {
 			if (tb[IFA_LOCAL]) {
@@ -4758,6 +4758,10 @@ _nl_msg_new_qdisc (int nlmsg_type,
 		NLA_PUT_U32 (msg, TCA_TBF_BURST, qdisc->tbf.burst);
 
 		nla_nest_end (msg, tc_options);
+	} else if (nm_streq (qdisc->kind, "prio")) {
+		struct tc_prio_qopt opt = {3, { 1, 2, 2, 2, 1, 2, 0, 0, 1, 1, 1, 1, 1, 1, 1, 1 } };
+
+		NLA_PUT (msg, TCA_OPTIONS, sizeof (opt), &opt);
 	} else {
 		if (!(tc_options = nla_nest_start (msg, TCA_OPTIONS)))
 			goto nla_put_failure;
@@ -8729,7 +8733,7 @@ continue_reading:
 			 * NL_PROCEED. */
 		} else if (hdr->nlmsg_type == NLMSG_OVERRUN) {
 			/* Data got lost, report back to user. The default action is to
-			 * quit parsing. The user may overrule this action by retuning
+			 * quit parsing. The user may overrule this action by returning
 			 * NL_SKIP or NL_PROCEED (dangerous) */
 			err = -NME_NL_MSG_OVERFLOW;
 			abort_parsing = TRUE;
diff --git a/src/platform/nm-netlink.c b/src/platform/nm-netlink.c
index d133d35166..fdb2becd03 100644
--- a/src/platform/nm-netlink.c
+++ b/src/platform/nm-netlink.c
@@ -526,7 +526,7 @@ _nest_end (struct nl_msg *msg, struct nlattr *start, int keep_empty)
 	if (pad > 0) {
 		/*
 		 * Data inside attribute does not end at a alignment boundary.
-		 * Pad accordingly and accoun for the additional space in
+		 * Pad accordingly and account for the additional space in
 		 * the message. nlmsg_reserve() may never fail in this situation,
 		 * the allocate message buffer must be a multiple of NLMSG_ALIGNTO.
 		 */
@@ -1184,7 +1184,7 @@ continue_reading:
 			goto skip;
 
 		/* Data got lost, report back to user. The default action is to
-		 * quit parsing. The user may overrule this action by retuning
+		 * quit parsing. The user may overrule this action by returning
 		 * NL_SKIP or NL_PROCEED (dangerous) */
 		else if (hdr->nlmsg_type == NLMSG_OVERRUN) {
 			nmerr = -NME_NL_MSG_OVERFLOW;
diff --git a/src/platform/nm-platform-utils.c b/src/platform/nm-platform-utils.c
index 6c14bc5c16..c8565f5d23 100644
--- a/src/platform/nm-platform-utils.c
+++ b/src/platform/nm-platform-utils.c
@@ -219,7 +219,7 @@ again:
 		 * calling it again should have no bad effect (just setting the same thing more than once).
 		 *
 		 * The only potential bad thing is if there was a race involving swapping names, and we just
-		 * set the ioctl option on the wrong device. But then the bad thing already happend and
+		 * set the ioctl option on the wrong device. But then the bad thing already happenned and
 		 * we cannot detect it (nor do anything about it). At least, we can retry and set the
 		 * option on the right interface. */
 		retry = (try_count < 5);
diff --git a/src/platform/nm-platform.c b/src/platform/nm-platform.c
index 4702ba9797..5c4a3abb55 100644
--- a/src/platform/nm-platform.c
+++ b/src/platform/nm-platform.c
@@ -2414,7 +2414,7 @@ nm_platform_link_tun_add (NMPlatform *self,
 	g_return_val_if_fail (props, -NME_BUG);
 	g_return_val_if_fail (NM_IN_SET (props->type, IFF_TUN, IFF_TAP), -NME_BUG);
 
-	/* creating a non-persistant device requires that the caller handles
+	/* creating a non-persistent device requires that the caller handles
 	 * the file descriptor. */
 	g_return_val_if_fail (props->persist || out_fd, -NME_BUG);
 
diff --git a/src/platform/nm-platform.h b/src/platform/nm-platform.h
index 2b5d491401..339ef5ba3b 100644
--- a/src/platform/nm-platform.h
+++ b/src/platform/nm-platform.h
@@ -115,7 +115,7 @@ typedef enum {
 	 * For the ID we can only recognize route fields that we actually implement.
 	 * However, kernel supports more routing options, some of them also part of
 	 * the ID. NetworkManager is oblivious to these options and will wrongly think
-	 * that two routes are idential, while they are not. That can lead to an
+	 * that two routes are identical, while they are not. That can lead to an
 	 * inconsistent platform cache. Not much what we can do about that, except
 	 * implementing all options that kernel supports *sigh*. See rh#1337860.
 	 */
@@ -414,7 +414,7 @@ typedef union {
 	/* RTA_METRICS:
 	 *
 	 * For IPv4 routes, these properties are part of their
-	 * ID (meaning: you can add otherwise idential IPv4 routes that
+	 * ID (meaning: you can add otherwise identical IPv4 routes that
 	 * only differ by the metric property).
 	 * On the other hand, for IPv6 you cannot add two IPv6 routes that only differ
 	 * by an RTA_METRICS property.
@@ -625,7 +625,7 @@ typedef struct {
 	guint32 quantum;
 	guint32 ce_threshold; /* TCA_FQ_CODEL_CE_THRESHOLD: kernel internally stores this value as
 	                       *   ((val64 * NSEC_PER_USEC) >> CODEL_SHIFT). The default value (in
-	                       *   the domain with this coersion) is CODEL_DISABLED_THRESHOLD (INT_MAX).
+	                       *   the domain with this coercion) is CODEL_DISABLED_THRESHOLD (INT_MAX).
 	                       *   That means, "disabled" is expressed on RTM_NEWQDISC netlink API by absence of the
 	                       *   netlink attribute but also as the special value 0x83126E97u
 	                       *   (NM_PLATFORM_FQ_CODEL_CE_THRESHOLD_DISABLED).
diff --git a/src/platform/nmp-object.c b/src/platform/nmp-object.c
index a6aa5e2239..1cd61a8e7d 100644
--- a/src/platform/nmp-object.c
+++ b/src/platform/nmp-object.c
@@ -1437,7 +1437,7 @@ _vt_cmd_plobj_id_cmp (ip4_address, NMPlatformIP4Address,
                       NM_CMP_FIELD (obj1, obj2, ifindex);
                       NM_CMP_FIELD (obj1, obj2, plen);
                       NM_CMP_FIELD (obj1, obj2, address);
-                      /* for IPv4 addresses, you can add the same local address with differing peer-adddress
+                      /* for IPv4 addresses, you can add the same local address with differing peer-address
                        * (IFA_ADDRESS), provided that their net-part differs. */
                       NM_CMP_DIRECT_IN4ADDR_SAME_PREFIX (obj1->peer_address, obj2->peer_address, obj1->plen);
 )
diff --git a/src/platform/nmp-object.h b/src/platform/nmp-object.h
index 44525ed05b..7866caa428 100644
--- a/src/platform/nmp-object.h
+++ b/src/platform/nmp-object.h
@@ -219,7 +219,7 @@ typedef struct {
 		 * "struct udev", but doesn't own it.
 		 *
 		 * Hence, the udev.device shall not be used after the library
-		 * context is is destroyed.
+		 * context is destroyed.
 		 *
 		 * In case of NMPObjectLink instances that you obtained from the
 		 * platform cache, that means that you shall no keep references
diff --git a/src/platform/tests/test-route.c b/src/platform/tests/test-route.c
index 42b5baf0f8..531c61dbdc 100644
--- a/src/platform/tests/test-route.c
+++ b/src/platform/tests/test-route.c
@@ -1309,7 +1309,7 @@ _rule_fuzzy_equal (const NMPObject *obj,
 		break;
 	case RTM_DELRULE:
 		/* when deleting a rule with RTM_DELRULE, kernel tries to find the
-		 * cadidate to delete. It might delete the wrong rule (rh#1685816). */
+		 * candidate to delete. It might delete the wrong rule (rh#1685816). */
 		if (rr->action == FR_ACT_UNSPEC)
 			rr_co.action = FR_ACT_UNSPEC;
 		if (rr->iifname[0] == '\0')
@@ -1510,7 +1510,7 @@ again:
 
 		objs_sync = g_ptr_array_new_with_free_func ((GDestroyNotify) nmp_object_unref);
 
-		/* ensure that priorities are unique. Otherwise it confuses the test, because
+		/* ensure that priorities are unique. Otherwise, it confuses the test, because
 		 * kernel may wrongly be unable to add/delete routes based on a wrong match
 		 * (rh#1685816, rh#1685816). */
 		for (i = 0; i < objs->len; i++) {
diff --git a/src/settings/nm-agent-manager.c b/src/settings/nm-agent-manager.c
index 363b117581..a3b99e94e7 100644
--- a/src/settings/nm-agent-manager.c
+++ b/src/settings/nm-agent-manager.c
@@ -1171,9 +1171,9 @@ _con_get_try_complete_early (Request *req)
  * Requests secrets for a connection.
  *
  * This function cannot fail. The callback will be invoked
- * asynchrnously, but it will always be invoked exactly once.
+ * asynchronously, but it will always be invoked exactly once.
  * Even for cancellation and disposing of @self. In those latter
- * cases, the callback is invoked synchrnously during the cancellation/
+ * cases, the callback is invoked synchronously during the cancellation/
  * disposal.
  *
  * Returns: a call-id to cancel the call.
diff --git a/src/settings/nm-settings-connection.h b/src/settings/nm-settings-connection.h
index 17573bbe05..dfd002efdf 100644
--- a/src/settings/nm-settings-connection.h
+++ b/src/settings/nm-settings-connection.h
@@ -80,7 +80,7 @@ typedef enum {
 
 	/* Update in-memory (i.e. persist to /run). If the profile is currently on disk,
 	 * then a reference to the profile is remembered as "shadowed-storage".
-	 * Later, when storing again to persistant storage, the shawowed-storage is
+	 * Later, when storing again to persistent storage, the shadowed-storage is
 	 * updated. When deleting the profile, the shadowed-storage is also deleted
 	 * from disk.
 	 *
@@ -90,7 +90,7 @@ typedef enum {
 	/* Update in-memory (i.e. persist to /run). This is almost like
 	 * %NM_SETTINGS_CONNECTION_PERSIST_MODE_IN_MEMORY, except the in-memory profile
 	 * remembers not to own the shadowed-storage ("shadowed-owned").
-	 * The diffrence is that when deleting the in-memory profile, the original
+	 * The difference is that when deleting the in-memory profile, the original
 	 * profile is not deleted but instead the nmmeta tombstone remembers the
 	 * shadowed-storage and re-used it when re-adding the profile.
 	 *
diff --git a/src/settings/nm-settings.c b/src/settings/nm-settings.c
index 0a1e7b47d6..82ab1b6c4e 100644
--- a/src/settings/nm-settings.c
+++ b/src/settings/nm-settings.c
@@ -1748,7 +1748,7 @@ nm_settings_add_connection (NMSettings *self,
 				/* We have a nmmeta tombstone that indicates that a storage is shadowed.
 				 *
 				 * This happens when deleting a in-memory profile that was decoupled from
-				 * the persitant storage with NM_SETTINGS_CONNECTION_PERSIST_MODE_IN_MEMORY_DETACHED.
+				 * the persistent storage with NM_SETTINGS_CONNECTION_PERSIST_MODE_IN_MEMORY_DETACHED.
 				 * We need to take over this storage again... */
 				break;
 			}
diff --git a/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-plugin.c b/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-plugin.c
index f5c9bb5e91..ad782e2c78 100644
--- a/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-plugin.c
+++ b/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-plugin.c
@@ -353,7 +353,7 @@ _storages_consolidate (NMSIfcfgRHPlugin *self,
 		storage = storages_modified->pdata[i];
 
 		if (!storage->dirty) {
-			/* the entry is no longer dirty. In the meantime we already emited
+			/* the entry is no longer dirty. In the meantime we already emitted
 			 * another signal for it. */
 			continue;
 		}
diff --git a/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-reader.c b/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-reader.c
index 1a9df92cee..4ac223c0c0 100644
--- a/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-reader.c
+++ b/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-reader.c
@@ -338,7 +338,7 @@ make_connection_name (shvarFile *ifcfg,
 	if (name)
 		return name;
 
-	/* Otherwise construct a new NAME */
+	/* Otherwise, construct a new NAME */
 	if (!prefix)
 		prefix = "System";
 
@@ -4021,6 +4021,7 @@ make_wireless_setting (shvarFile *ifcfg,
 	gint64 chan = 0;
 	NMSettingMacRandomization mac_randomization;
 	NMSettingWirelessPowersave powersave = NM_SETTING_WIRELESS_POWERSAVE_DEFAULT;
+	NMTernary ternary;
 
 	s_wireless = NM_SETTING_WIRELESS (nm_setting_wireless_new ());
 
@@ -4224,6 +4225,14 @@ make_wireless_setting (shvarFile *ifcfg,
 	              mac_randomization,
 	              NULL);
 
+	ternary = svGetValueTernary (ifcfg, "AP_ISOLATION");
+	if (ternary != NM_TERNARY_DEFAULT) {
+		g_object_set (s_wireless,
+		              NM_SETTING_WIRELESS_AP_ISOLATION,
+		              ternary,
+		              NULL);
+	}
+
 	return NM_SETTING (s_wireless);
 
 error:
diff --git a/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-utils.c b/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-utils.c
index d1500dbdb9..e967481500 100644
--- a/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-utils.c
+++ b/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-utils.c
@@ -805,6 +805,7 @@ nms_ifcfg_rh_utils_is_numbered_tag_impl (const char *key,
 const NMSIfcfgKeyTypeInfo nms_ifcfg_well_known_keys[] = {
 	_KEY_TYPE ("ACD_TIMEOUT",                                 NMS_IFCFG_KEY_TYPE_IS_PLAIN ),
 	_KEY_TYPE ("ADDRESS",                                     NMS_IFCFG_KEY_TYPE_IS_NUMBERED ),
+	_KEY_TYPE ("AP_ISOLATION",                                NMS_IFCFG_KEY_TYPE_IS_PLAIN ),
 	_KEY_TYPE ("ARPING_WAIT",                                 NMS_IFCFG_KEY_TYPE_IS_PLAIN ),
 	_KEY_TYPE ("AUTH_RETRIES",                                NMS_IFCFG_KEY_TYPE_IS_PLAIN ),
 	_KEY_TYPE ("AUTOCONNECT_PRIORITY",                        NMS_IFCFG_KEY_TYPE_IS_PLAIN ),
diff --git a/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-utils.h b/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-utils.h
index 459c5ae958..a864137ecd 100644
--- a/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-utils.h
+++ b/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-utils.h
@@ -33,7 +33,7 @@ typedef struct {
 	NMSIfcfgKeyTypeFlags key_flags;
 } NMSIfcfgKeyTypeInfo;
 
-extern const NMSIfcfgKeyTypeInfo nms_ifcfg_well_known_keys[240];
+extern const NMSIfcfgKeyTypeInfo nms_ifcfg_well_known_keys[241];
 
 const NMSIfcfgKeyTypeInfo *nms_ifcfg_well_known_key_find_info (const char *key, gssize *out_idx);
 
diff --git a/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-writer.c b/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-writer.c
index e6526944c7..67de73073a 100644
--- a/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-writer.c
+++ b/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-writer.c
@@ -114,10 +114,13 @@ write_secrets (shvarFile *ifcfg,
                GError **error)
 {
 	nm_auto_shvar_file_close shvarFile *keyfile = NULL;
-	gs_free const char **secrets_keys = NULL;
-	guint i, secrets_keys_n;
+	gs_free NMUtilsNamedValue *secrets_arr_free = NULL;
+	NMUtilsNamedValue secrets_arr_static[30];
+	const NMUtilsNamedValue *secrets_arr;
+	guint secrets_len;
 	GError *local = NULL;
 	gboolean any_secrets = FALSE;
+	guint i;
 
 	keyfile = utils_get_keys_ifcfg (svFileGetName (ifcfg), TRUE);
 	if (!keyfile) {
@@ -126,10 +129,13 @@ write_secrets (shvarFile *ifcfg,
 		return FALSE;
 	}
 
-	secrets_keys = nm_utils_strdict_get_keys (secrets, TRUE, &secrets_keys_n);
-	for (i = 0; i < secrets_keys_n; i++) {
-		const char *k = secrets_keys[i];
-		const char *v = g_hash_table_lookup (secrets, k);
+	secrets_arr = nm_utils_named_values_from_strdict (secrets,
+	                                                  &secrets_len,
+	                                                  secrets_arr_static,
+	                                                  &secrets_arr_free);
+	for (i = 0; i < secrets_len; i++) {
+		const char *k = secrets_arr[i].name;
+		const char *v = secrets_arr[i].value_str;
 
 		if (v) {
 			svSetValueStr (keyfile, k, v);
@@ -947,6 +953,8 @@ write_wireless_setting (NMConnection *connection,
 		break;
 	}
 
+	svSetValueTernary (ifcfg, "AP_ISOLATION", nm_setting_wireless_get_ap_isolation (s_wireless));
+
 	svSetValueStr (ifcfg, "TYPE", TYPE_WIRELESS);
 
 	return TRUE;
@@ -1415,23 +1423,29 @@ write_team_setting (NMConnection *connection, shvarFile *ifcfg, gboolean *wired,
 	return TRUE;
 }
 
-static gboolean
-get_setting_default_boolean (gpointer setting, const char *prop)
-{
-	return NM_G_PARAM_SPEC_GET_DEFAULT_BOOLEAN (g_object_class_find_property (G_OBJECT_GET_CLASS (setting), prop));
-}
-
-static guint
-get_setting_default_uint (gpointer setting, const char *prop)
-{
-	return NM_G_PARAM_SPEC_GET_DEFAULT_UINT (g_object_class_find_property (G_OBJECT_GET_CLASS (setting), prop));
-}
-
-static guint64
-get_setting_default_uint64 (gpointer setting, const char *prop)
-{
-	return NM_G_PARAM_SPEC_GET_DEFAULT_UINT64 (g_object_class_find_property (G_OBJECT_GET_CLASS (setting), prop));
-}
+#define get_setting_default_checked_boolean(dflt, setting, prop) \
+	({ \
+		const gboolean _dflt = (dflt); \
+		\
+		nm_assert (NM_G_PARAM_SPEC_GET_DEFAULT_BOOLEAN (g_object_class_find_property (G_OBJECT_GET_CLASS (setting), prop)) == _dflt); \
+		_dflt; \
+	})
+
+#define get_setting_default_checked_uint(dflt, setting, prop) \
+	({ \
+		const guint _dflt = (dflt); \
+		\
+		nm_assert (NM_G_PARAM_SPEC_GET_DEFAULT_UINT (g_object_class_find_property (G_OBJECT_GET_CLASS (setting), prop)) == _dflt); \
+		_dflt; \
+	})
+
+#define get_setting_default_checked_uint64(dflt, setting, prop) \
+	({ \
+		const guint64 _dflt = (dflt); \
+		\
+		nm_assert (NM_G_PARAM_SPEC_GET_DEFAULT_UINT64 (g_object_class_find_property (G_OBJECT_GET_CLASS (setting), prop)) == _dflt); \
+		_dflt; \
+	})
 
 static gboolean
 write_bridge_vlans (NMSetting *setting,
@@ -1475,6 +1489,7 @@ write_bridge_setting (NMConnection *connection, shvarFile *ifcfg, gboolean *wire
 	NMSettingBridge *s_bridge;
 	guint32 u32;
 	guint64 u64;
+	guint u;
 	gboolean b;
 	const char *s;
 	GString *opts;
@@ -1498,164 +1513,141 @@ write_bridge_setting (NMConnection *connection, shvarFile *ifcfg, gboolean *wire
 		svSetValueStr (ifcfg, "STP", "yes");
 
 		u32 = nm_setting_bridge_get_forward_delay (s_bridge);
-		if (u32 != get_setting_default_uint (s_bridge, NM_SETTING_BRIDGE_FORWARD_DELAY))
+		if (u32 != get_setting_default_checked_uint (NM_BRIDGE_FORWARD_DELAY_DEF, s_bridge, NM_SETTING_BRIDGE_FORWARD_DELAY))
 			svSetValueInt64 (ifcfg, "DELAY", u32);
 
 		g_string_append_printf (opts, "priority=%u", nm_setting_bridge_get_priority (s_bridge));
 
 		u32 = nm_setting_bridge_get_hello_time (s_bridge);
-		if (u32 != get_setting_default_uint (s_bridge, NM_SETTING_BRIDGE_HELLO_TIME)) {
-			if (opts->len)
-				g_string_append_c (opts, ' ');
+		if (u32 != get_setting_default_checked_uint (NM_BRIDGE_HELLO_TIME_DEF, s_bridge, NM_SETTING_BRIDGE_HELLO_TIME)) {
+			nm_gstring_add_space_delimiter (opts);
 			g_string_append_printf (opts, "hello_time=%u", u32);
 		}
 
 		u32 = nm_setting_bridge_get_max_age (s_bridge);
-		if (u32 != get_setting_default_uint (s_bridge, NM_SETTING_BRIDGE_MAX_AGE)) {
-			if (opts->len)
-				g_string_append_c (opts, ' ');
+		if (u32 != get_setting_default_checked_uint (NM_BRIDGE_MAX_AGE_DEF, s_bridge, NM_SETTING_BRIDGE_MAX_AGE)) {
+			nm_gstring_add_space_delimiter (opts);
 			g_string_append_printf (opts, "max_age=%u", u32);
 		}
 	}
 
-	u32 = nm_setting_bridge_get_ageing_time (s_bridge);
-	if (u32 != get_setting_default_uint (s_bridge, NM_SETTING_BRIDGE_AGEING_TIME)) {
-		if (opts->len)
-			g_string_append_c (opts, ' ');
-		g_string_append_printf (opts, "ageing_time=%u", u32);
+	u = nm_setting_bridge_get_ageing_time (s_bridge);
+	if (u != get_setting_default_checked_uint (NM_BRIDGE_AGEING_TIME_DEF, s_bridge, NM_SETTING_BRIDGE_AGEING_TIME)) {
+		nm_gstring_add_space_delimiter (opts);
+		g_string_append_printf (opts, "ageing_time=%u", u);
 	}
 
 	s = nm_setting_bridge_get_group_address (s_bridge);
 	if (s) {
-		if (opts->len)
-			g_string_append_c (opts, ' ');
+		nm_gstring_add_space_delimiter (opts);
 		g_string_append_printf (opts, "group_address=%s", s);
 	}
 
 	u32 = nm_setting_bridge_get_group_forward_mask (s_bridge);
-	if (u32 != get_setting_default_uint (s_bridge, NM_SETTING_BRIDGE_GROUP_FORWARD_MASK)) {
-		if (opts->len)
-			g_string_append_c (opts, ' ');
+	if (u32 != get_setting_default_checked_uint (0, s_bridge, NM_SETTING_BRIDGE_GROUP_FORWARD_MASK)) {
+		nm_gstring_add_space_delimiter (opts);
 		g_string_append_printf (opts, "group_fwd_mask=%u", u32);
 	}
 
-
 	u32 = nm_setting_bridge_get_multicast_hash_max (s_bridge);
-	if (u32 != get_setting_default_uint (s_bridge, NM_SETTING_BRIDGE_MULTICAST_HASH_MAX)) {
-		if (opts->len)
-			g_string_append_c (opts, ' ');
+	if (u32 != get_setting_default_checked_uint (NM_BRIDGE_MULTICAST_HASH_MAX_DEF, s_bridge, NM_SETTING_BRIDGE_MULTICAST_HASH_MAX)) {
+		nm_gstring_add_space_delimiter (opts);
 		g_string_append_printf (opts, "multicast_hash_max=%u", u32);
 	}
 
 	u32 = nm_setting_bridge_get_multicast_last_member_count (s_bridge);
-	if (u32 != get_setting_default_uint (s_bridge, NM_SETTING_BRIDGE_MULTICAST_LAST_MEMBER_COUNT)) {
-		if (opts->len)
-			g_string_append_c (opts, ' ');
+	if (u32 != get_setting_default_checked_uint (NM_BRIDGE_MULTICAST_LAST_MEMBER_COUNT_DEF, s_bridge, NM_SETTING_BRIDGE_MULTICAST_LAST_MEMBER_COUNT)) {
+		nm_gstring_add_space_delimiter (opts);
 		g_string_append_printf (opts, "multicast_last_member_count=%u", u32);
 	}
 
 	u64 = nm_setting_bridge_get_multicast_last_member_interval (s_bridge);
-	if (u64 != get_setting_default_uint64 (s_bridge, NM_SETTING_BRIDGE_MULTICAST_LAST_MEMBER_INTERVAL)) {
-		if (opts->len)
-			g_string_append_c (opts, ' ');
+	if (u64 != get_setting_default_checked_uint64 (NM_BRIDGE_MULTICAST_LAST_MEMBER_INTERVAL_DEF, s_bridge, NM_SETTING_BRIDGE_MULTICAST_LAST_MEMBER_INTERVAL)) {
+		nm_gstring_add_space_delimiter (opts);
 		g_string_append_printf (opts, "multicast_last_member_interval=%"G_GUINT64_FORMAT, u64);
 	}
 
 	u64 = nm_setting_bridge_get_multicast_membership_interval (s_bridge);
-	if (u64 != get_setting_default_uint64 (s_bridge, NM_SETTING_BRIDGE_MULTICAST_MEMBERSHIP_INTERVAL)) {
-		if (opts->len)
-			g_string_append_c (opts, ' ');
+	if (u64 != get_setting_default_checked_uint64 (NM_BRIDGE_MULTICAST_MEMBERSHIP_INTERVAL_DEF, s_bridge, NM_SETTING_BRIDGE_MULTICAST_MEMBERSHIP_INTERVAL)) {
+		nm_gstring_add_space_delimiter (opts);
 		g_string_append_printf (opts, "multicast_membership_interval=%"G_GUINT64_FORMAT, u64);
 	}
 
 	b = nm_setting_bridge_get_multicast_querier (s_bridge);
-	if (b != get_setting_default_boolean (s_bridge, NM_SETTING_BRIDGE_MULTICAST_QUERIER)) {
-		if (opts->len)
-			g_string_append_c (opts, ' ');
+	if (b != get_setting_default_checked_boolean (NM_BRIDGE_MULTICAST_QUERIER_DEF, s_bridge, NM_SETTING_BRIDGE_MULTICAST_QUERIER)) {
+		nm_gstring_add_space_delimiter (opts);
 		g_string_append_printf (opts, "multicast_querier=%u", (guint) b);
 	}
 
 	u64 = nm_setting_bridge_get_multicast_querier_interval (s_bridge);
-	if (u64 != get_setting_default_uint64 (s_bridge, NM_SETTING_BRIDGE_MULTICAST_QUERIER_INTERVAL)) {
-		if (opts->len)
-			g_string_append_c (opts, ' ');
+	if (u64 != get_setting_default_checked_uint64 (NM_BRIDGE_MULTICAST_QUERIER_INTERVAL_DEF, s_bridge, NM_SETTING_BRIDGE_MULTICAST_QUERIER_INTERVAL)) {
+		nm_gstring_add_space_delimiter (opts);
 		g_string_append_printf (opts, "multicast_querier_interval=%"G_GUINT64_FORMAT, u64);
 	}
 
 	u64 = nm_setting_bridge_get_multicast_query_interval (s_bridge);
-	if (u64 != get_setting_default_uint64 (s_bridge, NM_SETTING_BRIDGE_MULTICAST_QUERY_INTERVAL)) {
-		if (opts->len)
-			g_string_append_c (opts, ' ');
+	if (u64 != get_setting_default_checked_uint64 (NM_BRIDGE_MULTICAST_QUERY_INTERVAL_DEF, s_bridge, NM_SETTING_BRIDGE_MULTICAST_QUERY_INTERVAL)) {
+		nm_gstring_add_space_delimiter (opts);
 		g_string_append_printf (opts, "multicast_query_interval=%"G_GUINT64_FORMAT, u64);
 	}
 
 	u64 = nm_setting_bridge_get_multicast_query_response_interval (s_bridge);
-	if (u64 != get_setting_default_uint64 (s_bridge, NM_SETTING_BRIDGE_MULTICAST_QUERY_RESPONSE_INTERVAL)) {
-		if (opts->len)
-			g_string_append_c (opts, ' ');
+	if (u64 != get_setting_default_checked_uint64 (NM_BRIDGE_MULTICAST_QUERY_RESPONSE_INTERVAL_DEF, s_bridge, NM_SETTING_BRIDGE_MULTICAST_QUERY_RESPONSE_INTERVAL)) {
+		nm_gstring_add_space_delimiter (opts);
 		g_string_append_printf (opts, "multicast_query_response_interval=%"G_GUINT64_FORMAT, u64);
 	}
 
 	b = nm_setting_bridge_get_multicast_query_use_ifaddr (s_bridge);
-	if (b != get_setting_default_boolean (s_bridge, NM_SETTING_BRIDGE_MULTICAST_QUERY_USE_IFADDR)) {
-		if (opts->len)
-			g_string_append_c (opts, ' ');
+	if (b != get_setting_default_checked_boolean (NM_BRIDGE_MULTICAST_QUERY_USE_IFADDR_DEF, s_bridge, NM_SETTING_BRIDGE_MULTICAST_QUERY_USE_IFADDR)) {
+		nm_gstring_add_space_delimiter (opts);
 		g_string_append_printf (opts, "multicast_query_use_ifaddr=%u", (guint) b);
 	}
 
 	b = nm_setting_bridge_get_multicast_snooping (s_bridge);
-	if (b != get_setting_default_boolean (s_bridge, NM_SETTING_BRIDGE_MULTICAST_SNOOPING)) {
-		if (opts->len)
-			g_string_append_c (opts, ' ');
+	if (b != get_setting_default_checked_boolean (NM_BRIDGE_MULTICAST_SNOOPING_DEF, s_bridge, NM_SETTING_BRIDGE_MULTICAST_SNOOPING)) {
+		nm_gstring_add_space_delimiter (opts);
 		g_string_append_printf (opts, "multicast_snooping=%u", (guint32) b);
 	}
 
 	u32 = nm_setting_bridge_get_multicast_startup_query_count (s_bridge);
-	if (u32 != get_setting_default_uint (s_bridge, NM_SETTING_BRIDGE_MULTICAST_STARTUP_QUERY_COUNT)) {
-		if (opts->len)
-			g_string_append_c (opts, ' ');
+	if (u32 != get_setting_default_checked_uint (NM_BRIDGE_MULTICAST_STARTUP_QUERY_COUNT_DEF, s_bridge, NM_SETTING_BRIDGE_MULTICAST_STARTUP_QUERY_COUNT)) {
+		nm_gstring_add_space_delimiter (opts);
 		g_string_append_printf (opts, "multicast_startup_query_count=%u", u32);
 	}
 
 	u64 = nm_setting_bridge_get_multicast_startup_query_interval (s_bridge);
-	if (u64 != get_setting_default_uint64 (s_bridge, NM_SETTING_BRIDGE_MULTICAST_STARTUP_QUERY_INTERVAL)) {
-		if (opts->len)
-			g_string_append_c (opts, ' ');
+	if (u64 != get_setting_default_checked_uint64 (NM_BRIDGE_MULTICAST_STARTUP_QUERY_INTERVAL_DEF, s_bridge, NM_SETTING_BRIDGE_MULTICAST_STARTUP_QUERY_INTERVAL)) {
+		nm_gstring_add_space_delimiter (opts);
 		g_string_append_printf (opts, "multicast_startup_query_interval=%"G_GUINT64_FORMAT, u64);
 	}
 
 	s = nm_setting_bridge_get_multicast_router (s_bridge);
 	if (s) {
-		if (opts->len)
-			g_string_append_c (opts, ' ');
+		nm_gstring_add_space_delimiter (opts);
 		g_string_append_printf (opts, "multicast_router=%s", s);
 	}
 
 	b = nm_setting_bridge_get_vlan_filtering (s_bridge);
-	if (b != get_setting_default_boolean (s_bridge, NM_SETTING_BRIDGE_VLAN_FILTERING)) {
-		if (opts->len)
-			g_string_append_c (opts, ' ');
+	if (b != get_setting_default_checked_boolean (FALSE, s_bridge, NM_SETTING_BRIDGE_VLAN_FILTERING)) {
+		nm_gstring_add_space_delimiter (opts);
 		g_string_append_printf (opts, "vlan_filtering=%u", (guint32) b);
 	}
 
 	u32 = nm_setting_bridge_get_vlan_default_pvid (s_bridge);
-	if (u32 != get_setting_default_uint (s_bridge, NM_SETTING_BRIDGE_VLAN_DEFAULT_PVID)) {
-		if (opts->len)
-			g_string_append_c (opts, ' ');
+	if (u32 != get_setting_default_checked_uint (NM_BRIDGE_VLAN_DEFAULT_PVID_DEF, s_bridge, NM_SETTING_BRIDGE_VLAN_DEFAULT_PVID)) {
+		nm_gstring_add_space_delimiter (opts);
 		g_string_append_printf (opts, "default_pvid=%u", u32);
 	}
 
 	s = nm_setting_bridge_get_vlan_protocol (s_bridge);
 	if (s) {
-		if (opts->len)
-			g_string_append_c (opts, ' ');
+		nm_gstring_add_space_delimiter (opts);
 		g_string_append_printf (opts, "vlan_protocol=%s", s);
 	}
 
 	b = nm_setting_bridge_get_vlan_stats_enabled (s_bridge);
-	if (b != get_setting_default_boolean (s_bridge, NM_SETTING_BRIDGE_VLAN_STATS_ENABLED)) {
-		if (opts->len)
-			g_string_append_c (opts, ' ');
+	if (b != get_setting_default_checked_boolean (NM_BRIDGE_VLAN_STATS_ENABLED_DEF, s_bridge, NM_SETTING_BRIDGE_VLAN_STATS_ENABLED)) {
+		nm_gstring_add_space_delimiter (opts);
 		g_string_append_printf (opts, "vlan_stats_enabled=%u", (guint) b);
 	}
 
@@ -1692,11 +1684,11 @@ write_bridge_port_setting (NMConnection *connection, shvarFile *ifcfg, GError **
 	string = g_string_sized_new (32);
 
 	u32 = nm_setting_bridge_port_get_priority (s_port);
-	if (u32 != get_setting_default_uint (NM_SETTING (s_port), NM_SETTING_BRIDGE_PORT_PRIORITY))
+	if (u32 != get_setting_default_checked_uint (NM_BRIDGE_PORT_PRIORITY_DEF, s_port, NM_SETTING_BRIDGE_PORT_PRIORITY))
 		g_string_append_printf (string, "priority=%u", u32);
 
 	u32 = nm_setting_bridge_port_get_path_cost (s_port);
-	if (u32 != get_setting_default_uint (NM_SETTING (s_port), NM_SETTING_BRIDGE_PORT_PATH_COST)) {
+	if (u32 != get_setting_default_checked_uint (NM_BRIDGE_PORT_PATH_COST_DEF, s_port, NM_SETTING_BRIDGE_PORT_PATH_COST)) {
 		if (string->len)
 			g_string_append_c (string, ' ');
 		g_string_append_printf (string, "path_cost=%u", u32);
diff --git a/src/settings/plugins/ifcfg-rh/shvar.c b/src/settings/plugins/ifcfg-rh/shvar.c
index cd63661d9a..a447720690 100644
--- a/src/settings/plugins/ifcfg-rh/shvar.c
+++ b/src/settings/plugins/ifcfg-rh/shvar.c
@@ -1214,6 +1214,20 @@ svGetValueBoolean (shvarFile *s, const char *key, int fallback)
 	return svParseBoolean (value, fallback);
 }
 
+/* svGetValueTernary:
+ * @s: fhe file
+ * @key: the name of the key to read
+ *
+ * Reads a value @key and converts it to a NMTernary value.
+ *
+ * Returns: the parsed NMTernary
+ */
+NMTernary
+svGetValueTernary (shvarFile *s, const char *key)
+{
+	return svGetValueBoolean (s, key, NM_TERNARY_DEFAULT);
+}
+
 /* svGetValueInt64:
  * @s: fhe file
  * @key: the name of the key to read
@@ -1429,6 +1443,15 @@ svSetValueBoolean (shvarFile *s, const char *key, gboolean value)
 }
 
 gboolean
+svSetValueTernary (shvarFile *s, const char *key, NMTernary value)
+{
+	if (NM_IN_SET (value, NM_TERNARY_TRUE, NM_TERNARY_FALSE))
+		return svSetValueBoolean (s, key, (gboolean) value);
+	else
+		return svUnsetValue (s, key);
+}
+
+gboolean
 svSetValueBoolean_cond_true (shvarFile *s, const char *key, gboolean value)
 {
 	return svSetValue (s, key, value ? "yes" : NULL);
diff --git a/src/settings/plugins/ifcfg-rh/shvar.h b/src/settings/plugins/ifcfg-rh/shvar.h
index 410284f8cb..852dd4c1de 100644
--- a/src/settings/plugins/ifcfg-rh/shvar.h
+++ b/src/settings/plugins/ifcfg-rh/shvar.h
@@ -66,6 +66,8 @@ const char **svGetKeysSorted (shvarFile *s,
  */
 int svGetValueBoolean (shvarFile *s, const char *key, int def);
 
+NMTernary svGetValueTernary (shvarFile *s, const char *key);
+
 gint64 svGetValueInt64 (shvarFile *s, const char *key, guint base, gint64 min, gint64 max, gint64 fallback);
 
 gboolean svGetValueEnum (shvarFile *s, const char *key,
@@ -84,6 +86,7 @@ gboolean svSetValueBoolean_cond_true (shvarFile *s, const char *key, gboolean va
 gboolean svSetValueInt64 (shvarFile *s, const char *key, gint64 value);
 gboolean svSetValueInt64_cond (shvarFile *s, const char *key, gboolean do_set, gint64 value);
 gboolean svSetValueEnum (shvarFile *s, const char *key, GType gtype, int value);
+gboolean svSetValueTernary (shvarFile *s, const char *key, NMTernary value);
 
 gboolean svUnsetValue (shvarFile *s, const char *key);
 gboolean svUnsetAll (shvarFile *s, SvKeyType match_key_type);
diff --git a/src/settings/plugins/ifcfg-rh/tests/network-scripts/ifcfg-Test_Write_WiFi_AP_Mode.cexpected b/src/settings/plugins/ifcfg-rh/tests/network-scripts/ifcfg-Test_Write_WiFi_AP_Mode.cexpected
new file mode 100644
index 0000000000..ccec2b81ae
--- /dev/null
+++ b/src/settings/plugins/ifcfg-rh/tests/network-scripts/ifcfg-Test_Write_WiFi_AP_Mode.cexpected
@@ -0,0 +1,19 @@
+ESSID=MySSID
+MODE=Ap
+CHANNEL=196
+MAC_ADDRESS_RANDOMIZATION=default
+AP_ISOLATION=yes
+TYPE=Wireless
+PROXY_METHOD=none
+BROWSER_ONLY=no
+BOOTPROTO=dhcp
+DEFROUTE=yes
+IPV4_FAILURE_FATAL=no
+IPV6INIT=yes
+IPV6_AUTOCONF=yes
+IPV6_DEFROUTE=yes
+IPV6_FAILURE_FATAL=no
+IPV6_ADDR_GEN_MODE=stable-privacy
+NAME="Test Write Wi-Fi AP Mode"
+UUID=${UUID}
+ONBOOT=yes
diff --git a/src/settings/plugins/ifcfg-rh/tests/test-ifcfg-rh.c b/src/settings/plugins/ifcfg-rh/tests/test-ifcfg-rh.c
index 40d1bb8c53..935ea9fdf8 100644
--- a/src/settings/plugins/ifcfg-rh/tests/test-ifcfg-rh.c
+++ b/src/settings/plugins/ifcfg-rh/tests/test-ifcfg-rh.c
@@ -15,6 +15,7 @@
 #include <sys/types.h>
 #include <sys/stat.h>
 
+#include "nm-glib-aux/nm-json-aux.h"
 #include "nm-utils.h"
 #include "nm-setting-connection.h"
 #include "nm-setting-wired.h"
@@ -96,7 +97,7 @@ _assert_reread_same_FIXME (NMConnection *connection, NMConnection *reread)
 	/* FIXME: these assertion failures should not happen as we expect
 	 * that re-reading a connection after write yields the same result.
 	 *
-	 * Needs investation and fixing. */
+	 * Needs investigation and fixing. */
 	nmtst_assert_connection_verifies_without_normalization (reread);
 
 	connection_normalized = nmtst_connection_duplicate_and_normalize (connection);
@@ -3967,6 +3968,54 @@ test_write_wifi_band_a (void)
 }
 
 static void
+test_write_wifi_ap_mode (void)
+{
+	nmtst_auto_unlinkfile char *testfile = NULL;
+	gs_unref_object NMConnection *connection = NULL;
+	gs_unref_object NMConnection *reread = NULL;
+	NMSettingConnection *s_con;
+	NMSettingWireless *s_wifi;
+	gs_unref_bytes GBytes *ssid = NULL;
+
+	connection = nm_simple_connection_new ();
+
+	/* Connection setting */
+	s_con = (NMSettingConnection *) nm_setting_connection_new ();
+	nm_connection_add_setting (connection, NM_SETTING (s_con));
+
+	g_object_set (s_con,
+	              NM_SETTING_CONNECTION_ID, "Test Write Wi-Fi AP Mode",
+	              NM_SETTING_CONNECTION_UUID, nm_utils_uuid_generate_a (),
+	              NM_SETTING_CONNECTION_TYPE, NM_SETTING_WIRELESS_SETTING_NAME,
+	              NULL);
+
+	/* Wifi setting */
+	s_wifi = (NMSettingWireless *) nm_setting_wireless_new ();
+	nm_connection_add_setting (connection, NM_SETTING (s_wifi));
+
+	ssid = g_bytes_new ("MySSID", NM_STRLEN ("MySSID"));
+
+	g_object_set (s_wifi,
+	              NM_SETTING_WIRELESS_SSID, ssid,
+	              NM_SETTING_WIRELESS_MODE, "ap",
+	              NM_SETTING_WIRELESS_BAND, "a",
+	              NM_SETTING_WIRELESS_CHANNEL, (guint) 196,
+	              NM_SETTING_WIRELESS_AP_ISOLATION, NM_TERNARY_TRUE,
+	              NULL);
+
+	nmtst_assert_connection_verifies (connection);
+
+	_writer_new_connec_exp (connection,
+	                        TEST_SCRATCH_DIR,
+	                        TEST_IFCFG_DIR"/ifcfg-Test_Write_WiFi_AP_Mode.cexpected",
+	                        &testfile);
+
+	reread = _connection_from_file (testfile, NULL, TYPE_WIRELESS, NULL);
+
+	nmtst_assert_connection_equals (connection, TRUE, reread, FALSE);
+}
+
+static void
 test_read_wifi_band_a_channel_mismatch (void)
 {
 	gs_free_error GError *error = NULL;
@@ -9081,7 +9130,7 @@ test_read_team_master_invalid (gconstpointer user_data)
 	gs_free_error GError *error = NULL;
 	gs_unref_object NMConnection *connection = NULL;
 
-	if (WITH_JSON_VALIDATION) {
+	if (nm_json_vt ()) {
 		_connection_from_file_fail (PATH_NAME, NULL, TYPE_ETHERNET, &error);
 
 		g_assert_error (error, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_INVALID_PROPERTY);
@@ -9528,7 +9577,7 @@ do_svUnescape_combine_ansi_append (GString *str_val, GString *str_exp, const Une
 	if (honor_needs_ascii_separator && data->needs_ascii_separator) {
 		/* the string has an open escape sequence. We must ensure that when
 		 * combining it with another sequence, that they don't merge into
-		 * something diffent. for example "\xa" + "a" must not result in
+		 * something different. for example "\xa" + "a" must not result in
 		 * "\xaa". Instead, we add a space in between to get "\xa a". */
 		g_string_append (str_val, " ");
 		g_string_append (str_exp, " ");
@@ -10645,6 +10694,7 @@ int main (int argc, char **argv)
 	g_test_add_func (TPATH "wifi/write-wpa-then-wep-with-perms", test_write_wifi_wpa_then_wep_with_perms);
 	g_test_add_func (TPATH "wifi/write-hidden", test_write_wifi_hidden);
 	g_test_add_func (TPATH "wifi/write-band-a", test_write_wifi_band_a);
+	g_test_add_func (TPATH "wifi/write-ap-mode", test_write_wifi_ap_mode);
 
 	g_test_add_func (TPATH "s390/read-qeth-static", test_read_wired_qeth_static);
 	g_test_add_func (TPATH "s390/write-qeth-dhcp", test_write_wired_qeth_dhcp);
diff --git a/src/settings/plugins/ifupdown/tests/test-ifupdown.c b/src/settings/plugins/ifupdown/tests/test-ifupdown.c
index 6a7b5ecc76..497a1caa10 100644
--- a/src/settings/plugins/ifupdown/tests/test-ifupdown.c
+++ b/src/settings/plugins/ifupdown/tests/test-ifupdown.c
@@ -190,7 +190,7 @@ dump_blocks (if_parser *parser)
 		g_print("'%s' '%s'\n", n->type, n->name);
 
 		// each key-value pair within a block is indented & separated by a tab
-		// (single quotes used to show typ & name baoundaries)
+		// (single quotes used to show type & name boundaries)
 		c_list_for_each_entry (m, &n->data_lst_head, data_lst)
 			g_print("\t'%s'\t'%s'\n", m->key, m->data);
 
diff --git a/src/settings/plugins/keyfile/nms-keyfile-plugin.c b/src/settings/plugins/keyfile/nms-keyfile-plugin.c
index c84bd78d0d..09023dbb29 100644
--- a/src/settings/plugins/keyfile/nms-keyfile-plugin.c
+++ b/src/settings/plugins/keyfile/nms-keyfile-plugin.c
@@ -529,7 +529,7 @@ _storages_consolidate (NMSKeyfilePlugin *self,
 		storage = storages_modified->pdata[i];
 
 		if (!storage->is_dirty) {
-			/* the entry is no longer is_dirty. In the meantime we already emited
+			/* the entry is no longer is_dirty. In the meantime we already emitted
 			 * another signal for it. */
 			continue;
 		}
diff --git a/src/settings/plugins/keyfile/nms-keyfile-utils.c b/src/settings/plugins/keyfile/nms-keyfile-utils.c
index bc8dfd12c2..e3c3969146 100644
--- a/src/settings/plugins/keyfile/nms-keyfile-utils.c
+++ b/src/settings/plugins/keyfile/nms-keyfile-utils.c
@@ -266,7 +266,7 @@ nms_keyfile_nmmeta_write (const char *dirname,
 		}
 	} else {
 		/* we only have the "loaded_path" to store. That is commonly used for the tombstones to
-		 * link to /dev/null. A symlink is sufficient to store that ammount of information.
+		 * link to /dev/null. A symlink is sufficient to store that amount of information.
 		 * No need to bother with a keyfile. */
 		if (symlink (loaded_path, full_filename_tmp) != 0) {
 			errsv = -NM_ERRNO_NATIVE (errno);
diff --git a/src/supplicant/nm-supplicant-config.c b/src/supplicant/nm-supplicant-config.c
index 058792d026..f37798d97a 100644
--- a/src/supplicant/nm-supplicant-config.c
+++ b/src/supplicant/nm-supplicant-config.c
@@ -10,8 +10,8 @@
 
 #include <stdlib.h>
 
+#include "nm-glib-aux/nm-str-buf.h"
 #include "nm-core-internal.h"
-
 #include "nm-supplicant-settings-verify.h"
 #include "nm-setting.h"
 #include "nm-libnm-core-intern/nm-auth-subject.h"
@@ -34,6 +34,7 @@ typedef struct {
 	guint32 ap_scan;
 	bool fast_required:1;
 	bool dispose_has_run:1;
+	bool ap_isolation:1;
 } NMSupplicantConfigPrivate;
 
 struct _NMSupplicantConfig {
@@ -342,26 +343,39 @@ wifi_freqs_to_string (gboolean bg_band)
 {
 	static const char *str_2ghz = NULL;
 	static const char *str_5ghz = NULL;
-	const char *str;
+	const char **f_p;
+	const char *f;
+
+	f_p =   bg_band
+	      ? &str_2ghz
+	      : &str_5ghz;
 
-	str = bg_band ? str_2ghz : str_5ghz;
+again:
+	f = g_atomic_pointer_get (f_p);
 
-	if (G_UNLIKELY (str == NULL)) {
-		GString *tmp;
+	if (G_UNLIKELY (!f)) {
+		nm_auto_str_buf NMStrBuf strbuf = NM_STR_BUF_INIT (400, FALSE);
 		const guint *freqs;
 		int i;
 
-		freqs = bg_band ? nm_utils_wifi_2ghz_freqs () : nm_utils_wifi_5ghz_freqs ();
-		tmp = g_string_sized_new (bg_band ? 70 : 225);
-		for (i = 0; freqs[i]; i++)
-			g_string_append_printf (tmp, i == 0 ? "%d" : " %d", freqs[i]);
-		str = g_string_free (tmp, FALSE);
-		if (bg_band)
-			str_2ghz = str;
-		else
-			str_5ghz = str;
+		freqs =   bg_band
+		        ? nm_utils_wifi_2ghz_freqs ()
+		        : nm_utils_wifi_5ghz_freqs ();
+		for (i = 0; freqs[i]; i++) {
+			if (i > 0)
+				nm_str_buf_append_c (&strbuf, ' ');
+			nm_str_buf_append_printf (&strbuf, "%u", freqs[i]);
+		}
+
+		f = g_strdup (nm_str_buf_get_str (&strbuf));
+
+		if (!g_atomic_pointer_compare_and_exchange (f_p, NULL, f)) {
+			g_free ((char *) f);
+			goto again;
+		}
 	}
-	return str;
+
+	return f;
 }
 
 gboolean
@@ -464,9 +478,9 @@ nm_supplicant_config_add_setting_wireless (NMSupplicantConfig * self,
 	priv = NM_SUPPLICANT_CONFIG_GET_PRIVATE (self);
 
 	mode = nm_setting_wireless_get_mode (setting);
-	is_adhoc = (mode && !strcmp (mode, "adhoc")) ? TRUE : FALSE;
-	is_ap = (mode && !strcmp (mode, "ap")) ? TRUE : FALSE;
-	is_mesh = (mode && !strcmp (mode, "mesh")) ? TRUE : FALSE;
+	is_adhoc = nm_streq0 (mode, "adhoc");
+	is_ap = nm_streq0 (mode, "ap");
+	is_mesh = nm_streq0 (mode, "mesh");
 	if (is_adhoc || is_ap)
 		priv->ap_scan = 2;
 	else
@@ -540,9 +554,9 @@ nm_supplicant_config_add_setting_wireless (NMSupplicantConfig * self,
 		} else {
 			const char *freqs = NULL;
 
-			if (!strcmp (band, "a"))
+			if (nm_streq (band, "a"))
 				freqs = wifi_freqs_to_string (FALSE);
-			else if (!strcmp (band, "bg"))
+			else if (nm_streq (band, "bg"))
 				freqs = wifi_freqs_to_string (TRUE);
 
 			if (freqs && !nm_supplicant_config_add_option (self, "freq_list", freqs, strlen (freqs), NULL, error))
@@ -716,7 +730,7 @@ add_wep_key (NMSupplicantConfig *self,
 			                               sizeof (buffer),
 			                               NULL)) {
 				g_set_error (error, NM_SUPPLICANT_ERROR, NM_SUPPLICANT_ERROR_CONFIG,
-				             "cannot add wep-key %s to suplicant config because key is not hex",
+				             "cannot add wep-key %s to supplicant config because key is not hex",
 				             name);
 				return FALSE;
 			}
@@ -732,7 +746,7 @@ add_wep_key (NMSupplicantConfig *self,
 				return FALSE;
 		} else {
 			g_set_error (error, NM_SUPPLICANT_ERROR, NM_SUPPLICANT_ERROR_CONFIG,
-			             "Cannot add wep-key %s to suplicant config because key-length %u is invalid",
+			             "Cannot add wep-key %s to supplicant config because key-length %u is invalid",
 			             name, (guint) key_len);
 			return FALSE;
 		}
@@ -888,10 +902,10 @@ nm_supplicant_config_add_setting_wireless_security (NMSupplicantConfig *self,
 	}
 
 	/* Only WPA-specific things when using WPA */
-	if (   !strcmp (key_mgmt, "wpa-psk")
-	    || !strcmp (key_mgmt, "wpa-eap")
-	    || !strcmp (key_mgmt, "sae")
-	    || !strcmp (key_mgmt, "owe")) {
+	if (NM_IN_STRSET (key_mgmt, "wpa-psk",
+	                            "wpa-eap",
+	                            "sae",
+	                            "owe")) {
 		if (!ADD_STRING_LIST_VAL (self, setting, wireless_security, proto, protos, "proto", ' ', TRUE, NULL, error))
 			return FALSE;
 		if (!ADD_STRING_LIST_VAL (self, setting, wireless_security, pairwise, pairwise, "pairwise", ' ', TRUE, NULL, error))
@@ -914,7 +928,7 @@ nm_supplicant_config_add_setting_wireless_security (NMSupplicantConfig *self,
 	}
 
 	/* WEP keys if required */
-	if (!strcmp (key_mgmt, "none")) {
+	if (nm_streq (key_mgmt, "none")) {
 		NMWepKeyType wep_type = nm_setting_wireless_security_get_wep_key_type (setting);
 		const char *wep0 = nm_setting_wireless_security_get_wep_key (setting, 0);
 		const char *wep1 = nm_setting_wireless_security_get_wep_key (setting, 1);
@@ -939,9 +953,9 @@ nm_supplicant_config_add_setting_wireless_security (NMSupplicantConfig *self,
 		}
 	}
 
-	if (auth_alg && !strcmp (auth_alg, "leap")) {
+	if (nm_streq0 (auth_alg, "leap")) {
 		/* LEAP */
-		if (!strcmp (key_mgmt, "ieee8021x")) {
+		if (nm_streq (key_mgmt, "ieee8021x")) {
 			const char *tmp;
 
 			tmp = nm_setting_wireless_security_get_leap_username (setting);
@@ -961,7 +975,8 @@ nm_supplicant_config_add_setting_wireless_security (NMSupplicantConfig *self,
 		}
 	} else {
 		/* 802.1x for Dynamic WEP and WPA-Enterprise */
-		if (!strcmp (key_mgmt, "ieee8021x") || !strcmp (key_mgmt, "wpa-eap")) {
+		if (NM_IN_STRSET (key_mgmt, "ieee8021x",
+		                            "wpa-eap")) {
 			if (!setting_8021x) {
 				g_set_error (error, NM_SUPPLICANT_ERROR, NM_SUPPLICANT_ERROR_CONFIG,
 				             "Cannot set key-mgmt %s with missing 8021x setting", key_mgmt);
@@ -971,7 +986,7 @@ nm_supplicant_config_add_setting_wireless_security (NMSupplicantConfig *self,
 				return FALSE;
 		}
 
-		if (!strcmp (key_mgmt, "wpa-eap")) {
+		if (nm_streq (key_mgmt, "wpa-eap")) {
 			/* When using WPA-Enterprise, we want to use Proactive Key Caching (also
 			 * called Opportunistic Key Caching) to avoid full EAP exchanges when
 			 * roaming between access points in the same mobility group.
@@ -1135,9 +1150,9 @@ nm_supplicant_config_add_setting_8021x (NMSupplicantConfig *self,
 	phase1 = g_string_new (NULL);
 	peapver = nm_setting_802_1x_get_phase1_peapver (setting);
 	if (peapver) {
-		if (!strcmp (peapver, "0"))
+		if (nm_streq (peapver, "0"))
 			g_string_append (phase1, "peapver=0");
-		else if (!strcmp (peapver, "1"))
+		else if (nm_streq (peapver, "1"))
 			g_string_append (phase1, "peapver=1");
 	}
 
@@ -1153,7 +1168,7 @@ nm_supplicant_config_add_setting_8021x (NMSupplicantConfig *self,
 			g_string_append_c (phase1, ' ');
 		g_string_append_printf (phase1, "fast_provisioning=%s", value);
 
-		if (strcmp (value, "0") != 0)
+		if (!nm_streq (value, "0"))
 			fast_provisoning_allowed = TRUE;
 	}
 
@@ -1507,3 +1522,14 @@ nm_supplicant_config_add_no_security (NMSupplicantConfig *self, GError **error)
 	return nm_supplicant_config_add_option (self, "key_mgmt", "NONE", -1, NULL, error);
 }
 
+gboolean
+nm_supplicant_config_get_ap_isolation (NMSupplicantConfig *self)
+{
+	return self->_priv.ap_isolation;
+}
+
+void
+nm_supplicant_config_set_ap_isolation (NMSupplicantConfig *self, gboolean ap_isolation)
+{
+	self->_priv.ap_isolation = ap_isolation;
+}
diff --git a/src/supplicant/nm-supplicant-config.h b/src/supplicant/nm-supplicant-config.h
index e1da9a1eca..530c2cdd0b 100644
--- a/src/supplicant/nm-supplicant-config.h
+++ b/src/supplicant/nm-supplicant-config.h
@@ -69,4 +69,8 @@ gboolean nm_supplicant_config_add_setting_macsec (NMSupplicantConfig *self,
 
 gboolean nm_supplicant_config_enable_pmf_akm (NMSupplicantConfig *self,
                                               GError **error);
+
+void     nm_supplicant_config_set_ap_isolation (NMSupplicantConfig *self, gboolean ap_isolation);
+gboolean nm_supplicant_config_get_ap_isolation (NMSupplicantConfig *self);
+
 #endif /* __NETWORKMANAGER_SUPPLICANT_CONFIG_H__ */
diff --git a/src/supplicant/nm-supplicant-interface.c b/src/supplicant/nm-supplicant-interface.c
index 3dda0fbf25..93dbc59641 100644
--- a/src/supplicant/nm-supplicant-interface.c
+++ b/src/supplicant/nm-supplicant-interface.c
@@ -44,6 +44,7 @@ typedef struct {
 	gpointer user_data;
 	guint fail_on_idle_id;
 	guint blobs_left;
+	guint calls_left;
 	struct _AddNetworkData *add_network_data;
 } AssocData;
 
@@ -157,6 +158,8 @@ typedef struct _NMSupplicantInterfacePrivate {
 	bool           prop_scan_active:1;
 	bool           prop_scan_ssid:1;
 
+	bool           ap_isolate_supported:1;
+	bool           ap_isolate_needs_reset:1;
 } NMSupplicantInterfacePrivate;
 
 struct _NMSupplicantInterfaceClass {
@@ -436,6 +439,20 @@ _remove_network (NMSupplicantInterface *self)
 	                              g_variant_new ("(o)", net_path),
 	                              G_VARIANT_TYPE ("()"),
 	                              "remove-network");
+
+	if (   priv->ap_isolate_supported
+	    && priv->ap_isolate_needs_reset) {
+		_dbus_connection_call_simple (self,
+		                              DBUS_INTERFACE_PROPERTIES,
+		                              "Set",
+		                              g_variant_new ("(ssv)",
+		                                             NM_WPAS_DBUS_IFACE_INTERFACE,
+		                                             "ApIsolate",
+		                                             g_variant_new_string ("0")),
+		                              G_VARIANT_TYPE ("()"),
+		                              "reset-ap-isolation");
+	}
+	priv->ap_isolate_needs_reset = FALSE;
 }
 
 /*****************************************************************************/
@@ -1218,7 +1235,7 @@ parse_capabilities (NMSupplicantInterface *self, GVariant *capabilities)
 		const gint32 WPAS_MAX_SCAN_SSIDS = 16;
 
 		/* Even if supplicant claims that 20 SSIDs are supported, the Scan request
-		 * still only accepts WPAS_MAX_SCAN_SSIDS SSIDs. Otherwise the D-Bus
+		 * still only accepts WPAS_MAX_SCAN_SSIDS SSIDs. Otherwise, the D-Bus
 		 * request will be rejected with "fi.w1.wpa_supplicant1.InvalidArgs"
 		 * Body: ('Did not receive correct message arguments.', 'Too many ssids specified. Specify at most four')
 		 * */
@@ -1868,6 +1885,9 @@ _properties_changed_main (NMSupplicantInterface *self,
 		}
 	}
 
+	if (nm_g_variant_lookup (properties, "ApIsolate", "&s", &v_s))
+		priv->ap_isolate_supported = TRUE;
+
 	if (do_log_driver_info) {
 		_LOGD ("supplicant interface for ifindex=%d, ifname=%s%s%s, driver=%s%s%s (requested %s)",
 		       priv->ifindex,
@@ -2227,27 +2247,13 @@ assoc_add_network_cb (GObject *source, GAsyncResult *result, gpointer user_data)
 }
 
 static void
-assoc_set_ap_scan_cb (GVariant *ret, GError *error, gpointer user_data)
+add_network (NMSupplicantInterface *self)
 {
-	NMSupplicantInterface *self;
 	NMSupplicantInterfacePrivate *priv;
 	AddNetworkData *add_network_data;
 
-	if (nm_utils_error_is_cancelled (error))
-		return;
-
-	self = NM_SUPPLICANT_INTERFACE (user_data);
 	priv = NM_SUPPLICANT_INTERFACE_GET_PRIVATE (self);
 
-	if (error) {
-		assoc_return (self, error, "failure to set AP scan mode");
-		return;
-	}
-
-	_LOGT ("assoc["NM_HASH_OBFUSCATE_PTR_FMT"]: interface ap_scan set to %d",
-	       NM_HASH_OBFUSCATE_PTR (priv->assoc_data),
-	       nm_supplicant_config_get_ap_scan (priv->assoc_data->cfg));
-
 	/* the association does not keep @self alive. We want to be able to remove
 	 * the network again, even if @self is already gone. Hence, track the data
 	 * separately.
@@ -2276,6 +2282,62 @@ assoc_set_ap_scan_cb (GVariant *ret, GError *error, gpointer user_data)
 	                       add_network_data);
 }
 
+static void
+assoc_set_ap_isolation (GVariant *ret, GError *error, gpointer user_data)
+{
+	NMSupplicantInterface *self;
+	NMSupplicantInterfacePrivate *priv;
+	gboolean value;
+
+	if (nm_utils_error_is_cancelled (error))
+		return;
+
+	self = NM_SUPPLICANT_INTERFACE (user_data);
+	priv = NM_SUPPLICANT_INTERFACE_GET_PRIVATE (self);
+
+	if (error) {
+		assoc_return (self, error, "failure to set AP isolation");
+		return;
+	}
+
+	value = nm_supplicant_config_get_ap_isolation (priv->assoc_data->cfg);
+	_LOGT ("assoc["NM_HASH_OBFUSCATE_PTR_FMT"]: interface AP isolation set to %d",
+	       NM_HASH_OBFUSCATE_PTR (priv->assoc_data),
+	       value);
+
+	priv->ap_isolate_needs_reset = value;
+
+	nm_assert (priv->assoc_data->calls_left > 0);
+	if (--priv->assoc_data->calls_left == 0)
+		add_network (self);
+}
+
+static void
+assoc_set_ap_scan_cb (GVariant *ret, GError *error, gpointer user_data)
+{
+	NMSupplicantInterface *self;
+	NMSupplicantInterfacePrivate *priv;
+
+	if (nm_utils_error_is_cancelled (error))
+		return;
+
+	self = NM_SUPPLICANT_INTERFACE (user_data);
+	priv = NM_SUPPLICANT_INTERFACE_GET_PRIVATE (self);
+
+	if (error) {
+		assoc_return (self, error, "failure to set AP scan mode");
+		return;
+	}
+
+	_LOGT ("assoc["NM_HASH_OBFUSCATE_PTR_FMT"]: interface ap_scan set to %d",
+	       NM_HASH_OBFUSCATE_PTR (priv->assoc_data),
+	       nm_supplicant_config_get_ap_scan (priv->assoc_data->cfg));
+
+	nm_assert (priv->assoc_data->calls_left > 0);
+	if (--priv->assoc_data->calls_left == 0)
+		add_network (self);
+}
+
 static gboolean
 assoc_fail_on_idle_cb (gpointer user_data)
 {
@@ -2301,7 +2363,7 @@ assoc_fail_on_idle_cb (gpointer user_data)
  *
  * The callback is invoked exactly once (always) and always asynchronously.
  * The pending association can be aborted via nm_supplicant_interface_disconnect()
- * or by destroying @self. In that case, the @callback is invoked synchornously with
+ * or by destroying @self. In that case, the @callback is invoked synchronously with
  * an error reason indicating cancellation/disposing (see nm_utils_error_is_cancelled()).
  */
 void
@@ -2312,6 +2374,7 @@ nm_supplicant_interface_assoc (NMSupplicantInterface *self,
 {
 	NMSupplicantInterfacePrivate *priv;
 	AssocData *assoc_data;
+	gboolean ap_isolation;
 
 	g_return_if_fail (NM_IS_SUPPLICANT_INTERFACE (self));
 	g_return_if_fail (NM_IS_SUPPLICANT_CONFIG (cfg));
@@ -2343,6 +2406,7 @@ nm_supplicant_interface_assoc (NMSupplicantInterface *self,
 	}
 
 	assoc_data->cancellable = g_cancellable_new();
+	assoc_data->calls_left++;
 	nm_dbus_connection_call_set (priv->dbus_connection,
 	                             priv->name_owner->str,
 	                             priv->object_path->str,
@@ -2353,6 +2417,31 @@ nm_supplicant_interface_assoc (NMSupplicantInterface *self,
 	                             assoc_data->cancellable,
 	                             assoc_set_ap_scan_cb,
 	                             self);
+
+	ap_isolation = nm_supplicant_config_get_ap_isolation (priv->assoc_data->cfg);
+	if (!priv->ap_isolate_supported) {
+		if (ap_isolation) {
+			_LOGW ("assoc["NM_HASH_OBFUSCATE_PTR_FMT"]: requested AP isolation but the supplicant doesn't support it",
+			       NM_HASH_OBFUSCATE_PTR (assoc_data));
+		}
+	} else {
+		assoc_data->calls_left++;
+		/* It would be smarter to change the property only when necessary.
+		 * However, wpa_supplicant doesn't send the PropertiesChanged
+		 * signal for ApIsolate, and so to know the current value we would
+		 * need first a Get call. It seems simpler to just set the value
+		 * we want. */
+		nm_dbus_connection_call_set (priv->dbus_connection,
+		                             priv->name_owner->str,
+		                             priv->object_path->str,
+		                             NM_WPAS_DBUS_IFACE_INTERFACE,
+		                             "ApIsolate",
+		                             g_variant_new_string (ap_isolation ? "1" : "0"),
+		                             DBUS_TIMEOUT_MSEC,
+		                             assoc_data->cancellable,
+		                             assoc_set_ap_isolation,
+		                             self);
+	}
 }
 
 /*****************************************************************************/
diff --git a/src/supplicant/nm-supplicant-manager.c b/src/supplicant/nm-supplicant-manager.c
index b1a2dea898..b736079875 100644
--- a/src/supplicant/nm-supplicant-manager.c
+++ b/src/supplicant/nm-supplicant-manager.c
@@ -738,7 +738,7 @@ nm_supplicant_manager_create_interface (NMSupplicantManager *self,
 	c_list_link_tail (&priv->create_iface_lst_head, &handle->create_iface_lst);
 
 	if (!priv->dbus_connection) {
-		_LOGT ("create-iface["NM_HASH_OBFUSCATE_PTR_FMT"]: new request interface %d (driver %s). Fail bacause no D-Bus connection to talk to wpa_supplicant...",
+		_LOGT ("create-iface["NM_HASH_OBFUSCATE_PTR_FMT"]: new request interface %d (driver %s). Fail because no D-Bus connection to talk to wpa_supplicant...",
 		       NM_HASH_OBFUSCATE_PTR (handle),
 		       ifindex,
 		       nm_supplicant_driver_to_string (driver));
diff --git a/src/systemd/src/libsystemd-network/sd-dhcp-client.c b/src/systemd/src/libsystemd-network/sd-dhcp-client.c
index 70821ac279..334cd6565b 100644
--- a/src/systemd/src/libsystemd-network/sd-dhcp-client.c
+++ b/src/systemd/src/libsystemd-network/sd-dhcp-client.c
@@ -379,7 +379,7 @@ int sd_dhcp_client_set_client_id(
         /* For hardware types, log debug message about unexpected data length.
          *
          * Note that infiniband's INFINIBAND_ALEN is 20 bytes long, but only
-         * last last 8 bytes of the address are stable and suitable to put into
+         * the last 8 bytes of the address are stable and suitable to put into
          * the client-id. The caller is advised to account for that. */
         if ((type == ARPHRD_ETHER && data_len != ETH_ALEN) ||
             (type == ARPHRD_INFINIBAND && data_len != 8))
diff --git a/src/systemd/src/libsystemd-network/sd-dhcp6-client.c b/src/systemd/src/libsystemd-network/sd-dhcp6-client.c
index d653b2571c..a68089261c 100644
--- a/src/systemd/src/libsystemd-network/sd-dhcp6-client.c
+++ b/src/systemd/src/libsystemd-network/sd-dhcp6-client.c
@@ -1495,7 +1495,7 @@ static int client_receive_message(
                         break;
                 }
 
-                _fallthrough_; /* for Soliciation Rapid Commit option check */
+                _fallthrough_; /* for Solicitation Rapid Commit option check */
         case DHCP6_STATE_REQUEST:
         case DHCP6_STATE_RENEW:
         case DHCP6_STATE_REBIND:
diff --git a/src/systemd/src/systemd/sd-lldp.h b/src/systemd/src/systemd/sd-lldp.h
index 2dc9f63246..c2abc20121 100644
--- a/src/systemd/src/systemd/sd-lldp.h
+++ b/src/systemd/src/systemd/sd-lldp.h
@@ -176,7 +176,7 @@ int sd_lldp_neighbor_get_mud_url(sd_lldp_neighbor *n, const char **ret);
 int sd_lldp_neighbor_get_system_capabilities(sd_lldp_neighbor *n, uint16_t *ret);
 int sd_lldp_neighbor_get_enabled_capabilities(sd_lldp_neighbor *n, uint16_t *ret);
 
-/* Low-level, iterative TLV access. This is for evertyhing else, it iteratively goes through all available TLVs
+/* Low-level, iterative TLV access. This is for everything else, it iteratively goes through all available TLVs
  * (including the ones covered with the calls above), and allows multiple TLVs for the same fields. */
 int sd_lldp_neighbor_tlv_rewind(sd_lldp_neighbor *n);
 int sd_lldp_neighbor_tlv_next(sd_lldp_neighbor *n);
diff --git a/src/vpn/nm-vpn-connection.c b/src/vpn/nm-vpn-connection.c
index 6d995dc489..b5d79c7fb9 100644
--- a/src/vpn/nm-vpn-connection.c
+++ b/src/vpn/nm-vpn-connection.c
@@ -300,7 +300,7 @@ _get_settings_connection (NMVpnConnection *self, gboolean allow_missing)
 {
 	NMSettingsConnection *con;
 
-	/* Currently we operate on the assumption, that the settings-connection
+	/* Currently, we operate on the assumption, that the settings-connection
 	 * never changes after it is set (though initially, it might be unset).
 	 * Later we might want to change that, but then we need fixes here too. */