Merge ~danilogondolfo/netplan/+git/ubuntu:jammy_0_107_1_sru_with_security_fixes into ~ubuntu-core-dev/netplan/+git/ubuntu:ubuntu-jammy

[Danilo Egea Gondolfo]

A PPA with this change can be found at https://launchpad.net/~danilogondolfo/+archive/ubuntu/netplan-sru

Autopkgtest results

https://autopkgtest.ubuntu.com/results/autopkgtest-jammy-danilogondolfo-netplan-sru/jammy/amd64/n/netplan.io/20240628_181224_78755@/log.gz

https://autopkgtest.ubuntu.com/results/autopkgtest-jammy-danilogondolfo-netplan-sru/jammy/arm64/n/netplan.io/20240628_180420_fc871@/log.gz

https://autopkgtest.ubuntu.com/results/autopkgtest-jammy-danilogondolfo-netplan-sru/jammy/armhf/n/netplan.io/20240628_182427_1cf71@/log.gz

https://autopkgtest.ubuntu.com/results/autopkgtest-jammy-danilogondolfo-netplan-sru/jammy/ppc64el/n/netplan.io/20240628_180916_b64fc@/log.gz

https://autopkgtest.ubuntu.com/results/autopkgtest-jammy-danilogondolfo-netplan-sru/jammy/s390x/n/netplan.io/20240628_200205_bc663@/log.gz

The test for s390x failed due to infrastructure problems. I'm retrying it.

Tests are failing due to the known issues related to gre6/vti6 and systemd vs kernel and veths tests is failing due to a known problem in Network Manager.

[Lukas Märdian (slyon)]

LGTM. The new security patches match the noble patches (ignoring patch fuzz).

- I updated d/changelog to not drop the previous 0.106.1-7ubuntu0.22.04.3 and 0.106.1-7ubuntu0.22.04.4 updates.
- I updated d/changelog to keep this as UNRELEASED for now, pending fixes utf-8 handling in g_strescape() (https://github.com/daniloegea/netplan/commits/utf8_strescape/)
- I wonder if we need to reconsider d/p/sru-compat/0013-Keep-old-file-permission-for-backwards-compatibility.patch regarding the recent security updates. Writing Netplan YAML (through "netplan set" CLI, that could contain secrets as 640 might not be wise... but OTOH we want to keep it backwards compatible. Maybe we should at least issue a big fat warning?

review: Approve

diff --git a/debian/changelog b/debian/changelog
index e714607..a2dab85 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -37,6 +37,21 @@ netplan.io (0.107.1-3ubuntu0.22.04.1) jammy; urgency=medium
     - doc: create libnetplan apidoc structure (!423)
     - inc: Start documenting public API (!423)
     - doc: Update 'Netplan everywhere' for 23.10 (!418)
+    SECURITY UPDATE: weak permissions on secret files, command injection
+    - d/p/lp2065738/0014-libnetplan-use-more-restrictive-file-permissions.patch:
+      Use more restrictive file permissions to prevent unprivileged users to
+      read sensitive data from back end files (LP: 2065738, 1987842)
+    - CVE-2022-4968
+    - d/p/lp2066258/0015-libnetplan-escape-control-characters.patch:
+      Escape control characters in the parser and double quotes in backend
+      files.
+    - d/p/lp2066258/0016-backends-escape-file-paths.patch:
+      Escape special characters in file paths.
+    - d/p/lp2066258/0017-backends-escape-semicolons-in-service-units.patch:
+      Escape isolated semicolons in systemd service units. (LP: 2066258)
+    - debian/netplan-generator.postinst: Add a postinst maintainer script to
+      call the generator. It's needed so the file permissions fixes will be
+      applied automatically.
     Bug fixes:
     - Fix FTBFS on Fedora and refresh RPM packaging (!323)
     - parser: validate lacp-rate properly (LP: 1745648) (!324)
diff --git a/debian/netplan-generator.postinst b/debian/netplan-generator.postinst
new file mode 100644
index 0000000..f805c24
--- /dev/null
+++ b/debian/netplan-generator.postinst
@@ -0,0 +1,15 @@
+#!/bin/sh
+
+set -e
+
+# Calling the generator after installation to mitigate CVE-2022-4968
+# We avoid calling the generator if the system doesn't have networkd files to be fixed (LP: #2071333)
+if [ "$1" = configure ]; then
+    FILES=$(find /run/systemd/network/ -type f -regex ".*-netplan.*\.\(network\|netdev\)" 2>/dev/null || true)
+    if [ -n "${FILES}" ]; then
+        /usr/libexec/netplan/generate 2>/dev/null || echo "WARNING: Netplan could not re-generate network configuration. Please run 'netplan generate' to see details."
+    fi
+fi
+
+#DEBHELPER#
+
diff --git a/debian/patches/lp2065738/0013-libnetplan-use-more-restrictive-file-permissions.patch b/debian/patches/lp2065738/0013-libnetplan-use-more-restrictive-file-permissions.patch
new file mode 100644
index 0000000..9ebce53
--- /dev/null
+++ b/debian/patches/lp2065738/0013-libnetplan-use-more-restrictive-file-permissions.patch
@@ -0,0 +1,435 @@
+From: Danilo Egea Gondolfo <[e-mail]>
+Date: Wed, 22 May 2024 15:44:16 +0100
+Subject: libnetplan: use more restrictive file permissions
+
+A new util.c:_netplan_g_string_free_to_file_with_permissions() was added
+and accepts the owner, group and file mode as arguments. When these
+properties can't be set, when the generator is called by a non-root user
+for example, it will not hard-fail. This function is called by unit
+tests where we can't set the owner to a privileged account for example.
+
+When generating backend files, use more restrictive permissions:
+
+networkd related files will be owned by root:systemd-network and have
+mode 0640.
+
+service unit files will be owned by root:root and have mode 0640.
+udevd files will be owned by root:root with mode 0640.
+
+wpa_supplicant and Network Manager files will continue with the existing
+permissions.
+
+Autopkgtests will check if the permissions are set as expected when
+calling the generator.
+
+This fix addresses CVE-2022-4968
+---
+ src/networkd.c                | 36 ++++--------------
+ src/networkd.h                |  2 +
+ src/nm.c                      |  4 +-
+ src/openvswitch.c             |  2 +-
+ src/sriov.c                   |  2 +-
+ src/util-internal.h           |  3 ++
+ src/util.c                    | 46 +++++++++++++++++++++++
+ tests/generator/test_auth.py  |  2 +-
+ tests/generator/test_wifis.py |  2 +-
+ tests/integration/base.py     | 85 +++++++++++++++++++++++++++++++++++++++++++
+ 10 files changed, 149 insertions(+), 35 deletions(-)
+
+diff --git a/src/networkd.c b/src/networkd.c
+index 5554c99..1677381 100644
+--- a/src/networkd.c
++++ b/src/networkd.c
+@@ -222,7 +222,6 @@ static void
+ write_link_file(const NetplanNetDefinition* def, const char* rootdir, const char* path)
+ {
+     GString* s = NULL;
+-    mode_t orig_umask;
+ 
+     /* Don't write .link files for virtual devices; they use .netdev instead.
+      * Don't write .link files for MODEM devices, as they aren't supported by networkd.
+@@ -284,9 +283,7 @@ write_link_file(const NetplanNetDefinition* def, const char* rootdir, const char
+         g_string_append_printf(s, "LargeReceiveOffload=%s\n",
+         (def->large_receive_offload ? "true" : "false"));
+ 
+-    orig_umask = umask(022);
+-    g_string_free_to_file(s, rootdir, path, ".link");
+-    umask(orig_umask);
++    _netplan_g_string_free_to_file_with_permissions(s, rootdir, path, ".link", "root", "root", 0640);
+ }
+ 
+ static gboolean
+@@ -304,7 +301,7 @@ write_regdom(const NetplanNetDefinition* def, const char* rootdir, GError** erro
+     g_string_append(s, "\n[Service]\nType=oneshot\n");
+     g_string_append_printf(s, "ExecStart="SBINDIR"/iw reg set %s\n", def->regulatory_domain);
+ 
+-    g_string_free_to_file(s, rootdir, path, NULL);
++    _netplan_g_string_free_to_file_with_permissions(s, rootdir, path, NULL, "root", "root", 0640);
+     safe_mkdir_p_dir(link);
+     if (symlink(path, link) < 0 && errno != EEXIST) {
+         // LCOV_EXCL_START
+@@ -484,7 +481,6 @@ static void
+ write_netdev_file(const NetplanNetDefinition* def, const char* rootdir, const char* path)
+ {
+     GString* s = NULL;
+-    mode_t orig_umask;
+ 
+     g_assert(def->type >= NETPLAN_DEF_TYPE_VIRTUAL);
+ 
+@@ -580,11 +576,7 @@ write_netdev_file(const NetplanNetDefinition* def, const char* rootdir, const ch
+         default: g_assert_not_reached(); // LCOV_EXCL_LINE
+     }
+ 
+-    /* these do not contain secrets and need to be readable by
+-     * systemd-networkd - LP: #1736965 */
+-    orig_umask = umask(022);
+-    g_string_free_to_file(s, rootdir, path, ".netdev");
+-    umask(orig_umask);
++    _netplan_g_string_free_to_file_with_permissions(s, rootdir, path, ".netdev", "root", NETWORKD_GROUP, 0640);
+ }
+ 
+ static void
+@@ -728,7 +720,6 @@ netplan_netdef_write_network_file(
+     g_autoptr(GString) network = NULL;
+     g_autoptr(GString) link = NULL;
+     GString* s = NULL;
+-    mode_t orig_umask;
+     gboolean is_optional = def->optional;
+ 
+     SET_OPT_OUT_PTR(has_been_written, FALSE);
+@@ -979,11 +970,7 @@ netplan_netdef_write_network_file(
+         if (network->len > 0)
+             g_string_append_printf(s, "\n[Network]\n%s", network->str);
+ 
+-        /* these do not contain secrets and need to be readable by
+-         * systemd-networkd - LP: #1736965 */
+-        orig_umask = umask(022);
+-        g_string_free_to_file(s, rootdir, path, ".network");
+-        umask(orig_umask);
++        _netplan_g_string_free_to_file_with_permissions(s, rootdir, path, ".network", "root", NETWORKD_GROUP, 0640);
+     }
+ 
+     SET_OPT_OUT_PTR(has_been_written, TRUE);
+@@ -995,7 +982,6 @@ write_rules_file(const NetplanNetDefinition* def, const char* rootdir)
+ {
+     GString* s = NULL;
+     g_autofree char* path = g_strjoin(NULL, "run/udev/rules.d/99-netplan-", def->id, ".rules", NULL);
+-    mode_t orig_umask;
+ 
+     /* do we need to write a .rules file?
+      * It's only required for reliably setting the name of a physical device
+@@ -1029,9 +1015,7 @@ write_rules_file(const NetplanNetDefinition* def, const char* rootdir)
+ 
+     g_string_append_printf(s, "NAME=\"%s\"\n", def->set_name);
+ 
+-    orig_umask = umask(022);
+-    g_string_free_to_file(s, rootdir, path, NULL);
+-    umask(orig_umask);
++    _netplan_g_string_free_to_file_with_permissions(s, rootdir, path, NULL, "root", "root", 0640);
+ }
+ 
+ static gboolean
+@@ -1180,7 +1164,6 @@ static void
+ write_wpa_unit(const NetplanNetDefinition* def, const char* rootdir)
+ {
+     g_autofree gchar *stdouth = NULL;
+-    mode_t orig_umask;
+ 
+     stdouth = systemd_escape(def->id);
+ 
+@@ -1199,9 +1182,7 @@ write_wpa_unit(const NetplanNetDefinition* def, const char* rootdir)
+     } else {
+         g_string_append(s, " -Dnl80211,wext\n");
+     }
+-    orig_umask = umask(022);
+-    g_string_free_to_file(s, rootdir, path, NULL);
+-    umask(orig_umask);
++    _netplan_g_string_free_to_file_with_permissions(s, rootdir, path, NULL, "root", "root", 0640);
+ }
+ 
+ static gboolean
+@@ -1210,7 +1191,6 @@ write_wpa_conf(const NetplanNetDefinition* def, const char* rootdir, GError** er
+     GHashTableIter iter;
+     GString* s = g_string_new("ctrl_interface=/run/wpa_supplicant\n\n");
+     g_autofree char* path = g_strjoin(NULL, "run/netplan/wpa-", def->id, ".conf", NULL);
+-    mode_t orig_umask;
+ 
+     g_debug("%s: Creating wpa_supplicant configuration file %s", def->id, path);
+     if (def->type == NETPLAN_DEF_TYPE_WIFI) {
+@@ -1299,9 +1279,7 @@ write_wpa_conf(const NetplanNetDefinition* def, const char* rootdir, GError** er
+     }
+ 
+     /* use tight permissions as this contains secrets */
+-    orig_umask = umask(077);
+-    g_string_free_to_file(s, rootdir, path, NULL);
+-    umask(orig_umask);
++    _netplan_g_string_free_to_file_with_permissions(s, rootdir, path, NULL, "root", "root", 0600);
+     return TRUE;
+ }
+ 
+diff --git a/src/networkd.h b/src/networkd.h
+index a7092b2..0214e43 100644
+--- a/src/networkd.h
++++ b/src/networkd.h
+@@ -20,6 +20,8 @@
+ #include "netplan.h"
+ #include <glib.h>
+ 
++#define NETWORKD_GROUP "systemd-network"
++
+ NETPLAN_INTERNAL gboolean
+ netplan_netdef_write_networkd(
+         const NetplanState* np_state,
+diff --git a/src/nm.c b/src/nm.c
+index 4d6f1fe..d5dad98 100644
+--- a/src/nm.c
++++ b/src/nm.c
+@@ -1149,13 +1149,13 @@ netplan_state_finish_nm_write(
+ 
+     /* write generated NetworkManager drop-in config */
+     if (nm_conf->len > 0)
+-        g_string_free_to_file(nm_conf, rootdir, "run/NetworkManager/conf.d/netplan.conf", NULL);
++        _netplan_g_string_free_to_file_with_permissions(nm_conf, rootdir, "run/NetworkManager/conf.d/netplan.conf", NULL, "root", "root", 0640);
+     else
+         g_string_free(nm_conf, TRUE);
+ 
+     /* write generated udev rules */
+     if (udev_rules->len > 0)
+-        g_string_free_to_file(udev_rules, rootdir, "run/udev/rules.d/90-netplan.rules", NULL);
++        _netplan_g_string_free_to_file_with_permissions(udev_rules, rootdir, "run/udev/rules.d/90-netplan.rules", NULL, "root", "root", 0640);
+     else
+         g_string_free(udev_rules, TRUE);
+ 
+diff --git a/src/openvswitch.c b/src/openvswitch.c
+index d4af861..276762e 100644
+--- a/src/openvswitch.c
++++ b/src/openvswitch.c
+@@ -62,7 +62,7 @@ write_ovs_systemd_unit(const char* id, const GString* cmds, const char* rootdir,
+     g_string_append(s, "\n[Service]\nType=oneshot\nTimeoutStartSec=10s\n");
+     g_string_append(s, cmds->str);
+ 
+-    g_string_free_to_file(s, rootdir, path, NULL);
++    _netplan_g_string_free_to_file_with_permissions(s, rootdir, path, NULL, "root", "root", 0640);
+ 
+     safe_mkdir_p_dir(link);
+     if (symlink(path, link) < 0 && errno != EEXIST) {
+diff --git a/src/sriov.c b/src/sriov.c
+index f8117f7..c3cd80d 100644
+--- a/src/sriov.c
++++ b/src/sriov.c
+@@ -53,7 +53,7 @@ write_sriov_rebind_systemd_unit(GHashTable* pfs, const char* rootdir, GError** e
+     g_string_truncate(interfaces, interfaces->len-1); /* cut trailing whitespace */
+     g_string_append_printf(s, "ExecStart=" SBINDIR "/netplan rebind %s\n", interfaces->str);
+ 
+-    g_string_free_to_file(s, rootdir, path, NULL);
++    _netplan_g_string_free_to_file_with_permissions(s, rootdir, path, NULL, "root", "root", 0640);
+     g_string_free(interfaces, TRUE);
+ 
+     safe_mkdir_p_dir(link);
+diff --git a/src/util-internal.h b/src/util-internal.h
+index fe41c77..b30745b 100644
+--- a/src/util-internal.h
++++ b/src/util-internal.h
+@@ -40,6 +40,9 @@ safe_mkdir_p_dir(const char* file_path);
+ NETPLAN_INTERNAL void
+ g_string_free_to_file(GString* s, const char* rootdir, const char* path, const char* suffix);
+ 
++void
++_netplan_g_string_free_to_file_with_permissions(GString* s, const char* rootdir, const char* path, const char* suffix, const char* owner, const char* group, mode_t mode);
++
+ NETPLAN_INTERNAL void
+ unlink_glob(const char* rootdir, const char* _glob);
+ 
+diff --git a/src/util.c b/src/util.c
+index cbd5ac2..edecdab 100644
+--- a/src/util.c
++++ b/src/util.c
+@@ -22,6 +22,9 @@
+ #include <errno.h>
+ #include <string.h>
+ #include <sys/mman.h>
++#include <sys/types.h>
++#include <pwd.h>
++#include <grp.h>
+ 
+ #include <glib.h>
+ #include <glib/gprintf.h>
+@@ -87,6 +90,49 @@ void g_string_free_to_file(GString* s, const char* rootdir, const char* path, co
+     }
+ }
+ 
++void _netplan_g_string_free_to_file_with_permissions(GString* s, const char* rootdir, const char* path, const char* suffix, const char* owner, const char* group, mode_t mode)
++{
++    g_autofree char* full_path = NULL;
++    g_autofree char* path_suffix = NULL;
++    g_autofree char* contents = g_string_free(s, FALSE);
++    GError* error = NULL;
++    struct passwd* pw = NULL;
++    struct group* gr = NULL;
++    int ret = 0;
++
++    path_suffix = g_strjoin(NULL, path, suffix, NULL);
++    full_path = g_build_path(G_DIR_SEPARATOR_S, rootdir ?: G_DIR_SEPARATOR_S, path_suffix, NULL);
++    safe_mkdir_p_dir(full_path);
++    if (!g_file_set_contents_full(full_path, contents, -1, G_FILE_SET_CONTENTS_CONSISTENT | G_FILE_SET_CONTENTS_ONLY_EXISTING, mode, &error)) {
++        /* the mkdir() just succeeded, there is no sensible
++         * method to test this without root privileges, bind mounts, and
++         * simulating ENOSPC */
++        // LCOV_EXCL_START
++        g_fprintf(stderr, "ERROR: cannot create file %s: %s\n", path, error->message);
++        exit(1);
++        // LCOV_EXCL_STOP
++    }
++
++    /* Here we take the owner and group names and look up for their IDs in the passwd and group files.
++     * It's OK to fail to set the owners and mode as this code will be called from unit tests.
++     * The autopkgtests will check if the owner/group and mode are correctly set.
++     */
++    pw = getpwnam(owner);
++    if (!pw) {
++        g_debug("Failed to determine the UID of user %s: %s", owner, strerror(errno)); // LCOV_EXCL_LINE
++    }
++    gr = getgrnam(group);
++    if (!gr) {
++        g_debug("Failed to determine the GID of group %s: %s", group, strerror(errno)); // LCOV_EXCL_LINE
++    }
++    if (pw && gr) {
++        ret = chown(full_path, pw->pw_uid, gr->gr_gid);
++        if (ret != 0) {
++            g_debug("Failed to set owner and group for file %s: %s", full_path, strerror(errno));
++        }
++    }
++}
++
+ /**
+  * Remove all files matching given glob.
+  */
+diff --git a/tests/generator/test_auth.py b/tests/generator/test_auth.py
+index de23adb..d3d886c 100644
+--- a/tests/generator/test_auth.py
++++ b/tests/generator/test_auth.py
+@@ -226,7 +226,7 @@ network={
+ 
+         with open(os.path.join(self.workdir.name, 'run/systemd/system/netplan-wpa-eth0.service')) as f:
+             self.assertEqual(f.read(), SD_WPA % {'iface': 'eth0', 'drivers': 'wired'})
+-            self.assertEqual(stat.S_IMODE(os.fstat(f.fileno()).st_mode), 0o644)
++            self.assertEqual(stat.S_IMODE(os.fstat(f.fileno()).st_mode), 0o640)
+         self.assertTrue(os.path.islink(os.path.join(
+             self.workdir.name, 'run/systemd/system/systemd-networkd.service.wants/netplan-wpa-eth0.service')))
+ 
+diff --git a/tests/generator/test_wifis.py b/tests/generator/test_wifis.py
+index b875172..610782a 100644
+--- a/tests/generator/test_wifis.py
++++ b/tests/generator/test_wifis.py
+@@ -140,7 +140,7 @@ network={
+             self.workdir.name, 'run/systemd/system/netplan-wpa-wl0.service')))
+         with open(os.path.join(self.workdir.name, 'run/systemd/system/netplan-wpa-wl0.service')) as f:
+             self.assertEqual(f.read(), SD_WPA % {'iface': 'wl0', 'drivers': 'nl80211,wext'})
+-            self.assertEqual(stat.S_IMODE(os.fstat(f.fileno()).st_mode), 0o644)
++            self.assertEqual(stat.S_IMODE(os.fstat(f.fileno()).st_mode), 0o640)
+         self.assertTrue(os.path.islink(os.path.join(
+             self.workdir.name, 'run/systemd/system/systemd-networkd.service.wants/netplan-wpa-wl0.service')))
+ 
+diff --git a/tests/integration/base.py b/tests/integration/base.py
+index 81e8420..948b1c5 100644
+--- a/tests/integration/base.py
++++ b/tests/integration/base.py
+@@ -32,6 +32,8 @@ import shutil
+ import gi
+ import glob
+ import json
++import pwd
++import grp
+ 
+ # make sure we point to libnetplan properly.
+ os.environ.update({'LD_LIBRARY_PATH': '.:{}'.format(os.environ.get('LD_LIBRARY_PATH'))})
+@@ -367,6 +369,89 @@ class IntegrationTestsBase(unittest.TestCase):
+             if state:
+                 self.wait_output(['ip', 'addr', 'show', iface], state, 30)
+ 
++        # Assert file permissions
++        self.assert_file_permissions()
++
++    def assert_file_permissions(self):
++        """ Check if the generated files have the expected permissions """
++
++        nd_expected_mode = 0o100640
++        nd_expected_owner = 'root'
++        nd_expected_group = 'systemd-network'
++
++        sd_expected_mode = 0o100640
++        sd_expected_owner = 'root'
++        sd_expected_group = 'root'
++
++        udev_expected_mode = 0o100640
++        udev_expected_owner = 'root'
++        udev_expected_group = 'root'
++
++        nm_expected_mode = 0o100600
++        nm_expected_owner = 'root'
++        nm_expected_group = 'root'
++
++        wpa_expected_mode = 0o100600
++        wpa_expected_owner = 'root'
++        wpa_expected_group = 'root'
++
++        # Check systemd-networkd files
++        base_path = '/run/systemd/network'
++        files = glob.glob(f'{base_path}/*.network') + glob.glob(f'{base_path}/*.netdev')
++        for file in files:
++            res = os.stat(file)
++            user = pwd.getpwuid(res.st_uid)
++            group = grp.getgrgid(res.st_gid)
++            self.assertEqual(res.st_mode, nd_expected_mode, f'file {file}')
++            self.assertEqual(user.pw_name, nd_expected_owner, f'file {file}')
++            self.assertEqual(group.gr_name, nd_expected_group, f'file {file}')
++
++        # Check Network Manager files
++        base_path = '/run/NetworkManager/system-connections'
++        files = glob.glob(f'{base_path}/*.nmconnection')
++        for file in files:
++            res = os.stat(file)
++            user = pwd.getpwuid(res.st_uid)
++            group = grp.getgrgid(res.st_gid)
++            self.assertEqual(res.st_mode, nm_expected_mode, f'file {file}')
++            self.assertEqual(user.pw_name, nm_expected_owner, f'file {file}')
++            self.assertEqual(group.gr_name, nm_expected_group, f'file {file}')
++
++        # Check wpa_supplicant configuration files
++        base_path = '/run/netplan'
++        files = glob.glob(f'{base_path}/wpa-*.conf')
++        for file in files:
++            res = os.stat(file)
++            user = pwd.getpwuid(res.st_uid)
++            group = grp.getgrgid(res.st_gid)
++            self.assertEqual(res.st_mode, wpa_expected_mode, f'file {file}')
++            self.assertEqual(user.pw_name, wpa_expected_owner, f'file {file}')
++            self.assertEqual(group.gr_name, wpa_expected_group, f'file {file}')
++
++        # Check systemd service unit files
++        base_path = '/run/systemd/system/'
++        files = glob.glob(f'{base_path}/netplan-*.service')
++        files += glob.glob(f'{base_path}/systemd-networkd-wait-online.service.d/*.conf')
++        for file in files:
++            res = os.stat(file)
++            user = pwd.getpwuid(res.st_uid)
++            group = grp.getgrgid(res.st_gid)
++            self.assertEqual(res.st_mode, sd_expected_mode, f'file {file}')
++            self.assertEqual(user.pw_name, sd_expected_owner, f'file {file}')
++            self.assertEqual(group.gr_name, sd_expected_group, f'file {file}')
++
++        # Check systemd-udevd files
++        udev_path = '/run/udev/rules.d'
++        link_path = '/run/systemd/network'
++        files = glob.glob(f'{udev_path}/*-netplan*.rules') + glob.glob(f'{link_path}/*.link')
++        for file in files:
++            res = os.stat(file)
++            user = pwd.getpwuid(res.st_uid)
++            group = grp.getgrgid(res.st_gid)
++            self.assertEqual(res.st_mode, udev_expected_mode, f'file {file}')
++            self.assertEqual(user.pw_name, udev_expected_owner, f'file {file}')
++            self.assertEqual(group.gr_name, udev_expected_group, f'file {file}')
++
+     def state(self, iface, state):
+         '''Tell generate_and_settle() to wait for a specific state'''
+         return iface + '/' + state
diff --git a/debian/patches/lp2066258/0014-libnetplan-escape-control-characters.patch b/debian/patches/lp2066258/0014-libnetplan-escape-control-characters.patch
new file mode 100644
index 0000000..d21ff90
--- /dev/null
+++ b/debian/patches/lp2066258/0014-libnetplan-escape-control-characters.patch
@@ -0,0 +1,863 @@
+From: Danilo Egea Gondolfo <[e-mail]>
+Date: Wed, 29 May 2024 14:50:55 +0100
+Subject: libnetplan: escape control characters
+
+Control characters are escaped in the parser using glib's g_strescape.
+Quotes and backslashes were added to the list of exception.
+
+In places where double quotes are not escaped, such as netdef IDs as it
+is allowed as interface names, they are escaped as needed when
+generating back end configuration.
+
+To support escaping in wpa_supplicant configuration, the syntax for
+setting the SSID was changed to 'ssid=P"string here"'. With that,
+escaping is support in a printf-style.
+---
+ src/networkd.c                 | 32 ++++++++++-----
+ src/nm.c                       | 21 ++++++----
+ src/parse.c                    | 92 +++++++++++++++++++++++++++---------------
+ src/util-internal.h            |  3 ++
+ src/util.c                     | 11 +++++
+ tests/generator/test_auth.py   | 20 ++++-----
+ tests/generator/test_common.py | 42 +++++++++++++++++--
+ tests/generator/test_wifis.py  | 78 ++++++++++++++++++++++++++---------
+ 8 files changed, 216 insertions(+), 83 deletions(-)
+
+diff --git a/src/networkd.c b/src/networkd.c
+index 1677381..ac54112 100644
+--- a/src/networkd.c
++++ b/src/networkd.c
+@@ -1005,7 +1005,8 @@ write_rules_file(const NetplanNetDefinition* def, const char* rootdir)
+     g_string_append(s, "SUBSYSTEM==\"net\", ACTION==\"add\", ");
+ 
+     if (def->match.driver) {
+-        g_string_append_printf(s,"DRIVERS==\"%s\", ", def->match.driver);
++        g_autofree char* driver = _netplan_scrub_string(def->match.driver);
++        g_string_append_printf(s,"DRIVERS==\"%s\", ", driver);
+     } else {
+         g_string_append(s, "DRIVERS==\"?*\", ");
+     }
+@@ -1013,7 +1014,8 @@ write_rules_file(const NetplanNetDefinition* def, const char* rootdir)
+     if (def->match.mac)
+         g_string_append_printf(s, "ATTR{address}==\"%s\", ", def->match.mac);
+ 
+-    g_string_append_printf(s, "NAME=\"%s\"\n", def->set_name);
++    g_autofree char* set_name = _netplan_scrub_string(def->set_name);
++    g_string_append_printf(s, "NAME=\"%s\"\n", set_name);
+ 
+     _netplan_g_string_free_to_file_with_permissions(s, rootdir, path, NULL, "root", "root", 0640);
+ }
+@@ -1101,10 +1103,12 @@ append_wpa_auth_conf(GString* s, const NetplanAuthenticationSettings* auth, cons
+     }
+ 
+     if (auth->identity) {
+-        g_string_append_printf(s, "  identity=\"%s\"\n", auth->identity);
++        g_autofree char* identity = _netplan_scrub_string(auth->identity);
++        g_string_append_printf(s, "  identity=\"%s\"\n", identity);
+     }
+     if (auth->anonymous_identity) {
+-        g_string_append_printf(s, "  anonymous_identity=\"%s\"\n", auth->anonymous_identity);
++        g_autofree char* anonymous_identity = _netplan_scrub_string(auth->anonymous_identity);
++        g_string_append_printf(s, "  anonymous_identity=\"%s\"\n", anonymous_identity);
+     }
+ 
+     char* psk = NULL;
+@@ -1142,19 +1146,23 @@ append_wpa_auth_conf(GString* s, const NetplanAuthenticationSettings* auth, cons
+         }
+     }
+     if (auth->ca_certificate) {
+-        g_string_append_printf(s, "  ca_cert=\"%s\"\n", auth->ca_certificate);
++        g_autofree char* ca_certificate = _netplan_scrub_string(auth->ca_certificate);
++        g_string_append_printf(s, "  ca_cert=\"%s\"\n", ca_certificate);
+     }
+     if (auth->client_certificate) {
+-        g_string_append_printf(s, "  client_cert=\"%s\"\n", auth->client_certificate);
++        g_autofree char* client_certificate = _netplan_scrub_string(auth->client_certificate);
++        g_string_append_printf(s, "  client_cert=\"%s\"\n", client_certificate);
+     }
+     if (auth->client_key) {
+-        g_string_append_printf(s, "  private_key=\"%s\"\n", auth->client_key);
++        g_autofree char* client_key = _netplan_scrub_string(auth->client_key);
++        g_string_append_printf(s, "  private_key=\"%s\"\n", client_key);
+     }
+     if (auth->client_key_password) {
+         g_string_append_printf(s, "  private_key_passwd=\"%s\"\n", auth->client_key_password);
+     }
+     if (auth->phase2_auth) {
+-        g_string_append_printf(s, "  phase2=\"auth=%s\"\n", auth->phase2_auth);
++        g_autofree char* phase2_auth = _netplan_scrub_string(auth->phase2_auth);
++        g_string_append_printf(s, "  phase2=\"auth=%s\"\n", phase2_auth);
+     }
+     return TRUE;
+ }
+@@ -1203,14 +1211,16 @@ write_wpa_conf(const NetplanNetDefinition* def, const char* rootdir, GError** er
+         }
+         /* available as of wpa_supplicant version 0.6.7 */
+         if (def->regulatory_domain) {
+-            g_string_append_printf(s, "country=%s\n", def->regulatory_domain);
++            g_autofree char* regdom = _netplan_scrub_string(def->regulatory_domain);
++            g_string_append_printf(s, "country=%s\n", regdom);
+         }
+         NetplanWifiAccessPoint* ap;
+         g_hash_table_iter_init(&iter, def->access_points);
+         while (g_hash_table_iter_next(&iter, NULL, (gpointer) &ap)) {
+             gchar* freq_config_str = ap->mode == NETPLAN_WIFI_MODE_ADHOC ? "frequency" : "freq_list";
++            g_autofree char* ssid = _netplan_scrub_string(ap->ssid);
+ 
+-            g_string_append_printf(s, "network={\n  ssid=\"%s\"\n", ap->ssid);
++            g_string_append_printf(s, "network={\n  ssid=P\"%s\"\n", ssid);
+             if (ap->bssid) {
+                 g_string_append_printf(s, "  bssid=%s\n", ap->bssid);
+             }
+@@ -1257,7 +1267,7 @@ write_wpa_conf(const NetplanNetDefinition* def, const char* rootdir, GError** er
+ 
+             /* wifi auth trumps netdef auth */
+             if (ap->has_auth) {
+-                if (!append_wpa_auth_conf(s, &ap->auth, ap->ssid, error)) {
++                if (!append_wpa_auth_conf(s, &ap->auth, ssid, error)) {
+                     g_string_free(s, TRUE);
+                     return FALSE;
+                 }
+diff --git a/src/nm.c b/src/nm.c
+index d5dad98..a605c38 100644
+--- a/src/nm.c
++++ b/src/nm.c
+@@ -1081,28 +1081,30 @@ netplan_state_finish_nm_write(
+         GString *tmp = NULL;
+         guint unmanaged = nd->backend == NETPLAN_BACKEND_NM ? 0 : 1;
+ 
++        g_autofree char* netdef_id = _netplan_scrub_string(nd->id);
+         /* Special case: manage or ignore any device of given type on empty "match: {}" stanza */
+         if (nd->has_match && !nd->match.driver && !nd->match.mac && !nd->match.original_name) {
+             nm_type = type_str(nd);
+             g_assert(nm_type);
+             g_string_append_printf(nm_conf, "[device-netplan.%s.%s]\nmatch-device=type:%s\n"
+                                             "managed=%d\n\n", netplan_def_type_name(nd->type),
+-                                            nd->id, nm_type, !unmanaged);
++                                            netdef_id, nm_type, !unmanaged);
+         }
+         /* Normal case: manage or ignore devices by specific udev rules */
+         else {
+             const gchar *prefix = "SUBSYSTEM==\"net\", ACTION==\"add|change|move\",";
+             const gchar *suffix = nd->backend == NETPLAN_BACKEND_NM ? " ENV{NM_UNMANAGED}=\"0\"\n" : " ENV{NM_UNMANAGED}=\"1\"\n";
+             g_string_append_printf(udev_rules, "# netplan: network.%s.%s (on NetworkManager %s)\n",
+-                                   netplan_def_type_name(nd->type), nd->id,
++                                   netplan_def_type_name(nd->type), netdef_id,
+                                    unmanaged ? "deny-list" : "allow-list");
+             /* Match by explicit interface name, if possible */
+             if (nd->set_name) {
+                 // simple case: explicit new interface name
+-                g_string_append_printf(udev_rules, "%s ENV{ID_NET_NAME}==\"%s\",%s", prefix, nd->set_name, suffix);
++                g_autofree char* set_name = _netplan_scrub_string(nd->set_name);
++                g_string_append_printf(udev_rules, "%s ENV{ID_NET_NAME}==\"%s\",%s", prefix, set_name, suffix);
+             } else if (!nd->has_match) {
+                 // simple case: explicit netplan ID is interface name
+-                g_string_append_printf(udev_rules, "%s ENV{ID_NET_NAME}==\"%s\",%s", prefix, nd->id, suffix);
++                g_string_append_printf(udev_rules, "%s ENV{ID_NET_NAME}==\"%s\",%s", prefix, netdef_id, suffix);
+             }
+             /* Also, match by explicit (new) MAC, if available */
+             if (nd->set_mac) {
+@@ -1118,9 +1120,10 @@ netplan_state_finish_nm_write(
+                 // match on original name glob
+                 // TODO: maybe support matching on multiple name globs in the future (like drivers)
+                 g_string_append(udev_rules, prefix);
+-                if (nd->match.original_name)
+-                    g_string_append_printf(udev_rules, " ENV{ID_NET_NAME}==\"%s\",", nd->match.original_name);
+-
++                if (nd->match.original_name) {
++                    g_autofree char* original_name = _netplan_scrub_string(nd->match.original_name);
++                    g_string_append_printf(udev_rules, " ENV{ID_NET_NAME}==\"%s\",", original_name);
++                }
+                 // match on (explicit) MAC address. Yes this would be unique on its own, but we
+                 // keep it within the "full match" to make the logic more comprehensible.
+                 if (nd->match.mac) {
+@@ -1138,7 +1141,9 @@ netplan_state_finish_nm_write(
+                         g_strfreev(split);
+                     } else
+                         drivers = g_strdup(nd->match.driver);
+-                    g_string_append_printf(udev_rules, " ENV{ID_NET_DRIVER}==\"%s\",", drivers);
++
++                    g_autofree char* escaped_drivers = _netplan_scrub_string(drivers);
++                    g_string_append_printf(udev_rules, " ENV{ID_NET_DRIVER}==\"%s\",", escaped_drivers);
+                     g_free(drivers);
+                 }
+                 g_string_append(udev_rules, suffix);
+diff --git a/src/parse.c b/src/parse.c
+index 143f908..9cb941a 100644
+--- a/src/parse.c
++++ b/src/parse.c
+@@ -59,6 +59,15 @@ extern NetplanState global_state;
+ 
+ NetplanParser global_parser = {0};
+ 
++/*
++ * We use g_strescape to escape control characters from the input.
++ * Besides control characters, g_strescape will also escape double quotes and backslashes.
++ * Quotes are escaped at configuration generation time as needed, as they might be part of passwords for example.
++ * Escaping backslashes in the parser affects "netplan set" as it will always escape \'s from
++ * the input and update YAMLs with all the \'s escaped again.
++*/
++static char* STRESCAPE_EXCEPTIONS = "\"\\";
++
+ static gboolean
+ insert_kv_into_hash(void *key, void *value, void *hash);
+ 
+@@ -365,7 +374,7 @@ handle_generic_str(NetplanParser* npp, yaml_node_t* node, void* entryptr, const
+     guint offset = GPOINTER_TO_UINT(data);
+     char** dest = (char**) ((void*) entryptr + offset);
+     g_free(*dest);
+-    *dest = g_strdup(scalar(node));
++    *dest = g_strescape(scalar(node), STRESCAPE_EXCEPTIONS);
+     mark_data_as_dirty(npp, dest);
+     return TRUE;
+ }
+@@ -480,22 +489,25 @@ handle_generic_map(NetplanParser *npp, yaml_node_t* node, const char* key_prefix
+         assert_type(npp, key, YAML_SCALAR_NODE);
+         assert_type(npp, value, YAML_SCALAR_NODE);
+ 
++        g_autofree char* escaped_key = g_strescape(scalar(key), STRESCAPE_EXCEPTIONS);
++        g_autofree char* escaped_value = g_strescape(scalar(value), STRESCAPE_EXCEPTIONS);
++
+         if (key_prefix && npp->null_fields) {
+             g_autofree char* full_key = NULL;
+-            full_key = g_strdup_printf("%s\t%s", key_prefix, key->data.scalar.value);
++            full_key = g_strdup_printf("%s\t%s", key_prefix, escaped_key);
+             if (g_hash_table_contains(npp->null_fields, full_key))
+                 continue;
+         }
+ 
+         char* stored_value = NULL;
+-        if (g_hash_table_lookup_extended(*map, scalar(key), NULL, (void**)&stored_value)) {
++        if (g_hash_table_lookup_extended(*map, escaped_key, NULL, (void**)&stored_value)) {
+             /* We can safely skip this if it is the exact key/value match
+              * (probably caused by multi-pass processing) */
+-            if (g_strcmp0(stored_value, scalar(value)) == 0)
++            if (g_strcmp0(stored_value, escaped_value) == 0)
+                 continue;
+-            return yaml_error(npp, node, error, "duplicate map entry '%s'", scalar(key));
++            return yaml_error(npp, node, error, "duplicate map entry '%s'", escaped_key);
+         } else
+-            g_hash_table_insert(*map, g_strdup(scalar(key)), g_strdup(scalar(value)));
++            g_hash_table_insert(*map, g_strdup(escaped_key), g_strdup(escaped_value));
+     }
+     mark_data_as_dirty(npp, map);
+ 
+@@ -518,20 +530,26 @@ handle_generic_datalist(NetplanParser *npp, yaml_node_t* node, const char* key_p
+     for (yaml_node_pair_t* entry = node->data.mapping.pairs.start; entry < node->data.mapping.pairs.top; entry++) {
+         yaml_node_t* key, *value;
+         g_autofree char* full_key = NULL;
++        g_autofree char* escaped_key = NULL;
++        g_autofree char* escaped_value = NULL;
+ 
+         key = yaml_document_get_node(&npp->doc, entry->key);
+         value = yaml_document_get_node(&npp->doc, entry->value);
+ 
+         assert_type(npp, key, YAML_SCALAR_NODE);
+         assert_type(npp, value, YAML_SCALAR_NODE);
++
++        escaped_key = g_strescape(scalar(key), STRESCAPE_EXCEPTIONS);
++        escaped_value = g_strescape(scalar(value), STRESCAPE_EXCEPTIONS);
++
+         if (npp->null_fields && key_prefix) {
+-            full_key = g_strdup_printf("%s\t%s", key_prefix, scalar(key));
++            full_key = g_strdup_printf("%s\t%s", key_prefix, escaped_key);
+             if (g_hash_table_contains(npp->null_fields, full_key))
+                 continue;
+         }
+ 
+-        g_datalist_id_set_data_full(list, g_quark_from_string(scalar(key)),
+-                                    g_strdup(scalar(value)), g_free);
++        g_datalist_id_set_data_full(list, g_quark_from_string(escaped_key),
++                                    g_strdup(escaped_value), g_free);
+     }
+     mark_data_as_dirty(npp, list);
+ 
+@@ -864,13 +882,14 @@ handle_match_driver(NetplanParser* npp, yaml_node_t* node, __unused const char*
+         for (yaml_node_item_t *iter = node->data.sequence.items.start; iter < node->data.sequence.items.top; iter++) {
+             elem = yaml_document_get_node(&npp->doc, *iter);
+             assert_type(npp, elem, YAML_SCALAR_NODE);
+-            if (g_strrstr(scalar(elem), " "))
++            g_autofree char* escaped_elem = g_strescape(scalar(elem), STRESCAPE_EXCEPTIONS);
++            if (g_strrstr(escaped_elem, " "))
+                 return yaml_error(npp, node, error, "A 'driver' glob cannot contain whitespace");
+ 
+             if (!sequence)
+-                sequence = g_string_new(scalar(elem));
++                sequence = g_string_new(escaped_elem);
+             else
+-                g_string_append_printf(sequence, "\t%s", scalar(elem)); /* tab separated */
++                g_string_append_printf(sequence, "\t%s", escaped_elem); /* tab separated */
+         }
+ 
+         if (!sequence)
+@@ -902,7 +921,7 @@ handle_auth_str(NetplanParser* npp, yaml_node_t* node, const void* data, __unuse
+     guint offset = GPOINTER_TO_UINT(data);
+     char** dest = (char**) ((void*) npp->current.auth + offset);
+     g_free(*dest);
+-    *dest = g_strdup(scalar(node));
++    *dest = g_strescape(scalar(node), STRESCAPE_EXCEPTIONS);
+     mark_data_as_dirty(npp, dest);
+     return TRUE;
+ }
+@@ -1050,7 +1069,7 @@ handle_access_point_password(NetplanParser* npp, yaml_node_t* node, __unused con
+ 
+     access_point->auth.pmf_mode = NETPLAN_AUTH_PMF_MODE_OPTIONAL;
+     g_free(access_point->auth.psk);
+-    access_point->auth.psk = g_strdup(scalar(node));
++    access_point->auth.psk = g_strescape(scalar(node), STRESCAPE_EXCEPTIONS);
+     return TRUE;
+ }
+ 
+@@ -1434,6 +1453,7 @@ handle_wifi_access_points(NetplanParser* npp, yaml_node_t* node, const char* key
+     for (yaml_node_pair_t* entry = node->data.mapping.pairs.start; entry < node->data.mapping.pairs.top; entry++) {
+         NetplanWifiAccessPoint *access_point = NULL;
+         g_autofree char* full_key = NULL;
++        g_autofree char* escaped_key = NULL;
+         yaml_node_t* key, *value;
+         const gchar* ssid;
+ 
+@@ -1442,13 +1462,15 @@ handle_wifi_access_points(NetplanParser* npp, yaml_node_t* node, const char* key
+         value = yaml_document_get_node(&npp->doc, entry->value);
+         assert_type(npp, value, YAML_MAPPING_NODE);
+ 
++        escaped_key = g_strescape(scalar(key), STRESCAPE_EXCEPTIONS);
++
+         if (key_prefix && npp->null_fields) {
+-            full_key = g_strdup_printf("%s\t%s", key_prefix, key->data.scalar.value);
++            full_key = g_strdup_printf("%s\t%s", key_prefix, escaped_key);
+             if (g_hash_table_contains(npp->null_fields, full_key))
+                 continue;
+         }
+ 
+-        ssid = scalar(key);
++        ssid = escaped_key;
+ 
+         /*
+          * Delete the access-point if it already exists in the netdef and let the new
+@@ -1606,15 +1628,16 @@ handle_nameservers_search(NetplanParser* npp, yaml_node_t* node, __unused const
+     for (yaml_node_item_t *i = node->data.sequence.items.start; i < node->data.sequence.items.top; i++) {
+         yaml_node_t *entry = yaml_document_get_node(&npp->doc, *i);
+         assert_type(npp, entry, YAML_SCALAR_NODE);
++        g_autofree char* escaped_entry = g_strescape(scalar(entry), STRESCAPE_EXCEPTIONS);
+ 
+         if (!npp->current.netdef->search_domains)
+             npp->current.netdef->search_domains = g_array_new(FALSE, FALSE, sizeof(char*));
+ 
+-        if (!is_string_in_array(npp->current.netdef->search_domains, scalar(entry))) {
+-            char* s = g_strdup(scalar(entry));
++        if (!is_string_in_array(npp->current.netdef->search_domains, escaped_entry)) {
++            char* s = g_strdup(escaped_entry);
+             g_array_append_val(npp->current.netdef->search_domains, s);
+         } else {
+-            g_debug("%s: Search domain '%s' has already been added", npp->current.netdef->id, scalar(entry));
++            g_debug("%s: Search domain '%s' has already been added", npp->current.netdef->id, escaped_entry);
+         }
+     }
+     mark_data_as_dirty(npp, &npp->current.netdef->search_domains);
+@@ -2721,19 +2744,19 @@ handle_ovs_bridge_controller_addresses(NetplanParser* npp, yaml_node_t* node, __
+ 
+         /* Format: [p]unix:file */
+         if (is_unix && vec[1] != NULL && vec[2] == NULL) {
+-            char* s = g_strdup(scalar(entry));
++            char* s = g_strescape(scalar(entry), STRESCAPE_EXCEPTIONS);
+             g_array_append_val(npp->current.netdef->ovs_settings.controller.addresses, s);
+             g_strfreev(vec);
+             continue;
+         /* Format tcp:host[:port] or ssl:host[:port] */
+         } else if (is_host && validate_ovs_target(TRUE, vec[1])) {
+-            char* s = g_strdup(scalar(entry));
++            char* s = g_strescape(scalar(entry), STRESCAPE_EXCEPTIONS);
+             g_array_append_val(npp->current.netdef->ovs_settings.controller.addresses, s);
+             g_strfreev(vec);
+             continue;
+         /* Format ptcp:[port][:host] or pssl:[port][:host] */
+         } else if (is_port && validate_ovs_target(FALSE, vec[1])) {
+-            char* s = g_strdup(scalar(entry));
++            char* s = g_strescape(scalar(entry), STRESCAPE_EXCEPTIONS);
+             g_array_append_val(npp->current.netdef->ovs_settings.controller.addresses, s);
+             g_strfreev(vec);
+             continue;
+@@ -3045,6 +3068,8 @@ handle_network_ovs_settings_global_ports(NetplanParser* npp, yaml_node_t* node,
+     NetplanNetDefinition *component2 = NULL;
+ 
+     for (yaml_node_item_t *iter = node->data.sequence.items.start; iter < node->data.sequence.items.top; iter++) {
++        g_autofree char* escaped_port = NULL;
++        g_autofree char* escaped_peer = NULL;
+         pair = yaml_document_get_node(&npp->doc, *iter);
+         assert_type(npp, pair, YAML_SEQUENCE_NODE);
+ 
+@@ -3059,11 +3084,14 @@ handle_network_ovs_settings_global_ports(NetplanParser* npp, yaml_node_t* node,
+         peer = yaml_document_get_node(&npp->doc, *(item+1));
+         assert_type(npp, peer, YAML_SCALAR_NODE);
+ 
++        escaped_port = g_strescape(scalar(port), STRESCAPE_EXCEPTIONS);
++        escaped_peer = g_strescape(scalar(peer), STRESCAPE_EXCEPTIONS);
++
+         /* Create port 1 netdef */
+-        component1 = npp->parsed_defs ? g_hash_table_lookup(npp->parsed_defs, scalar(port)) : NULL;
++        component1 = npp->parsed_defs ? g_hash_table_lookup(npp->parsed_defs, escaped_port) : NULL;
+         if (!component1) {
+-            component1 = netplan_netdef_new(npp, scalar(port), NETPLAN_DEF_TYPE_PORT, NETPLAN_BACKEND_OVS);
+-            if (g_hash_table_remove(npp->missing_id, scalar(port)))
++            component1 = netplan_netdef_new(npp, escaped_port, NETPLAN_DEF_TYPE_PORT, NETPLAN_BACKEND_OVS);
++            if (g_hash_table_remove(npp->missing_id, escaped_port))
+                 npp->missing_ids_found++;
+         }
+ 
+@@ -3074,15 +3102,15 @@ handle_network_ovs_settings_global_ports(NetplanParser* npp, yaml_node_t* node,
+             component1->filepath = g_strdup(npp->current.filepath);
+         }
+ 
+-        if (component1->peer && g_strcmp0(component1->peer, scalar(peer)))
++        if (component1->peer && g_strcmp0(component1->peer, escaped_peer))
+             return yaml_error(npp, port, error, "Open vSwitch port '%s' is already assigned to peer '%s'",
+                               component1->id, component1->peer);
+ 
+         /* Create port 2 (peer) netdef */
+-        component2 = npp->parsed_defs ? g_hash_table_lookup(npp->parsed_defs, scalar(peer)) : NULL;
++        component2 = npp->parsed_defs ? g_hash_table_lookup(npp->parsed_defs, escaped_peer) : NULL;
+         if (!component2) {
+-            component2 = netplan_netdef_new(npp, scalar(peer), NETPLAN_DEF_TYPE_PORT, NETPLAN_BACKEND_OVS);
+-            if (g_hash_table_remove(npp->missing_id, scalar(peer)))
++            component2 = netplan_netdef_new(npp, escaped_peer, NETPLAN_DEF_TYPE_PORT, NETPLAN_BACKEND_OVS);
++            if (g_hash_table_remove(npp->missing_id, escaped_peer))
+                 npp->missing_ids_found++;
+         }
+ 
+@@ -3093,16 +3121,16 @@ handle_network_ovs_settings_global_ports(NetplanParser* npp, yaml_node_t* node,
+             component2->filepath = g_strdup(npp->current.filepath);
+         }
+ 
+-        if (component2->peer && g_strcmp0(component2->peer, scalar(port)))
++        if (component2->peer && g_strcmp0(component2->peer, escaped_port))
+             return yaml_error(npp, peer, error, "Open vSwitch port '%s' is already assigned to peer '%s'",
+                               component2->id, component2->peer);
+ 
+         if (!component1->peer) {
+-            component1->peer = g_strdup(scalar(peer));
++            component1->peer = g_strdup(escaped_peer);
+             component1->peer_link = component2;
+         }
+         if (!component2->peer) {
+-            component2->peer = g_strdup(scalar(port));
++            component2->peer = g_strdup(escaped_port);
+             component2->peer_link = component1;
+         }
+     }
+diff --git a/src/util-internal.h b/src/util-internal.h
+index b30745b..f6f36fc 100644
+--- a/src/util-internal.h
++++ b/src/util-internal.h
+@@ -182,3 +182,6 @@ _netplan_netdef_pertype_iter_next(struct netdef_pertype_iter* it);
+ 
+ NETPLAN_INTERNAL void
+ _netplan_netdef_pertype_iter_free(struct netdef_pertype_iter* it);
++
++gchar*
++_netplan_scrub_string(const char* content);
+diff --git a/src/util.c b/src/util.c
+index edecdab..d8d3a57 100644
+--- a/src/util.c
++++ b/src/util.c
+@@ -1223,3 +1223,14 @@ _is_auth_key_management_psk(const NetplanAuthenticationSettings* auth)
+     return (   auth->key_management == NETPLAN_AUTH_KEY_MANAGEMENT_WPA_PSK
+             || auth->key_management == NETPLAN_AUTH_KEY_MANAGEMENT_WPA_SAE);
+ }
++
++gchar*
++_netplan_scrub_string(const char* content)
++{
++    GString* s = g_string_new(content);
++
++    // Escape double quotes
++    g_string_replace(s, "\"", "\\\"", 0);
++
++    return g_string_free(s, FALSE);
++}
+diff --git a/tests/generator/test_auth.py b/tests/generator/test_auth.py
+index d3d886c..bf0108a 100644
+--- a/tests/generator/test_auth.py
++++ b/tests/generator/test_auth.py
+@@ -92,21 +92,21 @@ class TestNetworkd(TestBase):
+             self.assertIn('ctrl_interface=/run/wpa_supplicant', new_config)
+             self.assertIn('''
+ network={
+-  ssid="peer2peer"
++  ssid=P"peer2peer"
+   mode=1
+   key_mgmt=NONE
+ }
+ ''', new_config)
+             self.assertIn('''
+ network={
+-  ssid="Luke's Home"
++  ssid=P"Luke's Home"
+   key_mgmt=WPA-PSK
+   psk="4lsos3kr1t"
+ }
+ ''', new_config)
+             self.assertIn('''
+ network={
+-  ssid="BobsHome"
++  ssid=P"BobsHome"
+   key_mgmt=WPA-PSK WPA-PSK-SHA256 SAE
+   ieee80211w=1
+   psk=e03ce667c87bc81ca968d9120ca37f89eb09aec3c55b80386e5d772efd6b926e
+@@ -114,14 +114,14 @@ network={
+ ''', new_config)
+             self.assertIn('''
+ network={
+-  ssid="BillsHome"
++  ssid=P"BillsHome"
+   key_mgmt=WPA-PSK
+   psk=db3b0acf5653aeaddd5fe034fb9f07175b2864f847b005aaa2f09182d9411b04
+ }
+ ''', new_config)
+             self.assertIn('''
+ network={
+-  ssid="workplace2"
++  ssid=P"workplace2"
+   key_mgmt=WPA-EAP
+   eap=PEAP
+   identity="[e-mail]"
+@@ -131,7 +131,7 @@ network={
+ ''', new_config)
+             self.assertIn('''
+ network={
+-  ssid="workplace"
++  ssid=P"workplace"
+   key_mgmt=WPA-EAP
+   eap=TTLS
+   identity="[e-mail]"
+@@ -141,7 +141,7 @@ network={
+ ''', new_config)
+             self.assertIn('''
+ network={
+-  ssid="workplacehashed"
++  ssid=P"workplacehashed"
+   key_mgmt=WPA-EAP
+   eap=TTLS
+   identity="[e-mail]"
+@@ -151,7 +151,7 @@ network={
+ ''', new_config)
+             self.assertIn('''
+ network={
+-  ssid="customernet"
++  ssid=P"customernet"
+   key_mgmt=WPA-EAP
+   eap=TLS
+   identity="[e-mail]"
+@@ -164,13 +164,13 @@ network={
+ ''', new_config)
+             self.assertIn('''
+ network={
+-  ssid="opennet"
++  ssid=P"opennet"
+   key_mgmt=NONE
+ }
+ ''', new_config)
+             self.assertIn('''
+ network={
+-  ssid="Joe's Home"
++  ssid=P"Joe's Home"
+   key_mgmt=WPA-PSK WPA-PSK-SHA256 SAE
+   ieee80211w=1
+   psk="s0s3kr1t"
+diff --git a/tests/generator/test_common.py b/tests/generator/test_common.py
+index 785f6f4..3aab3f7 100644
+--- a/tests/generator/test_common.py
++++ b/tests/generator/test_common.py
+@@ -19,7 +19,7 @@
+ import os
+ import textwrap
+ 
+-from .base import TestBase, ND_DHCP4, ND_DHCP6, ND_DHCPYES, ND_EMPTY, NM_MANAGED, NM_UNMANAGED
++from .base import UDEV_NO_MAC_RULE, TestBase, ND_DHCP4, ND_DHCP6, ND_DHCPYES, ND_EMPTY, NM_MANAGED, NM_UNMANAGED
+ 
+ 
+ class TestNetworkd(TestBase):
+@@ -815,6 +815,18 @@ RouteMetric=100
+ UseMTU=true
+ '''})
+ 
++    def test_nd_udev_rules_escaped(self):
++        self.generate('''network:
++  version: 2
++  renderer: NetworkManager
++  ethernets:
++    def1:
++      match:
++        driver: "abc\\"xyz\\n0\\n\\n1"
++      set-name: "eth\\"\\n\\nxyz\\n0"''', skip_generated_yaml_validation=True)
++
++        self.assert_networkd_udev({'def1.rules': (UDEV_NO_MAC_RULE % ('abc\\"xyz\\n0\\n\\n1', 'eth\\"\\n\\nxyz\\n0'))})
++
+ 
+ class TestNetworkManager(TestBase):
+ 
+@@ -1320,6 +1332,28 @@ dns=8.8.8.8;
+ method=ignore
+ '''})
+ 
++    def test_nm_udev_rules_escaped(self):
++        self.generate('''network:
++  version: 2
++  renderer: networkd
++  ethernets:
++    eth0:
++      match:
++        name: "eth\\"0"
++      dhcp4: true''')
++        self.assert_nm_udev(NM_UNMANAGED % 'eth\\"0')
++
++        self.generate('''network:
++  version: 2
++  renderer: networkd
++  ethernets:
++    eth0:
++      match:
++        name: "eth0"
++      set-name: "eth\\n0"
++      dhcp4: true''', skip_generated_yaml_validation=True)
++        self.assert_nm_udev(NM_UNMANAGED % 'eth\\n0' + NM_UNMANAGED % 'eth0')
++
+ 
+ class TestForwardDeclaration(TestBase):
+ 
+@@ -1782,13 +1816,13 @@ LinkLocalAddressing=ipv6
+         self.assert_wpa_supplicant("wlan0", """ctrl_interface=/run/wpa_supplicant
+ 
+ network={
+-  ssid="mynewwifi"
++  ssid=P"mynewwifi"
+   key_mgmt=WPA-PSK WPA-PSK-SHA256 SAE
+   ieee80211w=1
+   psk="aaaaaaaa"
+ }
+ network={
+-  ssid="mywifi"
++  ssid=P"mywifi"
+   key_mgmt=WPA-PSK WPA-PSK-SHA256 SAE
+   ieee80211w=1
+   psk="aaaaaaaa"
+@@ -1819,7 +1853,7 @@ network={
+         self.assert_wpa_supplicant("wlan0", """ctrl_interface=/run/wpa_supplicant
+ 
+ network={
+-  ssid="mywifi"
++  ssid=P"mywifi"
+   key_mgmt=WPA-PSK WPA-PSK-SHA256 SAE
+   ieee80211w=1
+   psk="bbbbbbbb"
+diff --git a/tests/generator/test_wifis.py b/tests/generator/test_wifis.py
+index 610782a..9f7359b 100644
+--- a/tests/generator/test_wifis.py
++++ b/tests/generator/test_wifis.py
+@@ -65,7 +65,7 @@ class TestNetworkd(TestBase):
+         with open(os.path.join(self.workdir.name, 'run/netplan/wpa-wl0.conf')) as f:
+             new_config = f.read()
+ 
+-            network = 'ssid="{}"\n  freq_list='.format('band-no-channel2')
++            network = 'ssid=P"{}"\n  freq_list='.format('band-no-channel2')
+             freqs_5GHz = [5610, 5310, 5620, 5320, 5630, 5640, 5340, 5035, 5040, 5045, 5055, 5060, 5660, 5680, 5670, 5080, 5690,
+                           5700, 5710, 5720, 5825, 5745, 5755, 5805, 5765, 5160, 5775, 5170, 5480, 5180, 5795, 5190, 5500, 5200,
+                           5510, 5210, 5520, 5220, 5530, 5230, 5540, 5240, 5550, 5250, 5560, 5260, 5570, 5270, 5580, 5280, 5590,
+@@ -76,7 +76,7 @@ class TestNetworkd(TestBase):
+             for freq in freqs_5GHz:
+                 self.assertRegex(new_config, '{}[ 0-9]*{}[ 0-9]*\n'.format(network, freq))
+ 
+-            network = 'ssid="{}"\n  freq_list='.format('band-no-channel')
++            network = 'ssid=P"{}"\n  freq_list='.format('band-no-channel')
+             freqs_24GHz = [2412, 2417, 2422, 2427, 2432, 2442, 2447, 2437, 2452, 2457, 2462, 2467, 2472, 2484]
+             freqs = new_config.split(network)
+             freqs = freqs[1].split('\n')[0]
+@@ -86,20 +86,20 @@ class TestNetworkd(TestBase):
+ 
+             self.assertIn('''
+ network={
+-  ssid="channel-no-band"
++  ssid=P"channel-no-band"
+   key_mgmt=NONE
+ }
+ ''', new_config)
+             self.assertIn('''
+ network={
+-  ssid="peer2peer"
++  ssid=P"peer2peer"
+   mode=1
+   key_mgmt=NONE
+ }
+ ''', new_config)
+             self.assertIn('''
+ network={
+-  ssid="hidden-y"
++  ssid=P"hidden-y"
+   scan_ssid=1
+   key_mgmt=WPA-PSK WPA-PSK-SHA256 SAE
+   ieee80211w=1
+@@ -108,7 +108,7 @@ network={
+ ''', new_config)
+             self.assertIn('''
+ network={
+-  ssid="hidden-n"
++  ssid=P"hidden-n"
+   key_mgmt=WPA-PSK WPA-PSK-SHA256 SAE
+   ieee80211w=1
+   psk="5ecur1ty"
+@@ -116,7 +116,7 @@ network={
+ ''', new_config)
+             self.assertIn('''
+ network={
+-  ssid="workplace"
++  ssid=P"workplace"
+   bssid=de:ad:be:ef:ca:fe
+   freq_list=5500
+   key_mgmt=WPA-PSK WPA-PSK-SHA256 SAE
+@@ -126,7 +126,7 @@ network={
+ ''', new_config)
+             self.assertIn('''
+ network={
+-  ssid="Joe's Home"
++  ssid=P"Joe's Home"
+   bssid=00:11:22:33:44:55
+   freq_list=2462
+   key_mgmt=WPA-PSK WPA-PSK-SHA256 SAE
+@@ -303,7 +303,7 @@ LinkLocalAddressing=ipv6
+             self.assertIn('''
+ wowlan_triggers=any disconnect magic_pkt gtk_rekey_failure eap_identity_req four_way_handshake rfkill_release
+ network={
+-  ssid="homenet"
++  ssid=P"homenet"
+   key_mgmt=NONE
+ }
+ ''', new_config)
+@@ -336,7 +336,7 @@ LinkLocalAddressing=ipv6
+             new_config = f.read()
+             self.assertIn('''
+ network={
+-  ssid="homenet"
++  ssid=P"homenet"
+   key_mgmt=NONE
+ }
+ ''', new_config)
+@@ -360,7 +360,7 @@ network={
+         self.assert_wpa_supplicant("wl0", """ctrl_interface=/run/wpa_supplicant
+ 
+ network={
+-  ssid="homenet"
++  ssid=P"homenet"
+   key_mgmt=SAE
+   ieee80211w=2
+   psk="********"
+@@ -387,7 +387,7 @@ network={
+         self.assert_wpa_supplicant("wl0", """ctrl_interface=/run/wpa_supplicant
+ 
+ network={
+-  ssid="homenet"
++  ssid=P"homenet"
+   key_mgmt=WPA-EAP WPA-EAP-SHA256
+   eap=TLS
+   ieee80211w=1
+@@ -420,7 +420,7 @@ network={
+         self.assert_wpa_supplicant("wl0", """ctrl_interface=/run/wpa_supplicant
+ 
+ network={
+-  ssid="homenet"
++  ssid=P"homenet"
+   key_mgmt=WPA-EAP-SUITE-B-192
+   eap=TLS
+   ieee80211w=2
+@@ -449,7 +449,7 @@ network={
+         self.assert_wpa_supplicant("wl0", """ctrl_interface=/run/wpa_supplicant
+ 
+ network={
+-  ssid="homenet"
++  ssid=P"homenet"
+   key_mgmt=IEEE8021X
+   eap=LEAP
+   identity="some-id"
+@@ -473,7 +473,7 @@ network={
+         self.assert_wpa_supplicant("wl0", """ctrl_interface=/run/wpa_supplicant
+ 
+ network={
+-  ssid="homenet"
++  ssid=P"homenet"
+   key_mgmt=IEEE8021X
+   eap=PWD
+   identity="some-id"
+@@ -498,7 +498,7 @@ network={
+         self.assert_wpa_supplicant("wl0", """ctrl_interface=/run/wpa_supplicant
+ 
+ network={
+-  ssid="homenet"
++  ssid=P"homenet"
+   key_mgmt=WPA-EAP
+   eap=LEAP
+   ieee80211w=1
+@@ -508,6 +508,48 @@ network={
+ }
+ """)
+ 
++    def test_escaping_special_characters(self):
++        self.generate('''network:
++  version: 2
++  wifis:
++    wl0:
++      regulatory-domain: "abc\\n\\n321\\n\\"123"
++      access-points:
++        "abc\\n\\n123\\"x\\ry\\bz":
++          password:  "abc\\n\\n\\n\\"123"
++          auth:
++            key-management: eap
++            method: leap
++            anonymous-identity: "abc\\n\\n321\\n\\"123"
++            identity: "abc\\n\\n321\\n\\"123"
++            password: "abc\\n\\n\\n\\"123"
++            ca-certificate: "abc\\n\\n321\\n\\"123"
++            client-certificate: "abc\\n\\n321\\n\\"123"
++            client-key: "abc\\n\\n321\\n\\"123"
++            client-key-password: "abc\\n\\n321\\n\\"123"
++            phase2-auth: "abc\\n\\n321\\n\\"123"
++            ''', skip_generated_yaml_validation=True)
++
++        self.assert_wpa_supplicant("wl0", """ctrl_interface=/run/wpa_supplicant
++
++country=abc\\n\\n321\\n\\"123
++network={
++  ssid=P"abc\\n\\n123\\\"x\\ry\\bz"
++  key_mgmt=WPA-EAP
++  eap=LEAP
++  ieee80211w=1
++  identity="abc\\n\\n321\\n\\\"123"
++  anonymous_identity="abc\\n\\n321\\n\\\"123"
++  psk="abc\\n\\n\\n\"123"
++  password="abc\\n\\n\\n\"123"
++  ca_cert="abc\\n\\n321\\n\\\"123"
++  client_cert="abc\\n\\n321\\n\\\"123"
++  private_key="abc\\n\\n321\\n\\\"123"
++  private_key_passwd="abc\\n\\n321\\n\"123"
++  phase2="auth=abc\\n\\n321\\n\\\"123"
++}
++""")
++
+ 
+ class TestNetworkManager(TestBase):
+ 
+@@ -790,7 +832,7 @@ mode=adhoc
+         self.assert_wpa_supplicant("wl0", """ctrl_interface=/run/wpa_supplicant
+ 
+ network={
+-  ssid="homenet"
++  ssid=P"homenet"
+   frequency=2442
+   mode=1
+   key_mgmt=WPA-PSK WPA-PSK-SHA256 SAE
+@@ -814,7 +856,7 @@ network={
+         self.assert_wpa_supplicant("wl0", """ctrl_interface=/run/wpa_supplicant
+ 
+ network={
+-  ssid="homenet"
++  ssid=P"homenet"
+   frequency=5035
+   mode=1
+   key_mgmt=WPA-PSK WPA-PSK-SHA256 SAE
diff --git a/debian/patches/lp2066258/0015-backends-escape-file-paths.patch b/debian/patches/lp2066258/0015-backends-escape-file-paths.patch
new file mode 100644
index 0000000..606381e
--- /dev/null
+++ b/debian/patches/lp2066258/0015-backends-escape-file-paths.patch
@@ -0,0 +1,288 @@
+From: Danilo Egea Gondolfo <[e-mail]>
+Date: Thu, 23 May 2024 15:54:43 +0100
+Subject: backends: escape file paths
+
+Escape strings used to build paths with g_uri_escape_string().
+systemd_escape() could also be used but it has the downside of calling
+an external program and, by default, it escapes dashes (which are
+present in files generated from Network Manager for example).
+---
+ src/networkd.c                 | 13 +++++----
+ src/nm.c                       |  5 ++--
+ src/openvswitch.c              | 19 ++++++------
+ src/util.c                     |  7 +++--
+ tests/generator/test_common.py | 66 ++++++++++++++++++++++++++++++++++++++++++
+ tests/generator/test_ovs.py    | 24 +++++++++++++++
+ 6 files changed, 115 insertions(+), 19 deletions(-)
+
+diff --git a/src/networkd.c b/src/networkd.c
+index ac54112..e66ab4c 100644
+--- a/src/networkd.c
++++ b/src/networkd.c
+@@ -981,7 +981,8 @@ static void
+ write_rules_file(const NetplanNetDefinition* def, const char* rootdir)
+ {
+     GString* s = NULL;
+-    g_autofree char* path = g_strjoin(NULL, "run/udev/rules.d/99-netplan-", def->id, ".rules", NULL);
++    g_autofree char* escaped_netdef_id = g_uri_escape_string(def->id, NULL, TRUE);
++    g_autofree char* path = g_strjoin(NULL, "run/udev/rules.d/99-netplan-", escaped_netdef_id, ".rules", NULL);
+ 
+     /* do we need to write a .rules file?
+      * It's only required for reliably setting the name of a physical device
+@@ -1198,7 +1199,8 @@ write_wpa_conf(const NetplanNetDefinition* def, const char* rootdir, GError** er
+ {
+     GHashTableIter iter;
+     GString* s = g_string_new("ctrl_interface=/run/wpa_supplicant\n\n");
+-    g_autofree char* path = g_strjoin(NULL, "run/netplan/wpa-", def->id, ".conf", NULL);
++    g_autofree char* escaped_netdef_id = g_uri_escape_string(def->id, NULL, TRUE);
++    g_autofree char* path = g_strjoin(NULL, "run/netplan/wpa-", escaped_netdef_id, ".conf", NULL);
+ 
+     g_debug("%s: Creating wpa_supplicant configuration file %s", def->id, path);
+     if (def->type == NETPLAN_DEF_TYPE_WIFI) {
+@@ -1310,7 +1312,8 @@ netplan_netdef_write_networkd(
+         GError** error)
+ {
+     /* TODO: make use of netplan_netdef_get_output_filename() */
+-    g_autofree char* path_base = g_strjoin(NULL, "run/systemd/network/10-netplan-", def->id, NULL);
++    g_autofree char* escaped_netdef_id = g_uri_escape_string(def->id, NULL, TRUE);
++    g_autofree char* path_base = g_strjoin(NULL, "run/systemd/network/10-netplan-", escaped_netdef_id, NULL);
+     SET_OPT_OUT_PTR(has_been_written, FALSE);
+ 
+     /* We want this for all backends when renaming, as *.link and *.rules files are
+@@ -1332,8 +1335,8 @@ netplan_netdef_write_networkd(
+     }
+ 
+     if (def->type == NETPLAN_DEF_TYPE_WIFI || def->has_auth) {
+-        g_autofree char* link = g_strjoin(NULL, rootdir ?: "", "/run/systemd/system/systemd-networkd.service.wants/netplan-wpa-", def->id, ".service", NULL);
+-        g_autofree char* slink = g_strjoin(NULL, "/run/systemd/system/netplan-wpa-", def->id, ".service", NULL);
++        g_autofree char* link = g_strjoin(NULL, rootdir ?: "", "/run/systemd/system/systemd-networkd.service.wants/netplan-wpa-", escaped_netdef_id, ".service", NULL);
++        g_autofree char* slink = g_strjoin(NULL, "/run/systemd/system/netplan-wpa-", escaped_netdef_id, ".service", NULL);
+         if (def->type == NETPLAN_DEF_TYPE_WIFI && def->has_match) {
+             g_set_error(error, NETPLAN_BACKEND_ERROR, NETPLAN_ERROR_UNSUPPORTED, "ERROR: %s: networkd backend does not support wifi with match:, only by interface name\n", def->id);
+             return FALSE;
+diff --git a/src/nm.c b/src/nm.c
+index a605c38..380b7fd 100644
+--- a/src/nm.c
++++ b/src/nm.c
+@@ -931,10 +931,11 @@ write_nm_conf_access_point(const NetplanNetDefinition* def, const char* rootdir,
+         g_datalist_foreach((GData**)&def->backend_settings.passthrough, write_fallback_key_value, kf);
+     }
+ 
++    g_autofree char* escaped_netdef_id = g_uri_escape_string(def->id, NULL, TRUE);
+     if (ap) {
+         g_autofree char* escaped_ssid = g_uri_escape_string(ap->ssid, NULL, TRUE);
+         /* TODO: make use of netplan_netdef_get_output_filename() */
+-        conf_path = g_strjoin(NULL, "run/NetworkManager/system-connections/netplan-", def->id, "-", escaped_ssid, ".nmconnection", NULL);
++        conf_path = g_strjoin(NULL, "run/NetworkManager/system-connections/netplan-", escaped_netdef_id, "-", escaped_ssid, ".nmconnection", NULL);
+ 
+         g_key_file_set_string(kf, "wifi", "ssid", ap->ssid);
+         if (ap->mode < NETPLAN_WIFI_MODE_OTHER)
+@@ -969,7 +970,7 @@ write_nm_conf_access_point(const NetplanNetDefinition* def, const char* rootdir,
+         }
+     } else {
+         /* TODO: make use of netplan_netdef_get_output_filename() */
+-        conf_path = g_strjoin(NULL, "run/NetworkManager/system-connections/netplan-", def->id, ".nmconnection", NULL);
++        conf_path = g_strjoin(NULL, "run/NetworkManager/system-connections/netplan-", escaped_netdef_id, ".nmconnection", NULL);
+         if (def->has_auth) {
+             write_dot1x_auth_parameters(&def->auth, kf);
+         }
+diff --git a/src/openvswitch.c b/src/openvswitch.c
+index 276762e..b33769d 100644
+--- a/src/openvswitch.c
++++ b/src/openvswitch.c
+@@ -32,9 +32,9 @@
+ static gboolean
+ write_ovs_systemd_unit(const char* id, const GString* cmds, const char* rootdir, gboolean physical, gboolean cleanup, const char* dependency, GError** error)
+ {
+-    g_autofree gchar* id_escaped = NULL;
+-    g_autofree char* link = g_strjoin(NULL, rootdir ?: "", "/run/systemd/system/systemd-networkd.service.wants/netplan-ovs-", id, ".service", NULL);
+-    g_autofree char* path = g_strjoin(NULL, "/run/systemd/system/netplan-ovs-", id, ".service", NULL);
++    g_autofree char* escaped_netdef_id = g_uri_escape_string(id, NULL, TRUE);
++    g_autofree char* link = g_strjoin(NULL, rootdir ?: "", "/run/systemd/system/systemd-networkd.service.wants/netplan-ovs-", escaped_netdef_id, ".service", NULL);
++    g_autofree char* path = g_strjoin(NULL, "/run/systemd/system/netplan-ovs-", escaped_netdef_id, ".service", NULL);
+ 
+     GString* s = g_string_new("[Unit]\n");
+     g_string_append_printf(s, "Description=OpenVSwitch configuration for %s\n", id);
+@@ -43,9 +43,8 @@ write_ovs_systemd_unit(const char* id, const GString* cmds, const char* rootdir,
+     g_string_append_printf(s, "Wants=ovsdb-server.service\n");
+     g_string_append_printf(s, "After=ovsdb-server.service\n");
+     if (physical) {
+-        id_escaped = systemd_escape((char*) id);
+-        g_string_append_printf(s, "Requires=sys-subsystem-net-devices-%s.device\n", id_escaped);
+-        g_string_append_printf(s, "After=sys-subsystem-net-devices-%s.device\n", id_escaped);
++        g_string_append_printf(s, "Requires=sys-subsystem-net-devices-%s.device\n", escaped_netdef_id);
++        g_string_append_printf(s, "After=sys-subsystem-net-devices-%s.device\n", escaped_netdef_id);
+     }
+     if (!cleanup) {
+         g_string_append_printf(s, "After=netplan-ovs-cleanup.service\n");
+@@ -55,8 +54,9 @@ write_ovs_systemd_unit(const char* id, const GString* cmds, const char* rootdir,
+     }
+     g_string_append(s, "Before=network.target\nWants=network.target\n");
+     if (dependency) {
+-        g_string_append_printf(s, "Requires=netplan-ovs-%s.service\n", dependency);
+-        g_string_append_printf(s, "After=netplan-ovs-%s.service\n", dependency);
++        g_autofree char* escaped_dependency = g_uri_escape_string(dependency, NULL, TRUE);
++        g_string_append_printf(s, "Requires=netplan-ovs-%s.service\n", escaped_dependency);
++        g_string_append_printf(s, "After=netplan-ovs-%s.service\n", escaped_dependency);
+     }
+ 
+     g_string_append(s, "\n[Service]\nType=oneshot\nTimeoutStartSec=10s\n");
+@@ -321,6 +321,7 @@ netplan_netdef_write_ovs(const NetplanState* np_state, const NetplanNetDefinitio
+     gchar* dependency = NULL;
+     const char* type = netplan_type_to_table_name(def->type);
+     g_autofree char* base_config_path = NULL;
++    g_autofree char* escaped_netdef_id = g_uri_escape_string(def->id, NULL, TRUE);
+     char* value = NULL;
+     const NetplanOVSSettings* settings = &np_state->ovs_settings;
+ 
+@@ -411,7 +412,7 @@ netplan_netdef_write_ovs(const NetplanState* np_state, const NetplanNetDefinitio
+ 
+         /* Try writing out a base config */
+         /* TODO: make use of netplan_netdef_get_output_filename() */
+-        base_config_path = g_strjoin(NULL, "run/systemd/network/10-netplan-", def->id, NULL);
++        base_config_path = g_strjoin(NULL, "run/systemd/network/10-netplan-", escaped_netdef_id, NULL);
+         if (!netplan_netdef_write_network_file(np_state, def, rootdir, base_config_path, has_been_written, error))
+             return FALSE;
+     } else {
+diff --git a/src/util.c b/src/util.c
+index d8d3a57..a3dae98 100644
+--- a/src/util.c
++++ b/src/util.c
+@@ -691,17 +691,18 @@ ssize_t
+ netplan_netdef_get_output_filename(const NetplanNetDefinition* netdef, const char* ssid, char* out_buffer, size_t out_buf_size)
+ {
+     g_autofree gchar* conf_path = NULL;
++    g_autofree char* escaped_netdef_id = g_uri_escape_string(netdef->id, NULL, TRUE);
+ 
+     if (netdef->backend == NETPLAN_BACKEND_NM) {
+         if (ssid) {
+             g_autofree char* escaped_ssid = g_uri_escape_string(ssid, NULL, TRUE);
+-            conf_path = g_strjoin(NULL, "/run/NetworkManager/system-connections/netplan-", netdef->id, "-", escaped_ssid, ".nmconnection", NULL);
++            conf_path = g_strjoin(NULL, "/run/NetworkManager/system-connections/netplan-", escaped_netdef_id, "-", escaped_ssid, ".nmconnection", NULL);
+         } else {
+-            conf_path = g_strjoin(NULL, "/run/NetworkManager/system-connections/netplan-", netdef->id, ".nmconnection", NULL);
++            conf_path = g_strjoin(NULL, "/run/NetworkManager/system-connections/netplan-", escaped_netdef_id, ".nmconnection", NULL);
+         }
+ 
+     } else if (netdef->backend == NETPLAN_BACKEND_NETWORKD || netdef->backend == NETPLAN_BACKEND_OVS) {
+-        conf_path = g_strjoin(NULL, "/run/systemd/network/10-netplan-", netdef->id, ".network", NULL);
++        conf_path = g_strjoin(NULL, "/run/systemd/network/10-netplan-", escaped_netdef_id, ".network", NULL);
+     }
+ 
+     if (conf_path)
+diff --git a/tests/generator/test_common.py b/tests/generator/test_common.py
+index 3aab3f7..f145104 100644
+--- a/tests/generator/test_common.py
++++ b/tests/generator/test_common.py
+@@ -827,6 +827,47 @@ UseMTU=true
+ 
+         self.assert_networkd_udev({'def1.rules': (UDEV_NO_MAC_RULE % ('abc\\"xyz\\n0\\n\\n1', 'eth\\"\\n\\nxyz\\n0'))})
+ 
++    def test_nd_file_paths_escaped(self):
++        self.generate('''network:
++  version: 2
++  ethernets:
++    "abc/../../xyz0":
++      match:
++        driver: "drv"
++      set-name: "eth123"''')
++
++        self.assert_networkd_udev({'abc%2F..%2F..%2Fxyz0.rules': (UDEV_NO_MAC_RULE % ('drv', 'eth123'))})
++        self.assert_networkd({'abc%2F..%2F..%2Fxyz0.network': '''[Match]\nDriver=drv
++Name=eth123
++
++[Network]
++LinkLocalAddressing=ipv6
++''',
++                              'abc%2F..%2F..%2Fxyz0.link': '''[Match]\nDriver=drv\n
++[Link]
++Name=eth123
++WakeOnLan=off
++'''})
++
++        self.generate('''network:
++  version: 2
++  wifis:
++    "abc/../../xyz0":
++      dhcp4: true
++      access-points:
++        "mywifi":
++          password: "aaaaaaaa"''')
++
++        self.assert_wpa_supplicant("abc%2F..%2F..%2Fxyz0", """ctrl_interface=/run/wpa_supplicant
++
++network={
++  ssid=P"mywifi"
++  key_mgmt=WPA-PSK WPA-PSK-SHA256 SAE
++  ieee80211w=1
++  psk="aaaaaaaa"
++}
++""")
++
+ 
+ class TestNetworkManager(TestBase):
+ 
+@@ -1354,6 +1395,31 @@ method=ignore
+       dhcp4: true''', skip_generated_yaml_validation=True)
+         self.assert_nm_udev(NM_UNMANAGED % 'eth\\n0' + NM_UNMANAGED % 'eth0')
+ 
++    def test_nm_file_paths_escaped(self):
++        self.generate('''network:
++  version: 2
++  renderer: NetworkManager
++  ethernets:
++    "abc/../../xyz0":
++      match:
++        driver: "drv"
++      set-name: "eth123"''')
++
++        self.assert_nm({'abc%2F..%2F..%2Fxyz0': '''[connection]
++id=netplan-abc/../../xyz0
++type=ethernet
++interface-name=eth123
++
++[ethernet]
++wake-on-lan=0
++
++[ipv4]
++method=link-local
++
++[ipv6]
++method=ignore
++'''})
++
+ 
+ class TestForwardDeclaration(TestBase):
+ 
+diff --git a/tests/generator/test_ovs.py b/tests/generator/test_ovs.py
+index 307df5f..0d27ff9 100644
+--- a/tests/generator/test_ovs.py
++++ b/tests/generator/test_ovs.py
+@@ -1095,3 +1095,27 @@ ExecStart=/usr/bin/ovs-vsctl set-controller br123 tcp:127.0.0.1:6653\n\
+ ExecStart=/usr/bin/ovs-vsctl set Bridge br123 external-ids:netplan/global/set-controller=tcp:127.0.0.1:6653\n\
+ ')},
+                          'cleanup.service': OVS_CLEANUP % {'iface': 'cleanup'}})
++
++    def test_file_paths_escaped(self):
++        self.generate('''network:
++  version: 2
++  bridges:
++    "abc/../../123":
++      openvswitch: {}
++  vlans:
++    "abc/../../123.100":
++      id: 100
++      link: "abc/../../123"
++''')
++        self.assert_ovs({'abc%2F..%2F..%2F123.service': OVS_BR_EMPTY % {'iface': 'abc/../../123'},
++                         'abc%2F..%2F..%2F123.100.service': OVS_VIRTUAL % {'iface': 'abc/../../123.100', 'extra':
++                                                                           '''Requires=netplan-ovs-abc%2F..%2F..%2F123.service
++After=netplan-ovs-abc%2F..%2F..%2F123.service
++
++[Service]
++Type=oneshot
++TimeoutStartSec=10s
++ExecStart=/usr/bin/ovs-vsctl --may-exist add-br abc/../../123.100 abc/../../123 100
++ExecStart=/usr/bin/ovs-vsctl set Interface abc/../../123.100 external-ids:netplan=true
++'''},
++                         'cleanup.service': OVS_CLEANUP % {'iface': 'cleanup'}})
diff --git a/debian/patches/lp2066258/0016-backends-escape-semicolons-in-service-units.patch b/debian/patches/lp2066258/0016-backends-escape-semicolons-in-service-units.patch
new file mode 100644
index 0000000..ac83351
--- /dev/null
+++ b/debian/patches/lp2066258/0016-backends-escape-semicolons-in-service-units.patch
@@ -0,0 +1,292 @@
+From: Danilo Egea Gondolfo <[e-mail]>
+Date: Fri, 24 May 2024 14:11:12 +0100
+Subject: backends: escape semicolons in service units
+
+Semicolons separated from other words by a combination of spaces and/or
+tabs will be escaped.
+---
+ src/networkd.c                   |  7 +++++
+ src/openvswitch.c                |  3 +++
+ src/sriov.c                      |  3 +++
+ src/util-internal.h              |  3 +++
+ src/util.c                       | 34 +++++++++++++++++++++++
+ tests/ctests/test_netplan_misc.c | 45 +++++++++++++++++++++++++++++++
+ tests/generator/test_ovs.py      | 58 ++++++++++++++++++++++++++++++++++++++++
+ tests/test_sriov.py              | 29 ++++++++++++++++++++
+ 8 files changed, 182 insertions(+)
+
+diff --git a/src/networkd.c b/src/networkd.c
+index e66ab4c..f9fefe9 100644
+--- a/src/networkd.c
++++ b/src/networkd.c
+@@ -301,6 +301,9 @@ write_regdom(const NetplanNetDefinition* def, const char* rootdir, GError** erro
+     g_string_append(s, "\n[Service]\nType=oneshot\n");
+     g_string_append_printf(s, "ExecStart="SBINDIR"/iw reg set %s\n", def->regulatory_domain);
+ 
++    g_autofree char* new_s = _netplan_scrub_systemd_unit_contents(s->str);
++    g_string_free(s, TRUE);
++    s = g_string_new(new_s);
+     _netplan_g_string_free_to_file_with_permissions(s, rootdir, path, NULL, "root", "root", 0640);
+     safe_mkdir_p_dir(link);
+     if (symlink(path, link) < 0 && errno != EEXIST) {
+@@ -1191,6 +1194,10 @@ write_wpa_unit(const NetplanNetDefinition* def, const char* rootdir)
+     } else {
+         g_string_append(s, " -Dnl80211,wext\n");
+     }
++
++    g_autofree char* new_s = _netplan_scrub_systemd_unit_contents(s->str);
++    g_string_free(s, TRUE);
++    s = g_string_new(new_s);
+     _netplan_g_string_free_to_file_with_permissions(s, rootdir, path, NULL, "root", "root", 0640);
+ }
+ 
+diff --git a/src/openvswitch.c b/src/openvswitch.c
+index b33769d..7d31e7f 100644
+--- a/src/openvswitch.c
++++ b/src/openvswitch.c
+@@ -62,6 +62,9 @@ write_ovs_systemd_unit(const char* id, const GString* cmds, const char* rootdir,
+     g_string_append(s, "\n[Service]\nType=oneshot\nTimeoutStartSec=10s\n");
+     g_string_append(s, cmds->str);
+ 
++    g_autofree char* new_s = _netplan_scrub_systemd_unit_contents(s->str);
++    g_string_free(s, TRUE);
++    s = g_string_new(new_s);
+     _netplan_g_string_free_to_file_with_permissions(s, rootdir, path, NULL, "root", "root", 0640);
+ 
+     safe_mkdir_p_dir(link);
+diff --git a/src/sriov.c b/src/sriov.c
+index c3cd80d..710f1a8 100644
+--- a/src/sriov.c
++++ b/src/sriov.c
+@@ -53,6 +53,9 @@ write_sriov_rebind_systemd_unit(GHashTable* pfs, const char* rootdir, GError** e
+     g_string_truncate(interfaces, interfaces->len-1); /* cut trailing whitespace */
+     g_string_append_printf(s, "ExecStart=" SBINDIR "/netplan rebind %s\n", interfaces->str);
+ 
++    g_autofree char* new_s = _netplan_scrub_systemd_unit_contents(s->str);
++    g_string_free(s, TRUE);
++    s = g_string_new(new_s);
+     _netplan_g_string_free_to_file_with_permissions(s, rootdir, path, NULL, "root", "root", 0640);
+     g_string_free(interfaces, TRUE);
+ 
+diff --git a/src/util-internal.h b/src/util-internal.h
+index f6f36fc..e9c2d13 100644
+--- a/src/util-internal.h
++++ b/src/util-internal.h
+@@ -185,3 +185,6 @@ _netplan_netdef_pertype_iter_free(struct netdef_pertype_iter* it);
+ 
+ gchar*
+ _netplan_scrub_string(const char* content);
++
++gchar*
++_netplan_scrub_systemd_unit_contents(const char* content);
+diff --git a/src/util.c b/src/util.c
+index a3dae98..30d05cb 100644
+--- a/src/util.c
++++ b/src/util.c
+@@ -1235,3 +1235,37 @@ _netplan_scrub_string(const char* content)
+ 
+     return g_string_free(s, FALSE);
+ }
++
++static gboolean
++_is_space_or_tab(char c)
++{
++    return c == ' ' || c == '\t';
++}
++
++char*
++_netplan_scrub_systemd_unit_contents(const char* content)
++{
++    size_t content_len = strlen(content);
++    // Assume a few replacements will happen to reduce reallocation
++    GString* s = g_string_sized_new(content_len + 8);
++
++    // Append the first character of "content" to the result string
++    g_string_append_len(s, content, 1);
++
++    // Walk from the second element to the one before the last looking for isolated semicolons
++    // A semicolon is isolated if it's surrounded by either tabs or spaces
++    const char* p = content + 1;
++    while (p < (content + content_len - 1)) {
++        if (*p == ';' && _is_space_or_tab(*(p - 1)) && _is_space_or_tab(*(p + 1))) {
++            g_string_append_len(s, "\\;", 2);
++        } else {
++            g_string_append_len(s, p, 1);
++        }
++        p++;
++    }
++
++    // Append the last character of "content" to the result string
++    g_string_append_len(s, p, 1);
++
++    return g_string_free(s, FALSE);
++}
+diff --git a/tests/ctests/test_netplan_misc.c b/tests/ctests/test_netplan_misc.c
+index 35bf4f8..aa14a71 100644
+--- a/tests/ctests/test_netplan_misc.c
++++ b/tests/ctests/test_netplan_misc.c
+@@ -348,6 +348,50 @@ test_normalize_ip_address(__unused void** state)
+     assert_string_equal(normalize_ip_address("0.0.0.0/0", AF_INET), "0.0.0.0/0");
+ }
+ 
++void
++test_scrub_systemd_unit_content(__unused void** state)
++{
++    char* str = ";abc;";
++    char* res = _netplan_scrub_systemd_unit_contents(str);
++    assert_string_equal(res, ";abc;");
++    g_free(res);
++
++    str = ";;;;";
++    res = _netplan_scrub_systemd_unit_contents(str);
++    assert_string_equal(res, ";;;;");
++    g_free(res);
++
++    str = " ;;;; ";
++    res = _netplan_scrub_systemd_unit_contents(str);
++    assert_string_equal(res, " ;;;; ");
++    g_free(res);
++
++    str = "; ; ; ; ;";
++    res = _netplan_scrub_systemd_unit_contents(str);
++    assert_string_equal(res, "; \\; \\; \\; ;");
++    g_free(res);
++
++    str = " ; ; ; ; ; ";
++    res = _netplan_scrub_systemd_unit_contents(str);
++    assert_string_equal(res, " \\; \\; \\; \\; \\; ");
++    g_free(res);
++
++    str = "a ; ; ; ; ; b";
++    res = _netplan_scrub_systemd_unit_contents(str);
++    assert_string_equal(res, "a \\; \\; \\; \\; \\; b");
++    g_free(res);
++
++    str = "\t;\t; ;\t; \t ;\t ";
++    res = _netplan_scrub_systemd_unit_contents(str);
++    assert_string_equal(res, "\t\\;\t\\; \\;\t\\; \t \\;\t ");
++    g_free(res);
++
++    str = "\t;\t;\t;\t;\t;\t";
++    res = _netplan_scrub_systemd_unit_contents(str);
++    assert_string_equal(res, "\t\\;\t\\;\t\\;\t\\;\t\\;\t");
++    g_free(res);
++}
++
+ int
+ setup(__unused void** state)
+ {
+@@ -380,6 +424,7 @@ main()
+            cmocka_unit_test(test_util_is_route_rule_present),
+            cmocka_unit_test(test_util_is_string_in_array),
+            cmocka_unit_test(test_normalize_ip_address),
++           cmocka_unit_test(test_scrub_systemd_unit_content),
+        };
+ 
+        return cmocka_run_group_tests(tests, setup, tear_down);
+diff --git a/tests/generator/test_ovs.py b/tests/generator/test_ovs.py
+index 0d27ff9..17c33ed 100644
+--- a/tests/generator/test_ovs.py
++++ b/tests/generator/test_ovs.py
+@@ -1119,3 +1119,61 @@ ExecStart=/usr/bin/ovs-vsctl --may-exist add-br abc/../../123.100 abc/../../123
+ ExecStart=/usr/bin/ovs-vsctl set Interface abc/../../123.100 external-ids:netplan=true
+ '''},
+                          'cleanup.service': OVS_CLEANUP % {'iface': 'cleanup'}})
++
++    def test_control_characters_and_semicolons_escaping(self):
++        self.generate('''network:
++  version: 2
++  bridges: # bridges first, to trigger multi-pass processing
++    ovs0:
++      interfaces: [eth0, eth1]
++      openvswitch: {}
++  ethernets:
++    eth0:
++      openvswitch:
++        external-ids:
++          "a\\n1\\ra": " ; a ; 1 ;a; ;b\\t;\\t3 ;\\ta\\t; 1"
++        other-config:
++          "a\\n1\\ra": " ; a ; 1 ;a; ;b\\t;\\t3 ;\\ta\\t; 1"
++      dhcp6: true
++    eth1:
++      dhcp4: true
++      openvswitch:
++        other-config:
++          disable-in-band: false\n''', skip_generated_yaml_validation=True)
++        self.assert_ovs({'ovs0.service': OVS_VIRTUAL % {'iface': 'ovs0', 'extra': '''
++[Service]
++Type=oneshot
++TimeoutStartSec=10s
++ExecStart=/usr/bin/ovs-vsctl --may-exist add-br ovs0
++ExecStart=/usr/bin/ovs-vsctl --may-exist add-port ovs0 eth1
++ExecStart=/usr/bin/ovs-vsctl --may-exist add-port ovs0 eth0
++''' + OVS_BR_DEFAULT % {'iface': 'ovs0'}},
++                         'eth0.service': OVS_PHYSICAL % {'iface': 'eth0', 'extra': '''\
++Requires=netplan-ovs-ovs0.service
++After=netplan-ovs-ovs0.service
++
++[Service]
++Type=oneshot
++TimeoutStartSec=10s
++ExecStart=/usr/bin/ovs-vsctl set Interface eth0 external-ids:a\\n1\\ra= \\; a \\; 1 ;a; ;b\\t;\\t3 ;\\ta\\t; 1
++ExecStart=/usr/bin/ovs-vsctl set Interface eth0 external-ids:netplan/external-ids/a\\n1\\ra=,;,a,;,1,;a;,;b\\t;\\t3,;\\ta\\t;,1
++ExecStart=/usr/bin/ovs-vsctl set Interface eth0 other-config:a\\n1\\ra= \\; a \\; 1 ;a; ;b\\t;\\t3 ;\\ta\\t; 1
++ExecStart=/usr/bin/ovs-vsctl set Interface eth0 external-ids:netplan/other-config/a\\n1\\ra=,;,a,;,1,;a;,;b\\t;\\t3,;\\ta\\t;,1
++'''},
++                         'eth1.service': OVS_PHYSICAL % {'iface': 'eth1', 'extra': '''\
++Requires=netplan-ovs-ovs0.service
++After=netplan-ovs-ovs0.service
++
++[Service]
++Type=oneshot
++TimeoutStartSec=10s
++ExecStart=/usr/bin/ovs-vsctl set Interface eth1 other-config:disable-in-band=false
++ExecStart=/usr/bin/ovs-vsctl set Interface eth1 external-ids:netplan/other-config/disable-in-band=false
++'''},
++                         'cleanup.service': OVS_CLEANUP % {'iface': 'cleanup'}})
++        # Confirm that the networkd config is still sane
++        self.assert_networkd({'ovs0.network': ND_EMPTY % ('ovs0', 'ipv6'),
++                              'eth0.network': (ND_DHCP6 % 'eth0')
++                              .replace('LinkLocalAddressing=ipv6', 'LinkLocalAddressing=no\nBridge=ovs0'),
++                              'eth1.network': (ND_DHCP4 % 'eth1')
++                              .replace('LinkLocalAddressing=ipv6', 'LinkLocalAddressing=no\nBridge=ovs0')})
+diff --git a/tests/test_sriov.py b/tests/test_sriov.py
+index 3c06e43..054500c 100644
+--- a/tests/test_sriov.py
++++ b/tests/test_sriov.py
+@@ -913,6 +913,35 @@ After=sys-subsystem-net-devices-engreen.device
+ [Service]
+ Type=oneshot
+ ExecStart=/usr/sbin/netplan rebind enblue engreen
++'''})
++
++    def test_escaping_semicolons_from_unit_file(self):
++        ''' Check if semicolons and line breaks are properly escaped in the generated
++        systemd service unit.
++        '''
++        self.generate('''network:
++  version: 2
++  ethernets:
++    engreen:
++      embedded-switch-mode: switchdev
++      delay-virtual-functions-rebind: true
++    enblue:
++      match: {driver: dummy_driver}
++      set-name: ";en ; a\\t;\\tb ;\\tc\\t; d; \\n;\\nabc"
++      embedded-switch-mode: legacy
++      delay-virtual-functions-rebind: true
++      virtual-function-count: 4
++    sriov_vf0:
++      link: engreen''', skip_generated_yaml_validation=True)
++        self.assert_sriov({'rebind.service': '''[Unit]
++Description=(Re-)bind SR-IOV Virtual Functions to their driver
++After=network.target
++After=sys-subsystem-net-devices-;en \\; a\\t;\\tb ;\\tc\\t; d; \\n;\\nabc.device
++After=sys-subsystem-net-devices-engreen.device
++
++[Service]
++Type=oneshot
++ExecStart=/usr/sbin/netplan rebind ;en \\; a\\t;\\tb ;\\tc\\t; d; \\n;\\nabc engreen
+ '''})
+ 
+     def test_rebind_not_delayed(self):
diff --git a/debian/patches/series b/debian/patches/series
index 3e6ae18..6981f92 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -10,3 +10,7 @@ sru-compat/0011-parse-add-comment-about-OpenFlow16-deprecation.patch
 sru-compat/0012-migrate-fix-looback_only-legacy-test.patch
 sru-compat/0013-Keep-old-file-permission-for-backwards-compatibility.patch
 sru-compat/0014-Demote-lacp-rate-validation-error-to-warning-for-bac.patch
+lp2065738/0013-libnetplan-use-more-restrictive-file-permissions.patch
+lp2066258/0014-libnetplan-escape-control-characters.patch
+lp2066258/0015-backends-escape-file-paths.patch
+lp2066258/0016-backends-escape-semicolons-in-service-units.patch