Merge ~danilogondolfo/netplan/+git/ubuntu:noble_1.0.1-1ubuntu1 into ~ubuntu-core-dev/netplan/+git/ubuntu:ubuntu-noble

[Danilo Egea Gondolfo]

This is essentially the same netplan.io found in Oracular.

Apart from the changelog, there is just a small diff with distro specific changes, a patch file I renamed to avoid a prefix number collision and a DEP-3 header I added to another patch file.

A PPA is available here https://launchpad.net/~danilogondolfo/+archive/ubuntu/netplan-sru

Autopkgtests look good except for one "scenarios" test (TestNetworkManager.test_remove_virtual_interfaces) that appears to be flaky only on ppc64el. I executed it several times and it passed once, but failed many times. It *is not* failing on Oracular where netplan.io is basically the same as this package. I tested it with and without the patch that disabled the udev control --reload in the generator and I have the impression that is fails way more often with the patch. It's only happening on ppc64el.

Autopkgtests:

https://autopkgtest.ubuntu.com/results/autopkgtest-noble-danilogondolfo-netplan-sru/noble/s390x/n/netplan.io/20240729_105802_ef836@/log.gz
https://autopkgtest.ubuntu.com/results/autopkgtest-noble-danilogondolfo-netplan-sru/noble/amd64/n/netplan.io/20240729_110739_59501@/log.gz
https://autopkgtest.ubuntu.com/results/autopkgtest-noble-danilogondolfo-netplan-sru/noble/arm64/n/netplan.io/20240729_111042_49323@/log.gz
https://autopkgtest.ubuntu.com/results/autopkgtest-noble-danilogondolfo-netplan-sru/noble/armhf/n/netplan.io/20240729_111154_7f314@/log.gz

On ppc64el, there is one test from "scenarios" (TestNetworkManager.test_remove_virtual_interfaces) that is flaky.

On three consecutive runs it passed once:
https://autopkgtest.ubuntu.com/results/autopkgtest-noble-danilogondolfo-netplan-sru/noble/ppc64el/n/netplan.io/20240729_110320_9209f@/log.gz
https://autopkgtest.ubuntu.com/results/autopkgtest-noble-danilogondolfo-netplan-sru/noble/ppc64el/n/netplan.io/20240729_115407_9dcce@/log.gz
https://autopkgtest.ubuntu.com/results/autopkgtest-noble-danilogondolfo-netplan-sru/noble/ppc64el/n/netplan.io/20240729_115937_363b0@/log.gz

[Lukas Märdian (slyon)]

Thank you very much for running the different autopkgtest from the PPA and doing the analysis. This SRU is well prepared and LGTM!

Some notes from my review (nothing that needs any furhter action):

- note (non-blocking): 0002-CLI-apply-call-udevadm-trigger-using-action-add-Clos.patch Not necessarily needed on Noble's systemd v255, but this SRU is a full (Ubuntu-)version backport, so including this patch is sensible to keep the delta as small as possible.

- note (non-blocking): The SRU is mostly dropping distro patches for https://github.com/canonical/netplan/pull/456 that got included (but disabled) in upstream 1.0.1. This SRU re-enables the functionality, to keep status quo for Noble

- note (non-blocking) Upstream 1.0.1 contains CVE-2022-4968 & related fixes, so we can drop the corresponding distro patches

- note (non-blocking) This SRU matches the upstream 1.0.1 tag, except for the 4 patches in d/p/series.
  - python-limited-stable-api.patch
  - 0002-CLI-apply-call-udevadm-trigger-using-action-add-Clos.patch
  - 0003-Revert-wait-online-disabled-wait-online-for-stable-1.patch
  - 0004-generate-avoid-calling-udevadm-control-reload-LP-199.patch

Merged, tagged & sponsored for SRU review!

review: Approve

diff --git a/doc/CODE_OF_CONDUCT.md b/.github/CODE_OF_CONDUCT.md
similarity index 100%
rename from doc/CODE_OF_CONDUCT.md
rename to .github/CODE_OF_CONDUCT.md
diff --git a/.github/workflows/autopkgtest.yml b/.github/workflows/autopkgtest.yml
index 310e99b..5dc8bec 100644
--- a/.github/workflows/autopkgtest.yml
+++ b/.github/workflows/autopkgtest.yml
@@ -33,6 +33,8 @@ jobs:
       # it's needed (will be auto-loaded) by routing.test_vrf_basic
       - name: Install dependencies
         run: |
+          echo "APT::Get::Always-Include-Phased-Updates \"true\";" | sudo tee /etc/apt/apt.conf.d/90phased-updates
+          sudo add-apt-repository -y -u -s ppa:slyon/netplan-ci
           sudo apt update
           sudo apt install autopkgtest ubuntu-dev-tools devscripts openvswitch-switch linux-modules-extra-$(uname -r)
       # work around LP: #1878225 as fallback
@@ -46,7 +48,9 @@ jobs:
           cp -r netplan.io-*/debian .
           rm -r debian/patches/  # clear any distro patches
           # usrmerge-fix
-          sed -i 's|rm debian/tmp/lib/netplan/generate|sh -c "mkdir -p debian/tmp/usr/lib/systemd/system-generators; rm -rf debian/tmp/lib; ln -sf /usr/libexec/netplan/generate debian/tmp/usr/lib/systemd/system-generators/netplan"|' debian/rules
+          echo "" >> debian/rules
+          echo "execute_after_dh_auto_install:" >> debian/rules
+          echo "	sh -c \"mkdir -p debian/tmp/usr/lib/systemd/system-generators; rm -rf debian/tmp/lib; ln -sf /usr/libexec/netplan/generate debian/tmp/usr/lib/systemd/system-generators/netplan\"" >> debian/rules
           # usrmerge-fix-end
           sed -i 's| systemd-dev|# DELETED: systemd-dev|' debian/control
           TAG=$(git describe --tags $(git rev-list --tags --max-count=1))  # find latest (stable) tag
diff --git a/.github/workflows/build-abi.yml b/.github/workflows/build-abi.yml
index e517101..c7f1b18 100644
--- a/.github/workflows/build-abi.yml
+++ b/.github/workflows/build-abi.yml
@@ -29,6 +29,7 @@ jobs:
       - name: Install build depends
         run: |
           echo "APT::Get::Always-Include-Phased-Updates \"true\";" | sudo tee /etc/apt/apt.conf.d/90phased-updates
+          sudo add-apt-repository -y -u -s ppa:slyon/netplan-ci
           sudo apt update
           sudo apt install abigail-tools ubuntu-dev-tools devscripts equivs
           pull-lp-source netplan.io
diff --git a/.github/workflows/check-address-sanitizer.yml b/.github/workflows/check-address-sanitizer.yml
index 6d97a52..e604a53 100644
--- a/.github/workflows/check-address-sanitizer.yml
+++ b/.github/workflows/check-address-sanitizer.yml
@@ -25,6 +25,7 @@ jobs:
       - name: Install build depends
         run: |
           echo "APT::Get::Always-Include-Phased-Updates \"true\";" | sudo tee /etc/apt/apt.conf.d/90phased-updates
+          sudo add-apt-repository -y -u -s ppa:slyon/netplan-ci
           sudo apt update
           sudo apt -y install curl expect ubuntu-dev-tools devscripts equivs
           pull-lp-source netplan.io
diff --git a/.github/workflows/check-coverage.yml b/.github/workflows/check-coverage.yml
index c8caca7..d18f8b4 100644
--- a/.github/workflows/check-coverage.yml
+++ b/.github/workflows/check-coverage.yml
@@ -26,6 +26,7 @@ jobs:
       - name: Install build depends
         run: |
           echo "APT::Get::Always-Include-Phased-Updates \"true\";" | sudo tee /etc/apt/apt.conf.d/90phased-updates
+          sudo add-apt-repository -y -u -s ppa:slyon/netplan-ci
           sudo apt update
           sudo apt install curl expect ubuntu-dev-tools devscripts equivs gcovr
           pull-lp-source netplan.io
diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml
index 330652f..f654f30 100644
--- a/.github/workflows/coverity.yml
+++ b/.github/workflows/coverity.yml
@@ -14,6 +14,7 @@ jobs:
       - name: Install dependencies
         run: |
           echo "APT::Get::Always-Include-Phased-Updates \"true\";" | sudo tee /etc/apt/apt.conf.d/90phased-updates
+          sudo add-apt-repository -y -u -s ppa:slyon/netplan-ci
           sudo apt update
           sudo apt -y install curl ubuntu-dev-tools equivs
           pull-lp-source netplan.io
diff --git a/.github/workflows/debci.yml b/.github/workflows/debci.yml
index f20e908..8e9dd5b 100644
--- a/.github/workflows/debci.yml
+++ b/.github/workflows/debci.yml
@@ -45,7 +45,7 @@ jobs:
       - name: Prepare test
         run: |
           # pull-debian-source netplan.io  # snapshot.debian.org is not up-to-date
-          V=$(rmadison -u debian -s unstable netplan.io | tail -n1 | cut -d"|" -f2 | xargs)
+          V=$(rmadison -u debian -s unstable -a source netplan.io | tail -n1 | cut -d"|" -f2 | xargs)
           dget -u "https://deb.debian.org/debian/pool/main/n/netplan.io/netplan.io_$V.dsc"
           cp -r netplan.io-*/debian .
           rm -r debian/patches/  # clear any distro patches
diff --git a/.github/workflows/snapd.patch b/.github/workflows/snapd.patch
index 437e1f7..de964c3 100644
--- a/.github/workflows/snapd.patch
+++ b/.github/workflows/snapd.patch
@@ -1,9 +1,9 @@
 @@ -70,6 +70,8 @@
  
      sleep 5
-     if lxc exec "$CONTAINER" -- systemctl mask [e-mail]; then
-+       lxc exec "$CONTAINER" -- systemctl mask snapd.service
-+       lxc exec "$CONTAINER" -- systemctl mask snapd.seeded.service
-        lxc exec "$CONTAINER" -- reboot
+     if "$COMMAND" exec "$CONTAINER" -- systemctl mask [e-mail]; then
++       "$COMMAND" exec "$CONTAINER" -- systemctl mask snapd.service
++       "$COMMAND" exec "$CONTAINER" -- systemctl mask snapd.seeded.service
+        "$COMMAND" exec "$CONTAINER" -- reboot
      fi
  
diff --git a/.github/workflows/spread.yml b/.github/workflows/spread.yml
index c1593f5..a681057 100644
--- a/.github/workflows/spread.yml
+++ b/.github/workflows/spread.yml
@@ -18,7 +18,11 @@ jobs:
       - uses: actions/checkout@v3
       - name: Install spread
         run: |
-          go install github.com/snapcore/spread/cmd/spread@latest
+          # TODO: Once Spread PR #179 is merged, go back to:
+          # go install github.com/snapcore/spread/cmd/spread@latest
+          git clone --depth 1 --branch thp https://github.com/thp-canonical/spread spread-fork
+          cd spread-fork && go install ./cmd/spread
+          cd .. && rm -r spread-fork
       - name: Run the spread test inside LXD
         run: |
           ~/go/bin/spread -v lxd:
diff --git a/README.md b/README.md
index 6051ace..68d9e6e 100644
--- a/README.md
+++ b/README.md
@@ -1,4 +1,4 @@
-# netplan - Backend-agnostic network configuration in YAML
+# Netplan - Declarative network configuration for various backends
 
 [![Build+ABI](https://github.com/canonical/netplan/workflows/Build%20&%20ABI%20compatibility/badge.svg?branch=main)](https://github.com/canonical/netplan/actions/workflows/build-abi.yml?query=branch%3Amain)
 [![Test+Coverage](https://github.com/canonical/netplan/workflows/Unit%20tests%20&%20Coverage/badge.svg?branch=main)](https://github.com/canonical/netplan/actions/workflows/check-coverage.yml?query=branch%3Amain)
@@ -13,7 +13,7 @@ http://netplan.io
 
 An overview of the architecture can be found at [netplan.io/design](https://netplan.io/design)
 
-The full documentation for netplan is available in the [doc/](../main/doc/) directory.
+Find the full [documentation for Netplan](https://netplan.readthedocs.io) on "Read the Docs".
 
 # Build using Meson
 
@@ -30,7 +30,7 @@ Please file bug reports in [Launchpad](https://bugs.launchpad.net/netplan/+fileb
 
 # Contact us
 
-Please join us on IRC in #netplan at [Libera.Chat](https://libera.chat/).
+Please join us on [IRC in #netplan](https://web.libera.chat/gamja/?channels=%23netplan) at Libera.Chat.
 
 Our mailing list is [here](https://lists.launchpad.net/netplan-developers/).
 
diff --git a/debian/changelog b/debian/changelog
index a79d91d..743bab0 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,76 @@
+netplan.io (1.0.1-1ubuntu2~24.04.1) noble; urgency=medium
+
+  * Backport netplan.io 1.0.1-1ubuntu2 to 24.04 (LP: #2074197):
+    - sriov: accept setting the eswitch mode without VFs (LP: 2020409)
+    - cli/sriov: refactoring
+    - tests: use proper 0o600 file permissions in more places
+    - doc: Adding missing 'watchfiles' dependency for Sphinx
+    - doc: Minor fixes in lang. and mark-up in YAML reference
+    - doc: Tutorial reorg & lang. + formatting improvements
+    - networkd: add wait-online enumeration utils
+    - generate: enable systemd-networkd-wait-online for non-optional interfaces
+    - CLI:utils: Do not ask for daemon-reload password interactively
+    - CLI:generate: call daemon-reload after (re-)generating services
+    - wait-online: Do not block on loopback interface
+    - generate: Do not touch wait-online, if we don't have any networkd NetDefs
+    - wait-online: wait for existing interfaces only and downgrade operational
+      state for interfaces without IP configuration
+    - wait-online: account for DHCPv4/v6 addresses
+    - wait-online: do not require virtual devices to be created already
+    - wait-online: recognize that bridge/bond members will never gain
+      link-local addresses
+    - networkd:apply: Drop handling of legacy wpa@ instance units
+    - wait-online: disabled wait-online for stable 1.0
+    - test:integration: Try to improve test flakyness
+    - autopkgtest: More fixes for flaky 'ethernets' test
+    - Increase some test timeouts to account for slow (riscv64) buildds
+    SECURITY UPDATE:
+    - libnetplan: use more restrictive file permissions
+      (Closes: #1072789, LP: 2065738, LP: 1987842)
+    - CVE-2022-4968
+    - libnetplan: escape control characters
+    - backends: escape file paths
+    - backends: escape semicolons in service units (LP: 2066258)
+    Bug fixes:
+    - cli: Fix logging setup when python-rich is not present
+    - CI: fix DebCI case for no-change rebuilds
+    - CI: adopt autopkgtest for 1.0-1 on 22.04
+    - doc: Update README, move CODE_OF_CONDUCT
+    - doc: fix en_GB spelling
+    - CI: adopt snapd.patch for autopkgtest SRU (LP: 2051939)
+    - parse-nm: add a workaround for the DoT DNS option  (LP: 2055148)
+    - CI: Install netplan-ci PPA
+    - parse: don't remove datalist items during iteration
+    - ATTN: parse/bonds: handle same primary in multiple bonds
+    - parse/bonds: don't fail on primary reassignment
+    - cli/sriov: set eswitch regardless of pcidev.vfs
+    - doc: Fix wrong bonds.parameters.mode syntax in example
+    - parse: fix redefinition of gateway(4|6)
+    - doc:tutorial: fix whitespace formatting
+    - util: fix potential NULL pointer assert
+    - python: elements of __all__ must be strings
+    - tests: fix diff test with iproute2 6.8
+    - cli/generate: skip daemon_reload with --mapping
+    - test: cleanup after wait_online test to fix DebCI
+    - CI: fork spread to get !179 fixes
+    - doc: Fix netplan-generate.md formatting !483
+    - emitter: allow unicode characters in the emitter (LP: 2071652)
+    - parse: do not escape all non-ascii bytes
+  * d/t/control: 'diff' autopkgtest is not flaky anymore
+  * d/patches: Drop patches, applied upstream
+  * d/p/0002-CLI-apply-call-udevadm-trigger-using-action-add-Clos.patch:
+    Update 'udevadm trigger' patch, using MOVE action (LP: 2071363)
+  * d/p/0003-Revert-wait-online-disabled-wait-online-for-stable-1.patch:
+    Fix wait-online via s-n-wait-online.service.d/10-netplan.
+  * debian/netplan-generator.postinst: Add a postinst maintainer script to call
+    the generator, so the file permissions fixes will be applied automatically.
+  * d/libnetplan1.symbols:
+    - Update for new internal wait-online symbol
+    - Update for new (private) symbol
+  * d/copyright: Update for 2024
+
+ -- Danilo Egea Gondolfo <[e-mail]>  Wed, 17 Jul 2024 18:12:26 +0100
+
 netplan.io (1.0-2ubuntu1.2) noble-security; urgency=medium
 
   * SECURITY REGRESSION: failure on systems without dbus
diff --git a/debian/control b/debian/control
index 86d1d90..fc6bf78 100644
--- a/debian/control
+++ b/debian/control
@@ -27,6 +27,7 @@ Build-Depends:
  libcmocka-dev,
  libpython3-dev,
  libsystemd-dev,
+ udev <!nocheck>,
  systemd <!nocheck>,
  systemd-dev,
  dbus-x11 <!nocheck>,
diff --git a/debian/copyright b/debian/copyright
index f145c74..229f7e4 100644
--- a/debian/copyright
+++ b/debian/copyright
@@ -9,7 +9,7 @@ License: GPL-3
 
 Files: debian/*
 Copyright:
- 2016—2023 Canonical Ltd.
+ 2016—2024 Canonical Ltd.
  2018—2023 Andrej Shadura <[e-mail]>
 License: GPL-3
 
diff --git a/debian/patches/0002-CLI-apply-call-udevadm-trigger-using-action-add-Clos.patch b/debian/patches/0002-CLI-apply-call-udevadm-trigger-using-action-add-Clos.patch
new file mode 100644
index 0000000..dda68ca
--- /dev/null
+++ b/debian/patches/0002-CLI-apply-call-udevadm-trigger-using-action-add-Clos.patch
@@ -0,0 +1,72 @@
+From: =?utf-8?q?Lukas_M=C3=A4rdian?= <[e-mail]>
+Date: Wed, 29 May 2024 17:41:28 +0200
+Subject: CLI:apply: call udevadm trigger,
+ using --action=add (Closes: #1071220) (LP: #2066344)
+
+This will (re)-apply .link files, e.g. to set offloading options
+
+Also, containing a drive-by fix, solving FTBFS on unstable (probably /tmp on tmpfs?)
+
+Bug: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1071220
+Bug-Ubuntu: https://pad.lv/2066344
+Origin: https://github.com/canonical/netplan/pull/479
+Forwarded: not-needed
+---
+ netplan_cli/cli/commands/apply.py | 3 +--
+ tests/netplan_dbus/test_dbus.py   | 8 ++++----
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/netplan_cli/cli/commands/apply.py b/netplan_cli/cli/commands/apply.py
+index 9c88a3c..80c09e7 100644
+--- a/netplan_cli/cli/commands/apply.py
++++ b/netplan_cli/cli/commands/apply.py
+@@ -254,8 +254,7 @@ def command_apply(self, run_generate=True, sync=False, exit_on_error=True, state
+ 
+         # Reloading of udev rules happens during 'netplan generate' already
+         # subprocess.check_call(['udevadm', 'control', '--reload-rules'])
+-        subprocess.check_call(['udevadm', 'trigger', '--attr-match=subsystem=net'])
+-        subprocess.check_call(['udevadm', 'settle'])
++        subprocess.check_call(['udevadm', 'trigger', '--action=move', '--subsystem-match=net', '--settle'])
+ 
+         # apply any SR-IOV related changes, if applicable
+         NetplanApply.process_sriov_config(config_manager, exit_on_error)
+diff --git a/tests/netplan_dbus/test_dbus.py b/tests/netplan_dbus/test_dbus.py
+index fdfa92f..9c08af7 100644
+--- a/tests/netplan_dbus/test_dbus.py
++++ b/tests/netplan_dbus/test_dbus.py
+@@ -48,7 +48,7 @@ class TestNetplanDBus(unittest.TestCase):
+   ethernets:
+     eth0:
+       dhcp4: true""")
+-        self.addCleanup(shutil.rmtree, self.tmp)
++        self.addCleanup(shutil.rmtree, self.tmp, ignore_errors=True)
+         self.mock_netplan_cmd = MockCmd("netplan")
+         self._create_mock_system_bus()
+         self._run_netplan_dbus_on_mock_bus()
+@@ -284,7 +284,7 @@ class TestNetplanDBus(unittest.TestCase):
+ 
+         cid = self._new_config_object()
+         tmpdir = self.tmp + '/run/netplan/config-{}'.format(cid)
+-        self.addClassCleanup(shutil.rmtree, tmpdir)
++        self.addClassCleanup(shutil.rmtree, tmpdir, ignore_errors=True)
+ 
+         # Verify the object path has been created, by calling .Config.Get() on that object
+         # it would throw an error if it does not exist
+@@ -319,7 +319,7 @@ class TestNetplanDBus(unittest.TestCase):
+     def test_netplan_dbus_config_set(self):
+         cid = self._new_config_object()
+         tmpdir = self.tmp + '/run/netplan/config-{}'.format(cid)
+-        self.addCleanup(shutil.rmtree, tmpdir)
++        self.addCleanup(shutil.rmtree, tmpdir, ignore_errors=True)
+ 
+         # Verify .Config.Set() on the config object
+         # No actual YAML file will be created, as the netplan command is mocked
+@@ -340,7 +340,7 @@ class TestNetplanDBus(unittest.TestCase):
+     def test_netplan_dbus_config_get(self):
+         cid = self._new_config_object()
+         tmpdir = self.tmp + '/run/netplan/config-{}'.format(cid)
+-        self.addCleanup(shutil.rmtree, tmpdir)
++        self.addCleanup(shutil.rmtree, tmpdir, ignore_errors=True)
+ 
+         # Verify .Config.Get() on the config object
+         self.mock_netplan_cmd.set_output("network:\n  eth42:\n    dhcp6: true")
diff --git a/debian/patches/0002-parse-nm-add-a-workaround-for-the-DoT-DNS-option.patch b/debian/patches/0002-parse-nm-add-a-workaround-for-the-DoT-DNS-option.patch
deleted file mode 100644
index 9732eed..0000000
--- a/debian/patches/0002-parse-nm-add-a-workaround-for-the-DoT-DNS-option.patch
+++ /dev/null
@@ -1,91 +0,0 @@
-From: Danilo Egea Gondolfo <[e-mail]>
-Date: Mon, 25 Mar 2024 11:35:13 +0000
-Subject: parse-nm: add a workaround for the DoT DNS option
-
-Netplan doesn't support DNS options such as SNI. When we parse a
-nameserver entry with the SNI server name, example: 1.2.3.4#name.domain,
-the string is added to the list of nameservers without proper
-parsing/validation.
-
-This is a workaround for LP: #2055148.
-
-Origin: upstream, https://github.com/canonical/netplan/pull/447
-Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/netplan.io/+bug/2055148
----
- src/parse-nm.c               | 15 +++++++++++++++
- tests/parser/test_keyfile.py | 39 +++++++++++++++++++++++++++++++++++++++
- 2 files changed, 54 insertions(+)
-
-diff --git a/src/parse-nm.c b/src/parse-nm.c
-index 79275a0..e1b814b 100644
---- a/src/parse-nm.c
-+++ b/src/parse-nm.c
-@@ -348,6 +348,21 @@ parse_nameservers(GKeyFile* kf, const gchar* group, GArray** nameserver_arr)
-     g_assert(nameserver_arr);
-     gchar **split = g_key_file_get_string_list(kf, group, "dns", NULL, NULL);
-     if (split) {
-+
-+        /* Workaround for LP: #2055148
-+         * When an SNI server name is appended to the DNS server IP address,
-+         * for example: 1.2.3.4#example.com, we skip the parsing and keep the configuration
-+         * in the passthrough section by checking if the string is a valid IP address.
-+         * TODO: implement proper DNS options for both NM and ND and drop this
-+         * workaround.
-+         */
-+        for (unsigned i = 0; split[i]; ++i) {
-+            if (!is_ip4_address(split[i]) && !is_ip6_address(split[i])) {
-+                g_strfreev(split);
-+                return;
-+            }
-+        }
-+
-         if (!*nameserver_arr)
-             *nameserver_arr = g_array_new(FALSE, FALSE, sizeof(char*));
-         for(unsigned i = 0; split[i]; ++i) {
-diff --git a/tests/parser/test_keyfile.py b/tests/parser/test_keyfile.py
-index 5dcec8e..ce5cdca 100644
---- a/tests/parser/test_keyfile.py
-+++ b/tests/parser/test_keyfile.py
-@@ -2355,3 +2355,42 @@ route1_options=table=1000
- method=link-local\n'''.format(UUID), expect_fail=True)
- 
-         self.assertIn('missing \'table\' property', out)
-+
-+    def test_nameserver_with_DoT_lp2055148(self):
-+        self.generate_from_keyfile('''[connection]
-+id=ethernet-eth123
-+uuid={}
-+type=ethernet
-+interface-name=eth123
-+
-+[ethernet]
-+
-+[ipv4]
-+dns=8.8.8.8;1.1.1.1#lxd;192.168.0.1#domain.local;
-+method=auto
-+
-+[ipv6]
-+addr-gen-mode=default
-+method=auto
-+
-+[proxy]\n'''.format(UUID))
-+        self.assert_netplan({UUID: '''network:
-+  version: 2
-+  ethernets:
-+    NM-{}:
-+      renderer: NetworkManager
-+      match:
-+        name: "eth123"
-+      dhcp4: true
-+      dhcp6: true
-+      wakeonlan: true
-+      networkmanager:
-+        uuid: "{}"
-+        name: "ethernet-eth123"
-+        passthrough:
-+          ethernet._: ""
-+          ipv4.dns: "8.8.8.8;1.1.1.1#lxd;192.168.0.1#domain.local;"
-+          ipv6.addr-gen-mode: "default"
-+          ipv6.ip6-privacy: "-1"
-+          proxy._: ""
-+'''.format(UUID, UUID)})
diff --git a/debian/patches/0003-Revert-wait-online-disabled-wait-online-for-stable-1.patch b/debian/patches/0003-Revert-wait-online-disabled-wait-online-for-stable-1.patch
new file mode 100644
index 0000000..8fa2663
--- /dev/null
+++ b/debian/patches/0003-Revert-wait-online-disabled-wait-online-for-stable-1.patch
@@ -0,0 +1,155 @@
+From: =?utf-8?q?Lukas_M=C3=A4rdian?= <[e-mail]>
+Date: Thu, 4 Jul 2024 15:52:19 +0200
+Subject: Revert "wait-online: disabled wait-online for stable 1.0"
+
+This reverts commit 933baebe3f203ac7fd24bb4747cf49afc998784a.
+---
+ src/generate.c                 | 10 +---------
+ src/networkd.c                 |  7 +------
+ tests/generator/test_args.py   | 33 +++++++++++++++++++++++++++++++++
+ tests/integration/ethernets.py |  1 -
+ 4 files changed, 35 insertions(+), 16 deletions(-)
+
+diff --git a/src/generate.c b/src/generate.c
+index f961126..d6edb0a 100644
+--- a/src/generate.c
++++ b/src/generate.c
+@@ -63,7 +63,7 @@ reload_udevd(void)
+  * Create enablement symlink for systemd-networkd.service.
+  */
+ static void
+-enable_networkd(const char* generator_dir, __unused gboolean enable_wait_online)
++enable_networkd(const char* generator_dir, gboolean enable_wait_online)
+ {
+     g_autofree char* link = g_build_path(G_DIR_SEPARATOR_S, generator_dir, "multi-user.target.wants", "systemd-networkd.service", NULL);
+     g_debug("We created networkd configuration, adding %s enablement symlink", link);
+@@ -75,9 +75,6 @@ enable_networkd(const char* generator_dir, __unused gboolean enable_wait_online)
+         // LCOV_EXCL_STOP
+     }
+ 
+-    #if 0
+-    // Disabled for netplan 1.0 stable
+-    // LCOV_EXCL_START
+     if (enable_wait_online) {
+         g_autofree char* link2 = g_build_path(G_DIR_SEPARATOR_S, generator_dir, "network-online.target.wants", "systemd-networkd-wait-online.service", NULL);
+         _netplan_safe_mkdir_p_dir(link2);
+@@ -88,8 +85,6 @@ enable_networkd(const char* generator_dir, __unused gboolean enable_wait_online)
+             // LCOV_EXCL_STOP
+         }
+     }
+-    // LCOV_EXCL_STOP
+-    #endif
+ }
+ 
+ // LCOV_EXCL_START
+@@ -335,11 +330,8 @@ int main(int argc, char** argv)
+         /* covered via 'cloud-init' integration test */
+         if (any_networkd) {
+             start_unit_jit("systemd-networkd.socket");
+-            #if 0
+-            // Disabled for netplan 1.0 stable
+             if (enable_wait_online)
+                 start_unit_jit("systemd-networkd-wait-online.service");
+-            #endif
+             start_unit_jit("systemd-networkd.service");
+         }
+         g_autofree char* glob_run = g_build_path(G_DIR_SEPARATOR_S,
+diff --git a/src/networkd.c b/src/networkd.c
+index a6faeb2..b4d7b87 100644
+--- a/src/networkd.c
++++ b/src/networkd.c
+@@ -1551,15 +1551,10 @@ _netplan_networkd_write_wait_online(const NetplanState* np_state, const char* ro
+     }
+     g_string_append(content, "\n");
+ 
+-    g_string_free(content, TRUE);
+-    #if 0
+-    // Disabled for netplan 1.0 stable
+-    // LCOV_EXCL_START
+     g_autofree char* new_content = _netplan_scrub_systemd_unit_contents(content->str);
++    g_string_free(content, TRUE);
+     content = g_string_new(new_content);
+     _netplan_g_string_free_to_file_with_permissions(content, rootdir, override, NULL, "root", "root", 0640);
+-    // LCOV_EXCL_STOP
+-    #endif
+     g_hash_table_destroy(non_optional_interfaces);
+     return TRUE;
+ }
+diff --git a/tests/generator/test_args.py b/tests/generator/test_args.py
+index 78a76b7..6909194 100644
+--- a/tests/generator/test_args.py
++++ b/tests/generator/test_args.py
+@@ -172,8 +172,21 @@ class TestConfigArgs(TestBase):
+         os.unlink(n)
+ 
+         # should auto-enable networkd and -wait-online
++        service_dir = os.path.join(self.workdir.name, 'run', 'systemd', 'system')
+         self.assertTrue(os.path.islink(os.path.join(
+             outdir, 'multi-user.target.wants', 'systemd-networkd.service')))
++        self.assertTrue(os.path.islink(os.path.join(
++            outdir, 'network-online.target.wants', 'systemd-networkd-wait-online.service')))
++        override = os.path.join(service_dir, 'systemd-networkd-wait-online.service.d', '10-netplan.conf')
++        self.assertTrue(os.path.isfile(override))
++        with open(override, 'r') as f:
++            # eth99 does not exist on the system, so will not be listed
++            self.assertEqual(f.read(), '''[Unit]
++ConditionPathIsSymbolicLink=/run/systemd/generator/network-online.target.wants/systemd-networkd-wait-online.service
++
++[Service]
++ExecStart=
++ExecStart=/lib/systemd/systemd-networkd-wait-online -i eth99.43:degraded -i br0:degraded -i lo:carrier -i eth99.42:carrier\n''')
+ 
+         # should be a no-op the second time while the stamp exists
+         out = subprocess.check_output([generator, '--root-dir', self.workdir.name, outdir, outdir, outdir],
+@@ -210,10 +223,17 @@ class TestConfigArgs(TestBase):
+         os.unlink(n)
+ 
+         # should auto-enable networkd but not -wait-online
++        service_dir = os.path.join(self.workdir.name, 'run', 'systemd', 'system')
+         self.assertTrue(os.path.islink(os.path.join(
+             outdir, 'multi-user.target.wants', 'systemd-networkd.service')))
+         self.assertFalse(os.path.islink(os.path.join(
+             outdir, 'network-online.target.wants', 'systemd-networkd-wait-online.service')))
++        override = os.path.join(service_dir, 'systemd-networkd-wait-online.service.d', '10-netplan.conf')
++        self.assertTrue(os.path.isfile(override))
++        with open(override, 'r') as f:
++            self.assertEqual(f.read(), '''[Unit]
++ConditionPathIsSymbolicLink=/run/systemd/generator/network-online.target.wants/systemd-networkd-wait-online.service
++''')
+ 
+     def test_systemd_generator_noconf(self):
+         outdir = os.path.join(self.workdir.name, 'out')
+@@ -269,8 +289,21 @@ class TestConfigArgs(TestBase):
+         os.unlink(n)
+ 
+         # should auto-enable networkd and -wait-online
++        service_dir = os.path.join(self.workdir.name, 'run', 'systemd', 'system')
+         self.assertTrue(os.path.islink(os.path.join(
+             outdir, 'multi-user.target.wants', 'systemd-networkd.service')))
++        self.assertTrue(os.path.islink(os.path.join(
++            outdir, 'network-online.target.wants', 'systemd-networkd-wait-online.service')))
++        override = os.path.join(service_dir, 'systemd-networkd-wait-online.service.d', '10-netplan.conf')
++        self.assertTrue(os.path.isfile(override))
++        with open(override, 'r') as f:
++            # eth99 does not exist on the system, so will not be listed
++            self.assertEqual(f.read(), '''[Unit]
++ConditionPathIsSymbolicLink=/run/systemd/generator/network-online.target.wants/systemd-networkd-wait-online.service
++
++[Service]
++ExecStart=
++ExecStart=/lib/systemd/systemd-networkd-wait-online -i a \\; b\\t; c\\t; d \\n 123 \\; echo :degraded\n''')
+ 
+         # should be a no-op the second time while the stamp exists
+         out = subprocess.check_output([generator, '--root-dir', self.workdir.name, outdir, outdir, outdir],
+diff --git a/tests/integration/ethernets.py b/tests/integration/ethernets.py
+index c42e8b5..4ac7fe7 100644
+--- a/tests/integration/ethernets.py
++++ b/tests/integration/ethernets.py
+@@ -391,7 +391,6 @@ class TestNetworkd(IntegrationTestsBase, _CommonTests):
+                           ['inet6 9876:bbbb::11/70', 'inet 172.16.5.3/20'],
+                           ['inet6 fe80:', 'inet 169.254.'])
+ 
+-    @unittest.skip("networkd wait-online is disabled for netplan 1.0 stable")
+     def test_systemd_networkd_wait_online(self):
+         self.addCleanup(subprocess.call, ['ip', 'link', 'del', 'br0'])
+         self.setup_eth(None, False)
diff --git a/debian/patches/0004-generate-avoid-calling-udevadm-control-reload-LP-199.patch b/debian/patches/0004-generate-avoid-calling-udevadm-control-reload-LP-199.patch
new file mode 100644
index 0000000..8e5bb87
--- /dev/null
+++ b/debian/patches/0004-generate-avoid-calling-udevadm-control-reload-LP-199.patch
@@ -0,0 +1,82 @@
+From: =?utf-8?q?Lukas_M=C3=A4rdian?= <[e-mail]>
+Date: Thu, 4 Jul 2024 12:50:53 +0200
+Subject: generate: avoid calling 'udevadm control --reload' (LP: #1999178)
+
+The udev rules directories are monitored and re-loaded automatically with
+modern systemd-udevd. No need to manually reload them in the generator,
+causing side-effects.
+
+We can still force-reload them when issuing 'netplan generate' or
+'netplan apply' through the CLI, just to be on the safe side.
+
+Replaces: https://github.com/canonical/netplan/pull/304
+
+Bug-Ubuntu: https://bugs.launchpad.net/netplan/+bug/1999178
+Origin: https://github.com/canonical/netplan/pull/488
+---
+ netplan_cli/cli/commands/apply.py    |  3 +--
+ netplan_cli/cli/commands/generate.py |  4 ++++
+ src/generate.c                       | 14 --------------
+ 3 files changed, 5 insertions(+), 16 deletions(-)
+
+diff --git a/netplan_cli/cli/commands/apply.py b/netplan_cli/cli/commands/apply.py
+index cfcaf26..a4e744f 100644
+--- a/netplan_cli/cli/commands/apply.py
++++ b/netplan_cli/cli/commands/apply.py
+@@ -252,8 +252,7 @@ class NetplanApply(utils.NetplanCommand):
+                                       stdout=subprocess.DEVNULL,
+                                       stderr=subprocess.DEVNULL)
+ 
+-        # Reloading of udev rules happens during 'netplan generate' already
+-        # subprocess.check_call(['udevadm', 'control', '--reload-rules'])
++        subprocess.check_call(['udevadm', 'control', '--reload'])
+         subprocess.check_call(['udevadm', 'trigger', '--action=move', '--subsystem-match=net', '--settle'])
+ 
+         # apply any SR-IOV related changes, if applicable
+diff --git a/netplan_cli/cli/commands/generate.py b/netplan_cli/cli/commands/generate.py
+index ba51eb0..889411d 100644
+--- a/netplan_cli/cli/commands/generate.py
++++ b/netplan_cli/cli/commands/generate.py
+@@ -82,6 +82,10 @@ class NetplanGenerate(utils.NetplanCommand):
+             argv += ['--mapping', self.mapping]
+         logging.debug('command generate: running %s', argv)
+         res = subprocess.call(argv)
++        try:
++            subprocess.check_call(['udevadm', 'control', '--reload'])
++        except subprocess.CalledProcessError as e:
++            logging.debug(f'Could not call "udevadm control --reload": {str(e)}')
+         # reload systemd, as we might have changed service units, such as
+         # /run/systemd/system/systemd-networkd-wait-online.service.d/10-netplan.conf
+         # Skip it if --mapping is used as nothing will be generated
+diff --git a/src/generate.c b/src/generate.c
+index d6edb0a..ba02a32 100644
+--- a/src/generate.c
++++ b/src/generate.c
+@@ -52,13 +52,6 @@ static GOptionEntry options[] = {
+     {NULL}
+ };
+ 
+-static void
+-reload_udevd(void)
+-{
+-    const gchar *argv[] = { "/bin/udevadm", "control", "--reload", NULL };
+-    g_spawn_sync(NULL, (gchar**)argv, NULL, G_SPAWN_STDERR_TO_DEV_NULL, NULL, NULL, NULL, NULL, NULL, NULL);
+-};
+-
+ /**
+  * Create enablement symlink for systemd-networkd.service.
+  */
+@@ -288,13 +281,6 @@ int main(int argc, char** argv)
+ 
+         CHECK_CALL(netplan_state_finish_nm_write(np_state, rootdir, &error));
+         CHECK_CALL(netplan_state_finish_sriov_write(np_state, rootdir, &error));
+-        /* We may have written .rules & .link files, thus we must
+-         * invalidate udevd cache of its config as by default it only
+-         * invalidates cache at most every 3 seconds. Not sure if this
+-         * should live in `generate' or `apply', but it is confusing
+-         * when udevd ignores just-in-time created rules files.
+-         */
+-        reload_udevd();
+     }
+ 
+     /* Disable /usr/lib/NetworkManager/conf.d/10-globally-managed-devices.conf
diff --git a/debian/patches/lp2060311/0003-util-fix-potential-NULL-pointer-assert.patch b/debian/patches/lp2060311/0003-util-fix-potential-NULL-pointer-assert.patch
deleted file mode 100644
index 9110a71..0000000
--- a/debian/patches/lp2060311/0003-util-fix-potential-NULL-pointer-assert.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-From: =?utf-8?q?Lukas_M=C3=A4rdian?= <[e-mail]>
-Date: Tue, 16 Apr 2024 09:50:51 +0200
-Subject: util: fix potential NULL pointer assert
-
-Origin: https://github.com/canonical/netplan/pull/456/commits/e56a3dcedbf82d5154ad9cc87ef27a375fdfb9bb
-Bug-Ubuntu: https://bugs.launchpad.net/netplan/+bug/2060311
-Forwarded: https://github.com/canonical/netplan/pull/456
----
- src/util.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/util.c b/src/util.c
-index 36eb896..3e6c80d 100644
---- a/src/util.c
-+++ b/src/util.c
-@@ -955,7 +955,7 @@ netplan_netdef_match_interface(const NetplanNetDefinition* netdef, const char* n
-         return !g_strcmp0(name, netdef->id);
- 
-     if (netdef->match.mac) {
--        if (g_ascii_strcasecmp(netdef->match.mac, mac))
-+        if (g_ascii_strcasecmp(netdef->match.mac ?: "", mac ?: ""))
-             return FALSE;
-     }
- 
diff --git a/debian/patches/lp2060311/0004-networkd-add-wait-online-enumeration-utils.patch b/debian/patches/lp2060311/0004-networkd-add-wait-online-enumeration-utils.patch
deleted file mode 100644
index d842be6..0000000
--- a/debian/patches/lp2060311/0004-networkd-add-wait-online-enumeration-utils.patch
+++ /dev/null
@@ -1,189 +0,0 @@
-From: =?utf-8?q?Lukas_M=C3=A4rdian?= <[e-mail]>
-Date: Tue, 16 Apr 2024 09:30:34 +0200
-Subject: networkd: add wait-online enumeration utils
-
-Origin: https://github.com/canonical/netplan/pull/456/commits/4bc25c9ae24b6a6a7e81b92ae901cb7fef4c30df
-Bug-Ubuntu: https://bugs.launchpad.net/netplan/+bug/2060311
-Forwarded: https://github.com/canonical/netplan/pull/456
----
- src/networkd.c                       | 65 +++++++++++++++++++++++++++++++
- tests/ctests/meson.build             |  1 +
- tests/ctests/test_netplan_networkd.c | 74 ++++++++++++++++++++++++++++++++++++
- 3 files changed, 140 insertions(+)
- create mode 100644 tests/ctests/test_netplan_networkd.c
-
-diff --git a/src/networkd.c b/src/networkd.c
-index 25121c4..9289388 100644
---- a/src/networkd.c
-+++ b/src/networkd.c
-@@ -20,6 +20,7 @@
- #include <unistd.h>
- #include <ctype.h>
- #include <errno.h>
-+#include <net/if.h>
- #include <sys/stat.h>
- 
- #include <glib.h>
-@@ -32,6 +33,70 @@
- #include "util-internal.h"
- #include "validation.h"
- 
-+/**
-+ * Query sysfs for the MAC address (up to 20 bytes for infiniband) of @ifname
-+ * The caller owns the returned string and needs to free it.
-+ */
-+STATIC char*
-+_netplan_sysfs_get_mac_by_ifname(const char* ifname, const char* rootdir)
-+{
-+    g_autofree gchar* content = NULL;
-+    g_autofree gchar* sysfs_path = NULL;
-+    sysfs_path = g_build_path(G_DIR_SEPARATOR_S, rootdir ?: G_DIR_SEPARATOR_S,
-+                              "sys", "class", "net", ifname, "address", NULL);
-+
-+    if (!g_file_get_contents (sysfs_path, &content, NULL, NULL)) {
-+        g_debug("%s: Cannot read file contents.", __FUNCTION__);
-+        return NULL;
-+    }
-+
-+    // Trim whitespace & clone value
-+    return g_strdup(g_strstrip(content));
-+}
-+
-+/**
-+ * Query sysfs for the driver used by @ifname
-+ * The caller owns the returned string and needs to free it.
-+ */
-+STATIC char*
-+_netplan_sysfs_get_driver_by_ifname(const char* ifname, const char* rootdir)
-+{
-+    g_autofree gchar* link = NULL;
-+    g_autofree gchar* sysfs_path = NULL;
-+    sysfs_path = g_build_path(G_DIR_SEPARATOR_S, rootdir ?: G_DIR_SEPARATOR_S,
-+                              "sys", "class", "net", ifname, "device", "driver", NULL);
-+
-+    link = g_file_read_link(sysfs_path, NULL);
-+    if (!link) {
-+        g_debug("%s: Cannot read symlink of %s.", __FUNCTION__, sysfs_path);
-+        return NULL;
-+    }
-+
-+    return g_path_get_basename(link);
-+}
-+
-+/**
-+ * Enumerate all network interfaces (/sys/clas/net/...) and check
-+ * netplan_netdef_match_interface() to see if they match the current NetDef
-+ */
-+STATIC void
-+_netplan_enumerate_interfaces(const NetplanNetDefinition* def, GHashTable* tbl, const char* rootdir)
-+{
-+    g_assert(tbl);
-+    struct if_nameindex *if_nidxs, *intf;
-+    if_nidxs = if_nameindex();
-+    if (if_nidxs != NULL) {
-+        for (intf = if_nidxs; intf->if_index != 0 || intf->if_name != NULL; intf++) {
-+            if (g_hash_table_contains(tbl, intf->if_name)) continue;
-+            g_autofree gchar* mac = _netplan_sysfs_get_mac_by_ifname(intf->if_name, rootdir);
-+            g_autofree gchar* driver = _netplan_sysfs_get_driver_by_ifname(intf->if_name, rootdir);
-+            if (netplan_netdef_match_interface(def, intf->if_name, mac, driver))
-+                g_hash_table_add(tbl, g_strdup(intf->if_name));
-+        }
-+        if_freenameindex(if_nidxs);
-+    }
-+}
-+
- /**
-  * Append WiFi frequencies to wpa_supplicant's freq_list=
-  */
-diff --git a/tests/ctests/meson.build b/tests/ctests/meson.build
-index ed3bc5d..dcf4b6c 100644
---- a/tests/ctests/meson.build
-+++ b/tests/ctests/meson.build
-@@ -5,6 +5,7 @@ tests = {
-   'test_netplan_misc': false,
-   'test_netplan_validation': false,
-   'test_netplan_keyfile': false,
-+  'test_netplan_networkd': false,
-   'test_netplan_nm': false,
-   'test_netplan_openvswitch': false,
- }
-diff --git a/tests/ctests/test_netplan_networkd.c b/tests/ctests/test_netplan_networkd.c
-new file mode 100644
-index 0000000..e9e4b79
---- /dev/null
-+++ b/tests/ctests/test_netplan_networkd.c
-@@ -0,0 +1,74 @@
-+#include <stdio.h>
-+#include <stdarg.h>
-+#include <stddef.h>
-+#include <setjmp.h>
-+
-+#include <cmocka.h>
-+
-+#include "netplan.h"
-+#include "util-internal.h"
-+#include "networkd.c"
-+
-+#include "test_utils.h"
-+
-+void
-+test_wait_online_utils(__unused void** state)
-+{
-+    char template[] = "/tmp/netplan.XXXXXX";
-+    const char* rootdir = mkdtemp(template);
-+
-+    // create mock sysfs
-+    g_autofree gchar* sys = g_strdup_printf("%s/sys", rootdir);
-+    g_autofree gchar* sys_class = g_strdup_printf("%s/sys/class", rootdir);
-+    g_autofree gchar* sys_class_net = g_strdup_printf("%s/sys/class/net", rootdir);
-+    g_autofree gchar* eth99 = g_strdup_printf("%s/sys/class/net/eth99", rootdir);
-+    g_autofree gchar* eth99_device = g_strdup_printf("%s/device", eth99);
-+    g_autofree gchar* driver = g_strdup_printf("%s/device/driver", eth99);
-+    g_autofree gchar* mac = g_strdup_printf("%s/address", eth99);
-+    g_mkdir_with_parents(eth99_device, 0700);
-+
-+    // assert MAC address file
-+    assert_true(g_file_set_contents(mac, "  aa:bb:cc:dd:ee:ff \r\n\n", -1, NULL));
-+    g_autofree gchar* mac_value = _netplan_sysfs_get_mac_by_ifname("eth99", rootdir);
-+    assert_string_equal(mac_value, "aa:bb:cc:dd:ee:ff");
-+
-+    // assert driver link
-+    assert_int_equal(symlink("../somewhere/drivers/mock_drv", driver), 0);
-+    g_autofree gchar* driver_value = _netplan_sysfs_get_driver_by_ifname("eth99", rootdir);
-+    assert_string_equal(driver_value, "mock_drv");
-+
-+    // Cleanup
-+    remove(mac);
-+    remove(driver);
-+    rmdir(eth99_device);
-+    rmdir(eth99);
-+    rmdir(sys_class_net);
-+    rmdir(sys_class);
-+    rmdir(sys);
-+    rmdir(rootdir);
-+}
-+
-+
-+int
-+setup(__unused void** state)
-+{
-+    return 0;
-+}
-+
-+int
-+tear_down(__unused void** state)
-+{
-+    return 0;
-+}
-+
-+int
-+main()
-+{
-+
-+    const struct CMUnitTest tests[] = {
-+        cmocka_unit_test(test_wait_online_utils),
-+    };
-+
-+    return cmocka_run_group_tests(tests, setup, tear_down);
-+
-+}
diff --git a/debian/patches/lp2060311/0005-generate-enable-systemd-networkd-wait-online-for-non.patch b/debian/patches/lp2060311/0005-generate-enable-systemd-networkd-wait-online-for-non.patch
deleted file mode 100644
index 573d344..0000000
--- a/debian/patches/lp2060311/0005-generate-enable-systemd-networkd-wait-online-for-non.patch
+++ /dev/null
@@ -1,332 +0,0 @@
-From: =?utf-8?q?Lukas_M=C3=A4rdian?= <[e-mail]>
-Date: Tue, 16 Apr 2024 09:51:40 +0200
-Subject: generate: enable systemd-networkd-wait-online for non-optional
- interfaces only
-
-Skip s-n-wait-online if we don't have any non-optional interfaces, using a
-"ConditionPathIsSymbolicLink=" checking Netplan's s-n-wait-online.service
-enablement symlink.
-
-This is in favor to RequiredForOnline=yes as the behavior of upstream (pure)
-systemd-networkd-wait-online.service is not mean to be used in this way.
-
-If "RequiredForOnline=no" sd-networkd-wait-online will fully ignore the
-corresponding interface and it will block/delay network-online.target if
-no interfaces are "RequiredForOnline=yes" at all.
-
-FR-7246
-
-Origin: https://github.com/canonical/netplan/pull/456/commits/494b2e41dd9e17b79502aa53b49fd92e82acf5c1
-Bug-Ubuntu: https://bugs.launchpad.net/netplan/+bug/2060311
-Forwarded: https://github.com/canonical/netplan/pull/456
----
- src/generate.c                 | 24 ++++++++-------
- src/networkd.c                 | 66 +++++++++++++++++++++++++++++++++++-------
- src/networkd.h                 |  3 ++
- tests/generator/base.py        |  2 ++
- tests/generator/test_args.py   | 56 +++++++++++++++++++++++++++++++++++
- tests/generator/test_common.py |  5 ----
- 6 files changed, 131 insertions(+), 25 deletions(-)
-
-diff --git a/src/generate.c b/src/generate.c
-index 35179a2..19198ff 100644
---- a/src/generate.c
-+++ b/src/generate.c
-@@ -63,7 +63,7 @@ reload_udevd(void)
-  * Create enablement symlink for systemd-networkd.service.
-  */
- static void
--enable_networkd(const char* generator_dir)
-+enable_networkd(const char* generator_dir, gboolean enable_wait_online)
- {
-     g_autofree char* link = g_build_path(G_DIR_SEPARATOR_S, generator_dir, "multi-user.target.wants", "systemd-networkd.service", NULL);
-     g_debug("We created networkd configuration, adding %s enablement symlink", link);
-@@ -75,13 +75,15 @@ enable_networkd(const char* generator_dir)
-         // LCOV_EXCL_STOP
-     }
- 
--    g_autofree char* link2 = g_build_path(G_DIR_SEPARATOR_S, generator_dir, "network-online.target.wants", "systemd-networkd-wait-online.service", NULL);
--    _netplan_safe_mkdir_p_dir(link2);
--    if (symlink("/lib/systemd/system/systemd-networkd-wait-online.service", link2) < 0 && errno != EEXIST) {
--        // LCOV_EXCL_START
--        g_fprintf(stderr, "failed to create enablement symlink: %m\n");
--        exit(1);
--        // LCOV_EXCL_STOP
-+    if (enable_wait_online) {
-+        g_autofree char* link2 = g_build_path(G_DIR_SEPARATOR_S, generator_dir, "network-online.target.wants", "systemd-networkd-wait-online.service", NULL);
-+        _netplan_safe_mkdir_p_dir(link2);
-+        if (symlink("/lib/systemd/system/systemd-networkd-wait-online.service", link2) < 0 && errno != EEXIST) {
-+            // LCOV_EXCL_START
-+            g_fprintf(stderr, "failed to create enablement symlink: %m\n");
-+            exit(1);
-+            // LCOV_EXCL_STOP
-+        }
-     }
- }
- 
-@@ -300,10 +302,11 @@ int main(int argc, char** argv)
-     if (netplan_state_get_backend(np_state) == NETPLAN_BACKEND_NM || any_nm)
-         _netplan_g_string_free_to_file(g_string_new(NULL), rootdir, "/run/NetworkManager/conf.d/10-globally-managed-devices.conf", NULL);
- 
-+    gboolean enable_wait_online = _netplan_networkd_write_wait_online(np_state, rootdir);
-     if (called_as_generator) {
-         /* Ensure networkd starts if we have any configuration for it */
-         if (any_networkd)
--            enable_networkd(files[0]);
-+            enable_networkd(files[0], enable_wait_online);
- 
-         /* Leave a stamp file so that we don't regenerate the configuration
-          * multiple times and userspace can wait for it to finish */
-@@ -324,7 +327,8 @@ int main(int argc, char** argv)
-         /* covered via 'cloud-init' integration test */
-         if (any_networkd) {
-             start_unit_jit("systemd-networkd.socket");
--            start_unit_jit("systemd-networkd-wait-online.service");
-+            if (enable_wait_online)
-+                start_unit_jit("systemd-networkd-wait-online.service");
-             start_unit_jit("systemd-networkd.service");
-         }
-         g_autofree char* glob_run = g_build_path(G_DIR_SEPARATOR_S,
-diff --git a/src/networkd.c b/src/networkd.c
-index 9289388..cd1f7a2 100644
---- a/src/networkd.c
-+++ b/src/networkd.c
-@@ -803,7 +803,6 @@ _netplan_netdef_write_network_file(
-     g_autoptr(GString) link = NULL;
-     GString* s = NULL;
-     mode_t orig_umask;
--    gboolean is_optional = def->optional;
- 
-     SET_OPT_OUT_PTR(has_been_written, FALSE);
- 
-@@ -826,17 +825,9 @@ _netplan_netdef_write_network_file(
-         else /* "off" */
-             mode = "always-down";
-         g_string_append_printf(link, "ActivationPolicy=%s\n", mode);
--        /* When activation-mode is used we default to being optional.
--         * Otherwise systemd might wait indefinitely for the interface to
--         * become online.
--         */
--        is_optional = TRUE;
-     }
- 
--    if (is_optional || def->optional_addresses) {
--        if (is_optional) {
--            g_string_append(link, "RequiredForOnline=no\n");
--        }
-+    if (def->optional_addresses) {
-         for (unsigned i = 0; NETPLAN_OPTIONAL_ADDRESS_TYPES[i].name != NULL; ++i) {
-             if (def->optional_addresses & NETPLAN_OPTIONAL_ADDRESS_TYPES[i].flag) {
-             g_string_append_printf(link, "OptionalAddresses=%s\n", NETPLAN_OPTIONAL_ADDRESS_TYPES[i].name);
-@@ -1466,6 +1457,60 @@ _netplan_netdef_write_networkd(
-     return TRUE;
- }
- 
-+gboolean
-+_netplan_networkd_write_wait_online(const NetplanState* np_state, const char* rootdir)
-+{
-+    // Hash set of non-optional interfaces to wait for
-+    GHashTable* non_optional_interfaces = g_hash_table_new_full(g_str_hash, g_str_equal, g_free, NULL);
-+    NetplanStateIterator iter;
-+    netplan_state_iterator_init(np_state, &iter);
-+    while (netplan_state_iterator_has_next(&iter)) {
-+        const NetplanNetDefinition* def = netplan_state_iterator_next(&iter);
-+        if (def->backend != NETPLAN_BACKEND_NETWORKD)
-+            continue;
-+        /* When activation-mode is used we default to being optional.
-+         * Otherwise, systemd might wait indefinitely for the interface to
-+         * come online.
-+         */
-+        if (!(def->optional || def->activation_mode)) {
-+            if (!netplan_netdef_has_match(def)) { // no matching => single interface
-+                g_hash_table_add(non_optional_interfaces, g_strdup(def->id));
-+            } else if (def->set_name) { // matching on a single interface
-+                g_hash_table_add(non_optional_interfaces, g_strdup(def->set_name));
-+            } else { // matching on potentially multiple interfaces
-+                // XXX: we shouldn't run this enumeration for every NetDef...
-+                _netplan_enumerate_interfaces(def, non_optional_interfaces, rootdir);
-+            }
-+        }
-+    }
-+
-+    // create run/systemd/system/systemd-networkd-wait-online.service.d/
-+    const char* override = "/run/systemd/system/systemd-networkd-wait-online.service.d/10-netplan.conf";
-+    // The "ConditionPathIsSymbolicLink" is Netplan's s-n-wait-online enablement symlink,
-+    // as we want to run -wait-online only if enabled by Netplan.
-+    GString* content = g_string_new("[Unit]\n"
-+        "ConditionPathIsSymbolicLink=/run/systemd/generator/network-online.target.wants/systemd-networkd-wait-online.service\n");
-+    if (g_hash_table_size(non_optional_interfaces) == 0) {
-+        _netplan_g_string_free_to_file(content, rootdir, override, NULL);
-+        g_hash_table_destroy(non_optional_interfaces);
-+        return FALSE;
-+    }
-+
-+    // We have non-optional interface, so let's wait for those explicitly
-+    GHashTableIter idx;
-+    gpointer ifname;
-+    g_string_append(content, "\n[Service]\nExecStart=\n"
-+                                "ExecStart=/lib/systemd/systemd-networkd-wait-online");
-+    g_hash_table_iter_init (&idx, non_optional_interfaces);
-+    while (g_hash_table_iter_next (&idx, &ifname, NULL))
-+        g_string_append_printf(content, " -i %s", (const char*)ifname);
-+    g_string_append(content, "\n");
-+
-+    _netplan_g_string_free_to_file(content, rootdir, override, NULL);
-+    g_hash_table_destroy(non_optional_interfaces);
-+    return TRUE;
-+}
-+
- /**
-  * Clean up all generated configurations in @rootdir from previous runs.
-  */
-@@ -1479,6 +1524,7 @@ _netplan_networkd_cleanup(const char* rootdir)
-     _netplan_unlink_glob(rootdir, "/run/udev/rules.d/99-netplan-*");
-     _netplan_unlink_glob(rootdir, "/run/systemd/system/network.target.wants/netplan-regdom.service");
-     _netplan_unlink_glob(rootdir, "/run/systemd/system/netplan-regdom.service");
-+    _netplan_unlink_glob(rootdir, "/run/systemd/system/systemd-networkd-wait-online.service.d/10-netplan*.conf");
-     /* Historically (up to v0.98) we had netplan-wpa@*.service files, in case of an
-      * upgraded system, we need to make sure to clean those up. */
-     _netplan_unlink_glob(rootdir, "/run/systemd/system/systemd-networkd.service.wants/netplan-wpa@*.service");
-diff --git a/src/networkd.h b/src/networkd.h
-index 2bd0848..8332b7b 100644
---- a/src/networkd.h
-+++ b/src/networkd.h
-@@ -37,5 +37,8 @@ _netplan_netdef_write_network_file(
-         gboolean* has_been_written,
-         GError** error);
- 
-+NETPLAN_INTERNAL gboolean
-+_netplan_networkd_write_wait_online(const NetplanState* np_state, const char* rootdir);
-+
- NETPLAN_INTERNAL void
- _netplan_networkd_cleanup(const char* rootdir);
-diff --git a/tests/generator/base.py b/tests/generator/base.py
-index bcc9d8a..4f27e94 100644
---- a/tests/generator/base.py
-+++ b/tests/generator/base.py
-@@ -465,6 +465,8 @@ class TestBase(unittest.TestCase):
-         self.assertEqual(set(os.listdir(self.workdir.name)) - {'lib'}, {'etc', 'run'})
-         ovs_systemd_dir = set(os.listdir(systemd_dir))
-         ovs_systemd_dir.remove('systemd-networkd.service.wants')
-+        if 'systemd-networkd-wait-online.service.d' in ovs_systemd_dir:
-+            ovs_systemd_dir.remove('systemd-networkd-wait-online.service.d')
-         self.assertEqual(ovs_systemd_dir, {'netplan-ovs-' + f for f in file_contents_map})
-         for fname, contents in file_contents_map.items():
-             fname = 'netplan-ovs-' + fname
-diff --git a/tests/generator/test_args.py b/tests/generator/test_args.py
-index 2c5ffe2..ffa603a 100644
---- a/tests/generator/test_args.py
-+++ b/tests/generator/test_args.py
-@@ -124,6 +124,11 @@ class TestConfigArgs(TestBase):
-   version: 2
-   ethernets:
-     eth0:
-+      dhcp4: true
-+    eth1:
-+      dhcp4: true
-+      optional: true
-+    eth2:
-       dhcp4: true''')
-         outdir = os.path.join(self.workdir.name, 'out')
-         os.mkdir(outdir)
-@@ -136,12 +141,28 @@ class TestConfigArgs(TestBase):
-         n = os.path.join(self.workdir.name, 'run', 'systemd', 'network', '10-netplan-eth0.network')
-         self.assertTrue(os.path.exists(n))
-         os.unlink(n)
-+        n = os.path.join(self.workdir.name, 'run', 'systemd', 'network', '10-netplan-eth1.network')
-+        self.assertTrue(os.path.exists(n))
-+        os.unlink(n)
-+        n = os.path.join(self.workdir.name, 'run', 'systemd', 'network', '10-netplan-eth2.network')
-+        self.assertTrue(os.path.exists(n))
-+        os.unlink(n)
- 
-         # should auto-enable networkd and -wait-online
-+        service_dir = os.path.join(self.workdir.name, 'run', 'systemd', 'system')
-         self.assertTrue(os.path.islink(os.path.join(
-             outdir, 'multi-user.target.wants', 'systemd-networkd.service')))
-         self.assertTrue(os.path.islink(os.path.join(
-             outdir, 'network-online.target.wants', 'systemd-networkd-wait-online.service')))
-+        override = os.path.join(service_dir, 'systemd-networkd-wait-online.service.d', '10-netplan.conf')
-+        self.assertTrue(os.path.isfile(override))
-+        with open(override, 'r') as f:
-+            self.assertEqual(f.read(), '''[Unit]
-+ConditionPathIsSymbolicLink=/run/systemd/generator/network-online.target.wants/systemd-networkd-wait-online.service
-+
-+[Service]
-+ExecStart=
-+ExecStart=/lib/systemd/systemd-networkd-wait-online -i eth0 -i eth2\n''')
- 
-         # should be a no-op the second time while the stamp exists
-         out = subprocess.check_output([generator, '--root-dir', self.workdir.name, outdir, outdir, outdir],
-@@ -155,6 +176,41 @@ class TestConfigArgs(TestBase):
-         subprocess.check_output([generator, '--root-dir', self.workdir.name, outdir, outdir, outdir])
-         self.assertTrue(os.path.exists(n))
- 
-+    def test_systemd_generator_all_optional(self):
-+        conf = os.path.join(self.confdir, 'a.yaml')
-+        os.makedirs(os.path.dirname(conf))
-+        with open(conf, 'w') as f:
-+            f.write('''network:
-+  version: 2
-+  ethernets:
-+    eth0:
-+      dhcp4: true
-+      optional: true''')
-+        outdir = os.path.join(self.workdir.name, 'out')
-+        os.mkdir(outdir)
-+
-+        generator = os.path.join(self.workdir.name, 'systemd', 'system-generators', 'netplan')
-+        os.makedirs(os.path.dirname(generator))
-+        os.symlink(exe_generate, generator)
-+
-+        subprocess.check_call([generator, '--root-dir', self.workdir.name, outdir, outdir, outdir])
-+        n = os.path.join(self.workdir.name, 'run', 'systemd', 'network', '10-netplan-eth0.network')
-+        self.assertTrue(os.path.exists(n))
-+        os.unlink(n)
-+
-+        # should auto-enable networkd but not -wait-online
-+        service_dir = os.path.join(self.workdir.name, 'run', 'systemd', 'system')
-+        self.assertTrue(os.path.islink(os.path.join(
-+            outdir, 'multi-user.target.wants', 'systemd-networkd.service')))
-+        self.assertFalse(os.path.islink(os.path.join(
-+            outdir, 'network-online.target.wants', 'systemd-networkd-wait-online.service')))
-+        override = os.path.join(service_dir, 'systemd-networkd-wait-online.service.d', '10-netplan.conf')
-+        self.assertTrue(os.path.isfile(override))
-+        with open(override, 'r') as f:
-+            self.assertEqual(f.read(), '''[Unit]
-+ConditionPathIsSymbolicLink=/run/systemd/generator/network-online.target.wants/systemd-networkd-wait-online.service
-+''')
-+
-     def test_systemd_generator_noconf(self):
-         outdir = os.path.join(self.workdir.name, 'out')
-         os.mkdir(outdir)
-diff --git a/tests/generator/test_common.py b/tests/generator/test_common.py
-index 785f6f4..d98eb32 100644
---- a/tests/generator/test_common.py
-+++ b/tests/generator/test_common.py
-@@ -35,9 +35,6 @@ class TestNetworkd(TestBase):
-         self.assert_networkd({'eth0.network': '''[Match]
- Name=eth0
- 
--[Link]
--RequiredForOnline=no
--
- [Network]
- DHCP=ipv6
- LinkLocalAddressing=ipv6
-@@ -85,7 +82,6 @@ Name=eth0
- 
- [Link]
- ActivationPolicy=always-down
--RequiredForOnline=no
- 
- [Network]
- DHCP=ipv6
-@@ -109,7 +105,6 @@ Name=eth0
- 
- [Link]
- ActivationPolicy=manual
--RequiredForOnline=no
- 
- [Network]
- DHCP=ipv6
diff --git a/debian/patches/lp2060311/0006-CLI-utils-Do-not-ask-for-daemon-reload-password-inte.patch b/debian/patches/lp2060311/0006-CLI-utils-Do-not-ask-for-daemon-reload-password-inte.patch
deleted file mode 100644
index b05d01a..0000000
--- a/debian/patches/lp2060311/0006-CLI-utils-Do-not-ask-for-daemon-reload-password-inte.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From: =?utf-8?q?Lukas_M=C3=A4rdian?= <[e-mail]>
-Date: Wed, 17 Apr 2024 10:23:16 +0200
-Subject: CLI:utils: Do not ask for daemon-reload password interactively
-
-Origin: https://github.com/canonical/netplan/pull/456/commits/03c269d172955bff0fedff9504f6fa80e5a0b413
-Bug-Ubuntu: https://bugs.launchpad.net/netplan/+bug/2060311
-Forwarded: https://github.com/canonical/netplan/pull/456
----
- netplan_cli/cli/utils.py | 2 +-
- tests/cli_legacy.py      | 3 +--
- tests/test_utils.py      | 2 +-
- 3 files changed, 3 insertions(+), 4 deletions(-)
-
-diff --git a/netplan_cli/cli/utils.py b/netplan_cli/cli/utils.py
-index c89af1a..c9f9ce2 100644
---- a/netplan_cli/cli/utils.py
-+++ b/netplan_cli/cli/utils.py
-@@ -165,7 +165,7 @@ def systemctl_is_installed(unit_pattern):
- 
- def systemctl_daemon_reload():
-     '''Reload systemd unit files from disk and re-calculate its dependencies'''
--    subprocess.check_call(['systemctl', 'daemon-reload'])
-+    subprocess.check_call(['systemctl', 'daemon-reload', '--no-ask-password'])
- 
- 
- def ip_addr_flush(iface):
-diff --git a/tests/cli_legacy.py b/tests/cli_legacy.py
-index 897043e..decde81 100755
---- a/tests/cli_legacy.py
-+++ b/tests/cli_legacy.py
-@@ -98,8 +98,7 @@ class TestGenerate(unittest.TestCase):
-     enlol: {dhcp4: yes}''')
-         os.chmod(path_a, mode=0o600)
-         os.chmod(path_b, mode=0o600)
--        out = subprocess.check_output(exe_cli + ['generate', '--root-dir', self.workdir.name], stderr=subprocess.STDOUT)
--        self.assertEqual(out, b'')
-+        subprocess.check_call(exe_cli + ['generate', '--root-dir', self.workdir.name])
-         self.assertEqual(os.listdir(os.path.join(self.workdir.name, 'run', 'systemd', 'network')),
-                          ['10-netplan-enlol.network'])
- 
-diff --git a/tests/test_utils.py b/tests/test_utils.py
-index 55c907c..c7ab060 100644
---- a/tests/test_utils.py
-+++ b/tests/test_utils.py
-@@ -380,7 +380,7 @@ class TestUtils(unittest.TestCase):
-         os.environ['PATH'] = os.path.dirname(self.mock_cmd.path) + os.pathsep + path_env
-         utils.systemctl_daemon_reload()
-         self.assertEqual(self.mock_cmd.calls(), [
--            ['systemctl', 'daemon-reload']
-+            ['systemctl', 'daemon-reload', '--no-ask-password']
-         ])
- 
-     def test_ip_addr_flush(self):
diff --git a/debian/patches/lp2060311/0007-CLI-generate-call-daemon-reload-after-re-generating-.patch b/debian/patches/lp2060311/0007-CLI-generate-call-daemon-reload-after-re-generating-.patch
deleted file mode 100644
index 2998726..0000000
--- a/debian/patches/lp2060311/0007-CLI-generate-call-daemon-reload-after-re-generating-.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From: =?utf-8?q?Lukas_M=C3=A4rdian?= <[e-mail]>
-Date: Wed, 17 Apr 2024 10:23:51 +0200
-Subject: CLI:generate: call daemon-reload after (re-)generating services
-
-Origin: https://github.com/canonical/netplan/pull/456/commits/f3d9994ae3d45d5e114e40efe6040319caaf5850
-Bug-Ubuntu: https://bugs.launchpad.net/netplan/+bug/2060311
-Forwarded: https://github.com/canonical/netplan/pull/456
----
- netplan_cli/cli/commands/generate.py | 9 ++++++++-
- 1 file changed, 8 insertions(+), 1 deletion(-)
-
-diff --git a/netplan_cli/cli/commands/generate.py b/netplan_cli/cli/commands/generate.py
-index f84b171..dcbbb53 100644
---- a/netplan_cli/cli/commands/generate.py
-+++ b/netplan_cli/cli/commands/generate.py
-@@ -81,5 +81,12 @@ class NetplanGenerate(utils.NetplanCommand):
-         if self.mapping:
-             argv += ['--mapping', self.mapping]
-         logging.debug('command generate: running %s', argv)
-+        res = subprocess.call(argv)
-+        # reload systemd, as we might have changed service units, such as
-+        # /run/systemd/system/systemd-networkd-wait-online.service.d/10-netplan.conf
-+        try:
-+            utils.systemctl_daemon_reload()
-+        except subprocess.CalledProcessError as e:
-+            logging.warning(e)
-         # FIXME: os.execv(argv[0], argv) would be better but fails coverage
--        sys.exit(subprocess.call(argv))
-+        sys.exit(res)
diff --git a/debian/patches/lp2060311/0008-wait-online-Do-not-block-on-loopback-interface.patch b/debian/patches/lp2060311/0008-wait-online-Do-not-block-on-loopback-interface.patch
deleted file mode 100644
index 34c3ec2..0000000
--- a/debian/patches/lp2060311/0008-wait-online-Do-not-block-on-loopback-interface.patch
+++ /dev/null
@@ -1,71 +0,0 @@
-From: =?utf-8?q?Lukas_M=C3=A4rdian?= <[e-mail]>
-Date: Wed, 17 Apr 2024 10:24:36 +0200
-Subject: wait-online: Do not block on loopback interface
-
-Origin: https://github.com/canonical/netplan/pull/456/commits/bd9456999aa6a1a71a475985c8b8556f57ed2b2f
-Bug-Ubuntu: https://bugs.launchpad.net/netplan/+bug/2060311
-Forwarded: https://github.com/canonical/netplan/pull/456
----
- src/networkd.c               | 12 +++++++++---
- tests/generator/test_args.py |  8 ++++----
- 2 files changed, 13 insertions(+), 7 deletions(-)
-
-diff --git a/src/networkd.c b/src/networkd.c
-index cd1f7a2..862176b 100644
---- a/src/networkd.c
-+++ b/src/networkd.c
-@@ -1498,12 +1498,18 @@ _netplan_networkd_write_wait_online(const NetplanState* np_state, const char* ro
- 
-     // We have non-optional interface, so let's wait for those explicitly
-     GHashTableIter idx;
--    gpointer ifname;
-+    gpointer key;
-     g_string_append(content, "\n[Service]\nExecStart=\n"
-                                 "ExecStart=/lib/systemd/systemd-networkd-wait-online");
-     g_hash_table_iter_init (&idx, non_optional_interfaces);
--    while (g_hash_table_iter_next (&idx, &ifname, NULL))
--        g_string_append_printf(content, " -i %s", (const char*)ifname);
-+    while (g_hash_table_iter_next (&idx, &key, NULL)) {
-+        const char* ifname = key;
-+        g_string_append_printf(content, " -i %s", ifname);
-+        // XXX: We should be checking IFF_LOOPBACK instead of interface name.
-+        //      But don't have access to the flags here.
-+        if (!g_strcmp0(ifname, "lo"))
-+            g_string_append(content, ":carrier"); // "carrier" as min-oper state for loopback
-+    }
-     g_string_append(content, "\n");
- 
-     _netplan_g_string_free_to_file(content, rootdir, override, NULL);
-diff --git a/tests/generator/test_args.py b/tests/generator/test_args.py
-index ffa603a..0db4d38 100644
---- a/tests/generator/test_args.py
-+++ b/tests/generator/test_args.py
-@@ -128,8 +128,8 @@ class TestConfigArgs(TestBase):
-     eth1:
-       dhcp4: true
-       optional: true
--    eth2:
--      dhcp4: true''')
-+    lo:
-+      addresses: ["127.0.0.1/8", "::1/128"]''')
-         outdir = os.path.join(self.workdir.name, 'out')
-         os.mkdir(outdir)
- 
-@@ -144,7 +144,7 @@ class TestConfigArgs(TestBase):
-         n = os.path.join(self.workdir.name, 'run', 'systemd', 'network', '10-netplan-eth1.network')
-         self.assertTrue(os.path.exists(n))
-         os.unlink(n)
--        n = os.path.join(self.workdir.name, 'run', 'systemd', 'network', '10-netplan-eth2.network')
-+        n = os.path.join(self.workdir.name, 'run', 'systemd', 'network', '10-netplan-lo.network')
-         self.assertTrue(os.path.exists(n))
-         os.unlink(n)
- 
-@@ -162,7 +162,7 @@ ConditionPathIsSymbolicLink=/run/systemd/generator/network-online.target.wants/s
- 
- [Service]
- ExecStart=
--ExecStart=/lib/systemd/systemd-networkd-wait-online -i eth0 -i eth2\n''')
-+ExecStart=/lib/systemd/systemd-networkd-wait-online -i lo:carrier -i eth0\n''')
- 
-         # should be a no-op the second time while the stamp exists
-         out = subprocess.check_output([generator, '--root-dir', self.workdir.name, outdir, outdir, outdir],
diff --git a/debian/patches/lp2060311/0009-generate-Do-not-touch-wait-online-if-we-don-t-have-a.patch b/debian/patches/lp2060311/0009-generate-Do-not-touch-wait-online-if-we-don-t-have-a.patch
deleted file mode 100644
index a836418..0000000
--- a/debian/patches/lp2060311/0009-generate-Do-not-touch-wait-online-if-we-don-t-have-a.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From: =?utf-8?q?Lukas_M=C3=A4rdian?= <[e-mail]>
-Date: Wed, 17 Apr 2024 10:27:27 +0200
-Subject: generate: Do not touch wait-online,
- if we don't have any networkd NetDefs
-
-Origin: https://github.com/canonical/netplan/pull/456/commits/e98eac8074cdd7cd99d17a40b15ae414b9eb6d3d
-Bug-Ubuntu: https://bugs.launchpad.net/netplan/+bug/2060311
-Forwarded: https://github.com/canonical/netplan/pull/456
----
- src/generate.c               | 5 ++++-
- tests/generator/test_args.py | 4 ++++
- 2 files changed, 8 insertions(+), 1 deletion(-)
-
-diff --git a/src/generate.c b/src/generate.c
-index 19198ff..d6edb0a 100644
---- a/src/generate.c
-+++ b/src/generate.c
-@@ -302,7 +302,10 @@ int main(int argc, char** argv)
-     if (netplan_state_get_backend(np_state) == NETPLAN_BACKEND_NM || any_nm)
-         _netplan_g_string_free_to_file(g_string_new(NULL), rootdir, "/run/NetworkManager/conf.d/10-globally-managed-devices.conf", NULL);
- 
--    gboolean enable_wait_online = _netplan_networkd_write_wait_online(np_state, rootdir);
-+    gboolean enable_wait_online = FALSE;
-+    if (any_networkd)
-+        enable_wait_online = _netplan_networkd_write_wait_online(np_state, rootdir);
-+
-     if (called_as_generator) {
-         /* Ensure networkd starts if we have any configuration for it */
-         if (any_networkd)
-diff --git a/tests/generator/test_args.py b/tests/generator/test_args.py
-index 0db4d38..5e36cf2 100644
---- a/tests/generator/test_args.py
-+++ b/tests/generator/test_args.py
-@@ -39,6 +39,10 @@ class TestConfigArgs(TestBase):
-         self.assert_nm(None)
-         self.assert_nm_udev(None)
-         self.assert_ovs({'cleanup.service': OVS_CLEANUP % {'iface': 'cleanup'}})
-+        # should not touch -wait-online
-+        service_dir = os.path.join(self.workdir.name, 'run', 'systemd', 'system')
-+        override = os.path.join(service_dir, 'systemd-networkd-wait-online.service.d', '10-netplan.conf')
-+        self.assertFalse(os.path.isfile(override))
- 
-     def test_empty_config(self):
-         self.generate('')
diff --git a/debian/patches/lp2060311/0010-wait-online-wait-for-existing-interfaces-only-and-do.patch b/debian/patches/lp2060311/0010-wait-online-wait-for-existing-interfaces-only-and-do.patch
deleted file mode 100644
index 8568aa5..0000000
--- a/debian/patches/lp2060311/0010-wait-online-wait-for-existing-interfaces-only-and-do.patch
+++ /dev/null
@@ -1,238 +0,0 @@
-From: =?utf-8?q?Lukas_M=C3=A4rdian?= <[e-mail]>
-Date: Wed, 17 Apr 2024 12:01:13 +0200
-Subject: wait-online: wait for existing interfaces only and downgrade
- operational state for interfaces without IP configuration
-
-Origin: https://github.com/canonical/netplan/pull/456/commits/98d7f8af2013abc47dbaf3f11913ca06fb741255
-Bug-Ubuntu: https://bugs.launchpad.net/netplan/+bug/2060311
-Forwarded: https://github.com/canonical/netplan/pull/456
----
- src/networkd.c                 | 71 +++++++++++++++++++++++++++++-------------
- tests/generator/test_args.py   | 10 +++---
- tests/integration/ethernets.py | 37 ++++++++++++++++++++++
- 3 files changed, 92 insertions(+), 26 deletions(-)
-
-diff --git a/src/networkd.c b/src/networkd.c
-index 862176b..71432d4 100644
---- a/src/networkd.c
-+++ b/src/networkd.c
-@@ -75,28 +75,42 @@ _netplan_sysfs_get_driver_by_ifname(const char* ifname, const char* rootdir)
-     return g_path_get_basename(link);
- }
- 
--/**
-- * Enumerate all network interfaces (/sys/clas/net/...) and check
-- * netplan_netdef_match_interface() to see if they match the current NetDef
-- */
- STATIC void
--_netplan_enumerate_interfaces(const NetplanNetDefinition* def, GHashTable* tbl, const char* rootdir)
-+_netplan_query_system_interfaces(GHashTable* tbl)
- {
-     g_assert(tbl);
-     struct if_nameindex *if_nidxs, *intf;
-     if_nidxs = if_nameindex();
-     if (if_nidxs != NULL) {
--        for (intf = if_nidxs; intf->if_index != 0 || intf->if_name != NULL; intf++) {
--            if (g_hash_table_contains(tbl, intf->if_name)) continue;
--            g_autofree gchar* mac = _netplan_sysfs_get_mac_by_ifname(intf->if_name, rootdir);
--            g_autofree gchar* driver = _netplan_sysfs_get_driver_by_ifname(intf->if_name, rootdir);
--            if (netplan_netdef_match_interface(def, intf->if_name, mac, driver))
--                g_hash_table_add(tbl, g_strdup(intf->if_name));
--        }
-+        for (intf = if_nidxs; intf->if_index != 0 || intf->if_name != NULL; intf++)
-+            g_hash_table_add(tbl, g_strdup(intf->if_name));
-         if_freenameindex(if_nidxs);
-     }
- }
- 
-+/**
-+ * Enumerate all network interfaces (/sys/clas/net/...) and check
-+ * netplan_netdef_match_interface() to see if they match the current NetDef
-+ */
-+STATIC void
-+_netplan_enumerate_interfaces(const NetplanNetDefinition* def, GHashTable* ifaces, GHashTable* tbl, const char* carrier, const char* set_name, const char* rootdir)
-+{
-+    g_assert(ifaces);
-+    g_assert(tbl);
-+
-+    GHashTableIter iter;
-+    gpointer key;
-+    g_hash_table_iter_init (&iter, ifaces);
-+    while (g_hash_table_iter_next (&iter, &key, NULL)) {
-+        const char* ifname = key;
-+        if (g_hash_table_contains(tbl, ifname)|| (set_name && g_hash_table_contains(tbl, set_name))) continue;
-+        g_autofree gchar* mac = _netplan_sysfs_get_mac_by_ifname(ifname, rootdir);
-+        g_autofree gchar* driver = _netplan_sysfs_get_driver_by_ifname(ifname, rootdir);
-+        if (netplan_netdef_match_interface(def, ifname, mac, driver))
-+            g_hash_table_replace(tbl, set_name ? g_strdup(set_name) : g_strdup(ifname), g_strdup(carrier));
-+    }
-+}
-+
- /**
-  * Append WiFi frequencies to wpa_supplicant's freq_list=
-  */
-@@ -1460,29 +1474,41 @@ _netplan_netdef_write_networkd(
- gboolean
- _netplan_networkd_write_wait_online(const NetplanState* np_state, const char* rootdir)
- {
-+    // Set of all current network interfaces, potentially non yet renamed
-+    GHashTable* system_interfaces = g_hash_table_new_full(g_str_hash, g_str_equal, g_free, NULL);
-+    _netplan_query_system_interfaces(system_interfaces);
-+
-     // Hash set of non-optional interfaces to wait for
--    GHashTable* non_optional_interfaces = g_hash_table_new_full(g_str_hash, g_str_equal, g_free, NULL);
-+    GHashTable* non_optional_interfaces = g_hash_table_new_full(g_str_hash, g_str_equal, g_free, g_free);
-     NetplanStateIterator iter;
-     netplan_state_iterator_init(np_state, &iter);
-     while (netplan_state_iterator_has_next(&iter)) {
--        const NetplanNetDefinition* def = netplan_state_iterator_next(&iter);
-+        NetplanNetDefinition* def = netplan_state_iterator_next(&iter);
-         if (def->backend != NETPLAN_BACKEND_NETWORKD)
-             continue;
-+
-         /* When activation-mode is used we default to being optional.
-          * Otherwise, systemd might wait indefinitely for the interface to
-          * come online.
-          */
-         if (!(def->optional || def->activation_mode)) {
--            if (!netplan_netdef_has_match(def)) { // no matching => single interface
--                g_hash_table_add(non_optional_interfaces, g_strdup(def->id));
--            } else if (def->set_name) { // matching on a single interface
--                g_hash_table_add(non_optional_interfaces, g_strdup(def->set_name));
-+            // Check if we have any IP configuration
-+            struct address_iter* addr_iter = _netplan_netdef_new_address_iter(def);
-+            gboolean any_ips = _netplan_address_iter_next(addr_iter) != NULL || netplan_netdef_get_link_local_ipv4(def) || netplan_netdef_get_link_local_ipv6(def);
-+            _netplan_address_iter_free(addr_iter);
-+
-+            // no matching => single interface, ignoring non-existing interfaces
-+            if (!netplan_netdef_has_match(def) && g_hash_table_contains(system_interfaces, def->id)) {
-+                g_hash_table_replace(non_optional_interfaces, g_strdup(def->id), any_ips ? g_strdup("degraded") : g_strdup("carrier"));
-+            } else if (def->set_name) { // matching on a single interface, to be renamed
-+                 _netplan_enumerate_interfaces(def, system_interfaces, non_optional_interfaces, any_ips ? "degraded" : "carrier", def->set_name, rootdir);
-             } else { // matching on potentially multiple interfaces
-                 // XXX: we shouldn't run this enumeration for every NetDef...
--                _netplan_enumerate_interfaces(def, non_optional_interfaces, rootdir);
-+                _netplan_enumerate_interfaces(def, system_interfaces, non_optional_interfaces, any_ips ? "degraded" : "carrier", NULL, rootdir);
-             }
-         }
-     }
-+    g_hash_table_destroy(system_interfaces);
- 
-     // create run/systemd/system/systemd-networkd-wait-online.service.d/
-     const char* override = "/run/systemd/system/systemd-networkd-wait-online.service.d/10-netplan.conf";
-@@ -1498,17 +1524,20 @@ _netplan_networkd_write_wait_online(const NetplanState* np_state, const char* ro
- 
-     // We have non-optional interface, so let's wait for those explicitly
-     GHashTableIter idx;
--    gpointer key;
-+    gpointer key, value;
-     g_string_append(content, "\n[Service]\nExecStart=\n"
-                                 "ExecStart=/lib/systemd/systemd-networkd-wait-online");
-     g_hash_table_iter_init (&idx, non_optional_interfaces);
--    while (g_hash_table_iter_next (&idx, &key, NULL)) {
-+    while (g_hash_table_iter_next (&idx, &key, &value)) {
-         const char* ifname = key;
-+        const char* min_oper_state = value;
-         g_string_append_printf(content, " -i %s", ifname);
-         // XXX: We should be checking IFF_LOOPBACK instead of interface name.
-         //      But don't have access to the flags here.
-         if (!g_strcmp0(ifname, "lo"))
-             g_string_append(content, ":carrier"); // "carrier" as min-oper state for loopback
-+        else if (min_oper_state)
-+            g_string_append_printf(content, ":%s", min_oper_state);
-     }
-     g_string_append(content, "\n");
- 
-diff --git a/tests/generator/test_args.py b/tests/generator/test_args.py
-index 5e36cf2..de5aaa8 100644
---- a/tests/generator/test_args.py
-+++ b/tests/generator/test_args.py
-@@ -127,9 +127,9 @@ class TestConfigArgs(TestBase):
-             f.write('''network:
-   version: 2
-   ethernets:
--    eth0:
-+    eth99:
-       dhcp4: true
--    eth1:
-+    eth98:
-       dhcp4: true
-       optional: true
-     lo:
-@@ -142,10 +142,10 @@ class TestConfigArgs(TestBase):
-         os.symlink(exe_generate, generator)
- 
-         subprocess.check_call([generator, '--root-dir', self.workdir.name, outdir, outdir, outdir])
--        n = os.path.join(self.workdir.name, 'run', 'systemd', 'network', '10-netplan-eth0.network')
-+        n = os.path.join(self.workdir.name, 'run', 'systemd', 'network', '10-netplan-eth99.network')
-         self.assertTrue(os.path.exists(n))
-         os.unlink(n)
--        n = os.path.join(self.workdir.name, 'run', 'systemd', 'network', '10-netplan-eth1.network')
-+        n = os.path.join(self.workdir.name, 'run', 'systemd', 'network', '10-netplan-eth98.network')
-         self.assertTrue(os.path.exists(n))
-         os.unlink(n)
-         n = os.path.join(self.workdir.name, 'run', 'systemd', 'network', '10-netplan-lo.network')
-@@ -166,7 +166,7 @@ ConditionPathIsSymbolicLink=/run/systemd/generator/network-online.target.wants/s
- 
- [Service]
- ExecStart=
--ExecStart=/lib/systemd/systemd-networkd-wait-online -i lo:carrier -i eth0\n''')
-+ExecStart=/lib/systemd/systemd-networkd-wait-online -i lo:carrier\n''')  # eth99 does not exist on the system
- 
-         # should be a no-op the second time while the stamp exists
-         out = subprocess.check_output([generator, '--root-dir', self.workdir.name, outdir, outdir, outdir],
-diff --git a/tests/integration/ethernets.py b/tests/integration/ethernets.py
-index e43f533..7028a49 100644
---- a/tests/integration/ethernets.py
-+++ b/tests/integration/ethernets.py
-@@ -22,6 +22,7 @@
- # You should have received a copy of the GNU General Public License
- # along with this program.  If not, see <http://www.gnu.org/licenses/>.
- 
-+import os
- import sys
- import subprocess
- import unittest
-@@ -390,6 +391,42 @@ class TestNetworkd(IntegrationTestsBase, _CommonTests):
-                           ['inet6 9876:bbbb::11/70', 'inet 172.16.5.3/20'],
-                           ['inet6 fe80:', 'inet 169.254.'])
- 
-+    def test_systemd_networkd_wait_online(self):
-+        self.setup_eth(None)
-+        with open(self.config, 'w') as f:
-+            f.write('''network:
-+  renderer: %(r)s
-+  ethernets:
-+    lo:
-+      addresses: ["127.0.0.1/8", "::1/128"]
-+      optional: true
-+    doesnotexist:
-+      addresses: ["10.0.0.42/24"]
-+    findme:
-+      match:
-+        macaddress: %(ec_mac)s
-+      link-local: []
-+      set-name: "findme"
-+    %(e2c)s:
-+      addresses: ["10.0.0.1/24"]
-+''' % {'r': self.backend, 'ec_mac': self.dev_e_client_mac, 'e2c': self.dev_e2_client})
-+        self.generate_and_settle([self.dev_e2_client])
-+        override = os.path.join('/run', 'systemd', 'system', 'systemd-networkd-wait-online.service.d', '10-netplan.conf')
-+        self.assertTrue(os.path.isfile(override))
-+
-+        with open(override, 'r') as f:
-+            # lo is optional/ignored and should not be listed
-+            # doesnotexist should not be listed, as it does not exist
-+            # <dev_e_client> should be listed as "findme", using reduced operational state
-+            # <dev_e2_client> should be listed normally
-+            self.assertEqual(f.read(), '''[Unit]
-+ConditionPathIsSymbolicLink=/run/systemd/generator/network-online.target.wants/systemd-networkd-wait-online.service
-+
-+[Service]
-+ExecStart=
-+ExecStart=/lib/systemd/systemd-networkd-wait-online -i %s:degraded -i findme:carrier
-+''' % self.dev_e2_client)
-+
- 
- @unittest.skipIf("NetworkManager" not in test_backends,
-                  "skipping as NetworkManager backend tests are disabled")
diff --git a/debian/patches/lp2060311/0011-wait-online-account-for-DHCPv4-v6-addresses.patch b/debian/patches/lp2060311/0011-wait-online-account-for-DHCPv4-v6-addresses.patch
deleted file mode 100644
index 954ee57..0000000
--- a/debian/patches/lp2060311/0011-wait-online-account-for-DHCPv4-v6-addresses.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From: =?utf-8?q?Lukas_M=C3=A4rdian?= <[e-mail]>
-Date: Wed, 17 Apr 2024 17:42:27 +0200
-Subject: wait-online: account for DHCPv4/v6 addresses
-
-Origin: https://github.com/canonical/netplan/pull/456/commits/3d62dfbf3bbd028e4e9d69f7f1a5ddd803d60a33
-Bug-Ubuntu: https://bugs.launchpad.net/netplan/+bug/2060311
-Forwarded: https://github.com/canonical/netplan/pull/456
----
- src/networkd.c | 6 +++++-
- 1 file changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/src/networkd.c b/src/networkd.c
-index 71432d4..f4c081c 100644
---- a/src/networkd.c
-+++ b/src/networkd.c
-@@ -1494,7 +1494,11 @@ _netplan_networkd_write_wait_online(const NetplanState* np_state, const char* ro
-         if (!(def->optional || def->activation_mode)) {
-             // Check if we have any IP configuration
-             struct address_iter* addr_iter = _netplan_netdef_new_address_iter(def);
--            gboolean any_ips = _netplan_address_iter_next(addr_iter) != NULL || netplan_netdef_get_link_local_ipv4(def) || netplan_netdef_get_link_local_ipv6(def);
-+            gboolean any_ips =    _netplan_address_iter_next(addr_iter) != NULL
-+                               || netplan_netdef_get_dhcp4(def)
-+                               || netplan_netdef_get_dhcp6(def)
-+                               || netplan_netdef_get_link_local_ipv4(def)
-+                               || netplan_netdef_get_link_local_ipv6(def);
-             _netplan_address_iter_free(addr_iter);
- 
-             // no matching => single interface, ignoring non-existing interfaces
diff --git a/debian/patches/lp2060311/0012-wait-online-do-not-require-virtual-devices-to-be-cre.patch b/debian/patches/lp2060311/0012-wait-online-do-not-require-virtual-devices-to-be-cre.patch
deleted file mode 100644
index 7a34949..0000000
--- a/debian/patches/lp2060311/0012-wait-online-do-not-require-virtual-devices-to-be-cre.patch
+++ /dev/null
@@ -1,94 +0,0 @@
-From: =?utf-8?q?Lukas_M=C3=A4rdian?= <[e-mail]>
-Date: Wed, 17 Apr 2024 18:01:50 +0200
-Subject: wait-online: do not require virtual devices to be created already
-
-Origin: https://github.com/canonical/netplan/pull/456/commits/d04f4f9a9d740cdab286ef4865b68153001b6601
-Bug-Ubuntu: https://bugs.launchpad.net/netplan/+bug/2060311
-Forwarded: https://github.com/canonical/netplan/pull/456
----
- src/networkd.c                 |  8 ++++++--
- tests/generator/test_args.py   | 10 ++++++++--
- tests/integration/ethernets.py |  8 ++++++--
- 3 files changed, 20 insertions(+), 6 deletions(-)
-
-diff --git a/src/networkd.c b/src/networkd.c
-index f4c081c..f552bfd 100644
---- a/src/networkd.c
-+++ b/src/networkd.c
-@@ -1501,8 +1501,12 @@ _netplan_networkd_write_wait_online(const NetplanState* np_state, const char* ro
-                                || netplan_netdef_get_link_local_ipv6(def);
-             _netplan_address_iter_free(addr_iter);
- 
--            // no matching => single interface, ignoring non-existing interfaces
--            if (!netplan_netdef_has_match(def) && g_hash_table_contains(system_interfaces, def->id)) {
-+            // no matching => single physical interface, ignoring non-existing interfaces
-+            // OR: virtual interfaces, those will be created later on and cannot have a matching condition
-+            gboolean physical_no_match_or_virtual = FALSE
-+                || (!netplan_netdef_has_match(def) && g_hash_table_contains(system_interfaces, def->id))
-+                || (netplan_netdef_get_type(def) >= NETPLAN_DEF_TYPE_VIRTUAL);
-+            if (physical_no_match_or_virtual) {
-                 g_hash_table_replace(non_optional_interfaces, g_strdup(def->id), any_ips ? g_strdup("degraded") : g_strdup("carrier"));
-             } else if (def->set_name) { // matching on a single interface, to be renamed
-                  _netplan_enumerate_interfaces(def, system_interfaces, non_optional_interfaces, any_ips ? "degraded" : "carrier", def->set_name, rootdir);
-diff --git a/tests/generator/test_args.py b/tests/generator/test_args.py
-index de5aaa8..b48291a 100644
---- a/tests/generator/test_args.py
-+++ b/tests/generator/test_args.py
-@@ -133,7 +133,10 @@ class TestConfigArgs(TestBase):
-       dhcp4: true
-       optional: true
-     lo:
--      addresses: ["127.0.0.1/8", "::1/128"]''')
-+      addresses: ["127.0.0.1/8", "::1/128"]
-+  bridges:
-+    br0:
-+      dhcp4: true''')
-         outdir = os.path.join(self.workdir.name, 'out')
-         os.mkdir(outdir)
- 
-@@ -151,6 +154,9 @@ class TestConfigArgs(TestBase):
-         n = os.path.join(self.workdir.name, 'run', 'systemd', 'network', '10-netplan-lo.network')
-         self.assertTrue(os.path.exists(n))
-         os.unlink(n)
-+        n = os.path.join(self.workdir.name, 'run', 'systemd', 'network', '10-netplan-br0.network')
-+        self.assertTrue(os.path.exists(n))
-+        os.unlink(n)
- 
-         # should auto-enable networkd and -wait-online
-         service_dir = os.path.join(self.workdir.name, 'run', 'systemd', 'system')
-@@ -166,7 +172,7 @@ ConditionPathIsSymbolicLink=/run/systemd/generator/network-online.target.wants/s
- 
- [Service]
- ExecStart=
--ExecStart=/lib/systemd/systemd-networkd-wait-online -i lo:carrier\n''')  # eth99 does not exist on the system
-+ExecStart=/lib/systemd/systemd-networkd-wait-online -i br0:degraded -i lo:carrier\n''')  # eth99 does not exist on the system
- 
-         # should be a no-op the second time while the stamp exists
-         out = subprocess.check_output([generator, '--root-dir', self.workdir.name, outdir, outdir, outdir],
-diff --git a/tests/integration/ethernets.py b/tests/integration/ethernets.py
-index 7028a49..1e57816 100644
---- a/tests/integration/ethernets.py
-+++ b/tests/integration/ethernets.py
-@@ -409,8 +409,12 @@ class TestNetworkd(IntegrationTestsBase, _CommonTests):
-       set-name: "findme"
-     %(e2c)s:
-       addresses: ["10.0.0.1/24"]
-+  bridges:
-+    br0:
-+      addresses: ["10.0.0.2/24"]
-+      interfaces: [%(e2c)s]
- ''' % {'r': self.backend, 'ec_mac': self.dev_e_client_mac, 'e2c': self.dev_e2_client})
--        self.generate_and_settle([self.dev_e2_client])
-+        self.generate_and_settle([self.dev_e2_client, 'br0'])
-         override = os.path.join('/run', 'systemd', 'system', 'systemd-networkd-wait-online.service.d', '10-netplan.conf')
-         self.assertTrue(os.path.isfile(override))
- 
-@@ -424,7 +428,7 @@ ConditionPathIsSymbolicLink=/run/systemd/generator/network-online.target.wants/s
- 
- [Service]
- ExecStart=
--ExecStart=/lib/systemd/systemd-networkd-wait-online -i %s:degraded -i findme:carrier
-+ExecStart=/lib/systemd/systemd-networkd-wait-online -i %s:degraded -i br0:degraded -i findme:carrier
- ''' % self.dev_e2_client)
- 
- 
diff --git a/debian/patches/lp2060311/0013-wait-online-recognize-that-bridge-bond-members-will-.patch b/debian/patches/lp2060311/0013-wait-online-recognize-that-bridge-bond-members-will-.patch
deleted file mode 100644
index 5f99a69..0000000
--- a/debian/patches/lp2060311/0013-wait-online-recognize-that-bridge-bond-members-will-.patch
+++ /dev/null
@@ -1,79 +0,0 @@
-From: =?utf-8?q?Lukas_M=C3=A4rdian?= <[e-mail]>
-Date: Thu, 18 Apr 2024 12:16:56 +0200
-Subject: wait-online: recognize that bridge/bond members will never gain
- link-local addresses
-
-Origin: https://github.com/canonical/netplan/pull/456/commits/347d3fde2cc1c8b14c98d13d789f6ceff43b8710
-Bug-Ubuntu: https://bugs.launchpad.net/netplan/+bug/2060311
-Forwarded: https://github.com/canonical/netplan/pull/456
----
- src/networkd.c               | 12 ++++++++----
- tests/generator/test_args.py | 16 ++++++++++++++--
- 2 files changed, 22 insertions(+), 6 deletions(-)
-
-diff --git a/src/networkd.c b/src/networkd.c
-index f552bfd..523f717 100644
---- a/src/networkd.c
-+++ b/src/networkd.c
-@@ -1493,12 +1493,16 @@ _netplan_networkd_write_wait_online(const NetplanState* np_state, const char* ro
-          */
-         if (!(def->optional || def->activation_mode)) {
-             // Check if we have any IP configuration
-+            // bond and bridge members will never ask for link-local addresses (see above)
-             struct address_iter* addr_iter = _netplan_netdef_new_address_iter(def);
--            gboolean any_ips =    _netplan_address_iter_next(addr_iter) != NULL
-+            gboolean routable =   _netplan_address_iter_next(addr_iter) != NULL
-                                || netplan_netdef_get_dhcp4(def)
--                               || netplan_netdef_get_dhcp6(def)
--                               || netplan_netdef_get_link_local_ipv4(def)
--                               || netplan_netdef_get_link_local_ipv6(def);
-+                               || netplan_netdef_get_dhcp6(def);
-+            gboolean degraded =   (   netplan_netdef_get_link_local_ipv4(def)
-+                                   && !(netplan_netdef_get_bond_link(def) || netplan_netdef_get_bridge_link(def)))
-+                               || (   netplan_netdef_get_link_local_ipv6(def)
-+                                   && !(netplan_netdef_get_bond_link(def) || netplan_netdef_get_bridge_link(def)));
-+            gboolean any_ips = routable || degraded;
-             _netplan_address_iter_free(addr_iter);
- 
-             // no matching => single physical interface, ignoring non-existing interfaces
-diff --git a/tests/generator/test_args.py b/tests/generator/test_args.py
-index b48291a..291d164 100644
---- a/tests/generator/test_args.py
-+++ b/tests/generator/test_args.py
-@@ -134,9 +134,20 @@ class TestConfigArgs(TestBase):
-       optional: true
-     lo:
-       addresses: ["127.0.0.1/8", "::1/128"]
-+  vlans:
-+    eth99.42:
-+      link: eth99
-+      id: 42
-+      link-local: [ipv4, ipv6] # this is ignored for bridge-members
-+    eth99.43:
-+      link: eth99
-+      id: 43
-+      link-local: []
-+      addresses: [10.0.0.2/24]
-   bridges:
-     br0:
--      dhcp4: true''')
-+      dhcp4: true
-+      interfaces: [eth99.42, eth99.43]''')
-         outdir = os.path.join(self.workdir.name, 'out')
-         os.mkdir(outdir)
- 
-@@ -167,12 +178,13 @@ class TestConfigArgs(TestBase):
-         override = os.path.join(service_dir, 'systemd-networkd-wait-online.service.d', '10-netplan.conf')
-         self.assertTrue(os.path.isfile(override))
-         with open(override, 'r') as f:
-+            # eth99 does not exist on the system, so will not be listed
-             self.assertEqual(f.read(), '''[Unit]
- ConditionPathIsSymbolicLink=/run/systemd/generator/network-online.target.wants/systemd-networkd-wait-online.service
- 
- [Service]
- ExecStart=
--ExecStart=/lib/systemd/systemd-networkd-wait-online -i br0:degraded -i lo:carrier\n''')  # eth99 does not exist on the system
-+ExecStart=/lib/systemd/systemd-networkd-wait-online -i eth99.43:degraded -i br0:degraded -i lo:carrier -i eth99.42:carrier\n''')
- 
-         # should be a no-op the second time while the stamp exists
-         out = subprocess.check_output([generator, '--root-dir', self.workdir.name, outdir, outdir, outdir],
diff --git a/debian/patches/lp2065738/0014-libnetplan-use-more-restrictive-file-permissions.patch b/debian/patches/lp2065738/0014-libnetplan-use-more-restrictive-file-permissions.patch
deleted file mode 100644
index da5047c..0000000
--- a/debian/patches/lp2065738/0014-libnetplan-use-more-restrictive-file-permissions.patch
+++ /dev/null
@@ -1,462 +0,0 @@
-From: Danilo Egea Gondolfo <[e-mail]>
-Date: Wed, 22 May 2024 15:44:16 +0100
-Subject: libnetplan: use more restrictive file permissions
-
-A new util.c:_netplan_g_string_free_to_file_with_permissions() was added
-and accepts the owner, group and file mode as arguments. When these
-properties can't be set, when the generator is called by a non-root user
-for example, it will not hard-fail. This function is called by unit
-tests where we can't set the owner to a privileged account for example.
-
-When generating backend files, use more restrictive permissions:
-
-networkd related files will be owned by root:systemd-network and have
-mode 0640.
-
-service unit files will be owned by root:root and have mode 0640.
-udevd files will be owned by root:root with mode 0640.
-
-wpa_supplicant and Network Manager files will continue with the existing
-permissions.
-
-Autopkgtests will check if the permissions are set as expected when
-calling the generator.
-
-This fix addresses CVE-2022-4968
----
- src/networkd.c                | 40 +++++---------------
- src/networkd.h                |  2 +
- src/nm.c                      |  4 +-
- src/openvswitch.c             |  2 +-
- src/sriov.c                   |  4 +-
- src/util-internal.h           |  3 ++
- src/util.c                    | 46 +++++++++++++++++++++++
- tests/generator/test_auth.py  |  2 +-
- tests/generator/test_wifis.py |  2 +-
- tests/integration/base.py     | 85 +++++++++++++++++++++++++++++++++++++++++++
- 10 files changed, 152 insertions(+), 38 deletions(-)
-
-diff --git a/src/networkd.c b/src/networkd.c
-index 2379837..cb9547c 100644
---- a/src/networkd.c
-+++ b/src/networkd.c
-@@ -300,7 +300,6 @@ STATIC void
- write_link_file(const NetplanNetDefinition* def, const char* rootdir, const char* path)
- {
-     GString* s = NULL;
--    mode_t orig_umask;
- 
-     /* Don't write .link files for virtual devices; they use .netdev instead.
-      * Don't write .link files for MODEM devices, as they aren't supported by networkd.
-@@ -372,9 +371,7 @@ write_link_file(const NetplanNetDefinition* def, const char* rootdir, const char
-         g_string_append_printf(s, "LargeReceiveOffload=%s\n",
-         (def->large_receive_offload ? "true" : "false"));
- 
--    orig_umask = umask(022);
--    _netplan_g_string_free_to_file(s, rootdir, path, ".link");
--    umask(orig_umask);
-+    _netplan_g_string_free_to_file_with_permissions(s, rootdir, path, ".link", "root", "root", 0640);
- }
- 
- STATIC gboolean
-@@ -392,7 +389,7 @@ write_regdom(const NetplanNetDefinition* def, const char* rootdir, GError** erro
-     g_string_append(s, "\n[Service]\nType=oneshot\n");
-     g_string_append_printf(s, "ExecStart="SBINDIR"/iw reg set %s\n", def->regulatory_domain);
- 
--    _netplan_g_string_free_to_file(s, rootdir, path, NULL);
-+    _netplan_g_string_free_to_file_with_permissions(s, rootdir, path, NULL, "root", "root", 0640);
-     _netplan_safe_mkdir_p_dir(link);
-     if (symlink(path, link) < 0 && errno != EEXIST) {
-         // LCOV_EXCL_START
-@@ -572,7 +569,6 @@ STATIC void
- write_netdev_file(const NetplanNetDefinition* def, const char* rootdir, const char* path)
- {
-     GString* s = NULL;
--    mode_t orig_umask;
- 
-     g_assert(def->type >= NETPLAN_DEF_TYPE_VIRTUAL);
- 
-@@ -668,11 +664,7 @@ write_netdev_file(const NetplanNetDefinition* def, const char* rootdir, const ch
-         default: g_assert_not_reached(); // LCOV_EXCL_LINE
-     }
- 
--    /* these do not contain secrets and need to be readable by
--     * systemd-networkd - LP: #1736965 */
--    orig_umask = umask(022);
--    _netplan_g_string_free_to_file(s, rootdir, path, ".netdev");
--    umask(orig_umask);
-+    _netplan_g_string_free_to_file_with_permissions(s, rootdir, path, ".netdev", "root", NETWORKD_GROUP, 0640);
- }
- 
- STATIC void
-@@ -816,7 +808,6 @@ _netplan_netdef_write_network_file(
-     g_autoptr(GString) network = NULL;
-     g_autoptr(GString) link = NULL;
-     GString* s = NULL;
--    mode_t orig_umask;
- 
-     SET_OPT_OUT_PTR(has_been_written, FALSE);
- 
-@@ -1063,11 +1054,7 @@ _netplan_netdef_write_network_file(
-         if (network->len > 0)
-             g_string_append_printf(s, "\n[Network]\n%s", network->str);
- 
--        /* these do not contain secrets and need to be readable by
--         * systemd-networkd - LP: #1736965 */
--        orig_umask = umask(022);
--        _netplan_g_string_free_to_file(s, rootdir, path, ".network");
--        umask(orig_umask);
-+        _netplan_g_string_free_to_file_with_permissions(s, rootdir, path, ".network", "root", NETWORKD_GROUP, 0640);
-     }
- 
-     SET_OPT_OUT_PTR(has_been_written, TRUE);
-@@ -1079,7 +1066,6 @@ write_rules_file(const NetplanNetDefinition* def, const char* rootdir)
- {
-     GString* s = NULL;
-     g_autofree char* path = g_strjoin(NULL, "run/udev/rules.d/99-netplan-", def->id, ".rules", NULL);
--    mode_t orig_umask;
- 
-     /* do we need to write a .rules file?
-      * It's only required for reliably setting the name of a physical device
-@@ -1113,9 +1099,7 @@ write_rules_file(const NetplanNetDefinition* def, const char* rootdir)
- 
-     g_string_append_printf(s, "NAME=\"%s\"\n", def->set_name);
- 
--    orig_umask = umask(022);
--    _netplan_g_string_free_to_file(s, rootdir, path, NULL);
--    umask(orig_umask);
-+    _netplan_g_string_free_to_file_with_permissions(s, rootdir, path, NULL, "root", "root", 0640);
- }
- 
- STATIC gboolean
-@@ -1264,7 +1248,6 @@ STATIC void
- write_wpa_unit(const NetplanNetDefinition* def, const char* rootdir)
- {
-     g_autofree gchar *stdouth = NULL;
--    mode_t orig_umask;
- 
-     stdouth = systemd_escape(def->id);
- 
-@@ -1283,9 +1266,7 @@ write_wpa_unit(const NetplanNetDefinition* def, const char* rootdir)
-     } else {
-         g_string_append(s, " -Dnl80211,wext\n");
-     }
--    orig_umask = umask(022);
--    _netplan_g_string_free_to_file(s, rootdir, path, NULL);
--    umask(orig_umask);
-+    _netplan_g_string_free_to_file_with_permissions(s, rootdir, path, NULL, "root", "root", 0640);
- }
- 
- STATIC gboolean
-@@ -1294,7 +1275,6 @@ write_wpa_conf(const NetplanNetDefinition* def, const char* rootdir, GError** er
-     GHashTableIter iter;
-     GString* s = g_string_new("ctrl_interface=/run/wpa_supplicant\n\n");
-     g_autofree char* path = g_strjoin(NULL, "run/netplan/wpa-", def->id, ".conf", NULL);
--    mode_t orig_umask;
- 
-     g_debug("%s: Creating wpa_supplicant configuration file %s", def->id, path);
-     if (def->type == NETPLAN_DEF_TYPE_WIFI) {
-@@ -1383,9 +1363,7 @@ write_wpa_conf(const NetplanNetDefinition* def, const char* rootdir, GError** er
-     }
- 
-     /* use tight permissions as this contains secrets */
--    orig_umask = umask(077);
--    _netplan_g_string_free_to_file(s, rootdir, path, NULL);
--    umask(orig_umask);
-+    _netplan_g_string_free_to_file_with_permissions(s, rootdir, path, NULL, "root", "root", 0600);
-     return TRUE;
- }
- 
-@@ -1529,7 +1507,7 @@ _netplan_networkd_write_wait_online(const NetplanState* np_state, const char* ro
-     GString* content = g_string_new("[Unit]\n"
-         "ConditionPathIsSymbolicLink=/run/systemd/generator/network-online.target.wants/systemd-networkd-wait-online.service\n");
-     if (g_hash_table_size(non_optional_interfaces) == 0) {
--        _netplan_g_string_free_to_file(content, rootdir, override, NULL);
-+        _netplan_g_string_free_to_file_with_permissions(content, rootdir, override, NULL, "root", "root", 0640);
-         g_hash_table_destroy(non_optional_interfaces);
-         return FALSE;
-     }
-@@ -1553,7 +1531,7 @@ _netplan_networkd_write_wait_online(const NetplanState* np_state, const char* ro
-     }
-     g_string_append(content, "\n");
- 
--    _netplan_g_string_free_to_file(content, rootdir, override, NULL);
-+    _netplan_g_string_free_to_file_with_permissions(content, rootdir, override, NULL, "root", "root", 0640);
-     g_hash_table_destroy(non_optional_interfaces);
-     return TRUE;
- }
-diff --git a/src/networkd.h b/src/networkd.h
-index 8332b7b..9f80585 100644
---- a/src/networkd.h
-+++ b/src/networkd.h
-@@ -20,6 +20,8 @@
- #include "netplan.h"
- #include <glib.h>
- 
-+#define NETWORKD_GROUP "systemd-network"
-+
- NETPLAN_INTERNAL gboolean
- _netplan_netdef_write_networkd(
-         const NetplanState* np_state,
-diff --git a/src/nm.c b/src/nm.c
-index 2b850af..8f1bf05 100644
---- a/src/nm.c
-+++ b/src/nm.c
-@@ -1150,13 +1150,13 @@ netplan_state_finish_nm_write(
- 
-     /* write generated NetworkManager drop-in config */
-     if (nm_conf->len > 0)
--        _netplan_g_string_free_to_file(nm_conf, rootdir, "run/NetworkManager/conf.d/netplan.conf", NULL);
-+        _netplan_g_string_free_to_file_with_permissions(nm_conf, rootdir, "run/NetworkManager/conf.d/netplan.conf", NULL, "root", "root", 0640);
-     else
-         g_string_free(nm_conf, TRUE);
- 
-     /* write generated udev rules */
-     if (udev_rules->len > 0)
--        _netplan_g_string_free_to_file(udev_rules, rootdir, "run/udev/rules.d/90-netplan.rules", NULL);
-+        _netplan_g_string_free_to_file_with_permissions(udev_rules, rootdir, "run/udev/rules.d/90-netplan.rules", NULL, "root", "root", 0640);
-     else
-         g_string_free(udev_rules, TRUE);
- 
-diff --git a/src/openvswitch.c b/src/openvswitch.c
-index 6eb0688..2ab77e7 100644
---- a/src/openvswitch.c
-+++ b/src/openvswitch.c
-@@ -66,7 +66,7 @@ write_ovs_systemd_unit(const char* id, const GString* cmds, const char* rootdir,
-         g_string_append(s, "StartLimitBurst=0\n");
-     g_string_append(s, cmds->str);
- 
--    _netplan_g_string_free_to_file(s, rootdir, path, NULL);
-+    _netplan_g_string_free_to_file_with_permissions(s, rootdir, path, NULL, "root", "root", 0640);
- 
-     _netplan_safe_mkdir_p_dir(link);
-     if (symlink(path, link) < 0 && errno != EEXIST) {
-diff --git a/src/sriov.c b/src/sriov.c
-index 1534c94..213f124 100644
---- a/src/sriov.c
-+++ b/src/sriov.c
-@@ -54,7 +54,7 @@ write_sriov_rebind_systemd_unit(GHashTable* pfs, const char* rootdir, GError** e
-     g_string_truncate(interfaces, interfaces->len-1); /* cut trailing whitespace */
-     g_string_append_printf(s, "ExecStart=" SBINDIR "/netplan rebind --debug %s\n", interfaces->str);
- 
--    _netplan_g_string_free_to_file(s, rootdir, path, NULL);
-+    _netplan_g_string_free_to_file_with_permissions(s, rootdir, path, NULL, "root", "root", 0640);
-     g_string_free(interfaces, TRUE);
- 
-     _netplan_safe_mkdir_p_dir(link);
-@@ -90,7 +90,7 @@ write_sriov_apply_systemd_unit(GHashTable* pfs, const char* rootdir, GError** er
-     g_string_append(s, "\n[Service]\nType=oneshot\n");
-     g_string_append_printf(s, "ExecStart=" SBINDIR "/netplan apply --sriov-only\n");
- 
--    _netplan_g_string_free_to_file(s, rootdir, path, NULL);
-+    _netplan_g_string_free_to_file_with_permissions(s, rootdir, path, NULL, "root", "root", 0640);
- 
-     _netplan_safe_mkdir_p_dir(link);
-     if (symlink(path, link) < 0 && errno != EEXIST) {
-diff --git a/src/util-internal.h b/src/util-internal.h
-index 86bd1b7..7454e77 100644
---- a/src/util-internal.h
-+++ b/src/util-internal.h
-@@ -40,6 +40,9 @@ _netplan_safe_mkdir_p_dir(const char* file_path);
- NETPLAN_INTERNAL void
- _netplan_g_string_free_to_file(GString* s, const char* rootdir, const char* path, const char* suffix);
- 
-+void
-+_netplan_g_string_free_to_file_with_permissions(GString* s, const char* rootdir, const char* path, const char* suffix, const char* owner, const char* group, mode_t mode);
-+
- NETPLAN_INTERNAL void
- _netplan_unlink_glob(const char* rootdir, const char* _glob);
- 
-diff --git a/src/util.c b/src/util.c
-index 3e6c80d..46aba6e 100644
---- a/src/util.c
-+++ b/src/util.c
-@@ -23,6 +23,9 @@
- #include <regex.h>
- #include <string.h>
- #include <sys/mman.h>
-+#include <sys/types.h>
-+#include <pwd.h>
-+#include <grp.h>
- 
- #include <glib.h>
- #include <glib/gprintf.h>
-@@ -87,6 +90,49 @@ void _netplan_g_string_free_to_file(GString* s, const char* rootdir, const char*
-     }
- }
- 
-+void _netplan_g_string_free_to_file_with_permissions(GString* s, const char* rootdir, const char* path, const char* suffix, const char* owner, const char* group, mode_t mode)
-+{
-+    g_autofree char* full_path = NULL;
-+    g_autofree char* path_suffix = NULL;
-+    g_autofree char* contents = g_string_free(s, FALSE);
-+    GError* error = NULL;
-+    struct passwd* pw = NULL;
-+    struct group* gr = NULL;
-+    int ret = 0;
-+
-+    path_suffix = g_strjoin(NULL, path, suffix, NULL);
-+    full_path = g_build_path(G_DIR_SEPARATOR_S, rootdir ?: G_DIR_SEPARATOR_S, path_suffix, NULL);
-+    _netplan_safe_mkdir_p_dir(full_path);
-+    if (!g_file_set_contents_full(full_path, contents, -1, G_FILE_SET_CONTENTS_CONSISTENT | G_FILE_SET_CONTENTS_ONLY_EXISTING, mode, &error)) {
-+        /* the mkdir() just succeeded, there is no sensible
-+         * method to test this without root privileges, bind mounts, and
-+         * simulating ENOSPC */
-+        // LCOV_EXCL_START
-+        g_fprintf(stderr, "ERROR: cannot create file %s: %s\n", path, error->message);
-+        exit(1);
-+        // LCOV_EXCL_STOP
-+    }
-+
-+    /* Here we take the owner and group names and look up for their IDs in the passwd and group files.
-+     * It's OK to fail to set the owners and mode as this code will be called from unit tests.
-+     * The autopkgtests will check if the owner/group and mode are correctly set.
-+     */
-+    pw = getpwnam(owner);
-+    if (!pw) {
-+        g_debug("Failed to determine the UID of user %s: %s", owner, strerror(errno)); // LCOV_EXCL_LINE
-+    }
-+    gr = getgrnam(group);
-+    if (!gr) {
-+        g_debug("Failed to determine the GID of group %s: %s", group, strerror(errno)); // LCOV_EXCL_LINE
-+    }
-+    if (pw && gr) {
-+        ret = chown(full_path, pw->pw_uid, gr->gr_gid);
-+        if (ret != 0) {
-+            g_debug("Failed to set owner and group for file %s: %s", full_path, strerror(errno));
-+        }
-+    }
-+}
-+
- /**
-  * Remove all files matching given glob.
-  */
-diff --git a/tests/generator/test_auth.py b/tests/generator/test_auth.py
-index de23adb..d3d886c 100644
---- a/tests/generator/test_auth.py
-+++ b/tests/generator/test_auth.py
-@@ -226,7 +226,7 @@ network={
- 
-         with open(os.path.join(self.workdir.name, 'run/systemd/system/netplan-wpa-eth0.service')) as f:
-             self.assertEqual(f.read(), SD_WPA % {'iface': 'eth0', 'drivers': 'wired'})
--            self.assertEqual(stat.S_IMODE(os.fstat(f.fileno()).st_mode), 0o644)
-+            self.assertEqual(stat.S_IMODE(os.fstat(f.fileno()).st_mode), 0o640)
-         self.assertTrue(os.path.islink(os.path.join(
-             self.workdir.name, 'run/systemd/system/systemd-networkd.service.wants/netplan-wpa-eth0.service')))
- 
-diff --git a/tests/generator/test_wifis.py b/tests/generator/test_wifis.py
-index b875172..610782a 100644
---- a/tests/generator/test_wifis.py
-+++ b/tests/generator/test_wifis.py
-@@ -140,7 +140,7 @@ network={
-             self.workdir.name, 'run/systemd/system/netplan-wpa-wl0.service')))
-         with open(os.path.join(self.workdir.name, 'run/systemd/system/netplan-wpa-wl0.service')) as f:
-             self.assertEqual(f.read(), SD_WPA % {'iface': 'wl0', 'drivers': 'nl80211,wext'})
--            self.assertEqual(stat.S_IMODE(os.fstat(f.fileno()).st_mode), 0o644)
-+            self.assertEqual(stat.S_IMODE(os.fstat(f.fileno()).st_mode), 0o640)
-         self.assertTrue(os.path.islink(os.path.join(
-             self.workdir.name, 'run/systemd/system/systemd-networkd.service.wants/netplan-wpa-wl0.service')))
- 
-diff --git a/tests/integration/base.py b/tests/integration/base.py
-index e9c366c..74f0682 100644
---- a/tests/integration/base.py
-+++ b/tests/integration/base.py
-@@ -32,6 +32,8 @@ import shutil
- import gi
- import glob
- import json
-+import pwd
-+import grp
- 
- # make sure we point to libnetplan properly.
- os.environ.update({'LD_LIBRARY_PATH': '.:{}'.format(os.environ.get('LD_LIBRARY_PATH'))})
-@@ -367,6 +369,89 @@ class IntegrationTestsBase(unittest.TestCase):
-             if state:
-                 self.wait_output(['ip', 'addr', 'show', iface], state, 30)
- 
-+        # Assert file permissions
-+        self.assert_file_permissions()
-+
-+    def assert_file_permissions(self):
-+        """ Check if the generated files have the expected permissions """
-+
-+        nd_expected_mode = 0o100640
-+        nd_expected_owner = 'root'
-+        nd_expected_group = 'systemd-network'
-+
-+        sd_expected_mode = 0o100640
-+        sd_expected_owner = 'root'
-+        sd_expected_group = 'root'
-+
-+        udev_expected_mode = 0o100640
-+        udev_expected_owner = 'root'
-+        udev_expected_group = 'root'
-+
-+        nm_expected_mode = 0o100600
-+        nm_expected_owner = 'root'
-+        nm_expected_group = 'root'
-+
-+        wpa_expected_mode = 0o100600
-+        wpa_expected_owner = 'root'
-+        wpa_expected_group = 'root'
-+
-+        # Check systemd-networkd files
-+        base_path = '/run/systemd/network'
-+        files = glob.glob(f'{base_path}/*.network') + glob.glob(f'{base_path}/*.netdev')
-+        for file in files:
-+            res = os.stat(file)
-+            user = pwd.getpwuid(res.st_uid)
-+            group = grp.getgrgid(res.st_gid)
-+            self.assertEqual(res.st_mode, nd_expected_mode, f'file {file}')
-+            self.assertEqual(user.pw_name, nd_expected_owner, f'file {file}')
-+            self.assertEqual(group.gr_name, nd_expected_group, f'file {file}')
-+
-+        # Check Network Manager files
-+        base_path = '/run/NetworkManager/system-connections'
-+        files = glob.glob(f'{base_path}/*.nmconnection')
-+        for file in files:
-+            res = os.stat(file)
-+            user = pwd.getpwuid(res.st_uid)
-+            group = grp.getgrgid(res.st_gid)
-+            self.assertEqual(res.st_mode, nm_expected_mode, f'file {file}')
-+            self.assertEqual(user.pw_name, nm_expected_owner, f'file {file}')
-+            self.assertEqual(group.gr_name, nm_expected_group, f'file {file}')
-+
-+        # Check wpa_supplicant configuration files
-+        base_path = '/run/netplan'
-+        files = glob.glob(f'{base_path}/wpa-*.conf')
-+        for file in files:
-+            res = os.stat(file)
-+            user = pwd.getpwuid(res.st_uid)
-+            group = grp.getgrgid(res.st_gid)
-+            self.assertEqual(res.st_mode, wpa_expected_mode, f'file {file}')
-+            self.assertEqual(user.pw_name, wpa_expected_owner, f'file {file}')
-+            self.assertEqual(group.gr_name, wpa_expected_group, f'file {file}')
-+
-+        # Check systemd service unit files
-+        base_path = '/run/systemd/system/'
-+        files = glob.glob(f'{base_path}/netplan-*.service')
-+        files += glob.glob(f'{base_path}/systemd-networkd-wait-online.service.d/*.conf')
-+        for file in files:
-+            res = os.stat(file)
-+            user = pwd.getpwuid(res.st_uid)
-+            group = grp.getgrgid(res.st_gid)
-+            self.assertEqual(res.st_mode, sd_expected_mode, f'file {file}')
-+            self.assertEqual(user.pw_name, sd_expected_owner, f'file {file}')
-+            self.assertEqual(group.gr_name, sd_expected_group, f'file {file}')
-+
-+        # Check systemd-udevd files
-+        udev_path = '/run/udev/rules.d'
-+        link_path = '/run/systemd/network'
-+        files = glob.glob(f'{udev_path}/*-netplan*.rules') + glob.glob(f'{link_path}/*.link')
-+        for file in files:
-+            res = os.stat(file)
-+            user = pwd.getpwuid(res.st_uid)
-+            group = grp.getgrgid(res.st_gid)
-+            self.assertEqual(res.st_mode, udev_expected_mode, f'file {file}')
-+            self.assertEqual(user.pw_name, udev_expected_owner, f'file {file}')
-+            self.assertEqual(group.gr_name, udev_expected_group, f'file {file}')
-+
-     def state(self, iface, state):
-         '''Tell generate_and_settle() to wait for a specific state'''
-         return iface + '/' + state
diff --git a/debian/patches/lp2066258/0015-libnetplan-escape-control-characters.patch b/debian/patches/lp2066258/0015-libnetplan-escape-control-characters.patch
deleted file mode 100644
index 349ad9e..0000000
--- a/debian/patches/lp2066258/0015-libnetplan-escape-control-characters.patch
+++ /dev/null
@@ -1,867 +0,0 @@
-From: Danilo Egea Gondolfo <[e-mail]>
-Date: Wed, 29 May 2024 14:50:55 +0100
-Subject: libnetplan: escape control characters
-
-Control characters are escaped in the parser using glib's g_strescape.
-Quotes and backslashes were added to the list of exception.
-
-In places where double quotes are not escaped, such as netdef IDs as it
-is allowed as interface names, they are escaped as needed when
-generating back end configuration.
-
-To support escaping in wpa_supplicant configuration, the syntax for
-setting the SSID was changed to 'ssid=P"string here"'. With that,
-escaping is support in a printf-style.
----
- src/networkd.c                 | 32 +++++++++-----
- src/nm.c                       | 21 ++++++----
- src/parse.c                    | 94 +++++++++++++++++++++++++++---------------
- src/util-internal.h            |  3 ++
- src/util.c                     | 11 +++++
- tests/generator/test_auth.py   | 20 ++++-----
- tests/generator/test_common.py | 42 +++++++++++++++++--
- tests/generator/test_wifis.py  | 78 +++++++++++++++++++++++++++--------
- 8 files changed, 217 insertions(+), 84 deletions(-)
-
-diff --git a/src/networkd.c b/src/networkd.c
-index cb9547c..0414c92 100644
---- a/src/networkd.c
-+++ b/src/networkd.c
-@@ -1089,7 +1089,8 @@ write_rules_file(const NetplanNetDefinition* def, const char* rootdir)
-     g_string_append(s, "SUBSYSTEM==\"net\", ACTION==\"add\", ");
- 
-     if (def->match.driver) {
--        g_string_append_printf(s,"DRIVERS==\"%s\", ", def->match.driver);
-+        g_autofree char* driver = _netplan_scrub_string(def->match.driver);
-+        g_string_append_printf(s,"DRIVERS==\"%s\", ", driver);
-     } else {
-         g_string_append(s, "DRIVERS==\"?*\", ");
-     }
-@@ -1097,7 +1098,8 @@ write_rules_file(const NetplanNetDefinition* def, const char* rootdir)
-     if (def->match.mac)
-         g_string_append_printf(s, "ATTR{address}==\"%s\", ", def->match.mac);
- 
--    g_string_append_printf(s, "NAME=\"%s\"\n", def->set_name);
-+    g_autofree char* set_name = _netplan_scrub_string(def->set_name);
-+    g_string_append_printf(s, "NAME=\"%s\"\n", set_name);
- 
-     _netplan_g_string_free_to_file_with_permissions(s, rootdir, path, NULL, "root", "root", 0640);
- }
-@@ -1185,10 +1187,12 @@ append_wpa_auth_conf(GString* s, const NetplanAuthenticationSettings* auth, cons
-     }
- 
-     if (auth->identity) {
--        g_string_append_printf(s, "  identity=\"%s\"\n", auth->identity);
-+        g_autofree char* identity = _netplan_scrub_string(auth->identity);
-+        g_string_append_printf(s, "  identity=\"%s\"\n", identity);
-     }
-     if (auth->anonymous_identity) {
--        g_string_append_printf(s, "  anonymous_identity=\"%s\"\n", auth->anonymous_identity);
-+        g_autofree char* anonymous_identity = _netplan_scrub_string(auth->anonymous_identity);
-+        g_string_append_printf(s, "  anonymous_identity=\"%s\"\n", anonymous_identity);
-     }
- 
-     char* psk = NULL;
-@@ -1226,19 +1230,23 @@ append_wpa_auth_conf(GString* s, const NetplanAuthenticationSettings* auth, cons
-         }
-     }
-     if (auth->ca_certificate) {
--        g_string_append_printf(s, "  ca_cert=\"%s\"\n", auth->ca_certificate);
-+        g_autofree char* ca_certificate = _netplan_scrub_string(auth->ca_certificate);
-+        g_string_append_printf(s, "  ca_cert=\"%s\"\n", ca_certificate);
-     }
-     if (auth->client_certificate) {
--        g_string_append_printf(s, "  client_cert=\"%s\"\n", auth->client_certificate);
-+        g_autofree char* client_certificate = _netplan_scrub_string(auth->client_certificate);
-+        g_string_append_printf(s, "  client_cert=\"%s\"\n", client_certificate);
-     }
-     if (auth->client_key) {
--        g_string_append_printf(s, "  private_key=\"%s\"\n", auth->client_key);
-+        g_autofree char* client_key = _netplan_scrub_string(auth->client_key);
-+        g_string_append_printf(s, "  private_key=\"%s\"\n", client_key);
-     }
-     if (auth->client_key_password) {
-         g_string_append_printf(s, "  private_key_passwd=\"%s\"\n", auth->client_key_password);
-     }
-     if (auth->phase2_auth) {
--        g_string_append_printf(s, "  phase2=\"auth=%s\"\n", auth->phase2_auth);
-+        g_autofree char* phase2_auth = _netplan_scrub_string(auth->phase2_auth);
-+        g_string_append_printf(s, "  phase2=\"auth=%s\"\n", phase2_auth);
-     }
-     return TRUE;
- }
-@@ -1287,14 +1295,16 @@ write_wpa_conf(const NetplanNetDefinition* def, const char* rootdir, GError** er
-         }
-         /* available as of wpa_supplicant version 0.6.7 */
-         if (def->regulatory_domain) {
--            g_string_append_printf(s, "country=%s\n", def->regulatory_domain);
-+            g_autofree char* regdom = _netplan_scrub_string(def->regulatory_domain);
-+            g_string_append_printf(s, "country=%s\n", regdom);
-         }
-         NetplanWifiAccessPoint* ap;
-         g_hash_table_iter_init(&iter, def->access_points);
-         while (g_hash_table_iter_next(&iter, NULL, (gpointer) &ap)) {
-             gchar* freq_config_str = ap->mode == NETPLAN_WIFI_MODE_ADHOC ? "frequency" : "freq_list";
-+            g_autofree char* ssid = _netplan_scrub_string(ap->ssid);
- 
--            g_string_append_printf(s, "network={\n  ssid=\"%s\"\n", ap->ssid);
-+            g_string_append_printf(s, "network={\n  ssid=P\"%s\"\n", ssid);
-             if (ap->bssid) {
-                 g_string_append_printf(s, "  bssid=%s\n", ap->bssid);
-             }
-@@ -1341,7 +1351,7 @@ write_wpa_conf(const NetplanNetDefinition* def, const char* rootdir, GError** er
- 
-             /* wifi auth trumps netdef auth */
-             if (ap->has_auth) {
--                if (!append_wpa_auth_conf(s, &ap->auth, ap->ssid, error)) {
-+                if (!append_wpa_auth_conf(s, &ap->auth, ssid, error)) {
-                     g_string_free(s, TRUE);
-                     return FALSE;
-                 }
-diff --git a/src/nm.c b/src/nm.c
-index 8f1bf05..cb09559 100644
---- a/src/nm.c
-+++ b/src/nm.c
-@@ -1082,28 +1082,30 @@ netplan_state_finish_nm_write(
-         GString *tmp = NULL;
-         guint unmanaged = nd->backend == NETPLAN_BACKEND_NM ? 0 : 1;
- 
-+        g_autofree char* netdef_id = _netplan_scrub_string(nd->id);
-         /* Special case: manage or ignore any device of given type on empty "match: {}" stanza */
-         if (nd->has_match && !nd->match.driver && !nd->match.mac && !nd->match.original_name) {
-             nm_type = type_str(nd);
-             g_assert(nm_type);
-             g_string_append_printf(nm_conf, "[device-netplan.%s.%s]\nmatch-device=type:%s\n"
-                                             "managed=%d\n\n", netplan_def_type_name(nd->type),
--                                            nd->id, nm_type, !unmanaged);
-+                                            netdef_id, nm_type, !unmanaged);
-         }
-         /* Normal case: manage or ignore devices by specific udev rules */
-         else {
-             const gchar *prefix = "SUBSYSTEM==\"net\", ACTION==\"add|change|move\",";
-             const gchar *suffix = nd->backend == NETPLAN_BACKEND_NM ? " ENV{NM_UNMANAGED}=\"0\"\n" : " ENV{NM_UNMANAGED}=\"1\"\n";
-             g_string_append_printf(udev_rules, "# netplan: network.%s.%s (on NetworkManager %s)\n",
--                                   netplan_def_type_name(nd->type), nd->id,
-+                                   netplan_def_type_name(nd->type), netdef_id,
-                                    unmanaged ? "deny-list" : "allow-list");
-             /* Match by explicit interface name, if possible */
-             if (nd->set_name) {
-                 // simple case: explicit new interface name
--                g_string_append_printf(udev_rules, "%s ENV{ID_NET_NAME}==\"%s\",%s", prefix, nd->set_name, suffix);
-+                g_autofree char* set_name = _netplan_scrub_string(nd->set_name);
-+                g_string_append_printf(udev_rules, "%s ENV{ID_NET_NAME}==\"%s\",%s", prefix, set_name, suffix);
-             } else if (!nd->has_match) {
-                 // simple case: explicit netplan ID is interface name
--                g_string_append_printf(udev_rules, "%s ENV{ID_NET_NAME}==\"%s\",%s", prefix, nd->id, suffix);
-+                g_string_append_printf(udev_rules, "%s ENV{ID_NET_NAME}==\"%s\",%s", prefix, netdef_id, suffix);
-             }
-             /* Also, match by explicit (new) MAC, if available */
-             if (nd->set_mac && _is_valid_macaddress(nd->set_mac)) {
-@@ -1119,9 +1121,10 @@ netplan_state_finish_nm_write(
-                 // match on original name glob
-                 // TODO: maybe support matching on multiple name globs in the future (like drivers)
-                 g_string_append(udev_rules, prefix);
--                if (nd->match.original_name)
--                    g_string_append_printf(udev_rules, " ENV{ID_NET_NAME}==\"%s\",", nd->match.original_name);
--
-+                if (nd->match.original_name) {
-+                    g_autofree char* original_name = _netplan_scrub_string(nd->match.original_name);
-+                    g_string_append_printf(udev_rules, " ENV{ID_NET_NAME}==\"%s\",", original_name);
-+                }
-                 // match on (explicit) MAC address. Yes this would be unique on its own, but we
-                 // keep it within the "full match" to make the logic more comprehensible.
-                 if (nd->match.mac) {
-@@ -1139,7 +1142,9 @@ netplan_state_finish_nm_write(
-                         g_strfreev(split);
-                     } else
-                         drivers = g_strdup(nd->match.driver);
--                    g_string_append_printf(udev_rules, " ENV{ID_NET_DRIVER}==\"%s\",", drivers);
-+
-+                    g_autofree char* escaped_drivers = _netplan_scrub_string(drivers);
-+                    g_string_append_printf(udev_rules, " ENV{ID_NET_DRIVER}==\"%s\",", escaped_drivers);
-                     g_free(drivers);
-                 }
-                 g_string_append(udev_rules, suffix);
-diff --git a/src/parse.c b/src/parse.c
-index 7f7258c..55a236c 100644
---- a/src/parse.c
-+++ b/src/parse.c
-@@ -55,6 +55,15 @@
-     dst = g_strdup(src); \
- } }
- 
-+/*
-+ * We use g_strescape to escape control characters from the input.
-+ * Besides control characters, g_strescape will also escape double quotes and backslashes.
-+ * Quotes are escaped at configuration generation time as needed, as they might be part of passwords for example.
-+ * Escaping backslashes in the parser affects "netplan set" as it will always escape \'s from
-+ * the input and update YAMLs with all the \'s escaped again.
-+*/
-+static char* STRESCAPE_EXCEPTIONS = "\"\\";
-+
- STATIC gboolean
- insert_kv_into_hash(void *key, void *value, void *hash);
- 
-@@ -361,7 +370,7 @@ handle_generic_str(NetplanParser* npp, yaml_node_t* node, void* entryptr, const
-     guint offset = GPOINTER_TO_UINT(data);
-     char** dest = (char**) ((void*) entryptr + offset);
-     g_free(*dest);
--    *dest = g_strdup(scalar(node));
-+    *dest = g_strescape(scalar(node), STRESCAPE_EXCEPTIONS);
-     mark_data_as_dirty(npp, dest);
-     return TRUE;
- }
-@@ -481,22 +490,25 @@ handle_generic_map(NetplanParser *npp, yaml_node_t* node, const char* key_prefix
-         assert_type(npp, key, YAML_SCALAR_NODE);
-         assert_type(npp, value, YAML_SCALAR_NODE);
- 
-+        g_autofree char* escaped_key = g_strescape(scalar(key), STRESCAPE_EXCEPTIONS);
-+        g_autofree char* escaped_value = g_strescape(scalar(value), STRESCAPE_EXCEPTIONS);
-+
-         if (key_prefix && npp->null_fields) {
-             g_autofree char* full_key = NULL;
--            full_key = g_strdup_printf("%s\t%s", key_prefix, key->data.scalar.value);
-+            full_key = g_strdup_printf("%s\t%s", key_prefix, escaped_key);
-             if (g_hash_table_contains(npp->null_fields, full_key))
-                 continue;
-         }
- 
-         char* stored_value = NULL;
--        if (g_hash_table_lookup_extended(*map, scalar(key), NULL, (void**)&stored_value)) {
-+        if (g_hash_table_lookup_extended(*map, escaped_key, NULL, (void**)&stored_value)) {
-             /* We can safely skip this if it is the exact key/value match
-              * (probably caused by multi-pass processing) */
--            if (g_strcmp0(stored_value, scalar(value)) == 0)
-+            if (g_strcmp0(stored_value, escaped_value) == 0)
-                 continue;
--            return yaml_error(npp, node, error, "duplicate map entry '%s'", scalar(key));
-+            return yaml_error(npp, node, error, "duplicate map entry '%s'", escaped_key);
-         } else
--            g_hash_table_insert(*map, g_strdup(scalar(key)), g_strdup(scalar(value)));
-+            g_hash_table_insert(*map, g_strdup(escaped_key), g_strdup(escaped_value));
-     }
-     mark_data_as_dirty(npp, map);
- 
-@@ -519,20 +531,26 @@ handle_generic_datalist(NetplanParser *npp, yaml_node_t* node, const char* key_p
-     for (yaml_node_pair_t* entry = node->data.mapping.pairs.start; entry < node->data.mapping.pairs.top; entry++) {
-         yaml_node_t* key, *value;
-         g_autofree char* full_key = NULL;
-+        g_autofree char* escaped_key = NULL;
-+        g_autofree char* escaped_value = NULL;
- 
-         key = yaml_document_get_node(&npp->doc, entry->key);
-         value = yaml_document_get_node(&npp->doc, entry->value);
- 
-         assert_type(npp, key, YAML_SCALAR_NODE);
-         assert_type(npp, value, YAML_SCALAR_NODE);
-+
-+        escaped_key = g_strescape(scalar(key), STRESCAPE_EXCEPTIONS);
-+        escaped_value = g_strescape(scalar(value), STRESCAPE_EXCEPTIONS);
-+
-         if (npp->null_fields && key_prefix) {
--            full_key = g_strdup_printf("%s\t%s", key_prefix, scalar(key));
-+            full_key = g_strdup_printf("%s\t%s", key_prefix, escaped_key);
-             if (g_hash_table_contains(npp->null_fields, full_key))
-                 continue;
-         }
- 
--        g_datalist_id_set_data_full(list, g_quark_from_string(scalar(key)),
--                                    g_strdup(scalar(value)), g_free);
-+        g_datalist_id_set_data_full(list, g_quark_from_string(escaped_key),
-+                                    g_strdup(escaped_value), g_free);
-     }
-     mark_data_as_dirty(npp, list);
- 
-@@ -888,13 +906,14 @@ handle_match_driver(NetplanParser* npp, yaml_node_t* node, __unused const char*
-         for (yaml_node_item_t *iter = node->data.sequence.items.start; iter < node->data.sequence.items.top; iter++) {
-             elem = yaml_document_get_node(&npp->doc, *iter);
-             assert_type(npp, elem, YAML_SCALAR_NODE);
--            if (g_strrstr(scalar(elem), " "))
-+            g_autofree char* escaped_elem = g_strescape(scalar(elem), STRESCAPE_EXCEPTIONS);
-+            if (g_strrstr(escaped_elem, " "))
-                 return yaml_error(npp, node, error, "A 'driver' glob cannot contain whitespace");
- 
-             if (!sequence)
--                sequence = g_string_new(scalar(elem));
-+                sequence = g_string_new(escaped_elem);
-             else
--                g_string_append_printf(sequence, "\t%s", scalar(elem)); /* tab separated */
-+                g_string_append_printf(sequence, "\t%s", escaped_elem); /* tab separated */
-         }
- 
-         if (!sequence)
-@@ -926,7 +945,7 @@ handle_auth_str(NetplanParser* npp, yaml_node_t* node, const void* data, __unuse
-     guint offset = GPOINTER_TO_UINT(data);
-     char** dest = (char**) ((void*) npp->current.auth + offset);
-     g_free(*dest);
--    *dest = g_strdup(scalar(node));
-+    *dest = g_strescape(scalar(node), STRESCAPE_EXCEPTIONS);
-     mark_data_as_dirty(npp, dest);
-     return TRUE;
- }
-@@ -1074,7 +1093,7 @@ handle_access_point_password(NetplanParser* npp, yaml_node_t* node, __unused con
- 
-     access_point->auth.pmf_mode = NETPLAN_AUTH_PMF_MODE_OPTIONAL;
-     g_free(access_point->auth.psk);
--    access_point->auth.psk = g_strdup(scalar(node));
-+    access_point->auth.psk = g_strescape(scalar(node), STRESCAPE_EXCEPTIONS);
-     return TRUE;
- }
- 
-@@ -1458,6 +1477,7 @@ handle_wifi_access_points(NetplanParser* npp, yaml_node_t* node, const char* key
-     for (yaml_node_pair_t* entry = node->data.mapping.pairs.start; entry < node->data.mapping.pairs.top; entry++) {
-         NetplanWifiAccessPoint *access_point = NULL;
-         g_autofree char* full_key = NULL;
-+        g_autofree char* escaped_key = NULL;
-         yaml_node_t* key, *value;
-         const gchar* ssid;
- 
-@@ -1466,13 +1486,15 @@ handle_wifi_access_points(NetplanParser* npp, yaml_node_t* node, const char* key
-         value = yaml_document_get_node(&npp->doc, entry->value);
-         assert_type(npp, value, YAML_MAPPING_NODE);
- 
-+        escaped_key = g_strescape(scalar(key), STRESCAPE_EXCEPTIONS);
-+
-         if (key_prefix && npp->null_fields) {
--            full_key = g_strdup_printf("%s\t%s", key_prefix, key->data.scalar.value);
-+            full_key = g_strdup_printf("%s\t%s", key_prefix, escaped_key);
-             if (g_hash_table_contains(npp->null_fields, full_key))
-                 continue;
-         }
- 
--        ssid = scalar(key);
-+        ssid = escaped_key;
- 
-         /*
-          * Delete the access-point if it already exists in the netdef and let the new
-@@ -1630,15 +1652,16 @@ handle_nameservers_search(NetplanParser* npp, yaml_node_t* node, __unused const
-     for (yaml_node_item_t *i = node->data.sequence.items.start; i < node->data.sequence.items.top; i++) {
-         yaml_node_t *entry = yaml_document_get_node(&npp->doc, *i);
-         assert_type(npp, entry, YAML_SCALAR_NODE);
-+        g_autofree char* escaped_entry = g_strescape(scalar(entry), STRESCAPE_EXCEPTIONS);
- 
-         if (!npp->current.netdef->search_domains)
-             npp->current.netdef->search_domains = g_array_new(FALSE, FALSE, sizeof(char*));
- 
--        if (!is_string_in_array(npp->current.netdef->search_domains, scalar(entry))) {
--            char* s = g_strdup(scalar(entry));
-+        if (!is_string_in_array(npp->current.netdef->search_domains, escaped_entry)) {
-+            char* s = g_strdup(escaped_entry);
-             g_array_append_val(npp->current.netdef->search_domains, s);
-         } else {
--            g_debug("%s: Search domain '%s' has already been added", npp->current.netdef->id, scalar(entry));
-+            g_debug("%s: Search domain '%s' has already been added", npp->current.netdef->id, escaped_entry);
-         }
-     }
-     mark_data_as_dirty(npp, &npp->current.netdef->search_domains);
-@@ -2744,19 +2767,19 @@ handle_ovs_bridge_controller_addresses(NetplanParser* npp, yaml_node_t* node, __
- 
-         /* Format: [p]unix:file */
-         if (is_unix && vec[1] != NULL && vec[2] == NULL) {
--            char* s = g_strdup(scalar(entry));
-+            char* s = g_strescape(scalar(entry), STRESCAPE_EXCEPTIONS);
-             g_array_append_val(npp->current.netdef->ovs_settings.controller.addresses, s);
-             g_strfreev(vec);
-             continue;
-         /* Format tcp:host[:port] or ssl:host[:port] */
-         } else if (is_host && validate_ovs_target(TRUE, vec[1])) {
--            char* s = g_strdup(scalar(entry));
-+            char* s = g_strescape(scalar(entry), STRESCAPE_EXCEPTIONS);
-             g_array_append_val(npp->current.netdef->ovs_settings.controller.addresses, s);
-             g_strfreev(vec);
-             continue;
-         /* Format ptcp:[port][:host] or pssl:[port][:host] */
-         } else if (is_port && validate_ovs_target(FALSE, vec[1])) {
--            char* s = g_strdup(scalar(entry));
-+            char* s = g_strescape(scalar(entry), STRESCAPE_EXCEPTIONS);
-             g_array_append_val(npp->current.netdef->ovs_settings.controller.addresses, s);
-             g_strfreev(vec);
-             continue;
-@@ -3070,6 +3093,8 @@ handle_network_ovs_settings_global_ports(NetplanParser* npp, yaml_node_t* node,
-     NetplanNetDefinition *component2 = NULL;
- 
-     for (yaml_node_item_t *iter = node->data.sequence.items.start; iter < node->data.sequence.items.top; iter++) {
-+        g_autofree char* escaped_port = NULL;
-+        g_autofree char* escaped_peer = NULL;
-         pair = yaml_document_get_node(&npp->doc, *iter);
-         assert_type(npp, pair, YAML_SEQUENCE_NODE);
- 
-@@ -3084,14 +3109,17 @@ handle_network_ovs_settings_global_ports(NetplanParser* npp, yaml_node_t* node,
-         peer = yaml_document_get_node(&npp->doc, *(item+1));
-         assert_type(npp, peer, YAML_SCALAR_NODE);
- 
--        if (!g_strcmp0(scalar(port), scalar(peer)))
-+        escaped_port = g_strescape(scalar(port), STRESCAPE_EXCEPTIONS);
-+        escaped_peer = g_strescape(scalar(peer), STRESCAPE_EXCEPTIONS);
-+
-+        if (!g_strcmp0(escaped_port, escaped_peer))
-             return yaml_error(npp, peer, error, "Open vSwitch patch ports must be of different name");
- 
-         /* Create port 1 netdef */
--        component1 = npp->parsed_defs ? g_hash_table_lookup(npp->parsed_defs, scalar(port)) : NULL;
-+        component1 = npp->parsed_defs ? g_hash_table_lookup(npp->parsed_defs, escaped_port) : NULL;
-         if (!component1) {
--            component1 = netplan_netdef_new(npp, scalar(port), NETPLAN_DEF_TYPE_PORT, NETPLAN_BACKEND_OVS);
--            if (g_hash_table_remove(npp->missing_id, scalar(port)))
-+            component1 = netplan_netdef_new(npp, escaped_port, NETPLAN_DEF_TYPE_PORT, NETPLAN_BACKEND_OVS);
-+            if (g_hash_table_remove(npp->missing_id, escaped_port))
-                 npp->missing_ids_found++;
-         }
- 
-@@ -3102,15 +3130,15 @@ handle_network_ovs_settings_global_ports(NetplanParser* npp, yaml_node_t* node,
-             component1->filepath = g_strdup(npp->current.filepath);
-         }
- 
--        if (component1->peer && g_strcmp0(component1->peer, scalar(peer)))
-+        if (component1->peer && g_strcmp0(component1->peer, escaped_peer))
-             return yaml_error(npp, port, error, "Open vSwitch port '%s' is already assigned to peer '%s'",
-                               component1->id, component1->peer);
- 
-         /* Create port 2 (peer) netdef */
--        component2 = npp->parsed_defs ? g_hash_table_lookup(npp->parsed_defs, scalar(peer)) : NULL;
-+        component2 = npp->parsed_defs ? g_hash_table_lookup(npp->parsed_defs, escaped_peer) : NULL;
-         if (!component2) {
--            component2 = netplan_netdef_new(npp, scalar(peer), NETPLAN_DEF_TYPE_PORT, NETPLAN_BACKEND_OVS);
--            if (g_hash_table_remove(npp->missing_id, scalar(peer)))
-+            component2 = netplan_netdef_new(npp, escaped_peer, NETPLAN_DEF_TYPE_PORT, NETPLAN_BACKEND_OVS);
-+            if (g_hash_table_remove(npp->missing_id, escaped_peer))
-                 npp->missing_ids_found++;
-         }
- 
-@@ -3121,16 +3149,16 @@ handle_network_ovs_settings_global_ports(NetplanParser* npp, yaml_node_t* node,
-             component2->filepath = g_strdup(npp->current.filepath);
-         }
- 
--        if (component2->peer && g_strcmp0(component2->peer, scalar(port)))
-+        if (component2->peer && g_strcmp0(component2->peer, escaped_port))
-             return yaml_error(npp, peer, error, "Open vSwitch port '%s' is already assigned to peer '%s'",
-                               component2->id, component2->peer);
- 
-         if (!component1->peer) {
--            component1->peer = g_strdup(scalar(peer));
-+            component1->peer = g_strdup(escaped_peer);
-             component1->peer_link = component2;
-         }
-         if (!component2->peer) {
--            component2->peer = g_strdup(scalar(port));
-+            component2->peer = g_strdup(escaped_port);
-             component2->peer_link = component1;
-         }
-     }
-diff --git a/src/util-internal.h b/src/util-internal.h
-index 7454e77..3b33c03 100644
---- a/src/util-internal.h
-+++ b/src/util-internal.h
-@@ -185,3 +185,6 @@ _netplan_netdef_pertype_iter_next(struct netdef_pertype_iter* it);
- 
- NETPLAN_INTERNAL void
- _netplan_netdef_pertype_iter_free(struct netdef_pertype_iter* it);
-+
-+gchar*
-+_netplan_scrub_string(const char* content);
-diff --git a/src/util.c b/src/util.c
-index 46aba6e..86f8c1f 100644
---- a/src/util.c
-+++ b/src/util.c
-@@ -1230,3 +1230,14 @@ _is_valid_macaddress(const char* value)
- 
-     return regexec(&re, value, 0, NULL, 0) == 0;
- }
-+
-+gchar*
-+_netplan_scrub_string(const char* content)
-+{
-+    GString* s = g_string_new(content);
-+
-+    // Escape double quotes
-+    g_string_replace(s, "\"", "\\\"", 0);
-+
-+    return g_string_free(s, FALSE);
-+}
-diff --git a/tests/generator/test_auth.py b/tests/generator/test_auth.py
-index d3d886c..bf0108a 100644
---- a/tests/generator/test_auth.py
-+++ b/tests/generator/test_auth.py
-@@ -92,21 +92,21 @@ class TestNetworkd(TestBase):
-             self.assertIn('ctrl_interface=/run/wpa_supplicant', new_config)
-             self.assertIn('''
- network={
--  ssid="peer2peer"
-+  ssid=P"peer2peer"
-   mode=1
-   key_mgmt=NONE
- }
- ''', new_config)
-             self.assertIn('''
- network={
--  ssid="Luke's Home"
-+  ssid=P"Luke's Home"
-   key_mgmt=WPA-PSK
-   psk="4lsos3kr1t"
- }
- ''', new_config)
-             self.assertIn('''
- network={
--  ssid="BobsHome"
-+  ssid=P"BobsHome"
-   key_mgmt=WPA-PSK WPA-PSK-SHA256 SAE
-   ieee80211w=1
-   psk=e03ce667c87bc81ca968d9120ca37f89eb09aec3c55b80386e5d772efd6b926e
-@@ -114,14 +114,14 @@ network={
- ''', new_config)
-             self.assertIn('''
- network={
--  ssid="BillsHome"
-+  ssid=P"BillsHome"
-   key_mgmt=WPA-PSK
-   psk=db3b0acf5653aeaddd5fe034fb9f07175b2864f847b005aaa2f09182d9411b04
- }
- ''', new_config)
-             self.assertIn('''
- network={
--  ssid="workplace2"
-+  ssid=P"workplace2"
-   key_mgmt=WPA-EAP
-   eap=PEAP
-   identity="[e-mail]"
-@@ -131,7 +131,7 @@ network={
- ''', new_config)
-             self.assertIn('''
- network={
--  ssid="workplace"
-+  ssid=P"workplace"
-   key_mgmt=WPA-EAP
-   eap=TTLS
-   identity="[e-mail]"
-@@ -141,7 +141,7 @@ network={
- ''', new_config)
-             self.assertIn('''
- network={
--  ssid="workplacehashed"
-+  ssid=P"workplacehashed"
-   key_mgmt=WPA-EAP
-   eap=TTLS
-   identity="[e-mail]"
-@@ -151,7 +151,7 @@ network={
- ''', new_config)
-             self.assertIn('''
- network={
--  ssid="customernet"
-+  ssid=P"customernet"
-   key_mgmt=WPA-EAP
-   eap=TLS
-   identity="[e-mail]"
-@@ -164,13 +164,13 @@ network={
- ''', new_config)
-             self.assertIn('''
- network={
--  ssid="opennet"
-+  ssid=P"opennet"
-   key_mgmt=NONE
- }
- ''', new_config)
-             self.assertIn('''
- network={
--  ssid="Joe's Home"
-+  ssid=P"Joe's Home"
-   key_mgmt=WPA-PSK WPA-PSK-SHA256 SAE
-   ieee80211w=1
-   psk="s0s3kr1t"
-diff --git a/tests/generator/test_common.py b/tests/generator/test_common.py
-index d98eb32..8dfaf7d 100644
---- a/tests/generator/test_common.py
-+++ b/tests/generator/test_common.py
-@@ -19,7 +19,7 @@
- import os
- import textwrap
- 
--from .base import TestBase, ND_DHCP4, ND_DHCP6, ND_DHCPYES, ND_EMPTY, NM_MANAGED, NM_UNMANAGED
-+from .base import UDEV_NO_MAC_RULE, TestBase, ND_DHCP4, ND_DHCP6, ND_DHCPYES, ND_EMPTY, NM_MANAGED, NM_UNMANAGED
- 
- 
- class TestNetworkd(TestBase):
-@@ -810,6 +810,18 @@ RouteMetric=100
- UseMTU=true
- '''})
- 
-+    def test_nd_udev_rules_escaped(self):
-+        self.generate('''network:
-+  version: 2
-+  renderer: NetworkManager
-+  ethernets:
-+    def1:
-+      match:
-+        driver: "abc\\"xyz\\n0\\n\\n1"
-+      set-name: "eth\\"\\n\\nxyz\\n0"''', skip_generated_yaml_validation=True)
-+
-+        self.assert_networkd_udev({'def1.rules': (UDEV_NO_MAC_RULE % ('abc\\"xyz\\n0\\n\\n1', 'eth\\"\\n\\nxyz\\n0'))})
-+
- 
- class TestNetworkManager(TestBase):
- 
-@@ -1315,6 +1327,28 @@ dns=8.8.8.8;
- method=ignore
- '''})
- 
-+    def test_nm_udev_rules_escaped(self):
-+        self.generate('''network:
-+  version: 2
-+  renderer: networkd
-+  ethernets:
-+    eth0:
-+      match:
-+        name: "eth\\"0"
-+      dhcp4: true''')
-+        self.assert_nm_udev(NM_UNMANAGED % 'eth\\"0')
-+
-+        self.generate('''network:
-+  version: 2
-+  renderer: networkd
-+  ethernets:
-+    eth0:
-+      match:
-+        name: "eth0"
-+      set-name: "eth\\n0"
-+      dhcp4: true''', skip_generated_yaml_validation=True)
-+        self.assert_nm_udev(NM_UNMANAGED % 'eth\\n0' + NM_UNMANAGED % 'eth0')
-+
- 
- class TestForwardDeclaration(TestBase):
- 
-@@ -1777,13 +1811,13 @@ LinkLocalAddressing=ipv6
-         self.assert_wpa_supplicant("wlan0", """ctrl_interface=/run/wpa_supplicant
- 
- network={
--  ssid="mynewwifi"
-+  ssid=P"mynewwifi"
-   key_mgmt=WPA-PSK WPA-PSK-SHA256 SAE
-   ieee80211w=1
-   psk="aaaaaaaa"
- }
- network={
--  ssid="mywifi"
-+  ssid=P"mywifi"
-   key_mgmt=WPA-PSK WPA-PSK-SHA256 SAE
-   ieee80211w=1
-   psk="aaaaaaaa"
-@@ -1814,7 +1848,7 @@ network={
-         self.assert_wpa_supplicant("wlan0", """ctrl_interface=/run/wpa_supplicant
- 
- network={
--  ssid="mywifi"
-+  ssid=P"mywifi"
-   key_mgmt=WPA-PSK WPA-PSK-SHA256 SAE
-   ieee80211w=1
-   psk="bbbbbbbb"
-diff --git a/tests/generator/test_wifis.py b/tests/generator/test_wifis.py
-index 610782a..9f7359b 100644
---- a/tests/generator/test_wifis.py
-+++ b/tests/generator/test_wifis.py
-@@ -65,7 +65,7 @@ class TestNetworkd(TestBase):
-         with open(os.path.join(self.workdir.name, 'run/netplan/wpa-wl0.conf')) as f:
-             new_config = f.read()
- 
--            network = 'ssid="{}"\n  freq_list='.format('band-no-channel2')
-+            network = 'ssid=P"{}"\n  freq_list='.format('band-no-channel2')
-             freqs_5GHz = [5610, 5310, 5620, 5320, 5630, 5640, 5340, 5035, 5040, 5045, 5055, 5060, 5660, 5680, 5670, 5080, 5690,
-                           5700, 5710, 5720, 5825, 5745, 5755, 5805, 5765, 5160, 5775, 5170, 5480, 5180, 5795, 5190, 5500, 5200,
-                           5510, 5210, 5520, 5220, 5530, 5230, 5540, 5240, 5550, 5250, 5560, 5260, 5570, 5270, 5580, 5280, 5590,
-@@ -76,7 +76,7 @@ class TestNetworkd(TestBase):
-             for freq in freqs_5GHz:
-                 self.assertRegex(new_config, '{}[ 0-9]*{}[ 0-9]*\n'.format(network, freq))
- 
--            network = 'ssid="{}"\n  freq_list='.format('band-no-channel')
-+            network = 'ssid=P"{}"\n  freq_list='.format('band-no-channel')
-             freqs_24GHz = [2412, 2417, 2422, 2427, 2432, 2442, 2447, 2437, 2452, 2457, 2462, 2467, 2472, 2484]
-             freqs = new_config.split(network)
-             freqs = freqs[1].split('\n')[0]
-@@ -86,20 +86,20 @@ class TestNetworkd(TestBase):
- 
-             self.assertIn('''
- network={
--  ssid="channel-no-band"
-+  ssid=P"channel-no-band"
-   key_mgmt=NONE
- }
- ''', new_config)
-             self.assertIn('''
- network={
--  ssid="peer2peer"
-+  ssid=P"peer2peer"
-   mode=1
-   key_mgmt=NONE
- }
- ''', new_config)
-             self.assertIn('''
- network={
--  ssid="hidden-y"
-+  ssid=P"hidden-y"
-   scan_ssid=1
-   key_mgmt=WPA-PSK WPA-PSK-SHA256 SAE
-   ieee80211w=1
-@@ -108,7 +108,7 @@ network={
- ''', new_config)
-             self.assertIn('''
- network={
--  ssid="hidden-n"
-+  ssid=P"hidden-n"
-   key_mgmt=WPA-PSK WPA-PSK-SHA256 SAE
-   ieee80211w=1
-   psk="5ecur1ty"
-@@ -116,7 +116,7 @@ network={
- ''', new_config)
-             self.assertIn('''
- network={
--  ssid="workplace"
-+  ssid=P"workplace"
-   bssid=de:ad:be:ef:ca:fe
-   freq_list=5500
-   key_mgmt=WPA-PSK WPA-PSK-SHA256 SAE
-@@ -126,7 +126,7 @@ network={
- ''', new_config)
-             self.assertIn('''
- network={
--  ssid="Joe's Home"
-+  ssid=P"Joe's Home"
-   bssid=00:11:22:33:44:55
-   freq_list=2462
-   key_mgmt=WPA-PSK WPA-PSK-SHA256 SAE
-@@ -303,7 +303,7 @@ LinkLocalAddressing=ipv6
-             self.assertIn('''
- wowlan_triggers=any disconnect magic_pkt gtk_rekey_failure eap_identity_req four_way_handshake rfkill_release
- network={
--  ssid="homenet"
-+  ssid=P"homenet"
-   key_mgmt=NONE
- }
- ''', new_config)
-@@ -336,7 +336,7 @@ LinkLocalAddressing=ipv6
-             new_config = f.read()
-             self.assertIn('''
- network={
--  ssid="homenet"
-+  ssid=P"homenet"
-   key_mgmt=NONE
- }
- ''', new_config)
-@@ -360,7 +360,7 @@ network={
-         self.assert_wpa_supplicant("wl0", """ctrl_interface=/run/wpa_supplicant
- 
- network={
--  ssid="homenet"
-+  ssid=P"homenet"
-   key_mgmt=SAE
-   ieee80211w=2
-   psk="********"
-@@ -387,7 +387,7 @@ network={
-         self.assert_wpa_supplicant("wl0", """ctrl_interface=/run/wpa_supplicant
- 
- network={
--  ssid="homenet"
-+  ssid=P"homenet"
-   key_mgmt=WPA-EAP WPA-EAP-SHA256
-   eap=TLS
-   ieee80211w=1
-@@ -420,7 +420,7 @@ network={
-         self.assert_wpa_supplicant("wl0", """ctrl_interface=/run/wpa_supplicant
- 
- network={
--  ssid="homenet"
-+  ssid=P"homenet"
-   key_mgmt=WPA-EAP-SUITE-B-192
-   eap=TLS
-   ieee80211w=2
-@@ -449,7 +449,7 @@ network={
-         self.assert_wpa_supplicant("wl0", """ctrl_interface=/run/wpa_supplicant
- 
- network={
--  ssid="homenet"
-+  ssid=P"homenet"
-   key_mgmt=IEEE8021X
-   eap=LEAP
-   identity="some-id"
-@@ -473,7 +473,7 @@ network={
-         self.assert_wpa_supplicant("wl0", """ctrl_interface=/run/wpa_supplicant
- 
- network={
--  ssid="homenet"
-+  ssid=P"homenet"
-   key_mgmt=IEEE8021X
-   eap=PWD
-   identity="some-id"
-@@ -498,7 +498,7 @@ network={
-         self.assert_wpa_supplicant("wl0", """ctrl_interface=/run/wpa_supplicant
- 
- network={
--  ssid="homenet"
-+  ssid=P"homenet"
-   key_mgmt=WPA-EAP
-   eap=LEAP
-   ieee80211w=1
-@@ -508,6 +508,48 @@ network={
- }
- """)
- 
-+    def test_escaping_special_characters(self):
-+        self.generate('''network:
-+  version: 2
-+  wifis:
-+    wl0:
-+      regulatory-domain: "abc\\n\\n321\\n\\"123"
-+      access-points:
-+        "abc\\n\\n123\\"x\\ry\\bz":
-+          password:  "abc\\n\\n\\n\\"123"
-+          auth:
-+            key-management: eap
-+            method: leap
-+            anonymous-identity: "abc\\n\\n321\\n\\"123"
-+            identity: "abc\\n\\n321\\n\\"123"
-+            password: "abc\\n\\n\\n\\"123"
-+            ca-certificate: "abc\\n\\n321\\n\\"123"
-+            client-certificate: "abc\\n\\n321\\n\\"123"
-+            client-key: "abc\\n\\n321\\n\\"123"
-+            client-key-password: "abc\\n\\n321\\n\\"123"
-+            phase2-auth: "abc\\n\\n321\\n\\"123"
-+            ''', skip_generated_yaml_validation=True)
-+
-+        self.assert_wpa_supplicant("wl0", """ctrl_interface=/run/wpa_supplicant
-+
-+country=abc\\n\\n321\\n\\"123
-+network={
-+  ssid=P"abc\\n\\n123\\\"x\\ry\\bz"
-+  key_mgmt=WPA-EAP
-+  eap=LEAP
-+  ieee80211w=1
-+  identity="abc\\n\\n321\\n\\\"123"
-+  anonymous_identity="abc\\n\\n321\\n\\\"123"
-+  psk="abc\\n\\n\\n\"123"
-+  password="abc\\n\\n\\n\"123"
-+  ca_cert="abc\\n\\n321\\n\\\"123"
-+  client_cert="abc\\n\\n321\\n\\\"123"
-+  private_key="abc\\n\\n321\\n\\\"123"
-+  private_key_passwd="abc\\n\\n321\\n\"123"
-+  phase2="auth=abc\\n\\n321\\n\\\"123"
-+}
-+""")
-+
- 
- class TestNetworkManager(TestBase):
- 
-@@ -790,7 +832,7 @@ mode=adhoc
-         self.assert_wpa_supplicant("wl0", """ctrl_interface=/run/wpa_supplicant
- 
- network={
--  ssid="homenet"
-+  ssid=P"homenet"
-   frequency=2442
-   mode=1
-   key_mgmt=WPA-PSK WPA-PSK-SHA256 SAE
-@@ -814,7 +856,7 @@ network={
-         self.assert_wpa_supplicant("wl0", """ctrl_interface=/run/wpa_supplicant
- 
- network={
--  ssid="homenet"
-+  ssid=P"homenet"
-   frequency=5035
-   mode=1
-   key_mgmt=WPA-PSK WPA-PSK-SHA256 SAE
diff --git a/debian/patches/lp2066258/0016-backends-escape-file-paths.patch b/debian/patches/lp2066258/0016-backends-escape-file-paths.patch
deleted file mode 100644
index 1e42442..0000000
--- a/debian/patches/lp2066258/0016-backends-escape-file-paths.patch
+++ /dev/null
@@ -1,288 +0,0 @@
-From: Danilo Egea Gondolfo <[e-mail]>
-Date: Thu, 23 May 2024 15:54:43 +0100
-Subject: backends: escape file paths
-
-Escape strings used to build paths with g_uri_escape_string().
-systemd_escape() could also be used but it has the downside of calling
-an external program and, by default, it escapes dashes (which are
-present in files generated from Network Manager for example).
----
- src/networkd.c                 | 13 +++++----
- src/nm.c                       |  5 ++--
- src/openvswitch.c              | 19 ++++++------
- src/util.c                     |  7 +++--
- tests/generator/test_common.py | 66 ++++++++++++++++++++++++++++++++++++++++++
- tests/generator/test_ovs.py    | 24 +++++++++++++++
- 6 files changed, 115 insertions(+), 19 deletions(-)
-
-diff --git a/src/networkd.c b/src/networkd.c
-index 0414c92..1da684b 100644
---- a/src/networkd.c
-+++ b/src/networkd.c
-@@ -1065,7 +1065,8 @@ STATIC void
- write_rules_file(const NetplanNetDefinition* def, const char* rootdir)
- {
-     GString* s = NULL;
--    g_autofree char* path = g_strjoin(NULL, "run/udev/rules.d/99-netplan-", def->id, ".rules", NULL);
-+    g_autofree char* escaped_netdef_id = g_uri_escape_string(def->id, NULL, TRUE);
-+    g_autofree char* path = g_strjoin(NULL, "run/udev/rules.d/99-netplan-", escaped_netdef_id, ".rules", NULL);
- 
-     /* do we need to write a .rules file?
-      * It's only required for reliably setting the name of a physical device
-@@ -1282,7 +1283,8 @@ write_wpa_conf(const NetplanNetDefinition* def, const char* rootdir, GError** er
- {
-     GHashTableIter iter;
-     GString* s = g_string_new("ctrl_interface=/run/wpa_supplicant\n\n");
--    g_autofree char* path = g_strjoin(NULL, "run/netplan/wpa-", def->id, ".conf", NULL);
-+    g_autofree char* escaped_netdef_id = g_uri_escape_string(def->id, NULL, TRUE);
-+    g_autofree char* path = g_strjoin(NULL, "run/netplan/wpa-", escaped_netdef_id, ".conf", NULL);
- 
-     g_debug("%s: Creating wpa_supplicant configuration file %s", def->id, path);
-     if (def->type == NETPLAN_DEF_TYPE_WIFI) {
-@@ -1394,7 +1396,8 @@ _netplan_netdef_write_networkd(
-         GError** error)
- {
-     /* TODO: make use of netplan_netdef_get_output_filename() */
--    g_autofree char* path_base = g_strjoin(NULL, "run/systemd/network/10-netplan-", def->id, NULL);
-+    g_autofree char* escaped_netdef_id = g_uri_escape_string(def->id, NULL, TRUE);
-+    g_autofree char* path_base = g_strjoin(NULL, "run/systemd/network/10-netplan-", escaped_netdef_id, NULL);
-     SET_OPT_OUT_PTR(has_been_written, FALSE);
- 
-     /* We want this for all backends when renaming, as *.link and *.rules files are
-@@ -1416,8 +1419,8 @@ _netplan_netdef_write_networkd(
-     }
- 
-     if (def->type == NETPLAN_DEF_TYPE_WIFI || def->has_auth) {
--        g_autofree char* link = g_strjoin(NULL, rootdir ?: "", "/run/systemd/system/systemd-networkd.service.wants/netplan-wpa-", def->id, ".service", NULL);
--        g_autofree char* slink = g_strjoin(NULL, "/run/systemd/system/netplan-wpa-", def->id, ".service", NULL);
-+        g_autofree char* link = g_strjoin(NULL, rootdir ?: "", "/run/systemd/system/systemd-networkd.service.wants/netplan-wpa-", escaped_netdef_id, ".service", NULL);
-+        g_autofree char* slink = g_strjoin(NULL, "/run/systemd/system/netplan-wpa-", escaped_netdef_id, ".service", NULL);
-         if (def->type == NETPLAN_DEF_TYPE_WIFI && def->has_match) {
-             g_set_error(error, NETPLAN_BACKEND_ERROR, NETPLAN_ERROR_UNSUPPORTED, "ERROR: %s: networkd backend does not support wifi with match:, only by interface name\n", def->id);
-             return FALSE;
-diff --git a/src/nm.c b/src/nm.c
-index cb09559..aa22567 100644
---- a/src/nm.c
-+++ b/src/nm.c
-@@ -932,10 +932,11 @@ write_nm_conf_access_point(const NetplanNetDefinition* def, const char* rootdir,
-         g_datalist_foreach((GData**)&def->backend_settings.passthrough, write_fallback_key_value, kf);
-     }
- 
-+    g_autofree char* escaped_netdef_id = g_uri_escape_string(def->id, NULL, TRUE);
-     if (ap) {
-         g_autofree char* escaped_ssid = g_uri_escape_string(ap->ssid, NULL, TRUE);
-         /* TODO: make use of netplan_netdef_get_output_filename() */
--        conf_path = g_strjoin(NULL, "run/NetworkManager/system-connections/netplan-", def->id, "-", escaped_ssid, ".nmconnection", NULL);
-+        conf_path = g_strjoin(NULL, "run/NetworkManager/system-connections/netplan-", escaped_netdef_id, "-", escaped_ssid, ".nmconnection", NULL);
- 
-         g_key_file_set_string(kf, "wifi", "ssid", ap->ssid);
-         if (ap->mode < NETPLAN_WIFI_MODE_OTHER)
-@@ -970,7 +971,7 @@ write_nm_conf_access_point(const NetplanNetDefinition* def, const char* rootdir,
-         }
-     } else {
-         /* TODO: make use of netplan_netdef_get_output_filename() */
--        conf_path = g_strjoin(NULL, "run/NetworkManager/system-connections/netplan-", def->id, ".nmconnection", NULL);
-+        conf_path = g_strjoin(NULL, "run/NetworkManager/system-connections/netplan-", escaped_netdef_id, ".nmconnection", NULL);
-         if (def->has_auth) {
-             write_dot1x_auth_parameters(&def->auth, kf);
-         }
-diff --git a/src/openvswitch.c b/src/openvswitch.c
-index 2ab77e7..0a81a59 100644
---- a/src/openvswitch.c
-+++ b/src/openvswitch.c
-@@ -31,9 +31,9 @@
- STATIC gboolean
- write_ovs_systemd_unit(const char* id, const GString* cmds, const char* rootdir, gboolean physical, gboolean cleanup, const char* dependency, GError** error)
- {
--    g_autofree gchar* id_escaped = NULL;
--    g_autofree char* link = g_strjoin(NULL, rootdir ?: "", "/run/systemd/system/systemd-networkd.service.wants/netplan-ovs-", id, ".service", NULL);
--    g_autofree char* path = g_strjoin(NULL, "/run/systemd/system/netplan-ovs-", id, ".service", NULL);
-+    g_autofree char* escaped_netdef_id = g_uri_escape_string(id, NULL, TRUE);
-+    g_autofree char* link = g_strjoin(NULL, rootdir ?: "", "/run/systemd/system/systemd-networkd.service.wants/netplan-ovs-", escaped_netdef_id, ".service", NULL);
-+    g_autofree char* path = g_strjoin(NULL, "/run/systemd/system/netplan-ovs-", escaped_netdef_id, ".service", NULL);
- 
-     GString* s = g_string_new("[Unit]\n");
-     g_string_append_printf(s, "Description=OpenVSwitch configuration for %s\n", id);
-@@ -42,9 +42,8 @@ write_ovs_systemd_unit(const char* id, const GString* cmds, const char* rootdir,
-     g_string_append_printf(s, "Wants=ovsdb-server.service\n");
-     g_string_append_printf(s, "After=ovsdb-server.service\n");
-     if (physical) {
--        id_escaped = systemd_escape((char*) id);
--        g_string_append_printf(s, "Requires=sys-subsystem-net-devices-%s.device\n", id_escaped);
--        g_string_append_printf(s, "After=sys-subsystem-net-devices-%s.device\n", id_escaped);
-+        g_string_append_printf(s, "Requires=sys-subsystem-net-devices-%s.device\n", escaped_netdef_id);
-+        g_string_append_printf(s, "After=sys-subsystem-net-devices-%s.device\n", escaped_netdef_id);
-     }
-     if (!cleanup) {
-         g_string_append_printf(s, "After=netplan-ovs-cleanup.service\n");
-@@ -54,8 +53,9 @@ write_ovs_systemd_unit(const char* id, const GString* cmds, const char* rootdir,
-     }
-     g_string_append(s, "Before=network.target\nWants=network.target\n");
-     if (dependency) {
--        g_string_append_printf(s, "Requires=netplan-ovs-%s.service\n", dependency);
--        g_string_append_printf(s, "After=netplan-ovs-%s.service\n", dependency);
-+        g_autofree char* escaped_dependency = g_uri_escape_string(dependency, NULL, TRUE);
-+        g_string_append_printf(s, "Requires=netplan-ovs-%s.service\n", escaped_dependency);
-+        g_string_append_printf(s, "After=netplan-ovs-%s.service\n", escaped_dependency);
-     }
- 
-     g_string_append(s, "\n[Service]\nType=oneshot\nTimeoutStartSec=10s\n");
-@@ -325,6 +325,7 @@ _netplan_netdef_write_ovs(const NetplanState* np_state, const NetplanNetDefiniti
-     gchar* dependency = NULL;
-     const char* type = netplan_type_to_table_name(def->type);
-     g_autofree char* base_config_path = NULL;
-+    g_autofree char* escaped_netdef_id = g_uri_escape_string(def->id, NULL, TRUE);
-     char* value = NULL;
-     const NetplanOVSSettings* settings = &np_state->ovs_settings;
- 
-@@ -415,7 +416,7 @@ _netplan_netdef_write_ovs(const NetplanState* np_state, const NetplanNetDefiniti
- 
-         /* Try writing out a base config */
-         /* TODO: make use of netplan_netdef_get_output_filename() */
--        base_config_path = g_strjoin(NULL, "run/systemd/network/10-netplan-", def->id, NULL);
-+        base_config_path = g_strjoin(NULL, "run/systemd/network/10-netplan-", escaped_netdef_id, NULL);
-         if (!_netplan_netdef_write_network_file(np_state, def, rootdir, base_config_path, has_been_written, error))
-             return FALSE;
-     } else {
-diff --git a/src/util.c b/src/util.c
-index 86f8c1f..d8477a5 100644
---- a/src/util.c
-+++ b/src/util.c
-@@ -663,17 +663,18 @@ ssize_t
- netplan_netdef_get_output_filename(const NetplanNetDefinition* netdef, const char* ssid, char* out_buffer, size_t out_buf_size)
- {
-     g_autofree gchar* conf_path = NULL;
-+    g_autofree char* escaped_netdef_id = g_uri_escape_string(netdef->id, NULL, TRUE);
- 
-     if (netdef->backend == NETPLAN_BACKEND_NM) {
-         if (ssid) {
-             g_autofree char* escaped_ssid = g_uri_escape_string(ssid, NULL, TRUE);
--            conf_path = g_strjoin(NULL, "/run/NetworkManager/system-connections/netplan-", netdef->id, "-", escaped_ssid, ".nmconnection", NULL);
-+            conf_path = g_strjoin(NULL, "/run/NetworkManager/system-connections/netplan-", escaped_netdef_id, "-", escaped_ssid, ".nmconnection", NULL);
-         } else {
--            conf_path = g_strjoin(NULL, "/run/NetworkManager/system-connections/netplan-", netdef->id, ".nmconnection", NULL);
-+            conf_path = g_strjoin(NULL, "/run/NetworkManager/system-connections/netplan-", escaped_netdef_id, ".nmconnection", NULL);
-         }
- 
-     } else if (netdef->backend == NETPLAN_BACKEND_NETWORKD || netdef->backend == NETPLAN_BACKEND_OVS) {
--        conf_path = g_strjoin(NULL, "/run/systemd/network/10-netplan-", netdef->id, ".network", NULL);
-+        conf_path = g_strjoin(NULL, "/run/systemd/network/10-netplan-", escaped_netdef_id, ".network", NULL);
-     }
- 
-     if (conf_path)
-diff --git a/tests/generator/test_common.py b/tests/generator/test_common.py
-index 8dfaf7d..f87fef0 100644
---- a/tests/generator/test_common.py
-+++ b/tests/generator/test_common.py
-@@ -822,6 +822,47 @@ UseMTU=true
- 
-         self.assert_networkd_udev({'def1.rules': (UDEV_NO_MAC_RULE % ('abc\\"xyz\\n0\\n\\n1', 'eth\\"\\n\\nxyz\\n0'))})
- 
-+    def test_nd_file_paths_escaped(self):
-+        self.generate('''network:
-+  version: 2
-+  ethernets:
-+    "abc/../../xyz0":
-+      match:
-+        driver: "drv"
-+      set-name: "eth123"''')
-+
-+        self.assert_networkd_udev({'abc%2F..%2F..%2Fxyz0.rules': (UDEV_NO_MAC_RULE % ('drv', 'eth123'))})
-+        self.assert_networkd({'abc%2F..%2F..%2Fxyz0.network': '''[Match]\nDriver=drv
-+Name=eth123
-+
-+[Network]
-+LinkLocalAddressing=ipv6
-+''',
-+                              'abc%2F..%2F..%2Fxyz0.link': '''[Match]\nDriver=drv\n
-+[Link]
-+Name=eth123
-+WakeOnLan=off
-+'''})
-+
-+        self.generate('''network:
-+  version: 2
-+  wifis:
-+    "abc/../../xyz0":
-+      dhcp4: true
-+      access-points:
-+        "mywifi":
-+          password: "aaaaaaaa"''')
-+
-+        self.assert_wpa_supplicant("abc%2F..%2F..%2Fxyz0", """ctrl_interface=/run/wpa_supplicant
-+
-+network={
-+  ssid=P"mywifi"
-+  key_mgmt=WPA-PSK WPA-PSK-SHA256 SAE
-+  ieee80211w=1
-+  psk="aaaaaaaa"
-+}
-+""")
-+
- 
- class TestNetworkManager(TestBase):
- 
-@@ -1349,6 +1390,31 @@ method=ignore
-       dhcp4: true''', skip_generated_yaml_validation=True)
-         self.assert_nm_udev(NM_UNMANAGED % 'eth\\n0' + NM_UNMANAGED % 'eth0')
- 
-+    def test_nm_file_paths_escaped(self):
-+        self.generate('''network:
-+  version: 2
-+  renderer: NetworkManager
-+  ethernets:
-+    "abc/../../xyz0":
-+      match:
-+        driver: "drv"
-+      set-name: "eth123"''')
-+
-+        self.assert_nm({'abc%2F..%2F..%2Fxyz0': '''[connection]
-+id=netplan-abc/../../xyz0
-+type=ethernet
-+interface-name=eth123
-+
-+[ethernet]
-+wake-on-lan=0
-+
-+[ipv4]
-+method=link-local
-+
-+[ipv6]
-+method=ignore
-+'''})
-+
- 
- class TestForwardDeclaration(TestBase):
- 
-diff --git a/tests/generator/test_ovs.py b/tests/generator/test_ovs.py
-index a6ebbcb..7116705 100644
---- a/tests/generator/test_ovs.py
-+++ b/tests/generator/test_ovs.py
-@@ -1110,3 +1110,27 @@ ExecStart=/usr/bin/ovs-vsctl set Bridge br123 external-ids:netplan/global/set-co
-         - [portname, portname]
- ''', expect_fail=True)
-         self.assertIn('Open vSwitch patch ports must be of different name', err)
-+
-+    def test_file_paths_escaped(self):
-+        self.generate('''network:
-+  version: 2
-+  bridges:
-+    "abc/../../123":
-+      openvswitch: {}
-+  vlans:
-+    "abc/../../123.100":
-+      id: 100
-+      link: "abc/../../123"
-+''')
-+        self.assert_ovs({'abc%2F..%2F..%2F123.service': OVS_BR_EMPTY % {'iface': 'abc/../../123'},
-+                         'abc%2F..%2F..%2F123.100.service': OVS_VIRTUAL % {'iface': 'abc/../../123.100', 'extra':
-+                                                                           '''Requires=netplan-ovs-abc%2F..%2F..%2F123.service
-+After=netplan-ovs-abc%2F..%2F..%2F123.service
-+
-+[Service]
-+Type=oneshot
-+TimeoutStartSec=10s
-+ExecStart=/usr/bin/ovs-vsctl --may-exist add-br abc/../../123.100 abc/../../123 100
-+ExecStart=/usr/bin/ovs-vsctl set Interface abc/../../123.100 external-ids:netplan=true
-+'''},
-+                         'cleanup.service': OVS_CLEANUP % {'iface': 'cleanup'}})
diff --git a/debian/patches/lp2066258/0017-backends-escape-semicolons-in-service-units.patch b/debian/patches/lp2066258/0017-backends-escape-semicolons-in-service-units.patch
deleted file mode 100644
index 008ffad..0000000
--- a/debian/patches/lp2066258/0017-backends-escape-semicolons-in-service-units.patch
+++ /dev/null
@@ -1,386 +0,0 @@
-From: Danilo Egea Gondolfo <[e-mail]>
-Date: Fri, 24 May 2024 14:11:12 +0100
-Subject: backends: escape semicolons in service units
-
-Semicolons separated from other words by a combination of spaces and/or
-tabs will be escaped.
----
- src/networkd.c                   | 10 +++++++
- src/openvswitch.c                |  3 +++
- src/sriov.c                      |  6 +++++
- src/util-internal.h              |  3 +++
- src/util.c                       | 34 +++++++++++++++++++++++
- tests/ctests/test_netplan_misc.c | 45 +++++++++++++++++++++++++++++++
- tests/generator/test_args.py     | 54 +++++++++++++++++++++++++++++++++++++
- tests/generator/test_ovs.py      | 58 ++++++++++++++++++++++++++++++++++++++++
- tests/test_sriov.py              | 40 +++++++++++++++++++++++++++
- 9 files changed, 253 insertions(+)
-
-diff --git a/src/networkd.c b/src/networkd.c
-index 1da684b..1145547 100644
---- a/src/networkd.c
-+++ b/src/networkd.c
-@@ -389,6 +389,9 @@ write_regdom(const NetplanNetDefinition* def, const char* rootdir, GError** erro
-     g_string_append(s, "\n[Service]\nType=oneshot\n");
-     g_string_append_printf(s, "ExecStart="SBINDIR"/iw reg set %s\n", def->regulatory_domain);
- 
-+    g_autofree char* new_s = _netplan_scrub_systemd_unit_contents(s->str);
-+    g_string_free(s, TRUE);
-+    s = g_string_new(new_s);
-     _netplan_g_string_free_to_file_with_permissions(s, rootdir, path, NULL, "root", "root", 0640);
-     _netplan_safe_mkdir_p_dir(link);
-     if (symlink(path, link) < 0 && errno != EEXIST) {
-@@ -1275,6 +1278,10 @@ write_wpa_unit(const NetplanNetDefinition* def, const char* rootdir)
-     } else {
-         g_string_append(s, " -Dnl80211,wext\n");
-     }
-+
-+    g_autofree char* new_s = _netplan_scrub_systemd_unit_contents(s->str);
-+    g_string_free(s, TRUE);
-+    s = g_string_new(new_s);
-     _netplan_g_string_free_to_file_with_permissions(s, rootdir, path, NULL, "root", "root", 0640);
- }
- 
-@@ -1544,6 +1551,9 @@ _netplan_networkd_write_wait_online(const NetplanState* np_state, const char* ro
-     }
-     g_string_append(content, "\n");
- 
-+    g_autofree char* new_content = _netplan_scrub_systemd_unit_contents(content->str);
-+    g_string_free(content, TRUE);
-+    content = g_string_new(new_content);
-     _netplan_g_string_free_to_file_with_permissions(content, rootdir, override, NULL, "root", "root", 0640);
-     g_hash_table_destroy(non_optional_interfaces);
-     return TRUE;
-diff --git a/src/openvswitch.c b/src/openvswitch.c
-index 0a81a59..4723230 100644
---- a/src/openvswitch.c
-+++ b/src/openvswitch.c
-@@ -66,6 +66,9 @@ write_ovs_systemd_unit(const char* id, const GString* cmds, const char* rootdir,
-         g_string_append(s, "StartLimitBurst=0\n");
-     g_string_append(s, cmds->str);
- 
-+    g_autofree char* new_s = _netplan_scrub_systemd_unit_contents(s->str);
-+    g_string_free(s, TRUE);
-+    s = g_string_new(new_s);
-     _netplan_g_string_free_to_file_with_permissions(s, rootdir, path, NULL, "root", "root", 0640);
- 
-     _netplan_safe_mkdir_p_dir(link);
-diff --git a/src/sriov.c b/src/sriov.c
-index 213f124..0435731 100644
---- a/src/sriov.c
-+++ b/src/sriov.c
-@@ -54,6 +54,9 @@ write_sriov_rebind_systemd_unit(GHashTable* pfs, const char* rootdir, GError** e
-     g_string_truncate(interfaces, interfaces->len-1); /* cut trailing whitespace */
-     g_string_append_printf(s, "ExecStart=" SBINDIR "/netplan rebind --debug %s\n", interfaces->str);
- 
-+    g_autofree char* new_s = _netplan_scrub_systemd_unit_contents(s->str);
-+    g_string_free(s, TRUE);
-+    s = g_string_new(new_s);
-     _netplan_g_string_free_to_file_with_permissions(s, rootdir, path, NULL, "root", "root", 0640);
-     g_string_free(interfaces, TRUE);
- 
-@@ -90,6 +93,9 @@ write_sriov_apply_systemd_unit(GHashTable* pfs, const char* rootdir, GError** er
-     g_string_append(s, "\n[Service]\nType=oneshot\n");
-     g_string_append_printf(s, "ExecStart=" SBINDIR "/netplan apply --sriov-only\n");
- 
-+    g_autofree char* new_s = _netplan_scrub_systemd_unit_contents(s->str);
-+    g_string_free(s, TRUE);
-+    s = g_string_new(new_s);
-     _netplan_g_string_free_to_file_with_permissions(s, rootdir, path, NULL, "root", "root", 0640);
- 
-     _netplan_safe_mkdir_p_dir(link);
-diff --git a/src/util-internal.h b/src/util-internal.h
-index 3b33c03..6e602e1 100644
---- a/src/util-internal.h
-+++ b/src/util-internal.h
-@@ -188,3 +188,6 @@ _netplan_netdef_pertype_iter_free(struct netdef_pertype_iter* it);
- 
- gchar*
- _netplan_scrub_string(const char* content);
-+
-+gchar*
-+_netplan_scrub_systemd_unit_contents(const char* content);
-diff --git a/src/util.c b/src/util.c
-index d8477a5..2c52e21 100644
---- a/src/util.c
-+++ b/src/util.c
-@@ -1242,3 +1242,37 @@ _netplan_scrub_string(const char* content)
- 
-     return g_string_free(s, FALSE);
- }
-+
-+STATIC gboolean
-+_is_space_or_tab(char c)
-+{
-+    return c == ' ' || c == '\t';
-+}
-+
-+char*
-+_netplan_scrub_systemd_unit_contents(const char* content)
-+{
-+    size_t content_len = strlen(content);
-+    // Assume a few replacements will happen to reduce reallocation
-+    GString* s = g_string_sized_new(content_len + 8);
-+
-+    // Append the first character of "content" to the result string
-+    g_string_append_len(s, content, 1);
-+
-+    // Walk from the second element to the one before the last looking for isolated semicolons
-+    // A semicolon is isolated if it's surrounded by either tabs or spaces
-+    const char* p = content + 1;
-+    while (p < (content + content_len - 1)) {
-+        if (*p == ';' && _is_space_or_tab(*(p - 1)) && _is_space_or_tab(*(p + 1))) {
-+            g_string_append_len(s, "\\;", 2);
-+        } else {
-+            g_string_append_len(s, p, 1);
-+        }
-+        p++;
-+    }
-+
-+    // Append the last character of "content" to the result string
-+    g_string_append_len(s, p, 1);
-+
-+    return g_string_free(s, FALSE);
-+}
-diff --git a/tests/ctests/test_netplan_misc.c b/tests/ctests/test_netplan_misc.c
-index 9607662..06676da 100644
---- a/tests/ctests/test_netplan_misc.c
-+++ b/tests/ctests/test_netplan_misc.c
-@@ -502,6 +502,50 @@ test_normalize_ip_address(__unused void** state)
-     assert_string_equal(normalize_ip_address("0.0.0.0/0", AF_INET), "0.0.0.0/0");
- }
- 
-+void
-+test_scrub_systemd_unit_content(__unused void** state)
-+{
-+    char* str = ";abc;";
-+    char* res = _netplan_scrub_systemd_unit_contents(str);
-+    assert_string_equal(res, ";abc;");
-+    g_free(res);
-+
-+    str = ";;;;";
-+    res = _netplan_scrub_systemd_unit_contents(str);
-+    assert_string_equal(res, ";;;;");
-+    g_free(res);
-+
-+    str = " ;;;; ";
-+    res = _netplan_scrub_systemd_unit_contents(str);
-+    assert_string_equal(res, " ;;;; ");
-+    g_free(res);
-+
-+    str = "; ; ; ; ;";
-+    res = _netplan_scrub_systemd_unit_contents(str);
-+    assert_string_equal(res, "; \\; \\; \\; ;");
-+    g_free(res);
-+
-+    str = " ; ; ; ; ; ";
-+    res = _netplan_scrub_systemd_unit_contents(str);
-+    assert_string_equal(res, " \\; \\; \\; \\; \\; ");
-+    g_free(res);
-+
-+    str = "a ; ; ; ; ; b";
-+    res = _netplan_scrub_systemd_unit_contents(str);
-+    assert_string_equal(res, "a \\; \\; \\; \\; \\; b");
-+    g_free(res);
-+
-+    str = "\t;\t; ;\t; \t ;\t ";
-+    res = _netplan_scrub_systemd_unit_contents(str);
-+    assert_string_equal(res, "\t\\;\t\\; \\;\t\\; \t \\;\t ");
-+    g_free(res);
-+
-+    str = "\t;\t;\t;\t;\t;\t";
-+    res = _netplan_scrub_systemd_unit_contents(str);
-+    assert_string_equal(res, "\t\\;\t\\;\t\\;\t\\;\t\\;\t");
-+    g_free(res);
-+}
-+
- int
- setup(__unused void** state)
- {
-@@ -539,6 +583,7 @@ main()
-            cmocka_unit_test(test_normalize_ip_address),
-            cmocka_unit_test(test_util_get_link_local_true),
-            cmocka_unit_test(test_util_get_link_local_false),
-+           cmocka_unit_test(test_scrub_systemd_unit_content),
-        };
- 
-        return cmocka_run_group_tests(tests, setup, tear_down);
-diff --git a/tests/generator/test_args.py b/tests/generator/test_args.py
-index c2d0d98..45f51d0 100644
---- a/tests/generator/test_args.py
-+++ b/tests/generator/test_args.py
-@@ -260,3 +260,57 @@ ConditionPathIsSymbolicLink=/run/systemd/generator/network-online.target.wants/s
-         except subprocess.CalledProcessError as e:
-             self.assertEqual(e.returncode, 1)
-             self.assertIn(b'can not be called directly', e.output)
-+
-+    def test_systemd_generator_escaping(self):
-+        conf = os.path.join(self.confdir, 'a.yaml')
-+        os.makedirs(os.path.dirname(conf))
-+        with open(conf, 'w') as f:
-+            f.write('''network:
-+  version: 2
-+  ethernets:
-+    lo:
-+      match:
-+        name: lo
-+      set-name: "a ; b\\t; c\\t; d \\n 123 ; echo "
-+      addresses: ["127.0.0.1/8", "::1/128"]''')
-+        os.chmod(conf, mode=0o600)
-+        outdir = os.path.join(self.workdir.name, 'out')
-+        os.mkdir(outdir)
-+
-+        generator = os.path.join(self.workdir.name, 'systemd', 'system-generators', 'netplan')
-+        os.makedirs(os.path.dirname(generator))
-+        os.symlink(exe_generate, generator)
-+
-+        subprocess.check_call([generator, '--root-dir', self.workdir.name, outdir, outdir, outdir])
-+        n = os.path.join(self.workdir.name, 'run', 'systemd', 'network', '10-netplan-lo.network')
-+        self.assertTrue(os.path.exists(n))
-+        os.unlink(n)
-+
-+        # should auto-enable networkd and -wait-online
-+        service_dir = os.path.join(self.workdir.name, 'run', 'systemd', 'system')
-+        self.assertTrue(os.path.islink(os.path.join(
-+            outdir, 'multi-user.target.wants', 'systemd-networkd.service')))
-+        self.assertTrue(os.path.islink(os.path.join(
-+            outdir, 'network-online.target.wants', 'systemd-networkd-wait-online.service')))
-+        override = os.path.join(service_dir, 'systemd-networkd-wait-online.service.d', '10-netplan.conf')
-+        self.assertTrue(os.path.isfile(override))
-+        with open(override, 'r') as f:
-+            # eth99 does not exist on the system, so will not be listed
-+            self.assertEqual(f.read(), '''[Unit]
-+ConditionPathIsSymbolicLink=/run/systemd/generator/network-online.target.wants/systemd-networkd-wait-online.service
-+
-+[Service]
-+ExecStart=
-+ExecStart=/lib/systemd/systemd-networkd-wait-online -i a \\; b\\t; c\\t; d \\n 123 \\; echo :degraded\n''')
-+
-+        # should be a no-op the second time while the stamp exists
-+        out = subprocess.check_output([generator, '--root-dir', self.workdir.name, outdir, outdir, outdir],
-+                                      stderr=subprocess.STDOUT)
-+        self.assertFalse(os.path.exists(n))
-+        self.assertIn(b'netplan generate already ran', out)
-+
-+        # after removing the stamp it generates again, and not trip over the
-+        # existing enablement symlink
-+        os.unlink(os.path.join(outdir, 'netplan.stamp'))
-+        subprocess.check_output([generator, '--root-dir', self.workdir.name, outdir, outdir, outdir])
-+        self.assertTrue(os.path.exists(n))
-diff --git a/tests/generator/test_ovs.py b/tests/generator/test_ovs.py
-index 7116705..4393cea 100644
---- a/tests/generator/test_ovs.py
-+++ b/tests/generator/test_ovs.py
-@@ -1134,3 +1134,61 @@ ExecStart=/usr/bin/ovs-vsctl --may-exist add-br abc/../../123.100 abc/../../123
- ExecStart=/usr/bin/ovs-vsctl set Interface abc/../../123.100 external-ids:netplan=true
- '''},
-                          'cleanup.service': OVS_CLEANUP % {'iface': 'cleanup'}})
-+
-+    def test_control_characters_and_semicolons_escaping(self):
-+        self.generate('''network:
-+  version: 2
-+  bridges: # bridges first, to trigger multi-pass processing
-+    ovs0:
-+      interfaces: [eth0, eth1]
-+      openvswitch: {}
-+  ethernets:
-+    eth0:
-+      openvswitch:
-+        external-ids:
-+          "a\\n1\\ra": " ; a ; 1 ;a; ;b\\t;\\t3 ;\\ta\\t; 1"
-+        other-config:
-+          "a\\n1\\ra": " ; a ; 1 ;a; ;b\\t;\\t3 ;\\ta\\t; 1"
-+      dhcp6: true
-+    eth1:
-+      dhcp4: true
-+      openvswitch:
-+        other-config:
-+          disable-in-band: false\n''', skip_generated_yaml_validation=True)
-+        self.assert_ovs({'ovs0.service': OVS_VIRTUAL % {'iface': 'ovs0', 'extra': '''
-+[Service]
-+Type=oneshot
-+TimeoutStartSec=10s
-+ExecStart=/usr/bin/ovs-vsctl --may-exist add-br ovs0
-+ExecStart=/usr/bin/ovs-vsctl --may-exist add-port ovs0 eth1
-+ExecStart=/usr/bin/ovs-vsctl --may-exist add-port ovs0 eth0
-+''' + OVS_BR_DEFAULT % {'iface': 'ovs0'}},
-+                         'eth0.service': OVS_PHYSICAL % {'iface': 'eth0', 'extra': '''\
-+Requires=netplan-ovs-ovs0.service
-+After=netplan-ovs-ovs0.service
-+
-+[Service]
-+Type=oneshot
-+TimeoutStartSec=10s
-+ExecStart=/usr/bin/ovs-vsctl set Interface eth0 external-ids:a\\n1\\ra= \\; a \\; 1 ;a; ;b\\t;\\t3 ;\\ta\\t; 1
-+ExecStart=/usr/bin/ovs-vsctl set Interface eth0 external-ids:netplan/external-ids/a\\n1\\ra=,;,a,;,1,;a;,;b\\t;\\t3,;\\ta\\t;,1
-+ExecStart=/usr/bin/ovs-vsctl set Interface eth0 other-config:a\\n1\\ra= \\; a \\; 1 ;a; ;b\\t;\\t3 ;\\ta\\t; 1
-+ExecStart=/usr/bin/ovs-vsctl set Interface eth0 external-ids:netplan/other-config/a\\n1\\ra=,;,a,;,1,;a;,;b\\t;\\t3,;\\ta\\t;,1
-+'''},
-+                         'eth1.service': OVS_PHYSICAL % {'iface': 'eth1', 'extra': '''\
-+Requires=netplan-ovs-ovs0.service
-+After=netplan-ovs-ovs0.service
-+
-+[Service]
-+Type=oneshot
-+TimeoutStartSec=10s
-+ExecStart=/usr/bin/ovs-vsctl set Interface eth1 other-config:disable-in-band=false
-+ExecStart=/usr/bin/ovs-vsctl set Interface eth1 external-ids:netplan/other-config/disable-in-band=false
-+'''},
-+                         'cleanup.service': OVS_CLEANUP % {'iface': 'cleanup'}})
-+        # Confirm that the networkd config is still sane
-+        self.assert_networkd({'ovs0.network': ND_EMPTY % ('ovs0', 'ipv6'),
-+                              'eth0.network': (ND_DHCP6 % 'eth0')
-+                              .replace('LinkLocalAddressing=ipv6', 'LinkLocalAddressing=no\nBridge=ovs0'),
-+                              'eth1.network': (ND_DHCP4 % 'eth1')
-+                              .replace('LinkLocalAddressing=ipv6', 'LinkLocalAddressing=no\nBridge=ovs0')})
-diff --git a/tests/test_sriov.py b/tests/test_sriov.py
-index e842396..a7102fb 100644
---- a/tests/test_sriov.py
-+++ b/tests/test_sriov.py
-@@ -1172,6 +1172,46 @@ Before=network-pre.target
- After=sys-subsystem-net-devices-enblue.device
- After=sys-subsystem-net-devices-engreen.device
- 
-+[Service]
-+Type=oneshot
-+ExecStart=/usr/sbin/netplan apply --sriov-only
-+'''})
-+
-+    def test_escaping_semicolons_from_unit_file(self):
-+        ''' Check if semicolons and line breaks are properly escaped in the generated
-+        systemd service unit.
-+        '''
-+        self.generate('''network:
-+  version: 2
-+  ethernets:
-+    engreen:
-+      embedded-switch-mode: switchdev
-+      delay-virtual-functions-rebind: true
-+    enblue:
-+      match: {driver: dummy_driver}
-+      set-name: ";en ; a\\t;\\tb ;\\tc\\t; d; \\n;\\nabc"
-+      embedded-switch-mode: legacy
-+      delay-virtual-functions-rebind: true
-+      virtual-function-count: 4
-+    sriov_vf0:
-+      link: engreen''', skip_generated_yaml_validation=True)
-+        self.assert_sriov({'rebind.service': '''[Unit]
-+Description=(Re-)bind SR-IOV Virtual Functions to their driver
-+After=network.target
-+After=netplan-sriov-apply.service
-+After=sys-subsystem-net-devices-;en \\; a\\t;\\tb ;\\tc\\t; d; \\n;\\nabc.device
-+After=sys-subsystem-net-devices-engreen.device
-+
-+[Service]
-+Type=oneshot
-+ExecStart=/usr/sbin/netplan rebind --debug ;en \\; a\\t;\\tb ;\\tc\\t; d; \\n;\\nabc engreen
-+''', 'apply.service': '''[Unit]
-+Description=Apply SR-IOV configuration
-+DefaultDependencies=no
-+Before=network-pre.target
-+After=sys-subsystem-net-devices-;en \\; a\\t;\\tb ;\\tc\\t; d; \\n;\\nabc.device
-+After=sys-subsystem-net-devices-engreen.device
-+
- [Service]
- Type=oneshot
- ExecStart=/usr/sbin/netplan apply --sriov-only
diff --git a/debian/patches/series b/debian/patches/series
index c40a500..63aae32 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,17 +1,4 @@
 python-limited-stable-api.patch
-0002-parse-nm-add-a-workaround-for-the-DoT-DNS-option.patch
-lp2060311/0003-util-fix-potential-NULL-pointer-assert.patch
-lp2060311/0004-networkd-add-wait-online-enumeration-utils.patch
-lp2060311/0005-generate-enable-systemd-networkd-wait-online-for-non.patch
-lp2060311/0006-CLI-utils-Do-not-ask-for-daemon-reload-password-inte.patch
-lp2060311/0007-CLI-generate-call-daemon-reload-after-re-generating-.patch
-lp2060311/0008-wait-online-Do-not-block-on-loopback-interface.patch
-lp2060311/0009-generate-Do-not-touch-wait-online-if-we-don-t-have-a.patch
-lp2060311/0010-wait-online-wait-for-existing-interfaces-only-and-do.patch
-lp2060311/0011-wait-online-account-for-DHCPv4-v6-addresses.patch
-lp2060311/0012-wait-online-do-not-require-virtual-devices-to-be-cre.patch
-lp2060311/0013-wait-online-recognize-that-bridge-bond-members-will-.patch
-lp2065738/0014-libnetplan-use-more-restrictive-file-permissions.patch
-lp2066258/0015-libnetplan-escape-control-characters.patch
-lp2066258/0016-backends-escape-file-paths.patch
-lp2066258/0017-backends-escape-semicolons-in-service-units.patch
+0002-CLI-apply-call-udevadm-trigger-using-action-add-Clos.patch
+0003-Revert-wait-online-disabled-wait-online-for-stable-1.patch
+0004-generate-avoid-calling-udevadm-control-reload-LP-199.patch
diff --git a/debian/tests/control b/debian/tests/control
index d7af917..7852549 100644
--- a/debian/tests/control
+++ b/debian/tests/control
@@ -195,7 +195,7 @@ Depends: @,
   libnm0,
   python3-gi,
   gir1.2-nm-1.0,
-Restrictions: allow-stderr, needs-root, isolation-container, flaky
+Restrictions: allow-stderr, needs-root, isolation-container
 Features: test-name=diff
 
 Test-Command: ./debian/tests/prep-testbed.sh && ./debian/tests/autostart.sh
diff --git a/doc/.sphinx/requirements.txt b/doc/.sphinx/requirements.txt
index bc73a32..e9c2a91 100644
--- a/doc/.sphinx/requirements.txt
+++ b/doc/.sphinx/requirements.txt
@@ -14,3 +14,4 @@ sphinx-reredirects
 sphinx-tabs
 sphinxcontrib-jquery
 sphinxext-opengraph
+watchfiles
diff --git a/doc/conf.py b/doc/conf.py
index 0e638c0..3f60865 100644
--- a/doc/conf.py
+++ b/doc/conf.py
@@ -159,7 +159,6 @@ custom_excludes = [
     'doc-cheat-sheet*',
     'manpage-footer.md',
     'manpage-header.md',
-    'CODE_OF_CONDUCT.md',
 ]
 
 # Add CSS files (located in .sphinx/_static/)
diff --git a/doc/creating-link-aggregation.md b/doc/creating-link-aggregation.md
new file mode 100644
index 0000000..2543d00
--- /dev/null
+++ b/doc/creating-link-aggregation.md
@@ -0,0 +1,86 @@
+# How to create link aggregation
+
+:::{note}
+These instructions assume a system setup based on the example configuration outlined in the [Netplan tutorial](/netplan-tutorial).
+:::
+
+Let's suppose now that you need to configure your system to connect to your
+ISP links via a link aggregation. On Linux you can do that with a `bond`
+virtual interface.
+
+On Netplan, an interface of type `bond` can be created inside a `bonds` mapping.
+
+Now that the traffic will flow through the link aggregation, you will move
+all the addressing configuration to the bond itself.
+
+You can define a list of interfaces that will be attached to the bond. In our
+simple scenario, we have a single one.
+
+Edit the file `/etc/netplan/second-interface.yaml` and make the following changes:
+
+```yaml
+network:
+  version: 2
+  ethernets:
+    netplan-isp-interface:
+      dhcp4: false
+      dhcp6: false
+      match:
+        macaddress: 00:16:3e:0c:97:8a
+      set-name: netplan-isp
+  bonds:
+    isp-bond0:
+      interfaces:
+        - netplan-isp-interface
+      dhcp4: false
+      dhcp6: false
+      accept-ra: false
+      link-local: []
+      addresses:
+        - 172.16.0.1/24
+      routes:
+        - to: default
+          via: 172.16.0.254
+      nameservers:
+        search:
+          - netplanlab.local
+        addresses:
+          - 172.16.0.254
+          - 172.16.0.253
+```
+
+Note that you can reference the interface used in the bond by the name you
+defined for it in the `ethernets` section.
+
+Now use `netplan apply` to apply your changes
+
+```
+netplan apply
+```
+
+Now your system has a new interface called `isp-bond0`. Use the command
+`ip address show isp-bond0` or `netplan status` to check its state:
+
+```
+netplan status isp-bond0
+```
+
+You should see an output similar to the one below:
+
+```
+     Online state: online
+    DNS Addresses: 127.0.0.53 (stub)
+       DNS Search: lxd
+                   netplanlab.local
+
+●  4: isp-bond0 bond UP (networkd: isp-bond0)
+      MAC Address: b2:6b:19:b1:9a:86
+        Addresses: 172.16.0.1/24
+    DNS Addresses: 172.16.0.254
+                   172.16.0.253
+       DNS Search: netplanlab.local
+           Routes: default via 172.16.0.254 (static)
+                   172.16.0.0/24 from 172.16.0.1 (link)
+
+3 inactive interfaces hidden. Use "--all" to show all.
+```
diff --git a/doc/howto.md b/doc/howto.md
index 8385090..326ec11 100644
--- a/doc/howto.md
+++ b/doc/howto.md
@@ -1,28 +1,40 @@
 # How-to guides
 
-Below is a collection of how-to guides for common scenarios.
-If you see a scenario missing or have one to contribute, please,
-[file a bug](https://bugs.launchpad.net/netplan/+filebug) against this
-documentation with the example.
+This is a collection of how-to guides for common scenarios. If you see a scenario missing or have one to contribute, [file an issue](https://bugs.launchpad.net/netplan/+filebug) against this documentation with the example.
 
-To configure Netplan, save configuration files in the `/etc/netplan/` directory
-with a `.yaml` extension (e.g. `/etc/netplan/config.yaml`), then run
-`sudo netplan apply`. This command parses and applies the configuration to the
-system. Configuration written to disk under `/etc/netplan/` persists between
-reboots.
+To configure Netplan, save configuration files in the `/etc/netplan/` directory with a `.yaml` extension (e.g. `/etc/netplan/config.yaml`), then run `sudo netplan apply`. This command parses and applies the configuration to the system. Configuration written to disk under `/etc/netplan/` persists between reboots. Visit [Applying new Netplan configuration](/netplan-tutorial.md#applying-new-netplan-configuration) for detailed guidance.
 
-For each of the example below, use the `renderer` that applies to your scenario.
-For example, for Ubuntu Desktop the `renderer` is usually `NetworkManager`,
-and `networkd` for Ubuntu Server.
+For each of the examples below, use the `renderer` that applies to your scenario. For example, for Ubuntu Desktop, the `renderer` is usually `NetworkManager`. For Ubuntu Server, it is `networkd`.
 
-Also, see [/examples](https://github.com/canonical/netplan/tree/main/examples)
-on GitHub.
+
+## Quick configuration examples
 
 ```{toctree}
 :maxdepth: 1
 
 examples
+```
+
+YAML configuration snippets for these examples, as well as additional examples, are available in the [examples](https://github.com/canonical/netplan/tree/main/examples) directory on GitHub.
+
+
+## Complex how-to guides
+
+```{toctree}
+:maxdepth: 1
+
+using-static-ip-addresses
+matching-interface-by-mac-address
+creating-link-aggregation
 dbus-config
 netplan-everywhere
+```
+
+
+## Documentation
+
+```{toctree}
+:maxdepth: 1
+
 contribute-docs
 ```
diff --git a/doc/matching-interface-by-mac-address.md b/doc/matching-interface-by-mac-address.md
new file mode 100644
index 0000000..916cef3
--- /dev/null
+++ b/doc/matching-interface-by-mac-address.md
@@ -0,0 +1,85 @@
+# How to match the interface by MAC address
+
+:::{note}
+These instructions assume a system setup based on the example configuration outlined in the [Netplan tutorial](/netplan-tutorial).
+:::
+
+Sometimes you can't rely on the interface names to apply configuration to them. Changes in the system might cause a change in their names, such as when you move an interface card from a PCI slot to another.
+
+In this exercise you will use the `match` keyword to locate the device based on its MAC address and also set a more meaningful name to the interface.
+
+Let's assume that your second interface is connected to the Netplan ISP internet provider company and you want to identify it as such.
+
+First identify its MAC address:
+
+```
+ip link show enp6s0
+```
+
+In the output, the MAC address is the number in front of the `link/ether` property.
+```
+3: enp6s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000
+    link/ether 00:16:3e:0c:97:8a brd ff:ff:ff:ff:ff:ff
+```
+
+Edit the file `/etc/netplan/second-interface.yaml` and make the following changes:
+
+```yaml
+network:
+  version: 2
+  ethernets:
+    netplan-isp-interface:
+      match:
+        macaddress: 00:16:3e:0c:97:8a
+      set-name: netplan-isp
+      dhcp4: false
+      dhcp6: false
+      accept-ra: false
+      link-local: []
+      addresses:
+        - 172.16.0.1/24
+      routes:
+        - to: default
+          via: 172.16.0.254
+      nameservers:
+        search:
+          - netplanlab.local
+        addresses:
+          - 172.16.0.254
+          - 172.16.0.253
+```
+
+These are the important changes in this exercise:
+
+```yaml
+  ethernets:
+    netplan-isp-interface:
+      match:
+        macaddress: 00:16:3e:0c:97:8a
+      set-name: netplan-isp
+```
+
+Note that, as you are now matching the interface by its MAC address, you are free to identify it with a different name. It makes it easier to read and find information in the YAML file.
+
+After changing the file, apply your new configuration:
+
+```
+netplan apply
+```
+
+Now list your interfaces:
+
+```
+ip link show
+```
+
+As you can see, your interface is now called `netplan-isp`.
+
+```
+1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
+    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
+2: enp5s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000
+    link/ether 00:16:3e:13:ae:10 brd ff:ff:ff:ff:ff:ff
+3: netplan-isp: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000
+    link/ether 00:16:3e:0c:97:8a brd ff:ff:ff:ff:ff:ff
+```
diff --git a/doc/netplan-generate.md b/doc/netplan-generate.md
index 3c0d415..c2675d0 100644
--- a/doc/netplan-generate.md
+++ b/doc/netplan-generate.md
@@ -58,8 +58,8 @@ There are 3 locations that **`netplan generate`** considers:
  * `/run/netplan/*.yaml`
 
 If there are multiple files with exactly the same name, then only one
-will be read. A file in `/run/netplan` will shadow - completely replace
-- a file with the same name in `/etc/netplan`. A file in `/etc/netplan`
+will be read. A file in `/run/netplan` will shadow (completely replace)
+a file with the same name in `/etc/netplan`. A file in `/etc/netplan`
 will itself shadow a file in `/lib/netplan`.
 
 Or, in other words, `/run/netplan` is top priority, then `/etc/netplan`,
diff --git a/doc/netplan-status.md b/doc/netplan-status.md
index c4ad453..374ce23 100644
--- a/doc/netplan-status.md
+++ b/doc/netplan-status.md
@@ -35,10 +35,10 @@ Currently, **`netplan status`** depends on `systemd-networkd` as a source of dat
 :   Show all interface data including inactive.
 
 `--diff`
-:   Analyze and display differences between the current system configuration and network definitions present in the YAML files.
-    The configuration analyzed includes IP addresses, routes, MAC addresses, DNS addresses, search domains and missing network interfaces.
+:   Analyse and display differences between the current system configuration and network definitions present in the YAML files.
+    The configuration analysed includes IP addresses, routes, MAC addresses, DNS addresses, search domains and missing network interfaces.
 
-    The output format is similar to popular diff tools, such `diff` and `git diff`. Configuration present only in the system (and therefore missing in the Netplan YAMLs)
+    The output format is similar to popular diff tools, such `diff` and `git diff`. Configuration present only in the system (and therefore missing in the Netplan YAML)
     will be displayed with a `+` sign and will be highlighted in green. Configuration present only in Netplan (and therefore missing in the system) will be displayed
     with a `-` sign and highlighted in red. The same is applied to network interfaces.
 
diff --git a/doc/netplan-tutorial.md b/doc/netplan-tutorial.md
index ef4ebbc..344096f 100644
--- a/doc/netplan-tutorial.md
+++ b/doc/netplan-tutorial.md
@@ -1,108 +1,119 @@
-# Pre-requisites
+# Netplan tutorial
 
-In order to do the exercises yourself you will need a virtual machine, preferably running Ubuntu. In this tutorial, we will use LXD to create virtual networks and launch virtual machines. Feel free to use a cloud instance or a different hypervisor. As long as you can achieve the same results, you should be fine. If you're going to use your own desktop/laptop system, some of the exercises might interrupt your network connectivity.
+Use this tutorial to learn about basic use of the Netplan utility: how to set up an environment to try it, run it for the first time, check its configuration, and modify its settings.
 
-If you already have a setup where you can do the exercises you can just skip this section.
 
-## Setting up the environment
+# Trying Netplan in a virtual machine
 
-You can follow the steps below to install and create a basic LXD configuration you can use to launch virtual machines.
+To try Netplan, you can use a virtual environment, preferably running Ubuntu. This tutorial uses LXD to create virtual networks and launch virtual machines. You can also use a cloud instance or a different hypervisor.
 
-For more information about LXD, please visit [linuxcontainers.org](https://documentation.ubuntu.com/lxd/).
+:::{warning}
+When using your own system without virtualisation, some of the exercises might interrupt your network connectivity.
+:::
 
-First, install LXD: [LXD | How to install LXD](https://documentation.ubuntu.com/lxd/en/latest/installing/)
 
-On Ubuntu, you can install it using `snap`:
+## Setting up the virtual environment
 
-```
-snap install lxd
-```
+Follow the steps below to install and create a basic LXD configuration to launch virtual machines (VM). For more information about LXD, visit [documentation.ubuntu.com/lxd](https://documentation.ubuntu.com/lxd/).
 
-Now, initialise your LXD configuration:
+1. Install LXD: [LXD | How to install LXD](https://documentation.ubuntu.com/lxd/en/latest/installing/).
 
-```
-lxd init --minimal
-```
+   On Ubuntu, use `snap` to install LXD:
 
-Run the command below to create a new network in LXD. For some of the exercises you will need a second network interface in your virtual machine.
+   ```
+   snap install lxd
+   ```
 
-```
-lxc network create netplanbr0 --type=bridge
-```
+2. Initialise LXD configuration:
 
-You should see the output below:
+   ```
+   lxd init --minimal
+   ```
 
-```
-Network netplanbr0 created
-```
+3. Create a new network in LXD (some of the exercises require a second network interface in the virtual machine):
 
-At this point you should have a usable LXD installation with a working network bridge.
+   ```
+   lxc network create netplanbr0 --type=bridge
+   ```
 
-Now create a virtual machine called `netplan-lab0`:
+   The following output confirms the successful creation of the bridge network:
 
-```
-lxc init --vm ubuntu:22.04 netplan-lab0
-```
+   ```
+   Network netplanbr0 created
+   ```
 
-You should see the output below:
+   Now you have a usable LXD installation with a working network bridge.
 
-```
-Creating netplan-lab0
-```
+4. Create a virtual machine called `netplan-lab0`:
 
-The new VM will have one network interface attached to the default LXD bridge.
+   ```none
+   lxc init --vm ubuntu:23.10 netplan-lab0
+   ```
 
-Now attach the network you created just now, `netplanbr0`, to your VM, `netplan-lab0`, as interface `eth1`:
+   You should see the output below:
 
-```
-lxc network attach netplanbr0 netplan-lab0 eth1
-```
+   ```
+   Creating netplan-lab0
+   ```
 
->  See more: [LXD | Attach a network to an instance](https://documentation.ubuntu.com/lxd/en/latest/howto/network_create/#attach-a-network-to-an-instance)
+   The new VM has one network interface attached to the default LXD bridge.
 
-And start your new VM:
+5. Attach the network you created (`netplanbr0`) to the VM (`netplan-lab0`) as the `eth1` interface:
 
-```
-lxc start netplan-lab0
-```
+   ```
+   lxc network attach netplanbr0 netplan-lab0 eth1
+   ```
 
-Access your new VM using `lxc shell`:
+   :::{tip}
+   For more on LXD networking, visit [LXD | Attach a network to an instance](https://documentation.ubuntu.com/lxd/en/latest/howto/network_create/#attach-a-network-to-an-instance).
+   :::
 
-```
-lxc shell netplan-lab0
-```
+6. Start the new VM:
 
->  **If this doesn't work for you**: Try instead `lxc exec netplan-lab0 bash` or `lxc console netplan-lab0`.
+   ```
+   lxc start netplan-lab0
+   ```
 
-You should now have a root shell inside your VM:
+7. Access the new VM using `lxc shell`:
 
-```
-root@netplan-lab0:~#
-```
+   ```
+   lxc shell netplan-lab0
+   ```
 
-Run the command `ip link` to show your network interfaces:
+   In case of problems, try running `lxc exec netplan-lab0 bash` or `lxc console netplan-lab0`.
 
-```
-ip link
-```
+   You should now have a root shell inside the VM:
 
-You should see an output similar to the below:
+   ```none
+   root@netplan-lab0:~#
+   ```
 
-```
-1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
-    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
-2: enp5s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000
-    link/ether 00:16:3e:13:ae:10 brd ff:ff:ff:ff:ff:ff
-3: enp6s0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
-    link/ether 00:16:3e:0c:97:8a brd ff:ff:ff:ff:ff:ff
-```
+8. Run the `ip link` command to show the network interfaces:
+
+   ```
+   ip link
+   ```
+
+   You should see an output similar to the below:
+
+   ```none
+   1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
+       link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
+   2: enp5s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000
+       link/ether 00:16:3e:13:ae:10 brd ff:ff:ff:ff:ff:ff
+   3: enp6s0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
+       link/ether 00:16:3e:0c:97:8a brd ff:ff:ff:ff:ff:ff
+   ```
 
-In this case, `enp5s0` is the primary interface connected to the default LXD network and `enp6s0` is the second interface you added connected to your custom network.
+   In this case:
 
+   * `enp5s0` is the primary interface connected to the default LXD network.
+   * `enp6s0` is the second interface you added connected to your custom network.
 
-Now, let's start with a simple exercise.
+You're ready to start the first exercise.
 
-# Running netplan for the first time
+
+# Running Netplan for the first time
 
 Start by typing the command `netplan` in your shell:
 
@@ -110,9 +121,9 @@ Start by typing the command `netplan` in your shell:
 netplan
 ```
 
-You should see the output below
+You should see the following output:
 
-```
+```none
 You need to specify a command
 usage: /usr/sbin/netplan  [-h] [--debug]  ...
 
@@ -136,11 +147,12 @@ Available commands:
     try       Try to apply a new Netplan config to running system, with automatic rollback
 ```
 
-As you can see, Netplan has a number of sub commands. Let's explore some of them.
+As you can see, Netplan has a number of sub-commands. Let's explore some of them.
+
 
-# Showing your current Netplan configuration
+# Showing current Netplan configuration
 
-To show your current configuration, run the command `netplan get`.
+To show the current configuration, run the `netplan get` command:
 
 ```
 netplan get
@@ -148,7 +160,6 @@ netplan get
 
 You should see an output similar to the one below:
 
-
 ```yaml
 network:
   version: 2
@@ -157,16 +168,17 @@ network:
       dhcp4: true
 ```
 
-It shows you have an Ethernet interface called `enp5s0` and it has DHCP enabled for IPv4.
+This means:
 
+* There's an Ethernet interface called `enp5s0`.
+* DHCP is enabled for the IPv4 protocol on `enp5s0`.
 
-# Showing your current network configuration
 
-Netplan 0.106 introduced the `netplan status` command. You can use it to
-show your system's current network configuration. Try that by typing
-`netplan status --all` in your console:
+# Showing current network configuration
 
-```
+Netplan 0.106 introduced the `netplan status` command. The command displays the current network configuration of the system. Try it by running:
+
+```none
 netplan status --all
 ```
 
@@ -202,11 +214,18 @@ You should see an output similar to the one below:
       MAC Address: 00:16:3e:0c:97:8a (Red Hat, Inc.)
 ```
 
-# Checking the file where your configuration is stored
 
-The configuration you just listed is stored at `/etc/netplan`. You can see the contents of the file with the command below:
+# Checking Netplan configuration files
+
+Netplan configuration is stored in YAML-formatted files in the `/etc/netplan` directory. To display the contents of the directory, run:
 
+```none
+ls -1 /etc/netplan/
 ```
+
+Provided your system was initialised using `cloud-init`, such as the Ubuntu virtual machine recommended for testing Netplan in [Trying Netplan in a virtual machine](#trying-netplan-in-a-virtual-machine), you can find the initial Netplan configuration in the `50-cloud-init.yaml` file:
+
+```none
 cat /etc/netplan/50-cloud-init.yaml
 ```
 
@@ -225,518 +244,205 @@ network:
             dhcp4: true
 ```
 
-This file was automatically generated by `cloud-init` when the system was initialised. As noted in the comments, changes to this file will not persist.
+This configuration file is automatically generated by the `cloud-init` tool when the system is initialised. As noted in the file comments, direct changes to this file do not persist.
 
-# Enabling your second network interface with DHCP
 
-There are basically 2 ways to create or change Netplan configuration:
+# Creating and modifying Netplan configuration
 
-1) Using the `netplan set` command
-2) Editing the YAML files manually
+There are two methods to create or modify Netplan configuration:
 
-Let's see how you can enable your second network interface using both ways.
+Using the `netplan set` command
+: Example: [Using netplan set to enable a network interface with DHCP](#using-netplan-set-to-enable-a-network-interface-with-dhcp)
 
-## Using `netplan set`
+Editing the YAML configuration files manually
+: Example: [Editing Netplan YAML files to disable IPv6](#editing-netplan-yaml-files-to-disable-ipv6)
 
-For simple tasks, you can use `netplan set` to change your configuration.
 
-In the example below you are going to create a new YAML file called `second-interface.yaml` containing only the configuration needed to enable our second interfaces.
+## Using `netplan set` to enable a network interface with DHCP
 
-Considering your second network interface is `enp6s0`, run the command below:
+For simple configuration changes, use the `netplan set` command. In the example below, you are going to create a new YAML file called `second-interface.yaml` containing only the configuration needed to enable the second network interface.
 
-```
-netplan set --origin-hint second-interface ethernets.enp6s0.dhcp4=true
-```
+1. To create a second network interface called `enp6s0`, run:
 
-The command line parameter `--origin-hint` sets the name of the file where the configuration will be stored.
+   ```
+   netplan set --origin-hint second-interface ethernets.enp6s0.dhcp4=true
+   ```
 
-Now list the files in the directory `/etc/netplan`:
+   The `--origin-hint` command-line parameter sets the name of the file in which the configuration is stored.
 
-```
-ls /etc/netplan
-```
+2. List the files in the directory `/etc/netplan`:
 
-You should see the auto generated `cloud-init` file and a new file called `second-interface.yaml`:
+   ```none
+   ls -1 /etc/netplan
+   ```
 
-```
-root@netplan-lab0:~# ls /etc/netplan/
-50-cloud-init.yaml  second-interface.yaml
-```
-
-Use the command `cat` to see its content:
-
-```
-cat /etc/netplan/second-interface.yaml
-```
-
-```yaml
-network:
-  version: 2
-  ethernets:
-    enp6s0:
-      dhcp4: true
-```
-
-You will notice it is very similar to the one generated by `cloud-init`.
-
-Now use `netplan get` to see your full configuration:
-
-```
-netplan get
-```
+   You should see the auto-generated `cloud-init` file and a new file called `second-interface.yaml`:
 
-You should see an output similar to the one below with both Ethernet interfaces:
+   ```none
+   50-cloud-init.yaml
+   second-interface.yaml
+   ```
 
-```yaml
-network:
-  version: 2
-  ethernets:
-    enp5s0:
-      dhcp4: true
-    enp6s0:
-      dhcp4: true
-```
+3. Use the command `cat` to see the file content:
 
-## Applying your new configuration
+   ```
+   cat /etc/netplan/second-interface.yaml
+   ```
 
-The command `netplan set` created the configuration for your second network interface but it wasn't applied to the running system.
+   ```yaml
+   network:
+     version: 2
+     ethernets:
+       enp6s0:
+         dhcp4: true
+   ```
 
-Run the command below to see the current state of your second network interface:
+   Notice it is similar to the configuration file generated by `cloud-init` ([Checking Netplan configuration files](#checking-netplan-configuration-files)).
 
-```
-ip address show enp6s0
-```
+4. Check the full configuration using `netplan get`:
 
-You should see an output similar to the one below:
+   ```
+   netplan get
+   ```
 
-```
-3: enp6s0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
-    link/ether 00:16:3e:0c:97:8a brd ff:ff:ff:ff:ff:ff
-```
+   You should see an output similar to the one below with both Ethernet interfaces:
 
-As you can see, this interface has no IP address and its state is DOWN.
+   ```yaml
+   network:
+     version: 2
+     ethernets:
+       enp5s0:
+         dhcp4: true
+       enp6s0:
+         dhcp4: true
+   ```
 
-In order to apply the Netplan configuration, you can use the command `netplan apply`.
+The interface configuration has been created. To apply the changes to the system, follow the instructions in [Applying new Netplan configuration](#applying-new-netplan-configuration).
 
-Run the command below in your shell:
 
-```
-netplan apply
-```
+## Editing Netplan YAML files to disable IPv6
 
-Now check again the state of the interface `enp6s0`:
+For more complex settings, you can edit existing or create new configuration files manually.
 
-```
-ip address show enp6s0
-```
+For example, to disable automatic IPv6 configuration on the second network interface created in [Using netplan set to enable a network interface with DHCP](#using-netplan-set-to-enable-a-network-interface-with-dhcp), edit the `/etc/netplan/second-interface.yaml` file:
 
-You should see an output similar to this:
+1. Add the following lines to the configuration section of the interface:
 
-```
-3: enp6s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
-    link/ether 00:16:3e:0c:97:8a brd ff:ff:ff:ff:ff:ff
-    inet 10.33.59.157/24 metric 100 brd 10.33.59.255 scope global dynamic enp6s0
-       valid_lft 3589sec preferred_lft 3589sec
-    inet6 fd42:ee65:61d0:abcb:216:3eff:fe0c:978a/64 scope global dynamic mngtmpaddr noprefixroute
-       valid_lft 3599sec preferred_lft 3599sec
-    inet6 fe80::216:3eff:fe0c:978a/64 scope link
-       valid_lft forever preferred_lft forever
-```
+   ```yaml
+   accept-ra: false
+   link-local: []
+   ```
 
-You can also use `netplan status` to check the interface:
+   When you finish, the whole configuration in `second-interface.yaml` should look like this:
 
-```
-netplan status enp6s0
-```
+   ```yaml
+   network:
+     version: 2
+     ethernets:
+       enp6s0:
+         dhcp4: true
+         accept-ra: false
+         link-local: []
+   ```
 
-You should see an output similar to this:
+   With this new configuration, the network configuration back end (`systemd-networkd` in this case) does not accept Route Advertisements and does not add the `link-local` address to the interface.
 
-```
-     Online state: online
-    DNS Addresses: 127.0.0.53 (stub)
-       DNS Search: lxd
+2. Check the new configuration using the `netplan get` command:
 
-●  3: enp6s0 ethernet UP (networkd: enp6s0)
-      MAC Address: 00:16:3e:0c:97:8a (Red Hat, Inc.)
-        Addresses: 10.33.59.157/24 (dhcp)
-                   fd42:ee65:61d0:abcb:216:3eff:fe0c:978a/64
-                   fe80::216:3eff:fe0c:978a/64 (link)
-    DNS Addresses: 10.33.59.1
-                   fe80::216:3eff:fea1:585b
-       DNS Search: lxd
-           Routes: default via 10.33.59.1 from 10.33.59.157 metric 100 (dhcp)
-                   10.33.59.0/24 from 10.33.59.157 metric 100 (link)
-                   10.33.59.1 from 10.33.59.157 metric 100 (dhcp, link)
-                   fd42:ee65:61d0:abcb::/64 metric 100 (ra)
-                   fe80::/64 metric 256
+   ```
+   netplan get
+   ```
 
-2 inactive interfaces hidden. Use "--all" to show all.
-```
+   You should see something similar to this:
 
-As you can see, even though you haven't enabled DHCP for IPv6 on this interface, the network configuration back end (in this case systemd-networkd) enabled it anyway. But let's assume you want only IPv4.
+   ```yaml
+   network:
+     version: 2
+     ethernets:
+       enp5s0:
+         dhcp4: true
+       enp6s0:
+         dhcp4: true
+         accept-ra: false
+         link-local: []
+   ```
 
-Let's address this situation in the next exercise.
+IPv6 has been disabled for the interface in the configuration. To apply the changes to the system, follow the instructions in [Applying new Netplan configuration](#applying-new-netplan-configuration).
 
-## Editing YAML files
 
-For more complex configuration, you can just create or edit a new file yourself using your favourite text editor.
+# Applying new Netplan configuration
 
-Continuing the exercise from the previous section, let's go ahead and disable automatic IPv6 configuration on your second interface. But this time let's do it by manually editing the YAML file.
+New or modified Netplan settings need to be applied before they take effect on a running system.
 
-Use your favourite text editor and open the file `/etc/netplan/second-interface.yaml`.
+:::{note}
+Using the `netplan set` command to modify configuration or editing (creating) the Netplan YAML configuration files directly does not automatically apply the new settings to the running system.
+:::
 
-Add the configuration below to the interface configuration section:
+After creating a new configuration as described in [Using netplan set to enable a network interface with DHCP](#using-netplan-set-to-enable-a-network-interface-with-dhcp), follow these steps to apply the settings and confirm they have taken effect.
 
-```yaml
-accept-ra: false
-link-local: []
-```
+1. Display the current state of the network interface:
 
-When you finish, it should look like this:
+   ```
+   ip address show enp6s0
+   ```
 
-```yaml
-network:
-  version: 2
-  ethernets:
-    enp6s0:
-      dhcp4: true
-      accept-ra: false
-      link-local: []
-```
+   Where `enp6s0` is the interface you wish to display status for. You should see an output similar to the one below:
 
-With this new configuration, the network configuration back end (systemd-networkd in this case) will not accept Route Advertisements and will not add the link-local address to our interface.
+   ```none
+   3: enp6s0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
+       link/ether 00:16:3e:0c:97:8a brd ff:ff:ff:ff:ff:ff
+   ```
 
-Now check your new configuration with the `netplan get` command:
+   This interface has no IP address and its state is `DOWN`.
 
-```
-netplan get
-```
+2. Apply the new Netplan configuration:
 
-You should see something similar to this:
+   ```
+   netplan apply
+   ```
 
-```yaml
-network:
-  version: 2
-  ethernets:
-    enp5s0:
-      dhcp4: true
-    enp6s0:
-      dhcp4: true
-      accept-ra: false
-      link-local: []
-```
+3. Check the state of the `enp6s0` interface again using one of the following two methods:
 
-Now use `netplan apply` to apply your new configuration:
+   * Using the `ip` tool:
 
-```
-netplan apply
-```
+     ```
+     ip address show enp6s0
+     ```
 
-And check your interface configuration:
+     You should see an output similar to this:
 
-```
-ip address show enp6s0
-```
+     ```none
+     3: enp6s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
+         link/ether 00:16:3e:0c:97:8a brd ff:ff:ff:ff:ff:ff
+         inet 10.33.59.157/24 metric 100 brd 10.33.59.255 scope global dynamic enp6s0
+            valid_lft 3589sec preferred_lft 3589sec
+     ```
 
-You should see an output similar to this:
+   * Using the `netplan status` command:
 
-```
-3: enp6s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
-    link/ether 00:16:3e:0c:97:8a brd ff:ff:ff:ff:ff:ff
-    inet 10.33.59.157/24 metric 100 brd 10.33.59.255 scope global dynamic enp6s0
-       valid_lft 3585sec preferred_lft 3585sec
-```
+     ```
+     netplan status enp6s0
+     ```
 
-And as you can see, now it only has an IPv4 address.
+     You should see an output similar to this:
 
-In this exercise you explored the `netplan set`, `netplan get`, `netplan apply` and `netplan status` commands. You also used some of the Ethernet configuration options to get a network interface up and running with DHCP.
+     ```
+          Online state: online
+         DNS Addresses: 127.0.0.53 (stub)
+            DNS Search: lxd
 
-# Using static IP addresses
+     ●  3: enp6s0 ethernet UP (networkd: enp6s0)
+           MAC Address: 00:16:3e:0c:97:8a (Red Hat, Inc.)
+             Addresses: 10.33.59.157/24 (dhcp)
+         DNS Addresses: 10.33.59.1
+            DNS Search: lxd
+                Routes: default via 10.33.59.1 from 10.33.59.157 metric 100 (dhcp)
+                        10.33.59.0/24 from 10.33.59.157 metric 100 (link)
+                        10.33.59.1 from 10.33.59.157 metric 100 (dhcp, link)
 
-In this exercise you're going to add an static IP address to the second interface with a default route and DNS configuration.
+     2 inactive interfaces hidden. Use "--all" to show all.
+     ```
 
-Edit the file `/etc/netplan/second-interface.yaml` created previously. Change it so it will look like this:
+---
 
-```yaml
-network:
-  version: 2
-  ethernets:
-    enp6s0:
-      dhcp4: false
-      dhcp6: false
-      accept-ra: false
-      link-local: []
-      addresses:
-        - 172.16.0.1/24
-      routes:
-        - to: default
-          via: 172.16.0.254
-      nameservers:
-        search:
-          - netplanlab.local
-        addresses:
-          - 172.16.0.254
-          - 172.16.0.253
-```
-
-The configuration above is what you'd expect in a desktop system for example. It defines the interface's IP address statically as `172.16.0.1/24`, a default route via gateway `172.16.0.254` and the DNS search domain and name servers.
-
-Now use `netplan get` to visualise all your network configuration:
-
-```
-netplan get
-```
-
-You should see an output similar to this:
-
-```yaml
-network:
-  version: 2
-  ethernets:
-    enp5s0:
-      dhcp4: true
-    enp6s0:
-      addresses:
-      - "172.16.0.1/24"
-      nameservers:
-        addresses:
-        - 172.16.0.254
-        - 172.16.0.253
-        search:
-        - netplanlab.local
-      dhcp4: false
-      dhcp6: false
-      accept-ra: false
-      routes:
-      - to: "default"
-        via: "172.16.0.254"
-      link-local: []
-```
-
-You will notice that it might be a little different than what you have defined in the YAML file. Some things might be in a different order for example.
-
-The reason for that is that `netplan get` loads and parses your configuration before outputting it, and the YAML parsing engine used by Netplan might shuffle things around. Although, what you see from `netplan get` is equivalent to what you have in the file.
-
-Now use `netplan apply` to apply the new configuration:
-
-```
-netplan apply