Merge ~slyon/netplan/+git/ubuntu:slyon/0100-release into ~ubuntu-core-dev/netplan/+git/ubuntu:ubuntu/master

[Lukas Märdian]

Related to:

FFe: https://bugs.launchpad.net/ubuntu/+source/netplan.io/+bug/1894197
Merge: https://code.launchpad.net/~slyon/netplan/+git/ubuntu/+merge/390283
Builds: https://launchpad.net/~slyon/+archive/ubuntu/netplan/+packages

[Łukasz Zemczak (sil2100)]

Yes, glimpsing through the changes everything looks correct! I also think it has been done in a similar way to how we did it in the past, so +1 on proceeding.

I'll merge and sponsor it when we get an official +1 on the FFe.

review: Approve

diff --git a/Makefile b/Makefile
index 3ce1347..4b80a18 100644
--- a/Makefile
+++ b/Makefile
@@ -43,7 +43,7 @@ libnetplan.so.$(NETPLAN_SOVER): parse.o util.o validation.o error.o
 	ln -snf libnetplan.so.$(NETPLAN_SOVER) libnetplan.so
 
 #generate: src/generate.[hc] src/parse.[hc] src/util.[hc] src/networkd.[hc] src/nm.[hc] src/validation.[hc] src/error.[hc]
-generate: libnetplan.so.$(NETPLAN_SOVER) nm.o networkd.o generate.o
+generate: libnetplan.so.$(NETPLAN_SOVER) nm.o networkd.o openvswitch.o generate.o sriov.o
 	$(CC) $(BUILDFLAGS) $(CFLAGS) $(LDFLAGS) -o $@ $^ -L. -lnetplan `pkg-config --cflags --libs glib-2.0 gio-2.0 yaml-0.1 uuid`
 
 netplan-dbus: src/dbus.c src/_features.h
@@ -66,7 +66,8 @@ clean:
 	rm -f *.o *.so*
 	rm -f netplan-dbus dbus/*.service
 	rm -f *.gcda *.gcno generate.info
-	rm -rf test-coverage .coverage
+	rm -rf test-coverage .coverage coverage.xml
+	find . | grep -E "(__pycache__|\.pyc)" | xargs rm -rf
 
 check: default linting
 	tests/cli.py
diff --git a/debian/changelog b/debian/changelog
index c34e72b..524dea4 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,34 @@
+netplan.io (0.100-0ubuntu1) UNRELEASED; urgency=medium
+
+  * New upstream release: 0.100
+    - Documentation improvements
+    - Improved integration tests
+    - Overall cleanup and refactoring
+    - Improved SR-IOV first boot experience
+    - Initial Open vSwitch support (LP: #1728134)
+    - Add support for Wireguard tunnels
+    - Add support for IP address labels (LP: #1743200)
+    - Improved routing & globbing in NetworkManager backend
+      - route attributes "from", "onlink" and "table"
+      - matching interfaces by glob pattern
+    - Add support for hidden wireless SSIDs (LP: #1866100)
+    - Introduce support for networkd address options (LP: #1803203)
+    - Implement ipv6-address-token key (LP: #1737976)
+    Bug fixes:
+    - Not connect to WiFi after 'netplan apply' (LP: #1874377)
+    - Call daemon-reload after we touched systemd unit files (LP: #1874494)
+    - Don't fail if same primary slave was set before (LP: #1817651)
+    - Fix process_link_changes handling 'up' interfaces (LP: #1875411)
+    - Fix GCC-10 -fno-common linker errors (LP: #1875412)
+    - Flush IPs of NM managed interfaces (LP: #1870561)
+  * Enable autopkgtests for OVS and wireguard
+  * Drop all distro patches, which have been integrated upstream
+  * Update symbols file
+  * Added openvswitch-switch to Build-Depends
+    - ovs-vsctl is required to pass the unit-tests
+
+ -- Lukas Märdian <[e-mail]>  Thu, 03 Sep 2020 15:51:29 +0200
+
 netplan.io (0.99-0ubuntu6) groovy; urgency=medium
 
   * d/p/0005-Fix-GCC-10-fno-common-linker-errors-LP-1875412-155.patch
diff --git a/debian/control b/debian/control
index d6a69b1..029f74d 100644
--- a/debian/control
+++ b/debian/control
@@ -24,6 +24,7 @@ Build-Depends: debhelper (>= 11),
  pycodestyle | pep8,
  python3-nose,
  pandoc,
+ openvswitch-switch,
 Vcs-Git: https://salsa.debian.org/debian/netplan.io.git
 Vcs-Browser: https://salsa.debian.org/debian/netplan.io
 Homepage: https://netplan.io/
diff --git a/debian/libnetplan0.symbols b/debian/libnetplan0.symbols
index 62adadd..36b49bb 100644
--- a/debian/libnetplan0.symbols
+++ b/debian/libnetplan0.symbols
@@ -1,10 +1,13 @@
 libnetplan.so.0.0 libnetplan0 #MINVER#
  NETPLAN_OPTIONAL_ADDRESS_TYPES@Base 0.99
  NETPLAN_WIFI_WOWLAN_TYPES@Base 0.99
+ address_option_handlers@Base 0.100
  current_file@Base 0.99
  g_string_free_to_file@Base 0.99
+ is_hostname@Base 0.100
  is_ip4_address@Base 0.99
  is_ip6_address@Base 0.99
+ is_wireguard_key@Base 0.100
  missing_id@Base 0.99
  missing_ids_found@Base 0.99
  netdefs@Base 0.99
@@ -12,14 +15,18 @@ libnetplan.so.0.0 libnetplan0 #MINVER#
  netplan_finish_parse@Base 0.99
  netplan_get_global_backend@Base 0.99
  netplan_parse_yaml@Base 0.99
+ ovs_settings_global@Base 0.100
  parser_error@Base 0.99
  safe_mkdir_p_dir@Base 0.99
+ systemd_escape@Base 0.100
  tunnel_mode_to_string@Base 0.99
  unlink_glob@Base 0.99
  validate_backend_rules@Base 0.99
  validate_netdef_grammar@Base 0.99
+ validate_ovs_target@Base 0.100
  wifi_frequency_24@Base 0.99
  wifi_frequency_5@Base 0.99
  wifi_get_freq24@Base 0.99
  wifi_get_freq5@Base 0.99
+ wireguard_peer_handlers@Base 0.100
  yaml_error@Base 0.99
diff --git a/debian/patches/0001-Fix-LP-1874377-Not-connect-to-WiFi-after-netplan-app.patch b/debian/patches/0001-Fix-LP-1874377-Not-connect-to-WiFi-after-netplan-app.patch
deleted file mode 100644
index d401e97..0000000
--- a/debian/patches/0001-Fix-LP-1874377-Not-connect-to-WiFi-after-netplan-app.patch
+++ /dev/null
@@ -1,175 +0,0 @@
-From: Lukas Maerdian <[e-mail]>
-Date: Tue, 28 Apr 2020 14:35:36 +0200
-Subject: Fix LP#1874377: Not connect to WiFi after 'netplan apply' (#133)
-
-* Fix LP#1874377: Not connect to WiFi after 'netplan apply'
-
-Seems like the 'netplan apply' command was not properly adopted in #109 when wired wpa_supplicant support was introduced.
-
-Fixes: https://bugs.launchpad.net/ubuntu/+source/netplan.io/+bug/1874377
----
- netplan/cli/commands/apply.py | 10 ++++--
- netplan/cli/utils.py          |  7 +++++
- src/networkd.c                |  4 +++
- tests/generator/test_wifis.py | 71 +++++++++++++++++++++++++++++++++++++++++++
- tests/integration/base.py     |  2 +-
- 5 files changed, 91 insertions(+), 3 deletions(-)
-
-diff --git a/netplan/cli/commands/apply.py b/netplan/cli/commands/apply.py
-index 0ec95f5..cf9f122 100644
---- a/netplan/cli/commands/apply.py
-+++ b/netplan/cli/commands/apply.py
-@@ -108,7 +108,13 @@ class NetplanApply(utils.NetplanCommand):
-         # stop backends
-         if restart_networkd:
-             logging.debug('netplan generated networkd configuration changed, restarting networkd')
--            utils.systemctl_networkd('stop', sync=sync, extra_services=['netplan-wpa@*.service'])
-+            wpa_services = ['netplan-wpa-*.service']
-+            # Historically (up to v0.98) we had netplan-wpa@*.service files, in case of an
-+            # upgraded system, we need to make sure to stop those.
-+            if utils.systemctl_is_active('netplan-wpa@*.service'):
-+                wpa_services.insert(0, 'netplan-wpa@*.service')
-+            utils.systemctl_networkd('stop', sync=sync, extra_services=wpa_services)
-+
-         else:
-             logging.debug('no netplan generated networkd configuration exists')
- 
-@@ -169,7 +175,7 @@ class NetplanApply(utils.NetplanCommand):
- 
-         # (re)start backends
-         if restart_networkd:
--            netplan_wpa = [os.path.basename(f) for f in glob.glob('/run/systemd/system/*.wants/netplan-wpa@*.service')]
-+            netplan_wpa = [os.path.basename(f) for f in glob.glob('/run/systemd/system/*.wants/netplan-wpa-*.service')]
-             utils.systemctl_networkd('start', sync=sync, extra_services=netplan_wpa)
-         if restart_nm:
-             utils.systemctl_network_manager('start', sync=sync)
-diff --git a/netplan/cli/utils.py b/netplan/cli/utils.py
-index 5f54b1a..c0eee03 100644
---- a/netplan/cli/utils.py
-+++ b/netplan/cli/utils.py
-@@ -86,6 +86,13 @@ def systemctl_networkd(action, sync=False, extra_services=[]):  # pragma: nocove
-     subprocess.check_call(command)
- 
- 
-+def systemctl_is_active(unit_pattern):  # pragma: nocover (covered in autopkgtest)
-+    '''Return True if at least one matching unit is running'''
-+    if subprocess.call(['systemctl', '--quiet', 'is-active', unit_pattern]) == 0:
-+        return True
-+    return False
-+
-+
- def get_interface_driver_name(interface, only_down=False):  # pragma: nocover (covered in autopkgtest)
-     devdir = os.path.join('/sys/class/net', interface)
-     if only_down:
-diff --git a/src/networkd.c b/src/networkd.c
-index e2bb111..6f6173a 100644
---- a/src/networkd.c
-+++ b/src/networkd.c
-@@ -990,8 +990,12 @@ cleanup_networkd_conf(const char* rootdir)
- {
-     unlink_glob(rootdir, "/run/systemd/network/10-netplan-*");
-     unlink_glob(rootdir, "/run/netplan/wpa-*.conf");
-+    unlink_glob(rootdir, "/run/systemd/system/systemd-networkd.service.wants/netplan-wpa-*.service");
-     unlink_glob(rootdir, "/run/systemd/system/netplan-wpa-*.service");
-     unlink_glob(rootdir, "/run/udev/rules.d/99-netplan-*");
-+    /* Historically (up to v0.98) we had netplan-wpa@*.service files, in case of an
-+     * upgraded system, we need to make sure to clean those up. */
-+    unlink_glob(rootdir, "/run/systemd/system/systemd-networkd.service.wants/netplan-wpa@*.service");
- }
- 
- /**
-diff --git a/tests/generator/test_wifis.py b/tests/generator/test_wifis.py
-index 8eb804e..d5b79cf 100644
---- a/tests/generator/test_wifis.py
-+++ b/tests/generator/test_wifis.py
-@@ -116,6 +116,77 @@ network={
-         self.assertTrue(os.path.islink(os.path.join(
-             self.workdir.name, 'run/systemd/system/systemd-networkd.service.wants/netplan-wpa-wl0.service')))
- 
-+    def test_wifi_upgrade(self):
-+        # pretend an old 'netplan-wpa@*.service' link still exists on an upgraded system
-+        os.makedirs(os.path.join(self.workdir.name, 'lib/systemd/system'))
-+        os.makedirs(os.path.join(self.workdir.name, 'run/systemd/system/systemd-networkd.service.wants'))
-+        with open(os.path.join(self.workdir.name, 'lib/systemd/system/netplan-wpa@.service'), 'w') as out:
-+            out.write('''[Unit]
-+Description=WPA supplicant for netplan %I
-+DefaultDependencies=no
-+Requires=sys-subsystem-net-devices-%i.device
-+After=sys-subsystem-net-devices-%i.device
-+Before=network.target
-+Wants=network.target
-+
-+[Service]
-+Type=simple
-+ExecStart=/sbin/wpa_supplicant -c /run/netplan/wpa-%I.conf -i%I''')
-+        os.symlink(os.path.join(self.workdir.name, 'lib/systemd/system/netplan-wpa@.service'),
-+                   os.path.join(self.workdir.name, 'run/systemd/system/systemd-networkd.service.wants/[e-mail]'))
-+
-+        # run generate, which should cleanup the old files/symlinks
-+        self.generate('''network:
-+  version: 2
-+  wifis:
-+    wl0:
-+      access-points:
-+        "Joe's Home":
-+          password: "s0s3kr1t"
-+      dhcp4: yes''')
-+
-+        # verify new files/links exist, while old have been removed
-+        self.assertTrue(os.path.isfile(os.path.join(
-+            self.workdir.name, 'run/systemd/system/netplan-wpa-wl0.service')))
-+        self.assertTrue(os.path.islink(os.path.join(
-+            self.workdir.name, 'run/systemd/system/systemd-networkd.service.wants/netplan-wpa-wl0.service')))
-+        # old files/links
-+        self.assertTrue(os.path.isfile(os.path.join(
-+            self.workdir.name, 'lib/systemd/system/netplan-wpa@.service')))
-+        self.assertFalse(os.path.islink(os.path.join(
-+            self.workdir.name, 'run/systemd/system/systemd-networkd.service.wants/[e-mail]')))
-+
-+        # pretend another old systemd service file exists for wl1
-+        os.symlink(os.path.join(self.workdir.name, 'lib/systemd/system/netplan-wpa@.service'),
-+                   os.path.join(self.workdir.name, 'run/systemd/system/systemd-networkd.service.wants/[e-mail]'))
-+
-+        # run generate again, to verify the historical netplan-wpa@.service links and wl0 links are gone
-+        self.generate('''network:
-+  version: 2
-+  wifis:
-+    wl1:
-+      access-points:
-+        "Other Home":
-+          password: "s0s3kr1t"
-+      dhcp4: yes''')
-+
-+        # verify new files/links exist, while old have been removed
-+        self.assertTrue(os.path.isfile(os.path.join(
-+            self.workdir.name, 'run/systemd/system/netplan-wpa-wl1.service')))
-+        self.assertTrue(os.path.islink(os.path.join(
-+            self.workdir.name, 'run/systemd/system/systemd-networkd.service.wants/netplan-wpa-wl1.service')))
-+        # old files/links
-+        self.assertTrue(os.path.isfile(os.path.join(
-+            self.workdir.name, 'lib/systemd/system/netplan-wpa@.service')))
-+        self.assertFalse(os.path.islink(os.path.join(
-+            self.workdir.name, 'run/systemd/system/systemd-networkd.service.wants/[e-mail]')))
-+        self.assertFalse(os.path.islink(os.path.join(
-+            self.workdir.name, 'run/systemd/system/systemd-networkd.service.wants/[e-mail]')))
-+        self.assertFalse(os.path.isfile(os.path.join(
-+            self.workdir.name, 'run/systemd/system/netplan-wpa-wl0.service')))
-+        self.assertFalse(os.path.islink(os.path.join(
-+            self.workdir.name, 'run/systemd/system/systemd-networkd.service.wants/netplan-wpa-wl0.service')))
-+
-     def test_wifi_route(self):
-         self.generate('''network:
-   version: 2
-diff --git a/tests/integration/base.py b/tests/integration/base.py
-index ed7100e..16fd2ee 100644
---- a/tests/integration/base.py
-+++ b/tests/integration/base.py
-@@ -93,7 +93,7 @@ class IntegrationTestsBase(unittest.TestCase):
-             pass
- 
-     def tearDown(self):
--        subprocess.call(['systemctl', 'stop', 'NetworkManager', 'systemd-networkd', 'netplan-wpa@*',
-+        subprocess.call(['systemctl', 'stop', 'NetworkManager', 'systemd-networkd', 'netplan-wpa-*',
-                                               'systemd-networkd.socket'])
-         # NM has KillMode=process and leaks dhclient processes
-         subprocess.call(['systemctl', 'kill', 'NetworkManager'])
diff --git a/debian/patches/0002-Fix-process_link_changes-handling-up-interfaces.patch b/debian/patches/0002-Fix-process_link_changes-handling-up-interfaces.patch
deleted file mode 100644
index f9a2e56..0000000
--- a/debian/patches/0002-Fix-process_link_changes-handling-up-interfaces.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From: Heitor Alves de Siqueira <[e-mail]>
-Date: Thu, 28 May 2020 09:19:07 -0300
-Subject: Fix process_link_changes handling 'up' interfaces
-
-b7f1d9b04212 refactored process_link_changes with helper methods to get
-the interface driver name and MAC address. This new code introduced a
-regression where it's possible for an interface in the up state to be
-included in the changelist by its MAC address.
-
-This patch restores the previous behaviour, skipping interfaces that
-don't have driver_name set.
-
-Fixes: https://bugs.launchpad.net/bugs/1875411
-Origin: upstream, https://github.com/CanonicalLtd/netplan/commit/8f77deec17ce
-Bug-Ubuntu: https://bugs.launchpad.net/bugs/1875411
----
- netplan/cli/commands/apply.py | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/netplan/cli/commands/apply.py b/netplan/cli/commands/apply.py
-index cf9f122..4b91ae9 100644
---- a/netplan/cli/commands/apply.py
-+++ b/netplan/cli/commands/apply.py
-@@ -244,6 +244,9 @@ class NetplanApply(utils.NetplanCommand):
-                 continue
- 
-             driver_name = utils.get_interface_driver_name(interface, only_down=True)
-+            if not driver_name:
-+                # don't allow up interfaces to match by mac
-+                continue
-             macaddress = utils.get_interface_macaddress(interface)
-             if driver_name in matches['by-driver']:
-                 new_name = matches['by-driver'][driver_name]
diff --git a/debian/patches/0003-Call-daemon-reload-after-we-touched-systemd-unit-fil.patch b/debian/patches/0003-Call-daemon-reload-after-we-touched-systemd-unit-fil.patch
deleted file mode 100644
index 470dfbd..0000000
--- a/debian/patches/0003-Call-daemon-reload-after-we-touched-systemd-unit-fil.patch
+++ /dev/null
@@ -1,64 +0,0 @@
-From: Lukas Maerdian <[e-mail]>
-Date: Thu, 14 May 2020 10:12:14 +0200
-Subject: [PATCH 1/8] Call daemon-reload after we touched systemd unit files
- (LP: #1874494) (#135)
-
-When running netplan apply systemd unit files might be created/deleted/changed on disk. We need to run systemctl daemon-reload, to make systemd aware of those new units and calculate the new unit/service dependencies. Otherwise it will throw warnings at us:
-
-ubuntu@ubuntu:~$ sudo netplan apply
-Warning: The unit file, source configuration file or drop-ins of netplan-wpa-wlan0.service changed on disk. Run 'systemctl daemon-reload' to reload units.
-Warning: The unit file, source configuration file or drop-ins of netplan-wpa-wlan0.service changed on disk. Run 'systemctl daemon-reload' to reload units.
-
-Fixes: https://bugs.launchpad.net/ubuntu/+source/netplan.io/+bug/1874494
----
- netplan/cli/commands/apply.py | 4 ++++
- netplan/cli/utils.py          | 5 +++++
- tests/integration/base.py     | 4 +++-
- 3 files changed, 12 insertions(+), 1 deletion(-)
-
-diff --git a/netplan/cli/commands/apply.py b/netplan/cli/commands/apply.py
-index 4b91ae9..33ff5b5 100644
---- a/netplan/cli/commands/apply.py
-+++ b/netplan/cli/commands/apply.py
-@@ -108,6 +108,10 @@ class NetplanApply(utils.NetplanCommand):
-         # stop backends
-         if restart_networkd:
-             logging.debug('netplan generated networkd configuration changed, restarting networkd')
-+            # Running 'systemctl daemon-reload' will re-run the netplan systemd generator,
-+            # so let's make sure we only run it iff we're willing to run 'netplan generate'
-+            if run_generate:
-+                utils.systemctl_daemon_reload()
-             wpa_services = ['netplan-wpa-*.service']
-             # Historically (up to v0.98) we had netplan-wpa@*.service files, in case of an
-             # upgraded system, we need to make sure to stop those.
-diff --git a/netplan/cli/utils.py b/netplan/cli/utils.py
-index c0eee03..85342fc 100644
---- a/netplan/cli/utils.py
-+++ b/netplan/cli/utils.py
-@@ -93,6 +93,11 @@ def systemctl_is_active(unit_pattern):  # pragma: nocover (covered in autopkgtes
-     return False
- 
- 
-+def systemctl_daemon_reload():  # pragma: nocover (covered in autopkgtest)
-+    '''Reload systemd unit files from disk and re-calculate its dependencies'''
-+    subprocess.check_call(['systemctl', 'daemon-reload'])
-+
-+
- def get_interface_driver_name(interface, only_down=False):  # pragma: nocover (covered in autopkgtest)
-     devdir = os.path.join('/sys/class/net', interface)
-     if only_down:
-diff --git a/tests/integration/base.py b/tests/integration/base.py
-index 16fd2ee..7d36198 100644
---- a/tests/integration/base.py
-+++ b/tests/integration/base.py
-@@ -352,7 +352,9 @@ class IntegrationTestsBase(unittest.TestCase):
-         '''Generate config, launch and settle NM and networkd'''
- 
-         # regenerate netplan config
--        subprocess.check_call(['netplan', 'apply'])
-+        out = subprocess.check_output(['netplan', 'apply'], universal_newlines=True)
-+        if 'Run \'systemctl daemon-reload\' to reload units.' in out:
-+            self.fail('systemd units changed without reload')
-         # start NM so that we can verify that it does not manage anything
-         subprocess.check_call(['systemctl', 'start', '--no-block', 'NetworkManager.service'])
-         # wait until networkd is done
diff --git a/debian/patches/0004-Fix-autopkgtest-on-arm64-with-NM-1.24-146.patch b/debian/patches/0004-Fix-autopkgtest-on-arm64-with-NM-1.24-146.patch
deleted file mode 100644
index 3de2c71..0000000
--- a/debian/patches/0004-Fix-autopkgtest-on-arm64-with-NM-1.24-146.patch
+++ /dev/null
@@ -1,160 +0,0 @@
-From: Lukas Maerdian <[e-mail]>
-Date: Thu, 18 Jun 2020 11:28:28 +0200
-Subject: [PATCH] Fix autopkgtest on arm64 with NM 1.24 (#146)
-
-On arm64 we had a test failure in tests/integration/ethernets.py -> test_manual_addresses, which was caused by the fact that netplan apply was disconnecting ALL available network interfaces via nmcli, in order to reload the new netplan config. This way the IP of the 2nd test DHCP server (dnsmasq on veth43) was lost and did not provide correct responses for the rest of the test.
-
-It is not necessary to take all interfaces down, only the ones which are (or were) configured via netplan. This was fixed in the netplan apply command.
-
-Note: This should make its way into the Groovy package as a distro-patch, to avoid future autopkgtest failures.
-
-Commits:
-* tests: fix ethernets/test_manual_addresses on arm64
-* netplan:apply: disconnect/re-configure only netplan-NM interfaces
-* tests:ethernets: remove deprecated fix, was fixed via 'netplan apply'
-* tests: add unit-test for python utils
-* utils: get rid of default glob in nm_interfaces
----
- netplan/cli/commands/apply.py  | 11 ++++++++--
- netplan/cli/utils.py           | 14 ++++++++++++
- tests/integration/ethernets.py |  2 ++
- tests/test_utils.py            | 49 ++++++++++++++++++++++++++++++++++++++++++
- 4 files changed, 74 insertions(+), 2 deletions(-)
- create mode 100644 tests/test_utils.py
-
-diff --git a/netplan/cli/commands/apply.py b/netplan/cli/commands/apply.py
-index 33ff5b5..a38fe88 100644
---- a/netplan/cli/commands/apply.py
-+++ b/netplan/cli/commands/apply.py
-@@ -74,7 +74,9 @@ class NetplanApply(utils.NetplanCommand):
-                 return
- 
-         old_files_networkd = bool(glob.glob('/run/systemd/network/*netplan-*'))
--        old_files_nm = bool(glob.glob('/run/NetworkManager/system-connections/netplan-*'))
-+        old_nm_glob = glob.glob('/run/NetworkManager/system-connections/netplan-*')
-+        nm_ifaces = utils.nm_interfaces(old_nm_glob)
-+        old_files_nm = bool(old_nm_glob)
- 
-         generator_call = []
-         generate_out = None
-@@ -101,7 +103,10 @@ class NetplanApply(utils.NetplanCommand):
-         restart_networkd = bool(glob.glob('/run/systemd/network/*netplan-*'))
-         if not restart_networkd and old_files_networkd:
-             restart_networkd = True
--        restart_nm = bool(glob.glob('/run/NetworkManager/system-connections/netplan-*'))
-+
-+        restart_nm_glob = glob.glob('/run/NetworkManager/system-connections/netplan-*')
-+        nm_ifaces += utils.nm_interfaces(restart_nm_glob)
-+        restart_nm = bool(restart_nm_glob)
-         if not restart_nm and old_files_nm:
-             restart_nm = True
- 
-@@ -127,6 +132,8 @@ class NetplanApply(utils.NetplanCommand):
-             if utils.nm_running():
-                 # restarting NM does not cause new config to be applied, need to shut down devices first
-                 for device in devices:
-+                    if device not in nm_ifaces:
-+                        continue  # do not touch this interface
-                     # ignore failures here -- some/many devices might not be managed by NM
-                     try:
-                         utils.nmcli(['device', 'disconnect', device])
-diff --git a/netplan/cli/utils.py b/netplan/cli/utils.py
-index 85342fc..4f7e266 100644
---- a/netplan/cli/utils.py
-+++ b/netplan/cli/utils.py
-@@ -23,6 +23,7 @@ import fnmatch
- import argparse
- import subprocess
- import netifaces
-+import re
- 
- NM_SERVICE_NAME = 'NetworkManager.service'
- NM_SNAP_SERVICE_NAME = 'snap.network-manager.networkmanager.service'
-@@ -55,6 +56,19 @@ def nm_running():  # pragma: nocover (covered in autopkgtest)
-         return False
- 
- 
-+def nm_interfaces(paths):
-+    pat = re.compile('^interface-name=(.*)$')
-+    interfaces = []
-+    for path in paths:
-+        with open(path, 'r') as f:
-+            for line in f:
-+                m = pat.match(line)
-+                if m:
-+                    interfaces.append(m.group(1))
-+                    break  # skip to next file
-+    return interfaces
-+
-+
- def systemctl_network_manager(action, sync=False):  # pragma: nocover (covered in autopkgtest)
-     service_name = NM_SERVICE_NAME
- 
-diff --git a/tests/integration/ethernets.py b/tests/integration/ethernets.py
-index 231d337..dc5783b 100644
---- a/tests/integration/ethernets.py
-+++ b/tests/integration/ethernets.py
-@@ -156,6 +156,8 @@ class _CommonTests():
- ''' % {'r': self.backend, 'ec': self.dev_e_client, 'e2c': self.dev_e2_client})
-         self.start_dnsmasq(None, self.dev_e2_ap)
-         self.generate_and_settle()
-+        if self.backend == 'NetworkManager':
-+            self.nm_online_full(self.dev_e2_client)
-         self.assert_iface_up(self.dev_e_client,
-                              ['inet 172.16.5.3/20'],
-                              ['inet 192.168.5',   # old DHCP
-diff --git a/tests/test_utils.py b/tests/test_utils.py
-new file mode 100644
-index 0000000..2c137d4
---- /dev/null
-+++ b/tests/test_utils.py
-@@ -0,0 +1,49 @@
-+#!/usr/bin/python3
-+#
-+# Copyright (C) 2020 Canonical, Ltd.
-+# Author: Lukas Märdian <[e-mail]>
-+#
-+# This program is free software; you can redistribute it and/or modify
-+# it under the terms of the GNU General Public License as published by
-+# the Free Software Foundation; version 3.
-+#
-+# This program is distributed in the hope that it will be useful,
-+# but WITHOUT ANY WARRANTY; without even the implied warranty of
-+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+# GNU General Public License for more details.
-+#
-+# You should have received a copy of the GNU General Public License
-+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-+
-+import os
-+import unittest
-+import tempfile
-+import glob
-+
-+import netplan.cli.utils as utils
-+
-+
-+class TestUtils(unittest.TestCase):
-+
-+    def setUp(self):
-+        self.workdir = tempfile.TemporaryDirectory()
-+        os.makedirs(os.path.join(self.workdir.name, 'etc/netplan'))
-+        os.makedirs(os.path.join(self.workdir.name,
-+                    'run/NetworkManager/system-connections'))
-+
-+    def _create_nm_keyfile(self, filename, ifname):
-+        with open(os.path.join(self.workdir.name,
-+                  'run/NetworkManager/system-connections/', filename), 'w') as f:
-+            f.write('[connection]\n')
-+            f.write('key=value\n')
-+            f.write('interface-name=%s\n' % ifname)
-+            f.write('key2=value2\n')
-+
-+    def test_nm_interfaces(self):
-+        self._create_nm_keyfile('netplan-test.nmconnection', 'eth0')
-+        self._create_nm_keyfile('netplan-test2.nmconnection', 'eth1')
-+        ifaces = utils.nm_interfaces(glob.glob(os.path.join(self.workdir.name,
-+                                     'run/NetworkManager/system-connections/*.nmconnection')))
-+        self.assertTrue('eth0' in ifaces)
-+        self.assertTrue('eth1' in ifaces)
-+        self.assertTrue(len(ifaces) == 2)
diff --git a/debian/patches/0005-Fix-GCC-10-fno-common-linker-errors-LP-1875412-155.patch b/debian/patches/0005-Fix-GCC-10-fno-common-linker-errors-LP-1875412-155.patch
deleted file mode 100644
index afad0fc..0000000
--- a/debian/patches/0005-Fix-GCC-10-fno-common-linker-errors-LP-1875412-155.patch
+++ /dev/null
@@ -1,79 +0,0 @@
-From: Lukas Maerdian <[e-mail]>
-Date: Tue, 28 Jul 2020 09:54:19 +0200
-Subject: Fix GCC-10 -fno-common linker errors (LP: #1875412) (#155)
-
-https://gcc.gnu.org/gcc-10/porting_to.html
----
- src/parse.c | 5 +++++
- src/parse.h | 6 +++---
- src/util.c  | 3 +++
- src/util.h  | 4 ++--
- 4 files changed, 13 insertions(+), 5 deletions(-)
-
-diff --git a/src/parse.c b/src/parse.c
-index c1dc175..e705ef3 100644
---- a/src/parse.c
-+++ b/src/parse.c
-@@ -62,6 +62,11 @@ GList* netdefs_ordered;
-  * existing definition */
- static GHashTable* ids_in_file;
- 
-+/* Global variables, defined in this file */
-+int missing_ids_found;
-+const char* current_file;
-+GHashTable* missing_id;
-+
- /**
-  * Load YAML file name into a yaml_document_t.
-  *
-diff --git a/src/parse.h b/src/parse.h
-index b84ff4c..b5b767f 100644
---- a/src/parse.h
-+++ b/src/parse.h
-@@ -25,14 +25,14 @@
- 
- 
- /* file that is currently being processed, for useful error messages */
--const char* current_file;
-+extern const char* current_file;
- 
- /* List of "seen" ids not found in netdefs yet by the parser.
-  * These are removed when it exists in this list and we reach the point of
-  * creating a netdef for that id; so by the time we're done parsing the yaml
-  * document it should be empty. */
--GHashTable *missing_id;
--int missing_ids_found;
-+extern GHashTable *missing_id;
-+extern int missing_ids_found;
- 
- /****************************************************
-  * Parsed definitions
-diff --git a/src/util.c b/src/util.c
-index 4b71ef1..ee00e93 100644
---- a/src/util.c
-+++ b/src/util.c
-@@ -24,6 +24,9 @@
- 
- #include "util.h"
- 
-+GHashTable* wifi_frequency_24;
-+GHashTable* wifi_frequency_5;
-+
- /**
-  * Create the parent directories of given file path. Exit program on failure.
-  */
-diff --git a/src/util.h b/src/util.h
-index 4ed1a60..4cd6ca2 100644
---- a/src/util.h
-+++ b/src/util.h
-@@ -17,8 +17,8 @@
- 
- #pragma once
- 
--GHashTable* wifi_frequency_24;
--GHashTable* wifi_frequency_5;
-+extern GHashTable* wifi_frequency_24;
-+extern GHashTable* wifi_frequency_5;
- 
- void safe_mkdir_p_dir(const char* file_path);
- void g_string_free_to_file(GString* s, const char* rootdir, const char* path, const char* suffix);
diff --git a/debian/patches/series b/debian/patches/series
index 5638063..e69de29 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,5 +0,0 @@
-0001-Fix-LP-1874377-Not-connect-to-WiFi-after-netplan-app.patch
-0002-Fix-process_link_changes-handling-up-interfaces.patch
-0003-Call-daemon-reload-after-we-touched-systemd-unit-fil.patch
-0004-Fix-autopkgtest-on-arm64-with-NM-1.24-146.patch
-0005-Fix-GCC-10-fno-common-linker-errors-LP-1875412-155.patch
diff --git a/debian/tests/control b/debian/tests/control
index 727e3da..bb557aa 100644
--- a/debian/tests/control
+++ b/debian/tests/control
@@ -1,3 +1,17 @@
+Test-Command: python3 tests/integration/run.py --test=ovs
+Tests-Directory: tests/integration
+Depends: @,
+  systemd,
+  network-manager,
+  hostapd,
+  dnsmasq-base,
+  libnm0,
+  python3-gi,
+  gir1.2-nm-1.0,
+  openvswitch-switch,
+Restrictions: allow-stderr, needs-root, isolation-machine
+Features: test-name=ovs
+
 Test-Command: python3 tests/integration/run.py --test=ethernets
 Tests-Directory: tests/integration
 Depends: @,
@@ -86,6 +100,7 @@ Depends: @,
   libnm0,
   python3-gi,
   gir1.2-nm-1.0,
+  wireguard-tools,
 Restrictions: allow-stderr, needs-root, isolation-machine
 Features: test-name=tunnels
 
diff --git a/doc/netplan.md b/doc/netplan.md
index c4b0ba3..97dc945 100644
--- a/doc/netplan.md
+++ b/doc/netplan.md
@@ -43,8 +43,8 @@ configuration files. Their primary purpose is to serve as anchor names for
 composite devices, for example to enumerate the members of a bridge that is
 currently being defined.
 
-If an interface is defined with an ID in a configuration file; it will be
-brought up by the applicable renderer. To not have netplan touch an interface
+(Since 0.97) If an interface is defined with an ID in a configuration file; it will
+be brought up by the applicable renderer. To not have netplan touch an interface
 at all, it should be completely omitted from the netplan configuration files.
 
 There are two physically/structurally different classes of device definitions,
@@ -89,8 +89,8 @@ Virtual devices
      :   Current interface name. Globs are supported, and the primary use case
          for matching on names, as selecting one fixed name can be more easily
          achieved with having no ``match:`` at all and just using the ID (see
-         above). Note that currently only networkd supports globbing,
-         NetworkManager does not.
+         above).
+         (``NetworkManager``: as of v1.14.0)
 
      ``macaddress`` (scalar)
      :   Device's MAC address in the form "XX:XX:XX:XX:XX:XX". Globs are not
@@ -133,10 +133,80 @@ Virtual devices
 
 :    Enable wake on LAN. Off by default.
 
-``emit-lldp`` (bool)
+``emit-lldp`` (bool) – since **0.99**
 
 :    (networkd backend only) Whether to emit LLDP packets. Off by default.
 
+``openvswitch`` (mapping) – since **0.100**
+
+:    This provides additional configuration for the network device for openvswitch.
+     If openvswitch is not available on the system, netplan treats the presence of
+     openvswitch configuration as an error.
+
+     Any supported network device that is declared with the ``openvswitch`` mapping
+     (or any bond/bridge that includes an interface with an openvswitch configuration)
+     will be created in openvswitch instead of the defined renderer.
+     In the case of a ``vlan`` definition declared the same way, netplan will create
+     a fake VLAN bridge in openvswitch with the requested vlan properties.
+
+     ``external-ids`` (mapping) – since **0.100**
+     :   Passed-through directly to OpenVSwitch
+
+     ``other-config`` (mapping) – since **0.100**
+     :   Passed-through directly to OpenVSwitch
+
+     ``lacp`` (scalar) – since **0.100**
+     :   Valid for bond interfaces. Accepts ``active``, ``passive`` or ``off`` (the default).
+
+     ``fail-mode`` (scalar) – since **0.100**
+     :   Valid for bridge interfaces. Accepts ``secure`` or ``standalone`` (the default).
+
+     ``mcast-snooping`` (bool) – since **0.100**
+     :   Valid for bridge interfaces. False by default.
+
+     ``protocols`` (sequence of scalars) – since **0.100**
+     :   Valid for bridge interfaces or the network section. List of protocols to be used when
+         negotiating a connection with the controller. Accepts ``OpenFlow10``, ``OpenFlow11``,
+         ``OpenFlow12``, ``OpenFlow13``, ``OpenFlow14``, ``OpenFlow15`` and ``OpenFlow16``.
+
+     ``rstp`` (bool) – since **0.100**
+     :   Valid for bridge interfaces. False by default.
+
+     ``controller`` (mapping) – since **0.100**
+     :   Valid for bridge interfaces. Specify an external OpenFlow controller.
+
+          ``addresses`` (sequence of scalars)
+          :   Set the list of addresses to use for the controller targets. The
+              syntax of these addresses is as defined in ovs-vsctl(8). Example:
+              addresses: ``[tcp:127.0.0.1:6653, "ssl:[fe80::1234%eth0]:6653"]``
+
+          ``connection-mode`` (scalar)
+          :   Set the connection mode for the controller. Supported options are
+              ``in-band`` and ``out-of-band``. The default is ``in-band``.
+
+     ``ports`` (sequence of sequence of scalars) – since **0.100**
+     :   OpenvSwitch patch ports. Each port is declared as a pair of names
+         which can be referenced as interfaces in dependent virtual devices
+         (bonds, bridges).
+
+         Example:
+
+             openvswitch:
+               ports:
+                 - [patch0-1, patch1-0]
+
+     ``ssl`` (mapping) – since **0.100**
+     :   Valid for global ``openvswitch`` settings. Options for configuring SSL
+         server endpoint for the switch.
+
+          ``ca-cert`` (scalar)
+          :   Path to a file containing the CA certificate to be used.
+
+          ``certificate`` (scalar)
+          :   Path to a file containing the server certificate.
+
+          ``private-key`` (scalar)
+          :   Path to a file containing the private key for the server.
 
 ## Common properties for all device types
 
@@ -144,13 +214,13 @@ Virtual devices
 
 :   Use the given networking backend for this definition. Currently supported are
     ``networkd`` and ``NetworkManager``. This property can be specified globally
-    in ``networks:``, for a device type (in e. g. ``ethernets:``) or
+    in ``network:``, for a device type (in e. g. ``ethernets:``) or
     for a particular device definition. Default is ``networkd``.
 
-    The ``renderer`` property has one additional acceptable value for vlan objects
-    (i. e. defined in ``vlans:``): ``sriov``. If a vlan is defined with the ``sriov``
-    renderer for an SR-IOV Virtual Function interface, this causes netplan to set
-    up a hardware VLAN filter for it. There can be only one defined per VF.
+    (Since 0.99) The ``renderer`` property has one additional acceptable value for vlan
+    objects (i. e. defined in ``vlans:``): ``sriov``. If a vlan is defined with the
+    ``sriov`` renderer for an SR-IOV Virtual Function interface, this causes netplan to
+    set up a hardware VLAN filter for it. There can be only one defined per VF.
 
 ``dhcp4`` (bool)
 
@@ -172,7 +242,7 @@ Virtual devices
     Note that **``rdnssd``**(8) is required to use RDNSS with networkd. No extra
     software is required for NetworkManager.
 
-``ipv6-mtu`` (scalar)
+``ipv6-mtu`` (scalar) – since **0.98**
 :   Set the IPv6 MTU (only supported with `networkd` backend). Note
     that needing to set this is an unusual requirement.
 
@@ -231,7 +301,7 @@ Virtual devices
     When enabled, accept Router Advertisements. When disabled, do not respond to
     Router Advertisements.  If unset use the host kernel default setting.
 
-``addresses`` (sequence of scalars)
+``addresses`` (sequence of scalars and mappings)
 
 :   Add static addresses to the interface in addition to the ones received
     through DHCP or RA. Each sequence entry is in CIDR notation, i. e. of the
@@ -242,13 +312,41 @@ Virtual devices
     configured and DHCP is disabled, the interface may still be brought online,
     but will not be addressable from the network.
 
+    In addition to the addresses themselves one can specify configuration
+    parameters as mappings. Current supported options are:
+
+    ``lifetime`` (scalar) – since **0.100**
+    :    Default: ``forever``. This can be ``forever`` or ``0`` and corresponds
+         to the ``PreferredLifetime`` option in ``systemd-networkd``'s Address
+         section. Currently supported on the ``networkd`` backend only.
+
+    ``label`` (scalar) – since **0.100**
+    :    An IP address label, equivalent to the ``ip address label``
+         command. Currently supported on the ``networkd`` backend only.
+
     Example: ``addresses: [192.168.14.2/24, "2001:1::1/64"]``
 
-``ipv6-address-generation`` (scalar)
+    Example:
+
+        ethernets:
+          eth0:
+            addresses:
+              - 10.0.0.15/24:
+                  lifetime: 0
+                  label: "maas"
+              - "2001:1::1/64"
+
+``ipv6-address-generation`` (scalar) – since **0.99**
 
 :   Configure method for creating the address for use with RFC4862 IPv6
-    Stateless Address Autoconfiguration. Possible values are ``eui64``
-    or ``stable-privacy``.
+    Stateless Address Autoconfiguration (only supported with `NetworkManager`
+    backend). Possible values are ``eui64`` or ``stable-privacy``.
+
+``ipv6-address-token`` (scalar) – since **0.100**
+
+:   Define an IPv6 address token for creating a static interface identifier for
+    IPv6 Stateless Address Autoconfiguration. This is mutually exclusive with
+    ``ipv6-address-generation``.
 
 ``gateway4``, ``gateway6`` (scalar)
 
@@ -333,11 +431,11 @@ similar to ``gateway*``, and ``search:`` is a list of search domains.
             dhcp6: true
             optional-addresses: [ ipv4-ll, dhcp6 ]
 
-``routes`` (mapping)
+``routes`` (sequence of mappings)
 
 :   Configure static routing for the device; see the ``Routing`` section below.
 
-``routing-policy`` (mapping)
+``routing-policy`` (sequence of mappings)
 
 :   Configure policy routing for the device; see the ``Routing`` section below.
 
@@ -358,6 +456,8 @@ When using the NetworkManager backend, different values may be specified for
 ``dhcp4-overrides`` and ``dhcp6-overrides``, and will be applied to the DHCP
 client processes as specified in the netplan YAML.
 
+``dhcp4-overrides``, ``dhcp6-overrides`` (mapping)
+
 :    The ``dhcp4-overrides`` and ``dhcp6-overrides`` mappings override the
      default DHCP behavior.
 
@@ -405,15 +505,15 @@ client processes as specified in the netplan YAML.
 
      ``route-metric`` (scalar)
      :    Use this value for default metric for automatically-added routes.
-          Use this to prioritize routes for devices by setting a higher metric
+          Use this to prioritize routes for devices by setting a lower metric
           on a preferred interface. Available for both the ``networkd`` and
           ``NetworkManager`` backends.
 
-     ``use-domains`` (scalar)
-     :    Takes a boolean, or the special value "route". When true, the domain 
+     ``use-domains`` (scalar) – since **0.98**
+     :    Takes a boolean, or the special value "route". When true, the domain
           name received from the DHCP server will be used as DNS search domain
           over this link, similar to the effect of the Domains= setting. If set
-          to "route", the domain name received from the DHCP server will be 
+          to "route", the domain name received from the DHCP server will be
           used for routing DNS queries only, but not for searching, similar to
           the effect of the Domains= setting when the argument is prefixed with
           "~".
@@ -438,6 +538,7 @@ These options are available for all types of interfaces.
 
      ``from`` (scalar)
      :    Set a source IP address for traffic going through the route.
+          (``NetworkManager``: as of v1.8.0)
 
      ``to`` (scalar)
      :    Destination address for the route.
@@ -448,6 +549,7 @@ These options are available for all types of interfaces.
      ``on-link`` (bool)
      :    When set to "true", specifies that the route is directly connected
           to the interface.
+          (``NetworkManager``: as of v1.12.0 for IPv4 and v1.18.0 for IPv6)
 
      ``metric`` (scalar)
      :    The relative priority of the route. Must be a positive integer value.
@@ -458,7 +560,8 @@ These options are available for all types of interfaces.
 
      ``scope`` (scalar)
      :    The route scope, how wide-ranging it is to the network. Possible
-          values are "global", "link", or "host".
+          values are "global", "link", or "host". ``NetworkManager`` does
+          not support setting a scope.
 
      ``table`` (scalar)
      :    The table number to use for the route. In some scenarios, it may be
@@ -467,6 +570,7 @@ These options are available for all types of interfaces.
           parameter. Allowed values are positive integers starting from 1.
           Some values are already in use to refer to specific routing tables:
           see ``/etc/iproute2/rt_tables``.
+          (``NetworkManager``: as of v1.10.0)
 
 ``routing-policy`` (mapping)
 
@@ -555,7 +659,7 @@ interfaces, as well as individual wifi networks, by means of the ``auth`` block.
      :    Password to use to decrypt the private key specified in
           ``client-key`` if it is encrypted.
 
-     ``phase2-auth`` (scalar)
+     ``phase2-auth`` (scalar) – since **0.99**
      :    Phase 2 authentication mechanism.
 
 
@@ -563,7 +667,7 @@ interfaces, as well as individual wifi networks, by means of the ``auth`` block.
 Ethernet device definitions, beyond common ones described above, also support
 some additional properties that can be used for SR-IOV devices.
 
-``link`` (scalar)
+``link`` (scalar) – since **0.99**
 
 :    (SR-IOV devices only) The ``link`` property declares the device as a
      Virtual Function of the selected Physical Function device, as identified
@@ -576,7 +680,7 @@ Example:
       enp1s16f1:
         link: enp1
 
-``virtual-function-count`` (scalar)
+``virtual-function-count`` (scalar) – since **0.99**
 
 :    (SR-IOV devices only) In certain special cases VFs might need to be
      configured outside of netplan. For such configurations ``virtual-function-count``
@@ -585,47 +689,67 @@ Example:
      VFs as are defined in the netplan configuration. This should be used for special
      cases only.
 
+     **Requires feature: sriov**
+
 ## Properties for device type ``modems:``
-GSM/CDMA modem configuration is only supported for the ``NetworkManager`` backend. ``systemd-networkd`` does
-not support modems.
+GSM/CDMA modem configuration is only supported for the ``NetworkManager``
+backend. ``systemd-networkd`` does not support modems.
 
-``apn`` (scalar)
-:    Set the carrier APN (Access Point Name). This can be omitted if ``auto-config`` is enabled.
+**Requires feature: modems**
 
-``auto-config`` (bool)
-:    Specify whether to try and autoconfigure the modem by doing a lookup of the carrier
-     against the Mobile Broadband Provider database. This may not work for all carriers.
+``apn`` (scalar) – since **0.99**
 
-``device-id`` (scalar)
-:    Specify the device ID (as given by the WWAN management service) of the modem to match.
-     This can be found using ``mmcli``.
+:    Set the carrier APN (Access Point Name). This can be omitted if
+     ``auto-config`` is enabled.
+
+``auto-config`` (bool) – since **0.99**
+
+:    Specify whether to try and autoconfigure the modem by doing a lookup of
+     the carrier against the Mobile Broadband Provider database. This may not
+     work for all carriers.
+
+``device-id`` (scalar) – since **0.99**
+
+:    Specify the device ID (as given by the WWAN management service) of the
+     modem to match. This can be found using ``mmcli``.
+
+``network-id`` (scalar) – since **0.99**
+
+:    Specify the Network ID (GSM LAI format). If this is specified, the device
+     will not roam networks.
+
+``number`` (scalar) – since **0.99**
+
+:    The number to dial to establish the connection to the mobile broadband
+     network. (Deprecated for GSM)
 
-``network-id`` (scalar)
-:    Specify the Network ID (GSM LAI format). If this is specified, the device will not roam networks.
+``password`` (scalar) – since **0.99**
 
-``number`` (scalar)
-:    The number to dial to establish the connection to the mobile broadband network. (Deprecated for GSM)
+:    Specify the password used to authenticate with the carrier network. This
+     can be omitted if ``auto-config`` is enabled.
 
-``password`` (scalar)
-:    Specify the password used to authenticate with the carrier network. This can be omitted
-     if ``auto-config`` is enabled.
+``pin`` (scalar) – since **0.99**
 
-``pin`` (scalar)
 :    Specify the SIM PIN to allow it to operate if a PIN is set.
 
-``sim-id`` (scalar)
-:    Specify the SIM unique identifier (as given by the WWAN management service) which this
-     connection applies to. If given, the connection will apply to any device also allowed by
-     ``device-id`` which contains a SIM card matching the given identifier.
+``sim-id`` (scalar) – since **0.99**
 
-``sim-operator-id`` (scalar)
-:    Specify the MCC/MNC string (such as "310260" or "21601") which identifies the carrier that
-     this connection should apply to. If given, the connection will apply to any device also
-     allowed by ``device-id`` and ``sim-id`` which contains a SIM card provisioned by the given operator.
+:    Specify the SIM unique identifier (as given by the WWAN management service)
+     which this connection applies to. If given, the connection will apply to
+     any device also allowed by ``device-id`` which contains a SIM card matching
+     the given identifier.
 
-``username`` (scalar)
-:    Specify the username used to authentiate with the carrier network. This can be omitted if
-     ``auto-config`` is enabled.
+``sim-operator-id`` (scalar) – since **0.99**
+
+:    Specify the MCC/MNC string (such as "310260" or "21601") which identifies
+     the carrier that this connection should apply to. If given, the connection
+     will apply to any device also allowed by ``device-id`` and ``sim-id``
+     which contains a SIM card provisioned by the given operator.
+
+``username`` (scalar) – since **0.99**
+
+:    Specify the username used to authentiate with the carrier network. This
+     can be omitted if ``auto-config`` is enabled.
 
 ## Properties for device type ``wifis:``
 Note that ``systemd-networkd`` does not natively support wifi, so you need
@@ -657,21 +781,27 @@ wpasupplicant installed if you let the ``networkd`` renderer handle wifi.
           and ``adhoc`` (peer to peer networks without a central access point).
           ``ap`` is only supported with NetworkManager.
 
-     ``bssid`` (scalar)
+     ``bssid`` (scalar) – since **0.99**
      :    If specified, directs the device to only associate with the given
           access point.
 
-     ``band`` (scalar)
+     ``band`` (scalar) – since **0.99**
      :    Possible bands are ``5GHz`` (for 5GHz 802.11a) and ``2.4GHz``
           (for 2.4GHz 802.11), do not restrict the 802.11 frequency band of the
           network if unset (the default).
 
-     ``channel`` (scalar)
+     ``channel`` (scalar) – since **0.99**
      :    Wireless channel to use for the Wi-Fi connection. Because channel
           numbers overlap between bands, this property takes effect only if
           the ``band`` property is also set.
 
-``wakeonwlan`` (sequence of scalars)
+     ``hidden`` (bool) – since **0.100**
+     :    Set to ``true`` to change the SSID scan technique for connecting to 
+          hidden WiFi networks. Note this may have slower performance compared
+          to ``false`` (the default) when connecting to publicly broadcast
+          SSIDs.
+
+``wakeonwlan`` (sequence of scalars) – since **0.99**
 
 :    This enables WakeOnWLan on supported devices. Not all drivers support all
      options. May be any combination of ``any``, ``disconnect``, ``magic_pkt``,
@@ -783,6 +913,8 @@ wpasupplicant installed if you let the ``networkd`` renderer handle wifi.
           ``balance-rr`` (round robin). Possible values are ``balance-rr``,
           ``active-backup``, ``balance-xor``, ``broadcast``, ``802.3ad``,
           ``balance-tlb``, and ``balance-alb``.
+          For OpenVSwitch ``active-backup`` and the additional modes
+          ``balance-tcp`` and ``balance-slb`` are supported.
 
      ``lacp-rate`` (scalar)
      :    Set the rate at which LACPDUs are transmitted. This is only useful
@@ -923,8 +1055,9 @@ more general information about tunnels.
 ``mode`` (scalar)
 
 :   Defines the tunnel mode. Valid options are ``sit``, ``gre``, ``ip6gre``,
-    ``ipip``, ``ipip6``, ``ip6ip6``, ``vti``, and ``vti6``. Additionally,
-    the ``networkd`` backend also supports ``gretap`` and ``ip6gretap`` modes.
+    ``ipip``, ``ipip6``, ``ip6ip6``, ``vti``, ``vti6`` and ``wireguard``.
+    Additionally, the ``networkd`` backend also supports ``gretap`` and
+    ``ip6gretap`` modes.
     In addition, the ``NetworkManager`` backend supports ``isatap`` tunnels.
 
 ``local`` (scalar)
@@ -938,14 +1071,16 @@ more general information about tunnels.
 ``key``  (scalar or mapping)
 
 :   Define keys to use for the tunnel. The key can be a number or a dotted
-    quad (an IPv4 address). It is used for identification of IP transforms.
-    This is only required for ``vti`` and ``vti6`` when using the networkd
-    backend, and for ``gre`` or ``ip6gre`` tunnels when using the
-    NetworkManager backend.
+    quad (an IPv4 address). For ``wireguard`` it can be a base64-encoded
+    private key or (as of ``networkd`` v242+) an absolute path to a file,
+    containing the private key (since 0.100).
+    It is used for identification of IP transforms. This is only required
+    for ``vti`` and ``vti6`` when using the networkd backend, and for
+    ``gre`` or ``ip6gre`` tunnels when using the NetworkManager backend.
 
     This field may be used as a scalar (meaning that a single key is
-    specified and to be used for both input and output key), or as a mapping,
-    where you can then further specify ``input`` and ``output``.
+    specified and to be used for input, output and private key), or as a
+    mapping, where you can further specify ``input``/``output``/``private``.
 
     ``input`` (scalar)
     :    The input key for the tunnel
@@ -953,6 +1088,15 @@ more general information about tunnels.
     ``output`` (scalar)
     :    The output key for the tunnel
 
+    ``private`` (scalar) – since **0.100**
+    :    A base64-encoded private key required for Wireguard tunnels. When the
+         ``systemd-networkd`` backend (v242+) is used, this can also be an
+         absolute path to a file containing the private key.
+
+``keys`` (scalar or mapping)
+
+:   Alternate name for the ``key`` field. See above.
+
 Examples:
 
     tunnels:
@@ -971,10 +1115,91 @@ Examples:
         remote: ...
         key: 59568549
 
-``keys`` (scalar or mapping)
+    tunnels:
+      wg0:
+        mode: wireguard
+        addresses: [...]
+        peers:
+          - keys:
+              public: rlbInAj0qV69CysWPQY7KEBnKxpYCpaWqOs/dLevdWc=
+              shared: /path/to/shared.key
+            ...
+        key: mNb7OIIXTdgW4khM7OFlzJ+UPs7lmcWHV7xjPgakMkQ=
+
+    tunnels:
+      wg0:
+        mode: wireguard
+        addresses: [...]
+        peers:
+          - keys:
+              public: rlbInAj0qV69CysWPQY7KEBnKxpYCpaWqOs/dLevdWc=
+            ...
+        keys:
+          private: /path/to/priv.key
 
-:   Alternate name for the ``key`` field. See above.
 
+Wireguard specific keys:
+
+    ``mark`` (scalar) – since **0.100**
+    :   Firewall mark for outgoing WireGuard packets from this interface,
+        optional.
+
+    ``port`` (scalar) – since **0.100**
+    :   UDP port to listen at or ``auto``. Optional, defaults to ``auto``.
+
+    ``peers`` (sequence of mappings) – since **0.100**
+    :   A list of peers, each having keys documented below.
+
+    Example:
+
+    tunnels:
+        wg0:
+            mode: wireguard
+            key: /path/to/private.key
+            mark: 42
+            port: 5182
+            peers:
+                - keys:
+                      public: rlbInAj0qV69CysWPQY7KEBnKxpYCpaWqOs/dLevdWc=
+                  allowed-ips: [0.0.0.0/0, "2001:fe:ad:de:ad:be:ef:1/24"]
+                  keepalive: 23
+                  endpoint: 1.2.3.4:5
+                - keys:
+                      public: M9nt4YujIOmNrRmpIRTmYSfMdrpvE7u6WkG8FY8WjG4=
+                      shared: /some/shared.key
+                  allowed-ips: [10.10.10.20/24]
+                  keepalive: 22
+                  endpoint: 5.4.3.2:1
+
+    ``endpoint`` (scalar) – since **0.100**
+    :   Remote endpoint IPv4/IPv6 address or a hostname, followed by a colon
+        and a port number.
+
+    ``allowed-ips`` (sequence of scalars) – since **0.100**
+    :    A list of IP (v4 or v6) addresses with CIDR masks from which this peer
+         is allowed to send incoming traffic and to which outgoing traffic for
+         this peer is directed. The catch-all 0.0.0.0/0 may be specified for
+         matching all IPv4 addresses, and ::/0 may be specified for matching
+         all IPv6 addresses.
+
+    ``keepalive`` (scalar) – since **0.100**
+    :    An interval in seconds, between 1 and 65535 inclusive, of how often to
+         send an authenticated empty packet to the peer for the purpose of
+         keeping a stateful firewall or NAT mapping valid persistently. Optional.
+
+    ``keys`` (mapping) – since **0.100**
+    :    Define keys to use for the Wireguard peers.
+
+         This field can be used as a mapping, where you can further specify the
+         ``public`` and ``shared`` keys.
+
+         ``public`` (scalar) – since **0.100**
+         :    A base64-encoded public key, requried for Wireguard peers.
+
+         ``shared`` (scalar) – since **0.100**
+         :    A base64-encoded preshared key. Optional for Wireguard peers.
+              When the ``systemd-networkd`` backend (v242+) is used, this can
+              also be an absolute path to a file containing the preshared key.
 
 ## Properties for device type ``vlans:``
 
@@ -1009,24 +1234,24 @@ backends may require to record some of their own parameters in netplan,
 especially if the netplan definitions are generated automatically by the
 consumer of that backend. Currently, this is only used with ``NetworkManager``.
 
-``networkmanager`` (mapping)
+``networkmanager`` (mapping) – since **0.99**
 
 :    Keeps the NetworkManager-specific configuration parameters used by the
      daemon to recognize connections.
 
-     ``name`` (scalar)
+     ``name`` (scalar) – since **0.99**
      :    Set the display name for the connection.
 
-     ``uuid`` (scalar)
+     ``uuid`` (scalar) – since **0.99**
      :    Defines the UUID (unique identifier) for this connection, as
           generated by NetworkManager itself.
 
-     ``stable-id`` (scalar)
+     ``stable-id`` (scalar) – since **0.99**
      :    Defines the stable ID (a different form of a connection name) used
           by NetworkManager in case the name of the connection might otherwise
           change, such as when sharing connections between users.
 
-     ``device`` (scalar)
+     ``device`` (scalar) – since **0.99**
      :    Defines the interface name for which this connection applies.
 
 
@@ -1114,7 +1339,6 @@ This is a complex example which shows most available features:
         switchports:
           # all cards on second PCI bus unconfigured by
           # themselves, will be added to br0 below
-          # note: globbing is not supported by NetworkManager
           match:
             name: enp2*
           mtu: 1280
diff --git a/examples/sriov.yaml b/examples/sriov.yaml
new file mode 100644
index 0000000..67de132
--- /dev/null
+++ b/examples/sriov.yaml
@@ -0,0 +1,14 @@
+network:
+  version: 2
+  renderer: networkd
+  ethernets:
+    eno1:
+      mtu: 9000
+    enp1s16f1:
+      link: eno1
+      addresses : [ "10.15.98.25/24" ]
+    vf1:
+      match:
+        name: enp1s16f[2-3]
+      link: eno1
+      addresses : [ "10.15.99.25/24" ]
diff --git a/examples/sriov_vlan.yaml b/examples/sriov_vlan.yaml
new file mode 100644
index 0000000..2c664d7
--- /dev/null
+++ b/examples/sriov_vlan.yaml
@@ -0,0 +1,18 @@
+network:
+  version: 2
+  renderer: networkd
+  ethernets:
+    eno1:
+      mtu: 9000
+    enp1s16f1:
+      link: eno1
+      addresses : [ "10.15.98.25/24" ]
+  vlans:
+    vlan1:
+      id: 15
+      link: enp1s16f1
+      addresses: [ "10.3.99.5/24" ]
+    vlan2_hw:
+      id: 10
+      link: enp1s16f1
+      renderer: sriov
diff --git a/examples/static.yaml b/examples/static.yaml
index e618909..977710b 100644
--- a/examples/static.yaml
+++ b/examples/static.yaml
@@ -7,5 +7,5 @@ network:
         - 10.10.10.2/24
       gateway4: 10.10.10.1
       nameservers:
-          search: [mydomain,otherdomain]
-          addresses: [10.10.10.1, 1.1.1.1]
+        search: [mydomain, otherdomain]
+        addresses: [10.10.10.1, 1.1.1.1]
diff --git a/netplan/cli/commands/apply.py b/netplan/cli/commands/apply.py
index 0ec95f5..fb5a6ad 100644
--- a/netplan/cli/commands/apply.py
+++ b/netplan/cli/commands/apply.py
@@ -3,6 +3,7 @@
 # Copyright (C) 2018-2020 Canonical, Ltd.
 # Author: Mathieu Trudel-Lapierre <[e-mail]>
 # Author: Łukasz 'sil2100' Zemczak <[e-mail]>
+# Author: Lukas 'slyon' Märdian <[e-mail]>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -28,6 +29,7 @@ import shutil
 import netplan.cli.utils as utils
 from netplan.configmanager import ConfigManager, ConfigurationError
 from netplan.cli.sriov import apply_sriov_config
+from netplan.cli.ovs import apply_ovs_cleanup
 
 import netifaces
 
@@ -38,15 +40,33 @@ class NetplanApply(utils.NetplanCommand):
         super().__init__(command_id='apply',
                          description='Apply current netplan config to running system',
                          leaf=True)
+        self.sriov_only = False
+        self.only_ovs_cleanup = False
 
     def run(self):  # pragma: nocover (covered in autopkgtest)
-        self.func = NetplanApply.command_apply
+        self.parser.add_argument('--sriov-only', action='store_true',
+                                 help='Only apply SR-IOV related configuration and exit')
+        self.parser.add_argument('--only-ovs-cleanup', action='store_true',
+                                 help='Only clean up old OpenVSwitch interfaces and exit')
+
+        self.func = self.command_apply
 
         self.parse_args()
         self.run_command()
 
-    @staticmethod
-    def command_apply(run_generate=True, sync=False, exit_on_error=True):  # pragma: nocover (covered in autopkgtest)
+    def command_apply(self, run_generate=True, sync=False, exit_on_error=True):  # pragma: nocover (covered in autopkgtest)
+        config_manager = ConfigManager()
+
+        # For certain use-cases, we might want to only apply specific configuration.
+        # If we only need SR-IOV configuration, do that and exit early.
+        if self.sriov_only:
+            NetplanApply.process_sriov_config(config_manager, exit_on_error)
+            return
+        # If we only need OpenVSwitch cleanup, do that and exit early.
+        elif self.only_ovs_cleanup:
+            NetplanApply.process_ovs_cleanup(config_manager, False, False, exit_on_error)
+            return
+
         # if we are inside a snap, then call dbus to run netplan apply instead
         if "SNAP" in os.environ:
             # TODO: maybe check if we are inside a classic snap and don't do
@@ -73,8 +93,16 @@ class NetplanApply(utils.NetplanCommand):
             else:
                 return
 
+        ovs_cleanup_service = '/run/systemd/system/netplan-ovs-cleanup.service'
         old_files_networkd = bool(glob.glob('/run/systemd/network/*netplan-*'))
-        old_files_nm = bool(glob.glob('/run/NetworkManager/system-connections/netplan-*'))
+        old_ovs_glob = glob.glob('/run/systemd/system/netplan-ovs-*')
+        # Ignore netplan-ovs-cleanup.service, as it can always be there
+        if ovs_cleanup_service in old_ovs_glob:
+            old_ovs_glob.remove(ovs_cleanup_service)
+        old_files_ovs = bool(old_ovs_glob)
+        old_nm_glob = glob.glob('/run/NetworkManager/system-connections/netplan-*')
+        nm_ifaces = utils.nm_interfaces(old_nm_glob, netifaces.interfaces())
+        old_files_nm = bool(old_nm_glob)
 
         generator_call = []
         generate_out = None
@@ -89,7 +117,6 @@ class NetplanApply(utils.NetplanCommand):
             else:
                 raise ConfigurationError("the configuration could not be generated")
 
-        config_manager = ConfigManager()
         devices = netifaces.interfaces()
 
         # Re-start service when
@@ -101,14 +128,36 @@ class NetplanApply(utils.NetplanCommand):
         restart_networkd = bool(glob.glob('/run/systemd/network/*netplan-*'))
         if not restart_networkd and old_files_networkd:
             restart_networkd = True
-        restart_nm = bool(glob.glob('/run/NetworkManager/system-connections/netplan-*'))
+        restart_ovs_glob = glob.glob('/run/systemd/system/netplan-ovs-*')
+        # Ignore netplan-ovs-cleanup.service, as it can always be there
+        if ovs_cleanup_service in restart_ovs_glob:
+            restart_ovs_glob.remove(ovs_cleanup_service)
+        restart_ovs = bool(restart_ovs_glob)
+        if not restart_ovs and old_files_ovs:
+            # OVS is managed via systemd units
+            restart_networkd = True
+
+        restart_nm_glob = glob.glob('/run/NetworkManager/system-connections/netplan-*')
+        nm_ifaces.update(utils.nm_interfaces(restart_nm_glob, devices))
+        restart_nm = bool(restart_nm_glob)
         if not restart_nm and old_files_nm:
             restart_nm = True
 
         # stop backends
         if restart_networkd:
             logging.debug('netplan generated networkd configuration changed, restarting networkd')
-            utils.systemctl_networkd('stop', sync=sync, extra_services=['netplan-wpa@*.service'])
+            # Running 'systemctl daemon-reload' will re-run the netplan systemd generator,
+            # so let's make sure we only run it iff we're willing to run 'netplan generate'
+            if run_generate:
+                utils.systemctl_daemon_reload()
+            # Clean up any old netplan related OVS ports/bonds/bridges, if applicable
+            NetplanApply.process_ovs_cleanup(config_manager, old_files_ovs, restart_ovs, exit_on_error)
+            wpa_services = ['netplan-wpa-*.service']
+            # Historically (up to v0.98) we had netplan-wpa@*.service files, in case of an
+            # upgraded system, we need to make sure to stop those.
+            if utils.systemctl_is_active('netplan-wpa@*.service'):
+                wpa_services.insert(0, 'netplan-wpa@*.service')
+            utils.systemctl_networkd('stop', sync=sync, extra_services=wpa_services)
         else:
             logging.debug('no netplan generated networkd configuration exists')
 
@@ -117,6 +166,8 @@ class NetplanApply(utils.NetplanCommand):
             if utils.nm_running():
                 # restarting NM does not cause new config to be applied, need to shut down devices first
                 for device in devices:
+                    if device not in nm_ifaces:
+                        continue  # do not touch this interface
                     # ignore failures here -- some/many devices might not be managed by NM
                     try:
                         utils.nmcli(['device', 'disconnect', device])
@@ -135,14 +186,6 @@ class NetplanApply(utils.NetplanCommand):
         config_manager.parse()
         changes = NetplanApply.process_link_changes(devices, config_manager)
 
-        # apply any SR-IOV related changes, if applicable
-        try:
-            apply_sriov_config(devices, config_manager)
-        except (ConfigurationError, RuntimeError) as e:
-            logging.error(str(e))
-            if exit_on_error:
-                sys.exit(1)
-
         # if the interface is up, we can still apply some .link file changes
         devices = netifaces.interfaces()
         for device in devices:
@@ -167,11 +210,21 @@ class NetplanApply(utils.NetplanCommand):
 
         subprocess.check_call(['udevadm', 'settle'])
 
+        # apply any SR-IOV related changes, if applicable
+        NetplanApply.process_sriov_config(config_manager, exit_on_error)
+
         # (re)start backends
         if restart_networkd:
-            netplan_wpa = [os.path.basename(f) for f in glob.glob('/run/systemd/system/*.wants/netplan-wpa@*.service')]
-            utils.systemctl_networkd('start', sync=sync, extra_services=netplan_wpa)
+            netplan_wpa = [os.path.basename(f) for f in glob.glob('/run/systemd/system/*.wants/netplan-wpa-*.service')]
+            netplan_ovs = [os.path.basename(f) for f in glob.glob('/run/systemd/system/*.wants/netplan-ovs-*.service')]
+            # Run 'systemctl start' command synchronously, to avoid race conditions
+            # with 'oneshot' systemd service units, e.g. netplan-ovs-*.service.
+            utils.systemctl_networkd('start', sync=True, extra_services=netplan_wpa + netplan_ovs)
         if restart_nm:
+            # Flush all IP addresses of NM managed interfaces, to avoid NM creating
+            # new, non netplan-* connection profiles, using the existing IPs.
+            for iface in utils.nm_interfaces(restart_nm_glob, devices):
+                utils.ip_addr_flush(iface)
             utils.systemctl_network_manager('start', sync=sync)
 
     @staticmethod
@@ -238,6 +291,9 @@ class NetplanApply(utils.NetplanCommand):
                 continue
 
             driver_name = utils.get_interface_driver_name(interface, only_down=True)
+            if not driver_name:
+                # don't allow up interfaces to match by mac
+                continue
             macaddress = utils.get_interface_macaddress(interface)
             if driver_name in matches['by-driver']:
                 new_name = matches['by-driver'][driver_name]
@@ -252,3 +308,21 @@ class NetplanApply(utils.NetplanCommand):
 
         logging.debug(changes)
         return changes
+
+    @staticmethod
+    def process_sriov_config(config_manager, exit_on_error=True):  # pragma: nocover (covered in autopkgtest)
+        try:
+            apply_sriov_config(config_manager)
+        except (ConfigurationError, RuntimeError) as e:
+            logging.error(str(e))
+            if exit_on_error:
+                sys.exit(1)
+
+    @staticmethod
+    def process_ovs_cleanup(config_manager, ovs_old, ovs_current, exit_on_error=True):  # pragma: nocover (autopkgtest)
+        try:
+            apply_ovs_cleanup(config_manager, ovs_old, ovs_current)
+        except (OSError, RuntimeError) as e:
+            logging.error(str(e))
+            if exit_on_error:
+                sys.exit(1)
diff --git a/netplan/cli/commands/try_command.py b/netplan/cli/commands/try_command.py
index 0f70566..756fa49 100644
--- a/netplan/cli/commands/try_command.py
+++ b/netplan/cli/commands/try_command.py
@@ -80,7 +80,7 @@ class NetplanTry(utils.NetplanCommand):
             self.backup()
             self.setup()
 
-            NetplanApply.command_apply(run_generate=True, sync=True, exit_on_error=False)
+            NetplanApply().command_apply(run_generate=True, sync=True, exit_on_error=False)
 
             self.t.get_confirmation_input(timeout=self.timeout)
         except netplan.terminal.InputRejected:
@@ -114,7 +114,7 @@ class NetplanTry(utils.NetplanCommand):
 
     def revert(self):  # pragma: nocover (requires user input)
         self.config_manager.revert()
-        NetplanApply.command_apply(run_generate=False, sync=True, exit_on_error=False)
+        NetplanApply().command_apply(run_generate=False, sync=True, exit_on_error=False)
         for ifname in self.new_interfaces:
             if ifname not in self.config_manager.bonds and \
                ifname not in self.config_manager.bridges and \
diff --git a/netplan/cli/ovs.py b/netplan/cli/ovs.py
new file mode 100644
index 0000000..a7ae6c8
--- /dev/null
+++ b/netplan/cli/ovs.py
@@ -0,0 +1,168 @@
+#!/usr/bin/python3
+#
+# Copyright (C) 2020 Canonical, Ltd.
+# Author: Lukas 'slyon' Märdian <[e-mail]>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; version 3.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import logging
+import os
+import subprocess
+
+OPENVSWITCH_OVS_VSCTL = '/usr/bin/ovs-vsctl'
+# Defaults for non-optional settings, as defined here:
+# http://www.openvswitch.org/ovs-vswitchd.conf.db.5.pdf
+DEFAULTS = {
+    # Mandatory columns:
+    'mcast_snooping_enable': 'false',
+    'rstp_enable': 'false',
+}
+GLOBALS = {
+    # Global commands:
+    'set-ssl': ('del-ssl', 'get-ssl'),
+    'set-fail-mode': ('del-fail-mode', 'get-fail-mode'),
+    'set-controller': ('del-controller', 'get-controller'),
+}
+
+
+def _del_col(type, iface, column, value):
+    """Cleanup values from a column (i.e. "column=value")"""
+    default = DEFAULTS.get(column)
+    if default is None:
+        # removes the exact value only if it was set by netplan
+        subprocess.check_call([OPENVSWITCH_OVS_VSCTL, 'remove', type, iface, column, value])
+    elif default and default != value:
+        # reset to default, if its not the default already
+        subprocess.check_call([OPENVSWITCH_OVS_VSCTL, 'set', type, iface, '%s=%s' % (column, default)])
+
+
+def _del_dict(type, iface, column, key, value):
+    """Cleanup values from a dictionary (i.e. "column:key=value")"""
+    # removes the exact value only if it was set by netplan
+    subprocess.check_call([OPENVSWITCH_OVS_VSCTL, 'remove', type, iface, column, key, value])
+
+
+def _del_global(type, iface, key, value):
+    """Cleanup commands from the global namespace"""
+    del_cmd, get_cmd = GLOBALS.get(key, (None, None))
+    if del_cmd == 'del-ssl':
+        iface = None
+
+    if del_cmd:
+        args_get = [OPENVSWITCH_OVS_VSCTL, get_cmd]
+        args_del = [OPENVSWITCH_OVS_VSCTL, del_cmd]
+        if iface:
+            args_get.append(iface)
+            args_del.append(iface)
+        # Check the current value of a global command and compare it to the tag-value, e.g.:
+        # * get-ssl: netplan/global/set-ssl=/private/key.pem,/another/cert.pem,/some/ca-cert.pem
+        # Private key: /private/key.pem
+        # Certificate: /another/cert.pem
+        # CA Certificate: /some/ca-cert.pem
+        # Bootstrap: false
+        # * get-fail-mode: netplan/global/set-fail-mode=secure
+        # secure
+        # * get-controller: netplan/global/set-controller=tcp:127.0.0.1:1337,unix:/some/socket
+        # tcp:127.0.0.1:1337
+        # unix:/some/socket
+        out = subprocess.check_output(args_get, universal_newlines=True)
+        # Clean it only if the exact same value(s) were set by netplan.
+        # Don't touch it if other values were set by another integration.
+        if all(item in out for item in value.split(',')):
+            subprocess.check_call(args_del)
+    else:
+        raise Exception('Reset command unkown for:', key)
+
+
+def clear_setting(type, iface, setting, value):
+    """Check if this setting is in a dict or a colum and delete accordingly"""
+    split = setting.split('/', 2)
+    col = split[1]
+    if col == 'global' and len(split) > 2:
+        _del_global(type, iface, split[2], value)
+    elif len(split) > 2:
+        _del_dict(type, iface, split[1], split[2], value)
+    else:
+        _del_col(type, iface, split[1], value)
+    # Cleanup the tag itself (i.e. "netplan/column[/key]")
+    subprocess.check_call([OPENVSWITCH_OVS_VSCTL, 'remove', type, iface, 'external-ids', setting])
+
+
+def is_ovs_interface(iface, interfaces):
+    if interfaces[iface].get('openvswitch') is not None:
+        return True
+    else:
+        return any(is_ovs_interface(i, interfaces) for i in interfaces[iface].get('interfaces', []))
+
+
+def apply_ovs_cleanup(config_manager, ovs_old, ovs_current):  # pragma: nocover (covered in autopkgtest)
+    """
+    Query OpenVSwitch state through 'ovs-vsctl' and filter for netplan=true
+    tagged ports/bonds and bridges. Delete interfaces which are not defined
+    in the current configuration.
+    Also filter for individual settings tagged netplan/<column>[/<key]=value
+    in external-ids and clear them if they have been set by netplan.
+    """
+    config_manager.parse()
+    ovs_ifaces = set()
+    for i in config_manager.interfaces.keys():
+        if (is_ovs_interface(i, config_manager.interfaces)):
+            ovs_ifaces.add(i)
+
+    # Tear down old OVS interfaces, not defined in the current config.
+    # Use 'del-br' on the Interface table, to delete any netplan created VLAN fake bridges.
+    # Use 'del-bond-iface' on the Interface table, to delete netplan created patch port interfaces
+    if os.path.isfile(OPENVSWITCH_OVS_VSCTL):
+        # Step 1: Delete all interfaces, which are not part of the current OVS config
+        for t in (('Port', 'del-port'), ('Bridge', 'del-br'), ('Interface', 'del-br')):
+            out = subprocess.check_output([OPENVSWITCH_OVS_VSCTL, '--columns=name,external-ids',
+                                           '-f', 'csv', '-d', 'bare', '--no-headings', 'list', t[0]],
+                                          universal_newlines=True)
+            for line in out.splitlines():
+                if 'netplan=true' in line:
+                    iface = line.split(',')[0]
+                    # Skip cleanup if this OVS interface is part of the current netplan OVS config
+                    if iface in ovs_ifaces:
+                        continue
+                    if t[0] == 'Interface' and subprocess.run([OPENVSWITCH_OVS_VSCTL, 'iface-to-br', iface]).returncode > 0:
+                        subprocess.check_call([OPENVSWITCH_OVS_VSCTL, '--if-exists', 'del-bond-iface', iface])
+                    else:
+                        subprocess.check_call([OPENVSWITCH_OVS_VSCTL, '--if-exists', t[1], iface])
+
+        # Step 2: Clean up the settings of the remaining interfaces
+        for t in ('Port', 'Bridge', 'Interface', 'Open_vSwitch', 'Controller'):
+            cols = 'name,external-ids'
+            if t == 'Open_vSwitch':
+                cols = 'external-ids'
+            elif t == 'Controller':
+                cols = '_uuid,external-ids'  # handle _uuid as if it would be the iface 'name'
+            out = subprocess.check_output([OPENVSWITCH_OVS_VSCTL, '--columns=%s' % cols,
+                                           '-f', 'csv', '-d', 'bare', '--no-headings', 'list', t],
+                                          universal_newlines=True)
+            for line in out.splitlines():
+                if 'netplan/' in line:
+                    iface = '.'
+                    extids = line
+                    if t != 'Open_vSwitch':
+                        iface, extids = line.split(',', 1)
+                    # Check each line (interface) if it contains any netplan tagged settings, e.g.:
+                    # ovs0,"iface-id=myhostname netplan=true netplan/external-ids/iface-id=myhostname"
+                    # ovs1,"netplan=true netplan/global/set-fail-mode=standalone netplan/mcast_snooping_enable=false"
+                    for entry in extids.strip('"').split(' '):
+                        if entry.startswith('netplan/') and '=' in entry:
+                            setting, val = entry.split('=', 1)
+                            clear_setting(t, iface, setting, val)
+
+    # Show the warning only if we are or have been working with OVS definitions
+    elif ovs_old or ovs_current:
+        logging.warning('ovs-vsctl is missing, cannot tear down old OpenVSwitch interfaces')
diff --git a/netplan/cli/sriov.py b/netplan/cli/sriov.py
index 8feacf1..43e0259 100644
--- a/netplan/cli/sriov.py
+++ b/netplan/cli/sriov.py
@@ -30,25 +30,36 @@ import netifaces
 def _get_target_interface(interfaces, config_manager, pf_link, pfs):
     if pf_link not in pfs:
         # handle the match: syntax, get the actual device name
-        pf_match = config_manager.ethernets[pf_link].get('match')
+        pf_dev = config_manager.ethernets[pf_link]
+        pf_match = pf_dev.get('match')
         if pf_match:
-            by_name = pf_match.get('name')
-            by_mac = pf_match.get('macaddress')
-            by_driver = pf_match.get('driver')
-
-            for interface in interfaces:
-                if ((by_name and not utils.is_interface_matching_name(interface, by_name)) or
-                        (by_mac and not utils.is_interface_matching_macaddress(interface, by_mac)) or
-                        (by_driver and not utils.is_interface_matching_driver_name(interface, by_driver))):
-                    continue
-                # we have a matching PF
-                # store the matching interface in the dictionary of
-                # active PFs, but error out if we matched more than one
-                if pf_link in pfs:
-                    raise ConfigurationError('matched more than one interface for a PF device: %s' % pf_link)
-                pfs[pf_link] = interface
+            # now here it's a bit tricky
+            set_name = pf_dev.get('set-name')
+            if set_name and set_name in interfaces:
+                # if we had a match: stanza and set-name: this means we should
+                # assume that, if found, the interface has already been
+                # renamed - use the new name
+                pfs[pf_link] = set_name
+            else:
+                # no set-name (or interfaces not yet renamed) so we need to do
+                # the matching ourselves
+                by_name = pf_match.get('name')
+                by_mac = pf_match.get('macaddress')
+                by_driver = pf_match.get('driver')
+
+                for interface in interfaces:
+                    if ((by_name and not utils.is_interface_matching_name(interface, by_name)) or
+                            (by_mac and not utils.is_interface_matching_macaddress(interface, by_mac)) or
+                            (by_driver and not utils.is_interface_matching_driver_name(interface, by_driver))):
+                        continue
+                    # we have a matching PF
+                    # store the matching interface in the dictionary of
+                    # active PFs, but error out if we matched more than one
+                    if pf_link in pfs:
+                        raise ConfigurationError('matched more than one interface for a PF device: %s' % pf_link)
+                    pfs[pf_link] = interface
         else:
-            # no match field, assume entry name is interface name
+            # no match field, assume entry name is the interface name
             if pf_link in interfaces:
                 pfs[pf_link] = pf_link
 
@@ -219,11 +230,13 @@ def apply_vlan_filter_for_vf(pf, vf, vlan_name, vlan_id, prefix='/'):
             'failed setting SR-IOV VLAN filter for vlan %s (ip link set command failed)' % vlan_name)
 
 
-def apply_sriov_config(interfaces, config_manager):
+def apply_sriov_config(config_manager):
     """
     Go through all interfaces, identify which ones are SR-IOV VFs, create
     them and perform all other necessary setup.
     """
+    config_manager.parse()
+    interfaces = netifaces.interfaces()
 
     # for sr-iov devices, we identify VFs by them having a link: field
     # pointing to an PF. So let's browse through all ethernet devices,
@@ -316,5 +329,6 @@ def apply_sriov_config(interfaces, config_manager):
                 raise ConfigurationError(
                     'interface %s for netplan device %s (%s) already has an SR-IOV vlan defined' % (vf, link, vlan))
 
+            # TODO: make sure that we don't apply the filter twice
             apply_vlan_filter_for_vf(pf, vf, vlan, vlan_id)
             filtered_vlans_set.add(vf)
diff --git a/netplan/cli/utils.py b/netplan/cli/utils.py
index 5f54b1a..f076c25 100644
--- a/netplan/cli/utils.py
+++ b/netplan/cli/utils.py
@@ -23,6 +23,7 @@ import fnmatch
 import argparse
 import subprocess
 import netifaces
+import re
 
 NM_SERVICE_NAME = 'NetworkManager.service'
 NM_SNAP_SERVICE_NAME = 'snap.network-manager.networkmanager.service'
@@ -55,6 +56,20 @@ def nm_running():  # pragma: nocover (covered in autopkgtest)
         return False
 
 
+def nm_interfaces(paths, devices):
+    pat = re.compile('^interface-name=(.*)$')
+    interfaces = set()
+    for path in paths:
+        with open(path, 'r') as f:
+            for line in f:
+                m = pat.match(line)
+                if m:
+                    # Expand/match globbing of interface names, to real devices
+                    interfaces.update(set(fnmatch.filter(devices, m.group(1))))
+                    break  # skip to next file
+    return interfaces
+
+
 def systemctl_network_manager(action, sync=False):  # pragma: nocover (covered in autopkgtest)
     service_name = NM_SERVICE_NAME
 
@@ -86,6 +101,23 @@ def systemctl_networkd(action, sync=False, extra_services=[]):  # pragma: nocove
     subprocess.check_call(command)
 
 
+def systemctl_is_active(unit_pattern):  # pragma: nocover (covered in autopkgtest)
+    '''Return True if at least one matching unit is running'''
+    if subprocess.call(['systemctl', '--quiet', 'is-active', unit_pattern]) == 0:
+        return True
+    return False
+
+
+def systemctl_daemon_reload():  # pragma: nocover (covered in autopkgtest)
+    '''Reload systemd unit files from disk and re-calculate its dependencies'''
+    subprocess.check_call(['systemctl', 'daemon-reload'])
+
+
+def ip_addr_flush(iface):  # pragma: nocover (covered in autopkgtest)
+    '''Flush all IP addresses of a given interface via iproute2'''
+    subprocess.check_call(['ip', 'addr', 'flush', iface], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+
+
 def get_interface_driver_name(interface, only_down=False):  # pragma: nocover (covered in autopkgtest)
     devdir = os.path.join('/sys/class/net', interface)
     if only_down:
diff --git a/netplan/configmanager.py b/netplan/configmanager.py
index 0f9e28b..ce050a2 100644
--- a/netplan/configmanager.py
+++ b/netplan/configmanager.py
@@ -44,6 +44,7 @@ class ConfigManager(object):
     @property
     def interfaces(self):
         interfaces = {}
+        interfaces.update(self.ovs_ports)
         interfaces.update(self.ethernets)
         interfaces.update(self.wifis)
         interfaces.update(self.bridges)
@@ -59,6 +60,10 @@ class ConfigManager(object):
         return interfaces
 
     @property
+    def ovs_ports(self):
+        return self.network['ovs_ports']
+
+    @property
     def ethernets(self):
         return self.network['ethernets']
 
@@ -101,6 +106,7 @@ class ConfigManager(object):
         files = [names_to_paths[name] for name in sorted(names_to_paths.keys())]
 
         self.config['network'] = {
+            'ovs_ports': {},
             'ethernets': {},
             'wifis': {},
             'bridges': {},
@@ -172,6 +178,29 @@ class ConfigManager(object):
             else:
                 raise
 
+    def _merge_ovs_ports_config(self, orig, new):
+        new_interfaces = set()
+        ports = dict()
+        if 'ports' in new:
+            for p1, p2 in new.get('ports'):
+                # Spoof an interface config for patch ports, which are usually
+                # just strings. Add 'peer' and mark it via 'openvswitch' key.
+                ports[p1] = {'peer': p2, 'openvswitch': {}}
+                ports[p2] = {'peer': p1, 'openvswitch': {}}
+        changed_ifaces = list(ports.keys())
+
+        for ifname in changed_ifaces:
+            iface = ports.pop(ifname)
+            if ifname in orig:
+                logging.debug("{} exists in {}".format(ifname, orig))
+                orig[ifname].update(iface)
+            else:
+                logging.debug("{} not found in {}".format(ifname, orig))
+                orig[ifname] = iface
+                new_interfaces.add(ifname)
+
+        return new_interfaces
+
     def _merge_interface_config(self, orig, new):
         new_interfaces = set()
         changed_ifaces = list(new.keys())
@@ -198,6 +227,9 @@ class ConfigManager(object):
                 if yaml_data is not None:
                     network = yaml_data.get('network')
                 if network:
+                    if 'openvswitch' in network:
+                        new = self._merge_ovs_ports_config(self.ovs_ports, network.get('openvswitch'))
+                        new_interfaces |= new
                     if 'ethernets' in network:
                         new = self._merge_interface_config(self.ethernets, network.get('ethernets'))
                         new_interfaces |= new
diff --git a/src/generate.c b/src/generate.c
index c020d8f..e88dd7f 100644
--- a/src/generate.c
+++ b/src/generate.c
@@ -30,10 +30,13 @@
 #include "parse.h"
 #include "networkd.h"
 #include "nm.h"
+#include "openvswitch.h"
+#include "sriov.h"
 
 static gchar* rootdir;
 static gchar** files;
 static gboolean any_networkd;
+static gboolean any_sriov;
 static gchar* mapping_iface;
 
 static GOptionEntry options[] = {
@@ -53,9 +56,14 @@ reload_udevd(void)
 static void
 nd_iterator_list(gpointer value, gpointer user_data)
 {
-    if (write_networkd_conf((NetplanNetDefinition*) value, (const char*) user_data))
+    NetplanNetDefinition* def = (NetplanNetDefinition*) value;
+    if (write_networkd_conf(def, (const char*) user_data))
         any_networkd = TRUE;
-    write_nm_conf((NetplanNetDefinition*) value, (const char*) user_data);
+
+    write_ovs_conf(def, (const char*) user_data);
+    write_nm_conf(def, (const char*) user_data);
+    if (def->sriov_explicit_vf_count < G_MAXUINT || def->sriov_link)
+        any_sriov = TRUE;
 }
 
 
@@ -246,6 +254,8 @@ int main(int argc, char** argv)
     /* Clean up generated config from previous runs */
     cleanup_networkd_conf(rootdir);
     cleanup_nm_conf(rootdir);
+    cleanup_ovs_conf(rootdir);
+    cleanup_sriov_conf(rootdir);
 
     if (mapping_iface && netdefs) {
         return find_interface(mapping_iface);
@@ -256,6 +266,8 @@ int main(int argc, char** argv)
         g_debug("Generating output files..");
         g_list_foreach (netdefs_ordered, nd_iterator_list, rootdir);
         write_nm_conf_finish(rootdir);
+        write_ovs_conf_finish(rootdir);
+        if (any_sriov) write_sriov_conf_finish(rootdir);
         /* We may have written .rules & .link files, thus we must
          * invalidate udevd cache of its config as by default it only
          * invalidates cache at most every 3 seconds. Not sure if this
diff --git a/src/networkd.c b/src/networkd.c
index e2bb111..a1b31d8 100644
--- a/src/networkd.c
+++ b/src/networkd.c
@@ -28,6 +28,7 @@
 #include "networkd.h"
 #include "parse.h"
 #include "util.h"
+#include "validation.h"
 
 /**
  * Append WiFi frequencies to wpa_supplicant's freq_list=
@@ -152,6 +153,69 @@ write_tunnel_params(GString* s, const NetplanNetDefinition* def)
 }
 
 static void
+write_wireguard_params(GString* s, const NetplanNetDefinition* def)
+{
+    GString *params = NULL;
+    params = g_string_sized_new(200);
+
+    g_assert(def->tunnel.private_key);
+    /* The "PrivateKeyFile=" setting is available as of systemd-netwokrd v242+
+     * Base64 encoded PrivateKey= or absolute PrivateKeyFile= fields are mandatory.
+     *
+     * The key was already validated via validate_tunnel_grammar(), but we need
+     * to differentiate between base64 key VS absolute path key-file. And a base64
+     * string could (theoretically) start with '/', so we use is_wireguard_key()
+     * as well to check for more specific characteristics (if needed). */
+    if (def->tunnel.private_key[0] == '/' && !is_wireguard_key(def->tunnel.private_key))
+        g_string_append_printf(params, "PrivateKeyFile=%s\n", def->tunnel.private_key);
+    else
+        g_string_append_printf(params, "PrivateKey=%s\n", def->tunnel.private_key);
+
+    if (def->tunnel.port)
+        g_string_append_printf(params, "ListenPort=%u\n", def->tunnel.port);
+    /* This is called FirewallMark= as of systemd v243, but we keep calling it FwMark= for
+       backwards compatibility. FwMark= is still supported, but deprecated:
+       https://github.com/systemd/systemd/pull/12478 */
+    if (def->tunnel.fwmark)
+        g_string_append_printf(params, "FwMark=%u\n", def->tunnel.fwmark);
+
+    g_string_append_printf(s, "\n[WireGuard]\n%s", params->str);
+    g_string_free(params, TRUE);
+
+    for (guint i = 0; i < def->wireguard_peers->len; i++) {
+        NetplanWireguardPeer *peer = g_array_index (def->wireguard_peers, NetplanWireguardPeer*, i);
+        GString *peer_s = g_string_sized_new(200);
+
+        g_string_append_printf(peer_s, "PublicKey=%s\n", peer->public_key);
+        g_string_append(peer_s, "AllowedIPs=");
+        for (guint i = 0; i < peer->allowed_ips->len; ++i) {
+            if (i > 0 )
+                g_string_append_c(peer_s, ',');
+            g_string_append_printf(peer_s, "%s", g_array_index(peer->allowed_ips, char*, i));
+        }
+        g_string_append_c(peer_s, '\n');
+
+        if (peer->keepalive)
+            g_string_append_printf(peer_s, "PersistentKeepalive=%d\n", peer->keepalive);
+        if (peer->endpoint)
+            g_string_append_printf(peer_s, "Endpoint=%s\n", peer->endpoint);
+        /* The key was already validated via validate_tunnel_grammar(), but we need
+         * to differentiate between base64 key VS absolute path key-file. And a base64
+         * string could (theoretically) start with '/', so we use is_wireguard_key()
+         * as well to check for more specific characteristics (if needed). */
+        if (peer->preshared_key) {
+            if (peer->preshared_key[0] == '/' && !is_wireguard_key(peer->preshared_key))
+                g_string_append_printf(peer_s, "PresharedKeyFile=%s\n", peer->preshared_key);
+            else
+                g_string_append_printf(peer_s, "PresharedKey=%s\n", peer->preshared_key);
+        }
+
+        g_string_append_printf(s, "\n[WireGuardPeer]\n%s", peer_s->str);
+        g_string_free(peer_s, TRUE);
+    }
+}
+
+static void
 write_link_file(const NetplanNetDefinition* def, const char* rootdir, const char* path)
 {
     GString* s = NULL;
@@ -326,9 +390,9 @@ write_netdev_file(const NetplanNetDefinition* def, const char* rootdir, const ch
                 case NETPLAN_TUNNEL_MODE_SIT:
                 case NETPLAN_TUNNEL_MODE_VTI:
                 case NETPLAN_TUNNEL_MODE_VTI6:
-                    g_string_append_printf(s,
-                                          "Kind=%s\n",
-                                          tunnel_mode_to_string(def->tunnel.mode));
+                case NETPLAN_TUNNEL_MODE_WIREGUARD:
+                    g_string_append_printf(s, "Kind=%s\n",
+                                           tunnel_mode_to_string(def->tunnel.mode));
                     break;
 
                 case NETPLAN_TUNNEL_MODE_IP6IP6:
@@ -341,14 +405,13 @@ write_netdev_file(const NetplanNetDefinition* def, const char* rootdir, const ch
                     g_assert_not_reached();
                 // LCOV_EXCL_STOP
             }
-
-            write_tunnel_params(s, def);
+            if (def->tunnel.mode == NETPLAN_TUNNEL_MODE_WIREGUARD)
+                write_wireguard_params(s, def);
+            else
+                write_tunnel_params(s, def);
             break;
 
-        // LCOV_EXCL_START
-        default:
-            g_assert_not_reached();
-        // LCOV_EXCL_STOP
+        default: g_assert_not_reached(); // LCOV_EXCL_LINE
     }
 
     /* these do not contain secrets and need to be readable by
@@ -402,6 +465,19 @@ write_ip_rule(NetplanIPRule* r, GString* s)
         g_string_append_printf(s, "TypeOfService=%d\n", r->tos);
 }
 
+static void
+write_addr_option(NetplanAddressOptions* o, GString* s)
+{
+    g_string_append_printf(s, "\n[Address]\n");
+    g_assert(o->address);
+    g_string_append_printf(s, "Address=%s\n", o->address);
+
+    if (o->lifetime)
+        g_string_append_printf(s, "PreferredLifetime=%s\n", o->lifetime);
+    if (o->label)
+        g_string_append_printf(s, "Label=%s\n", o->label);
+}
+
 #define DHCP_OVERRIDES_ERROR                                            \
     "ERROR: %s: networkd requires that %s has the same value in both "  \
     "dhcp4_overrides and dhcp6_overrides\n"
@@ -459,7 +535,10 @@ combine_dhcp_overrides(const NetplanNetDefinition* def, NetplanDHCPOverrides* co
     }
 }
 
-static void
+/**
+ * Write the needed networkd .network configuration for the selected netplan definition.
+ */
+void
 write_network_file(const NetplanNetDefinition* def, const char* rootdir, const char* path)
 {
     GString* network = NULL;
@@ -524,13 +603,13 @@ write_network_file(const NetplanNetDefinition* def, const char* rootdir, const c
     if (def->ip6_addresses)
         for (unsigned i = 0; i < def->ip6_addresses->len; ++i)
             g_string_append_printf(network, "Address=%s\n", g_array_index(def->ip6_addresses, char*, i));
-    if (def->ip6_addr_gen_mode) {
-        /* TODO: Figure out how we can configure ipv6-address-generation for networkd.
-         *       IPv6Token= seems to be the corresponding option, but it doesn't do
-         *       exactly what we need and has quite some restrictions, c.f.:
-         *       https://github.com/systemd/systemd/issues/4625
-         *       https://github.com/systemd/systemd/pull/14415 */
-        g_fprintf(stderr, "ERROR: %s: ipv6-address-generation is not supported by networkd\n", def->id);
+    if (def->ip6_addr_gen_token) {
+        g_string_append_printf(network, "IPv6Token=static:%s\n", def->ip6_addr_gen_token);
+    } else if (def->ip6_addr_gen_mode > NETPLAN_ADDRGEN_EUI64) {
+        /* EUI-64 mode is enabled by default, if no IPv6Token= is specified */
+        /* TODO: Enable stable-privacy mode for networkd, once PR#16618 has been released:
+         *       https://github.com/systemd/systemd/pull/16618 */
+        g_fprintf(stderr, "ERROR: %s: ipv6-address-generation mode is not supported by networkd\n", def->id);
         exit(1);
     }
     if (def->accept_ra == NETPLAN_RA_MODE_ENABLED)
@@ -563,7 +642,7 @@ write_network_file(const NetplanNetDefinition* def, const char* rootdir, const c
     if (def->type >= NETPLAN_DEF_TYPE_VIRTUAL)
         g_string_append(network, "ConfigureWithoutCarrier=yes\n");
 
-    if (def->bridge) {
+    if (def->bridge && def->backend != NETPLAN_BACKEND_OVS) {
         g_string_append_printf(network, "Bridge=%s\n", def->bridge);
 
         if (def->bridge_params.path_cost || def->bridge_params.port_priority)
@@ -573,14 +652,14 @@ write_network_file(const NetplanNetDefinition* def, const char* rootdir, const c
         if (def->bridge_params.port_priority)
             g_string_append_printf(network, "Priority=%u\n", def->bridge_params.port_priority);
     }
-    if (def->bond) {
+    if (def->bond && def->backend != NETPLAN_BACKEND_OVS) {
         g_string_append_printf(network, "Bond=%s\n", def->bond);
 
         if (def->bond_params.primary_slave)
             g_string_append_printf(network, "PrimarySlave=true\n");
     }
 
-    if (def->has_vlans) {
+    if (def->has_vlans && def->backend != NETPLAN_BACKEND_OVS) {
         /* iterate over all netdefs to find VLANs attached to us */
         GList *l = netdefs_ordered;
         const NetplanNetDefinition* nd;
@@ -604,6 +683,13 @@ write_network_file(const NetplanNetDefinition* def, const char* rootdir, const c
         }
     }
 
+    if (def->address_options) {
+        for (unsigned i = 0; i < def->address_options->len; ++i) {
+            NetplanAddressOptions* opts = g_array_index(def->address_options, NetplanAddressOptions*, i);
+            write_addr_option(opts, network);
+        }
+    }
+
     if (def->dhcp4 || def->dhcp6 || def->critical) {
         /* NetworkManager compatible route metrics */
         g_string_append(network, "\n[DHCP]\n");
@@ -812,19 +898,8 @@ write_wpa_unit(const NetplanNetDefinition* def, const char* rootdir)
 {
     g_autoptr(GError) err = NULL;
     g_autofree gchar *stdouth = NULL;
-    g_autofree gchar *stderrh = NULL;
-    gint exit_status = 0;
 
-    gchar *argv[] = {"bin" "/" "systemd-escape", def->id, NULL};
-    g_spawn_sync("/", argv, NULL, 0, NULL, NULL, &stdouth, &stderrh, &exit_status, &err);
-    g_spawn_check_exit_status(exit_status, &err);
-    if (err != NULL) {
-        // LCOV_EXCL_START
-        g_fprintf(stderr, "failed to ask systemd to escape %s; exit %d\nstdout: '%s'\nstderr: '%s'", def->id, exit_status, stdouth, stderrh);
-        exit(1);
-        // LCOV_EXCL_STOP
-    }
-    g_strstrip(stdouth);
+    stdouth = systemd_escape(def->id);
 
     GString* s = g_string_new("[Unit]\n");
     g_autofree char* path = g_strjoin(NULL, "/run/systemd/system/netplan-wpa-", stdouth, ".service", NULL);
@@ -863,6 +938,9 @@ write_wpa_conf(const NetplanNetDefinition* def, const char* rootdir)
             if (ap->bssid) {
                 g_string_append_printf(s, "  bssid=%s\n", ap->bssid);
             }
+            if (ap->hidden) {
+                g_string_append(s, "  scan_ssid=1\n");
+            }
             if (ap->band == NETPLAN_WIFI_BAND_24) {
                 // initialize 2.4GHz frequency hashtable
                 if(!wifi_frequency_24)
@@ -990,8 +1068,12 @@ cleanup_networkd_conf(const char* rootdir)
 {
     unlink_glob(rootdir, "/run/systemd/network/10-netplan-*");
     unlink_glob(rootdir, "/run/netplan/wpa-*.conf");
+    unlink_glob(rootdir, "/run/systemd/system/systemd-networkd.service.wants/netplan-wpa-*.service");
     unlink_glob(rootdir, "/run/systemd/system/netplan-wpa-*.service");
     unlink_glob(rootdir, "/run/udev/rules.d/99-netplan-*");
+    /* Historically (up to v0.98) we had netplan-wpa@*.service files, in case of an
+     * upgraded system, we need to make sure to clean those up. */
+    unlink_glob(rootdir, "/run/systemd/system/systemd-networkd.service.wants/netplan-wpa@*.service");
 }
 
 /**
diff --git a/src/networkd.h b/src/networkd.h
index 5629a04..41ab125 100644
--- a/src/networkd.h
+++ b/src/networkd.h
@@ -22,3 +22,5 @@
 gboolean write_networkd_conf(const NetplanNetDefinition* def, const char* rootdir);
 void cleanup_networkd_conf(const char* rootdir);
 void enable_networkd(const char* generator_dir);
+
+void write_network_file(const NetplanNetDefinition* def, const char* rootdir, const char* path);
diff --git a/src/nm.c b/src/nm.c
index 2cd1d52..9a377d0 100644
--- a/src/nm.c
+++ b/src/nm.c
@@ -28,6 +28,7 @@
 #include "nm.h"
 #include "parse.h"
 #include "util.h"
+#include "validation.h"
 
 GString* udev_rules;
 
@@ -111,6 +112,8 @@ type_str(const NetplanNetDefinition* def)
         case NETPLAN_DEF_TYPE_VLAN:
             return "vlan";
         case NETPLAN_DEF_TYPE_TUNNEL:
+            if (def->tunnel.mode == NETPLAN_TUNNEL_MODE_WIREGUARD)
+                return "wireguard";
             return "ip-tunnel";
         // LCOV_EXCL_START
         default:
@@ -201,23 +204,14 @@ write_routes(const NetplanNetDefinition* def, GString *s, int family)
                 exit(1);
             }
 
-            if (cur_route->scope && g_ascii_strcasecmp(cur_route->scope, "global") != 0) {
-                g_fprintf(stderr, "ERROR: %s: NetworkManager only supports global scoped routes\n", def->id);
-                exit(1);
-            }
-
-            if (cur_route->table != NETPLAN_ROUTE_TABLE_UNSPEC) {
-                g_fprintf(stderr, "ERROR: %s: NetworkManager does not support non-default routing tables\n", def->id);
-                exit(1);
-            }
-
-            if (cur_route->from) {
-                g_fprintf(stderr, "ERROR: %s: NetworkManager does not support routes with 'from'\n", def->id);
-                exit(1);
-            }
-
-            if (cur_route->onlink) {
-                g_fprintf(stderr, "ERROR: %s: NetworkManager does not support on-link routes\n", def->id);
+            if (!g_strcmp0(cur_route->scope, "global")) {
+                /* For IPv6 addresses, kernel and NetworkManager don't support a scope.
+                 * For IPv4 addresses, NetworkManager determines the scope of addresses on its own
+                 * ("link" for addresses without gateway, "global" for addresses with next-hop). */
+                g_debug("%s: NetworkManager does not support setting a scope for routes, it will auto-detect them.", def->id);
+            } else if (cur_route->scope) {
+                /* Error out if scope is not set to its default value of 'global' */
+                g_fprintf(stderr, "ERROR: %s: NetworkManager does not support setting a scope for routes\n", def->id);
                 exit(1);
             }
 
@@ -226,6 +220,21 @@ write_routes(const NetplanNetDefinition* def, GString *s, int family)
             if (cur_route->metric != NETPLAN_METRIC_UNSPEC)
                 g_string_append_printf(s, ",%d", cur_route->metric);
             g_string_append(s, "\n");
+
+            if (   cur_route->onlink
+                || cur_route->table != NETPLAN_ROUTE_TABLE_UNSPEC
+                || cur_route->from) {
+                g_string_append_printf(s, "route%d_options=", j);
+                if (cur_route->onlink) {
+                    /* onlink for IPv6 addresses is only supported since nm-1.18.0. */
+                    g_string_append_printf(s, "onlink=true,");
+                }
+                if (cur_route->table != NETPLAN_ROUTE_TABLE_UNSPEC)
+                    g_string_append_printf(s, "table=%u,", cur_route->table);
+                if (cur_route->from)
+                    g_string_append_printf(s, "src=%s,", cur_route->from);
+                s->str[s->len - 1] = '\n';
+            }
             j++;
         }
     }
@@ -322,6 +331,60 @@ write_bridge_params(const NetplanNetDefinition* def, GString *s)
 }
 
 static void
+write_wireguard_params(const NetplanNetDefinition* def, GString *s)
+{
+    g_assert(def->tunnel.private_key);
+    g_string_append(s, "\n[wireguard]\n");
+
+    /* The key was already validated via validate_tunnel_grammar(), but we need
+     * to differentiate between base64 key VS absolute path key-file. And a base64
+     * string could (theoretically) start with '/', so we use is_wireguard_key()
+     * as well to check for more specific characteristics (if needed). */
+    if (def->tunnel.private_key[0] == '/' && !is_wireguard_key(def->tunnel.private_key)) {
+        g_fprintf(stderr, "%s: private key needs to be base64 encoded when using the NM backend\n", def->id);
+        exit(1);
+    } else
+        g_string_append_printf(s, "private-key=%s\n", def->tunnel.private_key);
+
+    if (def->tunnel.port)
+        g_string_append_printf(s, "listen-port=%u\n", def->tunnel.port);
+    if (def->tunnel.fwmark)
+        g_string_append_printf(s, "fwmark=%u\n", def->tunnel.fwmark);
+
+    for (guint i = 0; i < def->wireguard_peers->len; i++) {
+        NetplanWireguardPeer *peer = g_array_index (def->wireguard_peers, NetplanWireguardPeer*, i);
+        g_assert(peer->public_key);
+        g_string_append_printf(s, "\n[wireguard-peer.%s]\n", peer->public_key);
+
+        if (peer->keepalive)
+            g_string_append_printf(s, "persistent-keepalive=%d\n", peer->keepalive);
+        if (peer->endpoint)
+            g_string_append_printf(s, "endpoint=%s\n", peer->endpoint);
+        /* The key was already validated via validate_tunnel_grammar(), but we need
+         * to differentiate between base64 key VS absolute path key-file. And a base64
+         * string could (theoretically) start with '/', so we use is_wireguard_key()
+         * as well to check for more specific characteristics (if needed). */
+        if (peer->preshared_key) {
+            if (peer->preshared_key[0] == '/' && !is_wireguard_key(peer->preshared_key)) {
+                g_fprintf(stderr, "%s: shared key needs to be base64 encoded when using the NM backend\n", def->id);
+                exit(1);
+            } else {
+                g_string_append_printf(s, "preshared-key=%s\n", peer->preshared_key);
+                g_string_append(s, "preshared-key-flags=0\n");
+            }
+        }
+        if (peer->allowed_ips && peer->allowed_ips->len > 0) {
+            g_string_append(s, "allowed-ips=");
+            for (guint i = 0; i < peer->allowed_ips->len; ++i) {
+                if (i > 0 ) g_string_append_c(s, ';');
+                g_string_append_printf(s, "%s", g_array_index(peer->allowed_ips, char*, i));
+            }
+            g_string_append_c(s, '\n');
+        }
+    }
+}
+
+static void
 write_tunnel_params(const NetplanNetDefinition* def, GString *s)
 {
     g_string_append(s, "\n[ip-tunnel]\n");
@@ -437,6 +500,7 @@ write_nm_conf_access_point(NetplanNetDefinition* def, const char* rootdir, const
     g_autofree char* conf_path = NULL;
     mode_t orig_umask;
     char uuidstr[37];
+    const char *match_interface_name = NULL;
 
     if (def->type == NETPLAN_DEF_TYPE_WIFI)
         g_assert(ap);
@@ -472,12 +536,10 @@ write_nm_conf_access_point(NetplanNetDefinition* def, const char* rootdir, const
         else if (!def->has_match)
             g_string_append_printf(s, "interface-name=%s\n", def->id);
         else if (def->match.original_name) {
-            /* NM does not support interface name globbing */
-            if (strpbrk(def->match.original_name, "*[]?")) {
-                g_fprintf(stderr, "ERROR: %s: NetworkManager definitions do not support name globbing\n", def->id);
-                exit(1);
-            }
-            g_string_append_printf(s, "interface-name=%s\n", def->match.original_name);
+            if (strpbrk(def->match.original_name, "*[]?"))
+                match_interface_name = def->match.original_name;
+            else
+                g_string_append_printf(s, "interface-name=%s\n", def->match.original_name);
         }
         /* else matches on something other than the name, do not restrict interface-name */
     } else {
@@ -609,8 +671,17 @@ write_nm_conf_access_point(NetplanNetDefinition* def, const char* rootdir, const
     if (def->type == NETPLAN_DEF_TYPE_BOND)
         write_bond_parameters(def, s);
 
-    if (def->type == NETPLAN_DEF_TYPE_TUNNEL)
-        write_tunnel_params(def, s);
+    if (def->type == NETPLAN_DEF_TYPE_TUNNEL) {
+        if (def->tunnel.mode == NETPLAN_TUNNEL_MODE_WIREGUARD)
+            write_wireguard_params(def, s);
+        else
+            write_tunnel_params(def, s);
+    }
+
+    if (match_interface_name) {
+        g_string_append(s, "\n[match]\n");
+        g_string_append_printf(s, "interface-name=%s;\n", match_interface_name);
+    }
 
     g_string_append(s, "\n[ipv4]\n");
 
@@ -660,7 +731,11 @@ write_nm_conf_access_point(NetplanNetDefinition* def, const char* rootdir, const
         if (def->ip6_addresses)
             for (unsigned i = 0; i < def->ip6_addresses->len; ++i)
                 g_string_append_printf(s, "address%i=%s\n", i+1, g_array_index(def->ip6_addresses, char*, i));
-        if (def->ip6_addr_gen_mode) {
+        if (def->ip6_addr_gen_token) {
+            /* Token implies EUI-64, i.e mode=0 */
+            g_string_append(s, "addr-gen-mode=0\n");
+            g_string_append_printf(s, "token=%s\n", def->ip6_addr_gen_token);
+        } else if (def->ip6_addr_gen_mode) {
             g_string_append_printf(s, "addr-gen-mode=%s\n", addr_gen_mode_str(def->ip6_addr_gen_mode));
         }
         if (def->ip6_privacy)
@@ -700,6 +775,9 @@ write_nm_conf_access_point(NetplanNetDefinition* def, const char* rootdir, const
         if (ap->bssid) {
             g_string_append_printf(s, "bssid=%s\n", ap->bssid);
         }
+        if (ap->hidden) {
+            g_string_append(s, "hidden=true\n");
+        }
         if (ap->band == NETPLAN_WIFI_BAND_5 || ap->band == NETPLAN_WIFI_BAND_24) {
             g_string_append_printf(s, "band=%s\n", wifi_band_str(ap->band));
             /* Channel is only unambiguous, if band is set. */
@@ -747,6 +825,11 @@ write_nm_conf(NetplanNetDefinition* def, const char* rootdir)
         exit(1);
     }
 
+    if (def->address_options) {
+        g_fprintf(stderr, "ERROR: %s: NetworkManager does not support address options\n", def->id);
+        exit(1);
+    }
+
     /* for wifi we need to create a separate connection file for every SSID */
     if (def->type == NETPLAN_DEF_TYPE_WIFI) {
         GHashTableIter iter;
diff --git a/src/openvswitch.c b/src/openvswitch.c
new file mode 100644
index 0000000..79068d1
--- /dev/null
+++ b/src/openvswitch.c
@@ -0,0 +1,484 @@
+/*
+ * Copyright (C) 2020 Canonical, Ltd.
+ * Author: Łukasz 'sil2100' Zemczak <[e-mail]>
+ *         Lukas 'slyon' Märdian <[e-mail]>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 3.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <unistd.h>
+#include <errno.h>
+
+#include <glib.h>
+#include <glib/gprintf.h>
+
+#include "openvswitch.h"
+#include "networkd.h"
+#include "parse.h"
+#include "util.h"
+
+static void
+write_ovs_systemd_unit(const char* id, const GString* cmds, const char* rootdir, gboolean physical, gboolean cleanup, const char* dependency)
+{
+    g_autofree gchar* id_escaped = NULL;
+    g_autofree char* link = g_strjoin(NULL, rootdir ?: "", "/run/systemd/system/systemd-networkd.service.wants/netplan-ovs-", id, ".service", NULL);
+    g_autofree char* path = g_strjoin(NULL, "/run/systemd/system/netplan-ovs-", id, ".service", NULL);
+
+    GString* s = g_string_new("[Unit]\n");
+    g_string_append_printf(s, "Description=OpenVSwitch configuration for %s\n", id);
+    g_string_append(s, "DefaultDependencies=no\n");
+    /* run any ovs-netplan unit only after openvswitch-switch.service is ready */
+    g_string_append_printf(s, "Wants=openvswitch-switch.service\n");
+    g_string_append_printf(s, "After=openvswitch-switch.service\n");
+    if (physical) {
+        id_escaped = systemd_escape((char*) id);
+        g_string_append_printf(s, "Requires=sys-subsystem-net-devices-%s.device\n", id_escaped);
+        g_string_append_printf(s, "After=sys-subsystem-net-devices-%s.device\n", id_escaped);
+    }
+    if (!cleanup) {
+        g_string_append_printf(s, "After=netplan-ovs-cleanup.service\n");
+    } else {
+        /* The netplan-ovs-cleanup unit shall not run on systems where openvswitch is not installed. */
+        g_string_append(s, "ConditionFileIsExecutable=" OPENVSWITCH_OVS_VSCTL "\n");
+    }
+    g_string_append(s, "Before=network.target\nWants=network.target\n");
+    if (dependency) {
+        g_string_append_printf(s, "Requires=netplan-ovs-%s.service\n", dependency);
+        g_string_append_printf(s, "After=netplan-ovs-%s.service\n", dependency);
+    }
+
+    g_string_append(s, "\n[Service]\nType=oneshot\n");
+    g_string_append(s, cmds->str);
+
+    g_string_free_to_file(s, rootdir, path, NULL);
+
+    safe_mkdir_p_dir(link);
+    if (symlink(path, link) < 0 && errno != EEXIST) {
+        // LCOV_EXCL_START
+        g_fprintf(stderr, "failed to create enablement symlink: %m\n");
+        exit(1);
+        // LCOV_EXCL_STOP
+    }
+}
+
+#define append_systemd_cmd(s, command, ...) \
+{ \
+    g_string_append(s, "ExecStart="); \
+    g_string_append_printf(s, command, __VA_ARGS__); \
+    g_string_append(s, "\n"); \
+}
+
+static char*
+netplan_type_to_table_name(const NetplanDefType type)
+{
+    switch (type) {
+        case NETPLAN_DEF_TYPE_BRIDGE:
+            return "Bridge";
+        case NETPLAN_DEF_TYPE_BOND:
+        case NETPLAN_DEF_TYPE_PORT:
+            return "Port";
+        default: /* For regular interfaces and others */
+            return "Interface";
+    }
+}
+
+static gboolean
+netplan_type_is_physical(const NetplanDefType type)
+{
+    switch (type) {
+        case NETPLAN_DEF_TYPE_ETHERNET:
+        // case NETPLAN_DEF_TYPE_WIFI:
+        // case NETPLAN_DEF_TYPE_MODEM:
+            return TRUE;
+        default:
+            return FALSE;
+    }
+}
+
+static void
+write_ovs_tag_setting(const gchar* id, const char* type, const char* col, const char* key, const char* value, GString* cmds)
+{
+    g_assert(col);
+    g_assert(value);
+    g_autofree char *clean_value = g_strdup(value);
+    /* Replace " " -> "," if value contains spaces */
+    if (strchr(value, ' ')) {
+        char **split = g_strsplit(value, " ", -1);
+        g_free(clean_value);
+        clean_value = g_strjoinv(",", split);
+        g_strfreev(split);
+    }
+
+    GString* s = g_string_new("external-ids:netplan/");
+    g_string_append_printf(s, "%s", col);
+    if (key)
+        g_string_append_printf(s, "/%s", key);
+    g_string_append_printf(s, "=%s", clean_value);
+    append_systemd_cmd(cmds, OPENVSWITCH_OVS_VSCTL " set %s %s %s", type, id, s->str);
+    g_string_free(s, TRUE);
+}
+
+static void
+write_ovs_additional_data(GHashTable *data, const char* type, const gchar* id, GString* cmds, const char* setting)
+{
+    GHashTableIter iter;
+    gchar* key;
+    gchar* value;
+
+    g_hash_table_iter_init(&iter, data);
+    while (g_hash_table_iter_next(&iter, (gpointer) &key, (gpointer) &value)) {
+        /* XXX: we need to check what happens when an invalid key=value pair
+            gets supplied here. We might want to handle this somehow. */
+        append_systemd_cmd(cmds, OPENVSWITCH_OVS_VSCTL " set %s %s %s:%s=%s",
+                           type, id, setting, key, value);
+        write_ovs_tag_setting(id, type, setting, key, value, cmds);
+    }
+}
+
+static void
+setup_patch_port(GString* s, const NetplanNetDefinition* def)
+{
+    /* Execute the setup commands to create an OVS patch port atomically within
+     * the same command where this virtual interface is created. Either as a
+     * Port+Interface of an OVS bridge or as a Interface of an OVS bond. This
+     * avoids delays in the PatchPort creation and thus potential races. */
+    g_assert(def->type == NETPLAN_DEF_TYPE_PORT);
+    g_string_append_printf(s, " -- set Interface %s type=patch options:peer=%s",
+                           def->id, def->peer);
+}
+
+static char*
+write_ovs_bond_interfaces(const NetplanNetDefinition* def, GString* cmds)
+{
+    NetplanNetDefinition* tmp_nd;
+    GHashTableIter iter;
+    gchar* key;
+    guint i = 0;
+    GString* s = NULL;
+    GString* patch_ports = g_string_new("");
+
+    if (!def->bridge) {
+        g_fprintf(stderr, "Bond %s needs to be a slave of an OpenVSwitch bridge\n", def->id);
+        exit(1);
+    }
+
+    s = g_string_new(OPENVSWITCH_OVS_VSCTL " --may-exist add-bond");
+    g_string_append_printf(s, " %s %s", def->bridge, def->id);
+
+    g_hash_table_iter_init(&iter, netdefs);
+    while (g_hash_table_iter_next(&iter, (gpointer) &key, (gpointer) &tmp_nd)) {
+        if (!g_strcmp0(def->id, tmp_nd->bond)) {
+            /* Append and count bond interfaces */
+            g_string_append_printf(s, " %s", tmp_nd->id);
+            i++;
+            if (tmp_nd->type == NETPLAN_DEF_TYPE_PORT)
+                setup_patch_port(patch_ports, tmp_nd);
+        }
+    }
+    if (i < 2) {
+        g_fprintf(stderr, "Bond %s needs to have at least 2 slave interfaces\n", def->id);
+        exit(1);
+    }
+
+    g_string_append(s, patch_ports->str);
+    g_string_free(patch_ports, TRUE);
+    append_systemd_cmd(cmds, s->str, def->bridge, def->id);
+    g_string_free(s, TRUE);
+    return def->bridge;
+}
+
+static void
+write_ovs_tag_netplan(const gchar* id, const char* type, GString* cmds)
+{
+    /* Mark this bridge/port/interface as created by netplan */
+    append_systemd_cmd(cmds, OPENVSWITCH_OVS_VSCTL " set %s %s external-ids:netplan=true",
+                       type, id);
+}
+
+static void
+write_ovs_bond_mode(const NetplanNetDefinition* def, GString* cmds)
+{
+    char* value = NULL;
+    /* OVS supports only "active-backup", "balance-tcp" and "balance-slb":
+     * http://www.openvswitch.org/support/dist-docs/ovs-vswitchd.conf.db.5.txt */
+    if (!strcmp(def->bond_params.mode, "active-backup") ||
+        !strcmp(def->bond_params.mode, "balance-tcp") ||
+        !strcmp(def->bond_params.mode, "balance-slb")) {
+        value = def->bond_params.mode;
+        append_systemd_cmd(cmds, OPENVSWITCH_OVS_VSCTL " set Port %s bond_mode=%s", def->id, value);
+        write_ovs_tag_setting(def->id, "Port", "bond_mode", NULL, value, cmds);
+    } else {
+        g_fprintf(stderr, "%s: bond mode '%s' not supported by openvswitch\n",
+                  def->id, def->bond_params.mode);
+        exit(1);
+    }
+}
+
+static void
+write_ovs_bridge_interfaces(const NetplanNetDefinition* def, GString* cmds)
+{
+    NetplanNetDefinition* tmp_nd;
+    GHashTableIter iter;
+    gchar* key;
+
+    append_systemd_cmd(cmds, OPENVSWITCH_OVS_VSCTL " --may-exist add-br %s", def->id);
+
+    g_hash_table_iter_init(&iter, netdefs);
+    while (g_hash_table_iter_next(&iter, (gpointer) &key, (gpointer) &tmp_nd)) {
+        /* OVS bonds will connect to their OVS bridge and create the interface/port themselves */
+        if ((tmp_nd->type != NETPLAN_DEF_TYPE_BOND || tmp_nd->backend != NETPLAN_BACKEND_OVS)
+            && !g_strcmp0(def->id, tmp_nd->bridge)) {
+            GString * patch_ports = g_string_new("");
+            if (tmp_nd->type == NETPLAN_DEF_TYPE_PORT)
+                setup_patch_port(patch_ports, tmp_nd);
+            append_systemd_cmd(cmds, OPENVSWITCH_OVS_VSCTL " --may-exist add-port %s %s%s",
+                               def->id, tmp_nd->id, patch_ports->str);
+            g_string_free(patch_ports, TRUE);
+        }
+    }
+}
+
+static void
+write_ovs_protocols(const NetplanOVSSettings* ovs_settings, const gchar* bridge, GString* cmds)
+{
+    g_assert(bridge);
+    GString* s = g_string_new(g_array_index(ovs_settings->protocols, char*, 0));
+
+    for (unsigned i = 1; i < ovs_settings->protocols->len; ++i)
+        g_string_append_printf(s, ",%s", g_array_index(ovs_settings->protocols, char*, i));
+
+    append_systemd_cmd(cmds, OPENVSWITCH_OVS_VSCTL " set Bridge %s protocols=%s", bridge, s->str);
+    write_ovs_tag_setting(bridge, "Bridge", "protocols", NULL, s->str, cmds);
+    g_string_free(s, TRUE);
+}
+
+static gboolean
+check_ovs_ssl(gchar* target)
+{
+    /* Check if target needs ssl */
+    if (g_str_has_prefix(target, "ssl:") || g_str_has_prefix(target, "pssl:")) {
+        /* Check if SSL is configured in ovs_settings_global.ssl */
+        if (!ovs_settings_global.ssl.ca_certificate || !ovs_settings_global.ssl.client_certificate ||
+            !ovs_settings_global.ssl.client_key) {
+            g_fprintf(stderr, "ERROR: openvswitch bridge controller target '%s' needs SSL configuration, but global 'openvswitch.ssl' settings are not set\n", target);
+            exit(1);
+        }
+        return TRUE;
+    }
+    return FALSE;
+}
+
+static void
+write_ovs_bridge_controller_targets(const NetplanOVSController* controller, const gchar* bridge, GString* cmds)
+{
+    gchar* target = g_array_index(controller->addresses, char*, 0);
+    gboolean needs_ssl = check_ovs_ssl(target);
+    GString* s = g_string_new(target);
+
+    for (unsigned i = 1; i < controller->addresses->len; ++i) {
+        target = g_array_index(controller->addresses, char*, i);
+        if (!needs_ssl)
+            needs_ssl = check_ovs_ssl(target);
+        g_string_append_printf(s, " %s", target);
+    }
+
+    append_systemd_cmd(cmds, OPENVSWITCH_OVS_VSCTL " set-controller %s %s", bridge, s->str);
+    write_ovs_tag_setting(bridge, "Bridge", "global", "set-controller", s->str, cmds);
+    g_string_free(s, TRUE);
+}
+
+/**
+ * Generate the OpenVSwitch systemd units for configuration of the selected netdef
+ * @rootdir: If not %NULL, generate configuration in this root directory
+ *           (useful for testing).
+ */
+void
+write_ovs_conf(const NetplanNetDefinition* def, const char* rootdir)
+{
+    GString* cmds = g_string_new(NULL);
+    gchar* dependency = NULL;
+    const char* type = netplan_type_to_table_name(def->type);
+    g_autofree char* base_config_path = NULL;
+    char* value = NULL;
+
+    /* TODO: maybe dynamically query the ovs-vsctl tool path? */
+
+    /* For OVS specific settings, we expect the backend to be set to OVS.
+     * The OVS backend is implicitly set, if an interface contains an empty "openvswitch: {}"
+     * key, or an "openvswitch:" key, containing more than "external-ids" and/or "other-config". */
+    if (def->backend == NETPLAN_BACKEND_OVS) {
+        switch (def->type) {
+            case NETPLAN_DEF_TYPE_BOND:
+                dependency = write_ovs_bond_interfaces(def, cmds);
+                write_ovs_tag_netplan(def->id, type, cmds);
+                /* Set LACP mode, default to "off" */
+                value = def->ovs_settings.lacp? def->ovs_settings.lacp : "off";
+                append_systemd_cmd(cmds, OPENVSWITCH_OVS_VSCTL " set Port %s lacp=%s", def->id, value);
+                write_ovs_tag_setting(def->id, type, "lacp", NULL, value, cmds);
+                if (def->bond_params.mode) {
+                    write_ovs_bond_mode(def, cmds);
+                }
+                break;
+
+            case NETPLAN_DEF_TYPE_BRIDGE:
+                write_ovs_bridge_interfaces(def, cmds);
+                write_ovs_tag_netplan(def->id, type, cmds);
+                /* Set fail-mode, default to "standalone" */
+                value = def->ovs_settings.fail_mode? def->ovs_settings.fail_mode : "standalone";
+                append_systemd_cmd(cmds, OPENVSWITCH_OVS_VSCTL " set-fail-mode %s %s", def->id, value);
+                write_ovs_tag_setting(def->id, type, "global", "set-fail-mode", value, cmds);
+                /* Enable/disable mcast-snooping */ 
+                value = def->ovs_settings.mcast_snooping? "true" : "false";
+                append_systemd_cmd(cmds, OPENVSWITCH_OVS_VSCTL " set Bridge %s mcast_snooping_enable=%s", def->id, value);
+                write_ovs_tag_setting(def->id, type, "mcast_snooping_enable", NULL, value, cmds);
+                /* Enable/disable rstp */
+                value = def->ovs_settings.rstp? "true" : "false";
+                append_systemd_cmd(cmds, OPENVSWITCH_OVS_VSCTL " set Bridge %s rstp_enable=%s", def->id, value);
+                write_ovs_tag_setting(def->id, type, "rstp_enable", NULL, value, cmds);
+                /* Set protocols */
+                if (def->ovs_settings.protocols && def->ovs_settings.protocols->len > 0) {
+                    write_ovs_protocols(&(def->ovs_settings), def->id, cmds);
+                } else if (ovs_settings_global.protocols && ovs_settings_global.protocols->len > 0) {
+                    write_ovs_protocols(&(ovs_settings_global), def->id, cmds);
+                }
+                /* Set controller target addresses */
+                if (def->ovs_settings.controller.addresses && def->ovs_settings.controller.addresses->len > 0) {
+                    write_ovs_bridge_controller_targets(&(def->ovs_settings.controller), def->id, cmds);
+                    /* Set controller connection mode, only applicable if at least one controller target address was set */
+                    if (def->ovs_settings.controller.connection_mode) {
+                        value = def->ovs_settings.controller.connection_mode;
+                        append_systemd_cmd(cmds, OPENVSWITCH_OVS_VSCTL " set Controller %s connection-mode=%s", def->id, value);
+                        write_ovs_tag_setting(def->id, "Controller", "connection-mode", NULL, value, cmds);
+                    }
+                }
+                break;
+
+            case NETPLAN_DEF_TYPE_PORT:
+                g_assert(def->peer);
+                dependency = def->bridge?: def->bond;
+                if (!dependency) {
+                    g_fprintf(stderr, "%s: OpenVSwitch patch port needs to be assigned to a bridge/bond\n", def->id);
+                    exit(1);
+                }
+                /* There is no OVS Port which we could tag netplan=true if this
+                 * patch port is assigned as an OVS bond interface. Tag the
+                 * Interface instead, to clean it up from a bond. */
+                if (def->bond)
+                    write_ovs_tag_netplan(def->id, "Interface", cmds);
+                else
+                    write_ovs_tag_netplan(def->id, type, cmds);
+                break;
+
+            case NETPLAN_DEF_TYPE_VLAN:
+                g_assert(def->vlan_link);
+                dependency = def->vlan_link->id;
+                /* Create a fake VLAN bridge */
+                append_systemd_cmd(cmds, OPENVSWITCH_OVS_VSCTL " --may-exist add-br %s %s %i", def->id, def->vlan_link->id, def->vlan_id)
+                write_ovs_tag_netplan(def->id, type, cmds);
+                break;
+
+            default:
+                g_fprintf(stderr, "%s: This device type is not supported with the OpenVSwitch backend\n", def->id);
+                exit(1);
+                break;
+        }
+
+        /* Try writing out a base config */
+        base_config_path = g_strjoin(NULL, "run/systemd/network/10-netplan-", def->id, NULL);
+        write_network_file(def, rootdir, base_config_path);
+    } else {
+        /* Other interfaces must be part of an OVS bridge or bond to carry additional data */
+        if (   (def->ovs_settings.external_ids && g_hash_table_size(def->ovs_settings.external_ids) > 0)
+            || (def->ovs_settings.other_config && g_hash_table_size(def->ovs_settings.other_config) > 0)) {
+            dependency = def->bridge?: def->bond;
+            if (!dependency) {
+                g_fprintf(stderr, "%s: Interface needs to be assigned to an OVS bridge/bond to carry external-ids/other-config\n", def->id);
+                exit(1);
+            }
+        } else {
+            g_debug("openvswitch: definition %s is not for us (backend %i)", def->id, def->backend);
+            return;
+        }
+    }
+
+    /* Set "external-ids" and "other-config" after NETPLAN_BACKEND_OVS interfaces, as bonds,
+     * bridges, etc. might just be created before.*/
+
+    /* Common OVS settings can be specified even for non-OVS interfaces */
+    if (def->ovs_settings.external_ids && g_hash_table_size(def->ovs_settings.external_ids) > 0) {
+        write_ovs_additional_data(def->ovs_settings.external_ids, type,
+                                  def->id, cmds, "external-ids");
+    }
+
+    if (def->ovs_settings.other_config && g_hash_table_size(def->ovs_settings.other_config) > 0) {
+        write_ovs_additional_data(def->ovs_settings.other_config, type,
+                                  def->id, cmds, "other-config");
+    }
+
+    /* If we need to configure anything for this netdef, write the required systemd unit */
+    if (cmds->len > 0)
+        write_ovs_systemd_unit(def->id, cmds, rootdir, netplan_type_is_physical(def->type), FALSE, dependency);
+    g_string_free(cmds, TRUE);
+}
+
+/**
+ * Finalize the OpenVSwitch configuration (global config)
+ */
+void
+write_ovs_conf_finish(const char* rootdir)
+{
+    GString* cmds = g_string_new(NULL);
+
+    /* Global external-ids and other-config settings */
+    if (ovs_settings_global.external_ids && g_hash_table_size(ovs_settings_global.external_ids) > 0) {
+        write_ovs_additional_data(ovs_settings_global.external_ids, "open_vswitch",
+                                  ".", cmds, "external-ids");
+    }
+
+    if (ovs_settings_global.other_config && g_hash_table_size(ovs_settings_global.other_config) > 0) {
+        write_ovs_additional_data(ovs_settings_global.other_config, "open_vswitch",
+                                  ".", cmds, "other-config");
+    }
+
+    if (ovs_settings_global.ssl.client_key && ovs_settings_global.ssl.client_certificate &&
+        ovs_settings_global.ssl.ca_certificate) {
+        GString* value = g_string_new(NULL);
+        g_string_printf(value, "%s %s %s",
+                        ovs_settings_global.ssl.client_key,
+                        ovs_settings_global.ssl.client_certificate,
+                        ovs_settings_global.ssl.ca_certificate);
+        append_systemd_cmd(cmds, OPENVSWITCH_OVS_VSCTL " set-ssl %s", value->str);
+        write_ovs_tag_setting(".", "open_vswitch", "global", "set-ssl", value->str, cmds);
+        g_string_free(value, TRUE);
+    }
+
+    if (cmds->len > 0)
+        write_ovs_systemd_unit("global", cmds, rootdir, FALSE, FALSE, NULL);
+    g_string_free(cmds, TRUE);
+
+    /* Clear all netplan=true tagged ports/bonds and bridges, via 'netplan apply --only-ovs-cleanup' */
+    cmds = g_string_new(NULL);
+    append_systemd_cmd(cmds, "/usr/sbin/netplan apply %s", "--only-ovs-cleanup");
+    write_ovs_systemd_unit("cleanup", cmds, rootdir, FALSE, TRUE, NULL);
+    g_string_free(cmds, TRUE);
+}
+
+/**
+ * Clean up all generated configurations in @rootdir from previous runs.
+ */
+void
+cleanup_ovs_conf(const char* rootdir)
+{
+    unlink_glob(rootdir, "/run/systemd/system/systemd-networkd.service.wants/netplan-ovs-*.service");
+    unlink_glob(rootdir, "/run/systemd/system/netplan-ovs-*.service");
+}
diff --git a/src/openvswitch.h b/src/openvswitch.h
new file mode 100644
index 0000000..69bd6ee
--- /dev/null
+++ b/src/openvswitch.h
@@ -0,0 +1,24 @@
+/*
+ * Copyright (C) 2020 Canonical, Ltd.
+ * Author: Łukasz 'sil2100' Zemczak <[e-mail]>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 3.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#pragma once
+
+#include "parse.h"
+
+void write_ovs_conf(const NetplanNetDefinition* def, const char* rootdir);
+void write_ovs_conf_finish(const char* rootdir);
+void cleanup_ovs_conf(const char* rootdir);
diff --git a/src/parse.c b/src/parse.c
index c1dc175..2732f78 100644
--- a/src/parse.c
+++ b/src/parse.c
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2016 Canonical, Ltd.
  * Author: Martin Pitt <[e-mail]>
+ *         Lukas Märdian <[e-mail]>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -31,11 +32,14 @@
 #include "validation.h"
 
 /* convenience macro to put the offset of a NetplanNetDefinition field into "void* data" */
+#define access_point_offset(field) GUINT_TO_POINTER(offsetof(NetplanWifiAccessPoint, field))
+#define addr_option_offset(field) GUINT_TO_POINTER(offsetof(NetplanAddressOptions, field))
+#define auth_offset(field) GUINT_TO_POINTER(offsetof(NetplanAuthenticationSettings, field))
+#define ip_rule_offset(field) GUINT_TO_POINTER(offsetof(NetplanIPRule, field))
 #define netdef_offset(field) GUINT_TO_POINTER(offsetof(NetplanNetDefinition, field))
+#define ovs_settings_offset(field) GUINT_TO_POINTER(offsetof(NetplanOVSSettings, field))
 #define route_offset(field) GUINT_TO_POINTER(offsetof(NetplanIPRoute, field))
-#define ip_rule_offset(field) GUINT_TO_POINTER(offsetof(NetplanIPRule, field))
-#define auth_offset(field) GUINT_TO_POINTER(offsetof(NetplanAuthenticationSettings, field))
-#define access_point_offset(field) GUINT_TO_POINTER(offsetof(NetplanWifiAccessPoint, field))
+#define wireguard_peer_offset(field) GUINT_TO_POINTER(offsetof(NetplanWireguardPeer, field))
 
 /* NetplanNetDefinition that is currently being processed */
 static NetplanNetDefinition* cur_netdef;
@@ -43,14 +47,22 @@ static NetplanNetDefinition* cur_netdef;
 /* NetplanWifiAccessPoint that is currently being processed */
 static NetplanWifiAccessPoint* cur_access_point;
 
-/* authentication options that are currently being processed */
+/* NetplanAuthenticationSettings that are currently being processed */
 static NetplanAuthenticationSettings* cur_auth;
 
+/* NetplanWireguardPeer that is currently being processed */
+static NetplanWireguardPeer* cur_wireguard_peer;
+
+static NetplanAddressOptions* cur_addr_option;
+
 static NetplanIPRoute* cur_route;
 static NetplanIPRule* cur_ip_rule;
 
 static NetplanBackend backend_global, backend_cur_type;
 
+/* global OpenVSwitch settings */
+NetplanOVSSettings ovs_settings_global;
+
 /* Global ID → NetplanNetDefinition* map for all parsed config files */
 GHashTable* netdefs;
 
@@ -62,6 +74,11 @@ GList* netdefs_ordered;
  * existing definition */
 static GHashTable* ids_in_file;
 
+/* Global variables, defined in this file */
+int missing_ids_found;
+const char* current_file;
+GHashTable* missing_id;
+
 /**
  * Load YAML file name into a yaml_document_t.
  *
@@ -173,6 +190,57 @@ assert_valid_id(yaml_node_t* node, GError** error)
     return TRUE;
 }
 
+static void
+initialize_dhcp_overrides(NetplanDHCPOverrides* overrides)
+{
+    overrides->use_dns = TRUE;
+    overrides->use_domains = NULL;
+    overrides->use_ntp = TRUE;
+    overrides->send_hostname = TRUE;
+    overrides->use_hostname = TRUE;
+    overrides->use_mtu = TRUE;
+    overrides->use_routes = TRUE;
+    overrides->hostname = NULL;
+    overrides->metric = NETPLAN_METRIC_UNSPEC;
+}
+
+static void
+initialize_ovs_settings(NetplanOVSSettings* ovs_settings)
+{
+    ovs_settings->mcast_snooping = FALSE;
+    ovs_settings->rstp = FALSE;
+}
+
+static  NetplanNetDefinition*
+netplan_netdef_new(const char* id, NetplanDefType type, NetplanBackend backend)
+{
+    /* create new network definition */
+    cur_netdef = g_new0(NetplanNetDefinition, 1);
+    cur_netdef->type = type;
+    cur_netdef->backend = backend ?: NETPLAN_BACKEND_NONE;
+    cur_netdef->id = g_strdup(id);
+
+    /* Set some default values */
+    cur_netdef->vlan_id = G_MAXUINT; /* 0 is a valid ID */
+    cur_netdef->tunnel.mode = NETPLAN_TUNNEL_MODE_UNKNOWN;
+    cur_netdef->dhcp_identifier = g_strdup("duid"); /* keep networkd's default */
+    /* systemd-networkd defaults to IPv6 LL enabled; keep that default */
+    cur_netdef->linklocal.ipv6 = TRUE;
+    cur_netdef->sriov_vlan_filter = FALSE;
+    cur_netdef->sriov_explicit_vf_count = G_MAXUINT; /* 0 is a valid number of VFs */
+
+    /* DHCP override defaults */
+    initialize_dhcp_overrides(&cur_netdef->dhcp4_overrides);
+    initialize_dhcp_overrides(&cur_netdef->dhcp6_overrides);
+
+    /* OpenVSwitch defaults */
+    initialize_ovs_settings(&cur_netdef->ovs_settings);
+
+    g_hash_table_insert(netdefs, cur_netdef->id, cur_netdef);
+    netdefs_ordered = g_list_append(netdefs_ordered, cur_netdef);
+    return cur_netdef;
+}
+
 /****************************************************
  * Data types and functions for interpreting YAML nodes
  ****************************************************/
@@ -216,7 +284,7 @@ get_handler(const mapping_entry_handler* handlers, const char* key)
  * Returns: TRUE on success, FALSE on error (@error gets set then).
  */
 static gboolean
-process_mapping(yaml_document_t* doc, yaml_node_t* node, const mapping_entry_handler* handlers, GError** error)
+process_mapping(yaml_document_t* doc, yaml_node_t* node, const mapping_entry_handler* handlers, GList** out_values, GError** error)
 {
     yaml_node_pair_t* entry;
 
@@ -235,10 +303,12 @@ process_mapping(yaml_document_t* doc, yaml_node_t* node, const mapping_entry_han
         if (!h)
             return yaml_error(key, error, "unknown key '%s'", scalar(key));
         assert_type(value, h->type);
+        if (out_values)
+            *out_values = g_list_prepend(*out_values, g_strdup(scalar(key)));
         if (h->map_handlers) {
             g_assert(h->handler == NULL);
             g_assert(h->type == YAML_MAPPING_NODE);
-            if (!process_mapping(doc, value, h->map_handlers, error))
+            if (!process_mapping(doc, value, h->map_handlers, NULL, error))
                 return FALSE;
         } else {
             if (!h->handler(doc, value, h->data, error))
@@ -317,6 +387,65 @@ handle_generic_mac(yaml_document_t* doc, yaml_node_t* node, void* entryptr, cons
     return handle_generic_str(doc, node, entryptr, data, error);
 }
 
+/*
+ * Handler for setting a boolean field from a scalar node, inside a given struct
+ * @entryptr: pointer to the beginning of the to-be-modified data structure
+ * @data: offset into entryptr struct where the boolean field to write is located
+ */
+static gboolean
+handle_generic_bool(yaml_document_t* doc, yaml_node_t* node, void* entryptr, const void* data, GError** error)
+{
+    g_assert(entryptr);
+    guint offset = GPOINTER_TO_UINT(data);
+    gboolean v;
+
+    if (g_ascii_strcasecmp(scalar(node), "true") == 0 ||
+        g_ascii_strcasecmp(scalar(node), "on") == 0 ||
+        g_ascii_strcasecmp(scalar(node), "yes") == 0 ||
+        g_ascii_strcasecmp(scalar(node), "y") == 0)
+        v = TRUE;
+    else if (g_ascii_strcasecmp(scalar(node), "false") == 0 ||
+        g_ascii_strcasecmp(scalar(node), "off") == 0 ||
+        g_ascii_strcasecmp(scalar(node), "no") == 0 ||
+        g_ascii_strcasecmp(scalar(node), "n") == 0)
+        v = FALSE;
+    else
+        return yaml_error(node, error, "invalid boolean value '%s'", scalar(node));
+
+    *((gboolean*) ((void*) entryptr + offset)) = v;
+    return TRUE;
+}
+
+/*
+ * Handler for setting a HashTable field from a mapping node, inside a given struct
+ * @entryptr: pointer to the beginning of the to-be-modified data structure
+ * @data: offset into entryptr struct where the boolean field to write is located
+*/
+static gboolean
+handle_generic_map(yaml_document_t* doc, yaml_node_t* node, void* entryptr, const void* data, GError** error)
+{
+    guint offset = GPOINTER_TO_UINT(data);
+    GHashTable** map = (GHashTable**) ((void*) entryptr + offset);
+    if (!*map)
+        *map = g_hash_table_new(g_str_hash, g_str_equal);
+
+    for (yaml_node_pair_t* entry = node->data.mapping.pairs.start; entry < node->data.mapping.pairs.top; entry++) {
+        yaml_node_t* key, *value;
+
+        key = yaml_document_get_node(doc, entry->key);
+        value = yaml_document_get_node(doc, entry->value);
+
+        assert_type(key, YAML_SCALAR_NODE);
+        assert_type(value, YAML_SCALAR_NODE);
+
+        /* TODO: make sure we free all the memory here */
+        if (!g_hash_table_insert(*map, g_strdup(scalar(key)), g_strdup(scalar(value))))
+            return yaml_error(node, error, "duplicate map entry '%s'", scalar(key));
+    }
+
+    return TRUE;
+}
+
 /**
  * Generic handler for setting a cur_netdef string field from a scalar node
  * @data: offset into NetplanNetDefinition where the const char* field to write is
@@ -343,7 +472,9 @@ handle_netdef_id(yaml_document_t* doc, yaml_node_t* node, const void* data, GErr
 
 /**
  * Generic handler for setting a cur_netdef ID/iface name field referring to an
- * existing ID from a scalar node
+ * existing ID from a scalar node. This handler also includes a special case
+ * handler for OVS VLANs, switching the backend implicitly to OVS for such
+ * interfaces
  * @data: offset into NetplanNetDefinition where the NetplanNetDefinition* field to write is
  *        located
  */
@@ -358,6 +489,11 @@ handle_netdef_id_ref(yaml_document_t* doc, yaml_node_t* node, const void* data, 
         add_missing_node(node);
     } else {
         *((NetplanNetDefinition**) ((void*) cur_netdef + offset)) = ref;
+
+        if (cur_netdef->type == NETPLAN_DEF_TYPE_VLAN && ref->backend == NETPLAN_BACKEND_OVS) {
+            g_debug("%s: VLAN defined for openvswitch interface, choosing OVS backend", cur_netdef->id);
+            cur_netdef->backend = NETPLAN_BACKEND_OVS;
+        }
     }
     return TRUE;
 }
@@ -381,24 +517,7 @@ handle_netdef_mac(yaml_document_t* doc, yaml_node_t* node, const void* data, GEr
 static gboolean
 handle_netdef_bool(yaml_document_t* doc, yaml_node_t* node, const void* data, GError** error)
 {
-    guint offset = GPOINTER_TO_UINT(data);
-    gboolean v;
-
-    if (g_ascii_strcasecmp(scalar(node), "true") == 0 ||
-        g_ascii_strcasecmp(scalar(node), "on") == 0 ||
-        g_ascii_strcasecmp(scalar(node), "yes") == 0 ||
-        g_ascii_strcasecmp(scalar(node), "y") == 0)
-        v = TRUE;
-    else if (g_ascii_strcasecmp(scalar(node), "false") == 0 ||
-        g_ascii_strcasecmp(scalar(node), "off") == 0 ||
-        g_ascii_strcasecmp(scalar(node), "no") == 0 ||
-        g_ascii_strcasecmp(scalar(node), "n") == 0)
-        v = FALSE;
-    else
-        return yaml_error(node, error, "invalid boolean value '%s'", scalar(node));
-
-    *((gboolean*) ((void*) cur_netdef + offset)) = v;
-    return TRUE;
+    return handle_generic_bool(doc, node, cur_netdef, data, error);
 }
 
 /**
@@ -484,6 +603,22 @@ handle_netdef_addrgen(yaml_document_t* doc, yaml_node_t* node, const void* _, GE
     return TRUE;
 }
 
+static gboolean
+handle_netdef_addrtok(yaml_document_t* doc, yaml_node_t* node, const void* data, GError** error)
+{
+    g_assert(cur_netdef);
+    gboolean ret = handle_netdef_str(doc, node, data, error);
+    if (!is_ip6_address(cur_netdef->ip6_addr_gen_token))
+        return yaml_error(node, error, "invalid ipv6-address-token '%s'", scalar(node));
+    return ret;
+}
+
+static gboolean
+handle_netdef_map(yaml_document_t* doc, yaml_node_t* node, const void* data, GError** error)
+{
+    g_assert(cur_netdef);
+    return handle_generic_map(doc, node, cur_netdef, data, error);
+}
 
 /****************************************************
  * Grammar and handlers for network config "match" entry
@@ -585,6 +720,12 @@ handle_access_point_mac(yaml_document_t* doc, yaml_node_t* node, const void* dat
 }
 
 static gboolean
+handle_access_point_bool(yaml_document_t* doc, yaml_node_t* node, const void* data, GError** error)
+{
+    return handle_generic_bool(doc, node, cur_access_point, data, error);
+}
+
+static gboolean
 handle_access_point_password(yaml_document_t* doc, yaml_node_t* node, const void* _, GError** error)
 {
     g_assert(cur_access_point);
@@ -605,7 +746,7 @@ handle_access_point_auth(yaml_document_t* doc, yaml_node_t* node, const void* _,
     cur_access_point->has_auth = TRUE;
 
     cur_auth = &cur_access_point->auth;
-    ret = process_mapping(doc, node, auth_handlers, error);
+    ret = process_mapping(doc, node, auth_handlers, NULL, error);
     cur_auth = NULL;
 
     return ret;
@@ -642,6 +783,7 @@ handle_access_point_band(yaml_document_t* doc, yaml_node_t* node, const void* _,
 static const mapping_entry_handler wifi_access_point_handlers[] = {
     {"band", YAML_SCALAR_NODE, handle_access_point_band},
     {"bssid", YAML_SCALAR_NODE, handle_access_point_mac, NULL, access_point_offset(bssid)},
+    {"hidden", YAML_SCALAR_NODE, handle_access_point_bool, NULL, access_point_offset(hidden)},
     {"channel", YAML_SCALAR_NODE, handle_access_point_guint, NULL, access_point_offset(channel)},
     {"mode", YAML_SCALAR_NODE, handle_access_point_mode},
     {"password", YAML_SCALAR_NODE, handle_access_point_password},
@@ -680,27 +822,19 @@ handle_netdef_renderer(yaml_document_t* doc, yaml_node_t* node, const void* _, G
 static gboolean
 handle_accept_ra(yaml_document_t* doc, yaml_node_t* node, const void* data, GError** error)
 {
-    if (g_ascii_strcasecmp(scalar(node), "true") == 0 ||
-        g_ascii_strcasecmp(scalar(node), "on") == 0 ||
-        g_ascii_strcasecmp(scalar(node), "yes") == 0 ||
-        g_ascii_strcasecmp(scalar(node), "y") == 0)
+    gboolean ret = handle_generic_bool(doc, node, cur_netdef, data, error);
+    if (cur_netdef->accept_ra)
         cur_netdef->accept_ra = NETPLAN_RA_MODE_ENABLED;
-    else if (g_ascii_strcasecmp(scalar(node), "false") == 0 ||
-        g_ascii_strcasecmp(scalar(node), "off") == 0 ||
-        g_ascii_strcasecmp(scalar(node), "no") == 0 ||
-        g_ascii_strcasecmp(scalar(node), "n") == 0)
-        cur_netdef->accept_ra = NETPLAN_RA_MODE_DISABLED;
     else
-        return yaml_error(node, error, "invalid boolean value '%s'", scalar(node));
-
-    return TRUE;
+        cur_netdef->accept_ra = NETPLAN_RA_MODE_DISABLED;
+    return ret;
 }
 
 static gboolean
 handle_match(yaml_document_t* doc, yaml_node_t* node, const void* _, GError** error)
 {
     cur_netdef->has_match = TRUE;
-    return process_mapping(doc, node, match_handlers, error);
+    return process_mapping(doc, node, match_handlers, NULL, error);
 }
 
 struct NetplanWifiWowlanType NETPLAN_WIFI_WOWLAN_TYPES[] = {
@@ -747,20 +881,61 @@ handle_auth(yaml_document_t* doc, yaml_node_t* node, const void* _, GError** err
     cur_netdef->has_auth = TRUE;
 
     cur_auth = &cur_netdef->auth;
-    ret = process_mapping(doc, node, auth_handlers, error);
+    ret = process_mapping(doc, node, auth_handlers, NULL, error);
     cur_auth = NULL;
 
     return ret;
 }
 
 static gboolean
-handle_addresses(yaml_document_t* doc, yaml_node_t* node, const void* _, GError** error)
+handle_address_option_lifetime(yaml_document_t* doc, yaml_node_t* node, const void* data, GError** error)
 {
+    if (g_ascii_strcasecmp(scalar(node), "0") != 0 &&
+        g_ascii_strcasecmp(scalar(node), "forever") != 0) {
+        return yaml_error(node, error, "invalid lifetime value '%s'", scalar(node));
+    }
+    return handle_generic_str(doc, node, cur_addr_option, data, error);
+}
+
+static gboolean
+handle_address_option_label(yaml_document_t* doc, yaml_node_t* node, const void* data, GError** error)
+{
+    return handle_generic_str(doc, node, cur_addr_option, data, error);
+}
+
+const mapping_entry_handler address_option_handlers[] = {
+    {"lifetime", YAML_SCALAR_NODE, handle_address_option_lifetime, NULL, addr_option_offset(lifetime)},
+    {"label", YAML_SCALAR_NODE, handle_address_option_label, NULL, addr_option_offset(label)},
+    {NULL}
+};
+
+/*
+ * Handler for setting an array of IP addresses from a sequence node, inside a given struct
+ * @entryptr: pointer to the beginning of the do-be-modified data structure
+ * @data: offset into entryptr struct where the array to write is located
+ */
+static gboolean
+handle_generic_addresses(yaml_document_t* doc, yaml_node_t* node, gboolean check_zero_prefix, GArray** ip4, GArray** ip6, GError** error)
+{
+    g_assert(ip4);
+    g_assert(ip6);
     for (yaml_node_item_t *i = node->data.sequence.items.start; i < node->data.sequence.items.top; i++) {
         g_autofree char* addr = NULL;
         char* prefix_len;
         guint64 prefix_len_num;
         yaml_node_t *entry = yaml_document_get_node(doc, *i);
+        yaml_node_t *key = NULL;
+        yaml_node_t *value = NULL;
+
+        if (entry->type != YAML_SCALAR_NODE && entry->type != YAML_MAPPING_NODE) {
+            return yaml_error(entry, error, "expected either scalar or mapping (check indentation)");
+        }
+
+        if (entry->type == YAML_MAPPING_NODE) {
+            key = yaml_document_get_node(doc, entry->data.mapping.pairs.start->key);
+            value = yaml_document_get_node(doc, entry->data.mapping.pairs.start->value);
+            entry = key;
+        }
         assert_type(entry, YAML_SCALAR_NODE);
 
         /* split off /prefix_len */
@@ -772,26 +947,62 @@ handle_addresses(yaml_document_t* doc, yaml_node_t* node, const void* _, GError*
         prefix_len++; /* skip former '/' into first char of prefix */
         prefix_len_num = g_ascii_strtoull(prefix_len, NULL, 10);
 
+        if (value) {
+            if (!is_ip4_address(addr) && !is_ip6_address(addr))
+                return yaml_error(node, error, "malformed address '%s', must be X.X.X.X/NN or X:X:X:X:X:X:X:X/NN", scalar(entry));
+
+            if (!cur_netdef->address_options)
+                cur_netdef->address_options = g_array_new(FALSE, FALSE, sizeof(NetplanAddressOptions*));
+
+            for (unsigned i = 0; i < cur_netdef->address_options->len; ++i) {
+                NetplanAddressOptions* opts = g_array_index(cur_netdef->address_options, NetplanAddressOptions*, i);
+                /* check for multi-pass parsing, return early if options for this address already exist */
+                if (!g_strcmp0(scalar(key), opts->address))
+                    return TRUE;
+            }
+
+            cur_addr_option = g_new0(NetplanAddressOptions, 1);
+            cur_addr_option->address = g_strdup(scalar(key));
+
+            if (!process_mapping(doc, value, address_option_handlers, NULL, error))
+                return FALSE;
+
+            g_array_append_val(cur_netdef->address_options, cur_addr_option);
+            continue;
+        }
+
         /* is it an IPv4 address? */
         if (is_ip4_address(addr)) {
-            if (prefix_len_num == 0 || prefix_len_num > 32)
+            if ((check_zero_prefix && prefix_len_num == 0) || prefix_len_num > 32)
                 return yaml_error(node, error, "invalid prefix length in address '%s'", scalar(entry));
 
-            if (!cur_netdef->ip4_addresses)
-                cur_netdef->ip4_addresses = g_array_new(FALSE, FALSE, sizeof(char*));
+            if (!*ip4)
+                *ip4 = g_array_new(FALSE, FALSE, sizeof(char*));
+
+            /* Do not append the same IP (on multiple passes), if it is already contained */
+            for (unsigned i = 0; i < (*ip4)->len; ++i)
+                if (!g_strcmp0(scalar(entry), g_array_index(*ip4, char*, i)))
+                    goto skip_ip4;
             char* s = g_strdup(scalar(entry));
-            g_array_append_val(cur_netdef->ip4_addresses, s);
+            g_array_append_val(*ip4, s);
+skip_ip4:
             continue;
         }
 
         /* is it an IPv6 address? */
         if (is_ip6_address(addr)) {
-            if (prefix_len_num == 0 || prefix_len_num > 128)
+            if ((check_zero_prefix && prefix_len_num == 0) || prefix_len_num > 128)
                 return yaml_error(node, error, "invalid prefix length in address '%s'", scalar(entry));
-            if (!cur_netdef->ip6_addresses)
-                cur_netdef->ip6_addresses = g_array_new(FALSE, FALSE, sizeof(char*));
+            if (!*ip6)
+                *ip6 = g_array_new(FALSE, FALSE, sizeof(char*));
+
+            /* Do not append the same IP (on multiple passes), if it is already contained */
+            for (unsigned i = 0; i < (*ip6)->len; ++i)
+                if (!g_strcmp0(scalar(entry), g_array_index(*ip6, char*, i)))
+                    goto skip_ip6;
             char* s = g_strdup(scalar(entry));
-            g_array_append_val(cur_netdef->ip6_addresses, s);
+            g_array_append_val(*ip6, s);
+skip_ip6:
             continue;
         }
 
@@ -802,6 +1013,12 @@ handle_addresses(yaml_document_t* doc, yaml_node_t* node, const void* _, GError*
 }
 
 static gboolean
+handle_addresses(yaml_document_t* doc, yaml_node_t* node, const void* _, GError** error)
+{
+    return handle_generic_addresses(doc, node, TRUE, &(cur_netdef->ip4_addresses), &(cur_netdef->ip6_addresses), error);
+}
+
+static gboolean
 handle_gateway4(yaml_document_t* doc, yaml_node_t* node, const void* _, GError** error)
 {
     if (!is_ip4_address(scalar(node)))
@@ -847,7 +1064,7 @@ handle_wifi_access_points(yaml_document_t* doc, yaml_node_t* node, const void* d
             return ret;
         }
 
-        if (!process_mapping(doc, value, wifi_access_point_handlers, error)) {
+        if (!process_mapping(doc, value, wifi_access_point_handlers, NULL, error)) {
             cur_access_point = NULL;
             return FALSE;
         }
@@ -881,7 +1098,11 @@ handle_bridge_interfaces(yaml_document_t* doc, yaml_node_t* node, const void* da
             if (component->bond)
                 return yaml_error(node, error, "%s: interface '%s' is already assigned to bond %s",
                                   cur_netdef->id, scalar(entry), component->bond);
-           component->bridge = g_strdup(cur_netdef->id);
+            component->bridge = g_strdup(cur_netdef->id);
+            if (component->backend == NETPLAN_BACKEND_OVS) {
+                g_debug("%s: Bridge contains openvswitch interface, choosing OVS backend", cur_netdef->id);
+                cur_netdef->backend = NETPLAN_BACKEND_OVS;
+            }
         }
     }
 
@@ -902,9 +1123,19 @@ handle_bond_mode(yaml_document_t* doc, yaml_node_t* node, const void* data, GErr
         strcmp(scalar(node), "broadcast") == 0 ||
         strcmp(scalar(node), "802.3ad") == 0 ||
         strcmp(scalar(node), "balance-tlb") == 0 ||
-        strcmp(scalar(node), "balance-alb") == 0))
+        strcmp(scalar(node), "balance-alb") == 0 ||
+        strcmp(scalar(node), "balance-tcp") == 0 || // only supported for OVS
+        strcmp(scalar(node), "balance-slb") == 0))  // only supported for OVS
         return yaml_error(node, error, "unknown bond mode '%s'", scalar(node));
 
+    /* Implicitly set NETPLAN_BACKEND_OVS if ovs-only mode selected */
+    if (!strcmp(scalar(node), "balance-tcp") ||
+        !strcmp(scalar(node), "balance-slb")) {
+        g_debug("%s: mode '%s' only supported with openvswitch, choosing this backend",
+                cur_netdef->id, scalar(node));
+        cur_netdef->backend = NETPLAN_BACKEND_OVS;
+    }
+
     return handle_netdef_str(doc, node, data, error);
 }
 
@@ -932,6 +1163,10 @@ handle_bond_interfaces(yaml_document_t* doc, yaml_node_t* node, const void* data
                 return yaml_error(node, error, "%s: interface '%s' is already assigned to bond %s",
                                   cur_netdef->id, scalar(entry), component->bond);
             component->bond = g_strdup(cur_netdef->id);
+            if (component->backend == NETPLAN_BACKEND_OVS) {
+                g_debug("%s: Bond contains openvswitch interface, choosing OVS backend", cur_netdef->id);
+                cur_netdef->backend = NETPLAN_BACKEND_OVS;
+            }
         }
     }
 
@@ -1076,24 +1311,8 @@ check_and_set_family(int family, guint* dest)
 static gboolean
 handle_routes_bool(yaml_document_t* doc, yaml_node_t* node, const void* data, GError** error)
 {
-    guint offset = GPOINTER_TO_UINT(data);
-    gboolean v;
-
-    if (g_ascii_strcasecmp(scalar(node), "true") == 0 ||
-        g_ascii_strcasecmp(scalar(node), "on") == 0 ||
-        g_ascii_strcasecmp(scalar(node), "yes") == 0 ||
-        g_ascii_strcasecmp(scalar(node), "y") == 0)
-        v = TRUE;
-    else if (g_ascii_strcasecmp(scalar(node), "false") == 0 ||
-        g_ascii_strcasecmp(scalar(node), "off") == 0 ||
-        g_ascii_strcasecmp(scalar(node), "no") == 0 ||
-        g_ascii_strcasecmp(scalar(node), "n") == 0)
-        v = FALSE;
-    else
-        return yaml_error(node, error, "invalid boolean value '%s'", scalar(node));
-
-    *((gboolean*) ((void*) cur_route + offset)) = v;
-    return TRUE;
+    g_assert(cur_route);
+    return handle_generic_bool(doc, node, cur_route, data, error);
 }
 
 static gboolean
@@ -1166,87 +1385,26 @@ handle_ip_rule_ip(yaml_document_t* doc, yaml_node_t* node, const void* data, GEr
 }
 
 static gboolean
-handle_ip_rule_prio(yaml_document_t* doc, yaml_node_t* node, const void* data, GError** error)
+handle_ip_rule_guint(yaml_document_t* doc, yaml_node_t* node, const void* data, GError** error)
 {
-    guint64 v;
-    gchar* endptr;
-
-    v = g_ascii_strtoull(scalar(node), &endptr, 10);
-    if (*endptr != '\0' || v > G_MAXUINT)
-        return yaml_error(node, error, "invalid priority value '%s'", scalar(node));
-
-    cur_ip_rule->priority = (guint) v;
-    return TRUE;
+    g_assert(cur_ip_rule);
+    return handle_generic_guint(doc, node, cur_ip_rule, data, error);
 }
 
 static gboolean
-handle_ip_rule_tos(yaml_document_t* doc, yaml_node_t* node, const void* data, GError** error)
+handle_routes_guint(yaml_document_t* doc, yaml_node_t* node, const void* data, GError** error)
 {
-    guint64 v;
-    gchar* endptr;
-
-    v = g_ascii_strtoull(scalar(node), &endptr, 10);
-    if (*endptr != '\0' || v > 255)
-        return yaml_error(node, error, "invalid ToS (must be between 0 and 255): %s", scalar(node));
-
-    cur_ip_rule->tos = (guint) v;
-    return TRUE;
-}
-
-static gboolean
-handle_routes_table(yaml_document_t* doc, yaml_node_t* node, const void* data, GError** error)
-{
-    guint64 v;
-    gchar* endptr;
-
-    v = g_ascii_strtoull(scalar(node), &endptr, 10);
-    if (*endptr != '\0' || v > G_MAXUINT)
-        return yaml_error(node, error, "invalid routing table '%s'", scalar(node));
-
-    cur_route->table = (guint) v;
-    return TRUE;
-}
-
-static gboolean
-handle_ip_rule_table(yaml_document_t* doc, yaml_node_t* node, const void* data, GError** error)
-{
-    guint64 v;
-    gchar* endptr;
-
-    v = g_ascii_strtoull(scalar(node), &endptr, 10);
-    if (*endptr != '\0' || v > G_MAXUINT)
-        return yaml_error(node, error, "invalid routing table '%s'", scalar(node));
-
-    cur_ip_rule->table = (guint) v;
-    return TRUE;
-}
-
-static gboolean
-handle_ip_rule_fwmark(yaml_document_t* doc, yaml_node_t* node, const void* data, GError** error)
-{
-    guint64 v;
-    gchar* endptr;
-
-    v = g_ascii_strtoull(scalar(node), &endptr, 10);
-    if (*endptr != '\0' || v > G_MAXUINT)
-        return yaml_error(node, error, "invalid fwmark value '%s'", scalar(node));
-
-    cur_ip_rule->fwmark = (guint) v;
-    return TRUE;
+    g_assert(cur_route);
+    return handle_generic_guint(doc, node, cur_route, data, error);
 }
 
 static gboolean
-handle_routes_metric(yaml_document_t* doc, yaml_node_t* node, const void* _, GError** error)
+handle_ip_rule_tos(yaml_document_t* doc, yaml_node_t* node, const void* data, GError** error)
 {
-    guint64 v;
-    gchar* endptr;
-
-    v = g_ascii_strtoull(scalar(node), &endptr, 10);
-    if (*endptr != '\0' || v > G_MAXUINT)
-        return yaml_error(node, error, "invalid unsigned int value '%s'", scalar(node));
-
-    cur_route->metric = (guint) v;
-    return TRUE;
+    gboolean ret = handle_generic_guint(doc, node, cur_ip_rule, data, error);
+    if (cur_ip_rule->tos > 255)
+        return yaml_error(node, error, "invalid ToS (must be between 0 and 255): %s", scalar(node));
+    return ret;
 }
 
 /****************************************************
@@ -1343,7 +1501,7 @@ handle_bridge(yaml_document_t* doc, yaml_node_t* node, const void* _, GError** e
 {
     cur_netdef->custom_bridging = TRUE;
     cur_netdef->bridge_params.stp = TRUE;
-    return process_mapping(doc, node, bridge_params_handlers, error);
+    return process_mapping(doc, node, bridge_params_handlers, NULL, error);
 }
 
 /****************************************************
@@ -1354,44 +1512,57 @@ static const mapping_entry_handler routes_handlers[] = {
     {"from", YAML_SCALAR_NODE, handle_routes_ip, NULL, route_offset(from)},
     {"on-link", YAML_SCALAR_NODE, handle_routes_bool, NULL, route_offset(onlink)},
     {"scope", YAML_SCALAR_NODE, handle_routes_scope},
-    {"table", YAML_SCALAR_NODE, handle_routes_table},
+    {"table", YAML_SCALAR_NODE, handle_routes_guint, NULL, route_offset(table)},
     {"to", YAML_SCALAR_NODE, handle_routes_ip, NULL, route_offset(to)},
     {"type", YAML_SCALAR_NODE, handle_routes_type},
     {"via", YAML_SCALAR_NODE, handle_routes_ip, NULL, route_offset(via)},
-    {"metric", YAML_SCALAR_NODE, handle_routes_metric},
+    {"metric", YAML_SCALAR_NODE, handle_routes_guint, NULL, route_offset(metric)},
     {NULL}
 };
 
 static gboolean
 handle_routes(yaml_document_t* doc, yaml_node_t* node, const void* _, GError** error)
 {
+    if (!cur_netdef->routes)
+        cur_netdef->routes = g_array_new(FALSE, TRUE, sizeof(NetplanIPRoute*));
+
+    /* Avoid adding the same routes in a 2nd parsing pass by comparing
+     * the array size to the YAML sequence size. Skip if they are equal. */
+    guint item_count = node->data.sequence.items.top - node->data.sequence.items.start;
+    if (cur_netdef->routes->len == item_count) {
+        g_debug("%s: all routes have already been added", cur_netdef->id);
+        return TRUE;
+    }
+
     for (yaml_node_item_t *i = node->data.sequence.items.start; i < node->data.sequence.items.top; i++) {
         yaml_node_t *entry = yaml_document_get_node(doc, *i);
+        assert_type(entry, YAML_MAPPING_NODE);
 
+        g_assert(cur_route == NULL);
         cur_route = g_new0(NetplanIPRoute, 1);
         cur_route->type = g_strdup("unicast");
         cur_route->scope = g_strdup("global");
         cur_route->family = G_MAXUINT; /* 0 is a valid family ID */
         cur_route->metric = NETPLAN_METRIC_UNSPEC; /* 0 is a valid metric */
+        g_debug("%s: adding new route", cur_netdef->id);
 
-        if (process_mapping(doc, entry, routes_handlers, error)) {
-            if (!cur_netdef->routes) {
-                cur_netdef->routes = g_array_new(FALSE, FALSE, sizeof(NetplanIPRoute*));
-            }
-
+        if (process_mapping(doc, entry, routes_handlers, NULL, error))
             g_array_append_val(cur_netdef->routes, cur_route);
-        }
 
         if (       (   g_ascii_strcasecmp(cur_route->scope, "link") == 0
                     || g_ascii_strcasecmp(cur_route->scope, "host") == 0)
-                && !cur_route->to)
+                && !cur_route->to) {
+            cur_route = NULL;
             return yaml_error(node, error, "link and host routes must specify a 'to' IP");
-        else if (  g_ascii_strcasecmp(cur_route->type, "unicast") == 0
+        } else if (  g_ascii_strcasecmp(cur_route->type, "unicast") == 0
                 && g_ascii_strcasecmp(cur_route->scope, "global") == 0
-                && (!cur_route->to || !cur_route->via))
+                && (!cur_route->to || !cur_route->via)) {
+            cur_route = NULL;
             return yaml_error(node, error, "unicast route must include both a 'to' and 'via' IP");
-        else if (g_ascii_strcasecmp(cur_route->type, "unicast") != 0 && !cur_route->to)
+        } else if (g_ascii_strcasecmp(cur_route->type, "unicast") != 0 && !cur_route->to) {
+            cur_route = NULL;
             return yaml_error(node, error, "non-unicast routes must specify a 'to' IP");
+        }
 
         cur_route = NULL;
 
@@ -1403,11 +1574,11 @@ handle_routes(yaml_document_t* doc, yaml_node_t* node, const void* _, GError** e
 
 static const mapping_entry_handler ip_rules_handlers[] = {
     {"from", YAML_SCALAR_NODE, handle_ip_rule_ip, NULL, ip_rule_offset(from)},
-    {"mark", YAML_SCALAR_NODE, handle_ip_rule_fwmark},
-    {"priority", YAML_SCALAR_NODE, handle_ip_rule_prio},
-    {"table", YAML_SCALAR_NODE, handle_ip_rule_table},
+    {"mark", YAML_SCALAR_NODE, handle_ip_rule_guint, NULL, ip_rule_offset(fwmark)},
+    {"priority", YAML_SCALAR_NODE, handle_ip_rule_guint, NULL, ip_rule_offset(priority)},
+    {"table", YAML_SCALAR_NODE, handle_ip_rule_guint, NULL, ip_rule_offset(table)},
     {"to", YAML_SCALAR_NODE, handle_ip_rule_ip, NULL, ip_rule_offset(to)},
-    {"type-of-service", YAML_SCALAR_NODE, handle_ip_rule_tos},
+    {"type-of-service", YAML_SCALAR_NODE, handle_ip_rule_tos, NULL, ip_rule_offset(tos)},
     {NULL}
 };
 
@@ -1424,7 +1595,7 @@ handle_ip_rules(yaml_document_t* doc, yaml_node_t* node, const void* _, GError**
         cur_ip_rule->tos = NETPLAN_IP_RULE_TOS_UNSPEC;
         cur_ip_rule->fwmark = NETPLAN_IP_RULE_FW_MARK_UNSPEC;
 
-        if (process_mapping(doc, entry, ip_rules_handlers, error)) {
+        if (process_mapping(doc, entry, ip_rules_handlers, NULL, error)) {
             if (!cur_netdef->ip_rules) {
                 cur_netdef->ip_rules = g_array_new(FALSE, FALSE, sizeof(NetplanIPRule*));
             }
@@ -1482,7 +1653,10 @@ handle_bond_primary_slave(yaml_document_t* doc, yaml_node_t* node, const void* d
     if (!component) {
         add_missing_node(node);
     } else {
-        if (cur_netdef->bond_params.primary_slave)
+        /* If this is not the primary pass, the primary slave might already be equally set. */
+        if (!g_strcmp0(cur_netdef->bond_params.primary_slave, scalar(node))) {
+            return TRUE;
+        } else if (cur_netdef->bond_params.primary_slave)
             return yaml_error(node, error, "%s: bond already has a primary slave: %s",
                               cur_netdef->id, cur_netdef->bond_params.primary_slave);
 
@@ -1525,7 +1699,7 @@ static const mapping_entry_handler bond_params_handlers[] = {
 static gboolean
 handle_bonding(yaml_document_t* doc, yaml_node_t* node, const void* _, GError** error)
 {
-    return process_mapping(doc, node, bond_params_handlers, error);
+    return process_mapping(doc, node, bond_params_handlers, NULL, error);
 }
 
 static gboolean
@@ -1592,56 +1766,155 @@ handle_tunnel_mode(yaml_document_t* doc, yaml_node_t* node, const void* _, GErro
     return yaml_error(node, error, "%s: tunnel mode '%s' is not supported", cur_netdef->id, key);
 }
 
+static const mapping_entry_handler tunnel_keys_handlers[] = {
+    {"input", YAML_SCALAR_NODE, handle_netdef_str, NULL, netdef_offset(tunnel.input_key)},
+    {"output", YAML_SCALAR_NODE, handle_netdef_str, NULL, netdef_offset(tunnel.output_key)},
+    {"private", YAML_SCALAR_NODE, handle_netdef_str, NULL, netdef_offset(tunnel.private_key)},
+    {NULL}
+};
+
 static gboolean
-handle_tunnel_key(yaml_document_t* doc, yaml_node_t* node, const void* data, GError** error)
+handle_tunnel_key_mapping(yaml_document_t* doc, yaml_node_t* node, const void* _, GError** error)
 {
-    /* Tunnel key should be a number or dotted quad. */
-    guint offset = GPOINTER_TO_UINT(data);
-    char** dest = (char**) ((void*) cur_netdef + offset);
-    guint64 v;
-    gchar* endptr;
+    gboolean ret = FALSE;
 
-    v = g_ascii_strtoull(scalar(node), &endptr, 10);
-    if (*endptr != '\0' || v > G_MAXUINT) {
-        /* Not a simple uint, try for a dotted quad */
-        if (!is_ip4_address(scalar(node)))
-            return yaml_error(node, error, "invalid tunnel key '%s'", scalar(node));
+    /* We overload the 'key[s]' setting for tunnels; such that it can either be a
+     * single scalar with the same key to use for both input, output and private
+     * keys, or a mapping where one can specify each. */
+    if (node->type == YAML_SCALAR_NODE) {
+        ret = handle_netdef_str(doc, node, netdef_offset(tunnel.input_key), error);
+        if (ret)
+            ret = handle_netdef_str(doc, node, netdef_offset(tunnel.output_key), error);
+        if (ret)
+            ret = handle_netdef_str(doc, node, netdef_offset(tunnel.private_key), error);
+    } else if (node->type == YAML_MAPPING_NODE)
+        ret = process_mapping(doc, node, tunnel_keys_handlers, NULL, error);
+    else
+        return yaml_error(node, error, "invalid type for 'key[s]': must be a scalar or mapping");
+
+    return ret;
+}
+
+/**
+ * Handler for setting a NetplanWireguardPeer string field from a scalar node
+ * @data: pointer to the const char* field to write
+ */
+static gboolean
+handle_wireguard_peer_str(yaml_document_t* doc, yaml_node_t* node, const void* data, GError** error)
+{
+    g_assert(cur_wireguard_peer);
+    return handle_generic_str(doc, node, cur_wireguard_peer, data, error);
+}
+
+/**
+ * Handler for setting a NetplanWireguardPeer string field from a scalar node
+ * @data: pointer to the guint field to write
+ */
+static gboolean
+handle_wireguard_peer_guint(yaml_document_t* doc, yaml_node_t* node, const void* data, GError** error)
+{
+    g_assert(cur_wireguard_peer);
+    return handle_generic_guint(doc, node, cur_wireguard_peer, data, error);
+}
+
+static gboolean
+handle_wireguard_allowed_ips(yaml_document_t* doc, yaml_node_t* node, const void* _, GError** error)
+{
+    return handle_generic_addresses(doc, node, FALSE, &(cur_wireguard_peer->allowed_ips),
+                                    &(cur_wireguard_peer->allowed_ips), error);
+}
+
+static gboolean
+handle_wireguard_endpoint(yaml_document_t* doc, yaml_node_t* node, const void* _, GError** error)
+{
+    g_autofree char* endpoint = NULL;
+    char* port;
+    char* address;
+    guint64 port_num;
+
+    endpoint = g_strdup(scalar(node));
+    /* absolute minimal length of endpoint is 3 chars: 'h:8' */
+    if (strlen(endpoint) < 3) {
+        return yaml_error(node, error, "invalid endpoint address or hostname '%s'", scalar(node));
+    }
+    if (endpoint[0] == '[') {
+        /* this is an ipv6 endpoint in [ad:rr:ee::ss]:port form */
+        char *endbrace = strrchr(endpoint, ']');
+        if (!endbrace)
+            return yaml_error(node, error, "invalid address in endpoint '%s'", scalar(node));
+        address = endpoint + 1;
+        *endbrace = '\0';
+        port = strrchr(endbrace + 1, ':');
+    } else {
+        address = endpoint;
+        port = strrchr(endpoint, ':');
+    }
+    /* split off :port */
+    if (!port)
+        return yaml_error(node, error, "endpoint '%s' is missing :port", scalar(node));
+    *port = '\0';
+    port++; /* skip former ':' into first char of port */
+    port_num = g_ascii_strtoull(port, NULL, 10);
+    if (port_num > 65535)
+        return yaml_error(node, error, "invalid port in endpoint '%s'", scalar(node));
+    if (is_ip4_address(address) || is_ip6_address(address) || is_hostname(address)) {
+        return handle_wireguard_peer_str(doc, node, wireguard_peer_offset(endpoint), error);
     }
+    return yaml_error(node, error, "invalid endpoint address or hostname '%s'", scalar(node));
+}
 
-    g_free(*dest);
-    *dest = g_strdup(scalar(node));
+static const mapping_entry_handler wireguard_peer_keys_handlers[] = {
+    {"public", YAML_SCALAR_NODE, handle_wireguard_peer_str, NULL, wireguard_peer_offset(public_key)},
+    {"shared", YAML_SCALAR_NODE, handle_wireguard_peer_str, NULL, wireguard_peer_offset(preshared_key)},
+    {NULL}
+};
 
-    return TRUE;
+static gboolean
+handle_wireguard_peer_key_mapping(yaml_document_t* doc, yaml_node_t* node, const void* _, GError** error)
+{
+    return process_mapping(doc, node, wireguard_peer_keys_handlers, NULL, error);
 }
 
-static const mapping_entry_handler tunnel_keys_handlers[] = {
-    {"input", YAML_SCALAR_NODE, handle_tunnel_key, NULL, netdef_offset(tunnel.input_key)},
-    {"output", YAML_SCALAR_NODE, handle_tunnel_key, NULL, netdef_offset(tunnel.output_key)},
+const mapping_entry_handler wireguard_peer_handlers[] = {
+    {"keys", YAML_MAPPING_NODE, handle_wireguard_peer_key_mapping},
+    {"keepalive", YAML_SCALAR_NODE, handle_wireguard_peer_guint, NULL, wireguard_peer_offset(keepalive)},
+    {"endpoint", YAML_SCALAR_NODE, handle_wireguard_endpoint},
+    {"allowed-ips", YAML_SEQUENCE_NODE, handle_wireguard_allowed_ips},
     {NULL}
 };
 
 static gboolean
-handle_tunnel_key_mapping(yaml_document_t* doc, yaml_node_t* node, const void* _, GError** error)
+handle_wireguard_peers(yaml_document_t* doc, yaml_node_t* node, const void* _, GError** error)
 {
-    gboolean ret = FALSE;
+    if (!cur_netdef->wireguard_peers)
+        cur_netdef->wireguard_peers = g_array_new(FALSE, TRUE, sizeof(NetplanWireguardPeer*));
 
-    /* We overload the key 'key' for tunnels; such that it can either be a
-     * single scalar with the same key to use for both input and output keys,
-     * or a mapping where one can specify each.
-     */
-    if (node->type == YAML_SCALAR_NODE) {
-        ret = handle_tunnel_key(doc, node, netdef_offset(tunnel.input_key), error);
-        if (ret)
-            ret = handle_tunnel_key(doc, node, netdef_offset(tunnel.output_key), error);
-    }
-    else if (node->type == YAML_MAPPING_NODE) {
-        ret = process_mapping(doc, node, tunnel_keys_handlers, error);
-    }
-    else {
-        return yaml_error(node, error, "invalid type for 'keys': must be a scalar or mapping");
+    /* Avoid adding the same peers in a 2nd parsing pass by comparing
+     * the array size to the YAML sequence size. Skip if they are equal. */
+    guint item_count = node->data.sequence.items.top - node->data.sequence.items.start;
+    if (cur_netdef->wireguard_peers->len == item_count) {
+        g_debug("%s: all wireguard peers have already been added", cur_netdef->id);
+        return TRUE;
     }
 
-    return ret;
+    for (yaml_node_item_t *i = node->data.sequence.items.start; i < node->data.sequence.items.top; i++) {
+        g_autofree char* addr = NULL;
+        yaml_node_t *entry = yaml_document_get_node(doc, *i);
+        assert_type(entry, YAML_MAPPING_NODE);
+
+        g_assert(cur_wireguard_peer == NULL);
+        cur_wireguard_peer = g_new0(NetplanWireguardPeer, 1);
+        cur_wireguard_peer->allowed_ips = g_array_new(FALSE, FALSE, sizeof(char*));
+        g_debug("%s: adding new wireguard peer", cur_netdef->id);
+
+        g_array_append_val(cur_netdef->wireguard_peers, cur_wireguard_peer);
+        if (!process_mapping(doc, entry, wireguard_peer_handlers, NULL, error)) {
+            cur_wireguard_peer = NULL;
+            return FALSE;
+        }
+        cur_wireguard_peer = NULL;
+    }
+    return TRUE;
 }
 
 /****************************************************
@@ -1656,6 +1929,187 @@ static const mapping_entry_handler nm_backend_settings_handlers[] = {
     {NULL}
 };
 
+static gboolean
+handle_ovs_bond_lacp(yaml_document_t* doc, yaml_node_t* node, const void* data, GError** error)
+{
+    if (cur_netdef->type != NETPLAN_DEF_TYPE_BOND)
+        return yaml_error(node, error, "Key 'lacp' is only valid for iterface type 'openvswitch bond'");
+
+    if (g_strcmp0(scalar(node), "active") && g_strcmp0(scalar(node), "passive") && g_strcmp0(scalar(node), "off"))
+        return yaml_error(node, error, "Value of 'lacp' needs to be 'active', 'passive' or 'off");
+
+    return handle_netdef_str(doc, node, data, error);
+}
+
+static gboolean
+handle_ovs_bridge_bool(yaml_document_t* doc, yaml_node_t* node, const void* data, GError** error)
+{
+    if (cur_netdef->type != NETPLAN_DEF_TYPE_BRIDGE)
+        return yaml_error(node, error, "Key is only valid for iterface type 'openvswitch bridge'");
+
+    return handle_netdef_bool(doc, node, data, error);
+}
+
+static gboolean
+handle_ovs_bridge_fail_mode(yaml_document_t* doc, yaml_node_t* node, const void* data, GError** error)
+{
+    if (cur_netdef->type != NETPLAN_DEF_TYPE_BRIDGE)
+        return yaml_error(node, error, "Key 'fail-mode' is only valid for iterface type 'openvswitch bridge'");
+
+    if (g_strcmp0(scalar(node), "standalone") && g_strcmp0(scalar(node), "secure"))
+        return yaml_error(node, error, "Value of 'fail-mode' needs to be 'standalone' or 'secure'");
+
+    return handle_netdef_str(doc, node, data, error);
+}
+
+static gboolean
+handle_ovs_protocol(yaml_document_t* doc, yaml_node_t* node, void* entryptr, const void* data, GError** error)
+{
+    const char* supported[] = {
+        "OpenFlow10", "OpenFlow11", "OpenFlow12", "OpenFlow13", "OpenFlow14", "OpenFlow15", "OpenFlow16", NULL
+    };
+    unsigned i = 0;
+    guint offset = GPOINTER_TO_UINT(data);
+    GArray** protocols = (GArray**) ((void*) entryptr + offset);
+
+    for (yaml_node_item_t *iter = node->data.sequence.items.start; iter < node->data.sequence.items.top; iter++) {
+        yaml_node_t *entry = yaml_document_get_node(doc, *iter);
+        assert_type(entry, YAML_SCALAR_NODE);
+
+        for (i = 0; supported[i] != NULL; ++i)
+            if (!g_strcmp0(scalar(entry), supported[i]))
+                break;
+
+        if (supported[i] == NULL)
+            return yaml_error(node, error, "Unsupported OVS 'protocol' value: %s", scalar(entry));
+
+        if (!*protocols)
+            *protocols = g_array_new(FALSE, FALSE, sizeof(char*));
+        char* s = g_strdup(scalar(entry));
+        g_array_append_val(*protocols, s);
+    }
+
+    return TRUE;
+}
+
+static gboolean
+handle_ovs_bridge_protocol(yaml_document_t* doc, yaml_node_t* node, const void* data, GError** error)
+{
+    if (cur_netdef->type != NETPLAN_DEF_TYPE_BRIDGE)
+        return yaml_error(node, error, "Key 'protocols' is only valid for iterface type 'openvswitch bridge'");
+
+    return handle_ovs_protocol(doc, node, cur_netdef, data, error);
+}
+
+static gboolean
+handle_ovs_bridge_controller_connection_mode(yaml_document_t* doc, yaml_node_t* node, const void* data, GError** error)
+{
+    if (cur_netdef->type != NETPLAN_DEF_TYPE_BRIDGE)
+        return yaml_error(node, error, "Key 'controller.connection-mode' is only valid for iterface type 'openvswitch bridge'");
+
+    if (g_strcmp0(scalar(node), "in-band") && g_strcmp0(scalar(node), "out-of-band"))
+        return yaml_error(node, error, "Value of 'connection-mode' needs to be 'in-band' or 'out-of-band'");
+
+    return handle_netdef_str(doc, node, data, error);
+}
+
+static gboolean
+handle_ovs_bridge_controller_addresses(yaml_document_t* doc, yaml_node_t* node, const void* data, GError** error)
+{
+    if (cur_netdef->type != NETPLAN_DEF_TYPE_BRIDGE)
+        return yaml_error(node, error, "Key 'controller.addresses' is only valid for iterface type 'openvswitch bridge'");
+
+    for (yaml_node_item_t *i = node->data.sequence.items.start; i < node->data.sequence.items.top; i++) {
+        gchar** vec = NULL;
+        gboolean is_host = FALSE;
+        gboolean is_port = FALSE;
+        gboolean is_unix = FALSE;
+
+        yaml_node_t *entry = yaml_document_get_node(doc, *i);
+        assert_type(entry, YAML_SCALAR_NODE);
+        /* We always need at least one colon */
+        if (!g_strrstr(scalar(entry), ":"))
+            return yaml_error(node, error, "Unsupported OVS controller target: %s", scalar(entry));
+
+        vec = g_strsplit (scalar(entry), ":", 2);
+
+        is_host = !g_strcmp0(vec[0], "tcp") || !g_strcmp0(vec[0], "ssl");
+        is_port = !g_strcmp0(vec[0], "ptcp") || !g_strcmp0(vec[0], "pssl");
+        is_unix = !g_strcmp0(vec[0], "unix") || !g_strcmp0(vec[0], "punix");
+
+        if (!cur_netdef->ovs_settings.controller.addresses)
+            cur_netdef->ovs_settings.controller.addresses = g_array_new(FALSE, FALSE, sizeof(char*));
+
+        /* Format: [p]unix:file */
+        if (is_unix && vec[1] != NULL && vec[2] == NULL) {
+            char* s = g_strdup(scalar(entry));
+            g_array_append_val(cur_netdef->ovs_settings.controller.addresses, s);
+            g_strfreev(vec);
+            continue;
+        /* Format tcp:host[:port] or ssl:host[:port] */
+        } else if (is_host && validate_ovs_target(TRUE, vec[1])) {
+            char* s = g_strdup(scalar(entry));
+            g_array_append_val(cur_netdef->ovs_settings.controller.addresses, s);
+            g_strfreev(vec);
+            continue;
+        /* Format ptcp:[port][:host] or pssl:[port][:host] */
+        } else if (is_port && validate_ovs_target(FALSE, vec[1])) {
+            char* s = g_strdup(scalar(entry));
+            g_array_append_val(cur_netdef->ovs_settings.controller.addresses, s);
+            g_strfreev(vec);
+            continue;
+        }
+
+        g_strfreev(vec);
+        return yaml_error(node, error, "Unsupported OVS controller target: %s", scalar(entry));
+    }
+
+    return TRUE;
+}
+
+static const mapping_entry_handler ovs_controller_handlers[] = {
+    {"addresses", YAML_SEQUENCE_NODE, handle_ovs_bridge_controller_addresses, NULL, netdef_offset(ovs_settings.controller.addresses)},
+    {"connection-mode", YAML_SCALAR_NODE, handle_ovs_bridge_controller_connection_mode, NULL, netdef_offset(ovs_settings.controller.connection_mode)},
+    {NULL},
+};
+
+static const mapping_entry_handler ovs_backend_settings_handlers[] = {
+    {"external-ids", YAML_MAPPING_NODE, handle_netdef_map, NULL, netdef_offset(ovs_settings.external_ids)},
+    {"other-config", YAML_MAPPING_NODE, handle_netdef_map, NULL, netdef_offset(ovs_settings.other_config)},
+    {"lacp", YAML_SCALAR_NODE, handle_ovs_bond_lacp, NULL, netdef_offset(ovs_settings.lacp)},
+    {"fail-mode", YAML_SCALAR_NODE, handle_ovs_bridge_fail_mode, NULL, netdef_offset(ovs_settings.fail_mode)},
+    {"mcast-snooping", YAML_SCALAR_NODE, handle_ovs_bridge_bool, NULL, netdef_offset(ovs_settings.mcast_snooping)},
+    {"rstp", YAML_SCALAR_NODE, handle_ovs_bridge_bool, NULL, netdef_offset(ovs_settings.rstp)},
+    {"protocols", YAML_SEQUENCE_NODE, handle_ovs_bridge_protocol, NULL, netdef_offset(ovs_settings.protocols)},
+    {"controller", YAML_MAPPING_NODE, NULL, ovs_controller_handlers},
+    {NULL}
+};
+
+static gboolean
+handle_ovs_backend(yaml_document_t* doc, yaml_node_t* node, const void* _, GError** error)
+{
+    GList* values = NULL;
+    gboolean ret = process_mapping(doc, node, ovs_backend_settings_handlers, &values, error);
+    guint len = g_list_length(values);
+
+    if (cur_netdef->type != NETPLAN_DEF_TYPE_BOND && cur_netdef->type != NETPLAN_DEF_TYPE_BRIDGE) {
+        GList *other_config = g_list_find_custom(values, "other-config", (GCompareFunc) strcmp);
+        GList *external_ids = g_list_find_custom(values, "external-ids", (GCompareFunc) strcmp);
+        /* Non-bond/non-bridge interfaces might still be handled by the networkd backend */
+        if (len == 1 && (other_config || external_ids))
+            return ret;
+        else if (len == 2 && other_config && external_ids)
+            return ret;
+    }
+    g_list_free_full(values, g_free);
+
+    /* Set the renderer for this device to NETPLAN_BACKEND_OVS, implicitly.
+     * But only if empty "openvswitch: {}" or "openvswitch:" with more than
+     * "other-config" or "external-ids" keys is given. */
+    cur_netdef->backend = NETPLAN_BACKEND_OVS;
+    return ret;
+}
+
 static const mapping_entry_handler nameservers_handlers[] = {
     {"search", YAML_SEQUENCE_NODE, handle_nameservers_search},
     {"addresses", YAML_SEQUENCE_NODE, handle_nameservers_addresses},
@@ -1668,7 +2122,7 @@ static const mapping_entry_handler nameservers_handlers[] = {
     {"route-metric", YAML_SCALAR_NODE, handle_netdef_guint, NULL, netdef_offset(overrides.metric)},         \
     {"send-hostname", YAML_SCALAR_NODE, handle_netdef_bool, NULL, netdef_offset(overrides.send_hostname)},  \
     {"use-dns", YAML_SCALAR_NODE, handle_netdef_bool, NULL, netdef_offset(overrides.use_dns)},              \
-    {"use-domains", YAML_SCALAR_NODE, handle_netdef_str, NULL, netdef_offset(overrides.use_domains)},      \
+    {"use-domains", YAML_SCALAR_NODE, handle_netdef_str, NULL, netdef_offset(overrides.use_domains)},       \
     {"use-hostname", YAML_SCALAR_NODE, handle_netdef_bool, NULL, netdef_offset(overrides.use_hostname)},    \
     {"use-mtu", YAML_SCALAR_NODE, handle_netdef_bool, NULL, netdef_offset(overrides.use_mtu)},              \
     {"use-ntp", YAML_SCALAR_NODE, handle_netdef_bool, NULL, netdef_offset(overrides.use_ntp)},              \
@@ -1686,7 +2140,7 @@ static const mapping_entry_handler dhcp6_overrides_handlers[] = {
 
 /* Handlers shared by all link types */
 #define COMMON_LINK_HANDLERS                                                                  \
-    {"accept-ra", YAML_SCALAR_NODE, handle_accept_ra},                                        \
+    {"accept-ra", YAML_SCALAR_NODE, handle_accept_ra, NULL, netdef_offset(accept_ra)},        \
     {"addresses", YAML_SEQUENCE_NODE, handle_addresses},                                      \
     {"critical", YAML_SCALAR_NODE, handle_netdef_bool, NULL, netdef_offset(critical)},        \
     {"dhcp4", YAML_SCALAR_NODE, handle_netdef_bool, NULL, netdef_offset(dhcp4)},              \
@@ -1696,7 +2150,8 @@ static const mapping_entry_handler dhcp6_overrides_handlers[] = {
     {"dhcp6-overrides", YAML_MAPPING_NODE, NULL, dhcp6_overrides_handlers},                   \
     {"gateway4", YAML_SCALAR_NODE, handle_gateway4},                                          \
     {"gateway6", YAML_SCALAR_NODE, handle_gateway6},                                          \
-    {"ipv6-address-generation", YAML_SCALAR_NODE, handle_netdef_addrgen},                               \
+    {"ipv6-address-generation", YAML_SCALAR_NODE, handle_netdef_addrgen},                     \
+    {"ipv6-address-token", YAML_SCALAR_NODE, handle_netdef_addrtok, NULL, netdef_offset(ip6_addr_gen_token)}, \
     {"ipv6-mtu", YAML_SCALAR_NODE, handle_netdef_guint, NULL, netdef_offset(ipv6_mtubytes)},  \
     {"ipv6-privacy", YAML_SCALAR_NODE, handle_netdef_bool, NULL, netdef_offset(ip6_privacy)}, \
     {"link-local", YAML_SEQUENCE_NODE, handle_link_local},                                    \
@@ -1709,15 +2164,16 @@ static const mapping_entry_handler dhcp6_overrides_handlers[] = {
     {"routes", YAML_SEQUENCE_NODE, handle_routes},                                            \
     {"routing-policy", YAML_SEQUENCE_NODE, handle_ip_rules}
 
-#define COMMON_BACKEND_HANDLERS							\
-    {"networkmanager", YAML_MAPPING_NODE, NULL, nm_backend_settings_handlers}
+#define COMMON_BACKEND_HANDLERS                                                               \
+    {"networkmanager", YAML_MAPPING_NODE, NULL, nm_backend_settings_handlers},                \
+    {"openvswitch", YAML_MAPPING_NODE, handle_ovs_backend}
 
 /* Handlers for physical links */
-#define PHYSICAL_LINK_HANDLERS                                                           \
-    {"match", YAML_MAPPING_NODE, handle_match},                                          \
-    {"set-name", YAML_SCALAR_NODE, handle_netdef_str, NULL, netdef_offset(set_name)},    \
-    {"wakeonlan", YAML_SCALAR_NODE, handle_netdef_bool, NULL, netdef_offset(wake_on_lan)}, \
-    {"wakeonwlan", YAML_SEQUENCE_NODE, handle_wowlan, NULL, netdef_offset(wowlan)},       \
+#define PHYSICAL_LINK_HANDLERS                                                                \
+    {"match", YAML_MAPPING_NODE, handle_match},                                               \
+    {"set-name", YAML_SCALAR_NODE, handle_netdef_str, NULL, netdef_offset(set_name)},         \
+    {"wakeonlan", YAML_SCALAR_NODE, handle_netdef_bool, NULL, netdef_offset(wake_on_lan)},    \
+    {"wakeonwlan", YAML_SEQUENCE_NODE, handle_wowlan, NULL, netdef_offset(wowlan)},           \
     {"emit-lldp", YAML_SCALAR_NODE, handle_netdef_bool, NULL, netdef_offset(emit_lldp)}
 
 static const mapping_entry_handler ethernet_def_handlers[] = {
@@ -1789,6 +2245,11 @@ static const mapping_entry_handler tunnel_def_handlers[] = {
      */
     {"key", YAML_NO_NODE, handle_tunnel_key_mapping},
     {"keys", YAML_NO_NODE, handle_tunnel_key_mapping},
+
+    /* wireguard */
+    {"mark", YAML_SCALAR_NODE, handle_netdef_guint, NULL, netdef_offset(tunnel.fwmark)},
+    {"port", YAML_SCALAR_NODE, handle_netdef_guint, NULL, netdef_offset(tunnel.port)},
+    {"peers", YAML_SEQUENCE_NODE, handle_wireguard_peers},
     {NULL}
 };
 
@@ -1814,22 +2275,74 @@ handle_network_renderer(yaml_document_t* doc, yaml_node_t* node, const void* _, 
     return parse_renderer(node, &backend_global, error);
 }
 
-static void
-initialize_dhcp_overrides(NetplanDHCPOverrides* overrides)
+static gboolean
+handle_network_ovs_settings_global(yaml_document_t* doc, yaml_node_t* node, const void* data, GError** error)
 {
-    overrides->use_dns = TRUE;
-    overrides->use_domains = NULL;
-    overrides->use_ntp = TRUE;
-    overrides->send_hostname = TRUE;
-    overrides->use_hostname = TRUE;
-    overrides->use_mtu = TRUE;
-    overrides->use_routes = TRUE;
-    overrides->hostname = NULL;
-    overrides->metric = NETPLAN_METRIC_UNSPEC;
+    return handle_generic_map(doc, node, &ovs_settings_global, data, error);
+}
+
+static gboolean
+handle_network_ovs_settings_global_protocol(yaml_document_t* doc, yaml_node_t* node, const void* data, GError** error)
+{
+    return handle_ovs_protocol(doc, node, &ovs_settings_global, data, error);
+}
+
+static gboolean
+handle_network_ovs_settings_global_ports(yaml_document_t* doc, yaml_node_t* node, const void* data, GError** error)
+{
+    yaml_node_t* port = NULL;
+    yaml_node_t* peer = NULL;
+    yaml_node_t* pair = NULL;
+    yaml_node_item_t *item = NULL;
+    NetplanNetDefinition *component = NULL;
+
+    for (yaml_node_item_t *iter = node->data.sequence.items.start; iter < node->data.sequence.items.top; iter++) {
+        pair = yaml_document_get_node(doc, *iter);
+        assert_type(pair, YAML_SEQUENCE_NODE);
+
+        item = pair->data.sequence.items.start;
+        /* A peer port definition must contain exactly 2 ports */
+        if (item+2 != pair->data.sequence.items.top) {
+            return yaml_error(pair, error, "An openvswitch peer port sequence must have exactly two entries");
+        }
+
+        port = yaml_document_get_node(doc, *item);
+        assert_type(port, YAML_SCALAR_NODE);
+        peer = yaml_document_get_node(doc, *(item+1));
+        assert_type(peer, YAML_SCALAR_NODE);
+
+        /* Create port 1 netdef */
+        component = g_hash_table_lookup(netdefs, scalar(port));
+        if (!component) {
+            component = netplan_netdef_new(scalar(port), NETPLAN_DEF_TYPE_PORT, NETPLAN_BACKEND_OVS);
+            if (g_hash_table_remove(missing_id, scalar(port)))
+                missing_ids_found++;
+        }
+
+        if (component->peer && g_strcmp0(component->peer, scalar(peer)))
+            return yaml_error(port, error, "openvswitch port '%s' is already assigned to peer '%s'",
+                              component->id, component->peer);
+        component->peer = g_strdup(scalar(peer));
+
+        /* Create port 2 (peer) netdef */
+        component = NULL;
+        component = g_hash_table_lookup(netdefs, scalar(peer));
+        if (!component) {
+            component = netplan_netdef_new(scalar(peer), NETPLAN_DEF_TYPE_PORT, NETPLAN_BACKEND_OVS);
+            if (g_hash_table_remove(missing_id, scalar(peer)))
+                missing_ids_found++;
+        }
+
+        if (component->peer && g_strcmp0(component->peer, scalar(port)))
+            return yaml_error(peer, error, "openvswitch port '%s' is already assigned to peer '%s'",
+                              component->id, component->peer);
+        component->peer = g_strdup(scalar(port));
+    }
+    return TRUE;
 }
 
 /**
- * Callback for a net device type entry like "ethernets:" in "networks:"
+ * Callback for a net device type entry like "ethernets:" in "network:"
  * @data: netdef_type (as pointer)
  */
 static gboolean
@@ -1869,27 +2382,7 @@ handle_network_type(yaml_document_t* doc, yaml_node_t* node, const void* data, G
             if (cur_netdef->type != GPOINTER_TO_UINT(data))
                 return yaml_error(key, error, "Updated definition '%s' changes device type", scalar(key));
         } else {
-            /* create new network definition */
-            cur_netdef = g_new0(NetplanNetDefinition, 1);
-            cur_netdef->type = GPOINTER_TO_UINT(data);
-            cur_netdef->backend = backend_cur_type ?: NETPLAN_BACKEND_NONE;
-            cur_netdef->id = g_strdup(scalar(key));
-
-            /* Set some default values */
-            cur_netdef->vlan_id = G_MAXUINT; /* 0 is a valid ID */
-            cur_netdef->tunnel.mode = NETPLAN_TUNNEL_MODE_UNKNOWN;
-            cur_netdef->dhcp_identifier = g_strdup("duid"); /* keep networkd's default */
-            /* systemd-networkd defaults to IPv6 LL enabled; keep that default */
-            cur_netdef->linklocal.ipv6 = TRUE;
-            g_hash_table_insert(netdefs, cur_netdef->id, cur_netdef);
-            netdefs_ordered = g_list_append(netdefs_ordered, cur_netdef);
-            cur_netdef->sriov_vlan_filter = FALSE;
-
-            /* DHCP override defaults */
-            initialize_dhcp_overrides(&cur_netdef->dhcp4_overrides);
-            initialize_dhcp_overrides(&cur_netdef->dhcp6_overrides);
-
-            g_hash_table_insert(netdefs, cur_netdef->id, cur_netdef);
+            netplan_netdef_new(scalar(key), GPOINTER_TO_UINT(data), backend_cur_type);
         }
 
         // XXX: breaks multi-pass parsing.
@@ -1907,7 +2400,7 @@ handle_network_type(yaml_document_t* doc, yaml_node_t* node, const void* data, G
             case NETPLAN_DEF_TYPE_WIFI: handlers = wifi_def_handlers; break;
             default: g_assert_not_reached(); // LCOV_EXCL_LINE
         }
-        if (!process_mapping(doc, value, handlers, error))
+        if (!process_mapping(doc, value, handlers, NULL, error))
             return FALSE;
 
         /* validate definition-level conditions */
@@ -1923,6 +2416,34 @@ handle_network_type(yaml_document_t* doc, yaml_node_t* node, const void* data, G
     return TRUE;
 }
 
+static const mapping_entry_handler ovs_global_ssl_handlers[] = {
+    {"ca-cert", YAML_SCALAR_NODE, handle_auth_str, NULL, auth_offset(ca_certificate)},
+    {"certificate", YAML_SCALAR_NODE, handle_auth_str, NULL, auth_offset(client_certificate)},
+    {"private-key", YAML_SCALAR_NODE, handle_auth_str, NULL, auth_offset(client_key)},
+    {NULL}
+};
+
+static gboolean
+handle_ovs_global_ssl(yaml_document_t* doc, yaml_node_t* node, const void* _, GError** error)
+{
+    gboolean ret;
+
+    cur_auth = &(ovs_settings_global.ssl);
+    ret = process_mapping(doc, node, ovs_global_ssl_handlers, NULL, error);
+    cur_auth = NULL;
+
+    return ret;
+}
+
+static const mapping_entry_handler ovs_network_settings_handlers[] = {
+    {"external-ids", YAML_MAPPING_NODE, handle_network_ovs_settings_global, NULL, ovs_settings_offset(external_ids)},
+    {"other-config", YAML_MAPPING_NODE, handle_network_ovs_settings_global, NULL, ovs_settings_offset(other_config)},
+    {"protocols", YAML_SEQUENCE_NODE, handle_network_ovs_settings_global_protocol, NULL, ovs_settings_offset(protocols)},
+    {"ports", YAML_SEQUENCE_NODE, handle_network_ovs_settings_global_ports},
+    {"ssl", YAML_MAPPING_NODE, handle_ovs_global_ssl},
+    {NULL}
+};
+
 static const mapping_entry_handler network_handlers[] = {
     {"bonds", YAML_MAPPING_NODE, handle_network_type, NULL, GUINT_TO_POINTER(NETPLAN_DEF_TYPE_BOND)},
     {"bridges", YAML_MAPPING_NODE, handle_network_type, NULL, GUINT_TO_POINTER(NETPLAN_DEF_TYPE_BRIDGE)},
@@ -1933,6 +2454,7 @@ static const mapping_entry_handler network_handlers[] = {
     {"vlans", YAML_MAPPING_NODE, handle_network_type, NULL, GUINT_TO_POINTER(NETPLAN_DEF_TYPE_VLAN)},
     {"wifis", YAML_MAPPING_NODE, handle_network_type, NULL, GUINT_TO_POINTER(NETPLAN_DEF_TYPE_WIFI)},
     {"modems", YAML_MAPPING_NODE, handle_network_type, NULL, GUINT_TO_POINTER(NETPLAN_DEF_TYPE_MODEM)},
+    {"openvswitch", YAML_MAPPING_NODE, NULL, ovs_network_settings_handlers},
     {NULL}
 };
 
@@ -1966,7 +2488,7 @@ process_document(yaml_document_t* doc, GError** error)
 
         g_clear_error(error);
 
-        ret = process_mapping(doc, yaml_document_get_root_node(doc), root_handlers, error);
+        ret = process_mapping(doc, yaml_document_get_root_node(doc), root_handlers, NULL, error);
 
         still_missing = g_hash_table_size(missing_id);
 
diff --git a/src/parse.h b/src/parse.h
index b84ff4c..9f57bb4 100644
--- a/src/parse.h
+++ b/src/parse.h
@@ -25,14 +25,14 @@
 
 
 /* file that is currently being processed, for useful error messages */
-const char* current_file;
+extern const char* current_file;
 
 /* List of "seen" ids not found in netdefs yet by the parser.
  * These are removed when it exists in this list and we reach the point of
  * creating a netdef for that id; so by the time we're done parsing the yaml
  * document it should be empty. */
-GHashTable *missing_id;
-int missing_ids_found;
+extern GHashTable *missing_id;
+extern int missing_ids_found;
 
 /****************************************************
  * Parsed definitions
@@ -50,12 +50,14 @@ typedef enum {
     NETPLAN_DEF_TYPE_BOND,
     NETPLAN_DEF_TYPE_VLAN,
     NETPLAN_DEF_TYPE_TUNNEL,
+    NETPLAN_DEF_TYPE_PORT,
 } NetplanDefType;
 
 typedef enum {
     NETPLAN_BACKEND_NONE,
     NETPLAN_BACKEND_NETWORKD,
     NETPLAN_BACKEND_NM,
+    NETPLAN_BACKEND_OVS,
     NETPLAN_BACKEND_MAX_,
 } NetplanBackend;
 
@@ -63,6 +65,7 @@ static const char* const netplan_backend_to_name[NETPLAN_BACKEND_MAX_] = {
         [NETPLAN_BACKEND_NONE] = "none",
         [NETPLAN_BACKEND_NETWORKD] = "networkd",
         [NETPLAN_BACKEND_NM] = "NetworkManager",
+        [NETPLAN_BACKEND_OVS] = "OpenVSwitch",
 };
 
 typedef enum {
@@ -111,6 +114,7 @@ typedef enum {
     /* systemd-only, apparently? */
     NETPLAN_TUNNEL_MODE_GRETAP      = 101,
     NETPLAN_TUNNEL_MODE_IP6GRETAP   = 102,
+    NETPLAN_TUNNEL_MODE_WIREGUARD   = 103,
 
     NETPLAN_TUNNEL_MODE_MAX_,
 } NetplanTunnelMode;
@@ -130,6 +134,7 @@ netplan_tunnel_mode_table[NETPLAN_TUNNEL_MODE_MAX_] = {
 
     [NETPLAN_TUNNEL_MODE_GRETAP] = "gretap",
     [NETPLAN_TUNNEL_MODE_IP6GRETAP] = "ip6gretap",
+    [NETPLAN_TUNNEL_MODE_WIREGUARD] = "wireguard",
 };
 
 typedef enum {
@@ -196,6 +201,23 @@ typedef struct dhcp_overrides {
     guint metric;
 } NetplanDHCPOverrides;
 
+typedef struct ovs_controller {
+    char* connection_mode;
+    GArray* addresses;
+} NetplanOVSController;
+
+typedef struct ovs_settings {
+    GHashTable* external_ids;
+    GHashTable* other_config;
+    char* lacp;
+    char* fail_mode;
+    gboolean mcast_snooping;
+    GArray* protocols;
+    gboolean rstp;
+    NetplanOVSController controller;
+    NetplanAuthenticationSettings ssl;
+} NetplanOVSSettings;
+
 /**
  * Represent a configuration stanza
  */
@@ -225,8 +247,10 @@ struct net_definition {
     NetplanRAMode accept_ra;
     GArray* ip4_addresses;
     GArray* ip6_addresses;
+    GArray* address_options;
     gboolean ip6_privacy;
     guint ip6_addr_gen_mode;
+    char* ip6_addr_gen_token;
     char* gateway4;
     char* gateway6;
     GArray* ip4_nameservers;
@@ -234,6 +258,7 @@ struct net_definition {
     GArray* search_domains;
     GArray* routes;
     GArray* ip_rules;
+    GArray* wireguard_peers;
     struct {
         gboolean ipv4;
         gboolean ipv6;
@@ -243,6 +268,9 @@ struct net_definition {
     char* bridge;
     char* bond;
 
+    /* peer ID for OVS patch ports */
+    char* peer;
+
     /* vlan */
     guint vlan_id;
     NetplanNetDefinition* vlan_link;
@@ -269,7 +297,6 @@ struct net_definition {
     NetplanWifiWowlanFlag wowlan;
     gboolean emit_lldp;
 
-
     /* these properties are only valid for NETPLAN_DEF_TYPE_WIFI */
     GHashTable* access_points; /* SSID → NetplanWifiAccessPoint* */
 
@@ -297,6 +324,7 @@ struct net_definition {
         char* primary_slave;
     } bond_params;
 
+    /* netplan-feature: modems */
     struct {
         char* apn;
         gboolean auto_config;
@@ -328,16 +356,24 @@ struct net_definition {
         char *remote_ip;
         char *input_key;
         char *output_key;
+        char *private_key; /* used for wireguard */
+        guint fwmark;
+        guint port;
     } tunnel;
 
     NetplanAuthenticationSettings auth;
     gboolean has_auth;
 
     /* these properties are only valid for SR-IOV NICs */
+    /* netplan-feature: sriov */
     struct net_definition* sriov_link;
     gboolean sriov_vlan_filter;
     guint sriov_explicit_vf_count;
 
+    /* these properties are only valid for OpenVSwitch */
+    /* netplan-feature: openvswitch */
+    NetplanOVSSettings ovs_settings;
+
     union {
         struct NetplanNMSettings {
             char *name;
@@ -357,6 +393,14 @@ typedef enum {
     NETPLAN_WIFI_MODE_AP
 } NetplanWifiMode;
 
+typedef struct {
+    char *endpoint;
+    char *public_key;
+    char *preshared_key;
+    GArray *allowed_ips;
+    guint keepalive;
+} NetplanWireguardPeer;
+
 typedef enum {
     NETPLAN_WIFI_BAND_DEFAULT,
     NETPLAN_WIFI_BAND_5,
@@ -364,10 +408,17 @@ typedef enum {
 } NetplanWifiBand;
 
 typedef struct {
+    char* address;
+    char* lifetime;
+    char* label;
+} NetplanAddressOptions;
+
+typedef struct {
     NetplanWifiMode mode;
     char* ssid;
     NetplanWifiBand band;
     char* bssid;
+    gboolean hidden;
     guint channel;
 
     NetplanAuthenticationSettings auth;
@@ -415,6 +466,7 @@ typedef struct {
 /* Written/updated by parse_yaml(): char* id →  net_definition */
 extern GHashTable* netdefs;
 extern GList* netdefs_ordered;
+extern NetplanOVSSettings ovs_settings_global;
 
 /****************************************************
  * Functions
diff --git a/src/sriov.c b/src/sriov.c
new file mode 100644
index 0000000..60f9800
--- /dev/null
+++ b/src/sriov.c
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2020 Canonical, Ltd.
+ * Author: Łukasz 'sil2100' Zemczak <[e-mail]>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 3.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <unistd.h>
+
+#include <glib.h>
+#include <glib/gstdio.h>
+#include <glib-object.h>
+
+#include "util.h"
+
+void
+write_sriov_conf_finish(const char* rootdir)
+{
+    /* For now we execute apply --sriov-only everytime there is a new
+       SR-IOV device appearing, which is fine as it's relatively fast */
+    GString *udev_rule = g_string_new("ACTION==\"add\", SUBSYSTEM==\"net\", ATTRS{sriov_totalvfs}==\"?*\", RUN+=\"/usr/sbin/netplan apply --sriov-only\"\n");
+    g_string_free_to_file(udev_rule, rootdir, "run/udev/rules.d/99-sriov-netplan-setup.rules", NULL);
+}
+
+void
+cleanup_sriov_conf(const char* rootdir)
+{
+    g_autofree char* rulepath = g_strjoin(NULL, rootdir ?: "", "/run/udev/rules.d/99-sriov-netplan-setup.rules", NULL);
+    unlink(rulepath);
+}
diff --git a/src/sriov.h b/src/sriov.h
new file mode 100644
index 0000000..7cd5896
--- /dev/null
+++ b/src/sriov.h
@@ -0,0 +1,21 @@
+/*
+ * Copyright (C) 2020 Canonical, Ltd.
+ * Author: Łukasz 'sil2100' Zemczak <[e-mail]>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 3.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#pragma once
+
+void write_sriov_conf_finish(const char* rootdir);
+void cleanup_sriov_conf(const char* rootdir);
diff --git a/src/util.c b/src/util.c
index 4b71ef1..edd2969 100644
--- a/src/util.c
+++ b/src/util.c
@@ -24,6 +24,9 @@
 
 #include "util.h"
 
+GHashTable* wifi_frequency_24;
+GHashTable* wifi_frequency_5;
+
 /**
  * Create the parent directories of given file path. Exit program on failure.
  */
@@ -148,3 +151,29 @@ wifi_get_freq5(int channel)
     return GPOINTER_TO_INT(g_hash_table_lookup(wifi_frequency_5,
                            GINT_TO_POINTER(channel)));
 }
+
+/**
+ * Systemd-escape the given string. The caller is responsible for freeing
+ * the allocated escaped string.
+ */
+gchar*
+systemd_escape(char* string)
+{
+    g_autoptr(GError) err = NULL;
+    g_autofree gchar* stderrh = NULL;
+    gint exit_status = 0;
+    gchar *escaped;
+
+    gchar *argv[] = {"bin" "/" "systemd-escape", string, NULL};
+    g_spawn_sync("/", argv, NULL, 0, NULL, NULL, &escaped, &stderrh, &exit_status, &err);
+    g_spawn_check_exit_status(exit_status, &err);
+    if (err != NULL) {
+        // LCOV_EXCL_START
+        g_fprintf(stderr, "failed to ask systemd to escape %s; exit %d\nstdout: '%s'\nstderr: '%s'", string, exit_status, escaped, stderrh);
+        exit(1);
+        // LCOV_EXCL_STOP
+    }
+    g_strstrip(escaped);
+
+    return escaped;
+}
diff --git a/src/util.h b/src/util.h
index 4ed1a60..ef6671b 100644
--- a/src/util.h
+++ b/src/util.h
@@ -17,8 +17,8 @@
 
 #pragma once
 
-GHashTable* wifi_frequency_24;
-GHashTable* wifi_frequency_5;
+extern GHashTable* wifi_frequency_24;
+extern GHashTable* wifi_frequency_5;
 
 void safe_mkdir_p_dir(const char* file_path);
 void g_string_free_to_file(GString* s, const char* rootdir, const char* path, const char* suffix);
@@ -26,3 +26,7 @@ void unlink_glob(const char* rootdir, const char* _glob);
 
 int wifi_get_freq24(int channel);
 int wifi_get_freq5(int channel);
+
+gchar* systemd_escape(char* string);
+
+#define OPENVSWITCH_OVS_VSCTL "/usr/bin/ovs-vsctl"
diff --git a/src/validation.c b/src/validation.c
index ad08988..12a0231 100644
--- a/src/validation.c
+++ b/src/validation.c
@@ -25,6 +25,7 @@
 
 #include "parse.h"
 #include "error.h"
+#include "util.h"
 
 
 /* Check sanity for address types */
@@ -57,15 +58,148 @@ is_ip6_address(const char* address)
     return FALSE;
 }
 
+gboolean
+is_hostname(const char *hostname)
+{
+    static const gchar *pattern = "^(([a-z0-9]|[a-z0-9][a-z0-9\\-]*[a-z0-9])\\.)*([a-z0-9]|[a-z0-9][a-z0-9\\-]*[a-z0-9])$";
+    return g_regex_match_simple(pattern, hostname, G_REGEX_CASELESS, G_REGEX_MATCH_NOTEMPTY);
+}
+
+gboolean
+is_wireguard_key(const char* key)
+{
+    /* Check if this is (most likely) a 265bit, base64 encoded wireguard key */
+    if (strlen(key) == 44 && key[43] == '=' && key[42] != '=') {
+        static const gchar *pattern = "^(?:[A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{3}=)+$";
+        return g_regex_match_simple(pattern, key, 0, G_REGEX_MATCH_NOTEMPTY);
+    }
+    return FALSE;
+}
+
+/* Check sanity of OpenVSwitch controller targets */
+gboolean
+validate_ovs_target(gboolean host_first, gchar* s) {
+    static guint dport = 6653; // the default port
+    g_autofree gchar* host = NULL;
+    g_autofree gchar* port = NULL;
+    gchar** vec = NULL;
+
+    /* Format tcp:host[:port] or ssl:host[:port] */
+    if (host_first) {
+        g_assert(s != NULL);
+        // IP6 host, indicated by bracketed notation ([..IPv6..])
+        if (s[0] == '[') {
+            gchar* tmp = NULL;
+            tmp = s+1; //get rid of leading '['
+            // append default port to unify parsing
+            if (!g_strrstr(tmp, "]:"))
+                vec = g_strsplit(g_strdup_printf("%s:%u", tmp, dport), "]:", 2);
+            else
+                vec = g_strsplit(tmp, "]:", 2);
+        // IP4 host
+        } else {
+            // append default port to unify parsing
+            if (!g_strrstr(s, ":"))
+                vec = g_strsplit(g_strdup_printf("%s:%u", s, dport), ":", 2);
+            else
+                vec = g_strsplit(s, ":", 2);
+        }
+        // host and port are always set
+        host = g_strdup(vec[0]); //set host alias
+        port = g_strdup(vec[1]); //set port alias
+        g_assert(vec[2] == NULL);
+        g_strfreev(vec);
+    /* Format ptcp:[port][:host] or pssl:[port][:host] */
+    } else {
+        // special case: "ptcp:" (no port, no host)
+        if (!g_strcmp0(s, ""))
+            port = g_strdup_printf("%u", dport);
+        else {
+            vec = g_strsplit(s, ":", 2);
+            port = g_strdup(vec[0]);
+            host = g_strdup(vec[1]);
+            // get rid of leading & trailing IPv6 brackets
+            if (host && host[0] == '[') {
+                char **split = g_strsplit_set(host, "[]", 3);
+                g_free(host);
+                host = g_strjoinv("", split);
+                g_strfreev(split);
+            }
+            g_strfreev(vec);
+        }
+    }
+
+    g_assert(port != NULL);
+    // special case where IPv6 notation contains '%iface' name
+    if (host && g_strrstr(host, "%")) {
+        gchar** split = g_strsplit (host, "%", 2);
+        g_free(host);
+        host = g_strdup(split[0]); // designated scope for IPv6 link-level addresses
+        g_assert(split[1] != NULL && split[2] == NULL);
+        g_strfreev(split);
+    }
+
+    if (atoi(port) > 0 && atoi(port) <= 65535) {
+        if (!host)
+            return TRUE;
+        else if (host && (is_ip4_address(host) || is_ip6_address(host)))
+            return TRUE;
+    }
+    return FALSE;
+}
+
 /************************************************
  * Validation for grammar and backend rules.
  ************************************************/
 static gboolean
+validate_tunnel_key(yaml_node_t* node, gchar* key, GError** error)
+{
+    /* Tunnel key should be a number or dotted quad, except for wireguard. */
+    gchar* endptr;
+    guint64 v = g_ascii_strtoull(key, &endptr, 10);
+    if (*endptr != '\0' || v > G_MAXUINT) {
+        /* Not a simple uint, try for a dotted quad */
+        if (!is_ip4_address(key))
+            return yaml_error(node, error, "invalid tunnel key '%s'", key);
+    }
+    return TRUE;
+}
+
+static gboolean
 validate_tunnel_grammar(NetplanNetDefinition* nd, yaml_node_t* node, GError** error)
 {
     if (nd->tunnel.mode == NETPLAN_TUNNEL_MODE_UNKNOWN)
         return yaml_error(node, error, "%s: missing 'mode' property for tunnel", nd->id);
 
+    if (nd->tunnel.mode == NETPLAN_TUNNEL_MODE_WIREGUARD) {
+        if (!nd->tunnel.private_key)
+            return yaml_error(node, error, "%s: missing 'key' property (private key) for wireguard", nd->id);
+        if (nd->tunnel.private_key[0] != '/' && !is_wireguard_key(nd->tunnel.private_key))
+            return yaml_error(node, error, "%s: invalid wireguard private key", nd->id);
+        if (!nd->wireguard_peers || nd->wireguard_peers->len == 0)
+            return yaml_error(node, error, "%s: at least one peer is required.", nd->id);
+        for (guint i = 0; i < nd->wireguard_peers->len; i++) {
+            NetplanWireguardPeer *peer = g_array_index (nd->wireguard_peers, NetplanWireguardPeer*, i);
+
+            if (!peer->public_key)
+                return yaml_error(node, error, "%s: keys.public is required.", nd->id);
+            if (!is_wireguard_key(peer->public_key))
+                return yaml_error(node, error, "%s: invalid wireguard public key", nd->id);
+            if (peer->preshared_key && peer->preshared_key[0] != '/' && !is_wireguard_key(peer->preshared_key))
+                return yaml_error(node, error, "%s: invalid wireguard shared key", nd->id);
+            if (!peer->allowed_ips || peer->allowed_ips->len == 0)
+                return yaml_error(node, error, "%s: 'to' is required to define the allowed IPs.", nd->id);
+            if (peer->keepalive > 65535)
+                return yaml_error(node, error, "%s: keepalive must be 0-65535 inclusive.", nd->id);
+        }
+        return TRUE;
+    } else {
+        if (nd->tunnel.input_key && !validate_tunnel_key(node, nd->tunnel.input_key, error))
+            return FALSE;
+        if (nd->tunnel.output_key && !validate_tunnel_key(node, nd->tunnel.output_key, error))
+            return FALSE;
+    }
+
     /* Validate local/remote IPs */
     if (!nd->tunnel.local_ip)
         return yaml_error(node, error, "%s: missing 'local' property for tunnel", nd->id);
@@ -104,6 +238,7 @@ validate_tunnel_backend_rules(NetplanNetDefinition* nd, yaml_node_t* node, GErro
             switch (nd->tunnel.mode) {
                 case NETPLAN_TUNNEL_MODE_VTI:
                 case NETPLAN_TUNNEL_MODE_VTI6:
+                case NETPLAN_TUNNEL_MODE_WIREGUARD:
                     break;
 
                 /* TODO: Remove this exception and fix ISATAP handling with the
@@ -112,9 +247,9 @@ validate_tunnel_backend_rules(NetplanNetDefinition* nd, yaml_node_t* node, GErro
                  */
                 case NETPLAN_TUNNEL_MODE_ISATAP:
                     return yaml_error(node, error,
-                                    "%s: %s tunnel mode is not supported by networkd",
-                                    nd->id,
-                                    g_ascii_strup(tunnel_mode_to_string(nd->tunnel.mode), -1));
+                                      "%s: %s tunnel mode is not supported by networkd",
+                                      nd->id,
+                                      g_ascii_strup(tunnel_mode_to_string(nd->tunnel.mode), -1));
                     break;
 
                 default:
@@ -130,14 +265,15 @@ validate_tunnel_backend_rules(NetplanNetDefinition* nd, yaml_node_t* node, GErro
             switch (nd->tunnel.mode) {
                 case NETPLAN_TUNNEL_MODE_GRE:
                 case NETPLAN_TUNNEL_MODE_IP6GRE:
+                case NETPLAN_TUNNEL_MODE_WIREGUARD:
                     break;
 
                 case NETPLAN_TUNNEL_MODE_GRETAP:
                 case NETPLAN_TUNNEL_MODE_IP6GRETAP:
                     return yaml_error(node, error,
-                                    "%s: %s tunnel mode is not supported by NetworkManager",
-                                    nd->id,
-                                    g_ascii_strup(tunnel_mode_to_string(nd->tunnel.mode), -1));
+                                      "%s: %s tunnel mode is not supported by NetworkManager",
+                                      nd->id,
+                                      g_ascii_strup(tunnel_mode_to_string(nd->tunnel.mode), -1));
                     break;
 
                 default:
@@ -149,10 +285,7 @@ validate_tunnel_backend_rules(NetplanNetDefinition* nd, yaml_node_t* node, GErro
             }
             break;
 
-        // LCOV_EXCL_START
-        default:
-            break;
-        // LCOV_EXCL_STOP
+        default: break; //LCOV_EXCL_LINE
     }
 
     return TRUE;
@@ -195,6 +328,18 @@ validate_netdef_grammar(NetplanNetDefinition* nd, yaml_node_t* node, GError** er
             goto netdef_grammar_error;
     }
 
+    if (nd->ip6_addr_gen_mode != NETPLAN_ADDRGEN_DEFAULT && nd->ip6_addr_gen_token)
+        return yaml_error(node, error, "%s: ipv6-address-generation and ipv6-address-token are mutually exclusive", nd->id);
+
+    if (nd->backend == NETPLAN_BACKEND_OVS) {
+        // LCOV_EXCL_START
+        if (!g_file_test(OPENVSWITCH_OVS_VSCTL, G_FILE_TEST_EXISTS)) {
+            /* Tested via integration test */